summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2026-05-26irqchip/riscv-imsic: Add nr_guest_files in per-HART local configGuo Ren (Alibaba DAMO Academy)
Add nr_guest_files in per-HART local config to represent the number of guest files available on a particular HART whereas the nr_guest_files in the global config represents the number of guest files available across all HARTs. This allows KVM RISC-V to use nr_guest_files from per-HART local config for asymmetric big.Little systems. Signed-off-by: Guo Ren (Alibaba DAMO Academy) <guoren@kernel.org> Acked-by: Thomas Gleixner <tglx@kernel.org> Signed-off-by: Anup Patel <anup.patel@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260525094945.3721783-2-anup.patel@oss.qualcomm.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-05-25clk: socfpga: agilex: implement l3_main_free_clkAdrian Ng Ho Yin
The AGILEX_L3_MAIN_FREE_CLK is defined in the dt-bindings header but was never implemented in the clock driver. Per the Agilex TRM, l3_main_free_clk has no divider or mux and is a fixed 1:1 derivative of noc_free_clk that clocks most of the interconnect datapath. Signed-off-by: Adrian Ng Ho Yin <adrian.ho.yin.ng@altera.com> Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
2026-05-26Merge tag 'exynos-drm-next-for-v7.2' of ↵Dave Airlie
git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-next New feature and cleanup for Exynos fbdev - Move fbdev emulation to DRM client buffers . Reuses standard ADDFB2/GEM paths and simplifies cleanup. - Use DRM format helpers for geometry and size . Applies 4CC-based format/pitch/size calculation with stronger checks and PAGE_SIZE alignment. . Sets screen_size and fix.smem_len from actual allocated size. Exynos DRM internal cleanup - Adopt DRM core DMA tracking and drop redundant code . Removes private DMA tracking, exynos_drm_gem_prime_import(), and obsolete iommu_dma_init_domain() stub. - Reduce duplication and tighten local scope . Replaces MAX_FB_BUFFER with DRM_FORMAT_MAX_PLANES. . Drops redundant exynos_drm_gem.size and internalizes local-only helpers. Bug fix for Exynos fbdev behavior - Fix screen_buffer offset handling . Keeps screen_buffer at framebuffer base and avoids applying scanout offset. . Includes Fixes and stable Cc for backporting. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Inki Dae <inki.dae@samsung.com> Link: https://patch.msgid.link/20260521143624.56906-1-inki.dae@samsung.com
2026-05-26Merge tag 'mediatek-drm-next-20260521' of ↵Dave Airlie
https://git.kernel.org/pub/scm/linux/kernel/git/chunkuang.hu/linux into drm-next Mediatek DRM Next - 20260521 1. hdmi: Convert DRM_ERROR() to drm_err() 2. Simplify mtk_crtc allocation 3. mtk_dpi: Open-code drm_simple_encoder_init() 4. Convert legacy DRM logging to drm_* helpers in mtk_dsi.c 5. dsi: Add compatible for mt8167-dsi Signed-off-by: Dave Airlie <airlied@redhat.com> From: Chun-Kuang Hu <chunkuang.hu@kernel.org> Link: https://patch.msgid.link/20260521140841.5103-1-chunkuang.hu@kernel.org
2026-05-26Merge tag 'drm-xe-next-2026-05-21' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/xe/kernel into drm-next Driver Changes: - drm/xe/oa: Fix exec_queue leak on width check in stream open (Shuicheng Lin) - drm/xe/memirq: Drop cached iosys_map for MEMIRQ status (Michal Wajdeczko) - drm/xe/memirq: Drop cached iosys_map for MEMIRQ mask (Michal Wajdeczko) - drm/xe/memirq: Dump all source pages if MSI-X (Michal Wajdeczko) - drm/xe/memirq: Update diagnostic message (Michal Wajdeczko) - drm/xe/memirq: Reduce buffer size (Michal Wajdeczko) - drm/xe/memirq: Use IRQ page from HW engine definition (Michal Wajdeczko) - drm/xe/memirq: Update GuC initialization and IRQ handler (Michal Wajdeczko) - drm/xe/memirq: Make page layout macros private (Michal Wajdeczko) - drm/xe: Add IRQ page to HW engine definition (Michal Wajdeczko) - drm/xe/guc: Use xe_device_is_l2_flush_optimized() (Gustavo Sousa) - drm/xe/multi_queue: Fix secondary queue error case (Niranjana Vishwanathapura) - drm/xe/reg_sr: Do sanity check for MCR vs non-MCR (Gustavo Sousa) - drm/xe/mcr: Extract reg_in_steering_type_ranges() (Gustavo Sousa) - drm/xe/kunit: Use KUNIT_EXPECT_EQ() in xe_wa_gt() (Gustavo Sousa) - drm/xe: Extract xe_hw_engine_setup_reg_lrc() (Gustavo Sousa) - drm/xe: Define and use MCR version