summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-06-16drm/i915/mtl+: Enable PPS before PLLImre Deak
Enabling PPS after a display port's PLL is enabled leads to PLL / DDI BUF timeouts during system resuming after a long (> 45 mins) suspended state, at least on some ARL and MTL laptops, either all or some of them also containing an Nvidia GPU. Enabling PPS first and then the PLL fixes the problem for all the reporters. A similar issue is seen when enabling an external DP output on PHY B (vs. PHY A in the above eDP cases), where this change will not have any effect (since no PPS is used in that case). There isn't any direct connection between PPS and PLL, so the fix for eDP works by some side-effect only. However Bspec does seem to require enabling PPS first, so let's do that. Further investigation continues on the actual root cause and a cure for external panels. Fixes: 1a7fad2aea74 ("drm/i915/cx0: Enable dpll framework for MTL+") Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/work_items/16098 Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/work_items/16064 Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/work_items/16042 Cc: Mika Kahola <mika.kahola@intel.com> Cc: stable@vger.kernel.org # v7.0+ Tested-by: Jouni Högander <jouni.hogander@intel.com> Tested-by: Marco Nenciarini <mnencia@kcore.it> Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com> Signed-off-by: Imre Deak <imre.deak@intel.com> Link: https://patch.msgid.link/20260612172617.3427027-1-imre.deak@intel.com (cherry picked from commit 28783a274e886dd6da61419be6020bd9d0384e9f) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-06-16drm/i915: clear CRTC color blob pointers after dropping refsGuangshuo Li
intel_crtc_put_color_blobs() drops the CRTC color blob references, but leaves the corresponding pointers unchanged. This can matter in intel_crtc_prepare_cleared_state(), which frees the old CRTC hw state before calling intel_dp_tunnel_atomic_clear_stream_bw(). The latter can fail while looking up the DP tunnel group state, for example with -EDEADLK. If that happens, the function returns without completing the cleared state preparation. The failed atomic state will then be cleared by the atomic core and intel_crtc_free_hw_state() can be called again for the same state, dropping the same blob references again. Clear the blob pointers after dropping the references so repeated cleanup of the same CRTC hw state is safe. Fixes: 77fcf58df15e ("drm/i915/dp_tunnel: Fix error handling when clearing stream BW in atomic state") Suggested-by: Imre Deak <imre.deak@intel.com> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com> Reviewed-by: Imre Deak <imre.deak@intel.com> Signed-off-by: Imre Deak <imre.deak@intel.com> Link: https://patch.msgid.link/20260612035310.3013066-1-lgs201920130244@gmail.com (cherry picked from commit d5005addb5f68e8a0edce249506757bdc9e3d8c8) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-06-16drm/i915/mst: Call intel_pfit_compute_config() for sharpness filterVille Syrjälä
The sharpness filter property is on the CRTC (as opposed to the connector) so the expectation is that it's usable on all output types. Since the sharpness filter is now fully integrateds into the normal pfit code intel_pfit_compute_config() must be called from the encoder .compute_config() on all relevant output types. Sharpness filter is supported on LNL+ so only HDMI and DP SST/MST outputs are actually relevant. I already took care of HDMI and DP SST, but (as usual) forgot about DP MST. Add the missing intel_pfit_compute_config() call to make the sharpness filter operational on DP MST as well. Cc: Nemesa Garg <nemesa.garg@intel.com> Fixes: d4686f34bbeb ("drm/i915/pfit: Call intel_pfit_compute_config() unconditionally on (e)DP/HDMI") Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/20260409100841.1907-1-ville.syrjala@linux.intel.com Reviewed-by: Nemesa Garg <nemesa.garg@intel.com> (cherry picked from commit ca97f5546f191bf460b3f4b59ade3ea5e7378796) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-06-16block: invalidate cached plug timestamp after task switchUsama Arif
blk_time_get_ns() caches ktime_get_ns() in current->plug->cur_ktime and marks the task with PF_BLOCK_TS. That cache is only valid while the task keeps running; if the task is switched out, wall-clock time advances and the cached value must not be reused when the task runs again. The existing invalidation covers explicit plug flushes through __blk_flush_plug(), and the schedule() / rtmutex paths through sched_update_worker(). It does not cover in-kernel preemption paths such as preempt_schedule(), preempt_schedule_notrace(), and preempt_schedule_irq(), which enter __schedule(SM_PREEMPT) directly and return without calling sched_update_worker(). As a result, a task preempted while holding a plug with PF_BLOCK_TS set can reuse a stale plug->cur_ktime after it is scheduled back in. blk-iocost then consumes that stale timestamp through ioc_now(), producing stale vnow values for throttle decisions, and through ioc_rqos_done(), inflating on-queue time and feeding false missed-QoS samples into vrate adjustment. Move the schedule-side invalidation to finish_task_switch(), which runs for the scheduled-in task after every actual context switch regardless of which schedule entry point was used. Keep __blk_flush_plug() as the explicit flush/finish-plug invalidation path, and remove only the PF_BLOCK_TS handling from sched_update_worker(). Fixes: 06b23f92af87 ("block: update cached timestamp post schedule/preemption") Cc: stable@vger.kernel.org Signed-off-by: Usama Arif <usama.arif@linux.dev> Link: https://patch.msgid.link/20260616141604.328820-3-usama.arif@linux.dev Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-06-16kernel/fork: clear PF_BLOCK_TS in copy_process()Usama Arif
