summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-06-11RDMA/mlx5: Report packet pacing capabilities when querying deviceMaher Sanalla
When querying device, report packet pacing capabilities for UD and UC QPs when device supports it. Signed-off-by: Maher Sanalla <msanalla@nvidia.com> Reviewed-by: Michael Guralnik <michaelgur@nvidia.com> Signed-off-by: Edward Srouji <edwards@nvidia.com> Link: https://patch.msgid.link/20260524-packet-pacing-v1-5-3d79439f8d08@nvidia.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-06-11RDMA/mlx5: Support deferred rate limit configurationMaher Sanalla
Allow passing a rate limit attribute in modify QP flows even when the QP is in a state that does not support packet pacing programming in the lower layers. When the user sets a rate limit during a QP transition that is not to RTS, store the value in the mlx5 QP struct and program it to FW when the QP later transitions to RTS, which is the state that allows configuring the rate limit index in the QP context. Signed-off-by: Maher Sanalla <msanalla@nvidia.com> Reviewed-by: Michael Guralnik <michaelgur@nvidia.com> Signed-off-by: Edward Srouji <edwards@nvidia.com> Link: https://patch.msgid.link/20260524-packet-pacing-v1-4-3d79439f8d08@nvidia.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-06-11RDMA/mlx5: Add support for rate limit in UD and UC QPsMaher Sanalla
Rate limiting is currently supported only for raw packet QPs, where the packet pacing index is programmed into the SQC during SQ modify. Extend rate limit support to UD and UC QPs by setting the pacing index in the QPC during RTR2RTS and RTS2RTS transitions. Signed-off-by: Maher Sanalla <msanalla@nvidia.com> Reviewed-by: Michael Guralnik <michaelgur@nvidia.com> Signed-off-by: Edward Srouji <edwards@nvidia.com> Link: https://patch.msgid.link/20260524-packet-pacing-v1-3-3d79439f8d08@nvidia.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-06-11RDMA/mlx5: Refactor raw packet QP rate limit handlingMaher Sanalla
Refactor the raw packet QP modify path to extract rate limit configuration into a qp_rl_parse() helper that parses user attributes, and a qp_rl_prepare() helper that handles FW rate limit table adjustments before the SQ modify itself. Use qp_rl_commit() to commit changes to QP once FW call succeeds, and qp_rl_rollback() to rollback changes done to the FW rate limit table in the prepare stage, in case the modify operation fails. These helpers will be reused for extending rate limit support to additional QP types in the following patch. Signed-off-by: Maher Sanalla <msanalla@nvidia.com> Reviewed-by: Michael Guralnik <michaelgur@nvidia.com> Signed-off-by: Edward Srouji <edwards@nvidia.com> Link: https://patch.msgid.link/20260524-packet-pacing-v1-2-3d79439f8d08@nvidia.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-06-11net/mlx5: Add UD and UC packet pacing capsMaher Sanalla
Add the needed capabilities in mlx5_ifc to support packet pacing for UC and UD QPs. Signed-off-by: Maher Sanalla <msanalla@nvidia.com> Reviewed-by: Michael Guralnik <michaelgur@nvidia.com> Signed-off-by: Edward Srouji <edwards@nvidia.com> Link: https://patch.msgid.link/20260524-packet-pacing-v1-1-3d79439f8d08@nvidia.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-06-11phy: freescale: phy-fsl-imx8qm-lvds-phy: Use synchronous PM runtime put in resetFelix Gu
The mixel_lvds_phy_reset() function pairs pm_runtime_resume_and_get() with pm_runtime_put(). The asynchronous variant queues a work item to handle the idle check and potential suspend, which can be cancelled by a subsequent pm_runtime_disable() call if probe fails after the reset. Switch to pm_runtime_put_sync() to run the idle check and suspend synchronously. Fixes: 06ff622d61d2 ("phy: freescale: Add i.MX8qm Mixel LVDS PHY support") Reported-by: sashiko <sashiko-bot@kernel.org> Closes: https://sashiko.dev/#/patchset/20260605-lvds-v2-1-3ce7539d1104%40gmail.com Signed-off-by: Felix Gu <ustc.gu@gmail.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260609-lvds-phy-v1-1-6ad790c6d0ea@gmail.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-06-11octeontx2-af: fix IP fragment flag corruption on custom KPU profile loadKiran Kumar K
