Update recommend external control slot length to driver. Some of the
Wi-Fi feature has its time slot requirement can not be simply controlled
by coexistence firmware TDMA timer. For example: Wi-Fi scan/MCC etc.
In the same time, coexistence need to tell driver the recommend Bluetooth
slot length to make sure Bluetooth can still has enough time slot to
traffic.
Signed-off-by: Ching-Te Ku <ku920601@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260712030506.43438-11-pkshih@realtek.com
In the version 11 report control report, firmware will report firmware
build date, version. And Bluetooth to Wi-Fi scoreboard value will be
read at Wi-Fi firmware and update to Wi-Fi driver.
Signed-off-by: Ching-Te Ku <ku920601@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260712030506.43438-10-pkshih@realtek.com
To avoid the default value not match the real using scenario, it should
after assign desired default value after variable reset.
Signed-off-by: Ching-Te Ku <ku920601@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260712030506.43438-8-pkshih@realtek.com
Because the coexistence offload more register/ hardware setting I/O to
firmware by coexistence itself, and it goes with the same entry with other
control action, so the firmware command entry need to add different
condition to judge should it followed coexistence TLV format or not.
Signed-off-by: Ching-Te Ku <ku920601@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260712030506.43438-7-pkshih@realtek.com
To enable/disable firmware report once at the end of mechanism round.
This can make the logic more clearly, and make sure every round the
mechanism running can refresh the settings. It can avoid some report
missing after driver status change.
Signed-off-by: Ching-Te Ku <ku920601@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260712030506.43438-6-pkshih@realtek.com
Merge set antenna & grant signal logic. Combine all information to big
structure for runtime logic using, only separate to version format while
it is going to assign value to register or offload to firmware. Add new
format for dual-BT & external BT for RTL8922D.
Signed-off-by: Ching-Te Ku <ku920601@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260712030506.43438-5-pkshih@realtek.com
In order to make dual MAC Wi-Fi performance more stable, and take effect
in time, offload more register/ hardware control to firmware.
Signed-off-by: Ching-Te Ku <ku920601@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260712030506.43438-4-pkshih@realtek.com
The control structure will record some Wi-Fi/Bluetooth status, and
packed send to firmware. The new generation chip had offloaded many
mechanism control to firmware, firmware may need update these very
often to make sure run in correct mechanism.
Signed-off-by: Ching-Te Ku <ku920601@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260712030506.43438-3-pkshih@realtek.com
Because the new generation Bluetooth will able to work on 5/6GHz band,
it will suffer 5/6GHz Wi-Fi, the mechanism need to cover more scenario
with different Wi-Fi/Bluetooth combination.
Signed-off-by: Ching-Te Ku <ku920601@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260712030506.43438-2-pkshih@realtek.com
Usage of .driver_data_ptr allows to drop several casts. A nice upside of
that is that now the constness of the linked structures is kept and the
compiler warns about zdd missing a const. So add this missing const, too.
While touching the zorro_device_id array, drop an unneeded explicit zero in
the list terminator.
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
Acked-by: Helge Deller <deller@gmx.de>
Link: https://patch.msgid.link/b7f3b4bfa5daabf8a3043177341b8dbb4e4d980e.1779803053.git.u.kleine-koenig@baylibre.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Technically it is fine (on all current Linux architectures) to store a
pointer in an unsigned long variable. However this needs explicit casting
which is an easy source for type mismatches.
By replacing the plain unsigned long .driver_data in struct zorro_device_id
by an anonymous union, most of the casting can be dropped. There is still
some implicit casting involved (between a void * and a driver specific
pointer type), but that's better than the approach to store a pointer in an
unsigned long variable as this doesn't lose the information that the data
being pointed to is const.
All users of struct zorro_device_id are initialized in a way that is
compatible with the new definition, so no adaptions are needed there.
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
Acked-by: Geert Uytterhoeven <geert@linux-m68k.org>
Reviewed-by: Max Staudt <max@enpas.org>
Acked-by: Helge Deller <deller@gmx.de>
Link: https://patch.msgid.link/49576a7501128c93ef318566ed7faefce163f1fd.1779803053.git.u.kleine-koenig@baylibre.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Using named initializers is more explicit and thus easier to parse for a
human.
It's also more robust to changes in the struct definition. This robustness
is relevant for a planned change to struct zorro_device_id that replaces
.driver_data by an anonymous union.
While touching these arrays, drop explicit zeros from the list terminator.
This change doesn't introduce changes to the compiled zorro_device_id
arrays.