PF_BLOCK_TS is only set in blk_time_get_ns() when current->plug is non-NULL, and blk_finish_plug() clears it via __blk_flush_plug() before NULLing the plug pointer. copy_process() breaks the invariant by inheriting PF_BLOCK_TS from the parent while resetting the child's plug to NULL. Clear PF_BLOCK_TS alongside that assignment so callers can rely on "PF_BLOCK_TS set implies current->plug != NULL" and dereference current->plug unguarded. Fixes: 06b23f92af87 ("block: update cached timestamp post schedule/preemption") Cc: stable@vger.kernel.org Signed-off-by: Usama Arif <usama.arif@linux.dev> Link: https://patch.msgid.link/20260616141604.328820-2-usama.arif@linux.dev Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-06-16io_uring/register: preserve SQ array entries on resizeguzebing
Ring resizing copies pending SQEs from the old SQE array into the new one so submissions queued before the resize can still be consumed afterwards. That copy currently walks the SQ head/tail range directly. This is only correct when there is no SQ array indirection. With a regular SQ array, each pending SQ entry contains an index into the SQE array. After resize, ctx->sq_array is repointed at the newly allocated array, so pending entries lose their old logical-to-physical mapping and may submit the wrong SQE. Remember the old and new SQ arrays while migrating pending SQ entries. For each pending entry, copy the SQE selected by the old array into the new destination slot and rebuild the new array entry to point at the copied SQE. Keep invalid user-provided entries invalid so the normal submission path still drops them after resize. Fixes: 79cfe9e59c2a1 ("io_uring/register: add IORING_REGISTER_RESIZE_RINGS") Signed-off-by: guzebing <guzebing1612@gmail.com> Link: https://patch.msgid.link/20260608133316.3656440-1-guzebing1612@gmail.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-06-16block: Remove redundant plug in __submit_bio()Wen Xiong
The patch removes the automatic plug/unplug operations from __submit_bio() that were added to cache nsecs time when no explicit plug is used. The plug mechanism is most effective when batching multiple I/O operations together. Creating a plug for every bio submission provides minimal benefit while adding function call overhead and stack usage for every I/O operation. Below is performance comparison with the latest upstream kernel. Iotype qd nj rmix mpstat busy mpstat busy without plug Randrw 1 20 100 53% 24% Randrw 1 40 100 70% 24% Randrw 1 20 70 40% 24% Randrw 1 40 70 60% 26% Randrw 1 20 0 14% 6% Randrw 1 40 0 20% 7% Fixes: 060406c61c7c ("block: add plug while submitting IO") Signed-off-by: Wen Xiong <wenxiong@linux.ibm.com> Reviewed-by: Ming Lei <tom.leiming@gmail.com> Link: https://patch.msgid.link/20260616143121.878021-1-wenxiong@linux.ibm.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-06-16block: fix IORING_URING_CMD_REISSUE flags check in blkdev_uring_cmdYitang Yang
blkdev_uring_cmd() checks IORING_URING_CMD_REISSUE to determine whether this is the first issue. However, this flag lives in cmd->flags instead of issue_flags. Coincidentally, IO_URING_F_NONBLOCK shares bit 31 with IORING_URING_CMD_REISSUE. As a result, the SQE read was never performed, bic->len remained zero, and every BLOCK_URING_CMD_DISCARD failed with -EINVAL. Fix it by checking cmd->flags as intended. Cc: stable@vger.kernel.org Fixes: 212ec34e4e72 ("block: only read from sqe on initial invocation of blkdev_uring_cmd") Signed-off-by: Yitang Yang <yi1tang.yang@gmail.com> Link: https://patch.msgid.link/20260616155129.406057-1-yi1tang.yang@gmail.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-06-16Merge branch 'tls-reject-the-combination-of-tls-and-sockmap'Jakub Kicinski
Jakub Kicinski says: ==================== tls: reject the combination of TLS and sockmap There are no known TLS+sockmap users and it has some known hard to solve bugs. Let's reject this configuration as we discussed a number of times. ==================== Link: https://patch.msgid.link/20260614014102.461064-1-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-16selftests/bpf: test that TLS crypto is rejected on a sockmap socketJakub Kicinski
TLS and sockmap are mutually exclusive. We already have a test for the sockmap side rejecting kTLS, add the inverse test matching patch 1 of this series. Link: https://patch.msgid.link/20260614014102.461064-6-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-16selftests/bpf: drop the unused kTLS program from test_sockmapJakub Kicinski
