summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2026-04-14drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import()Shuicheng Lin
When xe_dma_buf_init_obj() fails, the attachment from dma_buf_dynamic_attach() is not detached. Add dma_buf_detach() before returning the error. Note: we cannot use goto out_err here because xe_dma_buf_init_obj() already frees bo on failure, and out_err would double-free it. Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4.6 Reviewed-by: Mattheq Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260408175255.3402838-5-shuicheng.lin@intel.com Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
2026-04-14drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failureShuicheng Lin
When drm_gpuvm_resv_object_alloc() fails, the pre-allocated storage bo is not freed. Add xe_bo_free(storage) before returning the error. xe_dma_buf_init_obj() calls xe_bo_init_locked(), which frees the bo on error. Therefore, xe_dma_buf_init_obj() must also free the bo on its own error paths. Otherwise, since xe_gem_prime_import() cannot distinguish whether the failure originated from xe_dma_buf_init_obj() or from xe_bo_init_locked(), it cannot safely decide whether the bo should be freed. Add comments documenting the ownership semantics: on success, ownership of storage is transferred to the returned drm_gem_object; on failure, storage is freed before returning. v2: Add comments to explain the free logic. Fixes: eb289a5f6cc6 ("drm/xe: Convert xe_dma_buf.c for exhaustive eviction") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4.6 Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260408175255.3402838-4-shuicheng.lin@intel.com Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
2026-04-14drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked()Shuicheng Lin
When XE_BO_FLAG_GGTT_ALL is set without XE_BO_FLAG_GGTT, the function returns an error without freeing a caller-provided bo, violating the documented contract that bo is freed on failure. Add xe_bo_free(bo) before returning the error. Fixes: 5a3b0df25d6a ("drm/xe: Allow bo mapping on multiple ggtts") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4.6 Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260408175255.3402838-3-shuicheng.lin@intel.com Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
2026-04-14drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked()Shuicheng Lin
When type is ttm_bo_type_device and aligned_size != size, the function returns an error without freeing a caller-provided bo, violating the documented contract that bo is freed on failure. Add xe_bo_free(bo) before returning the error. Fixes: 4e03b584143e ("drm/xe/uapi: Reject bo creation of unaligned size") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4.6 Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260408175255.3402838-2-shuicheng.lin@intel.com Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
2026-04-14drm/xe: Fix potential NULL deref in ↵Shuicheng Lin
xe_exec_queue_tlb_inval_last_fence_put_unlocked xe_exec_queue_tlb_inval_last_fence_put_unlocked() uses q->vm->xe as the first argument to xe_assert(). This function is called unconditionally from xe_exec_queue_destroy() for all queues, including kernel queues that have q->vm == NULL (e.g., queues created during GT init in xe_gt_record_default_lrcs() with vm=NULL). While current compilers optimize away the q->vm->xe dereference (even in CONFIG_DRM_XE_DEBUG=y builds, the compiler pushes the dereference into the WARN branch that is only taken when the assert condition is false), the code is semantically incorrect and constitutes undefined behavior in the C abstract machine for the NULL pointer case. Use gt_to_xe(q->gt) instead, which is always valid for any exec queue. This is consistent with how xe_exec_queue_destroy() itself obtains the xe_device pointer in its own xe_assert at the top of the function. Fixes: b2d7ec41f2a3 ("drm/xe: Attach last fence to TLB invalidation job queues") Assisted-by: Claude:claude-opus-4.6 Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260409003449.3405767-1-shuicheng.lin@intel.com Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
2026-04-14virt: arm-cca-guest: fix error check for RSI_INCOMPLETESami Mujawar
The RSI interface can return RSI_INCOMPLETE when a report spans multiple granules. This is an expected condition and should not be treated as a fatal error. Currently, arm_cca_report_new() checks for `info.result != RSI_SUCCESS` and bails out, which incorrectly flags RSI_INCOMPLETE as a failure. Fix the check to only break out on results other than RSI_SUCCESS or RSI_INCOMPLETE. This ensures partial reports are handled correctly and avoids spurious -ENXIO errors when generating attestation reports. Fixes: 7999edc484ca ("virt: arm-cca-guest: TSM_REPORT support for realms") Signed-off-by: Sami Mujawar <sami.mujawar@arm.com> Reported-by: Jagdish Gediya <Jagdish.Gediya@arm.com> Reviewed-by: Steven Price <steven.price@arm.com> Reviewed-by: Gavin Shan <gshan@redhat.com> Reviewed-by: Suzuki K Poulose <suzuki.poulose@arm.com> Reviewed-by: Yeoreum Yun <yeoreum.yun@arm.com> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2026-04-14net: airoha: Add missing PPE configurations in airoha_ppe_hw_init()Lorenzo Bianconi
Add the following PPE configuration in airoha_ppe_hw_init routine: - 6RD hw offloading is currently not supported by Netfilter flowtable. Disable explicitly PPE 6RD offloading in order to prevent PPE to learn 6RD flows and eventually interrupt the traffic. - Add missing PPE bind rate configuration for L3 and L2 traffic. PPE bind rate configuration specifies the pps threshold to move a PPE entry state from UNBIND to BIND. Without this configuration this value is random. - Set ageing thresholds to the values used in the vendor SDK in order to improve connection stability under load and avoid packet loss caused by fast aging. Fixes: 00a7678310fe3 ("net: airoha: Introduce flowtable offload support") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260412-airoha_ppe_hw_init-missing-bits-v1-1-06ac670819e3@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-04-14drm/mxsfb/lcdif: use DRM_BRIDGE_ATTACH_NO_CONNECTOR and the bridge-connectorLuca Ceresoli
Convert this driver to DRM_BRIDGE_ATTACH_NO_CONNECTOR and to the drm_bridge_connector framework which is the current DRM bridge best practice. Based on the in-tree dts[i] files this introduces no regression. Based on the kernel doc of drm_bridge_connector.c: * To make use of this helper, all bridges in the chain shall report bridge * operation flags (&drm_bridge->ops) and bridge output type * (&drm_bridge->type), as well as the DRM_BRIDGE_ATTACH_NO_CONNECTOR attach * flag (none of the bridges shall create a DRM connector directly). and each of the 3 LCDIF blocks in the i.MX8MP, all of them comply with the above requirement: * For the LCDIF3, the pipeline is: LCDIF3 -> fsl,imx8mp-hdmi-pvi -> fsl,imx8mp-hdmi-tx -> HDMI connector And the involved bridges are: * fsl,imx8mp-hdmi-pvi has ops = 0 (it doesn't set it) because it implements none the optional features mentioned by those flags, and it honors the DRM_BRIDGE_ATTACH_NO_CONNECTOR by propagating it * fsl,imx8mp-hdmi-tx is implemented based on dw-hdmi, which sets ops as appropriate and also propagates the DRM_BRIDGE_ATTACH_NO_CONNECTOR flag * display-connector (enabled via the DT overlay if needed) sets ops and makes DRM_BRIDGE_ATTACH_NO_CONNECTOR mandatory * The LCDIF2 involves the panel-bridge, display-connector and lvds-decoder (even though only the pane-bridge is currently supported), and all these three also set ops as needed and propagate DRM_BRIDGE_ATTACH_NO_CONNECTOR or make it mandatory. * The LCDIF1 is used with the adv7511, tc358767 and the panel bridge drivers which also comply with the requirements. Tested-by: Martyn Welch <martyn.welch@collabora.com> Tested-by: Alexander Stein <alexander.stein@ew.tq-group.com> # TQMa8MPxL/MBa8MPxL Reviewed-by: Liu Ying <victor.liu@nxp.com> Link: https://patch.msgid.link/20260407-drm-lcdif-dbanc-v4-11-247a16e61ef9@bootlin.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
2026-04-14drm/bridge: imx8mp-hdmi-tx: switch to DRM_BRIDGE_ATTACH_NO_CONNECTORLuca Ceresoli
The imx8mp-hdmi-tx one of many drivers based on dw-hdmi. dw-hdmi in turn can operate in two different modes, depending on the platform data as set by the driver: A. hdmi->plat_data->output_port = 0: the HDMI output (port@1) in device tree is not used [0] B. hdmi->plat_data->output_port = 1: the HDMI output (port@1) is parsed to find the next bridge The imx8mp-hdmi-tx driver falls in case A. Switching to case B, which is the current best practice, requires that the HDMI connector is always described in the live device tree, and a previous commit ensured this is always the case by adding an overlay in case the device tree does not comply. So now we can simply switch to the new mode and support DRM_BRIDGE_ATTACH_NO_CONNECTOR. Reviewed-by: Liu Ying <victor.liu@nxp.com> Link: https://patch.msgid.link/20260407-drm-lcdif-dbanc-v4-10-247a16e61ef9@bootlin.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
2026-04-14drm/bridge: imx8mp-hdmi-tx-connector-fixup: show a warning when adding the ↵Luca Ceresoli
