summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-07-22mm/mm_init: remove redundant memset in free_area_init()Sang-Heon Jeon
zone_movable_pfn is zero-initialized and only set by find_zone_movable_pfns_for_nodes(), which runs once during boot right after the memset, so the memset has no effect. Remove redundant memset. No functional change. Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com> Link: https://patch.msgid.link/20260720150915.756749-1-ekffu200098@gmail.com Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-07-22drm/i915/dp: set VSC_SDP MSA delegation only for capable sinksChaitanya Kumar Borah
Per DP 1.4a section 2.2.4.3, the MSA MISC1 VSC_SDP bit signals that the sink should defer colorimetry to the VSC SDP. It should only be set when the sink advertises DP_VSC_SDP_EXT_FOR_COLORIMETRY_SUPPORTED and a VSC SDP with pixel encoding/colorimetry payload will actually be sent. Fold the colorimetry_support check into intel_dp_needs_vsc_colorimetry() so both intel_ddi_set_dp_msa() and intel_dp_compute_vsc_sdp() share a single consistent gate. Assisted-by: GitHub_Copilot:claude-sonnet-4.6 Signed-off-by: Chaitanya Kumar Borah <chaitanya.kumar.borah@intel.com> Reviewed-by: Pranay Samala <pranay.samala@intel.com> Link: https://patch.msgid.link/20260709113951.3557968-3-chaitanya.kumar.borah@intel.com
2026-07-22drm/i915/dp: s/intel_dp_needs_vsc_sdp/intel_dp_needs_vsc_colorimetryChaitanya Kumar Borah
The function answers whether a VSC SDP with colorimetry and pixel encoding payload is required by the content being displayed. Rename it to reflect that. No functional change intended. Assisted-by: GitHub_Copilot:claude-sonnet-4.6 Signed-off-by: Chaitanya Kumar Borah <chaitanya.kumar.borah@intel.com> Reviewed-by: Pranay Samala <pranay.samala@intel.com> Link: https://patch.msgid.link/20260709113951.3557968-2-chaitanya.kumar.borah@intel.com
2026-07-22phy: lynx-10g: fix lynx_10g_pccr_val_enabled()Vladimir Oltean
The intention of the code is to extract the PCCR8_SGMIIa_CFG field out of the "pccr" value, not to create a new value with the PCCR8_SGMIIa_CFG field set to the "pccr" value. Since FIELD_GET() is implemented as ((reg) & (mask)) >> __bf_shf(mask) and FIELD_PREP() as (val) << __bf_shf(mask)) & (mask) and since "mask" is GENMASK(2, 0), in practice there is no functional difference between FIELD_GET() and FIELD_PREP(). But FIELD_GET() is logically the correct helper. Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com> Link: https://patch.msgid.link/20260612125731.133330-1-vladimir.oltean@nxp.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-07-22drm/pagemap: Guard HPAGE_PMD_ORDER use with CONFIG_ARCH_ENABLE_THP_MIGRATIONMatthew Brost
HPAGE_PMD_SHIFT expands to BUILD_BUG() when CONFIG_PGTABLE_HAS_HUGE_LEAVES is not set, causing a compile error when both CONFIG_TRANSPARENT_HUGEPAGE and CONFIG_HUGETLB_PAGE are disabled: drivers/gpu/drm/drm_pagemap.c:480:12: error: call to '__compiletime_assert_458' declared with 'error' attribute: BUILD_BUG failed 480 | order = HPAGE_PMD_ORDER; | ^ include/linux/huge_mm.h:117:26: note: expanded from macro 'HPAGE_PMD_ORDER' 117 | #define HPAGE_PMD_ORDER (HPAGE_PMD_SHIFT-PAGE_SHIFT) | ^ include/linux/huge_mm.h:113:28: note: expanded from macro 'HPAGE_PMD_SHIFT' 113 | #define HPAGE_PMD_SHIFT ({ BUILD_BUG(); 0; }) Define DRM_PAGEMAP_PMD_ORDER, which maps to HPAGE_PMD_ORDER when CONFIG_ARCH_ENABLE_THP_MIGRATION is enabled and to -1 otherwise. This is safe because all code paths that use DRM_PAGEMAP_PMD_ORDER are reachable only when CONFIG_ARCH_ENABLE_THP_MIGRATION is enabled. Fixes: 139ab31aea8a ("drm/pagemap: Correct cpages calculation for migrate_vma_setup") Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/r/202607201914.LpAGsbXs-lkp@intel.com/ Cc: Jan Stancek <jstancek@redhat.com> Cc: stable@vger.kernel.org Signed-off-by: Matthew Brost <matthew.brost@intel.com> Tested-by: Jan Stancek <jstancek@redhat.com> Reviewed-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com> Link: https://patch.msgid.link/20260721223244.1102276-1-matthew.brost@intel.com
2026-07-22drm/pagemap: Clear driver-provided PFNs from migration PFN arrayMatthew Brost
DRM pagemap overloads the migration PFN array to store driver-provided PFNs before calling migrate_vma_*() to finalize the migration. If an error occurs during the incremental copy phase, the migration PFN entries are reverted to their original state. After reverting the device-folio mutations, clear any remaining driver-provided PFNs to avoid confusing the migrate_vma_*() helpers. Also clear any driver-provided PFNs if populate_devmem_pfn() fails, as a precaution against stale entries being interpreted as migration PFNs. Reported-by: Sashiko <sashiko-bot@kernel.org> Fixes: 3902846af36b ("drm/pagemap Fix error paths in drm_pagemap_migrate_to_devmem") Fixes: ec265e1f1cfc ("drm/pagemap: Support source migration over interconnect") Cc: stable@vger.kernel.org Signed-off-by: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com> Link: https://patch.msgid.link/20260721204353.1082632-1-matthew.brost@intel.com
2026-07-22PCI: j721e: Fix incorrect max_lanes for J7200Takuma Fujiwara
The PCIe Controller in the J7200 SoC supports a 4-lane configuration. However, j7200_pcie_rc_data and j7200_pcie_ep_data incorrectly set .max_lanes = 2, limiting operation to fewer lanes than the hardware supports. Set .max_lanes = 4 for both j7200_pcie_rc_data and j7200_pcie_ep_data to match the hardware capability. See J7200 Technical Reference Manual (SPRUIU1D), section 12.2.3.1.1 for further details: https://www.ti.com/lit/pdf/spruiu1d Fixes: 3ac7f14084f5 ("PCI: j721e: Add per platform maximum lane settings") Signed-off-by: Takuma Fujiwara <t-fujiwara1@ti.com> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Reviewed-by: Siddharth Vadapalli <s-vadapalli@ti.com> Link: https://patch.msgid.link/20260721155743.3347659-1-t-fujiwara1@ti.com
2026-07-22drm/i915/display: Ensure a non-zero safe window from PTL onwardsAnkit Nautiyal
