summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-06-30fat: reject name longer than NAME_MAX in msdos_format_name()Zizhi Wo
msdos_format_name() performs no upper-bound check on the input name length. It silently truncates an arbitrarily long name into the 8.3 form (11 bytes) and returns success. The subsequent fat_scan() then matches only against these 11 truncated bytes, so it returns an inode as long as any entry with the same 8.3 name exists on disk. For example, passing a 300-byte name of all 'A's returns 0 with res set to "AAAAAAAA" (8 'A's + 3 padding spaces), reporting success for a name far longer than NAME_MAX. As a result, when a user calls open() on a path component longer than NAME_MAX (255) bytes, the VFS only enforces PATH_MAX, not the length of an individual component. The dentry keeps the original long name but gets an inode attached and becomes positive. Later in vfs_open() -> fsnotify_open() -> fanotify_info_copy_name() triggers WARN_ON_ONCE(), and the event is reported to userspace with an empty name. vfat is not affected, as create goes through xlate_to_uni() which refuses names longer than FAT_LFN_LEN. Fix this by checking 'len > NAME_MAX' at the entry of msdos_format_name(), the single entry point for all msdos name handling, aligning with the NAME_MAX check that xfs/9p/ceph/simple_lookup() perform at lookup. Signed-off-by: Zizhi Wo <wozizhi@huawei.com> Link: https://patch.msgid.link/20260629130943.3671939-1-wozizhi@huaweicloud.com Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-06-30posix_acl: remove useless codeLuis Henriques
This is just a trivial clean-up: it removes an unnecessary return branch. Signed-off-by: Luis Henriques <luis@igalia.com> Link: https://patch.msgid.link/20260629154554.29093-1-luis@igalia.com Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-06-30net: gianfar: dispose irq mappings on probe failure and device removalRosen Penev
irq_of_parse_and_map() creates irqdomain mappings that should be balanced with irq_dispose_mapping(). The driver never called irq_dispose_mapping(), leaking mappings on probe failure and device removal. Fix by adding irq_dispose_mapping() in free_gfar_dev() and expanding its loop from priv->num_grps to MAXGROUPS so the error path also catches partially-initialized groups. All irqinfo pointers are pre-initialized to NULL in gfar_of_init(), making the NULL-guarded walk in free_gfar_dev() safe for every scenario. gfar_parse_group() itself is left as a simple parse function with no resource management; cleanup is centralized in the caller's error path. Assisted-by: opencode:big-pickle Fixes: b31a1d8b4151 ("gianfar: Convert gianfar to an of_platform_driver") Signed-off-by: Rosen Penev <rosenp@gmail.com> Link: https://patch.msgid.link/20260626225228.427392-1-rosenp@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-30net: lan743x: Initialize eth_syslock spinlock before useAndrea Righi
lan743x_hardware_init() calls pci11x1x_strap_get_status() during the PCI11x1x probe sequence. That helper acquires the Ethernet subsystem hardware lock via lan743x_hs_syslock_acquire(), which relies on adapter->eth_syslock_spinlock to serialize access. The spinlock is currently initialized only after the strap status is read. With CONFIG_DEBUG_SPINLOCK enabled, taking the zeroed initialized spinlock can trip the spinlock debug check. Fix by initializing adapter->eth_syslock_spinlock before reading the strap status so the probe path never attempts to lock an uninitialized spinlock. Fixes: 46b777ad9a8c ("net: lan743x: Add support to SGMII 1G and 2.5G") Cc: stable@vger.kernel.org # v6.0+ Signed-off-by: Andrea Righi <arighi@nvidia.com> Reviewed-by: David Thompson <davthompson@nvidia.com> Reviewed-by: Thangaraj Samynathan<Thangaraj.s@microchip.com> Link: https://patch.msgid.link/20260626163218.3591486-1-arighi@nvidia.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-30pinctrl: renesas: rza2: Embed pins in the priv structRosen Penev
Turn the separately allocated pinctrl_pin_desc array into a flexible array member of struct rza2_pinctrl_priv, annotated with __counted_by(npins). Compute the pin count before allocation so struct_size() can size the combined object, and the two allocations can be collapsed into one. Change npins to unsigned int to avoid potential overflow/underflow errors. Assisted-by: Claude:Opus-4.7 Signed-off-by: Rosen Penev <rosenp@gmail.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260527202317.5347-1-rosenp@gmail.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-06-30dt-bindings: clock: renesas,versaclock7: Update maintainerBiju Das
Alex' email is bouncing. Update the maintainers list with my contact details to take over the schema maintenance. While at it, extend the entry in MAINTAINERS to the Versaclock 3 clock driver. Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Reviewed-by: Brian Masney <bmasney@redhat.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20250905143441.7082-1-biju.das.jz@bp.renesas.com Link: https://patch.msgid.link/20260623162039.153291-1-biju.das.jz@bp.renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-06-30clk: renesas: r9a09g047: Add LVDS clocks and resetsTommaso Merciai
