Commit graph

1,462,193 commits

Author SHA1 Message Date
Krzysztof Kozlowski
1cc30cfc66 Reset controller fixes for v7.0, part 3
* Add missing reset ops for amlogic,t7-reset to the reset-meson driver.
   The resets are unused as of now, but as soon as they are, the driver
   would otherwise run into a NULL pointer dereference.
 -----BEGIN PGP SIGNATURE-----
 
 iI0EABYKADUWIQRRO6F6WdpH1R0vGibVhaclGDdiwAUCadYiQBcccC56YWJlbEBw
 ZW5ndXRyb25peC5kZQAKCRDVhaclGDdiwMJ8AP9OANOyRc3ZeY8P6EQ+4BebOjiQ
 H3yJxgF21XhAmtm2awEAlmnyZDMkp+5UFj6Fo4a+jo/BjL2uMCUjaqPgzDDfJAA=
 =QTno
 -----END PGP SIGNATURE-----

Merge tag 'reset-fixes-for-v7.0-3' of https://git.pengutronix.de/git/pza/linux into arm/fixes

Reset controller fixes for v7.0, part 3

* Add missing reset ops for amlogic,t7-reset to the reset-meson driver.
  The resets are unused as of now, but as soon as they are, the driver
  would otherwise run into a NULL pointer dereference.

* tag 'reset-fixes-for-v7.0-3' of https://git.pengutronix.de/git/pza/linux:
  reset: amlogic: t7: Fix null reset ops

Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
2026-04-11 10:51:23 +02:00
Krzysztof Kozlowski
33a20cdaf4 Arm FF-A fix for v7.1
Use the page aligned backing allocation size when computing the RXTX_MAP
 page count. This fixes FF-A RX/TX buffer registration on kernels built
 with 16K/64K PAGE_SIZE, where alloc_pages_exact() backs the buffer with a
 larger aligned span than the discovered minimum buffer size.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEunHlEgbzHrJD3ZPhAEG6vDF+4pgFAmnU1mgACgkQAEG6vDF+
 4pgxLRAA2Ajhzi3ckYBv10LqiOoRVqW9MscCCub6+lmByt0Yh1ZyzyOOrEeMDU0a
 U/GxU4qkImflmcm5bZ7etADEkZVzvjg3Bj3e9riZ7yPaX2tHgwUx3H4ULHpyVGgP
 uOFf2bsvduDnMMpm4E2f8ra5YPHyklCcQ6H+U0oH+uqnxzbmvPwenP8TIsTZ9lBD
 7TMZMvw2bySUmLn/eBnUVU9HJkuNdhCz+VLKEcXlsvx2poeUxQDMzrD+qOvBF9AQ
 OZnVoCuBSDH71nuKFVPfXKEMZz1XXlhOmDuLHUHEHc9Bm5tOruHV8gQB8PluDHhI
 SMXBPTKjuJekD17ivlMFD5agEmhUFXUsqT5Tjp9f4jUD9PHYQa2jtd6qmPSKw768
 aufBt0EQQhdN4V0vdnn1g51exKQKPC8bxhL5NiURVlRQ0gEcKSxm1i0Y7Pn09kuS
 goFXKmsXNEpHS8W59hWALgS46oSTMmVBg4ymwJ/aZ5bhUd+ywtNB8avLO84FoFSJ
 nyd0ndzTpTQk+ZTP19SglIPgAgSwtr9nGpdfOiB2lN63dCiS6M/k+p4hqyp5ReIp
 RjKF1znEZHaLnS4SmX+ktZhoEwPWIyLnSIeZ2n0FoJF9gQKS3uom3DBBM0eax70/
 M5aFF4pLwe+dAUlO0/zLzyHSfgDPpRhBpGZJGkZwtZKDWBPl7cc=
 =ceS/
 -----END PGP SIGNATURE-----

Merge tag 'ffa-fix-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into soc/drivers

Arm FF-A fix for v7.1

Use the page aligned backing allocation size when computing the RXTX_MAP
page count. This fixes FF-A RX/TX buffer registration on kernels built
with 16K/64K PAGE_SIZE, where alloc_pages_exact() backs the buffer with a
larger aligned span than the discovered minimum buffer size.

* tag 'ffa-fix-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux:
  firmware: arm_ffa: Use the correct buffer size during RXTX_MAP

Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
2026-04-11 10:48:50 +02:00
Krzysztof Kozlowski
2bb665a217 Allwinner Device Tree Changes for 7.1 - Part 2
UART DMA channels added for A64 and H6. Standard resolution MMIO timer added
 for H616. This timer can be used as a broadcast timer for wakeup from idle
 states.
 -----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCgAuFiEE2nN1m/hhnkhOWjtHOJpUIZwPJDAFAmnTxhAQHHdlbnNAa2Vy
 bmVsLm9yZwAKCRA4mlQhnA8kMC0BEACw2J5vZTiXdnGbFILmCenvqu/+GTkz4p7N
 RSAyjnkXAgDF5Wq0PxiYG+9e1TtWX5PMNDv8QEM9U/uvKn6/3D6eq1D//3IBSENG
 owdgMBLSMGPL89zyMj0lkX4kWYaq2Jn6cmYCaN3sVPd1+vMKvGoZLZYZSsxAZrxA
 BOxhX1j53onlJOjSE0ziqgni335DCTnZRbMTGuob4YFQ6d+i388eF7VBPvCCXvqs
 pcZG7ukDFbKvVgeJ8rV9D0cedSyoqSMSJEwDpQK6uCpCD0tfBP7lTMe7SwaQhLzn
 I4Vz6nUpU2564vqXj/GfgDmrFJB6tqlrY8lDRiLlnBe7I8s58MAkEOb2pxaNkNrz
 sTpQ6ZPvWyHj5fFLxDLXoTkWTl7kSrW9PpvMa884LcBC0kDDXSM1Xpl7TmkW2w45
 wqq1k0lbxOWFx+nznNZ1learhMhHKL7NsxscXRnaut7uQtetKaOJb/U59gEtY+NL
 Q/hRNhYtV4cg/rfGxKrtLFnbWCQcigqnpSiqZuZQQp+Oc/Yxu0WrIBGYX5GJGj19
 4ToZKvjwT6sRRLrU1pLNK7u1Q7GKhnhL++joWWIHCJwMgQQOdj7iBKlQipa636D7
 nbMGZN1atc3Wqbn4xVg5//w0r1obDOAA7EBy2FyhQ8VDGHJmHuT3xdHu5vEk6CYm
 XUaDv1ZY8Q==
 =pYiy
 -----END PGP SIGNATURE-----

Merge tag 'sunxi-dt-for-7.1-2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into soc/dt

Allwinner Device Tree Changes for 7.1 - Part 2

UART DMA channels added for A64 and H6. Standard resolution MMIO timer added
for H616. This timer can be used as a broadcast timer for wakeup from idle
states.

* tag 'sunxi-dt-for-7.1-2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/sunxi/linux:
  arm64: dts: allwinner: enable h616 timer support
  arm64: dts: allwinner: sun50i-h6: add UART DMA channels
  arm64: dts: allwinner: sun50i-a64: add UART DMA channels

Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
2026-04-11 10:42:27 +02:00
Krzysztof Kozlowski
f5fc003c45 One more Qualcomm driver update for v7.1
Flag Lenovo IdeaCentre Mini X to have functional QSEECOM/uefisecapp.
 -----BEGIN PGP SIGNATURE-----
 
 iQJCBAABCgAsFiEEBd4DzF816k8JZtUlCx85Pw2ZrcUFAmnTs0cOHGJqb3JuQGty
 eW8uc2UACgkQCx85Pw2ZrcWR7Q/+LFjkiYpKe9b+9rPu8bbJiFQamXrfJO6BX1NF
 /t9Ko1nKJf2JJUuSrtwgF1d1/chibzn6O8/rUp5PW8JP7dsoYfUo8QpmrM1J7tGV
 MF2ct5PxjuNn0L4le49bbxjx/WzkbHCTUCbxjstP9Xx/GKYSR6A/5eO/6vZAvLsG
 HWdIR681IT/dudrP+B1BAq28XhlvlurRu7S1ELG7fay52ixisWPVGKeQWybdVvUt
 fssC5u3izQNVh5UEq/IuiXt0bvs4klw7q3IOw0U7zna0gqthhFaNkDZMgtjNp+NH
 oHpu2Zu6j69oo7PBuSqWd7pOsU5y9lPFsin3B3m9Xj+c2u4l0wmS0YwALUAjCfrz
 laJlYAdvIZtHFtRi3wP5nxIDVurFYBN6WtdFzPtoRlFhMJngnUdH3EKARNAX7hvc
 OIJ2/uUzgiYR/7AXIN6iZjZKLqzUb8vqgWRnj2Rvm2+3shxjEXuRdG7oNhwfacGT
 Dy4zJt8rdRPCKQBK0V+FKIQJ5YYWQhdAV5UoOmjGGuu1oRJKQ0OUopG36wN/26QM
 IvnC+x2rSoj+0RrTRswwknNAnYekUu5l3cozlx2MyvVlF5wL5/5fZVrgAf32Uw4+
 TXtXK38GrsIp/n77M+nT6/5EkS2POtUs/jLdgi3qPnUugCH4ravRjIlsIF00i7cD
 C3WfxPA=
 =niWJ
 -----END PGP SIGNATURE-----

Merge tag 'qcom-drivers-for-7.1-2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/drivers

One more Qualcomm driver update for v7.1

Flag Lenovo IdeaCentre Mini X to have functional QSEECOM/uefisecapp.

* tag 'qcom-drivers-for-7.1-2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/qcom/linux:
  firmware: qcom: scm: Allow QSEECOM on Lenovo IdeaCentre Mini X

Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
2026-04-11 10:40:56 +02:00
Krzysztof Kozlowski
b7e1557eb6 A few more Arm64 DeviceTree updates for v7.1
Introduce the Hamoa-based Lenovo IdeaCentre Mini X, the Dragonwing
 IQ-615 (Talos) EVK, and a Talos EVK camera overlay.
 
 Enable DisplayPort support on the Glymur CRD.
 
 Add WiFi, Bluetooh, LEDs, and venus on LG-based SDM845 devices. Add
 battery, charger, and display on the LG G7 ThinQ.
 
 Enable SD-card, describe the audio amplifier, and increase the speed of
 the i2c clock for touchscreen on the SHIFT SHIFT6mq.
 