From PTL onwards, the set context latency can be in the vactive region, letting the safe window start some lines before the vblank start. The DSB waits on this safe window instead of vblank (bits [15:14] select the safe window signal from the DPT unit to start the DMA engine). With modes that have a smaller vblank region, the computed guardband is clamped to the vblank length, making the undelayed and delayed vblank coincide. If the SCL is also 0, the 'safe window' becomes effectively 0, and the DSB configured to wait for it gets stalled, since the hardware never signals the safe window, leading to: *ERROR* [CRTC:159:pipe A] flip_done timed out *ERROR* [CRTC:159:pipe A] DSB 0 timed out waiting for idle Keep the set context latency at a minimum of 1 to avoid this. v2: Fix the bit numbers and correct the commit message. (Chaitanya) Fixes: 4a68c7516c57 ("drm/i915/dsb: Use safe window path when VRR TG is used") Cc: Ville Syrjälä <ville.syrjala@linux.intel.com> Signed-off-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Assisted-by: GitHub-Copilot:Claude-Opus-4.8 Reviewed-by: Chaitanya Kumar Borah <chaitanya.kumar.borah@intel.com> Link: https://patch.msgid.link/20260722062449.1166411-1-ankit.k.nautiyal@intel.com
2026-07-22drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffersSatyanarayana K V P
CCS read/write buffers are freed during BO destruction. In some cases, BOs may be destroyed after the device is unbound but while the DRM structure remains valid, leading to NULL pointer dereferences when accessing device resources. BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 0 UID: 0 PID: 9376 Comm: xe_pat Not tainted 7.2.0-rc2+ #1 PREEMPT(lazy) RIP: 0010:xe_sriov_vf_ccs_rw_update_bb_addr+0x4d/0xa0 [xe] RSP: 0018:ffffcf304110b9c8 EFLAGS: 00010246 RAX: ffff8a85c38a0a00 RBX: 00000000810ef000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8a85c39c1888 RBP: ffffcf304110b9e8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8a85c39c1888 R13: 0000000000000000 R14: ffff8a85c39b4f28 R15: ffff8a85c3885000 FS: 0000000000000000(0000) GS:ffff8a878b809000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000010314a002 CR4: 0000000000772ef0 PKRU: 55555554 Call Trace: <TASK> xe_migrate_ccs_rw_copy_clear+0x98/0x120 [xe] xe_sriov_vf_ccs_detach_bo+0x2c/0x60 [xe] xe_ttm_bo_delete_mem_notify+0xc8/0xe0 [xe] ttm_bo_cleanup_memtype_use+0x26/0x80 [ttm] ttm_bo_release+0x29e/0x2d0 [ttm] ttm_bo_fini+0x39/0x70 [ttm] xe_gem_object_free+0x1f/0x30 [xe] drm_gem_object_free+0x1d/0x40 ttm_bo_vm_close+0x5f/0x90 [ttm] remove_vma+0x2c/0x70 tear_down_vmas+0x63/0xf0 exit_mmap+0x20d/0x3f0 __mmput+0x45/0x170 mmput+0x31/0x40 do_exit+0x2ba/0xac0 do_group_exit+0x2d/0xb0 __x64_sys_exit_group+0x18/0x20 x64_sys_call+0x14a0/0x2390 do_syscall_64+0xdd/0x640 ? count_memcg_events+0xea/0x240 ? handle_mm_fault+0x1ec/0x2f0 Fixes: 864690cf4dd6 ("drm/xe/vf: Attach and detach CCS copy commands with BO") Signed-off-by: Satyanarayana K V P <satyanarayana.k.v.p@intel.com> Cc: Matthew Brost <matthew.brost@intel.com> Cc: Michal Wajdeczko <michal.wajdeczko@intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Signed-off-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260721052215.2267228-2-satyanarayana.k.v.p@intel.com (cherry picked from commit 1ae415a6eefe5004954a1d352b1718faca8844ef) Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2026-07-22ARM: dts: aspeed: sanmiguel: Fix PWRGD_RMC_N active-low hog configurationPotin Lai
GPIO 14 on the fio_ioexp (pca9555) controller corresponds to the PWRGD_RMC_N signal, which is active-low. The pwrgd-rmc-hog node currently specifies output-low for this GPIO with GPIO_ACTIVE_LOW flags. Under Linux gpiolib, configuring an active-low GPIO hog with output-low sets the logical value to inactive (0), causing the subsystem to drive the physical line high. Correct the hog configuration to output-high, which sets the logical value to active (1), driving the physical pin low on boot as intended. [arj: tidy subject line] Signed-off-by: Potin Lai <potin.lai.pt@gmail.com> Link: https://patch.msgid.link/20260716-upstream-sanmiguel-fix-pwrgd-rmc-n-v1-1-8287b306e02a@gmail.com Signed-off-by: Andrew Jeffery <andrew@codeconstruct.com.au>
2026-07-22drm/i915/hdcp: Make hdcp2_encrypted and hdcp_encrypted mutually exclusiveSuraj Kandpal
With introduction of force_hdcp14 we can now for HDCP 1.4 by passing HDCP 2.2 authentication but In MST, _intel_hdcp_disable() and _intel_hdcp2_disable() can return early when there are still other streams active on the port (num_streams > 0), leaving the per-connector hdcp_encrypted / hdcp2_encrypted flag stale. If the same connector is later re-enabled with the other HDCP version (e.g. HDCP 1.4 via force_hdcp14 after a prior HDCP 2.2 session on that connector) the stale flag from the previous protocol survives. intel_hdcp_disable() then picks the wrong branch on the next disable causing the following splat. xe 0000:00:02.0: [drm] drm_WARN_ON(!(intel_de_read(display, ((((&(display)->info.__runtime_info)->ip.ver) >= 12) ? ((const i915_reg_t){ .reg = (((0x664B4) + (cpu_transcoder) * ((0x665B4) - (0x664B4)))) }) : ((const i915_reg_t){ .reg = ((((const u32 []){ 0x66800, 0x66500, 0x66600, 0x66700, 0x66A00, 0x66900 })[(port)]) + (0xB4)) }))) & ((u32)(((int)sizeof(struct {_Static_assert(!(__builtin_choose_expr((sizeof(int) == sizeof(*(8 ? ((void *)((long)((20) >= (sizeof(u32) * 8)) * 0l)) : (int *)8))), (20) >= (sizeof(u32) * 8), false)), "const_true((20) >= BITS_PER_TYPE(u32))" " is true");})) + ((((1ULL))) << (20)))))) WARNING: drivers/gpu/drm/i915/display/intel_hdcp.c:1969 at _intel_hdcp2_disable+0x4bf/0x520 [xe], CPU#2: kms_content_pro/101318 Modules linked in: xe vfio_pci_core vfio_iommu_type1 vfio iommufd xt_multiport snd_hda_codec_intelhdmi snd_hda_codec_hdmi drm_gpuvm drm_gpusvm_helper drm_buddy gpu_sched drm_ttm_helper ttm drm_suballoc_helper drm_exec drm_display_helper cec rc_core drm_kunit_helpers kunit i2c_algo_bit xt_conntrack xt_MASQUERADE bridge stp llc nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 xt_addrtype nft_compat x_tables nf_tables xfrm_user xfrm_algo overlay cpuid cmdlinepart spi_nor mei_gsc_proxy mtd intel_rapl_msr wmi_bmof intel_uncore_frequency intel_uncore_frequency_common x86_pkg_temp_thermal intel_powerclamp coretemp snd_intel_dspcfg aesni_intel snd_hda_codec gf128mul snd_hda_core snd_hwdep r8169 snd_pcm intel_cstate snd_timer i2c_i801 i2c_mux snd spi_intel_pci processor_thermal_device_pci realtek video e1000e spi_intel i2c_smbus soundcore phy_package processor_thermal_device processor_thermal_wt_hint mei_me platform_temperature_control processor_thermal_soc_slider idma64 mei processor_thermal_rfim processor_thermal_rapl