Commit graph

1,447,411 commits

Author SHA1 Message Date
Sumit Gupta
13c45a2663 ACPI: CPPC: add APIs and sysfs interface for perf_limited
Add sysfs interface to read/write the Performance Limited register.

The Performance Limited register indicates to the OS that an
unpredictable event (like thermal throttling) has limited processor
performance. It contains two sticky bits set by the platform:
  - Bit 0 (Desired_Excursion): Set when delivered performance is
    constrained below desired performance. Not used when Autonomous
    Selection is enabled.
  - Bit 1 (Minimum_Excursion): Set when delivered performance is
    constrained below minimum performance.

These bits remain set until OSPM explicitly clears them. The write
operation accepts a bitmask of bits to clear:
  - Write 0x1 to clear bit 0
  - Write 0x2 to clear bit 1
  - Write 0x3 to clear both bits

This enables users to detect if platform throttling impacted a workload.
Users clear the register before execution, run the workload, then check
afterward - if set, hardware throttling occurred during that time window.

The interface is exposed as:
  /sys/devices/system/cpu/cpuX/cpufreq/perf_limited

Signed-off-by: Sumit Gupta <sumitg@nvidia.com>
Reviewed-by: Pierre Gondois <pierre.gondois@arm.com>
Reviewed-by: Lifeng Zheng <zhenglifeng1@huawei.com>
Link: https://patch.msgid.link/20260206142658.72583-7-sumitg@nvidia.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-02-27 20:50:42 +01:00
Sumit Gupta
ea3db45ae4 cpufreq: cppc: Update MIN_PERF/MAX_PERF in target callbacks
Update MIN_PERF and MAX_PERF registers from policy->min and policy->max
in the .target() and .fast_switch() callbacks. This allows controlling
performance bounds via standard scaling_min_freq and scaling_max_freq
sysfs interfaces.

Similar to intel_cpufreq which updates HWP min/max limits in .target(),
cppc_cpufreq now programs MIN_PERF/MAX_PERF along with DESIRED_PERF.
Since MIN_PERF/MAX_PERF can be updated even when auto_sel is disabled,
they are updated unconditionally.

Also program MIN_PERF/MAX_PERF in store_auto_select() when enabling
autonomous selection so the platform uses correct bounds immediately.

Suggested-by: Rafael J. Wysocki <rafael@kernel.org>
Signed-off-by: Sumit Gupta <sumitg@nvidia.com>
Link: https://patch.msgid.link/20260206142658.72583-6-sumitg@nvidia.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-02-27 20:50:42 +01:00
Sumit Gupta
24ad4c6c13 cpufreq: CPPC: Update cached perf_ctrls on sysfs write
Update the cached perf_ctrls values when writing via sysfs to keep
them in sync with hardware registers:
- store_auto_select(): update perf_ctrls.auto_sel
- store_energy_performance_preference_val(): update perf_ctrls.energy_perf

This ensures consistent cached values after sysfs writes, which
complements the cppc_get_perf() initialization during policy setup.

Signed-off-by: Sumit Gupta <sumitg@nvidia.com>
Reviewed-by: Pierre Gondois <pierre.gondois@arm.com>
Reviewed-by: Lifeng Zheng <zhenglifeng1@huawei.com>
Link: https://patch.msgid.link/20260206142658.72583-5-sumitg@nvidia.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-02-27 20:50:42 +01:00
Sumit Gupta
38428a6800 ACPI: CPPC: Extend cppc_set_epp_perf() for FFH/SystemMemory
Extend cppc_set_epp_perf() to write both auto_sel and energy_perf
registers when they are in FFH or SystemMemory address space.

This keeps the behavior consistent with PCC case where both registers
are already updated together, but was missing for FFH/SystemMemory.

Signed-off-by: Sumit Gupta <sumitg@nvidia.com>
Reviewed-by: Pierre Gondois <pierre.gondois@arm.com>
Reviewed-by: Lifeng Zheng <zhenglifeng1@huawei.com>
Link: https://patch.msgid.link/20260206142658.72583-4-sumitg@nvidia.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-02-27 20:50:41 +01:00
Sumit Gupta
b3e45fb2db ACPI: CPPC: Warn on missing mandatory DESIRED_PERF register
Add a warning during CPPC processor probe if the Desired Performance
register is not supported when it should be.

As per 8.4.6.1.2.3 section of ACPI 6.6 specification,
"The Desired Performance Register is optional only when OSPM indicates
support for CPPC2 in the platform-wide _OSC capabilities and the
Autonomous Selection Enable field is encoded as an Integer with a
value of 1."