 Add camera subsystem, camera control interface, GPU, GMU, and GPU
 cooling on the Talos platform. Enable the GPU on the Ride board.
 -----BEGIN PGP SIGNATURE-----
 
 iQJCBAABCgAsFiEEBd4DzF816k8JZtUlCx85Pw2ZrcUFAmnTsh4OHGJqb3JuQGty
 eW8uc2UACgkQCx85Pw2ZrcXT2RAArplB0JyG7sQ4PsE1fAaWK093q8+v9m6U9MqD
 61aDMNdbz3ZOpoIkREyau7e0Wt4+8SQjtMllnFIMyc31L6qYN+3/7CLdnvQmHKvj
 Rxutwy9L49yxTDyCXWGbK2lzjS2ExlNteugW/fVraC7A6UL2QbipsfBUMlZCvx+Z
 4wqUIySXzXKCJ25U1IDfHVNI+7X+yydKdRAsu3Gdj0adt5246mALEC55WSjK9DUm
 dyfzamHElM1EwJ9M6MxmlDyHuEkbfwO/5IlX0UBFYAbtVgVysO14XQh12CVRTcCA
 0Hsq9yYQDHxVjPCujMIlG3ySiArmF9shzmCmCxSjZHJbOd+6OX+XmbmkGmJfJFmO
 LKVQrJrsZBq8tB6LwVD8PIHziDL8/omuTZQUU2s0Q4wKqStWnshjXWlTtPuO0lno
 l5XMiPZ1ZEpY4juNXTu5cu9h6//OKZ9vQfvAKiYE8Fb8Fb3/T3LsLDb7SReI/RTS
 TNLzTRbbMFX8nqLBaPKhcsVbrvNd4k4nIM1jkO0nZPFpWH6Ly36u/irTZqRzUkSF
 /rGAv88zHp3LNztiTCLMR7hfnUk5c0ml+gPLSJgyK329JKljhoFMuiiaX/njRx+a
 jyQkYqtbxIqdeJyVFxrTam2+STxLuZ09yO+T98j6NhKVg0gmqnlqoB1KoscS04Bq
 2HTqK4Y=
 =2zB8
 -----END PGP SIGNATURE-----

Merge tag 'qcom-arm64-for-7.1-2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/dt

A few more Arm64 DeviceTree updates for v7.1

Introduce the Hamoa-based Lenovo IdeaCentre Mini X, the Dragonwing
IQ-615 (Talos) EVK, and a Talos EVK camera overlay.

Enable DisplayPort support on the Glymur CRD.

Add WiFi, Bluetooh, LEDs, and venus on LG-based SDM845 devices. Add
battery, charger, and display on the LG G7 ThinQ.

Enable SD-card, describe the audio amplifier, and increase the speed of
the i2c clock for touchscreen on the SHIFT SHIFT6mq.

Add camera subsystem, camera control interface, GPU, GMU, and GPU
cooling on the Talos platform. Enable the GPU on the Ride board.

* tag 'qcom-arm64-for-7.1-2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (31 commits)
  arm64: dts: qcom: Add the Lenovo IdeaCentre Mini X
  dt-bindings: arm: qcom: Document the Lenovo IdeaCentre Mini X
  arm64: dts: qcom: sdm845-shift-axolotl: Enable TFA9890 codec
  arm64: dts: qcom: sdm845-shift-axolotl: Set higher touchscreen i2c clock
  arm64: dts: qcom: sdm845-shift-axolotl: Enable sdcard
  arm64: dts: qcom: talos: Add clocks for QoS configuration
  arm64: dts: qcom: talos-evk-camera: Add DT overlay
  arm64: dts: qcom: talos: Add camera MCLK pinctrl
  arm64: dts: qcom: talos: Add CCI definitions
  arm64: dts: qcom: talos: Add camss node
  arm64: dts: qcom: talos: Add EL2 overlay
  arm64: dts: qcom: talos-evk: Add support for QCS615 talos evk board
  arm64: dts: qcom: talos/qcs615-ride: Fix inconsistent USB PHY node naming
  dt-bindings: arm: qcom: talos-evk: Add QCS615 Talos EVK SMARC platform
  arm64: dts: qcom: qcs615-ride: Enable Adreno 612 GPU
  arm64: dts: qcom: talos: Add GPU cooling
  arm64: dts: qcom: talos: Add gpu and rgmu nodes
  arm64: dts: qcom: talos: add the GPU SMMU node
  arm64: dts: qcom: sdm845-lg-common: Add chassis-type
  arm64: dts: qcom: sdm845-lg: Add wifi nodes
  ...

Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
2026-04-11 10:36:04 +02:00
Krzysztof Kozlowski
ecaf3a92fb RISC-V soc drivers for v7.1
Microchip:
 Add coverage for the pic64gx in the system controller and syscons.
 Add a interrupt mux driver (akin to the one that Renesas recently added)
 that fixes a problem where the platform never properly modelled gpio
 interrupts. There's a gpio driver change here that Bartosz has acked
 that adds the interrupt support to the GPIO driver itself.
 
 Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRh246EGq/8RLhDjO14tDGHoIJi0gUCadOMGgAKCRB4tDGHoIJi
 0gXaAP9j6X7ZAL+EOJqiUjQUVslWZUv+hZrKOCv1InnSHDkC5gEAovr3nk6yHjt0
 a+4XnUj8AGPbT4bcFEdzeArmH//QtgA=
 =+V3B
 -----END PGP SIGNATURE-----

Merge tag 'riscv-soc-drivers-for-v7.1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/conor/linux into soc/drivers

RISC-V soc drivers for v7.1

Microchip:
Add coverage for the pic64gx in the system controller and syscons.
Add a interrupt mux driver (akin to the one that Renesas recently added)
that fixes a problem where the platform never properly modelled gpio
interrupts. There's a gpio driver change here that Bartosz has acked
that adds the interrupt support to the GPIO driver itself.

Signed-off-by: Conor Dooley <conor.dooley@microchip.com>

* tag 'riscv-soc-drivers-for-v7.1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/conor/linux:
  soc: microchip: add mpfs gpio interrupt mux driver
  dt-bindings: soc: microchip: document PolarFire SoC's gpio interrupt mux
  gpio: mpfs: Add interrupt support
  soc: microchip: mpfs-sys-controller: add support for pic64gx
  dt-bindings: soc: microchip: mpfs-sys-controller: Add pic64gx compatibility
  dt-bindings: soc: microchip: add compatible for the mss-top-sysreg on pic64gx

Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
2026-04-11 10:31:20 +02:00
Krzysztof Kozlowski
746e195d43 RISC-V devicetrees for v7.1
Generic:
 Add binding coverage for Supm.
 
 Microchip:
 Add support for the picgx64 and its curiosity board. This is a PolarFire
 SoC without the FPGA.
 Add the missing tsu_clk for ptp on the macb on PolarFire SoC and resolve
 a long-running problem with gpio interrupts being incorrectly described
 on the platform.
 
 Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRh246EGq/8RLhDjO14tDGHoIJi0gUCadOI5gAKCRB4tDGHoIJi
 0jxXAP94SQeRxMv5UlPaz5qQfsDIDlH3wnPrbaKLkiKxke8QRwEAnv2sNIv6w6e9
 b96heW7o3KCEEEha19tFQKqXV5Vcrg4=
 =1yzS
 -----END PGP SIGNATURE-----

Merge tag 'riscv-dt-for-v7.1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/conor/linux into soc/dt

RISC-V devicetrees for v7.1

Generic:
Add binding coverage for Supm.

Microchip:
Add support for the picgx64 and its curiosity board. This is a PolarFire
SoC without the FPGA.
Add the missing tsu_clk for ptp on the macb on PolarFire SoC and resolve
a long-running problem with gpio interrupts being incorrectly described
on the platform.

Signed-off-by: Conor Dooley <conor.dooley@microchip.com>

* tag 'riscv-dt-for-v7.1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/conor/linux:
  riscv: dts: microchip: update mpfs gpio interrupts to better match the SoC
  riscv: dts: microchip: add tsu clock to macb on mpfs
  dt-bindings: riscv: Add Supm extension description
  riscv: dts: microchip: remove POLARFIRE mention in Makefile
  riscv: dts: microchip: add pic64gx and its curiosity kit
  dt-bindings: riscv: microchip: document the PIC64GX curiosity kit
  dt-bindings: timer: sifive,clint: add pic64gx compatibility
  riscv: dts: microchip: add pinctrl nodes for mpfs/icicle kit

Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
2026-04-11 10:29:22 +02:00
Krzysztof Kozlowski
17ed8fd2fa i.MX ARM device tree changes for 7.1:
- Device Tree Schema Compliance Fixes
 
   Fixed numerous CHECK_DTBS warnings across multiple i.MX SoC families
   Renamed nodes to match schema requirements (tcq→touchscreen,
   uart8250→serial, iomuxc→pinmux, etc.). Fixed node naming conventions
   (added "led-" prefix, proper addressing formats).
 
   Corrected compatible strings and removed undocumented fallbacks. Added
   required properties (clocks, clock-names, power supplies,
   #sound-dai-cells).
 
 - New Hardware Support
 
   Added DT overlays for various expansion modules (i.MX6 DHCOM PDK2,
   PicoITX display boards). Added support for muRata 1YN WiFi chip
   (replacement for 1DX) on i.MX6ULL DHCOR board.
 
   i.MX7ULP: Added CPU clock and OPP table support for frequency scaling.
 
 - Boot Phase Properties
   Added bootph.yaml properties to multiple TQ-Systems boards and SoCs:
   imx7s, tqma7, mba7 imx6ul/ull, tqma6ul/ull, mba6ulx imx6qdl, tqma6, mba6.
 
 - Bug Fixes & Corrections
 
   Fixed interrupt property usage (interrupts→interrupts-extended where
   needed). Corrected spelling ("TQ-Systems" with hyphen). Removed redundant
   intermediate nodes in pinmux hierarchy. Fixed clock references and
   naming.
 -----BEGIN PGP SIGNATURE-----
 
 iQHFBAABCgAvFiEEJS45w2QNr0ezLVaoNF3oRQ23YkwFAmnTEUYRHGZyYW5rLmxp
 QG54cC5jb20ACgkQNF3oRQ23YkzB/Av/TwMmAG81S/lO9YuCnfTekicj4PSI3F/W
 GN4ijb+5I8x9T6UyQQnq87zvMr74eD9FS16shsuT9fQ2omHRvCOrPd36UUiZeaDU
 sAgvWvjzcsbZ2DIGgiPL6RyuBscnAkheGwYnhdm6xCkfogH8ej8uoiMBt0eCCqQm
 YUyqS9HHX7D9rHvnC/mnedXRg3N9J0X5vuq7xc+enxXa105+1FaDqrhPDfS7oBeM
 4gApl3wAApmfaicQrMAZ+rtyiB1SdE1km1zJBUDjIglNZQuj02VdQwoNwF8Tn9ca
 Qm3ondEvpV9spLQC54hPrzJ/dI2v7hqYWSqK6Q7IJb8Rosk5bN2AMehzHWnDPkfH
 7bBK79JuBCV3DcjQ8tr9FqqW1UgGsZw9Z3zPDJpbQQW42VOcgxLELpBf4rdZqSl0
 KxNkK26/gJG5jgs/RiXqtz6JeBp3CbHfzAZ8WnpujldJqOG2Wvt9TO8OJQZedaqm
 VwsvSQkGBbOKLVyvzO67VkFCvCfL/HLJ
 =vWpp
 -----END PGP SIGNATURE-----

Merge tag 'imx-dt-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux into soc/dt

i.MX ARM device tree changes for 7.1:

- Device Tree Schema Compliance Fixes

  Fixed numerous CHECK_DTBS warnings across multiple i.MX SoC families
  Renamed nodes to match schema requirements (tcq→touchscreen,
  uart8250→serial, iomuxc→pinmux, etc.). Fixed node naming conventions
  (added "led-" prefix, proper addressing formats).

