Commit graph

1,464,108 commits

Author SHA1 Message Date
Hans Zhang
03f9209369 PCI: controller: Validate max-link-speed
Add validation for the "max-link-speed" DT property in three more
drivers, using the pcie_get_link_speed() helper.

- brcmstb: If the value is missing or invalid, fall back to no
  limitation (pcie->gen = 0).  Fix the previous incorrect logic.
- mediatek-gen3: If the value is missing or invalid, use the maximum
  speed supported by the controller.
- rzg3s-host: If the value is missing or invalid, fall back to Gen2.

This ensures that all users of of_pci_get_max_link_speed() are ready
for the removal of the central range check.

Signed-off-by: Hans Zhang <18255117159@163.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://patch.msgid.link/20260313165522.123518-5-18255117159@163.com
2026-03-27 00:01:31 +05:30
Hans Zhang
126d04398c PCI: j721e: Validate max-link-speed from DT
Use the new pcie_get_link_speed() helper to validate the value read from
the "max-link-speed" DT property.  If the value is missing or invalid,
fall back to Gen2 (speed = 2).  This prepares for the removal of the
range check in of_pci_get_max_link_speed().

Signed-off-by: Hans Zhang <18255117159@163.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Link: https://patch.msgid.link/20260313165522.123518-4-18255117159@163.com
2026-03-27 00:01:31 +05:30
Hans Zhang
0f34f647f1 PCI: dwc: Use pcie_get_link_speed() helper for safe array access
Replace direct indexing of pcie_link_speed[] with the new helper
pcie_get_link_speed() in all DesignWare core and glue drivers. This
ensures that out-of-range generation numbers do not cause out-of-bounds
accesses when the helper returns PCI_SPEED_UNKNOWN, and prepares for
the removal of the range check in of_pci_get_max_link_speed().

The actual validation of the "max-link-speed" DT property (e.g., fallback
to a safe default and warning) is added in subsequent patches for each
driver that reads the property.

Signed-off-by: Hans Zhang <18255117159@163.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Link: https://patch.msgid.link/20260313165522.123518-3-18255117159@163.com
2026-03-27 00:01:31 +05:30
Hans Zhang
28d20b0d89 PCI: Add pcie_get_link_speed() helper for safe array access
The pcie_link_speed[] array is indexed by PCIe generation numbers
(1 = 2.5 GT/s, 2 = 5 GT/s, ...).  Several drivers use it directly,
which can lead to out-of-bounds accesses if an invalid generation
number is used.

Introduce a helper function pcie_get_link_speed() that returns the
pci_bus_speed value for a given generation number, or PCI_SPEED_UNKNOWN if
the generation is out of range.  This will allow us to safely handle
invalid values after the range check is removed from
of_pci_get_max_link_speed().

Signed-off-by: Hans Zhang <18255117159@163.com>
[mani: Fixed kernel-doc]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20260313165522.123518-2-18255117159@163.com
2026-03-27 00:00:08 +05:30
Yeoreum Yun
42550d7d8a KVM: arm64: kselftest: set_id_regs: Add test for FEAT_LSUI
Add test coverage for FEAT_LSUI.

Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
Reviewed-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2026-03-26 18:19:41 +00:00
Yeoreum Yun
f6bff18d05 KVM: arm64: Expose FEAT_LSUI to guests
Expose the FEAT_LSUI ID register field to guests.

Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
Acked-by: Marc Zyngier <maz@kernel.org>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2026-03-26 18:19:28 +00:00
Yeoreum Yun
7181f718cb arm64: cpufeature: Add FEAT_LSUI
Since Armv9.6, FEAT_LSUI introduces atomic instructions that allow
privileged code to access user memory without clearing the PSTATE.PAN
bit. Add CPU feature detection for FEAT_LSUI.

Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
[catalin.marinas@arm.com: Remove commit log references to SW_PAN]
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2026-03-26 18:19:07 +00:00
Dmitry Baryshkov
39ecfef483 interconnect: qcom: msm8974: expand DEFINE_QNODE macros
The rest of Qualcomm Interconnect drivers have stopped using
DEFINE_QNODE long ago for the sake of readability. Stop using it inside
the msm8974 interconnect driver too.

Acked-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://msgid.link/20260324-msm8974-icc-v2-8-527280043ad8@oss.qualcomm.com
Signed-off-by: Georgi Djakov <djakov@kernel.org>
2026-03-26 20:10:07 +02:00
Dmitry Baryshkov
aa60d907b3 interconnect: qcom: msm8974: switch to the main icc-rpm driver
In preparation to restoring the ability of MSM8974 driver to work with
the modern kernels, switch the driver to the main icc-rpm set of helper
code.