overlay Describing the HDMI connector in device tree is recommended. While the overlay insertion is a workaround to avoid breaking existing devices, every dts should be improved by adding a connector description. Add a warning to make users aware as far as possible. As a warning line cannot hold all the relevant info, add a detailed comment in the code so it easy to find when the warning is seen. Reviewed-by: Liu Ying <victor.liu@nxp.com> Link: https://patch.msgid.link/20260407-drm-lcdif-dbanc-v4-9-247a16e61ef9@bootlin.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
2026-04-14drm/bridge: imx8mp-hdmi-tx-connector-fixup: add an hdmi-connector when ↵Luca Ceresoli
missing using a DT overlay at boot time The imx8mp-hdmi-tx is one of many drivers based on dw-hdmi. dw-hdmi in turn can operate in two different modes, depending on the platform data as set by the driver: A. hdmi->plat_data->output_port = 0: the HDMI output (port@1) in device tree is not used [0] B. hdmi->plat_data->output_port = 1: the HDMI output (port@1) is parsed to find the next bridge The imx8mp-hdmi-tx driver falls in case A. This implies next_bridge will always be NULL, and so dw_hdmi_bridge_attach() [1] will always fail if called with the DRM_BRIDGE_ATTACH_NO_CONNECTOR flag. In fact case A assumes that DRM_BRIDGE_ATTACH_NO_CONNECTOR is not set and in that case it adds an HDMI Type A connector programmatically at bridge attach time. Support for DRM_BRIDGE_ATTACH_NO_CONNECTOR is implemented by dw-hdmi.c in case B. However switching to base B requires that port@1 is connected to a "next bridge" DT node, typically the HDMI connector, because dw-hdmi won't add the connector when using DRM_BRIDGE_ATTACH_NO_CONNECTOR. Many dts files for imx8mp-based boards in the kernel have such a connector described and linked to port@1, so the pipeline will be fully attached up to a display-connector and a drm_connector added by the bridge-connector. Sadly some of those dts files don't have the connector described. Adding it would solve the problem easily, but this would break existing devices which do not update the dtb when upgrading to a newer kernel. In preparation for switching to case B while preserving backward compatibility for such devices, introduce a module adding the hdmi-connector node to the live device tree at init time. This will allow the dw-hdmi code to find the next bridge (the one wrapping the hdmi-connector) and let the pipeline work as before. The module is inserted only if there is no endpoint in port@1. So boards whose device tree describe the connector will not have the device tre modified, and will start isntantiating the correct HDMI connector type as described in the device tree. For boards lacking a connector description in DT the overlay will be added, abd the HDMI connector will be Type A, which is a reasonable fallback and is what the driver is currently doing. [0] https://elixir.bootlin.com/linux/v7.0-rc1/source/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c#L3310 [1] https://elixir.bootlin.com/linux/v7.0-rc1/source/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c#L2907 Reviewed-by: Liu Ying <victor.liu@nxp.com> Link: https://patch.msgid.link/20260407-drm-lcdif-dbanc-v4-8-247a16e61ef9@bootlin.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
2026-04-14drm/bridge: dw-hdmi: move next_bridge lookup to attach timeLuca Ceresoli
This driver looks up the next_bridge at probe time and stores it in hdmi->bridge.next_bridge, but only uses the stored value when attaching, and only in the DRM_BRIDGE_ATTACH_NO_CONNECTOR case. This will be problematic with an upcoming change, adding an hdmi-connector using a device tree overlay when not present. That change is in turn necessary to migrate the i.MX LCDIF driver to the bridge-connector. The problem is that, adding the hdmi-connector via an overlay, devlink considers hdmi-connector a consumer of the dw-hdmi device, generating a chicken-egg problem: * hdmi-connector probe won't be tried until dw-hdmi is probed (devlink) * dw-hdmi probe will defer until it finds the next_bridge (the hdmi-connector wrapper bridge) In preparation for those changes, move the next_bridge lookup from probe to attach, when it is actually used. This allows dw-hdmi to probe, so that the hdmi-connector can probe as well. Also avoid storing the pointer in hdmi->bridge.next_bridge: the value is computed when needed, thus a local variable is enough. Finally, this also allows to slightly improve the code by not doing any DT lookup in the !DRM_BRIDGE_ATTACH_NO_CONNECTOR case. Tested-by: Martyn Welch <martyn.welch@collabora.com> Tested-by: Alexander Stein <alexander.stein@ew.tq-group.com> # TQMa8MPxL/MBa8MPxL Acked-by: Liu Ying <victor.liu@nxp.com> Tested-by: Damon Ding <damon.ding@rock-chips.com> # rk3399 Link: https://patch.msgid.link/20260407-drm-lcdif-dbanc-v4-7-247a16e61ef9@bootlin.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
2026-04-14drm/bridge: dw-hdmi: warn on unsupported attach combinationLuca Ceresoli
dw-hdmi can operate in two different modes, depending on the platform data as set by the driver: A. hdmi->plat_data->output_port = 0: the HDMI output (port@1) in device tree is not used B. hdmi->plat_data->output_port = 1: the HDMI output (port@1) is parsed to find the next bridge Only case B is supported when the DRM_BRIDGE_ATTACH_NO_CONNECTOR flag is passed to the attach callback. Emit a warning when this is violated. Also return -EINVAL which would be returned by drm_bridge_attach() right after anyway. Reviewed-by: Liu Ying <victor.liu@nxp.com> Tested-by: Martyn Welch <martyn.welch@collabora.com> Tested-by: Alexander Stein <alexander.stein@ew.tq-group.com> # TQMa8MPxL/MBa8MPxL Tested-by: Damon Ding <damon.ding@rock-chips.com> # rk3399 Link: https://patch.msgid.link/20260407-drm-lcdif-dbanc-v4-6-247a16e61ef9@bootlin.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
2026-04-14drm/mxsfb/lcdif: move iteration-specific variables declaration inside loop ↵Luca Ceresoli
in lcdif_attach_bridge The bridge and ret variables are per-iteration variables, whose values don't have to be carried to the next iteration or be used after the loop end. Move their declaration inside the loop scope as a cleanup and to make code clearer. Reviewed-by: Liu Ying <victor.liu@nxp.com> Link: https://patch.msgid.link/20260407-drm-lcdif-dbanc-v4-4-247a16e61ef9@bootlin.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
2026-04-14drm/mxsfb/lcdif: use dev_err_probe() consistently in lcdif_attach_bridgeLuca Ceresoli
lcdif_attach_bridge() uses dev_err_probe() in some error paths, dev_err() + return in others. Use dev_err_probe() for all of them to make code consistent, simpler and with better error reporting. Reviewed-by: Liu Ying <victor.liu@nxp.com> Link: https://patch.msgid.link/20260407-drm-lcdif-dbanc-v4-3-247a16e61ef9@bootlin.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
2026-04-14drm/mxsfb/lcdif: simplify ep pointer management using __freeLuca Ceresoli
Putting the ep device_node reference requires a of_node_put(ep) in many return points. Use a cleanup action to simplify the code. Reviewed-by: Liu Ying <victor.liu@nxp.com> Link: https://patch.msgid.link/20260407-drm-lcdif-dbanc-v4-2-247a16e61ef9@bootlin.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
2026-04-14drm/mxsfb/lcdif: simplify remote pointer management using __freeLuca Ceresoli
Putting the remote device_node reference requires a of_node_put(remote) in two places. Use a cleanup action to simplify the code. Reviewed-by: Liu Ying <victor.liu@nxp.com> Tested-by: Martyn Welch <martyn.welch@collabora.com> Tested-by: Alexander Stein <alexander.stein@ew.tq-group.com> # TQMa8MPxL/MBa8MPxL Link: https://patch.msgid.link/20260407-drm-lcdif-dbanc-v4-1-247a16e61ef9@bootlin.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
2026-04-14ASoC: SOF: Intel: NVL/NVL-S: add platform nameMark Brown
Bard Liao <yung-chuan.liao@linux.intel.com> says: The platform name will be used in the topology name. Link: https://patch.msgid.link/20260413060800.3156425-1-yung-chuan.liao@linux.intel.com
2026-04-14net: airoha: Fix VIP configuration for AN7583 SoCLorenzo Bianconi
EN7581 and AN7583 SoCs have different VIP definitions. Introduce get_vip_port callback in airoha_eth_soc_data struct in order to take into account EN7581 and AN7583 VIP register layout and definition differences. Introduce nbq parameter in airoha_gdm_port struct. At the moment nbq is set statically to value previously used in airhoha_set_gdm2_loopback routine and it will be read from device tree in subsequent patches. Fixes: e4e5ce823bdd ("net: airoha: Add AN7583 SoC support") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260412-airoha-7583-vip-fix-v1-1-c35e02b054bb@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-04-14drm/xe/pf: Derive admin-only PF mode from xe_device stateSatyanarayana K V P
Stop tracking admin-only PF mode in a separate `xe->sriov.pf.admin_only` field and use `xe_device_is_admin_only(xe)` as the single source of admin mode. Signed-off-by: Satyanarayana K V P <satyanarayana.k.v.p@intel.com> Cc: Michal Wajdeczko <michal.wajdeczko@intel.com> Reviewed-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Link: https://patch.msgid.link/20260413095637.2871287-2-satyanarayana.k.v.p@intel.com
2026-04-14drm/xe/pf: Restrict device query responses in admin-only PF modeSatyanarayana K V P