  Corrected compatible strings and removed undocumented fallbacks. Added
  required properties (clocks, clock-names, power supplies,
  #sound-dai-cells).

- New Hardware Support

  Added DT overlays for various expansion modules (i.MX6 DHCOM PDK2,
  PicoITX display boards). Added support for muRata 1YN WiFi chip
  (replacement for 1DX) on i.MX6ULL DHCOR board.

  i.MX7ULP: Added CPU clock and OPP table support for frequency scaling.

- Boot Phase Properties
  Added bootph.yaml properties to multiple TQ-Systems boards and SoCs:
  imx7s, tqma7, mba7 imx6ul/ull, tqma6ul/ull, mba6ulx imx6qdl, tqma6, mba6.

- Bug Fixes & Corrections

  Fixed interrupt property usage (interrupts→interrupts-extended where
  needed). Corrected spelling ("TQ-Systems" with hyphen). Removed redundant
  intermediate nodes in pinmux hierarchy. Fixed clock references and
  naming.

* tag 'imx-dt-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux: (43 commits)
  ARM: dts: imx: Add DT overlays for DH i.MX6 DHCOM SoM and boards
  ARM: dts: imx6sx: remove fallback compatible string fsl,imx28-lcdif
  ARM: dts: imx25: rename node name tcq to touchscreen
  ARM: dts: imx: b850v3: Disable unused usdhc4
  ARM: dts: imx: b850v3: Define GPIO line names
  ARM: dts: imx: b850v3: Use alphabetical sorting
  ARM: dts: imx: bx50v3: Configure phy-mode to eliminate a warning
  ARM: dts: imx: bx50v3: Configure switch PHY max-speed to 100Mbps
  ARM: dts: imx7ulp: Add CPU clock and OPP table support
  ARM: dts: imx7-mba7: Deassert BOOT_EN after boot
  ARM: dts: tqma7: add boot phase properties
  ARM: dts: imx7s: add boot phase properties
  ARM: dts: tqma6ul[l]: correct spelling of TQ-Systems
  ARM: dts: mba6ulx: add boot phase properties
  ARM: dts: imx6ul[l]-tqma6ul[l]: add boot phase properties
  ARM: dts: imx6ul/imx6ull: add boot phase properties
  ARM: dts: imx6qdl-mba6: add boot phase properties
  ARM: dts: imx6qdl-tqma6: add boot phase properties
  ARM: dts: imx6qdl: add boot phase properties
  ARM: dts: imx6qdl-tqma6: add missing labels
  ...

Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
2026-04-11 10:20:17 +02:00
Krzysztof Kozlowski
90ac490364 i.MX fixes for 7.0 2nd round:
- Fixes interrupt storm by adding pull up pinctrl config for pin PMIC_nINT.
 -----BEGIN PGP SIGNATURE-----
 
 iQHFBAABCgAvFiEEJS45w2QNr0ezLVaoNF3oRQ23YkwFAmnPJG0RHGZyYW5rLmxp
 QG54cC5jb20ACgkQNF3oRQ23Ykzh4wwApbcT5KvoZwkZP7kvUBWVts+st2/fqkbl
 YRfcM5c5y69U8qgyflVuZuOtmZhqGzHBzlPOOPJB7vTQQywUiRan6NZ/RsjFrBET
 TLK9DqKoTKC/2xjlHtQcK118rAHSK5k0RNuv8pS/ziMGD8HWT3Xx/lRX046TuNLQ
 CAvULrmruGY9+Gi0g/9Kq4rYLG7ju2gJVAIOX17Gl40XNIGVkLpqor5rVKzRRDk2
 MzBy69AcfWkj9XQDZqp+zFj+aIqKIw14kenDRT4XvxI4l0rxqCC0xbSB2VZIQOKy
 M6+hHybsAvI762kBAZCmzi9LmO283OCwU3rQizjS+Y8uAWU9sQS0TPGgkWZCnhqm
 AHndQQLO+OAmMkgE42aNn4KnSAU1MclKYqWDeDjDC0wINivo2oC46N3TEXxOZRHS
 FMmbBaSJHw+jZLOt9dHxYAMMfsPNLg/WpNw7hYJrxHtDriwRxBD8BeBZ+y3+sKHb
 V6ooR9BT1sahgm5rmT1ObbA5iIixXlzd
 =ryPm
 -----END PGP SIGNATURE-----

Merge tag 'imx-fixes-7.0-2nd' of https://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux into arm/fixes

i.MX fixes for 7.0 2nd round:

- Fixes interrupt storm by adding pull up pinctrl config for pin PMIC_nINT.

* tag 'imx-fixes-7.0-2nd' of https://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux:
  arm64: dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT
  arm64: dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT
  arm64: dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT
  arm64: dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT
  arm64: dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT
  arm64: dts: imx8mp-ultra-mach-sbc: Correct PAD settings for PMIC_nINT
  arm64: dts: imx8mp-sr-som: Correct PAD settings for PMIC_nINT
  arm64: dts: imx8mp-nitrogen-som: Correct PAD settings for PMIC_nINT
  arm64: dts: imx8mp-aristainetos3a-som-v1: Correct PAD settings for PMIC_nINT
  arm64: dts: imx8mp-edm-g: Correct PAD settings for PMIC_nINT
  arm64: dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT
  arm64: dts: imx8mp-navqp: Correct PAD settings for PMIC_nINT
  arm64: dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT
  arm64: dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT

Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
2026-04-11 10:14:22 +02:00
Krzysztof Kozlowski
4177ec9d58 Support for the RV1103B SoC and the Onion Omega4 board using it.
While the RV1103B only got a B-extension to its name, the SoC internals
 were reworked heavily. So likely it's mainly pin compatible to the
 non-B variant.
 
 The dt-binding for the RV1103B clock driver is shared with the clock-
 driver branch going into the clock-tree.
 -----BEGIN PGP SIGNATURE-----
 
 iQFEBAABCAAuFiEE7v+35S2Q1vLNA3Lx86Z5yZzRHYEFAmnPiKMQHGhlaWtvQHNu
 dGVjaC5kZQAKCRDzpnnJnNEdgcVGB/9TvEArrDeCimaXfLRWKcZtQkrpbmcIb2Kh
 BdGY4cX4YS8g/77pBFg9LMt21dKI3jlmyR76Wf7i9iZVCcWnzcxrhCsB9unEi44c
 jQHa5QJQ++7IXk6/2SrKHfabcmFoVBiDHVpGqbOw2jq8vcTF0IgWKDu5NzjjDUoT
 jbvAxJa+JzTeqEvdZgTdFldPpwMUClqnQqVsTs1w6XlFyMNIRr2ItcJKFU6+JbQX
 UWAlL0/v4v4e+YGsfd/VIXVHFyN81e/yI4s4OwZh2DtM+eFjTbphpJuiltvatqXS
 fuUYjq0U0geWWJMQypDYsZBVXrlbRAICSSDkf8TUqWZSMxf9fFg6
 =5y+y
 -----END PGP SIGNATURE-----

Merge tag 'v7.1-rockchip-dts32-2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/dt

Support for the RV1103B SoC and the Onion Omega4 board using it.
While the RV1103B only got a B-extension to its name, the SoC internals
were reworked heavily. So likely it's mainly pin compatible to the
non-B variant.

The dt-binding for the RV1103B clock driver is shared with the clock-
driver branch going into the clock-tree.

* tag 'v7.1-rockchip-dts32-2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip:
  ARM: dts: rockchip: Add Onion Omega4 Evaluation Board
  dt-bindings: arm: rockchip: Add Omega4 Evaluation board
  ARM: dts: rockchip: Add support for RV1103B
  dt-bindings: soc: rockchip: grf: Add RV1103B compatibles
  dt-bindings: clock: rockchip: Add RV1103B CRU support

Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
2026-04-11 10:09:33 +02:00
Krzysztof Kozlowski
104f1e3f6d A number of dt-schema cleanups that are log standing, so not suitable
as fix for the current release.
 -----BEGIN PGP SIGNATURE-----
 
 iQFEBAABCAAuFiEE7v+35S2Q1vLNA3Lx86Z5yZzRHYEFAmnPiIcQHGhlaWtvQHNu
 dGVjaC5kZQAKCRDzpnnJnNEdgVsjB/wOmHnrqfSjPG0nWUUlXhAu9T2rRaSnRjvn
 ZALER7Gf+Z103KONaJC8mUt4aa+PDAxCO82kO9mr8a+5wEHM+Ujz4hk2PrT0MrGe
 9VHjd5HdU0NLMvmaeSHrBqJ3JQQokusvYJz1xEE/rP8Dc6hUmmjOq7IzjdbOcmCc
 m+64bMPfif+YdKaoQ123Wjg8CJN36fVdDQRgvPiG6sb1WmyApx3xo9wWlZl+E1Gb
 2Abi3TLvdQ/Xo1c9eqo//GblRQsCaTuOfJmwQoi2tVUyJe233RTP6XwrpHbav9LR
 tFv7VjcZ+qrKZxrgzm/2v/I7YjtJMSy3tRwCict8MO91CGi3mPPs
 =H+b0
 -----END PGP SIGNATURE-----

Merge tag 'v7.1-rockchip-dts32-1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/dt

A number of dt-schema cleanups that are log standing, so not suitable
as fix for the current release.

* tag 'v7.1-rockchip-dts32-1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip:
  ARM: dts: rockchip: Pass linux,code to the power key on rk3288-veyron-pinky
  ARM: dts: rockchip: Fix LED node names on rk3288-phycore-rdk
  ARM: dts: rockchip: Fix GMAC description n RK3288 boards
  ARM: dts: rockchip: Fix RTC description on rk3288-firefly-reload
  ARM: dts: rockchip: Add missing the touchscreen interrupt on rk3288-phycore-rdk
  ARM: dts: rockchip: Fix the trackpad supply on rk3288-veyron-jerry
  ARM: dts: rockchip: Fix the Bluetooth node name on rk3288-veyron
  ARM: dts: rockchip: Remove invalid regulator-property from rk3288-veyron
  ARM: dts: rockchip: Use mount-matrix on rk3188-bqedison2qc
  ARM: dts: rockchip: Fix RTC compatible on rk3288-phycore-rdk
  ARM: dts: rockchip: Move PHY reset to ethernet-phy node on rk3036 boards
  ARM: dts: rockchip: Remove rockchip,grf from rk3288 tsadc

Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
2026-04-11 10:04:14 +02:00
Rong Zhang
86aa1ea1f1 ALSA: usb-audio: Do not expose sticky mixers
Some devices' mixers are sticky, which accept SET_CUR but do absolutely
nothing. Registering these mixers confuses userspace and results in
ineffective volume control.

Check if a mixer is sticky by setting the volume to the maximum or
minimum value and checking for effectiveness afterward. Prevent the
mixer from being registered if it turns out to be sticky.