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
Acked-by: Helge Deller <deller@gmx.de>
Link: https://patch.msgid.link/9602004a447b474b15ca1e110d6d3c277f669e20.1779803053.git.u.kleine-koenig@baylibre.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
To match how device-id array terminators look like for other device
types drop '.id = ""' from it and let the compiler care for zeroing the
entry.
There are no changes in the compiled drivers, only the source looks
nicer.
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/096aaa981c0bf1aaa8be75e675f17b1c9ca0086c.1781102092.git.u.kleine-koenig@baylibre.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
To match how device-id array terminators look like for other device
types drop '.id = ""' from it and let the compiler care for zeroing the
entry.
There are no changes in the compiled drivers, only the source looks
nicer.
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/096aaa981c0bf1aaa8be75e675f17b1c9ca0086c.1781102092.git.u.kleine-koenig@baylibre.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Using named initializers is more explicit and thus easier to parse for a
human.
It's also more robust to changes in the struct definition. This robustness
is relevant for a planned change to struct zorro_device_id that replaces
.driver_data by an anonymous union.
This change doesn't introduce changes to the compiled zorro_device_id
array.
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Acked-by: Niklas Cassel <cassel@kernel.org>
Acked-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
Acked-by: Helge Deller <deller@gmx.de>
Link: https://patch.msgid.link/a20f52aeee9dfcacfaea43ff280fa1867878cbbe.1779803053.git.u.kleine-koenig@baylibre.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
mimo_ps is initialized to IEEE80211_SMPS_OFF and never modified in
rtl92d_update_hal_rate_table(). Therefore, the IEEE80211_SMPS_STATIC
case is unreachable.
Remove the unused mimo_ps variable and the dead branch.
Signed-off-by: Chelsy Ratnawat <chelsyratnawat2001@gmail.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260709194315.157030-1-chelsyratnawat2001@gmail.com
The PCI_INTERRUPT_PIN reports if the device supports the INTx. However,
when the device is assigned to a guest via vfio, the PCI_INTERRUPT_PIN
is set to 0 (i.e none) if the line is not connected and/or the platform
cannot route the interrupt.
In such cases, the guest PCI_INTERRUPT_PIN is 0 and the port number
becomes -1 (255, uint8_t underflow) for qla[25|27|28]xx and qla2031
devices. The flt_region_nvram is never set, and subsequently the LUN
detection fails. Below warnings show the NVRAM configuration failure:
[]-0073:1: Inconsistent NVRAM checksum=0xffffffc0 id=HCAM version=0x100.
[]-0074:1: Falling back to functioning (yet invalid -- WWPN) defaults.
[]-0076:1: NVRAM configuration failed.
Handle this case and set the port_no to devfn like its done everywhere
else.
Reference: commit 2bd42b03ab ("vfio/pci: Virtualize zero INTx PIN if no pdev->irq")
Signed-off-by: Shivaprasad G Bhat <sbhat@linux.ibm.com>
Reviewed-by: Kyle Mahlkuch <kmahlkuc@linux.ibm.com>
Link: https://patch.msgid.link/177885270578.1573.14283751510936407585.stgit@linux.ibm.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Once the UFS WriteBooster fails to allocate memory, the situation will
stay until fstrim or equivalent is ran.
Mark is as a warning since it impacts the performance but only print it
once for the lifetime of the kernel since it's not fatal.
Otherwise it will be printed each time the device is resumed:
[ 31.666880] ufshcd-qcom 1d84000.ufshc: dCurWBBuf: 0 WB disabled until free-space is available
[ 52.655594] ufshcd-qcom 1d84000.ufshc: dCurWBBuf: 0 WB disabled until free-space is available
[ 62.890469] ufshcd-qcom 1d84000.ufshc: dCurWBBuf: 0 WB disabled until free-space is available
...
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/20260618-topic-ufs-wb-empty-warn-v1-1-ec744a153e0e@linaro.org
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
ed.tsai@mediatek.com says:
The first patch adds the get_hba_nortt() callback to the UFS core
layer, allowing vendor drivers to provide dynamic, platform-specific
RTT capability handling.
The second patch implements this callback in the MediaTek UFS driver,
distinguishing between legacy platforms (which require the RTT to be
limited to 2) and newer MT6995 B0+ platforms (which can use the value
from the capability register directly).
The third patch removes the max_num_rtt field from ufs_hba_variant_ops
as it is now replaced by the get_hba_nortt() callback.