With the sockmap + kTLS tests gone, the BPF-side support in test_sockmap is dead: the tls_sock_map map and bpf_prog3 (which redirected skbs into it) are no longer referenced. Remove them, along with the now-unused bpf_write_pass() helper. bpf_prog3 was progs[2], so renumber the progs[] users in test_sockmap.c: the sockops program drops to progs[2] and the sk_msg tx programs to progs[3..7]. Shrink the map/prog arrays from 9 to 8 and drop the tls_sock_map entry (the last one) from map_names[] to match. Link: https://patch.msgid.link/20260614014102.461064-5-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-16selftests/bpf: remove sockmap + ktls testsJakub Kicinski
The combination of sockmap and TLS is no longer supported - installing the TLS ULP on a sockmap socket (and vice versa) is now rejected. Remove the tests that exercise the combination along with their BPF program; the file covered nothing but sockmap sockets holding kTLS contexts. Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com> Link: https://patch.msgid.link/20260614014102.461064-4-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-16tls: remove dead sockmap (psock) handling from the SW pathJakub Kicinski
TLS and sockmap are now mutually exclusive. Try to delete the code from sendmsg and recvmsg path which is now obviously dead. The main goal is to delete enough code for AI security scanners to no longer bother us with sockmap related bugs. At the same time retain the code in case someone has the cycles to fix all of this and make the integration work, again. If the integration does not get restored we can wipe the rest of the skmsg code from TLS in two or three releases. The changes on the Tx side are deeper since that's where most of the bugs are, Rx side simply takes the data from sockmap and gives it to the user. On Tx split record handling and rolling back the iterator were the two problem areas. Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com> Reviewed-by: Sabrina Dubroca <sd@queasysnail.net> Link: https://patch.msgid.link/20260614014102.461064-3-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-16tls: reject the combination of TLS and sockmapJakub Kicinski
TLS and sockmap (BPF psock) integration hides a lot of latent bugs. Bugs which may be more or less relevant for real users but they are definitely exploitable. We could not find anyone actively using this integration so let's reject this config. Adding a TLS socket to a sockmap was already rejected by sk_psock_init() through the inet_csk_has_ulp() check. We need to reject the attempts to configure the TLS keys (rather than adding the ULP itself) because checking prior to the ULP installation is tricky without risking a race with sockmap getting added in parallel (sockmap does not hold the socket lock). This patch is a minimal rejection of the feature. Subsequent patch in the series will do a light dead code removal. Full cleanup would require a major rewrite of the Tx path, we don't need skmsg any more. Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com> Reviewed-by: Sabrina Dubroca <sd@queasysnail.net> Link: https://patch.msgid.link/20260614014102.461064-2-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-16Merge branch 'atm-remove-more-dead-code'Jakub Kicinski
Jakub Kicinski says: ==================== atm: remove more dead code Commit 6deb53595092 ("net: remove unused ATM protocols and legacy ATM device drivers") removed a good chunk of old ATM drivers. Our goal going forward is to limit the ATM support to PPPoATM used in ADSL deployments. A recent burst of AI generated fixes for net/atm/signaling.c and net/atm/svc.c made me look closer at the remaining code. PPPoATM runs over permanent virtual circuits (PF_ATMPVC) with a statically configured VPI/VCI. We can drop switched virtual circuits (SVCs) and user-space signaling (atmsigd) support. While digging around I noticed a few more obviously dead pieces of code. Annoyingly, I have applied one "fix" to QoS config which will now make net conflict with this series :/ ==================== Link: https://patch.msgid.link/20260615194416.752559-1-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-16atm: remove orphaned uAPI for deleted drivers, protocols and SVCsJakub Kicinski
ATM removals have left a number of uAPI headers and ioctl definitions with no in-kernel implementation behind them: - device headers for adapters deleted with the legacy PCI/SBUS drivers: atm_eni.h, atm_he.h, atm_idt77105.h, atm_nicstar.h, atm_zatm.h and the atmtcp pair atm_tcp.h / <linux/atm_tcp.h> - protocol headers for the removed CLIP, LANE and MPOA stacks: atmarp.h, atmclip.h, atmlec.h, atmmpc.h - atmsvc.h and the SVC / p2mp / local-address ioctls in atmdev.h (ATM_{GET,RST,ADD,DEL}ADDR, ATM_{ADD,DEL,GET}LECSADDR, ATM_{ADD,DROP}PARTY) left behind by the SVC and address-registry removals None of these are referenced by any remaining in-tree code. Let's try to delete all this. Chances are nobody cares about these headers any more. I'm keeping this separate from the kernel side code changes for ease of revert, in case I am proven wrong... Link: https://patch.msgid.link/20260615194416.752559-10-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-16atm: remove unused ATM PHY operationsJakub Kicinski
The PHY operations are vestiges of the SAR/framer split used by the removed PCI/SBUS ATM adapters: - atmdev_ops::phy_put / ::phy_get (register accessors) are never called by the core and solos-pci only listed them as NULL - struct atmphy_ops and atm_dev::phy have no users at all - nothing assigns or dereferences them Remove all of them. atm_dev::phy_data is kept: solos-pci repurposes it to stash its per-port channel index. Link: https://patch.msgid.link/20260615194416.752559-9-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-16atm: remove the unused pre_send and send_bh device operationsJakub Kicinski