When a PF is configured in admin-only mode, it is intended for management only and must not expose workload-facing capabilities to userspace. Limit the exposed ioctl set in admin-only PF mode to XE_DEVICE_QUERY and XE_OBSERVATION, and suppress capability-bearing query payloads so that the userspace cannot discover execution-related device details in this mode. Signed-off-by: Satyanarayana K V P <satyanarayana.k.v.p@intel.com> Cc: Michal Wajdeczko <michal.wajdeczko@intel.com> Cc: Rodrigo Vivi <rodrigo.vivi@intel.com> Cc: Piotr Piórkowski <piotr.piorkowski@intel.com> Cc: Matthew Brost <matthew.brost@intel.com> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> Cc: Michał Winiarski <michal.winiarski@intel.com> Cc: Dunajski Bartosz <bartosz.dunajski@intel.com> Cc: Ashutosh Dixit <ashutosh.dixit@intel.com> Cc: dri-devel@lists.freedesktop.org Acked-by: Rodrigo Vivi <rodrigo.vivi@intel.com> Acked-by: Ashutosh Dixit <ashutosh.dixit@intel.com> Reviewed-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Link: https://patch.msgid.link/20260409154423.2499340-5-satyanarayana.k.v.p@intel.com
2026-04-14drm/bridge: dw-mipi-dsi: Fix bridge leak when host attach failsOsama Abdelkader
dw_mipi_dsi_host_attach() and dw_mipi_dsi2_host_attach() call drm_bridge_add() before pdata->host_ops->attach(). If attach fails, the bridge stayed registered without drm_bridge_remove(), leaking the bridge reference and leaving the device on the global bridge list. Fixes: 90910a651123 ("drm/bridge/synopsys: dsi: add ability to have glue-specific attach and detach") Fixes: 0d6d86253fef ("drm/bridge/synopsys: Add MIPI DSI2 host controller bridge") Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com> Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Link: https://patch.msgid.link/20260403145208.15890-1-osama.abdelkader@gmail.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
2026-04-14net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()Greg Kroah-Hartman
A malicious USB device claiming to be a CDC Phonet modem can overflow the skb_shared_info->frags[] array by sending an unbounded sequence of full-page bulk transfers. Drop the skb and increment the length error when the frag limit is reached. This matches the same fix that commit f0813bcd2d9d ("net: wwan: t7xx: fix potential skb->frags overflow in RX path") did for the t7xx driver. Cc: Andrew Lunn <andrew+netdev@lunn.ch> Cc: "David S. Miller" <davem@davemloft.net> Cc: Eric Dumazet <edumazet@google.com> Cc: Jakub Kicinski <kuba@kernel.org> Cc: Paolo Abeni <pabeni@redhat.com> Cc: stable <stable@kernel.org> Assisted-by: gregkh_clanker_t1000 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Link: https://patch.msgid.link/2026041134-dreamboat-buddhism-d1ec@gregkh Fixes: 87cf65601e17 ("USB host CDC Phonet network interface driver") Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-04-14drm/arcpgu: fix device node leakLuca Ceresoli
This function gets a device_node reference via of_graph_get_remote_port_parent() and stores it in encoder_node, but never puts that reference. Add it. There used to be a of_node_put(encoder_node) but it has been removed by mistake during a rework in commit 3ea66a794fdc ("drm/arc: Inline arcpgu_drm_hdmi_init"). Fixes: 3ea66a794fdc ("drm/arc: Inline arcpgu_drm_hdmi_init") Cc: stable@vger.kernel.org Reviewed-by: Louis Chauvet <louis.chauvet@bootlin.com> Link: https://patch.msgid.link/20260402-drm-arcgpu-fix-device-node-leak-v2-1-d773cf754ae5@bootlin.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
2026-04-14drm/i915/wm: Verify the correct plane DDB entryVille Syrjälä
Actually verify the DDB entry for the plane we're looking at instead of always verifying the cursor DDB. Fixes: 7d4561722c3b ("drm/i915: Tweak plane ddb allocation tracking") Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/20260324134843.2364-5-ville.syrjala@linux.intel.com Reviewed-by: Vinod Govindapillai <vinod.govindapillai@intel.com> (cherry picked from commit f002f7c7439de18117a31ca84dc87a59719c3dd6) Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
2026-04-14drm/i915/backlight: Fix VESA backlight possible check conditionSuraj Kandpal
VESA backlight enable is possible when BACKLIGHT_AUX_ENABLE_CAPABLE is true via AUX command or when BACKLIGHT_PIN_ENABLE_CAPABLE is true via eDP connector pin. Similarly, backlight brightness adjustment can be done via AUX-based control or PWM pin-based control. It means there can be three configurations: 1) Full AUX-based: Enable and adjustment both via AUX. We currently support this (apart from the AUX luminance-based backlight control). 2) Hybrid: Enable via the BL_ENABLE pin, adjustment via either AUX or PWM. 3) Fully PWM pin-based: Enable via the BL_ENABLE pin, adjustment via PWM. Since that only 1 is supported as of now we need to make sure we do not try to manipulate backlight when BACKLIGHT_AUX_ENABLE_CAPABLE is not set. Also fix return value when condition is not fulfilled. Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/work_items/15907 Fixes: 0fb03890d182 ("drm/i915/backlight: Check if VESA backlight is possible") Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com> Tested-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Reviewed-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Link: https://patch.msgid.link/20260407030710.1440046-1-suraj.kandpal@intel.com (cherry picked from commit 102d44b3a8fad96e94e9ccd0579986c14a1f2f75) Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
2026-04-13drm/xe/vf: Use drm mm instead of drm sa for CCS read/writeSatyanarayana K V P
The suballocator algorithm tracks a hole cursor at the last allocation and tries to allocate after it. This is optimized for fence-ordered progress, where older allocations are expected to become reusable first. In fence-enabled mode, that ordering assumption holds. In fence-disabled mode, allocations may be freed in arbitrary order, so limiting allocation to the current hole window can miss valid free space and fail allocations despite sufficient total space. Use DRM memory manager instead of sub-allocator to get rid of this issue as CCS read/write operations do not use fences. Fixes: 864690cf4dd6 ("drm/xe/vf: Attach and detach CCS copy commands with BO") Signed-off-by: Satyanarayana K V P <satyanarayana.k.v.p@intel.com> Cc: Matthew Brost <matthew.brost@intel.com> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> Cc: Maarten Lankhorst <dev@lankhorst.se> Cc: Michal Wajdeczko <michal.wajdeczko@intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Signed-off-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260408110145.1639937-6-satyanarayana.k.v.p@intel.com
2026-04-13drm/xe: Add memory pool with shadow supportSatyanarayana K V P
Add a memory pool to allocate sub-ranges from a BO-backed pool using drm_mm. Signed-off-by: Satyanarayana K V P <satyanarayana.k.v.p@intel.com> Cc: Matthew Brost <matthew.brost@intel.com> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> Cc: Maarten Lankhorst <dev@lankhorst.se> Cc: Michal Wajdeczko <michal.wajdeczko@intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Signed-off-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260408110145.1639937-5-satyanarayana.k.v.p@intel.com
2026-04-14mshv_vtl: Fix vmemmap_shift exceeding MAX_FOLIO_ORDERNaman Jain
When registering VTL0 memory via MSHV_ADD_VTL0_MEMORY, the kernel computes pgmap->vmemmap_shift as the number of trailing zeros in the OR of start_pfn and last_pfn, intending to use the largest compound page order both endpoints are aligned to. However, this value is not clamped to MAX_FOLIO_ORDER, so a sufficiently aligned range (e.g. physical range [0x800000000000, 0x800080000000), corresponding to start_pfn=0x800000000 with 35 trailing zeros) can produce a shift larger than what memremap_pages() accepts, triggering a WARN and returning -EINVAL: WARNING: ... memremap_pages+0x512/0x650 requested folio size unsupported The MAX_FOLIO_ORDER check was added by commit 646b67d57589 ("mm/memremap: reject unreasonable folio/compound page sizes in memremap_pages()"). Fix this by clamping vmemmap_shift to MAX_FOLIO_ORDER so we always request the largest order the kernel supports, in those cases, rather than an out-of-range value. Also fix the error path to propagate the actual error code from devm_memremap_pages() instead of hard-coding -EFAULT, which was masking the real -EINVAL return. Fixes: 7bfe3b8ea6e3 ("Drivers: hv: Introduce mshv_vtl driver") Cc: stable@vger.kernel.org Signed-off-by: Naman Jain <namjain@linux.microsoft.com> Reviewed-by: Michael Kelley <mhklinux@outlook.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-04-14Drivers: hv: vmbus: Export hv_vmbus_exists() and use it in pci-hypervDexuan Cui
With commit f84b21da3624 ("PCI: hv: Don't load the driver for baremetal root partition"), the bare metal Linux root partition won't use the pci-hyperv driver, but when a Linux VM runs on the Linux root partition, pci-hyperv's module_init function init_hv_pci_drv() can still run, e.g. in the case of CONFIG_PCI_HYPERV=y, even if the VMBus driver is not used in such a VM (i.e. the hv_vmbus driver's init function returns -ENODEV due to vmbus_root_device being NULL). In such a Linux VM, init_hv_pci_drv() runs with a side effect: the 3 hvpci_block_ops callbacks are set to functions that depend on hv_vmbus. Later, when the MLX driver in such a VM invokes the callbacks, e.g. in drivers/net/ethernet/mellanox/mlx5/core/lib/hv.c: mlx5_hv_register_invalidate(), hvpci_block_ops.reg_blk_invalidate() is hv_register_block_invalidate() rather than a NULL function pointer, and hv_register_block_invalidate() assumes that it can find a struct hv_pcibus_device from pdev->bus->sysdata, which is false in such a VM. Consequently, hv_register_block_invalidate() -> get_pcichild_wslot() -> spin_lock_irqsave() may hang since it can be accessing an invalid spinlock pointer. Fix the issue by exporting hv_vmbus_exists() and using it in pci-hyperv: hv_root_partition() is true and hv_nested is false ==> hv_vmbus_exists() is false. hv_root_partition() is true and hv_nested is true ==> hv_vmbus_exists() is true. hv_root_partition() is false ==> hv_vmbus_exists() is true. While at it, rename vmbus_exists() to hv_vmbus_exists() to follow the convention that all public functions have the hv_ prefix; also change the return value's type from int to bool to make the code more readable; also move the two pr_info() calls. Reported-by: Mukesh Rathor <mrathor@linux.microsoft.com> Signed-off-by: Dexuan Cui <decui@microsoft.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-04-14mshv: Introduce tracing supportStanislav Kinsburskii