of COMMON_SLICE_CHICKEN4 (Gustavo Sousa) - drm/xe: Define and use MCR version of COMMON_SLICE_CHICKEN1 (Gustavo Sousa) - drm/xe: Define CACHE_MODE_1 as MCR register (Gustavo Sousa) - drm/xe/pf: Fix CFI failure in debugfs access (Mohanram Meenakshisundaram) - drm/xe/vf: Fix signature of print functions (Michal Wajdeczko) - drm/xe: Make drm_driver const (Michal Wajdeczko) - drm/xe/display: Drop xe_display_driver_set_hooks() (Michal Wajdeczko) - drm/xe/display: Add macro with display driver features (Michal Wajdeczko) - drm/xe/display: Add macro with display driver ops (Michal Wajdeczko) - drm/xe/display: Prefer forward declarations (Michal Wajdeczko) - drm/xe/display: Drop xe_display_driver_remove() stub (Michal Wajdeczko) - drm/xe: Drop unused drm/drm_atomic_helper.h include (Michal Wajdeczko) - drm/xe/sriov: Mark NVL as SR-IOV capable (Jakub Kolakowski) - drm/xe/gt_idle: Use NSEC_PER_MSEC instead of float literal (Shuicheng Lin) - drm/xe/gsc: Fix double-free of managed BO in error path (Shuicheng Lin) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Thomas Hellstrom <thomas.hellstrom@linux.intel.com> Link: https://patch.msgid.link/ag9RLujZiYYnSc_F@fedora
2026-05-25eth: dpaa2: constify dpaa2_ethtool_stats and dpaa2_ethtool_extrasLen Bao
The 'dpaa2_ethtool_stats' and 'dpaa2_ethtool_extras' structures are initialized in their declarations and never changed. So, constify them to reduce the attack surface. Before the patch (size dpaa2-ethtool.o): text data bss dec hex 33433 5992 0 39425 9a01 After the patch (size dpaa2-ethtool.o): text data bss dec hex 34937 4488 0 39425 9a01 Signed-off-by: Len Bao <len.bao@gmx.us> Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com> Link: https://patch.msgid.link/20260523150737.36988-1-len.bao@gmx.us Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-25net: ibm: emac: Use napi_gro_receive() for Rx packetsRosen Penev
emac_poll_rx() already runs in NAPI context and TAH-equipped EMACs set CHECKSUM_UNNECESSARY on verified frames, which lets GRO coalesce TCP segments without a software checksum on the merge path. Replace the per-poll rx_list batched with netif_receive_skb_list() with direct napi_gro_receive() calls so the stack can merge segments into super-skbs and skip a full traversal per packet -- a meaningful win on the slow 4xx-class CPUs this driver targets. Small routing speed improvement tested on a Cisco Meraki MX60W: Tested with iperf3 Before: [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 494 MBytes 414 Mbits/sec 839 sender [ 5] 0.00-10.04 sec 492 MBytes 411 Mbits/sec receiver After: [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 510 MBytes 428 Mbits/sec 580 sender [ 5] 0.00-10.04 sec 508 MBytes 424 Mbits/sec receiver Traffic to and from the router seems to be slow no matter what: Tested with iperf3 --bidir Before: [ ID][Role] Interval Transfer Bitrate Retr [ 8][TX-C] 0.00-10.00 sec 297 MBytes 249 Mbits/sec 35 sender [ 8][TX-C] 0.00-10.00 sec 293 MBytes 245 Mbits/sec receiver [ 10][RX-C] 0.00-10.00 sec 184 MBytes 154 Mbits/sec 0 sender [ 10][RX-C] 0.00-10.00 sec 184 MBytes 154 Mbits/sec receiver After: [ ID][Role] Interval Transfer Bitrate Retr [ 8][TX-C] 0.00-10.00 sec 295 MBytes 248 Mbits/sec 31 sender [ 8][TX-C] 0.00-10.00 sec 294 MBytes 246 Mbits/sec receiver [ 10][RX-C] 0.00-10.00 sec 181 MBytes 152 Mbits/sec 0 sender [ 10][RX-C] 0.00-10.00 sec 181 MBytes 152 Mbits/sec receiver Signed-off-by: Rosen Penev <rosenp@gmail.com> Link: https://patch.msgid.link/20260521215908.257118-1-rosenp@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-25devlink: pass param values by pointerRatheesh Kannoth
union devlink_param_value grows substantially once U64 array parameters are added to devlink (from 32 bytes to over 264 bytes). devlink_nl_param_value_fill_one() and devlink_nl_param_value_put() copy the union by value in several places. Passing two instances as value arguments alone consumes over 528 bytes of stack; combined with deeper call chains the parameter stack can approach 800 bytes and trip CONFIG_FRAME_WARN more easily. Switch internal helpers and exported driver APIs to pass pointers to union devlink_param_value rather than passing the union by value. Reviewed-by: Petr Machata <petrm@nvidia.com> # for mlxsw Acked-by: Przemek Kitszel <przemyslaw.kitszel@intel.com> Reviewed-by: Arthur Kiyanovski <akiyano@amazon.com> #for ena Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com> Link: https://patch.msgid.link/20260521095303.2395584-4-rkannoth@marvell.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-25net/mlx5e: Reduce stack use reading PCIe congestion thresholdsRatheesh Kannoth