atmdev_ops::pre_send (a TX pre-processing hook) and ::send_bh (a bottom-half capable send variant) have no implementation behind them: no remaining ATM driver sets either, so vcc_sendmsg() always skipped pre_send and the raw AAL0/AAL5 paths always fell back to ->send(). The drivers that used these hooks were removed with the legacy ATM adapters. Drop both operations and the dead branches that tested for them. Link: https://patch.msgid.link/20260615194416.752559-8-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-16atm: remove the unused change_qos device operationJakub Kicinski
atmdev_ops::change_qos() was the hook for renegotiating the traffic parameters of an already-connected VCC, driven from SO_ATMQOS on a connected socket (and previously from the SVC as_modify path, now gone). None of the ATM drivers left in tree implement it - solos-pci only listed change_qos = NULL - so atm_change_qos() always returned -EOPNOTSUPP. Drop the operation and return -EOPNOTSUPP directly. Link: https://patch.msgid.link/20260615194416.752559-7-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-16atm: remove SVC socket support and the signaling daemon interfaceJakub Kicinski
ATM switched virtual circuits (SVCs) are set up and torn down by a user-space signaling daemon (atmsigd) which the kernel talks to over a dedicated "sigd" socket: the kernel marshals Q.2931-style requests (as_connect, as_listen, as_accept, as_close, ...) to the daemon and applies the results to PF_ATMSVC sockets. This is the machinery behind classical SVC use and was the foundation for LANE / MPOA, all of which have been removed. DSL deployments do not use any of this. PPPoATM and BR2684 run over permanent virtual circuits (PF_ATMPVC) with a statically configured VPI/VCI; no atmsigd, no Q.2931. Neither remaining ATM driver (solos-pci, the USB DSL modems) is reachable through the SVC path. Remove the SVC socket family and the signaling interface: - delete net/atm/svc.c, net/atm/signaling.c and signaling.h - drop atmsvc_init()/atmsvc_exit() and the PF_ATMSVC registration and module alias - drop the ATMSIGD_CTRL ioctl (sigd_attach) and the /proc/net/atm/svc file - fold the SVC branch out of atm_change_qos(); all sockets are PVCs now The obsolete ATM_SETSC ioctl stub is left in place (it already just warns and returns 0), as is the struct atm_vcc SVC bookkeeping shared with the queueing layer. Link: https://patch.msgid.link/20260615194416.752559-6-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-16atm: remove the local ATM (NSAP) address registryJakub Kicinski
net/atm/addr.c maintained the per-device lists of local NSAP addresses (dev->local) and ILMI-learned LECS addresses (dev->lecs). These exist solely to serve SVC signaling: the lists are populated through the ATM_{ADD,DEL,RST}ADDR / ATM_{ADD,DEL,GET}LECSADDR ioctls used by the atmsigd / ILMI daemons, and consumed when registering addresses with the signaling daemon. The LECS list belonged to LAN Emulation, which has been removed. With no SVC users in a DSL-only configuration these lists are always empty, so drop the registry entirely: - remove the ADDR/LECSADDR/RSTADDR ioctls - drop the now-always-empty "atmaddress" sysfs attribute - remove the dev->local / dev->lecs lists, structs and enums - delete net/atm/addr.c and net/atm/addr.h The device ESI ("MAC" address) and its ATM_{G,S}ETESI ioctls and "address" sysfs attribute are retained - the USB DSL modems populate the ESI. Link: https://patch.msgid.link/20260615194416.752559-5-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-16atm: remove dead SONET PHY ioctlsJakub Kicinski
The SONET_* ioctls are SONET/SDH PHY controls that atm_dev_ioctl() and the compat path only ever forwarded to the driver's ->ioctl() handler. The PHY drivers that implemented them (the S/UNI library and the framers on the removed PCI/SBUS adapters) are gone, and neither surviving driver services them: solos-pci has no ->ioctl, and usbatm handles only ATM_QUERYLOOP. They now uniformly return an error regardless. Drop the SONET compat passthrough and the SONET cases in atm_dev_ioctl(), along with the now-unused linux/sonet.h includes. The SONET_* uAPI definitions are untouched. Link: https://patch.msgid.link/20260615194416.752559-4-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-16atm: remove the unused send_oam / push_oam callbacksJakub Kicinski
The atmdev_ops::send_oam device operation and the atm_vcc::push_oam callback were the kernel's interface for raw F4/F5 OAM cell exchange. Nothing assigns them a non-NULL value and nothing ever invokes them: the core only ever initialises push_oam to NULL (in vcc_create() and the AAL init helpers) and the Solos driver only lists send_oam = NULL for documentation. The drivers that actually drove OAM through these hooks were removed along with the legacy ATM adapters. Drop both callbacks and the NULL initialisers. Link: https://patch.msgid.link/20260615194416.752559-3-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-16atm: remove AAL3/4 transport supportJakub Kicinski