Introduces various trace events and use them in the corresponding places in the driver. Signed-off-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-04-14Drivers: hv: vmbus: Limit channel interrupt scan to relid high water markMichael Kelley
When checking for VMBus channel interrupts, current code always scans the full SynIC receive interrupt bit array to get the relid of the interrupting channels. The array has HV_EVENT_FLAGS_COUNT (2048) bits. But VMs rarely have more than 100 channels, and the relid is typically a small integer that is densely assigned by the Hyper-V host. It's wasteful to scan 2048 bits when it is highly unlikely that anything will be found past bit 100. The waste is double with Confidential VMBus because there are two receive interrupt arrays that must be scanned: one for the hypervisor SynIC and one for the paravisor SynIC. Improve the scanning by tracking the largest relid that has been offered by the Hyper-V host. Then when checking for VMBus channel interrupts, only scan up to this high water mark. When channels are rescinded, it's not worth the complexity to recalculate the high water mark. Hyper-V tends to reuse the rescinded relids for any new channels that are subsequently added, and the performance benefit of exactly tracking the high water mark would be minimal. Signed-off-by: Michael Kelley <mhklinux@outlook.com> Tested-by: Roman Kisel <vdso@mailbox.org> Reviewed-by: Roman Kisel <vdso@mailbox.org> Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-04-13Merge tag 'pwrseq-updates-for-v7.1-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull power sequencing updates from Bartosz Golaszewski: "For this release we have an extension of the pwrseq-pcie-m2 driver with support for PCIe M.2 Key E connectors. The rest of the commits fulfill a supporting role: document the hardware in DT bindings, provide required serdev helpers (this has been provided in an immutable branch to Rob Herring so you may see it in his PR as well) and is followed up by some Kconfig fixes from Arnd. Summary: - add support for the PCIe M.2 Key E connectors in pwrseq-pcie-m2 - describe PCIe M.2 Mechanical Key E connectors in DT bindings - add serdev helpers for looking up devices by OF nodes - minor serdev core rework to enable support for PCIe M.2 Key E connectors" * tag 'pwrseq-updates-for-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: power: sequencing: pcie-m2: add SERIAL_DEV_BUS dependency power: sequencing: pcie-m2: enforce PCI and OF dependencies power: sequencing: pcie-m2: Create serdev device for WCN7850 bluetooth power: sequencing: pcie-m2: Add support for PCIe M.2 Key E connectors dt-bindings: connector: Add PCIe M.2 Mechanical Key E connector dt-bindings: serial: Document the graph port serdev: Do not return -ENODEV from of_serdev_register_devices() if external connector is used serdev: Add an API to find the serdev controller associated with the devicetree node serdev: Convert to_serdev_*() helpers to macros and use container_of_const()
2026-04-13Merge tag 'gpio-updates-for-v7.1-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio updates from Bartosz Golaszewski: "For this merge window we have two new drivers: support for GPIO-signalled ACPI events on Intel platforms and a generic GPIO-over-pinctrl driver using the ARM SCMI protocol for controlling pins. Several things have been reworked in GPIO core: we unduplicated GPIO hog handling, reduced the number of SRCU locks and dereferences, improved support for software-node-based lookup and removed more legacy code after converting remaining users to modern alternatives. There's also a number of driver reworks and refactoring, documentation updates, some bug-fixes and new tests. GPIO core: - defer probe on software node lookups when the remote software node exists but has not been registered as a firmware node yet - unify GPIO hog handling by moving code duplicated in OF and ACPI modules into GPIO core and allow setting up hogs with software nodes - allow matching GPIO controllers by secondary firmware node if matching by primary does not succeed - demote deferral warnings to debug level as they are quite normal when using software nodes which don't support fw_devlink yet - disable the legacy GPIO character device uAPI v1 supprt in Kconfig by default - rework several core functions in preparation for the upcoming Revocable helper library for protecting resources against sudden removal, this reduces the number of SRCU dereferences in GPIO core - simplify file descriptor logic in GPIO character device code by using FD_PREPARE() - introduce a header defining symbols used by both GPIO consumers and providers to avoid having to include provider-specific headers from drivers which only consume GPIOs - replace snprintf() with strscpy() where formatting is not required New drivers: - add the gpio-by-pinctrl generic driver using the ARM SCMI protocol to control GPIOs (along with SCMI changes pulled from the pinctrl tree) - add a driver providing support for handling of platform events via GPIO-signalled ACPI events (used on Intel Nova Lake and later platforms) Driver changes: - extend the gpio-kempld driver with support for more recent models, interrupts and setting/getting multiple values at once - improve interrupt handling in gpio-brcmstb - add support for multi-SoC systems in gpio-tegra186 - make sure we return correct values from the .get() callbacks in several GPIO drivers by normalizing any values other than 0, 1 or negative error numbers - use flexible arrays in several drivers to reduce the number of required memory allocations - simplify synchronous waiting for virtual drivers to probe and remove the dedicated, a bit overengineered helper library dev-sync-probe - remove unneeded Kconfig dependencies on OF_GPIO in several drivers and subsystems - convert the two remaining users of of_get_named_gpio() to using GPIO descriptors and remove the (no longer used) function along with the header that declares it - add missing includes in gpio-mmio - shrink and simplify code in gpio-max732x by using guard(mutex) - remove duplicated code handling the 'ngpios' property from gpio-ts4800, it's already handled in GPIO core - use correct variable type in gpio-aspeed - add support for a new model in gpio-realtek-otto - allow to specify the active-low setting of simulated hogs over the configfs interface (in addition to existing devicetree support) in gpio-sim Bug fixes: - clear the OF_POPULATED flag on hog nodes in GPIO chip remove path on OF systems - fix resource leaks in error path in gpiochip_add_data_with_key() - drop redundant device reference in gpio-mpsse Tests: - add selftests for use-after-free cases in GPIO character device code DT bindings: - add a DT binding document for SCMI based, gpio-over-pinctrl devices - fix interrupt description in microchip,mpfs-gpio - add new compatible for gpio-realtek-otto - describe the resets of the mpfs-gpio controller - fix maintainer's email in gpio-delay bindings - remove the binding document for cavium,thunder-8890 as the corresponding device is bound over PCI and not firmware nodes Documentation: - update the recommended way of converting legacy boards to using software nodes for GPIO description - describe GPIO line value semantics - misc updates to kerneldocs Misc: - convert OMAP1 ams-delta board to using GPIO hogs described with software nodes" * tag 'gpio-updates-for-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (79 commits) gpio: swnode: defer probe on references to unregistered software nodes dt-bindings: gpio: cavium,thunder-8890: Remove DT binding Documentation: gpio: update the preferred method for using software node lookup gpio: gpio-by-pinctrl: s/used to do/is used to do/ gpio: aspeed: fix unsigned long int declaration gpio: rockchip: convert to dynamic GPIO base allocation gpio: remove dev-sync-probe gpio: virtuser: stop using dev-sync-probe gpio: aggregator: stop using dev-sync-probe gpio: sim: stop using dev-sync-probe gpio: Add Intel Nova Lake ACPI GPIO events driver gpiolib: Make deferral warnings debug messages gpiolib: fix hogs with multiple lines gpio: fix up CONFIG_OF dependencies gpio: gpio-by-pinctrl: add pinctrl based generic GPIO driver gpio: dt-bindings: Add GPIO on top of generic pin control firmware: arm_scmi: Allow PINCTRL_REQUEST to return EOPNOTSUPP pinctrl: scmi: ignore PIN_CONFIG_PERSIST_STATE pinctrl: scmi: Delete PIN_CONFIG_OUTPUT_IMPEDANCE_OHMS support pinctrl: scmi: Add SCMI_PIN_INPUT_VALUE ...