Add LVDS clocks and resets entries to the r9a09g047 CPG driver. Signed-off-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260623152851.478573-1-tommaso.merciai.xr@bp.renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-06-30ALSA: hda/realtek: Add quirk for HP Victus 16-e0xxx (88EE) to enable mute LEDShubham Nayak
The mute LED on the HP Victus 16-e0xxx (board ID 88EE, ALC245 codec) does not function by default. Add the ALC245_FIXUP_HP_MUTE_LED_COEFBIT quirk to enable it. Tested on my HP Victus 16-e0xxx with kernel 7.1.2. Signed-off-by: Shubham Nayak <shubhamnayak392reborn@gmail.com> Link: https://patch.msgid.link/20260629-hp-victus-16-mute-led-v1-1-ab0f4a8a533b@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-06-30clk: renesas: r9a09g077: Add LCDC and PLL3 clock support for RZ/T2H display ↵Lad Prabhakar
pipeline Add the clock definitions and PLL logic required to supply the LCDC (VSPD/FCPVD/DU) blocks on the RZ/T2H (R9A09G077) SoC. The RZ/T2H display subsystem depends on a dedicated PLL (PLL3) and a set of new derived clocks. Introduce a new PLL clock type and implement rate recalculation, programming and locking sequences for PLL3 using the RZ/T2H specific divider and VCO limits. Add the corresponding muxes and divider entries, expose the LCDC core clock, and register the LCDC module clock using the correct PCLK parent. This enables the RZ/T2H clock driver to generate the display pipeline clocking tree needed by the DU and VSP-based composition engines, allowing upcoming display support to be integrated without duplicating CPG logic. Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260618181949.3036280-6-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-06-30clk: renesas: rzv2h-cpg: Extract PLL calculation helpers into shared libraryLad Prabhakar
Move the RZ/V2H PLL and divider parameter calculation helpers from rzv2h-cpg.c into a new reusable library. Introduce the CLK_RZV2H_CPG_LIB Kconfig symbol and add rzv2h-cpg-lib.c to host the PLL parameter search algorithms currently implemented by rzv2h_get_pll_pars() and rzv2h_get_pll_divs_pars(). Export the helpers as rzv2h_cpg_get_pll_pars() and rzv2h_cpg_get_pll_divs_pars() for use by other drivers. Update the public clock header to expose the new interfaces and provide compatibility aliases for the existing helper names, avoiding build breakage for current users while allowing future conversions to the new API. This prepares for reuse of the PLL and divider calculation logic by other Renesas clock drivers, including upcoming RZ/T2H and RZ/N2H CPG support, without duplicating the implementation. Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260618181949.3036280-5-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-06-30clk: renesas: rzv2h-cpg: Use per-SoC PLL reference frequency for calculationsLad Prabhakar
Introduce a per-SoC PLL reference input frequency parameter to avoid relying on a hardcoded 24MHz constant during PLL configuration math. Add an input_fref member to struct rzv2h_pll_limits. In the core calculation helper rzv2h_get_pll_pars(), derive the base input clock rate from limits->input_fref, utilizing the conditional ternary operator to fall back to 24MHz if the struct field is left uninitialized (0), and drop the obsolete macro RZ_V2H_OSC_CLK_IN_MEGA. This abstraction permits the reuse of the common PLL divider logic on newer SoC platforms like the RZ/T2H, which feature a 48 MHz PLL reference clock input instead of the 24 MHz signal used by RZ/V2H(P), without disrupting existing platforms. Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260618181949.3036280-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-06-30clk: renesas: r9a08g046: Add USB2.0 clock and reset entriesBiju Das
Add module clock and reset definitions for the USB2.0 interfaces on the RZ/G3L (r9a08g046) SoC. Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260616104459.410743-4-biju.das.jz@bp.renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-06-30clk: renesas: r9a09g077: Add RTC clocksLad Prabhakar
Add the core and module clock definitions for the Real-Time Clock (RTC) peripheral on the Renesas RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs. Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260615143943.1610095-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-06-30Merge tag 'renesas-r9a09g077-dt-binding-defs-tag7' into renesas-clk-for-v7.3Geert Uytterhoeven
Renesas RZ/T2H and RZ/N2H LCDC and RTC Clock DT Binding Definitions LCD Controller and Real-Time Clock DT binding definitions for the Renesas RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs, shared by driver and DT source files.