npc_cn20k_apply_custom_kpu() overwrites KPU profile entries with custom firmware values and then calls npc_cn20k_update_action_entries_n_flags() over all entries. Since the same function already ran during default profile initialisation, entries not overridden by the custom firmware get their flags translated twice, corrupting the CN20K-specific values. Fix this by extracting the per-entry translation into a helper npc_cn20k_translate_action_flags() and calling it as each custom entry is loaded, removing the redundant batch call at the end. Fixes: ef992a0f12e8 ("octeontx2-af: npc: cn20k: MKEX profile support") Cc: Suman Ghosh <sumang@marvell.com> Signed-off-by: Kiran Kumar K <kirankumark@marvell.com> Signed-off-by: Nitin Shetty J <nshettyj@marvell.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260608095455.1499203-1-nshettyj@marvell.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-11Merge branch 'net-shaper-follow-ups-to-recent-fixes'Paolo Abeni
Jakub Kicinski says: ==================== net: shaper: follow ups to recent fixes As discussed previously on the patch set with real fixes the xa_locking in shapers is a little confusing, remove it. Link: https://lore.kernel.org/20260506000628.1501691-2-kuba@kernel.org The remaining three patches are an attempt to silence AI reviewers, I believe Sashiko was complaining about these non-issues. Not adding Reported tags since these are false positives. ==================== Link: https://patch.msgid.link/20260609183224.1108521-1-kuba@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-11net: shaper: add a note that we expect cap dumps to be tinyJakub Kicinski
Various AI scan tools may complain that we don't support resuming the cap dump. This is true, but the cap dumps are tiny. net_shaper_nl_cap_pre_dumpit() sets up the dump for just one device, so the size of the dump scales with NET_SHAPER_SCOPE_MAX (3). We don't expect them to ever need more than a 4kB page. Document this. Signed-off-by: Jakub Kicinski <kuba@kernel.org> Link: https://patch.msgid.link/20260609183224.1108521-5-kuba@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-11net: shaper: add a comment why we don't need kfree_rcu() in flushJakub Kicinski
We keep getting misguided patches to fix the flush. Add a comment. Signed-off-by: Jakub Kicinski <kuba@kernel.org> Link: https://patch.msgid.link/20260609183224.1108521-4-kuba@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-11net: shaper: drop unnecessary kfree_rcu in pre_insertJakub Kicinski
If we fail to insert a node into the XArray in net_shaper_pre_insert() we can free it directly - it was never visible to the RCU readers. Signed-off-by: Jakub Kicinski <kuba@kernel.org> Link: https://patch.msgid.link/20260609183224.1108521-3-kuba@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-11net: shaper: drop redundant xa_lock() bracketingJakub Kicinski
The shaper insertion and update code takes xa_lock() explicitly. Paolo explained that the locking was purely to avoid re-taking the lock in loops. But it may be mis-read as if it was expecting readers to be fenced off by xa_lock. Readers of XArray are purely under RCU. Remove explicit taking of xa_lock(). All writers to hierarchy->shapers are serialized by the netdev instance lock (or run after netdev is made inaccessible to readers). Signed-off-by: Jakub Kicinski <kuba@kernel.org> Link: https://patch.msgid.link/20260609183224.1108521-2-kuba@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-11Merge tag 'nf-26-06-10' of ↵Paolo Abeni
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) Revalidate bridge ports, add missing NULL checks to fetch the bridge device by the port. From Florian Westphal. 2) Fix netdevice refcount leak in the error path of nft_fwd hardware offload function, also from Florian. 