In other words:
- In CPPC v1, DESIRED_PERF is mandatory
- In CPPC v2, it becomes optional only when AUTO_SEL_ENABLE is supported

This helps detect firmware configuration issues early during boot.

Link: https://lore.kernel.org/lkml/9fa21599-004a-4af8-acc2-190fd0404e35@nvidia.com/
Suggested-by: Pierre Gondois <pierre.gondois@arm.com>
Signed-off-by: Sumit Gupta <sumitg@nvidia.com>
Reviewed-by: Pierre Gondois <pierre.gondois@arm.com>
Reviewed-by: Lifeng Zheng <zhenglifeng1@huawei.com>
Link: https://patch.msgid.link/20260206142658.72583-3-sumitg@nvidia.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-02-27 20:50:41 +01:00
Sumit Gupta
658fa7b1c4 ACPI: CPPC: Add cppc_get_perf() API to read performance controls
Add cppc_get_perf() function to read values of performance control
registers including desired_perf, min_perf, max_perf, energy_perf,
and auto_sel.

This provides a read interface to complement the existing
cppc_set_perf() write interface for performance control registers.

Note that auto_sel is read by cppc_get_perf() but not written by
cppc_set_perf() to avoid unintended mode changes during performance
updates. It can be updated with existing dedicated cppc_set_auto_sel()
API.

Use cppc_get_perf() in cppc_cpufreq_get_cpu_data() to initialize
perf_ctrls with current hardware register values during cpufreq
policy initialization.

Signed-off-by: Sumit Gupta <sumitg@nvidia.com>
Reviewed-by: Pierre Gondois <pierre.gondois@arm.com>
Reviewed-by: Lifeng Zheng <zhenglifeng1@huawei.com>
Link: https://patch.msgid.link/20260206142658.72583-2-sumitg@nvidia.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-02-27 20:50:41 +01:00
Jakub Kicinski
3d17d76d1f io_uring/zcrx: don't set rx_page_size when not requested
The rx_buf_len parameter was recently added to the Rx zero-copy
implementation. The expectation is that when not set system will
maintain previous behavior and use the default buffer size (PAGE_SIZE).

This works correctly at the iouring level, but we don't preserve
the same "zero means default" semantics when registering the memory
provider on the netdev. mp_param.rx_page_size is unconditionally
set to PAGE_SIZE. This causes __net_mp_open_rxq() to check for
QCFG_RX_PAGE_SIZE support in the driver, and return -EOPNOTSUPP
for drivers that don't advertise it -- even though the user never
asked for large buffers.

Only set mp_param.rx_page_size when rx_buf_len was explicitly provided,
so that the default page size path works on all zcrx-capable drivers.
mlx5 and fbnic only support 4kB pages in the current release.

Fixes: 795663b4d1 ("io_uring/zcrx: implement large rx buffer support")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-02-27 12:32:49 -07:00
David Carlier
032e084f0d tools/sched_ext: fix strtoul() misuse in scx_hotplug_seq()
scx_hotplug_seq() uses strtoul() but validates the result with a
negative check (val < 0), which can never be true for an unsigned
return value.

Use the endptr mechanism to verify the entire string was consumed,
and check errno == ERANGE for overflow detection.

Signed-off-by: David Carlier <devnexen@gmail.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
2026-02-27 09:17:44 -10:00
Linus Torvalds
aed968f8a6 cxl fixes for v7.0-rc2
- Fix incorrect usages of decoder flags.
 cxl/region: Test CXL_DECODER_F_NORMALIZED_ADDRESSING as a bitmask
 cxl: Test CXL_DECODER_F_LOCK as a bitmask
 
 cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()
 
 - Moving of devm_cxl_add_nvdimm_bridge() is required for the race fix.
 cxl: Fix race of nvdimm_bus object when creating nvdimm objects
 cxl: Move devm_cxl_add_nvdimm_bridge() to cxl_pmem.ko
 