Link: https://patch.msgid.link/20260615055802.105479-1-ed.tsai@mediatek.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Can Guo <can.guo@oss.qualcomm.com> says:
TX Equalization training currently has a few error-path gaps that can
make the flow brittle and can leave variant/device cleanup incomplete.
This series hardens TX EQTR in three places:
1. ufs-qcom: route SW FOM setup failures through the shared cleanup
path so temporary device TX EQ settings are restored and link
recovery is always attempted before exit.
2. core: treat RX_FOM DME read failures as best effort so TX EQTR can
continue, and force failed lanes to deterministic 0 FOM.
3. core: always run tx_eqtr POST_CHANGE notify once PRE_CHANGE
succeeds, even when TX EQTR fails, so variant cleanup is not
skipped.
Together these changes improve TX EQTR robustness without changing the
normal success path.
Link: https://patch.msgid.link/20260625121306.1655467-1-can.guo@oss.qualcomm.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
ufshcd_tx_eqtr() skips POST_CHANGE notify when __ufshcd_tx_eqtr()
fails. That can leave variant cleanup incomplete when PRE_CHANGE saved
temporary state that POST_CHANGE is expected to restore.
Always call POST_CHANGE once PRE_CHANGE has succeeded. Keep the TX EQTR
result as the primary return value, and only propagate POST_CHANGE failure
when TX EQTR itself succeeded.
Log PRE_CHANGE and POST_CHANGE notify failures to make variant callback
failures visible in TX EQTR error paths.
Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
Reviewed-by: Peter Wang <peter.wang@mediatek.com>
Signed-off-by: Can Guo <can.guo@oss.qualcomm.com>
Reviewed-by: Bean Huo <beanhuo@micron.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Ziqi Chen <ziqi.chen@oss.qualcomm.com>
Link: https://patch.msgid.link/20260625121306.1655467-4-can.guo@oss.qualcomm.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
ufshcd_get_rx_fom() aborted TX EQTR when a per-lane RX_FOM DME read failed.
That makes the whole training flow fragile even though these reads can be
treated as best effort.
Keep TX EQTR running by logging RX_FOM read failures and continuing. Make
failed lanes deterministic by initializing each lane FOM to 0 before
reading and only updating it when the DME read succeeds. This avoids
propagating stale or uninitialized values into EQTR evaluation.
Also update the kerneldoc return description to match behavior: RX_FOM DME
read failures are handled as warnings, while get_rx_fom() vops failures are
still propagated to the caller.
Signed-off-by: Can Guo <can.guo@oss.qualcomm.com>
Reviewed-by: Peter Wang <peter.wang@mediatek.com>
Reviewed-by: Bean Huo <beanhuo@micron.com>
Reviewed-by: Ziqi Chen <ziqi.chen@oss.qualcomm.com>
Link: https://patch.msgid.link/20260625121306.1655467-3-can.guo@oss.qualcomm.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
ufs_qcom_get_rx_fom() applies temporary device TX Equalization values
before forcing HS mode and running the EOM-based SW FOM scan.
When one of these steps fails, the function can bypass the shared cleanup
path and leave temporary TX Equalization settings programmed.
Route those failures through the cleanup label so the original TX EQ
settings are restored and link recovery runs before exit.
This path also reuses ret for cleanup, so it may overwrite the original
error. Keep that on purpose: if cleanup succeeds, the caller can proceed
with the FOM result for the current iteration.
Signed-off-by: Can Guo <can.guo@oss.qualcomm.com>
Reviewed-by: Bean Huo <beanhuo@micron.com>
Reviewed-by: Ziqi Chen <ziqi.chen@oss.qualcomm.com>
Link: https://patch.msgid.link/20260625121306.1655467-2-can.guo@oss.qualcomm.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
TX EQTR may run while devfreq gear scaling has quiesced the UFS
tagset. In that context, functions ufshcd_tx_eqtr(), __ufshcd_tx_eqtr()
and ufs_qcom_get_rx_fom() allocate memory with GFP_KERNEL. If direct
reclaim is triggered, reclaim/writeback can depend on I/O to UFS
device. Because the queue is quiesced, this can cause deadlock.
Use memalloc_noio_save/restore() in ufshcd_tx_eqtr() to cover all
allocations in the TX EQTR call tree, including:
- params->eqtr_record in ufshcd_tx_eqtr()
- eqtr_data in __ufshcd_tx_eqtr()
- params in ufs_qcom_get_rx_fom()
This is preferred over tagging individual call sites with GFP_NOIO, as it
automatically covers any future allocations added anywhere in the call tree
without requiring each caller to be aware of this constraint.