As platform-specific workarounds, set the get_bw callback (returning 0)
to prevent initial setup from programming INT_MAX into the RPM (which
otherwise might hang the platform) and tell RPM programming code to
ignore -ENXIO errors from the firmware (until the QoS programming is
sorted out).

Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://msgid.link/20260324-msm8974-icc-v2-7-527280043ad8@oss.qualcomm.com
Signed-off-by: Georgi Djakov <djakov@kernel.org>
2026-03-26 20:09:55 +02:00
Dmitry Baryshkov
91cfd1604f interconnect: qcom: let platforms declare their bugginess
On MSM8974 programming some of the RPM resources results in the
"resource does not exist" messages from the firmware. This occurs even
with the downstream bus driver, which happily ignores the errors. My
assumption is that these resources existed in the earlier firmware
revisions but were later switched to be programmed differently (for the
later platforms corresponding nodes use qos.ap_owned, which prevents
those resources from being programmed.

In preparation for conversion of the MSM8974 driver (which doesn't have
QoS code yet) to the main icc-rpm set of helpers, let the driver declare
that those -ENXIO errors must be ignored (for now). Later, when the QoS
programming is sorted out (and more interconnects are added to the DT),
this quirk might be removed.

Reviewed-by: Brian Masney <bmasney@redhat.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://msgid.link/20260324-msm8974-icc-v2-6-527280043ad8@oss.qualcomm.com
Signed-off-by: Georgi Djakov <djakov@kernel.org>
2026-03-26 20:09:47 +02:00
Dmitry Baryshkov
1d5b5f7d75 interconnect: qcom: define OCMEM bus resource
Some of the platforms (MSM8974, MSM8x26) require voting on the OCMEM
clock. Add new resource for that clock.

Reviewed-by: Brian Masney <bmasney@redhat.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://msgid.link/20260324-msm8974-icc-v2-5-527280043ad8@oss.qualcomm.com
Signed-off-by: Georgi Djakov <djakov@kernel.org>
2026-03-26 20:09:35 +02:00
Dmitry Baryshkov
fba5454ef5 interconnect: qcom: icc-rpm: allow overwriting get_bw callback
MSM8974 requires a separate get_bw callback, since on that platform
increasing the clock rate for some of the NoCs during boot may lead to
hangs. For the details see commit 9caf2d956c ("interconnect: qcom:
msm8974: Don't boost the NoC rate during boot").

Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://msgid.link/20260324-msm8974-icc-v2-4-527280043ad8@oss.qualcomm.com
Signed-off-by: Georgi Djakov <djakov@kernel.org>
2026-03-26 20:09:26 +02:00
Dmitry Baryshkov
b8498af901 interconnect: qcom: drop unused is_on flag
The commit 2e2113c8a6 ("interconnect: qcom: rpm: Handle interface
clocks") has added the is_on flag to the qcom_icc_provider, but failed
to actually utilize it. Drop the flag.

Fixes: 2e2113c8a6 ("interconnect: qcom: rpm: Handle interface clocks")
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://msgid.link/20260324-msm8974-icc-v2-3-527280043ad8@oss.qualcomm.com
Signed-off-by: Georgi Djakov <djakov@kernel.org>
2026-03-26 20:09:20 +02:00
Dmitry Baryshkov
199363ed2f dt-bindings: interconnect: qcom,msm8974: use qcom,rpm-common
Use qcom,rpm-common schema to declare interconnects property instead
describing it again. In future this will allow the platform to switch to
the two-cell interconnects, adding the tag to the specification.

Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://msgid.link/20260324-msm8974-icc-v2-2-527280043ad8@oss.qualcomm.com
Signed-off-by: Georgi Djakov <djakov@kernel.org>
2026-03-26 20:09:13 +02:00
Hans Zhang
99d9866863 PCI: sky1: Use boolean true for is_rc field
The is_rc field in struct cdns_pcie is of type bool. Replace the
integer assignment (1) with the boolean literal true to improve
code clarity and maintain consistency with the type definition.

Signed-off-by: Hans Zhang <18255117159@163.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Link: https://patch.msgid.link/20260315155351.127078-1-18255117159@163.com
2026-03-26 23:39:12 +05:30
Dmitry Baryshkov
f64f37521c dt-bindings: interconnect: qcom,msm8974: drop bus clocks
Remove the wrong internal RPM bus clock representation that we've been
carrying for years. They are an internal part of the interconnect
fabric. They are not exported by any device and are not supposed to be
used.

Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://msgid.link/20260324-msm8974-icc-v2-1-527280043ad8@oss.qualcomm.com
Signed-off-by: Georgi Djakov <djakov@kernel.org>
2026-03-26 20:08:56 +02:00
Krishna Chaitanya Chundru
33a76fc3c3 PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion support
Qcom PCIe Root Ports advertise hotplug capability in hardware, but do not
support hotplug command completion. As a result, the hotplug commands
issued by the pciehp driver never gets completion notification, leading to
repeated timeout warnings and multi-second delays during boot and
suspend/resume.

Commit a54db86ddc ("PCI: qcom: Do not advertise hotplug capability for
IPs v2.7.0 and v1.9.0") mistakenly assumed that the Root Ports doesn't
support Hotplug due to timeouts and disabled the Hotplug functionality
altogether. But the Root Ports does support reporting Hotplug events like
DL_Up/Down events.

So to fix the command completion timeout issues, just set the No Command
Completed Support (NCCS) bit and enable Hotplug in Slot Capability field
back.

Fixes: a54db86ddc ("PCI: qcom: Do not advertise hotplug capability for IPs v2.7.0 and v1.9.0")
Signed-off-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com>
[mani: renamed function, commit log and added comment]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Tested-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> # Hamoa CRD, tunneled link
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://patch.msgid.link/20260314-hotplug-v1-1-96ac87d93867@oss.qualcomm.com
2026-03-26 23:32:23 +05:30
Rafael J. Wysocki
042f99c493 Merge branch 'pm-sleep'
Merge fixes related to system sleep for 7.0-rc6:

 - Prevent pm_restore_gfp_mask() from triggering a WARN_ON() in some
   code paths in which it is legitimately called without invoking
   pm_restrict_gfp_mask() previously (Youngjun Park)

 - Update snapshot_write_finalize() to take trailing zero pages into
   account properly which prevents user space restore from failing
   subsequently in some cases (Alberto Garcia)

* pm-sleep:
  PM: sleep: Drop spurious WARN_ON() from pm_restore_gfp_mask()
  PM: hibernate: Drain trailing zero pages on userspace restore
2026-03-26 18:44:46 +01:00
Rosen Penev
5387815aa8 dm-bufio: use kzalloc_flex
Avoid manual size calculations and use the proper helper.

Add __counted_by for extra runtime analysis.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
2026-03-26 18:31:15 +01:00
Hans Zhang
698dab284b PCI: dwc: Expose PCIe event counters for groups 5 to 7 over debugfs
Extend the DesignWare PCIe controller's debugfs statistical counter
interface with event definitions from groups 5 through 7 as documented
in the DWC PCIe Databook (version 6.30a, section 3.8.2.3, Tables 3-59,
3-60, 3-61). These counters provide visibility into Layer1 non-error
events (link state transitions,ASPM, L1 substates), Layer2 DLLP
exchanges, and Layer3 TLP transactions.

The counters are exposed under the debugfs statistical counter directory,
allowing users to monitor link behavior and diagnose PCIe protocol issues
more effectively.

Co-developed-by: Cheng Xin <chengqin195275@126.com>
Signed-off-by: Cheng Xin <chengqin195275@126.com>
Signed-off-by: Hans Zhang <18255117159@163.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Reviewed-by: Shawn Lin <shawn.lin@rock-chips.com>
Link: https://patch.msgid.link/20260307020152.1224518-1-18255117159@163.com
2026-03-26 22:50:53 +05:30
Bruce Johnston
fc1d438267 dm vdo: save the formatted metadata to disk
Add vdo_save_super_block() and vdo_save_geometry_block() to perform
asynchronous writes of the super block and geometry block respectively.
Add vdo_clear_layout() to zero the UDS index's first block, the block
map partition, and the recovery journal partition.

These operations are driven by new phases in the pre-load state machine
(PRE_LOAD_PHASE_FORMAT_*), ensuring that disk writes happen during
pre-resume rather than during dmsetup create.

Signed-off-by: Bruce Johnston <bjohnsto@redhat.com>
Reviewed-by: Matthew Sakai <msakai@redhat.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
2026-03-26 18:19:25 +01:00
Bruce Johnston
defce4e039 dm vdo: add formatting logic and initialization
Add the core formatting logic. The initialization path is updated to
read the geometry block (block 0 on the storage device). If the block
is entirely zeroed, the device is treated as unformatted and
vdo_format() is called. Otherwise, the existing geometry is parsed
and the VDO is loaded as before.

The vdo_format() function initializes the volume geometry and super
block, and marks the VDO as needing it's layout saved to disk.