3) Unregister helper expectfn callback on conntrack helper module removal, otherwise dangling pointer remains in place, from Weiming Shi. 4) Fix possible pointer infoleak in getsockopt() IPT_SO_GET_ENTRIES, From Kyle Zeng. 5) Validate that device MAC header is present before nf_syslog accesses it. From Xiang Mei. 6-8) Three patches to address a possible infoleak of stale stack data in three nf_tables expressions, due to mismatch in the _init() and _eval() function which is possible since 14fb07130c7d. From Davide Ornaghi and Florian Westphal. netfilter pull request 26-06-10 * tag 'nf-26-06-10' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register netfilter: nft_fib: fix stale stack leak via the OIFNAME register netfilter: nft_exthdr: fix register tracking for F_PRESENT flag netfilter: nf_log: validate MAC header was set before dumping it netfilter: x_tables: avoid leaking percpu counter pointers netfilter: nf_conntrack: destroy stale expectfn expectations on unregister netfilter: nf_tables_offload: drop device refcount on error netfilter: revalidate bridge ports ==================== Link: https://patch.msgid.link/20260610161629.214092-1-pablo@netfilter.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-11ASoC: loongson: Fix invalid position error in ls_pcm_pointerLi Jun
The "invalid position" error occurred when the DMA position descriptor returned an invalid address value (e.g., pos = -1048838144). This happened because the `bytes_to_frames()` function returns a signed value, but when `addr < runtime->dma_addr`, the subtraction produces a negative result that gets interpreted as a large unsigned integer in comparisons. when the addr is abnormal, for example,the DMA controller is abnormal in hardware,x=0 should not be a point(x == runtime->buffer_size),but a range, which includes the addr address being less than runtime ->dma1-adr, and the addr exceeding the DMA address range.the value of pos should not better a negative,return 0, maybe better. [ 32.834431][ 2] soc-audio soc-audio: invalid position: , pos = -1048838144 [ 32.845019][ 2] soc-audio soc-audio: invalid position: , pos = -1048838144 [ 32.855588][ 2] soc-audio soc-audio: invalid position: , pos = -1048838144 [ 32.866145][ 2] soc-audio soc-audio: invalid position: , pos = -1048838144 [ 32.995394][ 2] soc-audio soc-audio: invalid position: , pos = -1048838144 [ 33.006025][ 2] soc-audio soc-audio: invalid position: , pos = -1048838144 [ 33.016748][ 2] soc-audio soc-audio: invalid position: , pos = -1048838144 Signed-off-by: Li Jun <lijun01@kylinos.cn> [Remove XRUN reporting I'd mistakenly avised adding on prior review -- broonie] Link: https://patch.msgid.link/20260611010045.3668574-1-lijun01@kylinos.cn Signed-off-by: Mark Brown <broonie@kernel.org>
2026-06-11Merge branch 'net-rds-convert-rds-to-getsockopt_iter'Paolo Abeni
Breno Leitao says: ==================== net: rds: convert rds to getsockopt_iter This series continues the conversion of the remaining proto_ops getsockopt callbacks to the new getsockopt_iter callback introduced in commit 67fab22a7adc ("net: add getsockopt_iter callback to proto_ops"), this time for RDS. RDS is a little more involved than the protocols converted so far, because the RDS_INFO_* options snapshot kernel state directly into the destination buffer: the info producers memcpy into the pages under a spinlock via kmap_atomic() and so must not fault. The conversion preserves that model — it obtains the same page array and starting offset from opt->iter_out with iov_iter_extract_pages(), preallocating the array so the iterator fills it in place, and leaves the rds_info_iterator / rds_info_copy machinery and all producer callbacks unchanged; kernel (ITER_KVEC) buffers remain unsupported on the RDS_INFO path, as before. I've vibe-coded a kselftest exercising both the simple options and the RDS_INFO_* snapshot path, feel free to drop it in case this is not useful. Signed-off-by: Breno Leitao <leitao@debian.org> ==================== Link: https://patch.msgid.link/20260608-getsock_more-v3-0-706ecf2ea332@debian.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-11rds: convert to getsockopt_iterBreno Leitao