[mkp: fix label as suggested by Bart]
Fixes: 03e5d38e2f ("scsi: ufs: core: Add support for TX Equalization")
Closes: https://sashiko.dev/#/patchset/20260615132834.2985346-1-can.guo@oss.qualcomm.com?part=2
Signed-off-by: Can Guo <can.guo@oss.qualcomm.com>
Reviewed-by: Ziqi Chen <ziqi.chen@oss.qualcomm.com>
Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
Link: https://patch.msgid.link/20260618140941.902000-1-can.guo@oss.qualcomm.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Can Guo <can.guo@oss.qualcomm.com> says:
Hi,
This series adds support for board-specific static TX Equalization settings
provided through Device Tree.
This series is based on the earlier TX Equalization enablement work and
persistent storage/retrieval of optimal TX Equalization settings work:
https://lore.kernel.org/all/20260325152154.1604082-1-can.guo@oss.qualcomm.comhttps://lore.kernel.org/all/20260424151420.111675-1-can.guo@oss.qualcomm.com
Background
==========
UFS v5.0/UFSHCI v5.0 adds HS-G6 support (46.6 Gbps/lane) via UniPro v3.0
and M-PHY v6.0. These specs define TX Equalization for all High-Speed
Gears (not only HS-G6) to compensate channel loss and improve signal
integrity at high speed.
For HS-G6, M-PHY uses PAM4 1b1b line coding. Pre-Coding may also be
required depending on channel characteristics.
This series adds vendor-neutral DT properties:
- patternProperties: txeq-preshoot-g[1-6], txeq-deemphasis-g[1-6]
- fixed property: tx-precode-enable-g6
All properties use per-lane Host/Device tuples and accept 2 or 4 values
for x1/x2 lane configurations:
- txeq-preshoot-g[1-6]: values 0..7
- txeq-deemphasis-g[1-6]: values 0..7
- tx-precode-enable-g6: values 0/1
These properties carry board-level SI characterization data used as static
TX Equalization settings for each High-Speed Gear.
Example DTS snippet
===================
The following x2-lane example shows the expected DT encoding:
ufs@1d84000 {
lanes-per-direction = <2>;
txeq-preshoot-g6 = <1 2>, <3 4>;
txeq-deemphasis-g6 = <0 1>, <2 3>;
tx-precode-enable-g6 = <1 0>, <0 1>;
};
Relationship with Adaptive TX Equalization
==========================================
Adaptive TX Equalization remains the primary path when enabled.
Static TX Equalization settings from DT are board-specific baseline values,
but when adaptive TX Equalization is used, static settings are not final:
- If valid settings are retrieved from qTxEQGnSettings/wTxEQGnSettingsExt,
those retrieved settings override static DT settings.
- If retrieval is not available/valid, TX EQTR runs and trained settings
override static DT settings.
So static DT settings are a fallback and are intended for cases where
adaptive TX Equalization is not enabled/used.
No behavior changes for platforms that do not provide these properties.
What this series adds
=====================
1. dt-bindings:
- Document txeq-preshoot-g[1-6], txeq-deemphasis-g[1-6], and
tx-precode-enable-g6 in ufs-common.yaml.
- Define tuple encoding for host/device values per lane.
- Add per-property value validation ranges in schema.
2. UFS core/platform integration:
- Parse and validate per-gear DT TX EQ settings during platform init.
- Store parsed values into per-gear TX EQ params and track DT origin using
the from_dt flag.
- Integrate static-state handling in TX EQ flow so DT-provided entries are
fed through the adaptive TX Equalization path and then converted to
normal runtime params.
Link: https://patch.msgid.link/20260616113348.1168248-1-can.guo@oss.qualcomm.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
In power_info/gear sysfs, currently it supports output only till gear 5.
If operating mode is gear 6, it outputs "UNKNOWN". Add support for
HS_GEAR6 string in sysfs output when operating mode is gear 6.
Signed-off-by: Himanshu Batra <himanshubatra@google.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/20260616100121.548759-1-himanshubatra@google.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Replace myself with Xingui Yang who is very familiar with the HiSilicon
hisi_sas drivers.
Signed-off-by: Yihang Li <liyihang9@huawei.com>
Reviewed-by: Jason Yan <yanaijie@huawei.com>
Link: https://patch.msgid.link/20260616032051.1268608-1-liyihang9@huawei.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
HWDRM is currently the only supported PXP type, and it is display
related, so it cannot be combined with multi-queue exec queue groups.
Reject exec queue creation that requests both multi-queue and PXP,
returning -EINVAL.