2026-06-30clk: renesas: cpg-mssr: Implement dedicated MSTP delay logic for RZ/T2H LCDC ↵Lad Prabhakar
and RTC Introduce a dedicated clock delay mechanism, cpg_rzt2h_mstp_delay(), to satisfy the module-stop (MSTP) state release requirements specified in the RZ/T2H hardware manual. Per the hardware manual, while a standard 10 us delay (satisfying 7 dummy reads) is sufficient for most IP blocks, the LCDC requires 100 dummy reads (142 us) and the RTC requires 300 dummy reads (428 us) to stabilize after being released from a module-stop state. Implement a conditional bitmask filter helper that switches wait intervals based on the packaged module clock index. In cpg_mstp_clock_endisable(), the clock index and individual target bits are known, allowing an exact match. In the resume path cpg_mssr_resume_noirq(), where individual bits are not tracked, pass a fallback register index base (`reg * 32`) with bit verification masked out to match on the peripheral's register group block instead. Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260615104845.4122868-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-06-30clk: renesas: r9a08g046: Add clock and reset entries for GE3DBiju Das
Add clock and reset entries for GE3D. Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260604151855.307772-2-biju.das.jz@bp.renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-06-30clk: renesas: r9a08g046: Add clock and reset entries for SDHIBiju Das
Add clock and reset entries for SDHI. Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260603065731.93243-3-biju.das.jz@bp.renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-06-30clk: renesas: r9a09g047: Add audio clock and reset supportJohn Madieu
Add clock and reset entries for audio-related modules on the RZ/G3E SoC. Target modules are: - SSIU (Serial Sound Interface Unit) with SSI ch0-ch9, - SCU (Sampling Rate Converter Unit) with SRC ch0-ch9, DVC ch0-ch1, CTU/MIX ch0-ch1, - DMACpp (Audio DMA Controller), - ADG (Audio Clock Generator) with divider input clocks and audio master clock outputs. The ADG SSI clock outputs (adg_ssi[0-9]_clk) are parented on CLK_PLLCLN_DIV8 as a deliberate simplification: the ADG dynamically muxes each output between adg_0_clk_195m and audio_clk[a,b,c] at runtime via ADG_AUDIO_CLK_SEL{0,1,2}, owned by the rsnd-adg driver. While at it, reorder plldty_div16 to group it with the other plldty fixed dividers. Signed-off-by: John Madieu <john.madieu.xa@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260525110603.4018170-3-john.madieu.xa@bp.renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-06-30dt-bindings: clock: renesas: Add audio clock inputs for RZ/V2H familyJohn Madieu
RZ/V2H, RZ/V2N, and RZ/G3E support two optional external audio clock inputs (AUDIO_CLKB and AUDIO_CLKC) that can be used by the Audio Clock Generator (ADG) to derive internal audio clocks. The third ADG input (AUDIO_CLKA) is fed internally by the AUDIO_EXTAL pin and does not need a separate binding entry. Update the bindings to allow these optional clocks for all RZ/V2H family SoCs. Signed-off-by: John Madieu <john.madieu.xa@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Acked-by: Conor Dooley <conor.dooley@microchip.com> Link: https://patch.msgid.link/20260525110603.4018170-2-john.madieu.xa@bp.renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-06-30perf/core: Check kernel access when kernel callchains are requestedDapeng Mi
perf_event_open() currently gates perf_allow_kernel() only on !attr.exclude_kernel. However, users can still request kernel callchain collection with attr.exclude_callchain_kernel == 0 even when attr.exclude_kernel == 1. That still requires kernel profiling privilege, but the existing check does not enforce it. Update the permission check to call perf_allow_kernel() when either kernel sampling is requested or kernel callchains are requested. This keeps permission checks aligned with requested data and prevents unprivileged use of kernel callchain capture. Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://patch.msgid.link/20260616044654.3468742-9-dapeng1.mi@linux.intel.com
2026-06-30perf/core: Fix kernel register info leak via hardware skidDapeng Mi
An unprivileged hardware perf event using exclude_kernel=1 can leak kernel register data to user space via PERF_SAMPLE_REGS_INTR or PERF_SAMPLE_IP. Due to hardware skid, a PMI may trigger after the CPU has already entered kernel space (Ring 0), bypassing the perf_allow_kernel() privilege barrier. This security vulnerability is severely exacerbated by upcoming support for SIMD register sampling via XSAVES, which could expose sensitive kernel FPU states (such as active cryptographic keys). Fix this by ensuring that sampled register data is dropped if the event's exclude_kernel attribute is set but the PMI catches the CPU in kernel mode. Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://lore.kernel.org/all/20260529085613.CCAFB1F00893@smtp.kernel.org/ Link: https://patch.msgid.link/20260616044654.3468742-8-dapeng1.mi@linux.intel.com