Convert RDS socket's getsockopt implementation to use the new getsockopt_iter callback with sockopt_t. Key changes: - Replace (char __user *optval, int __user *optlen) with sockopt_t *opt - Use opt->optlen for buffer length (input) and returned size (output) - Use copy_to_iter() instead of put_user()/copy_to_user() The RDS_INFO_* snapshot path in rds_info_getsockopt() used to pin the userspace buffer with pin_user_pages_fast() on the raw optval address; the info producers then memcpy into those pages under a spinlock via kmap_atomic() and so must not fault. Obtain the same page array and starting offset from opt->iter_out with iov_iter_extract_pages(), which pins for write because iter_out is ITER_DEST. The page array is preallocated here (sized with iov_iter_npages()) and passed in, so iov_iter_extract_pages() fills it in place rather than allocating one for us; RDS therefore keeps ownership of the array on every return path and frees it itself. The rds_info_iterator / rds_info_copy machinery and all producer callbacks are unchanged. Kernel buffers (ITER_KVEC) are not page-backed in a way the info producers can use, so the RDS_INFO path returns -EOPNOTSUPP for them; this matches the previous behaviour, where a kernel-buffer getsockopt hit the WARN_ONCE() path in do_sock_getsockopt() and returned -EOPNOTSUPP. The simple RDS_RECVERR and SO_RDS_TRANSPORT options keep working for kernel buffers via copy_to_iter(). Signed-off-by: Breno Leitao <leitao@debian.org> Reviewed-by: Allison Henderson <achender@kernel.org> Link: https://patch.msgid.link/20260608-getsock_more-v3-2-706ecf2ea332@debian.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-11selftests: net: rds: add getsockopt() conversion testBreno Leitao
Add a kselftest that exercises the RDS getsockopt() paths converted to the getsockopt_iter() / sockopt_t callback: - RDS_RECVERR and SO_RDS_TRANSPORT, which return their int value through copy_to_iter() and report the written length in opt->optlen. - RDS_INFO_*, which obtains the userspace buffer pages with iov_iter_extract_pages() (including a non-zero starting page offset) and lets the info producers copy the snapshot in under a spinlock. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Breno Leitao <leitao@debian.org> Reviewed-by: Allison Henderson <achender@kernel.org> Link: https://patch.msgid.link/20260608-getsock_more-v3-1-706ecf2ea332@debian.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-11Merge tag 'ipsec-2026-06-10' of ↵Paolo Abeni
git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec Steffen Klassert says: ==================== pull request (net): ipsec 2026-06-10 1) xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags() Propagate SKBFL_SHARED_FRAG when paged fragments are moved between skbs so ESP can decide whether in-place crypto is safe. 2) xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload Replace the unlocked read of xtfs->ra_newskb with a local flag so a concurrent reassembly can no longer free first_skb between spin_unlock and the post-loop check. 3) xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() Prune the inexact bin under xfrm_policy_lock so a concurrent xfrm_hash_rebuild() can no longer free it before xfrm_policy_kill() dereferences it. 4) xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state() Move hrtimer_cancel() for the output and drop timers ahead of their spinlocks, breaking the softirq/lock cycle that could deadlock against the timer callbacks on SMP. 5) xfrm: espintcp: do not reuse an in-progress partial send Fail a new send when espintcp_push_msgs() returns with emsg->len still set, so a blocking caller can no longer overwrite ctx->partial while a previous transfer still owns it. 6) esp: fix page frag reference leak on skb_to_sgvec failure Add a flag to esp_ssg_unref() to unconditionally unref the source scatterlist, releasing the old page references that are otherwise leaked when the second skb_to_sgvec() in esp_output_tail() fails. Please pull or let me know if there are problems. ipsec-2026-06-10 * tag 'ipsec-2026-06-10' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec: esp: fix page frag reference leak on skb_to_sgvec failure xfrm: espintcp: do not reuse an in-progress partial send xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state() xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags() ==================== Link: https://patch.msgid.link/20260610140800.2562818-1-steffen.klassert@secunet.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-11ipv6: Fix a potential NPD in cleanup_prefix_route()Ido Schimmel