The secondary queue path already rejects any PXP property, so this
adds the missing check for the multi-queue primary,
which would otherwise allow the combination.
Validated with igt@xe_exec_multi_queue@sanity, which exercises both
the PXP-unsupported (-ENODEV) and PXP-supported (-EINVAL) paths.
v3:
- Change commit title prefix to drm/xe/multi_queue:.
- Add Niranjana's Reviewed-by.
v2:
- Move the multi-queue + PXP check to exec_queue_user_ext_check() to
bail out early, keyed off the properties bitmask (Niranjana).
Signed-off-by: Jagmeet Randhawa <jagmeet.randhawa@intel.com>
Reviewed-by: Niranjana Vishwanathapura <niranjana.vishwanathapura@intel.com>
Signed-off-by: Niranjana Vishwanathapura <niranjana.vishwanathapura@intel.com>
Link: https://patch.msgid.link/4d369249d52384bc93663055a3757a50614ebbfd.1784238312.git.jagmeet.randhawa@intel.com
Add 2 testcases for callback with tailcall:
1. failure case: callback->subprog->tailcall.
2. success case: subprog with tailcall do not affect
no-tailcall callback.
Signed-off-by: Pu Lehui <pulehui@huawei.com>
Link: https://patch.msgid.link/20260716120157.835937-4-pulehui@huaweicloud.com
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Some JIT compilers, such as x86_64, rely on a register to pass the TCC.
When subprograms of synchronous callback invoke tailcall, C helpers
invoking bpf callback clobber this register, and the corrupted TCC may
bypass the TCC limit, leading to infinite tailcall.
Fix this by rejecting tailcall inside all subprogs of sync callback.
This also cleanly consolidates the existing async and exception callback
checks into a single unified `is_cb` check.
Reported-by: Sashiko <sashiko-bot@kernel.org>
Reported-by: Björn Töpel <bjorn@kernel.org>
Signed-off-by: Pu Lehui <pulehui@huawei.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://patch.msgid.link/20260716120157.835937-3-pulehui@huaweicloud.com
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Currently in check_max_stack_depth_subprog, when the verifier enters a
new callee branch, the local tail_call_reachable is not properly
synchronized with the callee's state.
Consider a main prog branching into multiple subprogs:
subprog0 -> tailcall
main <
subprog1 -> subprog2
When the verifier finishes checking subprog0 and backtracks to main
prog, the local tail_call_reachable state is left as true. As it
proceeds to subprog1, this uncleared state leaks into the new branch,
falsely marking subprog1 and subprog2 as tailcall reachable.
Fix this by explicitly syncing tail_call_reachable with the callee's
has_tail_call state on entry. The caller's state is safely preserved and
restored via the existing backtracking logic.
Fixes: ebf7d1f508 ("bpf, x64: rework pro/epilogue and tailcall handling in JIT")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Pu Lehui <pulehui@huawei.com>
Link: https://patch.msgid.link/20260716120157.835937-2-pulehui@huaweicloud.com
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
UAPI Changes:
Cross-subsystem Changes:
Core Changes:
- blend: allow blend mode property without PREMULTI
- bridges:
- Rename drm_for_each_bridge_in_chain_scoped to
drm_for_each_bridge_in_chain
- Drop legacy bridges support
- gpusvm: Code reorganization to give drivers more flexibility
Driver Changes:
- etnaviv: Check if a reset has been successful
- nouveau: Create instmem iomapping at first use
- panthor: Remove redundant cleanup
- qxl: Convert to a simple encoder to a regular one
- bridges:
- Convert all remaining legacy bridges to atomic
- tc358767: clamp the reported AUX read size to the request
- panels:
- novatek-nt37801: Use mipi_dsi_*_multi() functions
- samsung-s6d16d0: Fix prepare error handling
-----BEGIN PGP SIGNATURE-----
iJUEABMJAB0WIQTkHFbLp4ejekA/qfgnX84Zoj2+dgUCaliKpwAKCRAnX84Zoj2+
dn97AYChSha31PCyoicBWbLiovMuDLyZzq7plQz/xdaRI5H0Z5aT1DkDAqeGLl+t
QLeAXKoBfjBp6OtRA7gBjEfwZPFpud58WxEmni4dU8hdHBQ1JW1R2ximQlsq5Y/A
/DESpMRzHg==
=9oKX
-----END PGP SIGNATURE-----
Merge tag 'drm-misc-next-2026-07-16' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next
drm-misc-next for 7.3:
UAPI Changes:
Cross-subsystem Changes:
Core Changes:
- blend: allow blend mode property without PREMULTI
- bridges:
- Rename drm_for_each_bridge_in_chain_scoped to
drm_for_each_bridge_in_chain
- Drop legacy bridges support
- gpusvm: Code reorganization to give drivers more flexibility
Driver Changes:
- etnaviv: Check if a reset has been successful
- nouveau: Create instmem iomapping at first use
- panthor: Remove redundant cleanup
- qxl: Convert to a simple encoder to a regular one
- bridges:
- Convert all remaining legacy bridges to atomic
- tc358767: clamp the reported AUX read size to the request
- panels:
- novatek-nt37801: Use mipi_dsi_*_multi() functions
- samsung-s6d16d0: Fix prepare error handling
Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Maxime Ripard <mripard@redhat.com>
Link: https://patch.msgid.link/20260716-famous-pastel-ostrich-a1aaef@houat
-----BEGIN PGP SIGNATURE-----
iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmpZZLcACgkQiiy9cAdy
T1HsUwv/SMAAxV/8OlEiSfhg+YBjgHio1MRG8eB8yyaJJxpbt5AfYKR5yDc57GUT
+CdVKxc+ZBFKhaNDFF+w0Z+nzTC5KGRRiixNVperet8gqzwuL5ZE1BrSJJDbf7CY
uPuUTlTol380U7mV/F+3elV+1oFiyNcZFIPPnTKldJdrVOf+tHKIoP9ffVbnVw4X
eY5h1EbmV+VCDNI+crkFPl49VeeYhOGeUx+zhW2gwkMae0/CBKeYVa2ztvWOPZeq
k8tLdL/OU4ZT85XFPPrjdJ8RY39kNqv6ZKE4k5LScWjm4Cz/kNvMrVbACoUfR6Vr
a7kt64rCDmpfcgpB5uIMsQ7TkPPULwT4qic41uBq8LxmsDKvYJD+Fc1mJkl2b4gW
6T0K0jieBleECc4Mj/XLwoZlfQux1F/2801aHo3QxcfY5zjjRY+FlEhrDGJ4dgXA
wGVXwvZF4od6Yp+dTn+JxsJs8x3PrLV5uON09yetoPaptIfINlCtfPc8noFOI+aa
3ApU8cuF
=MgQD
-----END PGP SIGNATURE-----
Merge tag 'v7.2-rc3-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6
Pull smb client fixes from Steve French:
- fallocate fixes
- unit test fixes
- fix allocation size after duplicate extents
- fix check for overlapping data areas
* tag 'v7.2-rc3-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6:
smb/client: flush dirty data before punching a hole
smb/client: Use EXPORT_SYMBOL_IF_KUNIT() to export symbols in SMB2
smb/client: Use EXPORT_SYMBOL_IF_KUNIT() to export symbols
smb: client: reject overlapping data areas in SMB2 responses
smb/client: refresh allocation after EOF-extending fallocate
smb/client: emulate small EOF-extending mode 0 fallocate ranges
smb/client: reduce fallocate zero buffer allocation
smb/client: handle overlapping allocated ranges in fallocate
smb/client: refresh allocation size after duplicate extents
smb: client: use kvzalloc() for megabyte buffer in simple fallocate
The kernel asserted frequency from scaling_cur_freq may not always match
the hardware reported frequency from cpuinfo_cur_freq.
Print both values when they are available, and only print the unavailable
message on x86 when the hardware frequency can't be read.
Link: https://lore.kernel.org/r/20260709221344.1919794-4-jeremy.linton@arm.com
Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Now that we have a generic CPPC printout, call it on !AMD
processors. If it fails to detect CPPC, or the registers don't look
reasonable then it will exit without printing anything.
Link: https://lore.kernel.org/r/20260709221344.1919794-3-jeremy.linton@arm.com
Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Arm64 machines, and possibly others, use the standard ACPI defined CPPC
infrastructure. cpupower has CPPC support, but it's largely written
around the intricacies of AMD processors, using platform MSRs to avoid
shortcomings in the specification.
Add a generic CPPC display that depends only on standardized fields. The
computed frequency values are best effort and rely on the FW providing
optional values that can be used to derive a meaningful frequency at a
given unique performance level.
Link: https://lore.kernel.org/r/20260709221344.1919794-2-jeremy.linton@arm.com
Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Ihor Solodrai says:
====================
bpf: Fix tracing of kfuncs with implicit args
Tejun reported an issue where a BPF program tracing a kfunc with
KF_IMPLICIT_ARGS can crash the kernel [1]. This is caused by a bug in
bpf_check_attach_target(): the btf_func_model for such a kfunc is
computed from a wrong BTF prototype. For more details see the commit
message of patch #1.