2026-04-13Merge tag 'thermal-7.1-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull thermal control updates from Rafael Wysocki: "These include thermal core fixes and simplifications, driver fixes and new hardware support (SDM670, Eliza SoC), new driver features (hwmon support in imx91, DDR data rate on Nova Lake in int340x), and a handful of cleanups: - Fix thermal core issues related to thermal zone removal and registration errors that may lead to a use-after-free or a memory leak in some cases (Rafael Wysocki) - Drop a redundant check from thermal_zone_device_update(), adjust thermal workqueue allocation flags, and switch over thermal_class allocation to static (Rafael Wysocki) - Relocate the suspend and resume of thermal zones closer to the suspend and resume of devices, respectively (Rafael Wysocki) - Remove a pointless variable used in the thermal core when registering a cooling device (Daniel Lezcano) - Replace sprintf() in thermal_bind_cdev_to_trip() and use str_enabled_disabled() helper in mode_show() (Thorsten Blum) - Replace cpumask_weight() in intel_hfi_offline() with cpumask_empty() which is generally more efficient (Yury Norov) - Add support for reading DDR data rate from PCI config space on Nova Lake platforms to the int340x thermal driver (Srinivas Pandruvada) - Add an OF node address to output message to make sensor names more distinguishable (Alexander Stein) - Add hwmon support for the i.MX97 thermal sensor (Alexander Stein) - Clamp correctly the results when doing value/temperature conversion in the Spreadtrum driver (Thorsten Blum) - Add SDM670 compatible DT bindings for the Tsens and the lMH thermal drivers (Richard Acayan) - Add SM8750 compatible DT bindings for the Tsens thermal driver (Manaf Meethalavalappu Pallikunhi) - Add Eliza SoC compatible DT bindings for the Tsens driver (Krzysztof Kozlowski) - Fix inverted condition check on error in the Spear thermal control driver (Gopi Krishna Menon) - Convert DT bindings documentation into DT schema (Gopi Krishna Menon) - Use max() macro to increase readability in the Broadcom STB thermal sensor (Thorsten Blum) - Remove a stale @trim_offset kernel-doc entry (John Madieu)" * tag 'thermal-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (25 commits) thermal: renesas: rzg3e: Remove stale @trim_offset kernel-doc entry thermal: core: Suspend thermal zones later and resume them earlier thermal: core: Allocate thermal_class statically thermal: core: Adjust thermal_wq allocation flags thermal: core: Drop redundant check from thermal_zone_device_update() thermal: core: Free thermal zone ID later during removal thermal: core: Fix thermal zone governor cleanup issues thermal/core: Remove pointless variable when registering a cooling device thermal/drivers/brcmstb_thermal: Use max to simplify brcmstb_get_temp dt-bindings: thermal: st,thermal-spear1340: convert to dtschema thermal/drivers/spear: Fix error condition for reading st,thermal-flags dt-bindings: thermal: qcom-tsens: Add Eliza SoC TSENS thermal: devfreq_cooling: avoid unnecessary kfree of freq_table thermal: intel: hfi: use cpumask_empty() in intel_hfi_offline() thermal: sysfs: Use str_enabled_disabled() helper in mode_show() dt-bindings: thermal: qcom-tsens: Document the SM8750 Temperature Sensor thermal/drivers/sprd: Use min instead of clamp in sprd_thm_temp_to_rawdata dt-bindings: thermal: lmh: Add SDM670 compatible dt-bindings: thermal: tsens: add SDM670 compatible thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp ...
2026-04-13Merge tag 'pm-7.1-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management updates from Rafael Wysocki: "Once again, cpufreq is the most active development area, mostly because of the new feature additions and documentation updates in the amd-pstate driver, but there are also changes in the cpufreq core related to boost support and other assorted updates elsewhere. Next up are power capping changes due to the major cleanup of the Intel RAPL driver. On the cpuidle front, a new C-states table for Intel Panther Lake is added to the intel_idle driver, the stopped tick handling in the menu and teo governors is updated, and there are a couple of cleanups. Apart from the above, support for Tegra114 is added to devfreq and there are assorted cleanups of that code, there are also two updates of the operating performance points (OPP) library, two minor updates related to hibernation, and cpupower utility man pages updates and cleanups. Specifics: - Update qcom-hw DT bindings to include Eliza hardware (Abel Vesa) - Update cpufreq-dt-platdev blocklist (Faruque Ansari) - Minor updates to driver and dt-bindings for Tegra (Thierry Reding, Rosen Penev) - Add MAINTAINERS entry for CPPC driver (Viresh Kumar) - Add support for new features: CPPC performance priority, Dynamic EPP, Raw EPP, and new unit tests for them to amd-pstate (Gautham Shenoy, Mario Limonciello) - Fix sysfs files being present when HW missing and broken/outdated documentation in the amd-pstate driver (Ninad Naik, Gautham Shenoy) - Pass the policy to cpufreq_driver->adjust_perf() to avoid using cpufreq_cpu_get() in the .adjust_perf() callback in amd-pstate which leads to a scheduling-while-atomic bug (K Prateek Nayak) - Clean up dead code in Kconfig for cpufreq (Julian Braha) - Remove max_freq_req update for pre-existing cpufreq policy and add a boost_freq_req QoS request to save the boost constraint instead of overwriting the last scaling_max_freq constraint (Pierre Gondois) - Embed cpufreq QoS freq_req objects in cpufreq policy so they all are allocated in one go along with the policy to simplify lifetime rules and avoid error handling issues (Viresh Kumar) - Use DMI max speed when CPPC is unavailable in the acpi-cpufreq scaling driver (Henry Tseng) - Switch policy_is_shared() in cpufreq to using cpumask_nth() instead of cpumask_weight() because the former is more efficient (Yury Norov) - Use sysfs_emit() in sysfs show functions for cpufreq governor attributes (Thorsten Blum) - Update intel_pstate to stop returning an error when "off" is written to its status sysfs attribute while the driver is already off (Fabio De Francesco) - Include current frequency in the debug message printed by __cpufreq_driver_target() (Pengjie Zhang) - Refine stopped tick handling in the menu cpuidle governor and rearrange stopped tick handling in the teo cpuidle governor (Rafael Wysocki) - Add Panther Lake C-states table to the intel_idle driver (Artem Bityutskiy) - Clean up dead dependencies on CPU_IDLE in Kconfig (Julian Braha) - Simplify cpuidle_register_device() with guard() (Huisong Li) - Use performance level if available to distinguish between rates in OPP debugfs (Manivannan Sadhasivam) - Fix scoped_guard in dev_pm_opp_xlate_required_opp() (Viresh Kumar) - Return -ENODATA if the snapshot image is not loaded (Alberto Garcia) - Remove inclusion of crypto/hash.h from hibernate_64.c on x86 (Eric Biggers) - Clean up and rearrange the intel_rapl power capping driver to make the respective interface drivers (TPMI, MSR, and MMOI) hold their own settings and primitives and consolidate PL4 and PMU support flags into rapl_defaults (Kuppuswamy Sathyanarayanan) - Correct kernel-doc function parameter names in the power capping core code (Randy Dunlap) - Remove unneeded casting for HZ_PER_KHZ in devfreq (Andy Shevchenko) - Use _visible attribute to replace create/remove_sysfs_files() in devfreq (Pengjie Zhang) - Add Tegra114 support to activity monitor device in tegra30-devfreq as a preparation to upcoming EMC controller support (Svyatoslav Ryhel) - Fix mistakes in cpupower man pages, add the boost and epp options to the cpupower-frequency-info man page, and add the perf-bias option to the cpupower-info man page (Roberto Ricci) - Remove unnecessary extern declarations from getopt.h in arguments parsing functions in cpufreq-set, cpuidle-info, cpuidle-set, cpupower-info, and cpupower-set utilities (Kaushlendra Kumar)" * tag 'pm-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (74 commits) cpufreq/amd-pstate: Add POWER_SUPPLY select for dynamic EPP cpupower: remove extern declarations in cmd functions cpuidle: Simplify cpuidle_register_device() with guard() PM / devfreq: tegra30-devfreq: add support for Tegra114 PM / devfreq: use _visible attribute to replace create/remove_sysfs_files() PM / devfreq: Remove unneeded casting for HZ_PER_KHZ MAINTAINERS: amd-pstate: Step down as maintainer, add Prateek as reviewer cpufreq: Pass the policy to cpufreq_driver->adjust_perf() cpufreq/amd-pstate: Pass the policy to amd_pstate_update() cpufreq/amd-pstate-ut: Add a unit test for raw EPP cpufreq/amd-pstate: Add support for raw EPP writes cpufreq/amd-pstate: Add support for platform profile class cpufreq/amd-pstate: add kernel command line to override dynamic epp cpufreq/amd-pstate: Add dynamic energy performance preference Documentation: amd-pstate: fix dead links in the reference section cpufreq/amd-pstate: Cache the max frequency in cpudata Documentation/amd-pstate: Add documentation for amd_pstate_floor_{freq,count} Documentation/amd-pstate: List amd_pstate_prefcore_ranking sysfs file Documentation/amd-pstate: List amd_pstate_hw_prefcore sysfs file amd-pstate-ut: Add a testcase to validate the visibility of driver attributes ...