addrconf_get_prefix_route() can return the fib6_null_entry sentinel entry which has a NULL fib6_table pointer. Therefore, before setting the route's expiration time, check that we are not working with this entry, as otherwise a NPD will be triggered [1]. Note that the other callers of addrconf_get_prefix_route() are not susceptible to this bug: 1. addrconf_prefix_rcv(): Requests a route with the 'RTF_ADDRCONF | RTF_PREFIX_RT' flags which are not set on fib6_null_entry. 2. modify_prefix_route(): Fixed by commit a747e02430df ("ipv6: avoid possible NULL deref in modify_prefix_route()"). 3. __ipv6_ifa_notify(): Calls ip6_del_rt() which specifically checks for fib6_null_entry and returns an error. [1] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] [...] Call Trace: <TASK> __kasan_check_byte (mm/kasan/common.c:573) lock_acquire.part.0 (kernel/locking/lockdep.c:5842 (discriminator 1)) _raw_spin_lock_bh (kernel/locking/spinlock.c:182 (discriminator 1)) cleanup_prefix_route (net/ipv6/addrconf.c:1280) ipv6_del_addr (net/ipv6/addrconf.c:1342) inet6_addr_del.isra.0 (net/ipv6/addrconf.c:3119) inet6_rtm_deladdr (net/ipv6/addrconf.c:4812) rtnetlink_rcv_msg (net/core/rtnetlink.c:6997) netlink_rcv_skb (net/netlink/af_netlink.c:2555) netlink_unicast (net/netlink/af_netlink.c:1344) netlink_sendmsg (net/netlink/af_netlink.c:1899) __sock_sendmsg (net/socket.c:802 (discriminator 4)) ____sys_sendmsg (net/socket.c:2698) ___sys_sendmsg (net/socket.c:2752) __sys_sendmsg (net/socket.c:2784) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Fixes: 5eb902b8e719 ("net/ipv6: Remove expired routes with a separated list of routes.") Reported-by: Ji'an Zhou <eilaimemedsnaimel@gmail.com> Reviewed-by: David Ahern <dahern@nvidia.com> Signed-off-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260609145448.768318-1-idosch@nvidia.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-11Merge branch 'selftests-drv-net-so_txtime-trivial-fixes'Paolo Abeni
Jakub Kicinski says: ==================== selftests: drv-net: so_txtime: trivial fixes I noticed that so_txtime is only passing on NIPA setups which are looped within a single host. The cross-machine cases just flat out fail. The initial bug is obvious - the test does not deploy the binary. But even with that I think more work would be needed to sync the time / adjust the expectations for a dual-machine test. Willem promised to follow up on the fundamental issues with 2-host setups :) v1: https://lore.kernel.org/20260608173305.372987-1-kuba@kernel.org ==================== Link: https://patch.msgid.link/20260609180803.1093428-1-kuba@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-11selftests: drv-net: so_txtime: check IP versionsJakub Kicinski
This test needs more work, and it fails in non-obvious way when IPv4 connectivity is not available: # Exception| CMD[remote]: /tmp/vjquwblf/gukinuzqso_txtime -4 -c mono -t 1780939014114542914 -S None -D None a,0 -r # Exception| EXIT: -15 Explicitly check for IPv4 support to make the future triage less painful. Reviewed-by: Willem de Bruijn <willemb@google.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org> Link: https://patch.msgid.link/20260609180803.1093428-3-kuba@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-11selftests: drv-net: so_txtime: remember to deploy the binariesJakub Kicinski
The test seems to be written with a single-host loopback in mind. We need to deploy the binary to remote before we run it. This is just fixing an obvious issue, but more work will be needed to make the dual-host setup work reliably. Most of the runs still fail with: FAIL: start time already passed Reviewed-by: Willem de Bruijn <willemb@google.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org> Link: https://patch.msgid.link/20260609180803.1093428-2-kuba@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-11Merge branch 'net-txgbe-fix-module-identification'Paolo Abeni
Jiawen Wu says: ==================== net: txgbe: fix module identification For AML devices, there are some issues where the wrong module indentified then configure PHY failed. The module info buffers should be initialized to 0 before the firmware returns information. And DECLARE_PHY_INTERFACE_MASK() does not guarantee zeroed contents, so explicitly clear the temporary interface masks before setting supported interfaces. Rework txgbe_identify_module() to validate module identifiers through explicit type checks instead of relying on transceiver_type heuristics. When using the SFP module, transceiver_type could be a random value, because it was read from an invalid register. ==================== Link: https://patch.msgid.link/20260608070842.36504-1-jiawenwu@trustnetic.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-11net: txgbe: initialize PHY interface to 0Jiawen Wu