Quirky device sample:

  usb 7-1: New USB device found, idVendor=0e0b, idProduct=fa01, bcdDevice= 1.00
  usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
  usb 7-1: Product: Feaulle Rainbow
  usb 7-1: Manufacturer: Generic
  usb 7-1: SerialNumber: 20210726905926
  (Mic Capture Volume)

Signed-off-by: Rong Zhang <i@rong.moe>
Link: https://patch.msgid.link/20260411-uac-sticky-mixer-v1-3-29d62717befd@rong.moe
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-11 10:03:14 +02:00
Rong Zhang
e3ad86a828 ALSA: usb-audio: Move volume control resolution check into a function
get_min_max_with_quirks() is too lengthy and hard to read.

Move the volume control resolution check code into a function as it's
relatively self-contained.

Suggested-by: Takashi Iwai <tiwai@suse.de>
Link: https://lore.kernel.org/r/87o6jsk3vs.wl-tiwai@suse.de
Signed-off-by: Rong Zhang <i@rong.moe>
Link: https://patch.msgid.link/20260411-uac-sticky-mixer-v1-2-29d62717befd@rong.moe
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-11 10:02:53 +02:00
Rong Zhang
4f55a85cd4 ALSA: usb-audio: Add error checks against get_min_max*()
All callers of get_min_max*() ignore the latter's return code
completely. This means to ignore temporary errors at the probe time.
However, it is not optimal and leads to some maintenance burdens.

Return -EAGAIN for temporary errors, and check against it in the callers
of get_min_max*(). If any other error occurs, bail out of the caller
early.

Suggested-by: Takashi Iwai <tiwai@suse.de>
Link: https://lore.kernel.org/r/87ldewi4j8.wl-tiwai@suse.de
Signed-off-by: Rong Zhang <i@rong.moe>
Link: https://patch.msgid.link/20260411-uac-sticky-mixer-v1-1-29d62717befd@rong.moe
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-11 10:02:25 +02:00
Ashish Yadav
a0c370a6fd hwmon:(pmbus/xdp720) Add support for efuse xdp720
Add the pmbus driver for Infineon XDP720 Digital eFuse Controller.

Signed-off-by: Ashish Yadav <ashish.yadav@infineon.com>
Link: https://lore.kernel.org/r/20260410070154.3313-3-Ashish.Yadav@infineon.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-04-11 00:02:35 -07:00
Ashish Yadav
59f0b7befa dt-bindings: hwmon/pmbus: Add Infineon XDP720
Add documentation for the device tree binding of the XDP720 eFuse.

Signed-off-by: Ashish Yadav <ashish.yadav@infineon.com>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Link: https://lore.kernel.org/r/20260410070154.3313-2-Ashish.Yadav@infineon.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-04-11 00:02:35 -07:00
Victor Duicu
e2fe950f34 hwmon: add support for MCP998X
Add driver for Microchip MCP998X/33 and MCP998XD/33D
Multichannel Automotive Temperature Monitor Family.

Signed-off-by: Victor Duicu <victor.duicu@microchip.com>
Link: https://lore.kernel.org/r/20260403-add-mcp9982-hwmon-v12-2-b3bfb26ff136@microchip.com
[groeck: Add missing break; to avoid build warning]
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-04-11 00:02:13 -07:00
Guilherme G. Piccoli
24b8f8dcb9 pstore/ftrace: Factor KASLR offset in the core kernel instruction addresses
The pstore ftrace frontend works by purely collecting the
instruction address, saving it on the persistent area through
the backend and when the log is read, on next boot for example,
the address is then resolved by using the regular printk symbol
lookup (%pS for example).

Problem: if we are running a relocatable kernel with KASLR enabled,
this is a recipe for failure in the symbol resolution on next boots,
since the addresses are offset'ed by the KASLR address. So, naturally
the way to go is factor the KASLR address out of instruction address
collection, and adding the fresh offset when resolving the symbol
on future boots.

Problem #2: modules also have varying addresses that float based
on module base address and potentially the module ordering in
memory, meaning factoring KASLR offset for them is useless.
So, let's hereby only take KASLR offset into account for core
kernel addresses, leaving module ones as is.

And we have yet a 3rd complexity: not necessarily the check range
for core kernel addresses holds true on future boots, since the
module base address will vary. With that, the choice was to mark
the addresses as being core vs module based on its MSB. And with
that...

...we have the 4th challenge here: for some "simple" architectures,
the CPU number is saved bit-encoded on the instruction pointer, to
allow bigger timestamps - this is set through the PSTORE_CPU_IN_IP
define for such architectures. Hence, the approach here is to skip
such architectures (at least in a first moment).

Finished? No. On top of all previous complexities, we have one
extra pain point: kaslr_offset() is inlined and fully "resolved"
at boot-time, after kernel decompression, through ELF relocation
mechanism. Once the offset is known, it's patched to the kernel
text area, wherever it is used. The mechanism, and its users, are
only built-in - incompatible with module usage. Though there are
possibly some hacks (as computing the offset using some kallsym
lookup), the choice here is to restrict this optimization to the
(hopefully common) case of CONFIG_PSTORE=y.

TL;DR: let's factor KASLR offsets on pstore/ftrace for core kernel
addresses, only when PSTORE is built-in and leaving module addresses
out, as well as architectures that define PSTORE_CPU_IN_IP.

Signed-off-by: Guilherme G. Piccoli <gpiccoli@igalia.com>
Link: https://patch.msgid.link/20260410205848.2607169-1-gpiccoli@igalia.com
Signed-off-by: Kees Cook <kees@kernel.org>
2026-04-10 23:59:41 -07:00
Thomas Gleixner
ff1c0c5d07 Merge branch 'timers/urgent' into timers/core
to resolve the conflict with urgent fixes.
2026-04-11 07:58:33 +02:00
Alexei Starovoitov
d6bae125f2 Merge branch 'use-kmalloc_nolock-universally-in-bpf-local-storage'
Amery Hung says:

====================
Use kmalloc_nolock() universally in BPF local storage

Socket local storage did not convert to use kmalloc_nolock() since there
were observable performance degredation due to kfree_nolock() hitting the
slow path and the lack of kfree_rcu()-like batching freeing. Now that
these concern were addressed in slub, convert all remaining local storage
flavors to use kmalloc_nolock().

v1 -> v2:
  - Fix build (CI, Alexei)
====================

Link: https://patch.msgid.link/20260411015419.114016-1-ameryhung@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-10 21:22:32 -07:00
Amery Hung
136deea435 bpf: Remove gfp_flags plumbing from bpf_local_storage_update()
Remove the check that rejects sleepable BPF programs from doing
BPF_ANY/BPF_EXIST updates on local storage. This restriction was added
in commit b00fa38a9c ("bpf: Enable non-atomic allocations in local
storage") because kzalloc(GFP_KERNEL) could sleep inside
local_storage->lock. This is no longer a concern: all local storage
allocations now use kmalloc_nolock() which never sleeps.

In addition, since kmalloc_nolock() only accepts __GFP_ACCOUNT,
__GFP_ZERO and __GFP_NO_OBJ_EXT, the gfp_flags parameter plumbing from
bpf_*_storage_get() to bpf_local_storage_update() becomes dead code.
Remove gfp_flags from bpf_selem_alloc(), bpf_local_storage_alloc() and
bpf_local_storage_update(). Drop the hidden 5th argument from
bpf_*_storage_get helpers, and remove the verifier patching that
injected GFP_KERNEL/GFP_ATOMIC into the fifth argument.

Signed-off-by: Amery Hung <ameryhung@gmail.com>
Link: https://lore.kernel.org/r/20260411015419.114016-4-ameryhung@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-10 21:22:32 -07:00
Amery Hung
5063e77588 bpf: Use kmalloc_nolock() universally in local storage
Switch to kmalloc_nolock() universally in local storage. Socket local
storage didn't move to kmalloc_nolock() when BPF memory allocator was
replaced by it for performance reasons. Now that kfree_rcu() supports
freeing memory allocated by kmalloc_nolock(), we can move the remaining
local storages to use kmalloc_nolock() and cleanup the cluttered free
paths.

Use kfree() instead of kfree_nolock() in bpf_selem_free_trace_rcu() and
bpf_local_storage_free_trace_rcu(). Both callbacks run in process context
where spinning is allowed, so kfree_nolock() is unnecessary.

Benchmark:

./bench -p 1 local-storage-create --storage-type socket \
  --batch-size {16,32,64}

The benchmark is a microbenchmark stress-testing how fast local storage
can be created. There is no measurable throughput change for socket local
storage after switching from kzalloc() to kmalloc_nolock().

Socket local storage

                 batch  creation speed              diff
---------------  ----   ------------------          ----
Baseline          16    433.9 ± 0.6 k/s
                  32    434.3 ± 1.4 k/s
                  64    434.2 ± 0.7 k/s

After             16    439.0 ± 1.9 k/s             +1.2%
                  32    437.3 ± 2.0 k/s             +0.7%
                  64    435.8 ± 2.5k/s              +0.4%

Also worth noting that the baseline got a 5% throughput boost when sheaf
replaces percpu partial slab recently [0].

[0] https://lore.kernel.org/bpf/20260123-sheaves-for-all-v4-0-041323d506f7@suse.cz/

Signed-off-by: Amery Hung <ameryhung@gmail.com>
Link: https://lore.kernel.org/r/20260411015419.114016-3-ameryhung@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-10 21:22:32 -07:00
Amery Hung
78ee02a966 selftests/bpf: Remove kmalloc tracing from local storage create bench
Remove the raw_tp/kmalloc BPF program and its associated reporting from
the local storage create benchmark. The kmalloc count per create is not
a useful metric as different code paths use different allocators (e.g.
kmalloc_nolock vs kzalloc), introducing noise that makes the number
hard to interpret.

Keep total_creates in the summary output as it is useful for normalizing
perf statistics collected alongside the benchmark.

Signed-off-by: Amery Hung <ameryhung@gmail.com>
Link: https://lore.kernel.org/r/20260411015419.114016-2-ameryhung@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-10 21:22:31 -07:00
Tejun Heo
49d78adf95 sched_ext: Drop spurious warning on kick during scheduler disable
kick_cpus_irq_workfn() warns when scx_kick_syncs is NULL, but this can
legitimately happen when a BPF timer or other kick source races with
free_kick_syncs() during scheduler disable. Drop the pr_warn_once() and
add a comment explaining the race.

Signed-off-by: Tejun Heo <tj@kernel.org>
Reviewed-by: Zhao Mengmeng <zhaomengmeng@kylinos.cn>
2026-04-10 16:38:25 -10:00
Paulo Alcantara
dc0325b0aa smb: client: get rid of d_drop()+d_add()
Replace d_drop()+d_add() in cifs_tmpfile() and cifs_create() with
d_instantiate(), and in cifs_atomic_open() with d_splice_alias() if
in-lookup, otherwise d_instantiate().

Reported-by: Al Viro <viro@zeniv.linux.org.uk>
Closes: https://lore.kernel.org/r/20260408065719.GF3836593@ZenIV
Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Cc: David Howells <dhowells@redhat.com>
Cc: NeilBrown <neilb@ownmail.net>
Cc: linux-fsdevel@vger.kernel.org
Cc: linux-cifs@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>
2026-04-10 20:18:45 -05:00
Daniel Borkmann
497fa510ee selftests/bpf: Add test for add_const base_id consistency
Add a test to verifier_linked_scalars that exercises the base_id
consistency check for BPF_ADD_CONST linked scalars during state
pruning.