intel_ish_ipc intel_rapl_common intel_ishtp thunderbolt processor_thermal_wt_req processor_thermal_power_floor intel_vpu processor_thermal_mbox igen6_edac wmi sunrpc kvm_intel binfmt_misc kvm irqbypass int3403_thermal int340x_thermal_zone intel_skl_int3472_tps68470 tps68470_regulator intel_pmc_core clk_tps68470 acpi_tad int3400_thermal intel_hid pmt_telemetry acpi_thermal_rel sparse_keymap pmt_discovery pinctrl_intel_platform pmt_class intel_pmc_ssram_telemetry intel_pmc_pwrm_telemetry intel_skl_int3472_discrete intel_skl_int3472_common acpi_pad intel_vsec nls_iso8859_1 dm_multipath msr fuse efi_pstore autofs4 [last unloaded: xe_live_test] CPU: 2 UID: 0 PID: 101318 Comm: kms_content_pro Kdump: loaded Tainted: G U L N 7.2.0-rc2-lgci-xe-xe-5389-67aa8ad5c4c59cd1a-debug+ #1 PREEMPT(lazy) Tainted: [U]=USER, [L]=SOFTLOCKUP, [N]=TEST Hardware name: Intel Corporation Panther Lake Client Platform/PTL-UH LP5 T3 RVP1, BIOS PTLPFWI1.R00.3514.D01.2512291130 12/29/2025 RIP: 0010:_intel_hdcp2_disable+0x4c9/0x520 [xe] Code: 85 ff 74 04 48 8b 7f 08 4c 8b 7f 50 4d 85 ff 74 23 e8 5b 80 df e0 48 89 c6 48 8d 3d b1 f7 ba ff 48 c7 c1 a0 27 6a a1 4c 89 fa <67> 48 0f b9 3a e9 c9 fc ff ff 4c 8b 3f eb d8 e8 33 45 4e e1 4c 89 RSP: 0018:ffffc900027bf738 EFLAGS: 00010246 RAX: ffffffffa16bd4f1 RBX: ffff8881a1e69000 RCX: ffffffffa16a27a0 RDX: ffff8881c7b1b190 RSI: ffffffffa16bd4f1 RDI: ffffffffa100de30 RBP: ffffc900027bf7b0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff88844397a000 R13: ffff88844397a000 R14: ffff88817f7d2000 R15: ffff8881c7b1b190 FS: 0000774e9299dbc0(0000) GS:ffff8884eb36c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000774e94bc7220 CR3: 00000002166c1002 CR4: 0000000108f72ef0 PKRU: 55555554 Call Trace: <TASK> ? intel_hdcp_update_value+0x7d/0x260 [xe] intel_hdcp_disable+0x118/0x130 [xe] intel_hdcp_update_pipe+0x175/0x1b0 [xe] ? intel_initial_watermarks+0x20/0x60 [xe] intel_ddi_update_pipe+0x44/0xb0 [xe] intel_pre_update_crtc+0x3bc/0x410 [xe] skl_commit_modeset_enables+0x1a7/0x890 [xe] ? icl_sagv_pre_plane_update+0x6c/0xf0 [xe] intel_atomic_commit_tail+0x114b/0x20a0 [xe] ? lock_release+0xd0/0x2a0 intel_atomic_commit+0x2ff/0x350 [xe] ? intel_atomic_commit+0x2ff/0x350 [xe] drm_atomic_commit+0xaf/0xf0 ? __pfx___drm_printfn_info+0x10/0x10 drm_mode_atomic_ioctl+0xcb5/0xf60 ? drm_mode_atomic_ioctl+0x8a8/0xf60 ? drm_mode_atomic_ioctl+0x604/0xf60 ? __pfx_drm_mode_atomic_ioctl+0x10/0x10 drm_ioctl_kernel+0xb3/0x120 drm_ioctl+0x2db/0x5a0 ? __pfx_drm_mode_atomic_ioctl+0x10/0x10 ? _raw_spin_unlock_irqrestore+0x51/0x80 ? __pm_runtime_resume+0x5b/0x90 ? xe_pm_runtime_get_ioctl+0x61/0x150 [xe] xe_drm_ioctl+0x64/0xb0 [xe] __x64_sys_ioctl+0xa5/0x100 x64_sys_call+0x1250/0x26e0 do_syscall_64+0x103/0x6d0 ? __task_pid_nr_ns+0xc0/0x290 ? trace_hardirqs_on_prepare+0xcb/0xf0 ? do_syscall_64+0x34/0x6d0 ? fred_entry_from_user+0x92/0x140 ? trace_hardirqs_on+0x22/0xe0 ? do_syscall_64+0xb8/0x6d0 fred_entry_from_user+0x92/0x140 asm_fred_entrypoint_user+0x41/ Ensure the two flags are mutually exclusive at every successful enable: after intel_hdcp_auth() succeeds. Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com> Tested-by: Santhosh Reddy Guddati <santhosh.reddy.guddati@intel.com> Reviewed-by: Santhosh Reddy Guddati <santhosh.reddy.guddati@intel.com> Link: https://patch.msgid.link/20260717034734.477591-1-suraj.kandpal@intel.com
2026-07-22wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht()Lorenzo Bianconi
mt76_connac_get_eht_phy_cap routine can theoretically return NULL so check cap pointer before dereferencing it. Fixes: ba01944adee9f ("wifi: mt76: mt7996: add EHT beamforming support") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260621-mt76_connac_get_he_phy_cap-fix-v1-4-ed4ccf7a0363@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-07-22RDMA/srpt: Pass the mapped task attribute to target_init_cmd()Leon Romanovsky
srpt_handle_cmd() maps the initiator-supplied srp_cmd->task_attr into cmd->sam_task_attr, but then hands a hardcoded TCM_SIMPLE_TAG to target_init_cmd(). Pass the already mapped cmd->sam_task_attr instead, so target core sees the attribute the initiator requested. Fixes: 9474b043132f ("ib_srpt: Convert I/O path to target_submit_cmd + drop legacy ioctx->kref") Link: https://patch.msgid.link/20260721-b4-scsi-ordering-violation-due-to-hardc-v1-1-07205aab71bb@nvidia.com Reviewed-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
2026-07-22wifi: mt76: mt7925: fix crash in reset link replaySean Wang
During reset recovery, mt7925_vif_connect_iter() replays firmware state for links tracked in mvif->valid_links. After MLO link changes or MCU timeout recovery, the driver bitmap can temporarily contain a link whose mac80211 bss_conf has already gone away. This can pass a NULL bss_conf to mt76_connac_mcu_uni_add_dev(), matching the crash where x1, the second argument, is NULL: pc : mt76_connac_mcu_uni_add_dev+0x8c/0x1f8 [mt76_connac_lib] lr : mt7925_vif_connect_iter+0x9c/0x168 [mt7925_common] x2 : ffffff80a77f6018 x1 : 0000000000000000 x0 : ffffff8099402080 Call trace: mt76_connac_mcu_uni_add_dev+0x8c/0x1f8 [mt76_connac_lib] mt7925_vif_connect_iter+0x9c/0x168 [mt7925_common] mt7925_mac_reset_work+0x264/0x2f8 [mt7925_common] Skip missing bss_conf entries before replaying the link. Non-MLO AP/STA reset replay is unchanged because the helper still returns &vif->bss_conf for the legacy link. Fixes: 14061994184d ("wifi: mt76: mt7925: add link handling in mt7925_vif_connect_iter") Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20260616161016.19346-1-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-07-22wifi: mt76: fix airoha_npu dependency trackingArnd Bergmann
There is a new build failure with MT7996E=m MT76_CORE=y and NET_AIROHA_NPU=m: ld.lld: error: undefined symbol: airoha_npu_get ld.lld: error: undefined symbol: airoha_npu_put >>> referenced by npu.c >>> drivers/net/wireless/mediatek/mt76/npu.o:(mt76_npu_init) in archive vmlinux.a Fix this by reworking the dependency for the MT7996_NPU to only allow enabling that when mt76_core can link against the npu driver. To make sure this gets caught more easily in the future when additional mt76 variants need the same dependency, also turn CONFIG_MT76_NPU into a tristate symbol that has the same dependency. Fixes: 7fb554b1b623 ("wifi: mt76: Introduce the NPU generic layer") Acked-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Arnd Bergmann <arnd@arndb.de> Link: https://patch.msgid.link/20260612201519.4054683-1-arnd@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-07-22wifi: mt76: restrict NPU/PPE active checks to MMIO devicesDevin Wittmayer