AAL3/4 is an obsolete connection-oriented ATM adaptation layer that has seen no real use since the SMDS-era hardware it was designed for (90s?). We are only maintaining ATM support in-tree to keep PPPoATM running, and PPPoATM runs over AAL5. Drop the "raw" AAL3/4 transport (atm_init_aal34()) and the ATM_AAL34 cases in the connect and traffic-parameter paths. A vcc_connect() with qos.aal == ATM_AAL34 now fails with -EPROTOTYPE. uAPI cleanup is performed later, separately. Link: https://patch.msgid.link/20260615194416.752559-2-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-16io_uring, audit: don't log IORING_OP_RECV_ZCRicardo Robaina
IORING_OP_RECV_ZC is a read operation. Audit only tracks file/socket creation, not subsequent reads. Set audit_skip to align with audit-userspace uringop_table.h. Fixes: 11ed914bbf94 ("io_uring/zcrx: add io_recvzc request") Suggested-by: Steve Grubb <sgrubb@redhat.com> Signed-off-by: Ricardo Robaina <rrobaina@redhat.com> Acked-by: Paul Moore <paul@paul-moore.com> Link: https://patch.msgid.link/20260616123632.3209545-1-rrobaina@redhat.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-06-16io_uring: get rid of tw_pending for !DEFER task workJens Axboe
The normal task_work path used a tw_pending bit to ensure the callback was only added once: the mpscq drains incrementally, so a single tctx_task_work() run can take the queue through empty -> non-empty several times, and each transition would otherwise re-add the already pending callback_head. This corrupts the task_work list, and is what tw_pending protects again. This can go away, if we stop running the task_work as soon as the queue empties. Suggested-by: Caleb Sander Mateos <csander@purestorage.com> Reviewed-by: Caleb Sander Mateos <csander@purestorage.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-06-16s390/mm: Complete ptep_get() conversionAlexander Gordeev
Finalize commit c33c794828f2 ("mm: ptep_get() conversion") and replace direct page table entry dereferencing with the proper accessors (ptep_get(), pmdp_get(), etc.). Override the default getter implementations even though they are currently identical: pud_clear(), p4d_clear(), and pgd_clear() require corresponding architecture-specific getters, but these are not yet defined. This avoids a dependency loop. Acked-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
2026-06-16RDMA/bnxt_re: Proper rollback if the ioremap failsSelvin Xavier
bnxt_qplib_alloc_dpi returns success even if ioremap fails. Add the proper rollback when the ioremap fails and return -ENOMEM status. Fixes: 0ac20faf5d83 ("RDMA/bnxt_re: Reorg the bar mapping") Fixes: 360da60d6c6e ("RDMA/bnxt_re: Enable low latency push") Link: https://patch.msgid.link/r/20260615224751.232802-11-selvin.xavier@broadcom.com Reviewed-by: Sriharsha Basavapatna <sriharsha.basavapatna@broadcom.com> Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-06-16RDMA/bnxt_re: Add a max slot check for SQSelvin Xavier
The variable WQE mode must be validated against the maximum slots supported by HW. The max supported value is 64K. Adding a max and min check and fail if user supplied value is more than the max supported and zero. Fixes: d8ea645d6984 ("RDMA/bnxt_re: Handle variable WQE support for user applications") Link: https://patch.msgid.link/r/20260615224751.232802-10-selvin.xavier@broadcom.com Reviewed-by: Sriharsha Basavapatna <sriharsha.basavapatna@broadcom.com> Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-06-16RDMA/bnxt_re: Avoid displaying the kernel pointerSelvin Xavier
While dumping the info on MR using the rdma tool, we dump the mr_hwq which is a kernel pointer. There is no need to expose this value for end user. So avoid it. Fixes: 7363eb76b7f3 ("RDMA/bnxt_re: Support driver specific data collection using rdma tool") Link: https://patch.msgid.link/r/20260615224751.232802-9-selvin.xavier@broadcom.com Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com> Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-06-16RDMA/bnxt_re: Free CQ toggle page after firmware teardownSelvin Xavier
Free the toggle page only after firmware teardown completes so that an NQ interrupt arriving during bnxt_qplib_destroy_cq() won't write the toggle value to an already-freed page. Move free_page() after bnxt_qplib_destroy_cq. Fixes: e275919d9669 ("RDMA/bnxt_re: Share a page to expose per CQ info with userspace") Link: https://patch.msgid.link/r/20260615224751.232802-4-selvin.xavier@broadcom.com Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-06-16RDMA/bnxt_re: Free SRQ toggle page after firmware teardownSelvin Xavier
Free the toggle page only after firmware teardown completes so that an NQ interrupt arriving during bnxt_qplib_destroy_srq() won't write the toggle values to an already-freed page. Move free_page() after bnxt_qplib_destroy_srq(). Fixes: 181028a0d84c ("RDMA/bnxt_re: Share a page to expose per SRQ info with userspace") Link: https://patch.msgid.link/r/20260615224751.232802-3-selvin.xavier@broadcom.com Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-06-16RDMA/bnxt_re: Initialize dpi variable to zeroSelvin Xavier