DECLARE_PHY_INTERFACE_MASK() does not guarantee zeroed contents. Add a new macro DECLARE_PHY_INTERFACE_MASK_ZERO(), make the stack variable to be zeroed before setting supported interfaces. Fixes: 57d39faed4c9 ("net: txgbe: improve functions of AML 40G devices") Signed-off-by: Jiawen Wu <jiawenwu@trustnetic.com> Link: https://patch.msgid.link/20260608070842.36504-4-jiawenwu@trustnetic.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-11net: txgbe: distinguish module types by checking identifierJiawen Wu
Rework txgbe_identify_module() to validate module identifiers through explicit type checks instead of relying on transceiver_type heuristics. When using the SFP module, transceiver_type could be a random value, because it was read from an invalid register. Fixes: 57d39faed4c9 ("net: txgbe: improve functions of AML 40G devices") Signed-off-by: Jiawen Wu <jiawenwu@trustnetic.com> Link: https://patch.msgid.link/20260608070842.36504-3-jiawenwu@trustnetic.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-11net: txgbe: initialize module info bufferJiawen Wu
The module info buffer should be initialized to 0 before the firmware returns information. Otherwise, there is a risk that the buffer field not filled by the firmware is random value. Fixes: 343929799ace ("net: txgbe: Support to handle GPIO IRQs for AML devices") Signed-off-by: Jiawen Wu <jiawenwu@trustnetic.com> Link: https://patch.msgid.link/20260608070842.36504-2-jiawenwu@trustnetic.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-11gpio: nomadik: remove dead DB8540 code from <gpio/gpio-nomadik.h>Ethan Nelson-Moore
DB8540 support was removed in commit b6d09f780761 ("pinctrl: nomadik: Drop U8540/9540 support"), but a couple small pieces of related code remained in <gpio/gpio-nomadik.h>. Remove them. Discovered while searching for CONFIG_* symbols referenced in code but not defined in any Kconfig file. Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com> Reviewed-by: Linus Walleij <linusw@kernel.org> Link: https://patch.msgid.link/20260610205007.44881-1-enelsonmoore@gmail.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-06-11x86/cpu: Make CONFIG_X86_CX8 unconditionalIngo Molnar
I.e. from now on it's a boot time requirement for the CPU to support it. ( This was preceded by the removal of all non-CX8 platform build options, so it should have no functional effects in theory. ) Signed-off-by: Ingo Molnar <mingo@kernel.org> Reviewed-by: Arnd Bergmann <arnd@arndb.de> Acked-by: Dave Hansen <dave.hansen@linux.intel.com> Cc: Ahmed S . Darwish <darwi@linutronix.de> Cc: Andrew Cooper <andrew.cooper3@citrix.com> Cc: Ard Biesheuvel <ardb@kernel.org> Cc: H . Peter Anvin <hpa@zytor.com> Cc: John Ogness <john.ogness@linutronix.de> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Link: https://lore.kernel.org/r/20250425084216.3913608-14-mingo@kernel.org
2026-06-11x86/cpu: Remove unused !CONFIG_X86_TSC codeIngo Molnar
Now that the Kconfig space always enables CONFIG_X86_TSC (on x86), remove !CONFIG_X86_TSC code from the x86 arch code. We still keep the Kconfig option to catch any eventual code still pending in maintainer or non-mainline trees, plus some drivers have raw TSC timestamping hacks that use CONFIG_X86_TSC. It's also still possible to disable TSC support runtime. Signed-off-by: Ingo Molnar <mingo@kernel.org> Reviewed-by: Arnd Bergmann <arnd@arndb.de> Acked-by: Dave Hansen <dave.hansen@linux.intel.com> Cc: Ahmed S . Darwish <darwi@linutronix.de> Cc: Andrew Cooper <andrew.cooper3@citrix.com> Cc: Ard Biesheuvel <ardb@kernel.org> Cc: H . Peter Anvin <hpa@zytor.com> Cc: John Ogness <john.ogness@linutronix.de> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Link: https://lore.kernel.org/r/20250425084216.3913608-13-mingo@kernel.org