2026-06-30perf/x86/intel: Drop fixed-counter PEBS constraints for baseline PEBSDapeng Mi
On Sapphire Rapids (SPR) guests where pebs_baseline is not advertised, running command $ ./perf record -e cpu/event=0x00,umask=0x01,i\ name=INST_RETIRED.PREC_DIST/p -c 10000 sleep 1 can trigger: unchecked MSR access error: WRMSR to 0x3f1 ... in\ intel_pmu_pebs_enable_all() This occurs because SPR-specific PEBS constraints allow fixed-counter scheduling (for example, INST_RETIRED.PREC_DIST on fixed counter 0). In guests lacking pebs_baseline, KVM does not support PEBS sampling on fixed counters, so enabling such events reaches an invalid MSR programming path. Starting with Icelake, regardless of whether Extended PEBS or Architectural PEBS is in use, all counters (including fixed counters) support PEBS sampling, and the PMU_FL_PEBS_ALL flag is set by default. As long as PMU_FL_PEBS_ALL is set, constraint lookup automatically falls back to the corresponding non-PEBS constraints if no matching entry is found in the PEBS constraints table. Since non-PEBS event constraints already contain the same fixed-counter constraints, it is safe to remove these fixed-counter entries from the PEBS constraints table. The fallback mechanism will ensure that fixed PEBS events are scheduled onto the correct fixed counters. So, directly drop the fixed-counter entries from the PEBS constraint table. Without pebs_baseline, these fixed-counter PEBS events will now resolve to empty constraints and will not be scheduled or enabled, thereby avoiding the warning and bypassing the broken guest PEBS path. Reported-by: Yi Lai <yi1.lai@intel.com> Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://patch.msgid.link/20260616044654.3468742-7-dapeng1.mi@linux.intel.com
2026-06-30perf/x86/intel: Validate the return value of intel_pmu_init_hybrid()Dapeng Mi
The intel_pmu_init_hybrid() function allocates memory for the x86_pmu.hybrid_pmu[] array. If this allocation fails under memory pressure, hybrid PMU initialization will fail. Currently, the caller does not check the return value of intel_pmu_init_hybrid(). This can lead to a null-pointer dereference or invalid memory access when attempting to use the uninitialized array, potentially triggering a system panic. Fix this by validating the return value of intel_pmu_init_hybrid(). Additionally, reset x86_pmu.num_hybrid_pmus to 0 on failure, and defer intel_pmu_arch_lbr_init() until after hybrid PMU initialization succeeds. This reordering avoids the need to explicitly destroy the kmem cache if the memory allocation fails. Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://patch.msgid.link/20260616044654.3468742-6-dapeng1.mi@linux.intel.com
2026-06-30perf/x86/intel: Fix kernel address leakages in LBR stackDapeng Mi
Before Arch LBR gained CPL filtering support, a user-only branch stack could still contain kernel addresses. As a result, kernel branch records may be exposed to user space even when PERF_SAMPLE_BRANCH_USER is requested. For example, on Intel Tiger Lake, the following command can still report SYSRET/ERET entries with kernel-space from addresses: $ ./perf record -e cycles:p -o - --branch-filter any,save_type,u -- \ ./perf bench syscall basic --loop 1000 | \ ./perf script -i - --fields brstack|tr ' ' '\n'| \ grep -E '0x[89a-f][0-9a-f]{15}' Total time: 0.000 [sec] 0.219000 usecs/op 4,566,210 ops/sec [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.551 MB - ] 0xffffffff93c001c8/0x7f12a2b1d647/P/-/-/16959/SYSRET/- 0xffffffff93c001c8/0x7f12a2b1d5c2/P/-/-/17535/SYSRET/- 0xffffffff93c01928/0x7f12a2861000/P/-/-/6719/ERET/- 0xffffffff93c01928/0x7f12a297a000/P/-/-/8575/ERET/- The problem is that intel_pmu_lbr_filter() does not fully validate the privilege level of sampled entries. It filters some mismatches based on the branch type and the to address, but it does not reject entries whose from address violates the requested branch privilege filter. Fix this by extending software filtering to validate both from and to addresses against br_sel. Any LBR entry contains kernel address does not match the requested user filter is dropped. This prevents kernel addresses from appearing in user-only branch stacks. Fixes: 47125db27e47 ("perf/x86/intel/lbr: Support Architectural LBR") Reported-by: Ian Rogers <irogers@google.com> Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260616044654.3468742-5-dapeng1.mi@linux.intel.com
2026-06-30perf/x86/intel: Fallback to sw branch type decoding if no hw decodingDapeng Mi