Signed-off-by: Bruce Johnston <bjohnsto@redhat.com>
Reviewed-by: Matthew Sakai <msakai@redhat.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
2026-03-26 18:19:15 +01:00
Bruce Johnston
9d9c28aa86 dm vdo: add synchronous metadata I/O submission helper
Add vdo_submit_metadata_vio_wait(), a synchronous I/O submission
helper that blocks until completion. This is needed for I/O during
early initialization before work queues are available.

Refactor read_geometry_block() to use it.

Signed-off-by: Bruce Johnston <bjohnsto@redhat.com>
Reviewed-by: Matthew Sakai <msakai@redhat.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
2026-03-26 18:19:05 +01:00
Bruce Johnston
b5d1f45c5f dm vdo: add geometry block structure
Introduce a vdo_geometry_block structure, containing a vio and buffer,
mirroring the existing vdo_super_block structure. Both are now
initialized at VDO startup and freed at shutdown, establishing the
infrastructure needed to read and write the geometry block using the
same mechanisms as the super block.

Refactor read_geometry_block() to use the new structure.

Signed-off-by: Bruce Johnston <bjohnsto@redhat.com>
Reviewed-by: Matthew Sakai <msakai@redhat.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
2026-03-26 18:18:55 +01:00
Bruce Johnston
427bf2c1f7 dm vdo: add geometry block encoding
Add vdo_encode_volume_geometry() to write the geometry block into a
buffer so that it can be written to disk. The corresponding decode
path already exists.

Signed-off-by: Bruce Johnston <bjohnsto@redhat.com>
Reviewed-by: Matthew Sakai <msakai@redhat.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
2026-03-26 18:18:42 +01:00
Bruce Johnston
beced130a3 dm vdo: add upfront validation for logical size
Add a validation check that the logical size passed via the table line
does not exceed MAXIMUM_VDO_LOGICAL_BLOCKS.

Signed-off-by: Bruce Johnston <bjohnsto@redhat.com>
Reviewed-by: Matthew Sakai <msakai@redhat.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
2026-03-26 18:18:25 +01:00
Bruce Johnston
2fb98e4170 dm vdo: add formatting parameters to table line
Extend the dm table line with three new optional parameters:
indexMemory (UDS index memory size), indexSparse (dense vs sparse
index), and slabSize (blocks per allocation slab). These values are
parsed, validated, and stored in the device configuration for use
during formatting.

Rework the slab size constants from the single MAX_VDO_SLAB_BITS into
explicit MIN_VDO_SLAB_BLOCKS, MAX_VDO_SLAB_BLOCKS, and
DEFAULT_VDO_SLAB_BLOCKS values.

Bump the target version from 9.1.0 to 9.2.0 to reflect this table
line change.

Signed-off-by: Bruce Johnston <bjohnsto@redhat.com>
Reviewed-by: Matthew Sakai <msakai@redhat.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
2026-03-26 18:18:08 +01:00
Bruce Johnston
e073bb098a dm vdo: add super block initialization to encodings.c
Add vdo_initialize_component_states() to populate the super block,
computing the space required for the main VDO components on disk.
Those include the slab depot, block map, and recovery journal.

Signed-off-by: Bruce Johnston <bjohnsto@redhat.com>
Reviewed-by: Matthew Sakai <msakai@redhat.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
2026-03-26 18:17:42 +01:00
Bruce Johnston
4b4a8d9560 dm vdo: add geometry block initialization to encodings.c
Add vdo_initialize_volume_geometry() to populate the geometry block,
computing the space required for the two main regions on disk.

Add uds_compute_index_size() to calculate the space required for the
UDS indexer from the UDS configuration.

Signed-off-by: Bruce Johnston <bjohnsto@redhat.com>
Reviewed-by: Matthew Sakai <msakai@redhat.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
2026-03-26 18:17:31 +01:00
Sherry Sun
180ea823bb PCI: imx6: Separate PERST# assertion from core reset functions
The imx_pcie_assert_core_reset() and imx_pcie_deassert_core_reset()
functions are primarily intended to reset the RC controller itself, not
the remote PCIe endpoint devices. However, the PERST# GPIO control was
previously embedded within these functions, which conflates two distinct
reset operations.

Move the PERST# GPIO handling into a dedicated function
imx_pcie_assert_perst(). This makes the code more maintainable and
prepares for parsing the reset-gpios property according to the new
Root Port DT binding in subsequent patches.

No functional change is intended.