2026-06-11m68k: stmark2: enable DACs outputsAngelo Dureghello
Enabled DAC0 and DAC1 outpus disabling shared ADC inputs on ADC3 and ADC7. Reviewed-by: Jonathan Cameron <jic23@kernel.org> Signed-off-by: Angelo Dureghello <adureghello@baylibre.com> Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
2026-06-11m68k: stmark2: add mcf5441x DAC platform devicesAngelo Dureghello
Add mcf5441x DAC platform devices. Reviewed-by: Jonathan Cameron <jic23@kernel.org> Signed-off-by: Angelo Dureghello <adureghello@baylibre.com> Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
2026-06-11m68k: stmark2: use ioport.h macros for resourcesAngelo Dureghello
Change resource declaration using DEFINE_RES_*() macros. DEFINE_DMA_RES() is for a single dma channel, not a range, so used twice. Also, some drivers assume IRQ resources are from index 1, so just to stay uniform, moved IRQ resource at index 1. Signed-off-by: Angelo Dureghello <adureghello@baylibre.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
2026-06-11m68k: mcf5441x: add CCR MISCCR2 bitfieldsAngelo Dureghello
Add CCR MISCCR2 register bitfields. Signed-off-by: Angelo Dureghello <adureghello@baylibre.com> Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
2026-06-11m68k: mcf5441x: add CCM registersAngelo Dureghello
Add CCM module register offsets. Signed-off-by: Angelo Dureghello <adureghello@baylibre.com> Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
2026-06-11m68k: add DAC modules base addressesAngelo Dureghello
Add DAC controller 0 and 1 base addresses. Signed-off-by: Angelo Dureghello <adureghello@baylibre.com> Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
2026-06-11m68k: mcf5441x: add clock for DAC channel 1Angelo Dureghello
Add missing clock for mcf5441x DAC channel 1. Signed-off-by: Angelo Dureghello <adureghello@baylibre.com> Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
2026-06-11m68k: mcf5441x: fix clocks numberingAngelo Dureghello
Fix clocks numbering, set correct values for eport and DAC, as per RM Rev 5, 05/2018, table 9.5. Fixes: bea8bcb12da09 ("m68knommu: Add support for the Coldfire m5441x.") Fixes: 007f84ede6e3e ("m68k: coldfire: remove private clk_get/clk_put") Signed-off-by: Angelo Dureghello <adureghello@baylibre.com> Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
2026-06-11Merge branch 'net-mvpp2-fix-xdp-rx-buffer-handling'Paolo Abeni
Til Kaiser says: ==================== net: mvpp2: fix XDP RX buffer handling This is v5 of the earlier XDP_PASS fix. The XDP_PASS change is retained, and the series also fixes related RX/XDP buffer handling issues found during review. Tested with tools/testing/selftests/drivers/net/xdp.py on mvpp2 hardware. ==================== Link: https://patch.msgid.link/20260607134943.21996-1-mail@tk154.de Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-11net: mvpp2: build skb from XDP-adjusted data on XDP_PASSTil Kaiser
When an XDP program uses bpf_xdp_adjust_head() or bpf_xdp_adjust_tail() and then returns XDP_PASS, mvpp2 still builds the skb from fixed offsets derived from the original RX descriptor. Packet geometry changes made by the XDP program are therefore discarded before the skb reaches the stack. Update rx_offset and rx_bytes from xdp.data and xdp.data_end for XDP_PASS. This makes skb_reserve() and skb_put() reflect the packet seen by XDP, and makes RX byte accounting for XDP_PASS follow the length of the skb passed to the network stack. Keep a separate rx_sync_size for page-pool recycling on skb allocation failure, which must stay tied to the received buffer range. Non-PASS verdicts continue to account the descriptor length because no skb is passed up in those cases. Fixes: 07dd0a7aae7f ("mvpp2: add basic XDP support") Signed-off-by: Til Kaiser <mail@tk154.de> Link: https://patch.msgid.link/20260607134943.21996-5-mail@tk154.de Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-11net: mvpp2: refill RX buffers before XDP or skb useTil Kaiser
The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM. Fixes: 07dd0a7aae7f ("mvpp2: add basic XDP support") Fixes: d6526926de73 ("net: mvpp2: fix memory leak in mvpp2_rx") Signed-off-by: Til Kaiser <mail@tk154.de> Link: https://patch.msgid.link/20260607134943.21996-4-mail@tk154.de Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-11net: mvpp2: limit XDP frame size to the RX bufferTil Kaiser
mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet. Fixes: 07dd0a7aae7f ("mvpp2: add basic XDP support") Signed-off-by: Til Kaiser <mail@tk154.de> Link: https://patch.msgid.link/20260607134943.21996-3-mail@tk154.de Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-11net: mvpp2: sync RX data at the hardware packet offsetTil Kaiser
mvpp2 programs the RX queue packet offset, so hardware writes received data at dma_addr + MVPP2_SKB_HEADROOM. The current CPU sync starts at dma_addr and only covers rx_bytes + MVPP2_MH_SIZE bytes, which syncs the unused headroom and misses the same number of bytes at the packet tail. On non-coherent DMA systems this can leave the CPU reading stale cache contents for the end of the received frame. Use dma_sync_single_range_for_cpu() with MVPP2_SKB_HEADROOM as the range offset so the sync covers the Marvell header and packet data actually written by hardware. Fixes: e1921168bbd4 ("mvpp2: sync only the received frame") Signed-off-by: Til Kaiser <mail@tk154.de> Link: https://patch.msgid.link/20260607134943.21996-2-mail@tk154.de Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-11kbuild: rust: clean `zerocopy-derive` in `mrproper`Miguel Ojeda
Just like for the other two Rust proc macros, remove the artifacts in `mrproper`. This should have been part of commit 506054980429 ("rust: zerocopy-derive: enable support in kbuild"). Link: https://patch.msgid.link/20260610143025.368801-1-ojeda@kernel.org Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-06-11ALSA: usb-audio: Use the new helper for shutdown refcountTakashi Iwai
Replace the open-code for managing the shutdown refcount with the new helpers. Only a code cleanup, no functional changes. Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260610154538.51076-6-tiwai@suse.de
2026-06-11ALSA: aloop: Use the new helper for stop-count refcountTakashi Iwai
Replace the open-code for managing the stop-count refcount with the new helpers. Only a code cleanup, no functional changes. Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260610154538.51076-5-tiwai@suse.de
2026-06-11ALSA: hda: Use the new helper for PCM instance refcountTakashi Iwai
HD-audio core driver has some open-code for managing the refcount for PCM instances, and it can be replaced gracefully with the new helpers. Only a code cleanup, no functional changes. Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260610154538.51076-4-tiwai@suse.de
2026-06-11ALSA: core: Use the new helper for the power refcountTakashi Iwai
Replace the open code for managing the power refcount in the snd_card object with the new helper functions. Only a code cleanup, no functional changes. Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260610154538.51076-3-tiwai@suse.de
2026-06-11ALSA: Add simple refcount helper functionsTakashi Iwai
There are many open-code to manage the same pattern for refcount + wakeup sync at closing. Let's provide the common helper functions to replace the open-code. - The recount is kept in struct snd_refcount, where it's initialized by snd_refcount_init(). - The user can simply reference or unreference via snd_refcount_get() and snd_refcount_put() functions - The user can wait for the all usages gone by snd_refcount_sync() Note that here we use atomic_t instead of refcount_t since the current users allow reusing the refcount after sync again. The design of refcount_t prevents exactly this behavior, so it doesn't fit. Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260610154538.51076-2-tiwai@suse.de
2026-06-11mtd: cfi: Use common error handling code in two functionsMarkus Elfring
Use additional labels so that a bit of exception handling can be better reused at the end of two function implementations. This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-06-11mtd: slram: simplify register_device() cleanupRuoyu Wang
Use local variables for the list entry, mtd_info, and private data while initializing a new device. This keeps the initialization path easier to read and publishes the new list entry only after mtd_device_register() has succeeded. Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>