intel_pmu_lbr_filter() currently assumes arch-LBR provides hardware branch-type decoding and skips software decoding on that path. However, arch-LBR may not always expose branch-type information. In that case, treating entries as hardware-decoded can misclassify sampled branches (for example, defaulting to JCC), which breaks branch-type filtering results. Fix this by using software branch-type decoding when hardware branch-type decoding is unavailable (that is, when x86_lbr_type is not enabled). This keeps branch classification and filtering behavior correct across arch-LBR configurations. Since x86_lbr_type is only set to true when arch-LBR is supported, it's unnecessary to check if the CPU has the arch-LBR feature. Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://patch.msgid.link/20260616044654.3468742-4-dapeng1.mi@linux.intel.com
2026-06-30perf/x86/intel: Keep cap_user_rdpmc in sync with RDPMC user-disable stateDapeng Mi
After introducing the RDPMC user disable feature, user-space RDPMC may return 0 instead of the actual event count. This creates an inconsistency with cap_user_rdpmc, where cap_user_rdpmc is set, but user-space RDPMC only returns 0. To accurately represent the user-space RDPMC capability, update cap_user_rdpmc (depending on PERF_EVENT_FLAG_USER_READ_CNT) according to the RDPMC user disable state. If RDPMC user disable is enabled, cap_user_rdpmc is updated to false eventually, allowing user-space programs to fall back to the read() syscall to obtain the real event count. Because PERF_EVENT_FLAG_USER_READ_CNT is evaluated in x86_pmu_event_init(), move intel_pmu_update_rdpmc_user_disable() earlier into intel_pmu_hw_config(). This ensures that the user-disable state is updated before updating PERF_EVENT_FLAG_USER_READ_CNT. Note that since event->ctx is not yet assigned at this stage, use the PERF_ATTACH_TASK flag to detect whether the event is task-attached. While at it, fix the indentation of x86_pmu_has_rdpmc_user_disable() to adhere to the kernel coding style. Fixes: 59af95e028d4 ("perf/x86/intel: Add support for rdpmc user disable feature") Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://patch.msgid.link/20260616044654.3468742-3-dapeng1.mi@linux.intel.com
2026-06-30perf/x86/intel: Remove anythread_deprecated bit from perf_capabilitiesDapeng Mi
AnyThread mode deprecation is enumerated by CPUID.0AH:EDX[15] instead of PERF_CAPABILITIES MSR. It's not a good practice to define a bit to represent "anythread deprecation" in perf_capabilities. It leads to the anythread_deprecated bit could be overwritten by the real value of PERF_CAPABILITIES MSR, just like the below code in update_pmu_cap() does. if (!intel_pmu_broken_perf_cap()) { /* Perf Metric (Bit 15) and PEBS via PT (Bit 16) are hybrid enumeration */ rdmsrq(MSR_IA32_PERF_CAPABILITIES, hybrid(pmu, intel_cap).capabilities); } It leads to the anythread_deprecated bit is cleared to 0 and the "any" attribute is incorrectly shown in the /sys/devices/cpu/format/ folder on these support Perfmon v6 platforms, like Clearwater Forest. $ grep . /sys/devices/cpu/format/* /sys/devices/cpu/format/acr_mask:config2:0-63 /sys/devices/cpu/format/any:config:21 /sys/devices/cpu/format/cmask:config:24-31 So remove the anythread_deprecated bit from perf_capabilities structure and directly depends on CPUID.0AH:EDX[15] to judge if anythread is deprecated. Fixes: cadbaa039b99 ("perf/x86/intel: Make anythread filter support conditional") Reported-by: Namhyung Kim <namhyung@kernel.org> Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Zide Chen <zide.chen@intel.com> Reviewed-by: Thomas Falcon <thomas.falcon@intel.com> Acked-by: Namhyung Kim <namhyung@kernel.org> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260616044654.3468742-2-dapeng1.mi@linux.intel.com
2026-06-30drm/fixed: fix kernel-doc for drm_sm2fixp()Jani Nikula
Fix the kernel-doc comment for drm_sm2fixp(). Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patch.msgid.link/20260615153012.1899576-1-jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-06-30drm/dp: fix kernel-doc for struct drm_dp_as_sdpJani Nikula
Add the missing coasting_vtotal kernel-doc member documentation for struct drm_dp_as_sdp. Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patch.msgid.link/20260615153027.1899784-1-jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-06-30firmware: arm_scmi: Grammar s/may needed/may be needed/Geert Uytterhoeven
Fix grammar in the help text for the ARM_SCMI_POWER_CONTROL symbol. Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/5180d04abfb8e3074a321e2eb73bacfdd61c30c5.1780499850.git.geert+renesas@glider.be Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
2026-06-30net: libwx: fix VMDQ mask for 1-queue modeJiawen Wu
In wx_set_vmdq_queues(), the VMDQ mask was not set for the devices not supporting WX_FLAG_MULTI_64_FUNC, i.e., NGBE devices. A mask of 0 causes __ALIGN_MASK(1, ~vmdq->mask) to return 0, which incorrectly sets q_per_pool to 0 in wx_write_qde(). Fix the VMDQ 1-queue mask to 0x7F then ensures that __ALIGN_MASK(1, ~0x7F) correctly evaluates to 1. Fixes: c52d4b898901 ("net: libwx: Redesign flow when sriov is enabled") Signed-off-by: Jiawen Wu <jiawenwu@trustnetic.com> Reviewed-by: Larysa Zaremba <larysa.zaremba@intel.com> Link: https://patch.msgid.link/161F704D2C983E2C+20260626092530.551028-1-jiawenwu@trustnetic.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-30firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get()Unnathi Chalicheemala