With the fix, pruning fails and the verifier discovers the true
branch's R3 is too wide for the stack access.

  # LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh -- ./test_progs -t verifier_linked_scalars
  [...]
  #613/22  verifier_linked_scalars/scalars_stale_delta_from_cleared_id:OK
  #613/23  verifier_linked_scalars/scalars_stale_delta_from_cleared_id_alu32:OK
  #613/24  verifier_linked_scalars/linked scalars: add_const base_id must be consistent for pruning:OK
  #613     verifier_linked_scalars:OK
  Summary: 1/24 PASSED, 0 SKIPPED, 0 FAILED

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/r/20260410232651.559778-2-daniel@iogearbox.net
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-10 17:39:09 -07:00
Daniel Borkmann
2f2ec8e773 bpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars
When regsafe() compares two scalar registers that both carry
BPF_ADD_CONST, check_scalar_ids() maps their full compound id
(aka base | BPF_ADD_CONST flag) as one idmap entry. However,
it never verifies that the underlying base ids, that is, with
the flag stripped are consistent with existing idmap mappings.

This allows construction of two verifier states where the old
state has R3 = R2 + 10 (both sharing base id A) while the current
state has R3 = R4 + 10 (base id C, unrelated to R2). The idmap
creates two independent entries: A->B (for R2) and A|flag->C|flag
(for R3), without catching that A->C conflicts with A->B. State
pruning then incorrectly succeeds.

Fix this by additionally verifying base ID mapping consistency
whenever BPF_ADD_CONST is set: after mapping the compound ids,
also invoke check_ids() on the base IDs (flag bits stripped).
This ensures that if A was already mapped to B from comparing
the source register, any ADD_CONST derivative must also derive
from B, not an unrelated C.

Fixes: 98d7ca374b ("bpf: Track delta between "linked" registers.")
Reported-by: STAR Labs SG <info@starlabs.sg>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/r/20260410232651.559778-1-daniel@iogearbox.net
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-10 17:39:09 -07:00
Linus Torvalds
e774d5f1bc RISC-V updates for v7.0-rc8
Before v7.0 is released, fix a few issues with the CFI patchset,
 merged earlier in v7.0-rc, that primarily affect interfaces to
 non-kernel code:
 
 - Improve the prctl() interface for per-task indirect branch landing
   pad control to expand abbreviations and to resemble the speculation
   control prctl() interface
 
 - Expand the "LP" and "SS" abbreviations in the ptrace uapi header
   file to "branch landing pad" and "shadow stack", to improve
   readability
 
 - Fix a typo in a CFI-related macro name in the ptrace uapi header
   file
 
 - Ensure that the indirect branch tracking state and shadow stack
   state are unlocked immediately after an exec() on the new task so
   that libc subsequently can control it
 
 - While working in this area, clean up the kernel-internal,
   cross-architecture prctl() function names by expanding the
   abbreviations mentioned above
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEElRDoIDdEz9/svf2Kx4+xDQu9KksFAmnYP5YACgkQx4+xDQu9
 KkuoPQ//Yye5D+35EqfA12yP96Vrtg0QCKiqMotz3yLo0T7zh5KosAs/QIE5eQi7
 vWRnCld5PsFa0ZS2822oPfQo8pKVO1y7M2ecFWSwaOWq865Xs82M/puqEQF3GFCS
 219cg1dTVBGvvKSf4MINUBRprfZmZRT9pzhSk79qHEbHKzwCDk7uah51iUdyPJyd
 KX3hshYMLq3rooTHR2wD/ChTpV+pCrt2rSUVbW8+sTUWDfv2sTLauHmemKw7LpdW
 C0SulXvcYkGyiqsB5AXW9x2ttJ5hX9diPb73XS6eBCU0CaMl9BVZWNKeqhEMJxKR
 wmqIadD8pelf7Jh7wGAbNW4hWqTsO3xRpZH38Y/cGLdhs3cqvKjEmT3fOFWUP9bP
 hWv5027gVXVSOmvxhPiUJs7D5WWAz4Q64JZfdJSmDdEWVXcI0v/hzdukuPw4iiT6
 DaqOyClTcwc+j1jawFTICXTF7wXfvZT5sjulrmPk1HX4nZ5padKpfQ77AdKHF9Q6
 9pC25QHQk42h/R4ynA4lm15YnCOfYvjP25hU7K64gQnqO6qBrolfrA4kJOmdYv/g
 1IXsA2YZafJbcXwyFZjWy50uu5gaCM5JhRRFdUrjmB6j3gv9HfBlWJXQywReUjPo
 Kq4tnFppxzFVm23COj9j5kyjsFjUhZ8KCft3+n7lrndeOCk5Z3E=
 =5/Ct
 -----END PGP SIGNATURE-----

Merge tag 'riscv-for-linus-v7.0-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux

Pull RISC-V updates from Paul Walmsley:
 "Before v7.0 is released, fix a few issues with the CFI patchset,
  merged earlier in v7.0-rc, that primarily affect interfaces to
  non-kernel code:

   - Improve the prctl() interface for per-task indirect branch landing
     pad control to expand abbreviations and to resemble the speculation
     control prctl() interface

   - Expand the "LP" and "SS" abbreviations in the ptrace uapi header
     file to "branch landing pad" and "shadow stack", to improve
     readability

   - Fix a typo in a CFI-related macro name in the ptrace uapi header
     file

   - Ensure that the indirect branch tracking state and shadow stack
     state are unlocked immediately after an exec() on the new task so
     that libc subsequently can control it

   - While working in this area, clean up the kernel-internal,
     cross-architecture prctl() function names by expanding the
     abbreviations mentioned above"

* tag 'riscv-for-linus-v7.0-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
  prctl: cfi: change the branch landing pad prctl()s to be more descriptive
  riscv: ptrace: cfi: expand "SS" references to "shadow stack" in uapi headers
  prctl: rename branch landing pad implementation functions to be more explicit
  riscv: ptrace: expand "LP" references to "branch landing pads" in uapi headers
  riscv: cfi: clear CFI lock status in start_thread()
  riscv: ptrace: cfi: fix "PRACE" typo in uapi header
2026-04-10 17:27:08 -07:00
Linus Torvalds
c43adb3613 drm fixes for 7.0 final
xe:
 - Fix HW engine idleness unit conversion
 
 i915:
 - Drop check for changed VM in EXECBUF
 - Fix refcount underflow race in intel_engine_park_heartbeat
 - Do not use pipe_src as borders for SU area in PSR
 
 vc4:
 - runtime pm reference fix
 - memory leak fixes
 - locking fix
 
 ethosu:
 - make ARM only
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmnZbwYACgkQDHTzWXnE
 hr6peA/+J7OdSuUJYwNQ59chQWD3q2jVVjlGWfUyYtE2Z1iYyt4uAkvKtZ5PFQnH
 WdluAtUdg/bc15QbBMeoKEWOBniJyjAgs/4o/oFsQNZL87trxCoaiL/akWdv7QiV
 lx51a3R26WvhsDJDgBklMNvPydTDxM2jdqX4juwXjIE324/WyPTE1ytYQQkJAbAx
 zo82XDx1Ucog+N1XtO13ORwC0Qaug2AU5JPi1ZbjwyzLX/3fFmCb3SmcdLyGlwbY
 mCyoivvs4e0PgpE2RprrVpazW+yZE2n6pj1Xi3FwNHx/8VUmTzECbaw+2nasaONY
 t8tri/etOkNl6w4VvNXoZXZiCU577nMjMDd9KXBmI3daRvq8zUqbiBIcFY2TCtbV
 NyL52vgn01SVXejASrm/x3r/FIL3UETbu1qKpOrF8gUEoMtlFPKCNGRIZt+PWDT9
 jGzug6d6XXKfhf/nOQr42TOXKbA3dO2I3QB0BosZJxwfwushEHqzw3rNCtRfahlx
 l++Upc//w9FkPO57UCtfcdymXA0NOiwsqTM2gS9r2dGt5cf6WJkR3tylUzZuwgqv
 WvpjjwHL3Zun4pBLL+ELpdfnGXVbGFD0vfown+hIrY0RDKVEgUPRfpmyMX1ZV3k7
 6IugM3HSZmQZMdCeWKCMKL210E5Wo1AwPj+YrTFX/REYJeLlZCw=
 =jot2
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-2026-04-11' of https://gitlab.freedesktop.org/drm/kernel

Pull drm fixes from Dave Airlie:
 "Last set of fixes, a few vc4, and i915, one xe and one ethosu Kconfig
  fix.

  xe:
   - Fix HW engine idleness unit conversion

  i915:
   - Drop check for changed VM in EXECBUF
   - Fix refcount underflow race in intel_engine_park_heartbeat
   - Do not use pipe_src as borders for SU area in PSR

  vc4:
   - runtime pm reference fix
   - memory leak fixes
   - locking fix

  ethosu:
   - make ARM only"

* tag 'drm-fixes-2026-04-11' of https://gitlab.freedesktop.org/drm/kernel:
  drm/i915/gem: Drop check for changed VM in EXECBUF
  drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat
  drm/xe: Fix bug in idledly unit conversion
  drm/i915/psr: Do not use pipe_src as borders for SU area
  accel: ethosu: Add hardware dependency hint
  drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock
  drm/vc4: Fix a memory leak in hang state error path
  drm/vc4: Fix memory leak of BO array in hang state
  drm/vc4: Release runtime PM reference after binding V3D
2026-04-10 17:18:20 -07:00
Aleksandr Loktionov
3f3a2aefbc iavf: fix kernel-doc comment style in iavf_ethtool.c
iavf_ethtool.c contains 31 kernel-doc comment blocks using the legacy
`**/` terminator instead of the correct single `*/`. Two function
headers also use a colon separator (`iavf_get_channels:`,
`iavf_set_channels:`) instead of the ` - ` dash required by kernel-doc.

Additionally several comments embed their return-value descriptions in
the body paragraph, producing `scripts/kernel-doc -Wreturn` warnings.
Void functions that incorrectly say "Returns ..." are also rephrased.

Fix all issues across the full file:
 - Replace every `**/` terminator with `*/`.
 - Change `function_name:` doc headers to `function_name -`.
 - Move inline "Returns ..." sentences into dedicated `Return:` sections
   for non-void functions (iavf_get_msglevel, iavf_get_rxnfc,
   iavf_set_channels, iavf_get_rxfh_key_size, iavf_get_rxfh_indir_size,
   iavf_get_rxfh, iavf_set_rxfh).
 - Rephrase body descriptions in void functions that incorrectly said
   "Returns ..." (iavf_get_drvinfo, iavf_get_ringparam, iavf_get_coalesce).
 - Remove boilerplate body text for iavf_get_rxfh_key_size and
   iavf_get_rxfh_indir_size; the `Return:` line now conveys the same
   information without the vague "Returns the table size." sentence.