mt76_npu_device_active() and mt76_ppe_device_active() read dev->mmio.npu and dev->mmio.ppe_dev. The mmio, usb and sdio bus structs share a union in struct mt76_dev, so on USB and SDIO these read unrelated data from the usb/sdio struct, which is non-NULL in practice. mt76_npu_device_active() then returns true on USB, and mt76_rx_poll_complete() takes the offload path and skips mt76_rx_aggr_reorder(). RX A-MPDU subframes are delivered out of order and the peer's TCP stack treats that as loss: heavy retransmissions and reduced throughput in AP mode. Seen on mt7921u, mt7925u, mt76x2u and mt76x0u. Gate both helpers on mt76_is_mmio() so they only run for the bus type that owns the mmio union member. Fixes: 7fb554b1b623 ("wifi: mt76: Introduce the NPU generic layer") Cc: stable@vger.kernel.org Tested-by: Nick Morrow <morrownr@gmail.com> Signed-off-by: Devin Wittmayer <lucid_duck@justthetip.ca> Link: https://patch.msgid.link/20260720232640.41293-1-lucid_duck@justthetip.ca Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-07-22wifi: mt76: fix MAC address for non OF pcie cardsRosen Penev
If seems the check for err is wrong as the proper macaddr gets written to from the EEPROM itself. Meaning checking err from of_get_mac_address is wrong as the proper macaddr has been written by this point. Closes: https://lore.kernel.org/linux-wireless/30a90714-02d8-45f2-a7f1-4cfe0627d50b@skade.local/ Reported-by: Klara Modin <klarasmodin@gmail.com> Closes: https://lore.kernel.org/all/ajRmlyx_AEGybykL@soda.int.kasm.eu/ Reported-by: Tobias Klausmann <klausman@schwarzvogel.de> Fixes: 31ee1582717e ("wifi: mt76: fix of_get_mac_address error handling") Signed-off-by: Rosen Penev <rosenp@gmail.com> Tested-by: Tobias Klausmann <klausman@schwarzvogel.de> Tested-by: Klara Modin <klarasmodin@gmail.com> Tested-by: John Rowley <lkml@johnrowley.me> Link: https://patch.msgid.link/20260706232857.807044-1-rosenp@gmail.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-07-22wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap()Lorenzo Bianconi
mt76_connac_get_he_phy_cap routine can theoretically return NULL so check cap pointer before dereferencing it. Fixes: 98686cd21624c ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260621-mt76_connac_get_he_phy_cap-fix-v1-3-ed4ccf7a0363@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-07-22wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv()Lorenzo Bianconi
mt76_connac_get_he_phy_cap routine can theoretically return NULL so check cap pointer before dereferencing it. Fixes: c948b5da6bbec ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260621-mt76_connac_get_he_phy_cap-fix-v1-2-ed4ccf7a0363@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-07-22wifi: mt76: connac: fix possible NULL-pointer deref in ↵Lorenzo Bianconi
mt76_connac_mcu_uni_bss_he_tlv() mt76_connac_get_he_phy_cap routine can theoretically return NULL so check cap pointer before dereferencing it. Fixes: d0e274af2f2e4 ("mt76: mt76_connac: create mcu library") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260621-mt76_connac_get_he_phy_cap-fix-v1-1-ed4ccf7a0363@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-07-22wifi: mt76: mt7915: guard HE capability lookupsRuoyu Wang
mt7915_mcu_bss_he_tlv() and mt7915_mcu_sta_bfer_tlv() both run after checking HE support, then dereference the HE PHY capability returned by mt76_connac_get_he_phy_cap(). That helper can return NULL when no capability entry matches the vif type. Fetch the capability before appending the TLV and skip the HE-specific setup when no matching capability is available. Fixes: e6d557a78b60 ("mt76: mt7915: rely on mt76_connac_get_phy utilities") Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com> Acked-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260620155332.81120-1-ruoyuw560@gmail.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-07-22wifi: mt76: mt7925: guard link STA in decap offloadGuangshuo Li
mt7925_sta_set_decap_offload() iterates over the vif valid_links mask when updating decap offload state for an MLO station. The station may not have a link STA for every valid link of the vif, so mt792x_sta_to_link() can return NULL for a link that belongs to the vif but not to the station. The function currently dereferences mlink before checking whether the link WCID is ready. If mlink is NULL, setting or clearing MT_WCID_FLAG_HDR_TRANS dereferences a NULL pointer. Skip links without a station link before touching mlink->wcid. Fixes: b859ad65309a ("wifi: mt76: mt7925: add link handling in mt7925_sta_set_decap_offload") Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com> Link: https://patch.msgid.link/20260708075539.726200-1-lgs201920130244@gmail.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-07-22wifi: mt76: Disable napi when removing deviceNicolas Cavallari
Unloading the mt7915e module with a MT7916 triggers multiples WARN in __netif_napi_del_locked() and in page_pool_disable_direct_recycling() because the driver does not disable the napi before destroying it. This is troublesome since on MT7916 it is required to unload the module and reinsert it with a different enable_6ghz parameter to change the frequency. The system generally becomes unstable after reinserting the module. Fix it by disabling napi before deleting it. Also, do not delete napi on WED queues since napi is neither used nor initialized on them. Fixes: 17f1de56df05 ("mt76: add common code shared between multiple chipsets") Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr> Link: https://patch.msgid.link/20260708144615.24092-1-nicolas.cavallari@green-communications.fr Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-07-22wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio busesDevin Wittmayer