2026-04-13scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()Greg Kroah-Hartman
target_tg_pt_gp_members_show() formats LUN paths with snprintf() into a 256-byte stack buffer, then will memcpy() cur_len bytes from that buffer. snprintf() returns the length the output would have had, which can exceed the buffer size when the fabric WWN is long because iSCSI IQN names can be up to 223 bytes. The check at the memcpy() site only guards the destination page write, not the source read, so memcpy() will read past the stack buffer and copy adjacent stack contents to the sysfs reader, which when CONFIG_FORTIFY_SOURCE is enabled, fortify_panic() will be triggered. Commit 27e06650a5ea ("scsi: target: target_core_configfs: Add length check to avoid buffer overflow") added the same bound to the target_lu_gp_members_show() but the tg_pt_gp variant was missed so resolve that here. Cc: Martin K. Petersen <martin.petersen@oracle.com> Fixes: c66ac9db8d4a ("[SCSI] target: Add LIO target core v4.0.0-rc6") Assisted-by: gregkh_clanker_t1000 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Link: https://patch.msgid.link/2026041159-garter-theft-3be0@gregkh Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-04-13Merge tag 'acpi-7.1-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI support updates from Rafael Wysocki: "These include an update of the CMOS RTC driver and the related ACPI and x86 code that, among other things, switches it over to using the platform device interface for device binding on x86 instead of the PNP device driver interface (which allows the code in question to be simplified quite a bit), a major update of the ACPI Time and Alarm Device (TAD) driver adding an RTC class device interface to it, and updates of core ACPI drivers that remove some unnecessary and not really useful code from them. Apart from that, two drivers are converted to using the platform driver interface for device binding instead of the ACPI driver one, which is slated for removal, support for the Performance Limited register is added to the ACPI CPPC library and there are some janitorial updates of it and the related cpufreq CPPC driver, the ACPI processor driver is fixed and cleaned up, and NVIDIA vendor CPER record handler is added to the APEI GHES code. Also, the interface for obtaining a CPU UID from ACPI is consolidated across architectures and used for fixing a problem with the PCI TPH Steering Tag on ARM64, there are two updates related to ACPICA, a minor ACPI OS Services Layer (OSL) update, and a few assorted updates related to ACPI tables parsing. Specifics: - Update maintainers information regarding ACPICA (Rafael Wysocki) - Replace strncpy() with strscpy_pad() in acpi_ut_safe_strncpy() (Kees Cook) - Trigger an ordered system power off after encountering a fatal error operator in AML (Armin Wolf) - Enable ACPI FPDT parsing on LoongArch (Xi Ruoyao) - Remove the temporary stop-gap acpi_pptt_cache_v1_full structure from the ACPI PPTT parser (Ben Horgan) - Add support for exposing ACPI FPDT subtables FBPT and S3PT (Nate DeSimone) - Address multiple assorted issues and clean up the code in the ACPI processor idle driver (Huisong Li) - Replace strlcat() in the ACPI processor idle drive with a better alternative (Andy Shevchenko) - Rearrange and clean up acpi_processor_errata_piix4() (Rafael Wysocki) - Move reference performance to capabilities and fix an uninitialized variable in the ACPI CPPC library (Pengjie Zhang) - Add support for the Performance Limited Register to the ACPI CPPC library (Sumit Gupta) - Add cppc_get_perf() API to read performance controls, extend cppc_set_epp_perf() for FFH/SystemMemory, and make the ACPI CPPC library warn on missing mandatory DESIRED_PERF register (Sumit Gupta) - Modify the cpufreq CPPC driver to update MIN_PERF/MAX_PERF in target callbacks to allow it to control performance bounds via standard scaling_min_freq and scaling_max_freq sysfs attributes and add sysfs documentation for the Performance Limited Register to it (Sumit Gupta) - Add ACPI support to the platform device interface in the CMOS RTC driver, make the ACPI core device enumeration code create a platform device for the CMOS RTC, and drop CMOS RTC PNP device support (Rafael Wysocki) - Consolidate the x86-specific CMOS RTC handling with the ACPI TAD driver and clean up the CMOS RTC ACPI address space handler (Rafael Wysocki) - Enable ACPI alarm in the CMOS RTC driver if advertised in ACPI FADT and allow that driver to work without a dedicated IRQ if the ACPI alarm is used (Rafael Wysocki) - Clean up the ACPI TAD driver in various ways and add an RTC class device interface, including both the RTC setting/reading and alarm timer support, to it (Rafael Wysocki) - Clean up the ACPI AC and ACPI PAD (processor aggregator device) drivers (Rafael Wysocki) - Rework checking for duplicate video bus devices and consolidate pnp.bus_id workarounds handling in the ACPI video bus driver (Rafael Wysocki) - Update the ACPI core device drivers to stop setting acpi_device_name() unnecessarily (Rafael Wysocki) - Rearrange code using acpi_device_class() in the ACPI core device drivers and update them to stop setting acpi_device_class() unnecessarily (Rafael Wysocki) - Define ACPI_AC_CLASS in one place (Rafael Wysocki) - Convert the ni903x_wdt watchdog driver and the xen ACPI PAD driver to bind to platform devices instead of ACPI devices (Rafael Wysocki) - Add devm_ghes_register_vendor_record_notifier(), use it in the PCI hisi driver, and Add NVIDIA vendor CPER record handler (Kai-Heng Feng) - Consolidate the interface for obtaining a CPU UID from ACPI across architectures and use it to address incorrect PCI TPH Steering Tag on ARM64 resulting from the invalid assumption that the ACPI Processor UID would always be the same as the corresponding logical CPU ID in Linux (Chengwen Feng)" * tag 'acpi-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (73 commits) ACPICA: Update maintainers information watchdog: ni903x_wdt: Convert to a platform driver ACPI: PAD: xen: Convert to a platform driver ACPI: processor: idle: Reset cpuidle on C-state list changes cpuidle: Extract and export no-lock variants of cpuidle_unregister_device() PCI/TPH: Pass ACPI Processor UID to Cache Locality _DSM ACPI: PPTT: Use acpi_get_cpu_uid() and remove get_acpi_id_for_cpu() perf: arm_cspmu: Switch to acpi_get_cpu_uid() from get_acpi_id_for_cpu() ACPI: Centralize acpi_get_cpu_uid() declaration in include/linux/acpi.h x86/acpi: Add acpi_get_cpu_uid() for unified ACPI CPU UID retrieval RISC-V: ACPI: Add acpi_get_cpu_uid() for unified ACPI CPU UID retrieval LoongArch: Add acpi_get_cpu_uid() for unified ACPI CPU UID retrieval arm64: acpi: Add acpi_get_cpu_uid() for unified ACPI CPU UID retrieval ACPI: APEI: GHES: Add NVIDIA vendor CPER record handler PCI: hisi: Use devm_ghes_register_vendor_record_notifier() ACPI: APEI: GHES: Add devm_ghes_register_vendor_record_notifier() ACPI: tables: Enable FPDT on LoongArch ACPI: processor: idle: Fix NULL pointer dereference in hotplug path ACPI: processor: idle: Reset power_setup_done flag on initialization failure ACPI: TAD: Add alarm support to the RTC class device interface ...