dpi is initialized only for BNXT_RE_ALLOC_WC_PAGE, but copied for all the cases. So initialize the dpi to 0. Fixes: eee6268421a2 ("RDMA/bnxt_re: Move the UAPI methods to a dedicated file") Fixes: 360da60d6c6e ("RDMA/bnxt_re: Enable low latency push") Link: https://patch.msgid.link/r/20260615224751.232802-2-selvin.xavier@broadcom.com Reviewed-by: Anantha Prabhu <anantha.prabhu@broadcom.com> Signed-off-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com> Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-06-16Merge branch 'idle-time-acc' into featuresAlexander Gordeev
Heiko Carstens says: =================== This is supposed to improve s390 idle time accounting, and brings it back to the state it was before arch_cpu_idle_time() was removed from s390 [3]. In result all cpu time accounting is done by the s390 architecture backend again, instead of having a mix of architecure specific and common code accounting (common code: idle, s390 architecture: everything else). =================== Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
2026-06-16dt-bindings: interrupt-controller: qcom,pdc: Add Maili compatible stringYijie Yang
Register qcom,maili-pdc as a supported compatible string for the Qualcomm PDC interrupt controller binding. Signed-off-by: Yijie Yang <yijie.yang@oss.qualcomm.com> Link: https://patch.msgid.link/20260615-maili-pdc-v1-1-add21e8eec3e@oss.qualcomm.com Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2026-06-16regcache: Do not overwrite error code when finalizing cache after errorFrancesco Lavra
During regcache initialization, if an error occurs in the cache_ops->populate callback, and if cache operations include an exit callback, the error code from populate() is overwritten with the return value from exit(). This hides the error condition from the caller of regcache_init(), and can cause NULL pointer dereferences when the regcache is later accessed. Fixes: 94a3a95f0315 ("regcache: Add ->populate() callback to separate from ->init()") Signed-off-by: Francesco Lavra <flavra@baylibre.com> Link: https://patch.msgid.link/20260616114429.1852456-1-flavra@baylibre.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-06-16dt-bindings: i2c: i2c-mux-pinctrl: change maintainerWolfram Sang
The YAML conversion added me as maintainer but I can't recall being asked nor do I want to maintain it. Thierry has created the YAML file and works for the company which contributed the driver. Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Acked-by: Conor Dooley <conor.dooley@microchip.com> Acked-by: Thierry Reding <thierry.reding@kernel.org> Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Andi Shyti <andi.shyti@kernel.org> Link: https://lore.kernel.org/r/20260616060910.1480-2-wsa+renesas@sang-engineering.com
2026-06-16dt-bindings: i2c: convert i2c-mux-reg to DT schemaAbdurrahman Hussain
Convert Documentation/devicetree/bindings/i2c/i2c-mux-reg.txt to the YAML schema so the i2c-mux-reg binding is validated by dt_binding_check. Faithful port of the existing properties; no semantic change. Signed-off-by: Abdurrahman Hussain <abdurrahman@nexthop.ai> Acked-by: Conor Dooley <conor.dooley@microchip.com> Signed-off-by: Andi Shyti <andi.shyti@kernel.org> Link: https://lore.kernel.org/r/20260608-i2c-mux-reg-base-bus-num-v2-1-776e313f213a@nexthop.ai
2026-06-16i2c: davinci: Unregister cpufreq notifier on probe failureHaoxiang Li
davinci_i2c_probe() registers a cpufreq transition notifier before adding the I2C adapter. If i2c_add_numbered_adapter() fails, the probe error path releases the device resources without unregistering the notifier. Add a dedicated error path to unregister the cpufreq notifier after i2c_add_numbered_adapter() fails. Fixes: 82c0de11b734 ("i2c: davinci: Add cpufreq support") Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com> Cc: <stable@vger.kernel.org> # v2.6.36+ Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Signed-off-by: Andi Shyti <andi.shyti@kernel.org> Link: https://lore.kernel.org/r/20260610030513.2651018-1-haoxiang_li2024@163.com
2026-06-16i2c: qcom-cci: Remove overcautious disable_irq() callsVladimir Zapolskiy
In cci_probe() the controller's interrupt is requested using a devres managed API, and in cci_probe() error path and cci_remove() it'd be safe to rely on devres mechanism to free and shutdown the interrupt, thus explicit disable_irq() calls can be removed as unnecessary ones. Signed-off-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org> Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Andi Shyti <andi.shyti@kernel.org> Link: https://lore.kernel.org/r/20260515234121.1607425-5-vladimir.zapolskiy@linaro.org
2026-06-16i2c: qcom-cci: Move cci_init() under cci_reset() functionVladimir Zapolskiy
On probe or runtime errors cci_reset() is called and it should be coupled with cci_init(), instead of doing this on caller's side, embed cci_init() directly into the cci_reset() function. This is a non-functional change, cci_reset() and cci_init() function bodies are reordered. Signed-off-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org> Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Andi Shyti <andi.shyti@kernel.org> Link: https://lore.kernel.org/r/20260515234121.1607425-4-vladimir.zapolskiy@linaro.org
2026-06-16i2c: qcom-cci: Do not check return value of cci_init()Vladimir Zapolskiy
The cci_init() function is not supposed to fail, and it never returns a non-zero, so it'd make sense to convert its signature to void. Signed-off-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org> Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Andi Shyti <andi.shyti@kernel.org> Link: https://lore.kernel.org/r/20260515234121.1607425-3-vladimir.zapolskiy@linaro.org