PKT_TYPE_TXRX_NOTIFY is an mmio-only event, but mt7615_rx_check() and mt7615_queue_rx_skb() dispatch it to mt7615_mac_tx_free() on every bus. mt7615_mac_tx_free() cleans the DMA tx queues with mt76_queue_tx_cleanup(), which calls queue_ops->tx_cleanup(). Only the mmio queue ops implement that callback; on the mt7663 USB and SDIO buses it is NULL, so a TXRX_NOTIFY there calls a NULL pointer in the RX worker. Same defect as the mt7921 and mt7925 patches in this series. Drop the event on non-mmio buses via mt76_is_mmio(), as in commit 5683e1488aa9 ("wifi: mt76: connac: do not check WED status for non-mmio devices"). Fixes: eb99cc95c3b6 ("mt76: mt7615: introduce mt7663u support") Cc: stable@vger.kernel.org Signed-off-by: Devin Wittmayer <lucid_duck@justthetip.ca> Link: https://patch.msgid.link/20260627191336.20223-4-lucid_duck@justthetip.ca Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-07-22wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio busesDevin Wittmayer
PKT_TYPE_TXRX_NOTIFY is an mmio-only event, but mt7925_rx_check() and mt7925_queue_rx_skb() dispatch it to mt7925_mac_tx_free() on every bus. mt7925_mac_tx_free() cleans the DMA tx queues with mt76_queue_tx_cleanup(), which calls queue_ops->tx_cleanup(). Only the mmio queue ops implement that callback; on USB it is NULL, so a TXRX_NOTIFY there calls a NULL pointer in the RX worker: BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:0x0 Call Trace: mt7925_mac_tx_free+0x58/0x350 [mt7925_common] mt7925_rx_check+0xe2/0x130 [mt7925_common] mt76u_rx_worker+0x1b9/0x620 [mt76_usb] Drop the event on non-mmio buses via mt76_is_mmio(), as in commit 5683e1488aa9 ("wifi: mt76: connac: do not check WED status for non-mmio devices"). Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips") Cc: stable@vger.kernel.org Signed-off-by: Devin Wittmayer <lucid_duck@justthetip.ca> Link: https://patch.msgid.link/20260627191336.20223-3-lucid_duck@justthetip.ca Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-07-22wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio busesDevin Wittmayer
PKT_TYPE_TXRX_NOTIFY is an mmio-only event, but mt7921_rx_check() and mt7921_queue_rx_skb() dispatch it to mt7921_mac_tx_free() on every bus. mt7921_mac_tx_free() cleans the DMA tx queues with mt76_queue_tx_cleanup(), which calls queue_ops->tx_cleanup(). Only the mmio queue ops implement that callback; on USB and SDIO it is NULL, so a TXRX_NOTIFY there calls a NULL pointer in the RX worker: BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:0x0 Call Trace: mt7921_mac_tx_free+0x64/0x310 [mt7921_common] mt7921_rx_check+0x5f/0xf0 [mt7921_common] mt76u_rx_worker+0x1b9/0x620 [mt76_usb] Drop the event on non-mmio buses via mt76_is_mmio(), as in commit 5683e1488aa9 ("wifi: mt76: connac: do not check WED status for non-mmio devices"). Fixes: 48fab5bbef40 ("mt76: mt7921: introduce mt7921s support") Cc: stable@vger.kernel.org Signed-off-by: Devin Wittmayer <lucid_duck@justthetip.ca> Link: https://patch.msgid.link/20260627191336.20223-2-lucid_duck@justthetip.ca Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-07-22ARM: dts: aspeed: sanmiguel: Fix FIO IOEXP interrupt pinPotin Lai
The interrupt properties for fio_ioexp (pca9555 on i2c14) were incorrectly configured to gpio1 with ASPEED_GPIO(B, 6). Update the interrupt-parent to gpio0 and the interrupt pin to ASPEED_GPIO(C, 6) according to the hardware specification. Signed-off-by: Potin Lai <potin.lai.pt@gmail.com> Signed-off-by: Andrew Jeffery <andrew@codeconstruct.com.au>
2026-07-22MAINTAINERS: update Hongbo Li's email addressHongbo Li
Since the original email account is no longer in use, I have updated it to my current email address. Signed-off-by: Hongbo Li <hongbohbli@tencent.com> Acked-by: Chao Yu <chao@kernel.org> Acked-by: Gao Xiang <hsiangkao@linux.alibaba.com> Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
2026-07-21ppp: annotate concurrent dev->stats accessesEric Dumazet
dev->stats fields can be updated concurrently from multiple CPUs without synchronization. Use DEV_STATS_INC() for stats increments and DEV_STATS_READ() when reading dev->stats in ppp_get_stats64() and ppp_get_stats() to avoid data races. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Qingfang Deng <qingfang.deng@linux.dev> Link: https://patch.msgid.link/20260715055541.1147542-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-21cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain pathsFrank Sorenson
In cifs_close_deferred_file(), cifs_close_all_deferred_files(), and cifs_close_deferred_file_under_dentry(), when a pending deferred close is cancelled via cancel_delayed_work(), the subsequent kmalloc_obj() to add the file to the local processing list may fail under memory pressure. The loop breaks immediately, but the cancelled work is no longer pending (it would have called _cifsFileInfo_put()), and the cfile is never added to file_head for processing. The cifsFileInfo reference and the open server handle both leak. Fix by saving the cfile that failed allocation in a local variable, breaking as before, and calling _cifsFileInfo_put() on it after releasing the lock. Any files later in the iteration are unaffected since their deferred work is still pending and will fire normally. Fixes: e3fc065682eb ("cifs: Deferred close performance improvements") Signed-off-by: Frank Sorenson <sorenson@redhat.com> Signed-off-by: Steve French <stfrench@microsoft.com>
2026-07-21cifs: prevent readdir from changing file size due to stale directory metadataFrank Sorenson
Windows Server's directory enumeration metadata lags behind the actual file size after a write+close or rename. A concurrent readdir() in the window between close() returning to userspace and stat() being called overwrites the correct cached i_size with the stale server value, causing stat() to return the wrong size. Once _cifsFileInfo_put() removes the last writable handle from openFileList, is_size_safe_to_change() permits readdir to overwrite i_size. smb2_close_getattr() then stamps cifs_i->time = jiffies, making the corrupt cached value appear fresh to the next stat(). The existing check (see Fixes:) only blocked stale size updates while an active RW lease was held, not after the last writable handle closes. Add cifsInodeInfo->time_last_write, written via smp_store_release() at writable close and on setattr/truncate. is_size_safe_to_change() checks is_inode_writable() first (acquiring open_file_lock), then rejects a readdir size update if time_last_write falls within acregmax jiffies. The spinlock release in _cifsFileInfo_put() forms a store-release barrier that pairs with the spin_lock() (load-acquire) in