union devlink_param_value grew when U64 array parameters were added. Keeping union devlink_param_value val[4] in mlx5e_pcie_cong_get_thresh_config() exceeded the compiler's -Wframe-larger-than limit. Reuse one union: call devl_param_driverinit_value_get() once per MLX5 PCIe congestion threshold and assign each vu16 to the corresponding mlx5e_pcie_cong_thresh member. Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com> Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com> Link: https://patch.msgid.link/20260521095303.2395584-3-rkannoth@marvell.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-26Merge tag 'drm-misc-next-2026-05-21' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/misc/kernel into drm-next drm-misc-next for v7.2-rc1: UAPI Changes: - Add VIRTIO_GPU_F_BLOB_ALIGNMENT flag. Cross-subsystem Changes: - Add common TMDS character rate constants to video/hdmi and use those in bridge drivers. Core Changes: - Fix leak in drm_syncobj_find_fence. - Fix OOB reads related to DP-MST. - Create drm_get_bridge_by_endpoint and convert drivers to use it in preparation of hotplug. Driver Changes: - Assorted bugfixes and cleanups to accel/ethosu, imagination, virtio, rockchip. - Expandable device heap support to amdxdna, bridge/chipone-icn6211. - Add Surface Pro 12 panels. - Convert ite-it6211 to use drm hdmi audio helpers. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Link: https://patch.msgid.link/f4034e3c-8290-49e1-9410-dc1f449265f4@linux.intel.com
2026-05-25net/mlx5: Add SPF function type for page managementMoshe Shemesh
Add MLX5_SPF to enum mlx5_func_type so SPFs get their own page counter, and add the corresponding WARN check at page cleanup. Wait for SPF pages to be reclaimed during ECPF teardown, alongside the existing host PF and VF page waits. SPF page requests are always identified by vhca_id, so the legacy func_id_to_type() path is not reached for satellite PFs. Signed-off-by: Moshe Shemesh <moshe@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260521110843.367329-13-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-25net/mlx5: Add FDB peer miss rules for satellite PFsMoshe Shemesh
Add satellite PF (SPF) vports to the FDB peer miss rules flow. Introduce mlx5_esw_for_each_spf_vport() macro to iterate SPF vports. Signed-off-by: Moshe Shemesh <moshe@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260521110843.367329-12-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-25net/mlx5: Support state get/set for satellite PF portsMoshe Shemesh
Extend mlx5_devlink_pf_port_fn_state_get() to support satellite PF vports by querying their vhca_state from the query_esw_functions output using the vport's vhca_id. Extend mlx5_devlink_pf_port_fn_state_set() to support satellite PFs by using the generic mlx5_esw_pf_enable/disable_hca() functions. Signed-off-by: Moshe Shemesh <moshe@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260521110843.367329-11-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-25net/mlx5: Register SF resource on satellite PF portsOr Har-Toov
Extend port-level resource registration to satellite PF vports. Signed-off-by: Or Har-Toov <ohartoov@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260521110843.367329-10-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-25net/mlx5: Register devlink ports for satellite PFsMoshe Shemesh
Include satellite PFs in mlx5_eswitch_is_pf_vf_vport() so they receive the standard PF/VF devlink port operations. Update mlx5_esw_devlink_port_supported() and devlink port attribute setup to register SPF devlink ports with controller number and PF number. Add mlx5_esw_spf_vport_to_idx() to look up the SPF array index by vport number, and mlx5_esw_is_spf_vport() boolean wrapper to identify satellite PF vports. Signed-off-by: Moshe Shemesh <moshe@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260521110843.367329-9-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-25net/mlx5: Map SF controller to pfnum for satellite PFsMoshe Shemesh