ffa_partition_info_get() passes uuid_str directly to uuid_parse() without a NULL check. When a caller passes NULL, uuid_parse() -> __uuid_parse() -> uuid_is_valid() dereferences the pointer, causing a kernel panic: | Unable to handle kernel NULL pointer dereference at virtual address | 0000000000000040 | pc : uuid_parse+0x40/0xac | lr : ffa_partition_info_get+0x1c/0x94 [arm_ffa] Add a NULL guard before uuid_parse() so a NULL argument returns -ENODEV instead of crashing. Callers are expected to always supply a valid partition UUID, so NULL is not a supported input. Fixes: d0c0bce83122 ("firmware: arm_ffa: Setup in-kernel users of FFA partitions") Signed-off-by: Unnathi Chalicheemala <unnathi.chalicheemala@oss.qualcomm.com> Link: https://patch.msgid.link/20260617-ffa_partition_nullptr_fix-v2-1-bc801b4ce34c@oss.qualcomm.com Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
2026-06-30drm/sysfb: simpledrm: Validate mmap size against framebuffer sizeThomas Zimmermann
The size of the mmap'ed framebuffer could be smaller than the minimum required framebuffer size. Validate the resource size against the framebuffer size. Buggy firmware that triggers this check should be fixed up with a quirk on a case-by-case base. v3: - fix size checks (Sashiko) - improve error message for alignment check (Thierry) - do not store aligned size value Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Suggested-by: Sashiko <sashiko-bot@kernel.org> Reviewed-by: Thierry Reding <treding@nvidia.com> Reviewed-by: Maxime Ripard <mripard@kernel.org> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Link: https://patch.msgid.link/20260625094509.157581-6-tzimmermann@suse.de
2026-06-30drm/sysfb: simpledrm: Improve stride validationThomas Zimmermann
Validate the computed stride against the maximum value INT_MAX. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Thierry Reding <treding@nvidia.com> Reviewed-by: Maxime Ripard <mripard@kernel.org> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Fixes: 7bfa5c7b28d6 ("drm/simpledrm: Compute linestride with drm_format_info_min_pitch()") Cc: <stable@vger.kernel.org> # v6.1+ Link: https://patch.msgid.link/20260625094509.157581-5-tzimmermann@suse.de
2026-06-30drm/sysfb: simpledrm: Inline simplefb_get_validated_int()Thomas Zimmermann
The helper simplefb_get_validated_int() is only a wrapper around drm_sysfb_get_validated_int(). Inline the function into its callers. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Thierry Reding <treding@nvidia.com> Reviewed-by: Maxime Ripard <mripard@kernel.org> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Link: https://patch.msgid.link/20260625094509.157581-4-tzimmermann@suse.de
2026-06-30drm/sysfb: simpledrm: Improve panel-size validationThomas Zimmermann
Validate the panel size from the device-tree node against the limitations of struct drm_display_mode. The type only stores sizes in 16-bit fields. Fail transparently on errors; do not warn. v3: - move comments to a more prominent place (Thierry) v2: - only use initialized values in debugging output (Sashiko) Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Thierry Reding <treding@nvidia.com> Reviewed-by: Maxime Ripard <mripard@kernel.org> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Fixes: 2a6d731a8f16 ("drm/simpledrm: Allow physical width and height configuration via panel node") Cc: Rayyan Ansari <rayyan@ansari.sh> Cc: <stable@vger.kernel.org> # v6.4+ Link: https://patch.msgid.link/20260625094509.157581-3-tzimmermann@suse.de
2026-06-30drm/sysfb: simpledrm: Improve framebuffer-size validationThomas Zimmermann
Validate the framebuffer size from the firmware against the limitations of struct drm_display_mode. The type only stores sizes in 16-bit fields. Fail probing on errors. v2: - remove unused function simplefb_get_validated_int0() (Sashiko) Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Thierry Reding <treding@nvidia.com> Reviewed-by: Maxime Ripard <mripard@kernel.org> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Fixes: 11e8f5fd223b ("drm: Add simpledrm driver") Cc: <stable@vger.kernel.org> # v5.14+ Fixes: 11e8f5fd223b ("drm: Add simpledrm driver") Link: https://patch.msgid.link/20260625094509.157581-2-tzimmermann@suse.de
2026-06-30firmware: sysfb: Mark CONFIG_SYSFB_SIMPLEFB as deprecatedThomas Zimmermann
Mark CONFIG_SYSFB_SIMPLEFB as deprecated. Enabling it allows to run simpledrm and simplefb on EFI/VESA framebuffers. Doing this is discouraged in favor of using efidrm and vesadrm. v2: - resolve conflicting help texts (Sashiko) Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Link: https://patch.msgid.link/20260625065724.15794-1-tzimmermann@suse.de
2026-06-30net: airoha: fix max receive size configurationLorenzo Bianconi