The second patch adds a selftest that can catch this situation.
The fix is a candidate for 7.1 backport.
[1] https://github.com/sched-ext/scx/issues/3687#issuecomment-4906694106
---
v2->v3:
* Replace btf_kfunc_accumulated_flags() with btf_kfunc_check_flag()
following a discussion with Eduard. Inlining the hook walk is a
worse option than a helper, because BTF_KFUNC_HOOK_MAX and co are
internal to btf.c and exposing them is uglier.
* remove reduntant btf_is_func check (Jiri)
* formatting nit (Eduard)
v2: https://lore.kernel.org/bpf/20260710192940.3020280-1-ihor.solodrai@linux.dev/
v1->v2:
* Take a module reference in btf_attach_func_proto() around the
btf_kfunc_accumulated_flags() call (sashiko)
v1: https://lore.kernel.org/bpf/20260710005902.2234832-1-ihor.solodrai@linux.dev/
---
====================
Link: https://patch.msgid.link/20260713235223.1639022-1-ihor.solodrai@linux.dev
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
KF_IMPLICIT_ARGS kfuncs have a BPF-call prototype and a real kernel
target prototype. Add a tracing selftest that attaches fentry and fexit
programs to bpf_kfunc_implicit_arg(), runs a syscall BPF program that
calls it, and checks that the tracing context exposes both the explicit
argument and the implicit prog aux pointer.
Co-developed-by: Ihor Solodrai <ihor.solodrai@linux.dev>
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
Link: https://patch.msgid.link/20260713235223.1639022-3-ihor.solodrai@linux.dev
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
A kfunc marked with KF_IMPLICIT_ARGS flag takes implicit arguments
(such as bpf_prog_aux) that the verifier injects at load time.
resolve_btfids strips those from the kfunc's BTF-visible prototype and
keeps the real kernel ABI in a counterpart _impl prototype [1].
fentry/fexit/fmod_ret/fsession programs may attach to the BPF kernel
functions, including those with implicit args. However
bpf_check_attach_target() and bpf_check_attach_btf_id_multi() extract
the struct btf_func_model from the wrong BTF prototype of the
kfunc. The btf_func_model is later read to construct the trampoline,
which then causes the injected implicit argument to be clobbered and
the kfunc dereferencing garbage.
Add btf_attach_func_proto() to resolve the real ABI prototype of the
kfunc the way the call site does: by looking up the _impl prototype
for a KF_IMPLICIT_ARGS kfunc. Use it at both attach-target model
construction sites.
To enable this, make two supporting changes:
* pass bpf_verifier_log instead of bpf_verifier_env to
find_kfunc_impl_proto(), so it can be reused from the attach path
* add btf_kfunc_check_flag() to test a flag across all of a kfunc's
hook sets, because a program attaching to a kfunc is not in the
kfunc's call-set
KF_IMPLICIT_ARGS must be consistent across the sets, so
btf_kfunc_check_flag() returns -EINVAL on inconsistency.
btf_kfunc_check_flag() reads the kfunc's flags from the target's
kfunc_set_tab. For a module BTF that table is stable only after the
module is live, so take a module reference around the read, mirroring
how the kfunc call path gates the same lookup with btf_try_get_module().
The remaining call sites of btf_distill_func_proto() are safe as
is. The BPF_TRACE_ITER case distills a registered iterator's
prototype, and bpf_struct_ops_desc_init() distills the
function-pointer members of a struct_ops type. Neither is a kfunc, and
so can't have implicit arguments.
[1] https://lore.kernel.org/all/20260120222638.3976562-1-ihor.solodrai@linux.dev/
Fixes: 64e1360524 ("bpf: Verifier support for KF_IMPLICIT_ARGS")
Reported-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
Link: https://github.com/sched-ext/scx/issues/3687#issuecomment-4906694106
Link: https://patch.msgid.link/20260713235223.1639022-2-ihor.solodrai@linux.dev
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
rhashtable_walk_start_check() has two restart paths when resuming a walk.
When iter->walker.tbl is valid, it re-validates iter->p against the table
and sets iter->p = NULL if the object is gone. When iter->walker.tbl is
NULL (table was freed during resize), it resets slot and skip but forgets
to clear iter->p.
rhashtable_walk_next() then dereferences the stale iter->p, reading
freed memory. This is a use-after-free.