SF devlink port creation and registration used the ECPF's PCI function as pfnum. Extend this to support satellite PF controllers by introducing mlx5_esw_sf_controller_to_pfnum() that maps a controller number to the corresponding PF number, and use it in SF port attribute setup and SF creation validation. Reorder the checks in mlx5_devlink_sf_port_new() so that mlx5_sf_table_supported() runs before attribute validation, since the new helper requires the eswitch to be initialized. Signed-off-by: Moshe Shemesh <moshe@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260521110843.367329-8-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-25net/mlx5: Expose PF number from query_esw_functionsMoshe Shemesh
Extract pci_device_function from the query_esw_functions output for both the host PF and satellite PFs, storing it alongside the existing host_number field. Add mlx5_esw_get_hpf_pf_num() helper that returns the host PF's actual PCI device function when the new query format is supported, falling back to PCI_FUNC(dev->pdev->devfn) for older firmware. Use it in devlink port attribute setup so that host PF and VF devlink ports report the correct PF number rather than the ECPF's own PCI function number. Signed-off-by: Moshe Shemesh <moshe@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260521110843.367329-7-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-25net/mlx5: Support SPF SFs in SF hardware tableMoshe Shemesh
Convert the SF hardware table from a fixed-size hwc array to a dynamically allocated one, supporting satellite PF (SPF) SFs alongside local and external host SFs. Initialize hwc entries for each SPF using its host_number as controller. Rename MLX5_SF_HWC_EXTERNAL to MLX5_SF_HWC_EXT_HOST and add MLX5_SF_HWC_FIRST_SPF for clarity. Signed-off-by: Moshe Shemesh <moshe@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260521110843.367329-6-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-25net/mlx5: Initialize satellite PF SF vportsMoshe Shemesh
Extend satellite PF (SPF) initialization to allocate SF vports for each SPF. For each discovered SPF, query its SF capabilities, allocate SF vports, and store the host_number for controller identification. Add accessor APIs mlx5_esw_get_num_spfs(), mlx5_esw_spf_get_host_number(), mlx5_esw_sf_max_spf_functions(), and mlx5_esw_has_spf_sfs() for use by the SF hardware table in a subsequent patch. Also extend mlx5_esw_offloads_controller_valid() to accept SPF controllers in addition to the host PF controller. Signed-off-by: Moshe Shemesh <moshe@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260521110843.367329-5-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-25net/mlx5: Initialize host PF host number earlierMoshe Shemesh
Move host_number from esw->offloads to esw->esw_funcs as hpf_host_number and initialize it during vports_init instead of offloads_enable. This makes the host PF host number available earlier in the initialization sequence, which is required for upcoming SF hardware table support for satellite PFs. Add a mlx5_esw_get_hpf_host_number() accessor to retrieve the stored host number. Signed-off-by: Moshe Shemesh <moshe@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260521110843.367329-4-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-25net/mlx5: Introduce generic helper for PF SFs infoMoshe Shemesh
Introduce mlx5_esw_sf_max_pf_functions() that queries a PF's max_num_sf and sf_base_id using mlx5_vport_get_other_func_general_cap(), which supports both function_id and vhca_id based addressing. Refactor mlx5_esw_sf_max_hpf_functions() into a thin wrapper that adds the host PF precondition checks and calls the new generic helper. Remove mlx5_query_hca_cap_host_pf() as it is not used anymore. This prepares for querying SFs info of Satellite PFs. Signed-off-by: Moshe Shemesh <moshe@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260521110843.367329-3-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-25net/mlx5: Add satellite PF vport supportMoshe Shemesh