Set the GDM maximum receive size to AIROHA_MAX_RX_SIZE unconditionally during hardware initialization instead of updating it according to the configured MTU. This avoids dropping incoming frames that exceed the current MTU but could still be processed by the networking stack, which is able to fragment the reply on the TX side (e.g. ICMP echo requests). Move the per-port MTU configuration to the PPE egress path where it belongs, and set the tx frame size running airoha_ppe_set_xmit_frame_size() to dynamically track the maximum MTU across running interfaces sharing the same PPE instance. Fix the PPE MTU register addressing to pack two port entries per register word and add WAN_MTU0 configuration for non-LAN GDM devices. Fixes: 54d989d58d2a ("net: airoha: Move min/max packet len configuration in airoha_dev_open()") Tested-by: Madhur Agrawal <madhur.agrawal@airoha.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260625-airoha-fix-rx-max-len-v1-1-45b9b827358d@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-30drm/i915/bios: range check LFP Data Block panel_type2Jani Nikula
While the panel_type from LFP Data Block is range checked, panel_type2 is not. Add a few helpers for range checking, and use them to not only check panel_type2, but also improve clarity and correctness in the panel type selection. Discovered using AI-assisted static analysis confirmed by Intel Product Security. v2: - Fix commit message typo (Michał) - Add is_panel_type_pnp() (Ville) Reported-by: Martin Hodo <martin.hodo@intel.com> Fixes: 6434cf630086 ("drm/i915/bios: calculate panel type as per child device index in VBT") Cc: stable@vger.kernel.org # v6.0+ Cc: Animesh Manna <animesh.manna@intel.com> Cc: Ville Syrjälä <ville.syrjala@intel.com> Reviewed-by: Michał Grzelak <michal.grzelak@intel.com> # v1 Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/20260626140155.1389655-1-jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-06-30MAINTAINERS: add myself as the maintainer for Qualcomm pin control driversBartosz Golaszewski
Linus Walleij expresed the need for a dedicated maintainer for Qualcomm pin control drivers which receive a lot more changes lately. Qualcomm volunteered me for this role so add an entry to MAINTAINERS. Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-06-30pinctrl: imx1: fix device_node leak in dt_is_flat_functions()Felix Gu
for_each_child_of_node() holds a reference on the iterator node that must be released on early return. imx1_pinctrl_dt_is_flat_functions() has two early return paths inside the loop that skip this cleanup. Replace both loops with the scoped variant so that the reference is automatically dropped when the iterator goes out of scope. Fixes: 63d2059cd665 ("pinctrl: imx1: Allow parsing DT without function nodes") Signed-off-by: Felix Gu <ustc.gu@gmail.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-06-30perf/x86/intel/uncore: Implement lazy setup for MSR/MMIO PMUsZide Chen
MSR and MMIO uncore PMUs are currently registered at module init time and appear in sysfs even when no PMU boxes are functional. Apply the same lazy registration model used by PCI uncore PMUs: the PMU is registered when the first box is successfully initialized, and unregistered when the last box exits. If a box fails to initialize on a subsequent die, the PMU is marked broken but remains registered to avoid disrupting any in-flight perf events. Box allocation and freeing remain at module init/exit time to avoid repeated kfree/alloc cycles across CPU offline/online events. Signed-off-by: Zide Chen <zide.chen@intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Link: https://patch.msgid.link/20260611160033.66760-9-zide.chen@intel.com
2026-06-30perf/x86/intel/uncore: Fix uncore_box ref/unref orderingZide Chen
In uncore_event_cpu_online(), uncore_box_ref() was called before uncore_change_context(). uncore_box_ref() gates on box->cpu >= 0, but box->cpu is still -1 at that point because uncore_change_context() has not run yet. As a result, the box is never initialized on the first CPU to come online in a die, leaving it permanently uninitialized in the single-CPU-per-die case. Thus, box->refcnt is one count below the true value, and in the CPU offline path, the box will be torn down on the second-to-last CPU. In uncore_event_cpu_offline(), uncore_box_unref() was called after uncore_change_context(), so box->cpu is already -1 when the collector CPU goes offline, which prevents it from tearing down the box. Fix by swapping the call order in both paths so that uncore_box_{ref,unref}() runs at the point where box->cpu reflects the correct context. Move allocate_boxes() out of uncore_box_ref() to enable this reordering. Fixes: c74443d92f68 ("perf/x86/uncore: Support per PMU cpumask") Signed-off-by: Zide Chen <zide.chen@intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Ian Rogers <irogers@google.com> Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Link: https://patch.msgid.link/20260611160033.66760-8-zide.chen@intel.com