2026-06-16Merge tag 'trace-tools-v7.2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull RTLA tool updates from Steven Rostedt: - Fix discrepancy in --dump-tasks option Due to a mistake, rtla-timerlat-hist used the CLI syntax "--dump-task" instead of the documented "--dump-tasks". Change the option to match both documentation and the other timerlat tool, rtla-timerlat-top. - Extend coverage of runtime tests Cover both top and hist tools in all applicable test cases, add tests for a few uncovered options, and extend checks for some existing tests. - Add unit tests for actions rtla's actions feature is implemented in its source file and contains non-trivial parsing logic. Cover it with unit tests. - Stop record trace on interrupt Fix a bug where an interval exists after receiving a signal in which the main instance is stopped but the record instance is not, leading to discrepancies in reported results and sometimes rtla hanging. - Restore continue flag in actions_perform() Fix a bug where rtla always continues tracing after hitting a threshold even if the continue action was triggered just once, and add tests verifying that the flag is reset properly. - Migrate command line interface to libsubcmd Replace rtla's argument parsing using getopt_long() with libsubcmd, used by perf and objtool, to reuse existing code and auto-generate better help messages. Extensive unit tests are included to detect regressions. - Add -A/--aligned option to timerlat tools Add an option to align timerlat threads, based on the recently introduced TIMERLAT_ALIGN option of the timerlat tracer, together with unit tests and documentation. - Document tests in README Document how to run unit and runtime tests in rtla's README.txt, including the dependencies needed to run them. * tag 'trace-tools-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (26 commits) rtla: Document tests in README Documentation/rtla: Add -A/--aligned option rtla/tests: Add unit tests for -A/--aligned option rtla/timerlat: Add -A/--aligned CLI option rtla/tests: Add unit tests for CLI option callbacks rtla/tests: Add unit tests for _parse_args() functions rtla: Parse cmdline using libsubcmd tools subcmd: allow parsing distinct --opt and --no-opt tools subcmd: support optarg as separate argument rtla: Add libsubcmd dependency rtla/tests: Add runtime tests for restoring continue flag rtla/tests: Run runtime tests in temporary directory rtla/tests: Add unit test for restoring continue flag rtla/actions: Restore continue flag in actions_perform() rtla: Stop the record trace on interrupt rtla/tests: Add unit tests for actions module rtla/tests: Add runtime tests for -C/--cgroup rtla/tests: Add runtime test for -k and -u options rtla/tests: Add runtime test for -H/--house-keeping rtla/tests: Cover all hist options in runtime tests ...
2026-06-16io_uring/rw: preserve partial result for iopollMichael Wigham
A partial read will store the completed byte count in io->bytes_done. The regular completion path applies io_fixup_rw_res() so that, when the following operation reaches EOF, the number of bytes already read is returned. The iopoll completion path does not apply this fixup to the return value and can return zero instead. Use the fixup result when updating the CQE, and the raw result for the reissue check. Cc: stable@vger.kernel.org Fixes: 4d9cb92ca41d ("io_uring/rw: fix short rw error handling") Signed-off-by: Michael Wigham <michael@wigham.net> Link: https://patch.msgid.link/20260613225240.34032-1-michael@wigham.net Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-06-16io_uring/nop: fix file reference leak with IOSQE_FIXED_FILEVasileios Almpanis
NOP file-acquisition support choses between a fixed (registered) file and a normal fget()'d file based on its own IORING_NOP_FIXED_FILE flag in sqe->nop_flags. However, a request's REQ_F_FIXED_FILE is set independently from the generic IOSQE_FIXED_FILE sqe flag during request init, before the issue handler runs. If a NOP is submitted with IOSQE_FIXED_FILE set (so REQ_F_FIXED_FILE is set) but without IORING_NOP_FIXED_FILE, io_nop() takes the normal path and grabs a real reference via io_file_get_normal(). On completion, io_put_file() only drops the reference when REQ_F_FIXED_FILE is clear, so the fget()'d file is never released and leaks: BUG: memory leak unreferenced object 0xffff88800f42c240 (size 176): kmem_cache_alloc_noprof+0x358/0x440 alloc_empty_file+0x57/0x180 path_openat+0x44/0x1e50 do_file_open+0x121/0x200 do_sys_openat2+0xa7/0x150 __x64_sys_openat+0x82/0xf0 Decide between fixed and normal file acquisition from REQ_F_FIXED_FILE, the same way io_assign_file() does for every other opcode, and fold IORING_NOP_FIXED_FILE into REQ_F_FIXED_FILE at prep time. Cc: stable@vger.kernel.org Fixes: a85f31052bce ("io_uring/nop: add support for testing registered files and buffers") Reported-by: syzbot+2cd473471e77bda12b0e@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?id=879092631b98f73a28ea405adacfa5bb34a14a25 Signed-off-by: Vasileios Almpanis <vasilisalmpanis@gmail.com> Link: https://patch.msgid.link/20260615144619.482749-1-vasilisalmpanis@gmail.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-06-16Merge tag 'trace-latency-v7.2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing latency updates from Steven Rostedt: - Dump the stack to the buffer on timerlat uret threashold event Record the stack trace in the buffer for THREAD_URET as well as THREAD_CONTEXT when the threshold is hit. Otherwise, if the threshold was not hit at task wakeup, but was at task return, it will not produce a stack trace making it harder to debug. - Have osnoise trace prints print to all buffers The osnoise tracer is allowed to print to the main buffer. Add a osnoise_print() helper function and use trace_array_vprintk() to print osnoise output. * tag 'trace-latency-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing/osnoise: Array printk init and cleanup tracing/osnoise: Dump stack on timerlat uret threshold event