2026-04-13Merge tag 'driver-core-7.1-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core Pull driver core updates from Danilo Krummrich: "debugfs: - Fix NULL pointer dereference in debugfs_create_str() - Fix misplaced EXPORT_SYMBOL_GPL for debugfs_create_str() - Fix soundwire debugfs NULL pointer dereference from uninitialized firmware_file device property: - Make fwnode flags modifications thread safe; widen the field to unsigned long and use set_bit() / clear_bit() based accessors - Document how to check for the property presence devres: - Separate struct devres_node from its "subclasses" (struct devres, struct devres_group); give struct devres_node its own release and free callbacks for per-type dispatch - Introduce struct devres_action for devres actions, avoiding the ARCH_DMA_MINALIGN alignment overhead of struct devres - Export struct devres_node and its init/add/remove/dbginfo primitives for use by Rust Devres<T> - Fix missing node debug info in devm_krealloc() - Use guard(spinlock_irqsave) where applicable; consolidate unlock paths in devres_release_group() driver_override: - Convert PCI, WMI, vdpa, s390/cio, s390/ap, and fsl-mc to the generic driver_override infrastructure, replacing per-bus driver_override strings, sysfs attributes, and match logic; fixes a potential UAF from unsynchronized access to driver_override in bus match() callbacks - Simplify __device_set_driver_override() logic kernfs: - Send IN_DELETE_SELF and IN_IGNORED inotify events on kernfs file and directory removal - Add corresponding selftests for memcg platform: - Allow attaching software nodes when creating platform devices via a new 'swnode' field in struct platform_device_info - Add kerneldoc for struct platform_device_info software node: - Move software node initialization from postcore_initcall() to driver_init(), making it available early in the boot process - Move kernel_kobj initialization (ksysfs_init) earlier to support the above - Remove software_node_exit(); dead code in a built-in unit SoC: - Introduce of_machine_read_compatible() and of_machine_read_model() OF helpers and export soc_attr_read_machine() to replace direct accesses to of_root from SoC drivers; also enables CONFIG_COMPILE_TEST coverage for these drivers sysfs: - Constify attribute group array pointers to 'const struct attribute_group *const *' in sysfs functions, device_add_groups() / device_remove_groups(), and struct class Rust: - Devres: - Embed struct devres_node directly in Devres<T> instead of going through devm_add_action(), avoiding the extra allocation and the unnecessary ARCH_DMA_MINALIGN alignment - I/O: - Turn IoCapable from a marker trait into a functional trait carrying the raw I/O accessor implementation (io_read / io_write), providing working defaults for the per-type Io methods - Add RelaxedMmio wrapper type, making relaxed accessors usable in code generic over the Io trait - Remove overloaded per-type Io methods and per-backend macros from Mmio and PCI ConfigSpace - I/O (Register): - Add IoLoc trait and generic read/write/update methods to the Io trait, making I/O operations parameterizable by typed locations - Add register! macro for defining hardware register types with typed bitfield accessors backed by Bounded values; supports direct, relative, and array register addressing - Add write_reg() / try_write_reg() and LocatedRegister trait - Update PCI sample driver to demonstrate the register! macro Example: ``` register! { /// UART control register. CTRL(u32) @ 0x18 { /// Receiver enable. 19:19 rx_enable => bool; /// Parity configuration. 14:13 parity ?=> Parity; } /// FIFO watermark and counter register. WATER(u32) @ 0x2c { /// Number of datawords in the receive FIFO. 26:24 rx_count; /// RX interrupt threshold. 17:16 rx_water; } } impl WATER { fn rx_above_watermark(&self) -> bool { self.rx_count() > self.rx_water() } } fn init(bar: &pci::Bar<BAR0_SIZE>) { let water = WATER::zeroed() .with_const_rx_water::<1>(); // > 3 would not compile bar.write_reg(water); let ctrl = CTRL::zeroed() .with_parity(Parity::Even) .with_rx_enable(true); bar.write_reg(ctrl); } fn handle_rx(bar: &pci::Bar<BAR0_SIZE>) { if bar.read(WATER).rx_above_watermark() { // drain the FIFO } } fn set_parity(bar: &pci::Bar<BAR0_SIZE>, parity: Parity) { bar.update(CTRL, |r| r.with_parity(parity)); } ``` - IRQ: - Move 'static bounds from where clauses to trait declarations for IRQ handler traits - Misc: - Enable the generic_arg_infer Rust feature - Extend Bounded with shift operations, single-bit bool conversion, and const get() Misc: - Make deferred_probe_timeout default a Kconfig option - Drop auxiliary_dev_pm_ops; the PM core falls back to driver PM callbacks when no bus type PM ops are set - Add conditional guard support for device_lock() - Add ksysfs.c to the DRIVER CORE MAINTAINERS entry - Fix kernel-doc warnings in base.h - Fix stale reference to memory_block_add_nid() in documentation" * tag 'driver-core-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: (67 commits) bus: fsl-mc: use generic driver_override infrastructure s390/ap: use generic driver_override infrastructure s390/cio: use generic driver_override infrastructure vdpa: use generic driver_override infrastructure platform/wmi: use generic driver_override infrastructure PCI: use generic driver_override infrastructure driver core: make software nodes available earlier software node: remove software_node_exit() kernel: ksysfs: initialize kernel_kobj earlier MAINTAINERS: add ksysfs.c to the DRIVER CORE entry drivers/base/memory: fix stale reference to memory_block_add_nid() device property: Document how to check for the property presence soundwire: debugfs: initialize firmware_file to empty string debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str() debugfs: check for NULL pointer in debugfs_create_str() driver core: Make deferred_probe_timeout default a Kconfig option driver core: simplify __device_set_driver_override() clearing logic driver core: auxiliary bus: Drop auxiliary_dev_pm_ops device property: Make modifications of fwnode "flags" thread safe rust: devres: embed struct devres_node directly ...
2026-04-13Merge tag 'hardening-v7.1-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull hardening updates from Kees Cook: - randomize_kstack: Improve implementation across arches (Ryan Roberts) - lkdtm/fortify: Drop unneeded FORTIFY_STR_OBJECT test - refcount: Remove unused __signed_wrap function annotations * tag 'hardening-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: lkdtm/fortify: Drop unneeded FORTIFY_STR_OBJECT test refcount: Remove unused __signed_wrap function annotations randomize_kstack: Unify random source across arches randomize_kstack: Maintain kstack_offset per task
2026-04-13Merge tag 'libcrypto-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull crypto library updates from Eric Biggers: - Migrate more hash algorithms from the traditional crypto subsystem to lib/crypto/ Like the algorithms migrated earlier (e.g. SHA-*), this simplifies the implementations, improves performance, enables further simplifications in calling code, and solves various other issues: - AES CBC-based MACs (AES-CMAC, AES-XCBC-MAC, and AES-CBC-MAC) - Support these algorithms in lib/crypto/ using the AES library and the existing arm64 assembly code - Reimplement the traditional crypto API's "cmac(aes)", "xcbc(aes)", and "cbcmac(aes)" on top of the library - Convert mac80211 to use the AES-CMAC library. Note: several other subsystems can use it too and will be converted later - Drop the broken, nonstandard, and likely unused support for "xcbc(aes)" with key lengths other than 128 bits - Enable optimizations by default - GHASH - Migrate the standalone GHASH code into lib/crypto/ - Integrate the GHASH code more closely with the very similar POLYVAL code, and improve the generic GHASH implementation to resist cache-timing attacks and use much less memory - Reimplement the AES-GCM library and the "gcm" crypto_aead template on top of the GHASH library. Remove "ghash" from the crypto_shash API, as it's no longer needed - Enable optimizations by default - SM3 - Migrate the kernel's existing SM3 code into lib/crypto/, and reimplement the traditional crypto API's "sm3" on top of it - I don't recommend using SM3, but this cleanup is worthwhile to organize the code the same way as other algorithms - Testing improvements: - Add a KUnit test suite for each of the new library APIs - Migrate the existing ChaCha20Poly1305 test to KUnit - Make the KUnit all_tests.config enable all crypto library tests - Move the test kconfig options to the Runtime Testing menu - Other updates to arch-optimized crypto code: - Optimize SHA-256 for Zhaoxin CPUs using the Padlock Hash Engine - Remove some MD5 implementations that are no longer worth keeping - Drop big endian and voluntary preemption support from the arm64 code, as those configurations are no longer supported on arm64 - Make jitterentropy and samples/tsm-mr use the crypto library APIs * tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: (66 commits) lib/crypto: arm64: Assume a little-endian kernel arm64: fpsimd: Remove obsolete cond_yield macro lib/crypto: arm64/sha3: Remove obsolete chunking logic lib/crypto: arm64/sha512: Remove obsolete chunking logic lib/crypto: arm64/sha256: Remove obsolete chunking logic lib/crypto: arm64/sha1: Remove obsolete chunking logic lib/crypto: arm64/poly1305: Remove obsolete chunking logic lib/crypto: arm64/gf128hash: Remove obsolete chunking logic lib/crypto: arm64/chacha: Remove obsolete chunking logic lib/crypto: arm64/aes: Remove obsolete chunking logic lib/crypto: Include <crypto/utils.h> instead of <crypto/algapi.h> lib/crypto: aesgcm: Don't disable IRQs during AES block encryption lib/crypto: aescfb: Don't disable IRQs during AES block encryption lib/crypto: tests: Migrate ChaCha20Poly1305 self-test to KUnit lib/crypto: sparc: Drop optimized MD5 code lib/crypto: mips: Drop optimized MD5 code lib: Move crypto library tests to Runtime Testing menu crypto: sm3 - Remove 'struct sm3_state' crypto: sm3 - Remove the original "sm3_block_generic()" crypto: sm3 - Remove sm3_base.h ...