Signed-off-by: Sherry Sun <sherry.sun@nxp.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Reviewed-by: Richard Zhu <hongxing.zhu@nxp.com>
Link: https://patch.msgid.link/20260306030456.1032815-1-sherry.sun@nxp.com
2026-03-26 22:41:41 +05:30
Sherry Sun
192b8a1bf8 PCI: imx6: Change imx_pcie_deassert_core_reset() return type to void
The function imx_pcie_deassert_core_reset() always returns 0 and the
return value is not used meaningfully by its callers.

Change the return type from int to void to simplify the code and
remove unnecessary error handling paths. No functional change intended.

Signed-off-by: Sherry Sun <sherry.sun@nxp.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Reviewed-by: Richard Zhu <hongxing.zhu@nxp.com>
Link: https://patch.msgid.link/20260306021247.991976-1-sherry.sun@nxp.com
2026-03-26 22:39:19 +05:30
Carlos Maiolino
025b245f0b Merge branch 'xfs-7.0-fixes' into for-next
Signed-off-by: Carlos Maiolino <cem@kernel.org>
2026-03-26 18:06:56 +01:00
Manivannan Sadhasivam
396d44dcaf PCI: endpoint: Improve error messages
Include errno in the error prints and also use dev_err() where applicable.

Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Link: https://patch.msgid.link/20260305071236.23792-2-mani@kernel.org
2026-03-26 22:33:11 +05:30
Manivannan Sadhasivam
ff5387d4f0 PCI: endpoint: Print the EPF name in the error log of pci_epf_make()
Merely printing the error log without the actual EPF name will not give
much clue to the users about the failure. Hence, print the EPF name also.

Suggested-by: Bjorn Helgaas <helgaas@kernel.org>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Link: https://patch.msgid.link/20260305071236.23792-1-mani@kernel.org
2026-03-26 22:30:43 +05:30
Linus Torvalds
453a4a5f97 Including fixes from Bluetooth, CAN, IPsec and Netfilter.
Notably, this includes the fix for the Bluetooth regression that you
 were notified about. I'm not aware of any other pending regressions.
 
 Current release - regressions:
 
   - bluetooth:
     - fix stack-out-of-bounds read in l2cap_ecred_conn_req
     - fix regressions caused by reusing ident
 
   - netfilter: revisit array resize logic
 
   - eth: ice: set max queues in alloc_etherdev_mqs()
 
 Previous releases - regressions:
 
   - core: correctly handle tunneled traffic on IPV6_CSUM GSO fallback
 
   - bluetooth:
     - fix dangling pointer on mgmt_add_adv_patterns_monitor_complete
     - fix deadlock in l2cap_conn_del()
 
   - sched: codel: fix stale state for empty flows in fq_codel
 
   - ipv6: remove permanent routes from tb6_gc_hlist when all exceptions expire.
 
   - xfrm: fix skb_put() panic on non-linear skb during reassembly
 
   - openvswitch:
     - avoid releasing netdev before teardown completes
     - validate MPLS set/set_masked payload length
 
   - eth: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()
 
 Previous releases - always broken:
 
   - bluetooth: fix null-ptr-deref on l2cap_sock_ready_cb
 
   - udp: fix wildcard bind conflict check when using hash2
 
   - netfilter: fix use of uninitialized rtp_addr in process_sdp
 
   - tls: Purge async_hold in tls_decrypt_async_wait()
 
   - xfrm:
     - prevent policy_hthresh.work from racing with netns teardown
     - fix skb leak with espintcp and async crypto
 
   - smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer
 
   - can:
     - add missing error handling to call can_ctrlmode_changelink()
     - fix OOB heap access in cgw_csum_crc8_rel()
 