is_inode_writable(), ensuring the subsequent smp_load_acquire() on time_last_write observes any update from a concurrent close(). When a size update is rejected and the server value differs from the cached one, cifs_i->time is cleared to force a fresh QUERY_INFO on the next stat(). readdir is also blocked from changing i_size while writable handles are open or an RW lease is held, even on direct-IO mounts. For deferred close (closetimeo > 0), time_last_write is refreshed at the actual server close in smb2_deferred_work_close() and in the cifs_close_deferred_file*() drain paths invoked by lease/oplock breaks and tcon teardown, anchoring the protection window to the real close time rather than the earlier userspace close. time_last_write == 0 skips the time_before() check to avoid false positives near boot on 32-bit systems where jiffies starts close to INITIAL_JIFFIES. Does not reproduce against Samba or with actimeo=0. Fixes: e4b61f3b1c67 ("cifs: prevent updating file size from server if we have a read/write lease") Signed-off-by: Frank Sorenson <sorenson@redhat.com> Signed-off-by: Steve French <stfrench@microsoft.com>
2026-07-21net: dsa: microchip: make read-only const array ts_reg staticColin Ian King
Don't populate the read-only const array ts_reg on the stack at run time, instead make it static Signed-off-by: Colin Ian King <colin.i.king@gmail.com> Link: https://patch.msgid.link/20260714191406.195375-1-colin.i.king@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-21net: stmmac: intel: skip SerDes reconfig when rate is unchangedMarkus Breitenberger
intel_mac_finish() is registered as the phylink mac_finish() callback for the Elkhart Lake SGMII ports. phylink calls it at the end of every major link reconfiguration, including the initial one during probe. The callback selects the PMC ModPHY LCPLL programming for the requested MAC-side interface and then power-cycles the SerDes. On Elkhart Lake that ModPHY is also used by the on-die AHCI SATA PHY. Reapplying the programming during the initial boot-time link-up disturbs the shared analog block while it is still driving SATA, so the SATA link fails to train: ata1: SATA link down (SStatus 1 SControl 300) The disk carrying the root filesystem is never detected and the system hangs at rootwait. Ethernet itself comes up normally, which makes the failure look unrelated to the network driver. Before mac_finish() runs, the legacy SerDes power-up path has already programmed SERDES_GCR0 for the current interface. The 1G and 2.5G ModPHY tables selected by mac_finish() correspond to the SerDes lane rate, so read that rate back from SERDES_GCR0 and skip the PMC reprogramming and SerDes power-cycle when it already matches the selected interface. This keeps the disruptive reprogramming out of the boot path when the SerDes is configured correctly, while preserving the previous behavior when a real SGMII/1000BASE-X to 2500BASE-X rate change is needed. If the register read fails, reconfigure as before. Fixes: a42f6b3f1cc1 ("net: stmmac: configure SerDes according to the interface mode") Cc: stable@vger.kernel.org Signed-off-by: Markus Breitenberger <bre@keba.com> Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Link: https://patch.msgid.link/20260713171619.192452-1-bre@breiti.cc Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-22power: supply: bq24190: Disable watchdog with bq24190_write_mask()Waqar Hameed
The watchdog is disabled by updating the register field with a `bq24190_read()` and `bq24190_write()`. Combine this instead with `bq24190_write_mask(..., 0)`. Signed-off-by: Waqar Hameed <waqar.hameed@axis.com> Link: https://patch.msgid.link/efa4524aa6879fd4452807f747a9e522183246a1.1782746851.git.waqar.hameed@axis.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-07-22power: supply: bq24190: Remove unused watchdog struct fieldWaqar Hameed
The field member `watchdog` in `struct bq24190_dev_info` is only set once in `bq24190_set_config()` during probe, and never read again. Remove this unnecessary field. Signed-off-by: Waqar Hameed <waqar.hameed@axis.com> Link: https://patch.msgid.link/5c9b9ac1599704ff94dba34b9b2a82f62f348bd4.1782746851.git.waqar.hameed@axis.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-07-22power: supply: rt9471: Remove superfluous unpacking of propvalWaqar Hameed
Remove extra variable in `set/get_property`-functions that is only supplied directly to other functions. The value is not used for anything else. Moreover, wrap these lines. Otherwise `checkpatch` warns about too long lines. Signed-off-by: Waqar Hameed <waqar.hameed@axis.com> Link: https://patch.msgid.link/6b4367512dfad62e865de8b6be52eefd5385fa26.1782746851.git.waqar.hameed@axis.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-07-21tools headers: Sync KVM headers with the kernel sourcesArnaldo Carvalho de Melo
To pick up the changes in: 103ff3a50e3a50a9 ("KVM: s390: Add capability to support 2G hugepages") 229132c309d667bb ("LoongArch: KVM: Add DMSINTC device support") 2619da73bb2f10d8 ("KVM: x86: Use __DECLARE_FLEX_ARRAY() for UAPI structures with VLAs") 4aebd7d5c72f805e ("KVM: s390: Add KVM capability for ESA mode guests") 4f256d5770febb9d ("KVM: x86: nSVM: Save/restore gPAT with KVM_{GET,SET}_NESTED_STATE") 822790ab01495d67 ("KVM: x86: Define KVM_X86_QUIRK_NESTED_SVM_SHARED_PAT") 8800dbf6614aad10 ("KVM: arm64: Allow userspace to create protected VMs when pKVM is enabled") bf8f3cec939db68e ("KVM: s390: vsie: Refactor handle_stfle") c547c51ff4d44c78 ("KVM: arm64: gic-v5: Add ARM_VGIC_V5 device to KVM headers") d7507a94a0720223 ("KVM: SVM: Treat exit_code as an unsigned 64-bit value through all of KVM") This addresses these perf build warnings: Warning: Kernel ABI header differences: diff -u tools/include/uapi/linux/kvm.h include/uapi/linux/kvm.h diff -u tools/arch/x86/include/uapi/asm/kvm.h arch/x86/include/uapi/asm/kvm.h diff -u tools/arch/x86/include/uapi/asm/svm.h arch/x86/include/uapi/asm/svm.h diff -u tools/arch/s390/include/uapi/asm/kvm.h arch/s390/include/uapi/asm/kvm.h Please see tools/include/uapi/README for further details. Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-07-21tools headers: Sync UAPI linux/fs.h with the kernel sourcesArnaldo Carvalho de Melo