Suggested-by: Anthony L. Nguyen <anthony.l.nguyen@intel.com>
Suggested-by: Leszek Pepiak <leszek.pepiak@intel.com>
Signed-off-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Reviewed-by: Breno Leitao <leitao@debian.org>
Reviewed-by: Joe Damato <joe@dama.to>
Link: https://patch.msgid.link/20260409093020.3808687-1-aleksandr.loktionov@intel.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-10 16:05:44 -07:00
Lorenzo Bianconi
02f7296439 net: airoha: Fix FE_PSE_BUF_SET configuration if PPE2 is available
airoha_fe_set routine is used to set specified bits to 1 in the selected
register. In the FE_PSE_BUF_SET case this can due to a overestimation of
the required buffers for I/O queues since we can miss to set some bits
of PSE_ALLRSV_MASK subfield to 0. Fix the issue relying on airoha_fe_rmw
routine instead.

Fixes: 8e38e08f2c ("net: airoha: fix PSE memory configuration in airoha_fe_pse_ports_init()")
Tested-by: Xuegang Lu <xuegang.lu@airoha.com>
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://patch.msgid.link/20260408-airoha-reg_fe_pse_buf_set-v1-1-0c4fa8f4d1d9@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-10 16:05:05 -07:00
Jakub Kicinski
43f7081d52 Merge branch 'net-dsa-mxl862xx-vlan-support-and-minor-improvements'
Daniel Golle says:

====================
net: dsa: mxl862xx: VLAN support and minor improvements

This series adds VLAN offloading to the mxl862xx DSA driver along
with two minor improvements to port setup and bridge configuration.
VLAN support uses a hybrid architecture combining the Extended VLAN
engine for PVID insertion and tag stripping with the VLAN Filter
engine for per-port VID membership, both drawing from shared
1024-entry hardware pools partitioned across user ports at probe time.
====================

Link: https://patch.msgid.link/cover.1775581804.git.daniel@makrotopia.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-10 16:03:49 -07:00
Daniel Golle
d587f9b6dc net: dsa: mxl862xx: implement VLAN functionality
Add VLAN support using both the Extended VLAN (EVLAN) engine and the
VLAN Filter (VF) engine in a hybrid architecture that allows a higher
number of VIDs than either engine could achieve alone.

The VLAN Filter engine handles per-port VID membership checks with
discard-unmatched semantics. The Extended VLAN engine handles PVID
insertion on ingress (via fixed catchall rules) and tag stripping on
egress (2 rules per untagged VID). Tagged-only VIDs need no EVLAN
egress rules at all, so they consume only a VF entry.

Both engines draw from shared 1024-entry hardware pools. The VF pool
is divided equally among user ports for VID membership, while the
EVLAN pool is partitioned into small fixed-size ingress blocks (7
entries of catchall rules per port) and fixed-size egress blocks for
tag stripping.

With 5 user ports this yields up to 204 VIDs per port (limited by VF),
of which up to 98 can be untagged (limited by EVLAN egress budget).
With 9 user ports the numbers are 113 total and 53 untagged.

Wire up .port_vlan_add, .port_vlan_del, and .port_vlan_filtering.
Reprogram all EVLAN rules when the PVID or filtering mode changes.
Detach blocks from the bridge port before freeing them on bridge leave
to satisfy the firmware's internal refcount.

Future optimizations could increase VID capacity by dynamically sizing
the egress EVLAN blocks based on actual per-port untagged VID counts
rather than worst-case pre-allocation, or by sharing EVLAN egress and
VLAN Filter blocks across ports with identical VID sets.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Link: https://patch.msgid.link/9be29637675342b109a85fa08f5378800d9f7b78.1775581804.git.daniel@makrotopia.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-10 16:03:44 -07:00
Daniel Golle
71934b9e6f net: dsa: mxl862xx: don't skip early bridge port configuration
mxl862xx_bridge_port_set() is currently guarded by the
mxl8622_port->setup_done flag, as the early call to
mxl862xx_bridge_port_set() from mxl862xx_port_stp_state_set() would
otherwise cause a NULL-pointer dereference on unused ports which don't
have dp->cpu_dp despite not being a CPU port.

Using the setup_done flag (which is never set for unused ports),
however, also prevents mxl862xx_bridge_port_set() from configuring
user ports' single-port bridges early, which was unintended.

Fix this by returning early from mxl862xx_bridge_port_set() in case
dsa_port_is_unused().

Fixes: 340bdf9846 ("net: dsa: mxl862xx: implement bridge offloading")
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Link: https://patch.msgid.link/15962aac29ebe0a6eb77565451acff880c41ef33.1775581804.git.daniel@makrotopia.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-10 16:03:44 -07:00
Daniel Golle
3a4056ec7e net: dsa: mxl862xx: reject DSA_PORT_TYPE_DSA
DSA links aren't supported by the mxl862xx driver.

Instead of returning early from .port_setup when called for
DSA_PORT_TYPE_DSA ports rather return -EOPNOTSUPP and show an error
message.

The desired side-effect is that the framework will switch the port to
DSA_PORT_TYPE_UNUSED, so we can stop caring about DSA_PORT_TYPE_DSA in
all other places.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Link: https://patch.msgid.link/b686f3a22d8a6e7d470e7aa98da811a996a229b9.1775581804.git.daniel@makrotopia.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-10 16:03:44 -07:00
Jakub Kicinski
d6aa477045 Merge branch 'net-bridge-add-stp_mode-attribute-for-stp-mode-selection'
Andy Roulin says:

====================
net: bridge: add stp_mode attribute for STP mode selection

The bridge-stp usermode helper is currently restricted to the initial
network namespace, preventing userspace STP daemons like mstpd from
operating on bridges in other namespaces. Since commit ff62198553
("bridge: Only call /sbin/bridge-stp for the initial network
namespace"), bridges in non-init namespaces silently fall back to
kernel STP with no way to request userspace STP.

This series adds a new IFLA_BR_STP_MODE bridge attribute that allows
explicit per-bridge control over STP mode selection. Three modes are
supported:

  - auto (default): existing behavior, try /sbin/bridge-stp in
    init_net, fall back to kernel STP otherwise
  - user: directly enable BR_USER_STP without invoking the helper,
    works in any network namespace
  - kernel: directly enable BR_KERNEL_STP without invoking the helper

The user and kernel modes bypass call_usermodehelper() entirely,
addressing the security concerns discussed at [1]. Userspace is
responsible for ensuring an STP daemon manages the bridge, rather
than relying on the kernel to invoke /sbin/bridge-stp.

Patch 1 adds the kernel support. The mode can only be changed while
STP is disabled and is processed before IFLA_BR_STP_STATE in
br_changelink() so both can be set atomically in a single netlink
message.

Patch 2 adds documentation for the new attribute in the bridge docs.

Patch 3 adds a selftest with 9 test cases. The test requires iproute2
with IFLA_BR_STP_MODE support and can be run with virtme-ng:

  vng --run arch/x86/boot/bzImage --skip-modules \
      --overlay-rwdir /sbin --overlay-rwdir /tmp --overlay-rwdir /bin \
      --exec 'cp /path/to/iproute2-next/ip/ip /bin/ip && \
              cd tools/testing/selftests/net && \
              bash bridge_stp_mode.sh'

iproute2 support can be found here [2].

[1] https://lore.kernel.org/netdev/565B7F7D.80208@nod.at/
[2] https://github.com/aroulin/iproute2-next/tree/bridge-stp-mode
====================

Link: https://patch.msgid.link/20260405205224.3163000-1-aroulin@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-10 15:52:47 -07:00
Andy Roulin
20ae6d76e3 selftests: net: add bridge STP mode selection test
Add a selftest for the IFLA_BR_STP_MODE bridge attribute that verifies:

1. stp_mode defaults to auto on new bridges
2. stp_mode can be toggled between user, kernel, and auto
3. Changing stp_mode while STP is active is rejected with -EBUSY
4. Re-setting the same stp_mode while STP is active succeeds
5. stp_mode user in a network namespace yields userspace STP (stp_state=2)
6. stp_mode kernel forces kernel STP (stp_state=1)
7. stp_mode auto in a netns preserves traditional fallback to kernel STP
8. stp_mode and stp_state can be set atomically in a single message
9. stp_mode persists across STP disable/enable cycles

Test 5 is the key use case: it demonstrates that userspace STP can now
be enabled in non-init network namespaces by setting stp_mode to user
before enabling STP.

Test 8 verifies the atomic usage pattern where both attributes are set
in a single netlink message, which is supported because br_changelink()
processes IFLA_BR_STP_MODE before IFLA_BR_STP_STATE.

The test gracefully skips if the installed iproute2 does not support
the stp_mode attribute.

Assisted-by: Claude:claude-opus-4-6
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Acked-by: Nikolay Aleksandrov <nikolay@nvidia.com>
Signed-off-by: Andy Roulin <aroulin@nvidia.com>
Link: https://patch.msgid.link/20260405205224.3163000-4-aroulin@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-10 15:52:25 -07:00
Andy Roulin
c4f2aab121 docs: net: bridge: document stp_mode attribute
Add documentation for the IFLA_BR_STP_MODE bridge attribute in the
"User space STP helper" section of the bridge documentation. Reference
the BR_STP_MODE_* values via kernel-doc and describe the use case for
network namespace environments.

Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Acked-by: Nikolay Aleksandrov <nikolay@nvidia.com>
Signed-off-by: Andy Roulin <aroulin@nvidia.com>
Link: https://patch.msgid.link/20260405205224.3163000-3-aroulin@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-10 15:52:25 -07:00
Andy Roulin
54fc83a172 net: bridge: add stp_mode attribute for STP mode selection
The bridge-stp usermode helper is currently restricted to the initial
network namespace, preventing userspace STP daemons (e.g. mstpd) from
operating on bridges in other network namespaces. Since commit
ff62198553 ("bridge: Only call /sbin/bridge-stp for the initial
network namespace"), bridges in non-init namespaces silently fall
back to kernel STP with no way to use userspace STP.

Add a new bridge attribute IFLA_BR_STP_MODE that allows explicit
per-bridge control over STP mode selection:

  BR_STP_MODE_AUTO (default) - Existing behavior: invoke the
    /sbin/bridge-stp helper in init_net only; fall back to kernel STP
    if it fails or in non-init namespaces.

  BR_STP_MODE_USER - Directly enable userspace STP (BR_USER_STP)
    without invoking the helper. Works in any network namespace.
    Userspace is responsible for ensuring an STP daemon manages the
    bridge.

  BR_STP_MODE_KERNEL - Directly enable kernel STP (BR_KERNEL_STP)
    without invoking the helper.

The mode can only be changed while STP is disabled, or set to the
same value (-EBUSY otherwise). IFLA_BR_STP_MODE is processed before
IFLA_BR_STP_STATE in br_changelink(), so both can be set atomically
in a single netlink message. The mode can also be changed in the
same message that disables STP.

The stp_mode struct field is u8 since all possible values fit, while
NLA_U32 is used for the netlink attribute since it occupies the same
space in the netlink message as NLA_U8.

A new stp_helper_active boolean tracks whether the /sbin/bridge-stp
helper was invoked during br_stp_start(), so that br_stp_stop() only
calls the helper for stop when it was called for start. This avoids
calling the helper asymmetrically when stp_mode changes between
start and stop.