Discover satellite PFs from query_esw_functions output and allocate eswitch vports for them. For each satellite PF, create a vport via the CREATE_ESW_VPORT command using its vhca_id and allocate it in the eswitch vport table. When enabling switchdev mode, the ECPF acting as the eswitch manager activates each satellite PF with enable_hca, loads its vport and adds a representor. Since satellite PF devlink ports are registered in a later patch, guard mlx5_esw_offloads_devlink_port() against vports with no devlink port to avoid NULL dereference during representor attach. Signed-off-by: Moshe Shemesh <moshe@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260521110843.367329-2-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-25net: lan966x: cleanup error handling in lan966x_fdma_rx_alloc_page_pool()Dan Carpenter
This code works, but there are a few things to tidy up: 1. No need to an unlikely() because IS_ERR() already has an unlikely() built in. 2. No need to use PTR_ERR_OR_ZERO() because it's not an error pointer. 3. Use the returned error code directly instead of using groveling in rx->page_pool to find it. Signed-off-by: Dan Carpenter <error27@gmail.com> Link: https://patch.msgid.link/ag7_YBWRpRmY9MGT@stanley.mountain Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-25clk: at91: sama7d65: add peripheral clock for I3CDurai Manickam KR
Add peripheral clock description for I3C. Signed-off-by: Durai Manickam KR <durai.manickamkr@microchip.com> Reviewed-by: Claudiu Beznea <claudiu.beznea@tuxon.dev> Signed-off-by: Manikandan Muralidharan <manikandan.m@microchip.com> Link: https://lore.kernel.org/r/20260525092405.1514213-3-manikandan.m@microchip.com Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
2026-05-25octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notifyMichael Bommarito
rvu_mbox_handler_rep_event_notify() in drivers/net/ethernet/marvell/ octeontx2/af/rvu_rep.c queues a sender-controlled REP_EVENT_NOTIFY request body verbatim, and rvu_rep_up_notify() then forwards event->pcifunc (the nested body field, distinct from the AF-normalised header pcifunc) into rvu_get_pfvf(), rvu_get_pf() and the AF->PF mailbox device index without any bounds check. A VF attached to a PF that has been put into switchdev representor mode reaches this path: the VF mailbox handler otx2_pfvf_mbox_handler() forwards every message id including MBOX_MSG_REP_EVENT_NOTIFY to AF without an allowlist, and the AF dispatcher rewrites only msg->pcifunc, leaving struct rep_event::pcifunc attacker-controlled. The sibling rvu_mbox_handler_esw_cfg() refuses requests whose header pcifunc is not rvu->rep_pcifunc; this handler has no equivalent gate. An out-of-range body pcifunc selects an &rvu->pf[]/&rvu->hwvf[] element past the allocated array and, for RVU_EVENT_MAC_ADDR_CHANGE, turns into a six-byte attacker-chosen OOB ether_addr_copy() target inside the queued worker; KASAN reports a slab-out-of-bounds write in rvu_rep_wq_handler. Reject malformed requests at the handler entry by gating on is_pf_func_valid(), which is already the canonical PF/VF range check in this driver; expose it via rvu.h so callers in rvu_rep.c can use it instead of open-coding the same range arithmetic. Fixes: b8fea84a0468 ("octeontx2-pf: Add support to sync link state between representor and VFs") Cc: stable@vger.kernel.org Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com> Link: https://patch.msgid.link/20260520154157.1439319-1-michael.bommarito@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-25Merge tag 'for-7.1/dm-fixes-2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fix from Mikulas Patocka: - fix crashes in dm-vdo if GFP_NOWAIT allocation fails * tag 'for-7.1/dm-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm vdo: use GFP_NOIO for blkdev_issue_zeroout on format path
2026-05-25macsec: fix replay protection at XPN lower-PN wrapJunrui Luo
In macsec_post_decrypt(), when pn is U32_MAX, pn + 1 overflows u32 to 0 and the first branch never fires. If next_pn_halves.lower is also in the upper half, pn_same_half(pn, lower) is true and the XPN else-if does not fire either, leaving next_pn_halves unchanged. An attacker that captures the legitimate frame carrying pn == 0xFFFFFFFF on an XPN association can then replay it indefinitely, since lowest_pn never rises above the captured pn and macsec_decrypt() reconstructs the same IV. Extend the XPN else-if to also fire when pn + 1 wraps to 0, so receipt of pn == U32_MAX advances next_pn_halves to (upper + 1, 0). Fixes: a21ecf0e0338 ("macsec: Support XPN frame handling - IEEE 802.1AEbw") Reported-by: Yuhao Jiang <danisjiang@gmail.com> Cc: stable@vger.kernel.org Signed-off-by: Junrui Luo <moonafterrain@outlook.com> Link: https://patch.msgid.link/SYBPR01MB78813FD49E58F253B989F197AF012@SYBPR01MB7881.ausprd01.prod.outlook.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-25gpu: nova-core: vbios: remove unused rom_header fieldEliot Courtney