2026-04-13net: airoha: Remove PCE_MC_EN_MASK bit in REG_FE_PCE_CFG configurationLorenzo Bianconi
PCE_MC_EN_MASK bit in REG_FE_PCE_CFG configuration performed in airoha_fe_init() is used to duplicate multicast packets and send a copy to the CPU when the traffic is offloaded. This is necessary just if it is requested by the user. Disable multicast packets duplication by default. Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260412-airoha_fe_init_remove_mc_en_bit-v1-1-7b6a5a25a74d@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-13net: airoha: Rely on net_device pointer in ETS callbacksLorenzo Bianconi
Remove airoha_gdm_port dependency in ETS tc callback signatures and rely on net_device pointer instead. Please note this patch does not introduce any logical change and it is a preliminary patch in order to support multiple net_devices connected to the same GDM3 or GDM4 port via an external hw arbiter. Tested-by: Xuegang Lu <xuegang.lu@airoha.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260412-airoha-multi-serdes-preliminary-patch-v1-3-08d5b670ca8f@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-13net: airoha: Rely on net_device pointer in HTB callbacksLorenzo Bianconi
Remove airoha_gdm_port dependency in HTB tc callback signatures and rely on net_device pointer instead. Please note this patch does not introduce any logical change and it is a preliminary patch in order to support multiple net_devices connected to the same GDM3 or GDM4 port via an external hw arbiter. Tested-by: Xuegang Lu <xuegang.lu@airoha.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260412-airoha-multi-serdes-preliminary-patch-v1-2-08d5b670ca8f@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-13net: airoha: Rely on net_device pointer in airoha_dev_setup_tc_block signatureLorenzo Bianconi
Remove airoha_gdm_port dependency in airoha_dev_setup_tc_block routine signature and rely on net_device pointer instead. Please note this patch does not introduce any logical change and it is a preliminary patch to support multiple net_devices connected to the GDM3 or GDM4 ports via an external hw arbiter. Tested-by: Xuegang Lu <xuegang.lu@airoha.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260412-airoha-multi-serdes-preliminary-patch-v1-1-08d5b670ca8f@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-13net: dsa: mxl862xx: implement .get_stats64Daniel Golle
Poll free-running firmware RMON counters every 2 seconds and accumulate deltas into 64-bit per-port statistics. 32-bit packet counters wrap in ~220s at 10 Gbps line rate with minimum-size frames; the 2s polling interval provides a comfortable margin. The .get_stats64 callback forces a fresh poll so that counters are always up to date when queried. Signed-off-by: Daniel Golle <daniel@makrotopia.org> Link: https://patch.msgid.link/fa38548ba05866879e8912721edc91947ce4ff12.1775951347.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-13net: dsa: mxl862xx: add ethtool statistics supportDaniel Golle
The MxL862xx firmware exposes per-port RMON counters through the RMON_PORT_GET command, covering standard IEEE 802.3 MAC statistics (unicast/multicast/broadcast packet and byte counts, collision counters, pause frames) as well as hardware-specific counters such as extended VLAN discard and MTU exceed events. Add the RMON counter firmware API structures and command definitions. Implement .get_strings, .get_sset_count, and .get_ethtool_stats for legacy ethtool -S support. Implement .get_eth_mac_stats, .get_eth_ctrl_stats, and .get_pause_stats for the standardized IEEE 802.3 statistics interface. Signed-off-by: Daniel Golle <daniel@makrotopia.org> Link: https://patch.msgid.link/480be14d5ed51f3db7b1681b298044dbf8e87494.1775951347.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-13net: phy: realtek: use LEDCR page number define on RTL8211FAleksander Jan Bajkowski
Replace the magic number with an existing define for the LEDCR register page number on the RTL8211F. Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl> Reviewed-by: Daniel Golle <daniel@makrotopia.org> Link: https://patch.msgid.link/20260411105150.184577-1-olek2@wp.pl Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-13Merge tag 'for-7.1/io_uring-20260411' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring updates from Jens Axboe: - Add a callback driven main loop for io_uring, and BPF struct_ops on top to allow implementing custom event loop logic - Decouple IOPOLL from being a ring-wide all-or-nothing setting, allowing IOPOLL use cases to also issue certain white listed non-polled opcodes - Timeout improvements. Migrate internal timeout storage from timespec64 to ktime_t for simpler arithmetic and avoid copying of timespec data - Zero-copy receive (zcrx) updates: - Add a device-less mode (ZCRX_REG_NODEV) for testing and experimentation where data flows through the copy fallback path - Fix two-step unregistration regression, DMA length calculations, xarray mark usage, and a potential 32-bit overflow in id shifting - Refactoring toward multi-area support: dedicated refill queue struct, consolidated DMA syncing, netmem array refilling format, and guard-based locking - Zero-copy transmit (zctx) cleanup: - Unify io_send_zc() and io_sendmsg_zc() into a single function - Add vectorized registered buffer send for IORING_OP_SEND_ZC - Add separate notification user_data via sqe->addr3 so notification and completion CQEs can be distinguished without extra reference counting - Switch struct io_ring_ctx internal bitfields to explicit flag bits with atomic-safe accessors, and annotate the known harmless races on those flags - Various optimizations caching ctx and other request fields in local variables to avoid repeated loads, and cleanups for tctx setup, ring fd registration, and read path early returns * tag 'for-7.1/io_uring-20260411' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (58 commits) io_uring: unify getting ctx from passed in file descriptor io_uring/register: don't get a reference to the registered ring fd io_uring/tctx: clean up __io_uring_add_tctx_node() error handling io_uring/tctx: have io_uring_alloc_task_context() return tctx io_uring/timeout: use 'ctx' consistently io_uring/rw: clean up __io_read() obsolete comment and early returns io_uring/zcrx: use correct mmap off constants io_uring/zcrx: use dma_len for chunk size calculation io_uring/zcrx: don't clear not allocated niovs io_uring/zcrx: don't use mark0 for allocating xarray io_uring: cast id to u64 before shifting in io_allocate_rbuf_ring() io_uring/zcrx: reject REG_NODEV with large rx_buf_size io_uring/cancel: validate opcode for IORING_ASYNC_CANCEL_OP io_uring/rsrc: use io_cache_free() to free node io_uring/zcrx: rename zcrx [un]register functions io_uring/zcrx: check ctrl op payload struct sizes io_uring/zcrx: cache fallback availability in zcrx ctx io_uring/zcrx: warn on a repeated area append io_uring/zcrx: consolidate dma syncing io_uring/zcrx: netmem array as refiling format ...
2026-04-13bnge: return after auxiliary_device_uninit() in error pathGreg Kroah-Hartman
When auxiliary_device_add() fails, the error block calls auxiliary_device_uninit() but does not return. The uninit drops the last reference and synchronously runs bnge_aux_dev_release(), which sets bd->auxr_dev = NULL and frees the underlying object. The subsequent bd->auxr_dev->net = bd->netdev then dereferences NULL, which is not a good thing to have happen when trying to clean up from an error. Add the missing return, as the auxiliary bus documentation states is a requirement (seems that LLM tools read documentation better than humans do...) Cc: Vikas Gupta <vikas.gupta@broadcom.com> Cc: Andrew Lunn <andrew+netdev@lunn.ch> Fixes: 8ac050ec3b1c ("bng_en: Add RoCE aux device support") Cc: stable <stable@kernel.org> Assisted-by: gregkh_clanker_t1000 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Link: https://patch.msgid.link/2026041124-banshee-molecular-0f70@gregkh Signed-off-by: Jakub Kicinski <kuba@kernel.org>