   - eth: mana: fix use-after-free in add_adev() error path
 
   - eth: virtio-net: fix for VIRTIO_NET_F_GUEST_HDRLEN
 
   - eth: bcmasp: fix double free of WoL irq
 
 Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 
 iQJGBAABCgAwFiEEg1AjqC77wbdLX2LbKSR5jcyPE6QFAmnFXoESHHBhYmVuaUBy
 ZWRoYXQuY29tAAoJECkkeY3MjxOkHIsP+QGWo2TdNS6FENMC4TL0HYR/pTf6Kwil
 rxxvt3CSpqfEkdwtRlgXqJycaLydl6YiNlIgnd1QtNYUTa6SHziuhUevSmK3nJTa
 QkuqXnIbWFDD6nWID/P0CrBTQsZB+Vv4OhVFTbMkkvjX4X73PIbtvoNcWaZd+6rz
 1BANq4dS5AjBieY824ovGlgqCxRyTr1g71RjSQy89RVgxabCwrKokLFFeqo8VObm
 gemyra4wmAt43mxcTWbq/ZgTPfKpHoUSFBF8/c93zad7UKNTP9UqzydrRDSvoqZL
 ZLIYxZ2jGwXCKQjs2pOEmBk2KWfrfnVxFPXizjqpPEagUQEV0NK2hSQswj1sOQnB
 Ee4eL1MgXD6oUQI3qXK6XNAC4rOyDCYjVK3AeRs4hgwEkJCQp4iR+OcGO9lhU+/3
 kNAUG3x0ySW0l2UNmpqnfAAu0+LR2FIdvfpoa9lTKjm6A+kKPMIrlQM4Wq1vwWoN
 f6NV0Br0fQ4FclDh+KyvpZFHrEWCWlfB8sIV5JhQNHnVviP2Rarbw9VBiWvjDxky
 Xn9Mac6mCswHx9GxrC3nPfNBtoNTQ9JvY0Cms/FtrERHaEvIhYxsUpXJs0fxK5mg
 LACTkRzfQkXun9i1B+DYM26M6Yq4lm5TN9a1Mj2G3Df2EECriIgwdl6RI+J2bPJU
 D8RbdAX5qiWu
 =kySL
 -----END PGP SIGNATURE-----

Merge tag 'net-7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Paolo Abeni:
 "Including fixes from Bluetooth, CAN, IPsec and Netfilter.

  Notably, this includes the fix for the Bluetooth regression that you
  were notified about. I'm not aware of any other pending regressions.

  Current release - regressions:

    - bluetooth:
       - fix stack-out-of-bounds read in l2cap_ecred_conn_req
       - fix regressions caused by reusing ident

    - netfilter: revisit array resize logic

    - eth: ice: set max queues in alloc_etherdev_mqs()

  Previous releases - regressions:

    - core: correctly handle tunneled traffic on IPV6_CSUM GSO fallback

    - bluetooth:
       - fix dangling pointer on mgmt_add_adv_patterns_monitor_complete
       - fix deadlock in l2cap_conn_del()

    - sched: codel: fix stale state for empty flows in fq_codel

    - ipv6: remove permanent routes from tb6_gc_hlist when all exceptions expire.

    - xfrm: fix skb_put() panic on non-linear skb during reassembly

    - openvswitch:
       - avoid releasing netdev before teardown completes
       - validate MPLS set/set_masked payload length

    - eth: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()

  Previous releases - always broken:

    - bluetooth: fix null-ptr-deref on l2cap_sock_ready_cb

    - udp: fix wildcard bind conflict check when using hash2

    - netfilter: fix use of uninitialized rtp_addr in process_sdp

    - tls: Purge async_hold in tls_decrypt_async_wait()

    - xfrm:
       - prevent policy_hthresh.work from racing with netns teardown
       - fix skb leak with espintcp and async crypto

    - smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer

    - can:
       - add missing error handling to call can_ctrlmode_changelink()
       - fix OOB heap access in cgw_csum_crc8_rel()

    - eth:
       - mana: fix use-after-free in add_adev() error path
       - virtio-net: fix for VIRTIO_NET_F_GUEST_HDRLEN
       - bcmasp: fix double free of WoL irq"

* tag 'net-7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (90 commits)
  net: macb: use the current queue number for stats
  netfilter: ctnetlink: use netlink policy range checks
  netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp
  netfilter: nf_conntrack_expect: skip expectations in other netns via proc
  netfilter: nf_conntrack_expect: store netns and zone in expectation
  netfilter: ctnetlink: ensure safe access to master conntrack
  netfilter: nf_conntrack_expect: use expect->helper
  netfilter: nf_conntrack_expect: honor expectation helper field
  netfilter: nft_set_rbtree: revisit array resize logic
  netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()
  netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD
  tls: Purge async_hold in tls_decrypt_async_wait()
  selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug
  netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry
  Bluetooth: btusb: clamp SCO altsetting table indices
  Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop
  Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()
  Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock
  Bluetooth: L2CAP: Fix send LE flow credits in ACL link
  net: mana: fix use-after-free in add_adev() error path
  ...
2026-03-26 09:53:08 -07:00
Richard Zhu
5f73cf1db8 PCI: imx6: Skip waiting for L2/L3 Ready on i.MX6SX
On i.MX6SX, the LTSSM registers become inaccessible after the
PME_Turn_Off message is sent to the link. So there is no way to verify
whether the link has entered L2/L3 Ready state or not.

Hence, set IMX_PCIE_FLAG_SKIP_L23_READY flag for i.MX6SX SoC to skip the
L2/L3 Ready state polling and let the DWC core wait for 10ms after sending
the PME_Turn_Off message as per the PCIe spec r6.0, sec 5.3.3.2.1.