This is only used during construction, so we can remove it. Signed-off-by: Eliot Courtney <ecourtney@nvidia.com> Link: https://patch.msgid.link/20260525-fix-vbios-v5-22-e5e455251537@nvidia.com Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-05-25gpu: nova-core: vbios: move constants and functions to be associatedEliot Courtney
Move constants and functions to be inside the impls of the types they are related to. This makes it more obvious what each type and value is for. Signed-off-by: Eliot Courtney <ecourtney@nvidia.com> Link: https://patch.msgid.link/20260525-fix-vbios-v5-21-e5e455251537@nvidia.com Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-05-25gpu: nova-core: vbios: drop redundant TryFrom importEliot Courtney
This is unused. Reviewed-by: John Hubbard <jhubbard@nvidia.com> Signed-off-by: Eliot Courtney <ecourtney@nvidia.com> Link: https://patch.msgid.link/20260525-fix-vbios-v5-20-e5e455251537@nvidia.com Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-05-25gpu: nova-core: vbios: drop unused image wrappersEliot Courtney
These are unused currently, and it is probably sufficient to just check the type of BIOS image in the future. Reviewed-by: John Hubbard <jhubbard@nvidia.com> Signed-off-by: Eliot Courtney <ecourtney@nvidia.com> Link: https://patch.msgid.link/20260525-fix-vbios-v5-19-e5e455251537@nvidia.com Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-05-25gpu: nova-core: vbios: remove unnecessary fields in PciRomHeaderEliot Courtney
Remove unnecessary fields in PciRomHeader. This allows a simplification to use `FromBytes` instead of reading fields piecemeal. A lot of these checks were redundant as well since it checks the size of the `data` first in `BiosImage`. Reviewed-by: John Hubbard <jhubbard@nvidia.com> Signed-off-by: Eliot Courtney <ecourtney@nvidia.com> Link: https://patch.msgid.link/20260525-fix-vbios-v5-18-e5e455251537@nvidia.com Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-05-25gpu: nova-core: vbios: use let-else in Vbios::newEliot Courtney
Improve readability by moving the success path outside of a nested branch. Reviewed-by: John Hubbard <jhubbard@nvidia.com> Signed-off-by: Eliot Courtney <ecourtney@nvidia.com> Link: https://patch.msgid.link/20260525-fix-vbios-v5-17-e5e455251537@nvidia.com Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-05-25gpu: nova-core: vbios: use single logical block for the FWSEC sectionEliot Courtney
Currently, FWSEC takes the first image and the last image. Treat the first FWSEC image and all following image data as one logical block for building the final FWSEC image. This avoids explicitly tracking two FWSEC images. Signed-off-by: Eliot Courtney <ecourtney@nvidia.com> Link: https://patch.msgid.link/20260525-fix-vbios-v5-16-e5e455251537@nvidia.com Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-05-25gpu: nova-core: vbios: use the first PCI-AT imageEliot Courtney
Currently, PCI-AT takes the final image if multiple exist. Use the first one instead, to match nouveau behaviour. Signed-off-by: Eliot Courtney <ecourtney@nvidia.com> Link: https://patch.msgid.link/20260525-fix-vbios-v5-15-e5e455251537@nvidia.com Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-05-25Merge tag 'v7.1-rc5' into rdma.git for-nextJason Gunthorpe
For dependencies in the following patches Resolve conflicts, use the goto labels from the rc tag. * tag 'v7.1-rc5': (1526 commits) Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-05-25dm-inlinecrypt: add support for hardware-wrapped keysLinlin Zhang