2026-06-30perf/x86/intel/uncore: Introduce PMU flags and broken stateZide Chen
Replace the boolean 'registered' field in intel_uncore_pmu with an unsigned long 'flags' field, and add a PMU_BROKEN flag to track box setup failures. The broken flag is sticky, meaning it is cleared only by a module reload or system reboot. Broken PMUs are skipped in the CPU hotplug and box allocation paths. When any box fails to initialize, the PMU is marked broken. Broken PMUs reject new event assignments and skip future box setup attempts. If the PMU was already registered, it remains so to avoid disrupting in-flight events on other boxes. Signed-off-by: Zide Chen <zide.chen@intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Link: https://patch.msgid.link/20260611160033.66760-7-zide.chen@intel.com
2026-06-30perf/x86/intel/uncore: Factor out box setup codeZide Chen
The PCI uncore PMU path already implements a lazy registration model: the PMU is registered when the first active box appears and unregistered when the last active box is removed. Factor this registration management into a shared helper, so the same code can be reused by the MSR and MMIO paths in later changes. No functional change intended. Signed-off-by: Zide Chen <zide.chen@intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Ian Rogers <irogers@google.com> Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Link: https://patch.msgid.link/20260611160033.66760-6-zide.chen@intel.com
2026-06-30perf/x86/intel/uncore: Keep PCI PMUs working when MMIO/MSR setup failsZide Chen
uncore_event_cpu_online() returns -ENOMEM early when both the MSR and MMIO box allocations fail. This also aborts PCI uncore setup, even though PCI PMUs are independent of the MSR/MMIO paths. Remove the early return so PCI uncore setup always runs regardless of whether MSR or MMIO box allocation succeeds. Fixes: 3da04b8a00dd ("perf/x86/intel/uncore: Support MMIO type uncore blocks") Signed-off-by: Zide Chen <zide.chen@intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Ian Rogers <irogers@google.com> Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Link: https://patch.msgid.link/20260611160033.66760-5-zide.chen@intel.com
2026-06-30perf/x86/intel/uncore: Let init_box() callback report failuresZide Chen
The init_box() callback currently returns void, so initialization failures are silently ignored and the box is still marked initialized. Change the callback to return int so platform code can report errors back to the common uncore layer. Update uncore_box_init() to set the initialized flag only when init_box() succeeds. Because box->refcnt guarantees that at most one CPU calls uncore_box_init() for a given box at a time, plain __set_bit() is safe for the initialized flag without atomic overhead. Convert all init_box() implementations to return 0 on success or a negative error code on failure. This is a prerequisite for propagating initialization errors to the caller so they can be handled properly. Signed-off-by: Zide Chen <zide.chen@intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Ian Rogers <irogers@google.com> Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Link: https://patch.msgid.link/20260611160033.66760-4-zide.chen@intel.com
2026-06-30perf/x86/intel/uncore: Fix refcnt and other cleanupsZide Chen
Fix typo UNCORE_BOX_FLAG_INITIATED to UNCORE_BOX_FLAG_INITIALIZED. Rename the 'id' parameter in uncore_box_{ref,unref}() to 'die' to reflect its actual meaning and be consistent with other functions. box->refcnt is incremented in the PCI PMU register path but has never been checked or decremented. Although for PCI PMUs box->refcnt effectively tracks only a single user, add atomic_dec_return() in the PCI PMU unregister path to make the reference counting complete and consistent. Signed-off-by: Zide Chen <zide.chen@intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Link: https://patch.msgid.link/20260611160033.66760-3-zide.chen@intel.com
2026-06-30perf/x86/intel/uncore: Fix PCI PMU cleanup on setup failureZide Chen
When uncore_pci_pmu_register() fails, pmu->boxes[die] is set to NULL before returning. In the uncore_pci_remove() path, this causes uncore_pci_pmu_unregister() to be skipped entirely, leaking pmu->activeboxes. In the uncore_bus_notify() path, uncore_pci_pmu_unregister() may still be called and must exit early when pmu->boxes[die] is NULL to avoid a NULL pointer dereference, and to ensure activeboxes is only decremented for a previously active box. Additionally, since pci_get_drvdata() returns NULL on registration failure, uncore_pci_remove() can no longer treat NULL drvdata as an indicator of an auxiliary PCI device. Remove the associated WARN_ON_ONCE(). Signed-off-by: Zide Chen <zide.chen@intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Link: https://sashiko.dev/#/patchset/20260512233048.9577-1-zide.chen@intel.com?part=1 Link: https://patch.msgid.link/20260611160033.66760-2-zide.chen@intel.com
generated by cgit v1.2.3 (git 2.39.1) at 2026-09-22 16:59:12 +0000