Any caller that does multi-fragment rhashtable walks across
walk_stop/walk_start boundaries is affected. Concrete cases include
netlink_diag (__netlink_diag_dump in net/netlink/diag.c) and TIPC
(tipc_nl_sk_walk in net/tipc/socket.c).
Crash stack (netlink_diag):
BUG: KASAN: slab-use-after-free in rhashtable_walk_next+0x365/0x3c0
Read of size 8 at addr ffff88801a9d2438 (freed kmalloc-2k, offset 1080)
Call Trace:
rhashtable_walk_next+0x365/0x3c0 (lib/rhashtable.c:1016)
__netlink_diag_dump+0x160/0x760 (net/netlink/diag.c:122)
netlink_diag_dump+0xc2/0x240
netlink_dump+0x5bc/0x1270
netlink_recvmsg+0x7a3/0x980
sock_recvmsg+0x1bc/0x200
__sys_recvfrom+0x1d4/0x2c0
Fixes: 5d240a8936 ("rhashtable: improve rhashtable_walk stability when stop/start used.")
Cc: <stable@vger.kernel.org>
Reported-by: AutonomousCodeSecurity@microsoft.com
Reported-by: Yuan Tan <yuantan098@gmail.com>
Closes: https://lore.kernel.org/linux-crypto/CAB8m9Wh559e+=n8z51gB8DrbEyCc2mc0MgGjrRR6_VXBmU=2AQ@mail.gmail.com
Signed-off-by: Cen Zhang (Microsoft) <blbllhy@gmail.com>
Reviewed-by: NeilBrown <neil@brown.name>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Translate the deprecated interfaces, language features, attributes, and
conventions document (deprecated.rst) to Portuguese (pt_BR).
This ensures Portuguese-speaking developers have access to local guidelines
on deprecated APIs (like BUG(), strcpy(), and VLAs), correct usage of
safe alternatives (like WARN(), strscpy(), and flexible array members),
and modern object allocator macros (kmalloc_obj).
Signed-off-by: Daniel Pereira <danielmaraboo@gmail.com>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20260716021013.48025-5-danielmaraboo@gmail.com>
Translate the Contributor Covenant Code of Conduct document from
Documentation/process/code-of-conduct.rst to Portuguese (pt_BR)
to ensure the community guidelines are accessible in the local
language.
Also, add the newly translated file to the main index in the pt_BR
translation directory to ensure it compiles correctly within the
Sphinx build.
Signed-off-by: Daniel Pereira <danielmaraboo@gmail.com>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20260716021013.48025-4-danielmaraboo@gmail.com>
Translate the code-of-conduct-interpretation.rst document from
Documentation/process/ to Portuguese (pt_BR) to make the kernel
guidelines on community standards and enforcement more accessible
to Portuguese-speaking developers.
Signed-off-by: Daniel Pereira <danielmaraboo@gmail.com>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20260716021013.48025-3-danielmaraboo@gmail.com>
Translate the submit-checklist document from Documentation/process/
to Portuguese (pt_BR) to make the kernel contribution guidelines
more accessible to Portuguese-speaking developers.
Also, add the newly translated file to the main index in the pt_BR
translation directory to ensure it compiles and links correctly
within the Sphinx build.
Signed-off-by: Daniel Pereira <danielmaraboo@gmail.com>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20260716021013.48025-2-danielmaraboo@gmail.com>
Resolve rough edges in translation text added since commit 61e4155c81
("docs/ja_JP: translate more of submitting-patches.rst").
As with commit 999084ee0b ("docs/ja_JP: submitting-patches: Amend
"Describe your changes""), do the following tweaks:
- Rewording and rephrasing.
- Suppress extra white spaces rendered before and after strong emphasis
in HTML and PDF by using espcaped spaces.
- Provide translation words for "embargo", "word-wrap", "top-posting",
etc.
- Rather than keep "interleaved replies", use only 「インライン返信」
("inline reply"), which is a popular term in Japanese.
Signed-off-by: Akira Yokosawa <akiyks@gmail.com>
Cc: Akiyoshi Kurita <weibu@redadmin.org>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20260715120545.99917-1-akiyks@gmail.com>
This fixes the build failure
drivers/gpu/drm/radeon/radeon_bios.c:614:12: error: ‘radeon_acpi_vfct_match’ defined but not used [-Werror=unused-function]
614 | static int radeon_acpi_vfct_match(struct radeon_device *rdev,
| ^~~~~~~~~~~~~~~~~~~~~~
for builds with CONFIG_ACPI unset.
Fixes: 4059e2f02c ("drm/radeon: Fix VFCT bus number matching with soft filter")
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