Add support for hardware-wrapped encryption keys to the dm-inlinecrypt target. Introduce a new optional argument <key_type> to indicate whether the provided key is a raw key or a hardware-wrapped key. Based on this flag, the appropriate blk-crypto key type is selected when initializing the key. This allows dm-inlinecrypt to work with hardware that requires keys to be wrapped and managed by the underlying inline encryption engine. Update the target argument parsing accordingly and pass the key type to blk_crypto_init_key(). Documentation is also updated to reflect the new parameter and usage. Signed-off-by: Linlin Zhang <linlin.zhang@oss.qualcomm.com> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Fixes: e7f57d2c47e2 ("dm-inlinecrypt: add target for inline block device encryption")
2026-05-25RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanupTao Cui
The error cleanup loop in rdma_counter_init() iterates with variable 'i' but accesses dev->port_data[port] instead of dev->port_data[i]. This causes the failed port's hstats to be freed multiple times while leaking hstats of previously initialized ports. Fixes: 56594ae1d250 ("RDMA/core: Annotate destroy of mutex to ensure that it is released as unlocked") Link: https://patch.msgid.link/r/20260520104546.1776253-3-cuitao@kylinos.cn Signed-off-by: Tao Cui <cuitao@kylinos.cn> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-05-25RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind()Tao Cui
When __rdma_counter_bind_qp() fails in alloc_and_bind(), the error path jumps to err_mode which frees the counter without decrementing port_counter->num_counters. The only place that decrements is rdma_counter_free(), which is unreachable since the counter was never successfully bound. This leak accumulates across repeated failures, permanently preventing the port from switching to AUTO mode (-EBUSY in __counter_set_mode()) and blocking the MANUAL→NONE auto-revert in rdma_counter_free(). When the mode was NONE before the call, the MANUAL mode set by __counter_set_mode() also leaks since the revert logic is never reached. Add an err_bind label between the num_counters increment and the existing err_mode label. It decrements num_counters and mirrors the MANUAL→NONE revert from rdma_counter_free(), ensuring the port state is fully restored on bind failure. Link: https://patch.msgid.link/r/20260520104546.1776253-2-cuitao@kylinos.cn Signed-off-by: Tao Cui <cuitao@kylinos.cn> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-05-25remoteproc: use rsc_table_for_each_entry() in rproc_handle_resources()Mukesh Ojha
Replace the open-coded resource table iteration loop in rproc_handle_resources() with the rsc_table_for_each_entry() helper. The remoteproc-specific dispatch logic (vendor resource handling via rproc_handle_rsc(), RSC_LAST bounds check, handler table lookup) is moved into a local callback rproc_handle_rsc_entry(), keeping the iteration mechanics in one canonical place. The callback receives the payload offset within the table so that handlers which write back into the resource table (e.g. rproc_handle_carveout() recording a dynamically allocated address via rsc_offset) continue to work correctly. No functional change. Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260506050107.1985033-3-mukesh.ojha@oss.qualcomm.com
2026-05-25net/mlx5: HWS: Reject unsupported remove-header actionPrathamesh Deshpande
mlx5_cmd_hws_packet_reformat_alloc() handles MLX5_REFORMAT_TYPE_REMOVE_HDR by looking up a matching HWS remove-header action. If mlx5_fs_get_action_remove_header_vlan() returns NULL, the code only logs an error and continues. The function then returns success with a NULL HWS action stored in the packet-reformat object. Return an error when no matching remove-header action is available. Fixes: aecd9d1020e3 ("net/mlx5: fs, add HWS packet reformat API function") Signed-off-by: Prathamesh Deshpande <prathameshdeshpande7@gmail.com> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Yevgeny Kliteynik <kliteyn@nvidia.com> Acked-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260506000054.51797-1-prathameshdeshpande7@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-25ACPI: video: Switch over to devres-based resource managementRafael J. Wysocki
Turn acpi_video_bus_remove_notify_handler() into a devm action added by acpi_video_bus_probe() after calling acpi_video_bus_add_notify_handler and use the newly introduced devm_acpi_install_notify_handler() to install an ACPI notify handler for the video bus device. This replaces the rollback path remnant in acpi_video_bus_probe() and allows acpi_video_bus_remove() to be dropped altogether. No intentional functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/2556320.jE0xQCEvom@rafael.j.wysocki