To pick up the changes in: 45e57cfb7b10b64f ("fs: Clarify FS_CASEFOLD_FL semantics in UAPI header") That don't result in changes to the string tables generated from this header. This addresses this perf build warning: Warning: Kernel ABI header differences: diff -u tools/perf/trace/beauty/include/uapi/linux/fs.h include/uapi/linux/fs.h Please see tools/include/uapi/README for further details. Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-07-21perf beauty: Update copy of linux/socket.h with the kernel sourcesArnaldo Carvalho de Melo
To pick up the changes in: 4987a5763fd5ab72 ("net: block MSG_NO_SHARED_FRAGS in sendmsg()") That don't result in changes to the string tables generated from this header. This addresses this perf build warning: Warning: Kernel ABI header differences: diff -u tools/perf/trace/beauty/include/linux/socket.h include/linux/socket.h Please see tools/include/uapi/README for further details. Cc: Jann Horn <jannh@google.com> Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-07-21tools headers: Sync UAPI drm/drm.h with kernel sourcesArnaldo Carvalho de Melo
To pick up the changes in: a1b6cf8e5e7e9102 ("drm: uapi: Use SPDX in DRM core uAPI headers") dc2d30e7db8321a6 ("drm/doc: document DRM_IOCTL_SYNCOBJ_EVENTFD") That don't result in changes to the string tables generated from this header. This addresses this perf build warning: Warning: Kernel ABI header differences: diff -u tools/perf/trace/beauty/include/uapi/drm/drm.h include/uapi/drm/drm.h Please see tools/include/uapi/README for further details. Cc: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Cc: Simon Ser <contact@emersion.fr> Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-07-21tools arch x86: Sync the msr-index.h copy with the kernel sourcesArnaldo Carvalho de Melo
To pick up the changes in: e93a93f11490992a ("KVM: x86: Virtualize AMD CPUID faulting") That introduce these new entries in the string tables: $ tools/perf/trace/beauty/tracepoints/x86_msr.sh > before.txt $ cp arch/x86/include/asm/msr-index.h tools/arch/x86/include/asm/msr-index.h $ tools/perf/trace/beauty/tracepoints/x86_msr.sh > after.txt $ diff -u before.txt after.txt @@ -349,6 +349,7 @@ [0xc00102b2 - x86_AMD_V_KVM_MSRs_offset] = "AMD_CPPC_CAP2", [0xc00102b3 - x86_AMD_V_KVM_MSRs_offset] = "AMD_CPPC_REQ", [0xc00102b4 - x86_AMD_V_KVM_MSRs_offset] = "AMD_CPPC_STATUS", + [0xc00102b5 - x86_AMD_V_KVM_MSRs_offset] = "AMD_CPPC_REQ2", [0xc00102f0 - x86_AMD_V_KVM_MSRs_offset] = "AMD_PPIN_CTL", [0xc00102f1 - x86_AMD_V_KVM_MSRs_offset] = "AMD_PPIN", [0xc0010300 - x86_AMD_V_KVM_MSRs_offset] = "AMD_SAMP_BR_FROM", This addresses this perf build warning: Warning: Kernel ABI header differences: diff -u tools/arch/x86/include/asm/msr-index.h arch/x86/include/asm/msr-index.h Please see tools/include/uapi/README for further details. Cc: Jim Mattson <jmattson@google.com> Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-07-21tools headers x86 cpufeatures: Sync with the kernel sourcesArnaldo Carvalho de Melo
To pick up the changes in: 5ce9cc5a232b9928 ("coco/tdx-host: Don't expose P-SEAMLDR information on CPUs with erratum") 7658b9343a8f65e5 ("KVM: SVM: add GMET bit definitions") de0bfdc7137d5132 ("KVM: x86: Advertise AVX512 Bit Matrix Multiply (BMM) to userspace") That just rebuilds perf, silencing this build warning. This addresses this perf build warning: Warning: Kernel ABI header differences: diff -u tools/arch/x86/include/asm/cpufeatures.h arch/x86/include/asm/cpufeatures.h Please see tools/include/uapi/README for further details. Cc: Chao Gao <chao.gao@intel.com> Cc: Nikunj A Dadhania <nikunj@amd.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-07-21tools headers: Sync linux/gfp_types.h with the kernel sourcesArnaldo Carvalho de Melo
To pick up the changes in: b56ca146a2b27501 ("vmalloc: add __GFP_SKIP_KASAN support") 6a288a4ddb4a9944 ("mm/page_alloc: fix initialization of tags of the huge zero folio with init_on_free") That just rebuilds perf, silencing this build warning. This addresses this perf build warning: Warning: Kernel ABI header differences: diff -u tools/include/linux/gfp_types.h include/linux/gfp_types.h Please see tools/include/uapi/README for further details. Cc: David Hildenbrand (Arm) <david@kernel.org> Cc: Muhammad Usama Anjum <usama.anjum@arm.com> Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-07-21tools headers UAPI: Sync linux/rtnetlink.h with the kernel sourcesArnaldo Carvalho de Melo
To pick up the changes in: b588019e85f49069 ("rtnetlink: add RTEXT_FILTER_NAME_ONLY support") That just rebuilds perf, silencing this build warning. This addresses this perf build warning: Warning: Kernel ABI header differences: diff -u tools/include/uapi/linux/rtnetlink.h include/uapi/linux/rtnetlink.h Please see tools/include/uapi/README for further details. Cc: Eric Dumazet <edumazet@google.com> Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-07-21tools headers UAPI: Sync linux/const.h with the kernel sourcesArnaldo Carvalho de Melo
To pick up the changes in: de9e2b3d88af3641 ("uapi: Provide DIV_ROUND_CLOSEST()") That just rebuilds perf, silencing this build warning. This addresses this perf build warning: Warning: Kernel ABI header differences: diff -u tools/include/uapi/linux/const.h include/uapi/linux/const.h Please see tools/include/uapi/README for further details. Cc: Cristian Ciocaltea <cristian.ciocaltea@collabora.com> Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-07-22power: supply: max8903: add DC and USB input current-limit GPIO controlsHerman van Hazendonk