Suggested-by: Ido Schimmel <idosch@nvidia.com>
Assisted-by: Claude:claude-opus-4-6
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Acked-by: Nikolay Aleksandrov <nikolay@nvidia.com>
Signed-off-by: Andy Roulin <aroulin@nvidia.com>
Link: https://patch.msgid.link/20260405205224.3163000-2-aroulin@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-10 15:52:24 -07:00
Jakub Kicinski
02468f3492 Merge branch 'add-selftests-for-ntuple-nfc-rules'
Dimitri Daskalakis says:

====================
Add selftests for ntuple (NFC) rules

Thoroughly testing a device's NFC implementation can be tedious. The more
features a device supports, the more combinations to validate.

This series aims to ease that burden, validating the most common NFC rule
combinations.
====================

Link: https://patch.msgid.link/20260407164954.2977820-1-dimitri.daskalakis1@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-10 15:32:14 -07:00
Dimitri Daskalakis
a66374a3eb selftests: drv-net: ntuple: Add dst-ip, src-port, dst-port fields
Extend the ntuple flow steering test to cover dst-ip, src-port, and
dst-port fields. The test supports arbitrary combinations of the fields,
for now we test src_ip/dst_ip, and src_ip/dst_ip/src_port/dst_port.

The tests currently match full fields, but we can consider adding
support for masked fields in the future.

 TAP version 13
 1..24
 ok 1 ntuple.queue.tcp4.src_ip
 ok 2 ntuple.queue.tcp4.dst_ip
 ok 3 ntuple.queue.tcp4.src_port
 ok 4 ntuple.queue.tcp4.dst_port
 ok 5 ntuple.queue.tcp4.src_ip.dst_ip
 ok 6 ntuple.queue.tcp4.src_ip.dst_ip.src_port.dst_port
 ok 7 ntuple.queue.udp4.src_ip
 ok 8 ntuple.queue.udp4.dst_ip
 ok 9 ntuple.queue.udp4.src_port
 ok 10 ntuple.queue.udp4.dst_port
 ok 11 ntuple.queue.udp4.src_ip.dst_ip
 ok 12 ntuple.queue.udp4.src_ip.dst_ip.src_port.dst_port
 ok 13 ntuple.queue.tcp6.src_ip
 ok 14 ntuple.queue.tcp6.dst_ip
 ok 15 ntuple.queue.tcp6.src_port
 ok 16 ntuple.queue.tcp6.dst_port
 ok 17 ntuple.queue.tcp6.src_ip.dst_ip
 ok 18 ntuple.queue.tcp6.src_ip.dst_ip.src_port.dst_port
 ok 19 ntuple.queue.udp6.src_ip
 ok 20 ntuple.queue.udp6.dst_ip
 ok 21 ntuple.queue.udp6.src_port
 ok 22 ntuple.queue.udp6.dst_port
 ok 23 ntuple.queue.udp6.src_ip.dst_ip
 ok 24 ntuple.queue.udp6.src_ip.dst_ip.src_port.dst_port
 # Totals: pass:24 fail:0 xfail:0 xpass:0 skip:0 error:0

Signed-off-by: Dimitri Daskalakis <daskald@meta.com>
Link: https://patch.msgid.link/20260407164954.2977820-3-dimitri.daskalakis1@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-10 15:32:11 -07:00
Dimitri Daskalakis
18589df934 selftests: drv-net: Add ntuple (NFC) flow steering test
Add a test for ethtool NFC (ntuple) flow steering rules. The test
creates an ntuple rule matching on various flow fields and verifies
that traffic is steered to the correct queue.

The test forces all traffic to queue 0 via the indirection table,
then installs an ntuple rule to steer select traffic to a specific
queue. The test then verifies the expected number of packets is received
on the queue.

This test has variants for TCP/UDP over IPv4/IPv6, with rules matching
the source IP. Additional match fields will be added in the next commit.

 TAP version 13
 1..4
 ok 1 ntuple.queue.tcp4.src_ip
 ok 2 ntuple.queue.udp4.src_ip
 ok 3 ntuple.queue.tcp6.src_ip
 ok 4 ntuple.queue.udp6.src_ip
 # Totals: pass:4 fail:0 xfail:0 xpass:0 skip:0 error:0

Signed-off-by: Dimitri Daskalakis <daskald@meta.com>
Link: https://patch.msgid.link/20260407164954.2977820-2-dimitri.daskalakis1@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-10 15:32:11 -07:00
Alexei Starovoitov
e2e6a6ea24 Merge branch 'bpf-static-stack-liveness-data-flow-analysis'
Eduard Zingerman says:

====================
bpf: static stack liveness data flow analysis

This patch set converts current dynamic stack slot liveness tracking
mechanism to a static data flow analysis. The result is used during
state pruning (clean_verifier_state): to zero out dead stack slots,
enabling more aggressive state equivalence and pruning. To improve
analysis precision live stack slot tracking is converted to 4-byte
granularity.

The key ideas and the bulk of the execution behind the series belong
to Alexei Starovoitov. I contributed to patch set integration
with existing liveness tracking mechanism.

Due to complexity of the changes the bisectability property of the
patch set is not preserved. Some selftests may fail between
intermediate patches of the series.

Analysis consists of two passes:
- A forward fixed-point analysis that tracks which frame's FP each
  register value is derived from, and at what byte offset. This is
  needed because a callee can receive a pointer to its caller's stack
  frame (e.g. r1 = fp-16 at the call site), then do *(u64 *)(r1 + 0)
  inside the callee - a cross-frame stack access that the callee's
  local liveness must attribute to the caller's stack.
- A backward dataflow pass within each callee subprog that computes
  live_in = (live_out \ def) ∪ use for both local and non-local
  (ancestor) stack slots. The result of the analysis for callee is
  propagated up to the callsite.

The key idea making such analysis possible is that limited and
conservative argument tracking pass is sufficient to recover most of
the offsets / stack pointer arguments.

Changelog:
v3 -> v4:
  liveness.c:
  - fill_from_stack(): correct conservative stack mask for imprecise
    result, instead of picking frames from pointer register
    (Alexei, sashiko).
  - spill_to_stack(): join with existing values instead of
    overwriting when dst has multiple offsets (cnt > 1) or imprecise
    offset (cnt == 0) (Alexei, sashiko).
  - analyze_subprog(): big change, now each analyze_subprog() is
    called with a fresh func_instance, once read/write marks are
    collected the instance is joined with the one accumulated for
    (callsite, depth) and update_instance() is called.
    This handles several issues:
    - Avoids stale must_write marks when same func_instance is reused
      by analyze_subprog() several times.
    - Handles potential calls multiple calls for mark_stack_write()
      within single instruction.
    (Alexei, sashiko).
  - analyze_subprog(): added complexity limit to avoid exponential
    analysis time blowup for crafted programs with lots of nested
    function calls (Alexei, sashiko).
  - the patch "bpf: record arg tracking results in bpf_liveness masks"
    is reinstated, it was accidentally squashed during v1->v2
    transition.

  verifier.c:
  - clean_live_states() is replaced by a direct call to
    clean_verifier_state(), bpf_verifier_state->cleaned is dropped.

  verifier_live_stack.c:
  - added selftests for arg tracking changes.

v2 -> v3:
  liveness.c:
  - record_stack_access(): handle S64_MIN (unknown read) with
    imprecise offset. Test case can't be created with existing
    helpers/kfuncs (sashiko).
  - fmt_subprog(): handle NULL name (subprogs without BTF info).
  - print_instance(): use u64 for pos/insn_pos avoid truncation
    (bot+bpf-ci).
  - compute_subprog_args(): return error if
    'env->callsite_at_stack[idx] = kvmalloc_objs(...)' fails
    (sashiko).
  - clear_overlapping_stack_slots(): avoid integer promoting
    issues by adding explicit (int) cast (sashiko).

  bpf_verifier.h, verifier.c, liveness.c:
  - Fixes in comments and commit messages (bot+bpf-ci).

v1 -> v2:
  liveness.c:
  - Removed func_instance->callsites and replaced it with explicit
    spine passed through analys_subprog() calls (sashiko).
  - Fixed BPF_LOAD_ACQ handling in arg_track_xfer: don't clear dst
    register tracking (sashiko).
  - Various error threading nits highlighted by bots
    (sashiko, bot+bpf-ci).
  - Massaged fmt_spis_mask() to be more concise (Alexei)

  verifier.c:
  - Move subprog_info[i].name assignment from add_subprog_and_kfunc to
    check_btf_func (sashiko, bot+bpf-ci).
  - Fixed inverse usage of msb/lsb halves by patch
    "bpf: make liveness.c track stack with 4-byte granularity"
    (sashiko, bot+bpf-ci).

v1: https://lore.kernel.org/bpf/20260408-patch-set-v1-0-1a666e860d42@gmail.com/
v2: https://lore.kernel.org/bpf/20260409-patch-set-v2-0-651804512349@gmail.com/
v3: https://lore.kernel.org/bpf/20260410-patch-set-v3-0-1f5826dc0ef2@gmail.com/

Verification performance impact (negative % is good):

========= selftests: master vs patch-set =========

File                     Program        Insns (A)  Insns (B)  Insns    (DIFF)
-----------------------  -------------  ---------  ---------  ---------------
xdp_synproxy_kern.bpf.o  syncookie_tc       20363      22910  +2547 (+12.51%)
xdp_synproxy_kern.bpf.o  syncookie_xdp      20450      23001  +2551 (+12.47%)

Total progs: 4490
Old success: 2856
New success: 2856
total_insns diff min:  -80.26%
total_insns diff max:   12.51%
0 -> value: 0
value -> 0: 0
total_insns abs max old: 837,487
total_insns abs max new: 837,487
 -85 .. -75  %: 1
 -50 .. -40  %: 1
 -35 .. -25  %: 1
 -20 .. -10  %: 5
 -10 .. 0    %: 18
   0 .. 5    %: 4458
   5 .. 15   %: 6

========= scx: master vs patch-set =========

File            Program    Insns (A)  Insns (B)  Insns   (DIFF)
--------------  ---------  ---------  ---------  --------------
scx_qmap.bpf.o  qmap_init      20230      19022  -1208 (-5.97%)

Total progs: 376
Old success: 351
New success: 351
total_insns diff min:  -27.15%
total_insns diff max:    0.50%
0 -> value: 0
value -> 0: 0
total_insns abs max old: 236,251
total_insns abs max new: 233,669
 -30 .. -20  %: 8
 -20 .. -10  %: 2
 -10 .. 0    %: 21
   0 .. 5    %: 345