Fixes: a528d1a725 ("PCI: imx6: Use DWC common suspend resume method")
Signed-off-by: Richard Zhu <hongxing.zhu@nxp.com>
[mani: commit log]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260228080925.1558395-1-hongxing.zhu@nxp.com
2026-03-26 22:17:00 +05:30
Marco Crivellari
7eb28030f6 smp: Use system_percpu_wq instead of system_wq
When a caller enqueues a work item using schedule_delayed_work() the used
wq is "system_wq" (per-cpu wq) while queue_delayed_work() uses
WORK_CPU_UNBOUND (used when no target CPU is specified). The same applies
to schedule_work() that is using system_wq and queue_work(), which again
makes use of WORK_CPU_UNBOUND.

This lack of consistency cannot be addressed without refactoring the API.

Continue the effort to refactor workqueue APIs, which began with the
introduction of new workqueues and a new alloc_workqueue() flag in:

  commit 128ea9f6cc ("workqueue: Add system_percpu_wq and system_dfl_wq")
  commit 930c2ea566 ("workqueue: Add new WQ_PERCPU flag")

and switch smp_call_on_cpu() to use system_percpu_wq because system_wq is
going away once the ongoing workqueue restructuring is done.

Suggested-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Marco Crivellari <marco.crivellari@suse.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
Link: https://patch.msgid.link/20251110170332.319314-1-marco.crivellari@suse.com
2026-03-26 17:31:35 +01:00
Geert Uytterhoeven
42972b5464 irqchip/gic-v3: Print a warning for out-of-range interrupt numbers
gic_irq_domain_translate() does not check if an interrupt number lies
within the valid range of the specified interrupt type.  Add these checks,
and print a warning if the interrupt number is out of range.

This can help flagging incorrectly described Extended SPI and PPI
interrupts in DT.

Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Acked-by: Marc Zyngier <maz@kernel.org>
Link: https://patch.msgid.link/ce695ea46decc816974179314a86f2b9b5cad6a9.1772799134.git.geert+renesas@glider.be
2026-03-26 17:26:14 +01:00
Mark Brown
52dac22f0a
ASoC: add rt1320/rt1321 dmic dai and fix the wrong name prefix
Bard Liao <yung-chuan.liao@linux.intel.com> says:

The new rt722 + rt1320 configuration uses the DMIC on the rt1320.
This series adds support for such configurations, where the DMIC is
provided by the rt1320 instead of the rt722.
2026-03-26 16:22:45 +00:00
Derek Fang
ae2cb33843
ASoC: sdw_utils: add rt1320 and rt1321 dmic dai in codec_info_list
Add 'rt1320-aif2' dai infos for rt1320 and rt1321 dmic function.

Signed-off-by: Derek Fang <derek.fang@realtek.com>
Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://patch.msgid.link/20260326075303.1083567-4-yung-chuan.liao@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-26 16:22:43 +00:00
Derek Fang
dd4a1963dd
ASoC: SOF: Intel: Add a is_amp flag to fix the wrong name prefix
According to the Intel sof design, it will create the name prefix
appended with amp index for the amp codec only, such as:
rt1318-1, rt1318-2, etc...

But the rt1320 is a codec with amp and mic codec functions, it doesn't
have the amp index in its name prefix as above.
And then it will be hard to identify the codec if in multi-rt1320 case.
So we add a flag to force the amp index to be appended.

Signed-off-by: Derek Fang <derek.fang@realtek.com>
Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://patch.msgid.link/20260326075303.1083567-3-yung-chuan.liao@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-26 16:22:42 +00:00
Mac Chiang
9033f7b7f2
ASoC: Intel: soc-acpi-intel-ptl-match: drop rt722 monolithic match tables
Use functional topologies to support RT722 topologies with/without
amplifiers,
e.g. sof-ptl-rt722.tplg, sof-ptl-rt722-rt1320.tplg...

If these entries are not removed, they will find the first same link of
sof-ptl-rt722.tplg.

Signed-off-by: Mac Chiang <mac.chiang@intel.com>
Co-developed-by: Derek Fang <derek.fang@realtek.com>
Signed-off-by: Derek Fang <derek.fang@realtek.com>
Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://patch.msgid.link/20260326075303.1083567-2-yung-chuan.liao@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-26 16:22:41 +00:00
Ernest Van Hoecke
e54390aae6 dt-bindings: arm: fsl: add Verdin iMX95
Add DT compatible strings for the Verdin i.MX95 SoM and its supported
carrier boards: the Verdin Development Board, and the Dahlia, Ivy,
Mallow and Yavia carrier boards.