Add two optional current-limit knobs surfaced through POWER_SUPPLY_PROP_INPUT_CURRENT_LIMIT, selected by which input source is currently online: - DC (DOK / TA-IN): a "dc-current-limit-gpios" array drives the GPIOs of an external resistor mux connected to the MAX8903 IDC pin (DC Current-Limit Set Input, pin 11). The IDC pin programs the step-down DC input current limit from 0.5 A to 2 A via R_IDC when the DCM mode pin is logic-high. The DT property "dc-current-limit-mapping" describes the (current_ua, gpio_value) pairs the board can program; the driver picks the largest entry whose limit is <= the requested limit. A 0 uA entry, used to stop drawing DC current, is selectable by issuing a 0 uA request (the selection uses a -1 "not found" sentinel rather than tracking best_limit > 0, so the all-zero entry can win). - USB (UOK / USB-IN): a single "usb-current-limit-gpio" drives the MAX8903 IUSB pin (USB Current-Limit Set Input, pin 7). The IUSB pin is silicon-fixed per the MAX8903 datasheet Pin Description: logic-low selects 100 mA, logic-high selects 500 mA. The two values are encoded as MAX8903_USB_CURRENT_LIMIT_{LOW,HIGH}_UA #defines with the datasheet quote in a header comment. The requested limit picks HIGH if it can absorb 500 mA, else LOW, else returns -EINVAL rather than silently programming a higher current that would violate the system power budget. Mirroring the DC-priority policy in the get path: when ta_in is asserted the part draws from DC regardless of USB state, so the set path only routes to USB when DC is not online. The dispatch in max8903_set_property() to the DC vs USB path needs to match the active source flag set by the corresponding *_ok GPIO IRQ handler; both update sites take a new struct mutex source_lock so the check and the resulting hardware write cannot be torn by a concurrent IRQ flipping the source-online flag mid-decision. The DOK/UOK IRQ handlers hold source_lock across the full read-modify-evaluate block (line sampling, ta_in/usb_in update, dcm/cen GPIO writes, psy type update) so the cen enable calculation reads a stable other-source flag rather than racing with the peer IRQ. The IRQs are requested with IRQF_ONESHOT (threaded), so a sleepable lock is the right primitive in both contexts. max8903_get_property() also takes source_lock briefly to snapshot the source flags and current-limit values so userspace never observes a torn pair of (source-online flag, current-limit ua). dc-current-limit-mapping gpio_value entries are validated at parse against the GPIO array width so a malformed DT value is rejected instead of being silently truncated by gpiod_set_array_value() and selecting the wrong mux level. ndescs is also bounded to < BITS_PER_TYPE(u32) to keep BIT(ndescs) well-defined on 32-bit. The mapping is additionally required to contain a gpio_value=0 entry: devm_gpiod_get_array_optional() asks for GPIOD_OUT_LOW, so the hardware mux starts at gpio_value 0, and the driver seeds dc_current_limit_ua from the matching map entry. A DT lacking the all-zero entry is rejected with -EINVAL because otherwise the reported INPUT_CURRENT_LIMIT could disagree with the mux state until a set_property write picks a real value. Negative INPUT_CURRENT_LIMIT requests are rejected at the set_property entry: val->intval is signed, the set_*_current_limit() helpers take a u32, and a negative cast would silently widen to a huge unsigned value, bypass the upper-bound guard and program the maximum permitted current. Signed-off-by: Herman van Hazendonk <github.com@herrie.org> Link: https://patch.msgid.link/20260605-submit-power-max8903-dc-limit-v2-2-0c5396e98f14@herrie.org Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-07-22dt-bindings: power: supply: maxim,max8903: add DC and USB input ↵Herman van Hazendonk
current-limit controls Add three optional properties to the MAX8903 charger binding to describe board-level GPIO control of the DC and USB input current limits: DC input (TA / DOK pin): - dc-current-limit-gpios (1..4 GPIOs): mux control lines feeding the MAX8903 IDC resistor mux; - dc-current-limit-mapping (uint32-matrix of {microamps, gpio_bit_pattern} pairs): the available current levels and the GPIO bit pattern that selects each level. USB input (USB / UOK pin): - usb-current-limit-gpios: a single GPIO driving the IUSB pin. The IUSB pin is silicon-fixed by the MAX8903 datasheet (Pin Description): low selects 100 mA, high selects 500 mA. Only the GPIO mapping is board-specific; the current values are not exposed in DT. A dependentRequired block ties dc-current-limit-gpios and dc-current-limit-mapping together so an incomplete DT cannot pass validation with only one half of the pair. These let userspace clamp the input draw via the standard POWER_SUPPLY_PROP_INPUT_CURRENT_LIMIT power_supply attribute. The HP TouchPad uses both: two TLMM lines select between 0.5 A, 1.0 A, 1.5 A and 2.0 A DC input current limits behind the MAX8903B charger, and a third TLMM line picks the IUSB 100 mA / 500 mA limit. These are purely additive; existing platforms remain unaffected. Signed-off-by: Herman van Hazendonk <github.com@herrie.org> Reviewed-by: Rob Herring (Arm) <robh@kernel.org> Link: https://patch.msgid.link/20260605-submit-power-max8903-dc-limit-v2-1-0c5396e98f14@herrie.org Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-07-21perf bench bpf: Add missing .gitignore fileArnaldo Carvalho de Melo
In 713eeb2279402758 ("perf build: Move BPF skeleton generation out of Makefile.perf") the bpf_skel used with 'perf bench uprobe' was moved from tools/perf/util/bpf_skel/ to tools/perf/bench/bpf_skel. Copy tools/perf/util/bpf_skel/.gitignore to that new directory so that files generated during build get ignored by git. Reported-by: Linus Torvalds <torvalds@linux-foundation.org> Cc: Adrian Hunter <adrian.hunter@intel.com> Cc: Ian Rogers <irogers@google.com> Cc: James Clark <james.clark@linaro.org> Cc: Jiri Olsa <jolsa@kernel.org> Cc: Namhyung Kim <namhyung@kernel.org> Fixes: 713eeb2279402758 ("perf build: Move BPF skeleton generation out of Makefile.perf") Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-07-21Merge branch 'fix-unique-field-logic-in-btf'Eduard Zingerman
Kumar Kartikeya Dwivedi says: ==================== Fix unique field logic in BTF Fix constraint of certain fields that have to be unique when nested structs are present, BPF_REFCOUNT which should be marked as unique. See commit logs for details. While at it, fix improper offset check. Changelog: ---------- v1 -> v2 v1: https://lore.kernel.org/bpf/20260719142401.2420111-1-memxor@gmail.com * Add fix for BPF_REFCOUNT not being unique. (Sashiko) * Roll improper offset warning check into series. (Sashiko) ==================== Link: https://patch.msgid.link/20260719153634.2908692-1-memxor@gmail.com Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-07-21selftests/bpf: Test duplicate bpf_refcount fieldsKumar Kartikeya Dwivedi
Add a raw BTF test with two bpf_refcount fields. The duplicate must be rejected during BTF loading instead of reaching the duplicate-field invariant in btf_parse_fields(). Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Link: https://patch.msgid.link/20260719153634.2908692-6-memxor@gmail.com Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>