2026-06-16Merge tag 'probes-v7.2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull probes updates from Masami Hiramatsu: - BTF support for dereferencing pointers Add syntax to the parsing of eprobes to typecast structure pointer trace event fields, enabling BTF-based dereferencing instead of relying on manual offsets. - Improvements and robustness enhancements - Use flexible array for entry fetch code. Store probe entry fetch instructions in the probe_entry_arg allocation via a flexible array member to simplify memory allocation and lifetime management. - Replace BUG_ON with lockdep_assert_held in uprobe_buffer functions Replace BUG_ON() calls with lockdep_assert_held() in uprobe buffer enable/disable paths to prevent kernel crashes and better verify lock ownership. - Ensure the uprobe buffer size is bigger than event size. Add a BUILD_BUG_ON() assertion to guarantee that the per-CPU uprobe working buffer size is always larger than the maximum probe event size. * tag 'probes-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing/eprobes: Allow use of BTF names to dereference pointers tracing: Replace BUG_ON with lockdep_assert_held in uprobe_buffer functions tracing: Use flexible array for entry fetch code tracing/probes: Ensure the uprobe buffer size is bigger than event size
2026-06-16Merge tag 'bootconfig-v7.2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull bootconfig updates from Masami Hiramatsu: - bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c Move the xbc_snprint_cmdline() function and its buffer from main.c to the shared lib/bootconfig.c parser library so it can be reused by userspace tools. - render kernel.* subtree as cmdline string with -C Add a new -C option to print the kernel.* subtree as a flat command-line string at build time, allowing early parameter injection without runtime parsing. * tag 'bootconfig-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tools/bootconfig: render kernel.* subtree as cmdline string with -C bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c
2026-06-16Merge tag 'linux_kselftest-next-7.2-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kselftest updates from Shuah Khan: "Several fixes and improvements to resctrl tests and a change to kselftest document to clarify the use of FORCE_TARGETS build variable" * tag 'linux_kselftest-next-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: kselftest: fix doc for ksft_test_result_report() selftests/resctrl: Reduce L2 impact on CAT test selftests/resctrl: Simplify perf usage in CAT test selftests/resctrl: Remove requirement on cache miss rate selftests/resctrl: Raise threshold at which MBM and PMU values are compared selftests/resctrl: Increase size of buffer used in MBM and MBA tests selftests/resctrl: Support multiple events associated with iMC selftests/resctrl: Prepare for parsing multiple events per iMC selftests/resctrl: Do not store iMC counter value in counter config structure selftests/resctrl: Reduce interference from L2 occupancy during cache occupancy test selftests/resctrl: Improve accuracy of cache occupancy test docs: kselftest: Document the FORCE_TARGETS build variable
2026-06-16Merge tag 'linux_kselftest-kunit-7.2-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kunit updates from Shuah Khan: "Fixes to tool and kunit core and new features to both to support JUnit XML (primitive) and backtrace suppression API: - Core support for suppressing warning backtraces - Parse and print the reason tests are skipped - Add (primitive) support for outputting JUnit XML - Don't write to stdout when it should be disabled - Add backtrace suppression self-tests - Suppress intentional warning backtraces in scaling unit tests - Add documentation for warning backtrace suppression API - Fix spelling mistakes in comments and messages - gen_compile_commands: Ignore libgcc.a - qemu_configs: Add or1k / openrisc configuration" * tag 'linux_kselftest-kunit-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: kunit:tool: Don't write to stdout when it should be disabled kunit: tool: Add (primitive) support for outputting JUnit XML kunit: tool: Parse and print the reason tests are skipped kunit: Add documentation for warning backtrace suppression API drm: Suppress intentional warning backtraces in scaling unit tests kunit: Add backtrace suppression self-tests bug/kunit: Core support for suppressing warning backtraces kunit: Fix spelling mistakes in comments and messages kunit: qemu_configs: Add or1k / openrisc configuration gen_compile_commands: Ignore libgcc.a