Link: https://www.toradex.com/computer-on-modules/verdin-arm-family/nxp-imx95
Link: https://www.toradex.com/products/carrier-board/verdin-development-board-kit
Link: https://www.toradex.com/products/carrier-board/dahlia-carrier-board-kit
Link: https://www.toradex.com/products/carrier-board/ivy-carrier-board
Link: https://www.toradex.com/products/carrier-board/mallow-carrier-board
Link: https://www.toradex.com/products/carrier-board/yavia
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Ernest Van Hoecke <ernest.vanhoecke@toradex.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-03-26 12:17:45 -04:00
Martin Schmiedel
53210b46cd dt-bindings: arm: fsl: add MBa93xxLA-MINI
Adds support for the MBa93xxLA-MINI SBC.
https://www.tq-group.com/en/products/tq-embedded/arm-architecture/mba93xxla-mini/

Signed-off-by: Martin Schmiedel <Martin.Schmiedel@tq-group.com>
Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-03-26 12:11:52 -04:00
Markus Niebel
d44627c130 dt-bindings: arm: add bindings for TQMa95xxLA
TQMa95xxLA is a SOM using NXP i.MX95 CPU. MBa95xxCA is a carrier
reference design / starter kit board.

[1] https://www.tq-group.com/en/products/tq-embedded/arm-architecture/tqma95xxla/

Signed-off-by: Markus Niebel <Markus.Niebel@ew.tq-group.com>
Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-03-26 12:11:51 -04:00
Frank Li
43dcd2c99f dt-bindings: arm: lpc: add missed lpc43xx board
Add missed legancy lpc43xx board compatible string to fix below CHECK_DTB
warnings:
arch/arm/boot/dts/nxp/lpc/lpc4337-ciaa.dtb: /: failed to match any schema with compatible: ['ciaa,lpc4337', 'nxp,lpc4337', 'nxp,lpc4350']

Reviewed-by: Vladimir Zapolskiy <vz@mleia.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-03-26 12:11:51 -04:00
Ciprian Marian Costea
bda4af7c78 dt-bindings: arm: fsl: Add NXP S32N79 SoC and RDB board
Add device tree binding documentation for the NXP S32N79 automotive SoC
and the S32N79 Reference Design Board (S32N79-RDB).

The S32N79 is an automotive-grade SoC featuring eight ARM Cortex-A78AE
cores organized for high-performance networking and gateway applications
in vehicles.

Co-developed-by: Larisa Grigore <larisa.grigore@nxp.com>
Signed-off-by: Larisa Grigore <larisa.grigore@nxp.com>
Signed-off-by: Ciprian Marian Costea <ciprianmarian.costea@oss.nxp.com>
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-03-26 12:11:50 -04:00
Ciprian Marian Costea
0b7973dfb7 dt-bindings: interrupt-controller: fsl,irqsteer: add S32N79 support
Add compatible string for the interrupt steering controller used in NXP
S32N79 SoC.

The S32N79 SoC differs from the i.MX version by not implementing the
CHANCTRL register, but otherwise maintains the same programming model and
register layout.

Co-developed-by: Larisa Grigore <larisa.grigore@nxp.com>
Signed-off-by: Larisa Grigore <larisa.grigore@nxp.com>
Signed-off-by: Ciprian Marian Costea <ciprianmarian.costea@oss.nxp.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-03-26 12:11:49 -04:00
Shengjiu Wang
f2c05ff2fe dt-bindings: arm: fsl: Add compatible for i.MX8MP audio board (version 2)
Introduce a new DT compatible string for the NXP i.MX8MP audio board
(version 2).

i.MX Audio Board is a configurable and functional audio processing
platform. Integrating a variety of audio input and output interfaces into
the system, the i.MX Audio Board supports HDMI input, HDMI eARC,
S/PDIF I/O, 2-ch ADC line-in, 24-ch DAC line-out and more. Based on these
features, rich audio application cases can be realized.

Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-03-26 12:11:49 -04:00
Josua Mayer
05452c58ef dt-bindings: arm: fsl: Add various solidrun i.MX8M boards
Add bindings for various SolidRun boards:

- i.MX8MP HummingBoard IIoT - based on the SolidRun i.MX8M Plus SoM
- SolidSense N8 - single-board design with i.MX8M Nano
- i.MX8M Mini System on Module
- i.MX8M Mini HummingBoard Ripple

Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Josua Mayer <josua@solid-run.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-03-26 12:11:35 -04:00