========= meta: master vs patch-set =========

File                                                                          Program            Insns (A)  Insns (B)  Insns      (DIFF)
----------------------------------------------------------------------------  -----------------  ---------  ---------  -----------------
...
third-party-scx-backports-scheds-rust-scx_layered-bpf_skel_genskel-bpf.bpf.o  layered_dispatch       13944      13104      -840 (-6.02%)
third-party-scx-backports-scheds-rust-scx_layered-bpf_skel_genskel-bpf.bpf.o  layered_dispatch       13944      13104      -840 (-6.02%)
third-party-scx-gefe21962f49a-__scx_layered_bpf_skel_genskel-bpf.bpf.o        layered_dispatch       13825      12985      -840 (-6.08%)
third-party-scx-v1.0.16-__scx_lavd_bpf_skel_genskel-bpf.bpf.o                 lavd_enqueue           15501      13602    -1899 (-12.25%)
third-party-scx-v1.0.16-__scx_lavd_bpf_skel_genskel-bpf.bpf.o                 lavd_select_cpu        19814      16231    -3583 (-18.08%)
third-party-scx-v1.0.17-__scx_lavd_bpf_skel_genskel-bpf.bpf.o                 lavd_enqueue           15501      13602    -1899 (-12.25%)
third-party-scx-v1.0.17-__scx_lavd_bpf_skel_genskel-bpf.bpf.o                 lavd_select_cpu        19814      16231    -3583 (-18.08%)
third-party-scx-v1.0.17-__scx_layered_bpf_skel_genskel-bpf.bpf.o              layered_dispatch       13976      13151      -825 (-5.90%)
third-party-scx-v1.0.18-__scx_lavd_bpf_skel_genskel-bpf.bpf.o                 lavd_dispatch         260628     237930    -22698 (-8.71%)
third-party-scx-v1.0.18-__scx_lavd_bpf_skel_genskel-bpf.bpf.o                 lavd_enqueue           13437      12225     -1212 (-9.02%)
third-party-scx-v1.0.18-__scx_lavd_bpf_skel_genskel-bpf.bpf.o                 lavd_select_cpu        17744      14730    -3014 (-16.99%)
third-party-scx-v1.0.19-10-6b1958477-__scx_lavd_bpf_skel_genskel-bpf.bpf.o    lavd_cpu_offline       19676      18418     -1258 (-6.39%)
third-party-scx-v1.0.19-10-6b1958477-__scx_lavd_bpf_skel_genskel-bpf.bpf.o    lavd_cpu_online        19674      18416     -1258 (-6.39%)
...

Total progs: 1540
Old success: 1492
New success: 1493
total_insns diff min:  -75.83%
total_insns diff max:   73.60%
0 -> value: 0
value -> 0: 0
total_insns abs max old: 434,763
total_insns abs max new: 666,036
 -80 .. -70  %: 2
 -55 .. -50  %: 7
 -50 .. -45  %: 10
 -45 .. -35  %: 4
 -35 .. -25  %: 4
 -25 .. -20  %: 8
 -20 .. -15  %: 15
 -15 .. -10  %: 11
 -10 .. -5   %: 45
  -5 .. 0    %: 112
   0 .. 5    %: 1316
   5 .. 15   %: 2
  15 .. 25   %: 1
  25 .. 35   %: 1
  55 .. 65   %: 1
  70 .. 75   %: 1

========= cilium: master vs patch-set =========

File             Program                            Insns (A)  Insns (B)  Insns     (DIFF)
---------------  ---------------------------------  ---------  ---------  ----------------
bpf_host.o       cil_host_policy                        45801      32027  -13774 (-30.07%)
bpf_host.o       cil_to_netdev                         100287      69042  -31245 (-31.16%)
bpf_host.o       tail_handle_ipv4_cont_from_host        60911      20962  -39949 (-65.59%)
bpf_host.o       tail_handle_ipv4_from_netdev           59735      33155  -26580 (-44.50%)
bpf_host.o       tail_handle_ipv6_cont_from_host        23529      17036   -6493 (-27.60%)
bpf_host.o       tail_handle_ipv6_from_host             11906      10303   -1603 (-13.46%)
bpf_host.o       tail_handle_ipv6_from_netdev           29778      23743   -6035 (-20.27%)
bpf_host.o       tail_handle_snat_fwd_ipv4              61616      67463    +5847 (+9.49%)
bpf_host.o       tail_handle_snat_fwd_ipv6              30802      22806   -7996 (-25.96%)
bpf_host.o       tail_ipv4_host_policy_ingress          20017      10528   -9489 (-47.40%)
bpf_host.o       tail_ipv6_host_policy_ingress          20693      17301   -3392 (-16.39%)
bpf_host.o       tail_nodeport_nat_egress_ipv4          16455      13684   -2771 (-16.84%)
bpf_host.o       tail_nodeport_nat_ingress_ipv4         36174      20080  -16094 (-44.49%)
bpf_host.o       tail_nodeport_nat_ingress_ipv6         48039      25779  -22260 (-46.34%)
bpf_lxc.o        tail_handle_ipv4                       13765      10001   -3764 (-27.34%)
bpf_lxc.o        tail_handle_ipv4_cont                  96891      68725  -28166 (-29.07%)
bpf_lxc.o        tail_handle_ipv6_cont                  21809      17697   -4112 (-18.85%)
bpf_lxc.o        tail_ipv4_ct_egress                    15949      17746   +1797 (+11.27%)
bpf_lxc.o        tail_nodeport_nat_egress_ipv4          16183      13432   -2751 (-17.00%)
bpf_lxc.o        tail_nodeport_nat_ingress_ipv4         18532      10697   -7835 (-42.28%)
bpf_overlay.o    tail_handle_inter_cluster_revsnat      15708      11099   -4609 (-29.34%)
bpf_overlay.o    tail_handle_ipv4                      105672      76108  -29564 (-27.98%)
bpf_overlay.o    tail_handle_ipv6                       15733      19944   +4211 (+26.77%)
bpf_overlay.o    tail_handle_snat_fwd_ipv4              19327      26468   +7141 (+36.95%)
bpf_overlay.o    tail_handle_snat_fwd_ipv6              20817      12556   -8261 (-39.68%)
bpf_overlay.o    tail_nodeport_nat_egress_ipv4          16175      12184   -3991 (-24.67%)
bpf_overlay.o    tail_nodeport_nat_ingress_ipv4         20760      11951   -8809 (-42.43%)
bpf_wireguard.o  tail_handle_ipv4                       27466      28909    +1443 (+5.25%)
bpf_wireguard.o  tail_nodeport_nat_egress_ipv4          15937      12094   -3843 (-24.11%)
bpf_wireguard.o  tail_nodeport_nat_ingress_ipv4         20624      11993   -8631 (-41.85%)
bpf_xdp.o        tail_lb_ipv4                           42673      60855  +18182 (+42.61%)
bpf_xdp.o        tail_lb_ipv6                           87903     108585  +20682 (+23.53%)
bpf_xdp.o        tail_nodeport_nat_ingress_ipv4         28787      20991   -7796 (-27.08%)
bpf_xdp.o        tail_nodeport_nat_ingress_ipv6        207593     152012  -55581 (-26.77%)

Total progs: 134
Old success: 134
New success: 134
total_insns diff min:  -65.59%
total_insns diff max:   42.61%
0 -> value: 0
value -> 0: 0
total_insns abs max old: 207,593
total_insns abs max new: 152,012
 -70 .. -60  %: 1
 -50 .. -40  %: 7
 -40 .. -30  %: 9
 -30 .. -25  %: 9
 -25 .. -20  %: 12
 -20 .. -15  %: 7
 -15 .. -10  %: 14
 -10 .. -5   %: 6
  -5 .. 0    %: 16
   0 .. 5    %: 42
   5 .. 15   %: 5
  15 .. 25   %: 2
  25 .. 35   %: 2
  35 .. 45   %: 2
====================

Link: https://patch.msgid.link/20260410-patch-set-v4-0-5d4eecb343db@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-10 15:30:51 -07:00
Jacob Moroni
70cf146a67 PCI/P2PDMA: Add Google SoCs to the P2P DMA host bridge list
All Google SoCs support peer-to-peer DMA between Root Ports, so add a
wildcard rule to the host bridge list.

Signed-off-by: Jacob Moroni <jmoroni@google.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: David Hu <xuehaohu@google.com>
Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
Link: https://patch.msgid.link/20260409150123.3538444-2-jmoroni@google.com
2026-04-10 17:27:39 -05:00
Jacob Moroni
1a1f96e3e2 PCI/P2PDMA: Allow wildcard Device IDs in host bridge list
Currently, the pci_p2pdma_whitelist array requires an exact match for both
Vendor and Device ID. Some hardware vendors support cross bridge
peer-to-peer DMA across their entire silicon lineup, so add support for
wildcard device IDs to avoid the need to continuously update this array.

Signed-off-by: Jacob Moroni <jmoroni@google.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
Link: https://patch.msgid.link/20260409150123.3538444-1-jmoroni@google.com
2026-04-10 17:27:15 -05:00
Mashiro Chen
bf9a38803b net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf
sixpack_receive_buf() does not properly skip bytes with TTY error flags.
The while loop iterates through the flags buffer but never advances the
data pointer (cp), and passes the original count (including error bytes)
to sixpack_decode(). This causes sixpack_decode() to process bytes that
should have been skipped due to TTY errors.  The TTY layer does not
guarantee that cp[i] holds a meaningful value when fp[i] is set, so
passing those positions to sixpack_decode() results in KMSAN reporting
an uninit-value read.

Fix this by processing bytes one at a time, advancing cp on each
iteration, and only passing valid (non-error) bytes to sixpack_decode().
This matches the pattern used by slip_receive_buf() and
mkiss_receive_buf() for the same purpose.

Reported-by: syzbot+ecdb8c9878a81eb21e54@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ecdb8c9878a81eb21e54
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Mashiro Chen <mashiro.chen@mailbox.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260407173101.107352-1-mashiro.chen@mailbox.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-10 15:25:59 -07:00
Alexei Starovoitov
2cb27158ad bpf: poison dead stack slots
As a sanity check poison stack slots that stack liveness determined
to be dead, so that any read from such slots will cause program rejection.
If stack liveness logic is incorrect the poison can cause
valid program to be rejected, but it also will prevent unsafe program
to be accepted.

Allow global subprogs "read" poisoned stack slots.
The static stack liveness determined that subprog doesn't read certain
stack slots, but sizeof(arg_type) based global subprog validation
isn't accurate enough to know which slots will actually be read by
the callee, so it needs to check full sizeof(arg_type) at the caller.

Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20260410-patch-set-v4-14-5d4eecb343db@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-10 15:13:38 -07:00
Alexei Starovoitov
27417e5eb9 selftests/bpf: add new tests for static stack liveness analysis
Add a bunch of new tests to verify the static stack
liveness analysis.

Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20260410-patch-set-v4-13-5d4eecb343db@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-10 15:13:38 -07:00
Alexei Starovoitov
957c30c067 selftests/bpf: adjust verifier_log buffers
The new liveness analysis in liveness.c adds verbose output at
BPF_LOG_LEVEL2, making the verifier log for good_prog exceed the 1024-byte
reference buffer. When the reference is truncated in fixed mode, the
rolling mode captures the actual tail of the full log, which doesn't match
the truncated reference.

The fix is to increase the buffer sizes in the test.

Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20260410-patch-set-v4-12-5d4eecb343db@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-10 15:13:38 -07:00
Alexei Starovoitov
b42eb55f6c selftests/bpf: update existing tests due to liveness changes
The verifier cleans all dead registers and stack slots in the current
state. Adjust expected output in tests or insert dummy stack/register
reads. Also update verifier_live_stack tests to adhere to new logging
scheme.

Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20260410-patch-set-v4-11-5d4eecb343db@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-10 15:13:37 -07:00