2026-05-25ACPI: video: Use devm for video->entry and backlight cleanupRafael J. Wysocki
Introduce acpi_video_bus_del() for removing the video bus object from the video_bus_head list and unregistering backlight and make acpi_video_bus_probe() add it as a devm action after adding the video bus object to the video_bus_head list. Accordingly, remove the code superseded by it from acpi_video_bus_remove() and from the rollback path in acpi_video_bus_probe(). No intentional functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/2279582.Icojqenx9y@rafael.j.wysocki
2026-05-25ACPI: video: Use devm action for freeing video devicesRafael J. Wysocki
Rename acpi_video_bus_put_devices() to devm_acpi_video_bus_get_devices() and turn acpi_video_bus_put_devices() into a devm action added by it for freeing the video devices allocated by it and the attached_array memory. Accordingly, remove the acpi_video_bus_put_devices() calls and attached_array freeing from acpi_video_bus_remove() and the rollback path in acpi_video_bus_probe(). No intentional functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/1932803.atdPhlSkOF@rafael.j.wysocki
2026-05-25ACPI: video: Use devm action for video bus object cleanupRafael J. Wysocki
Introduce acpi_video_bus_free() for freeing video bus object memory and reversing changes related to it made during ACPI video bus device probe, modify acpi_video_bus_probe() to add acpi_video_bus_free() as a devm action, and remove the code superseded by it from acpi_video_bus_remove(). No intentional functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/3892168.MHq7AAxBmi@rafael.j.wysocki
2026-05-25ACPI: video: Rearrange probe and remove codeRafael J. Wysocki
Rearrange some ACPI video bus probe and remove code so that it is more clear that the probe and removal are carried in reverse orders, which will also facilitate subsequent changes. No intentional functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/2276683.Mh6RI2rZIc@rafael.j.wysocki
2026-05-25ACPI: video: Reduce the number of auxiliary device dereferencesRafael J. Wysocki
Store the &aux_dev->dev pointer in a separate local variable in acpi_video_bus_probe() to avoid dereferencing aux_dev many times. No intentional functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/2707186.Lt9SDvczpP@rafael.j.wysocki
2026-05-25ACPI: PAD: Switch over to devres-based resource managementRafael J. Wysocki
Use the newly introduced devm_acpi_install_notify_handler() for installing an ACPI notify handler and since that function checks the ACPI companion of the owner device against NULL internally, remove the the explicit ACPI companion check from acpi_pad_probe(). However, to prevent the notify handler from running acpi_pad_idle_cpus() with the number of idle CPUs greater than zero after acpi_pad_remove() has returned, add a bool static variable for synchronization between the two. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/1964581.CQOukoFCf9@rafael.j.wysocki
2026-05-25ACPI: PAD: Fix teardown ordering in acpi_pad_remove()Rafael J. Wysocki
The ACPI notify handler installed by acpi_pad_probe() needs to be removed before calling acpi_pad_idle_cpus() in acpi_pad_remove() so it doesn't schedule idle time injection on some CPUs again. Fixes: 8e0af5141ab9 ("ACPI: create Processor Aggregator Device driver") Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/2064153.usQuhbGJ8B@rafael.j.wysocki
2026-05-25ACPI: PAD: Pass struct device pointer to acpi_pad_notify()Rafael J. Wysocki
Use the struct device pointer to the dev member in the struct platform_device object representing the platform device used for driver binding as the last argument of acpi_dev_install_notify_handler() and accordingly update acpi_pad_notify() to pass that pointer directly to dev_name() when generating the netlink event. Since the dev_name() value for an ACPI-enumerated platform device is the same as the dev_name() value for the dev member of its ACPI companion object, as per acpi_create_platform_device(), the above code modification is not expected to cause functionality to change. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/1862521.VLH7GnMWUR@rafael.j.wysocki