 - The port_to_host() is used to fix the race window without host lock.
 cxl/port: Hold port host lock during dport adding.
 cxl/port: Introduce port_to_host() helper
 
 cxl/memdev: fix deadlock in cxl_memdev_autoremove() on attach failure
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE5DAy15EJMCV1R6v9YGjFFmlTOEoFAmmhzZgACgkQYGjFFmlT
 OEqKrhAA2DoFTLePsbDXOAqs/9A90amNkWjE7JRuKELqVs0o00vutYiWiThP7lXP
 v0wsCq5V2+DT35Oo0SpDntNQkYn54vjRF4Q4VYdHvBRuU4mbWFEqctJBvYRHjXSE
 I4POupbqO8pAIz5R7jaRdq/PgnW1S+4ZARzkmJGXfpzgUC2JdHN+hl2aRkBWr09o
 2RCmVu0H5yxLibw7DmZex/s4ksXzuegy0BDo94Xmo+GXabYHCPCiQOZobZzUMhlL
 5r+YTGMY+Q3Z+nHm3fuC4lQCMClgTVf6xdHtqqZ/GQ6b69KjhO0V7/RmZENvmlLS
 LtW4ZwEmgQRX6rnoT3p2UaB1cu4lBscU9kYRZdmP7FnYbu8cJXe6Dfk+56lDnqy8
 8bwYAPPmV/IBv4dRecoliYhGMJ4TMmgCoxwxuh2KROUpKI1GkIsTzMeoypviS6Nm
 5EAlMvoMZkgygkpJ+z8u009IgIQyxQRWqIxw0aLcutAlBhtZxb8/iq8dOCrgCb64
 HFpeglrmechDbXgf9hHWWh+RX+A6MrhLTcjyYIdVJzb7jrfWkwUDZaKg7cRni51W
 IPZtjaawvEMbYRs+dVP0frZvLDqPYE0U4Y3GWa7d9XRSHx0QwTcLwi8ShXEx3dqS
 wcL/THCEH0Zhtl3LU6CDfeChPKyyUnt2ChbucccVLjN2thaRH44=
 =4//d
 -----END PGP SIGNATURE-----

Merge tag 'cxl-fixes-7.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl

Pull cxl fixes from Dave Jiang:

 - Fix incorrect usages of decoder flags

 - Validate payload size before accessing contents

 - Fix race condition when creating nvdimm objects

 - Fix deadlock on attach failure

* tag 'cxl-fixes-7.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl:
  cxl/region: Test CXL_DECODER_F_NORMALIZED_ADDRESSING as a bitmask
  cxl: Test CXL_DECODER_F_LOCK as a bitmask
  cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()
  cxl: Fix race of nvdimm_bus object when creating nvdimm objects
  cxl: Move devm_cxl_add_nvdimm_bridge() to cxl_pmem.ko
  cxl/port: Hold port host lock during dport adding.
  cxl/port: Introduce port_to_host() helper
  cxl/memdev: fix deadlock in cxl_memdev_autoremove() on attach failure
2026-02-27 10:52:57 -08:00
Linus Torvalds
962336b9ff MMC core:
- Avoid bitfield RMW for claim/retune flags
 
 MMC host:
  - dw_mmc-rockchip: Fix runtime PM support for internal phase support
  - mmci: Fix device_node reference leak in of_get_dml_pipe_index()
  - sdhci-brcmstb: Use correct register offset for V1 pin_sel restore
 -----BEGIN PGP SIGNATURE-----
 
 iQJLBAABCgA1FiEEugLDXPmKSktSkQsV/iaEJXNYjCkFAmmhyS4XHHVsZi5oYW5z
 c29uQGxpbmFyby5vcmcACgkQ/iaEJXNYjCnhaA/+IzAHwVL1DGwZNbO/5cO84rkL
 vx7Hnzt0CMbwkBlEdFFXUDt1/ESSWNQk2e7ydNCElwBIz0PdBp5hlMIyumksx1D0
 sQibqz4kNywtAAVtFcgemKb8BVdf7bdwVD+5sGnFhHmX8+GyTjlTd9Qj/Yt7bgcA
 ywWfl+w45rR0bypGsfMJVQ3l2pslwiXTyo0K4TUJiZkCtpwu9hzSfFShGM2ipYFX
 HiSTGV240MvxYteuqgVJIFdQmEje1NczGjRS6s6BIvt7zwKcfJgJACpue6ZJu3Ra
 vy9NFnNXCQ2C1LFtr0MjjrdWBowed6/HJJoxCgfcmdxbnqYqZWMfDGrOtH6xP8HQ
 xGHJJF5BA3EvvyfBg5hgUKVvQ80yRnIYUJ52Tzwcm0U9gcHe1tu1rxRYwNPUpLBS
 L/smXIvt0j/WVPEjKO+I1TXB1XMqJFSh88vAut7UXbCtJZN9YBP/aRqXJSVc5gs/
 LKNWrNr1qymusvPagnlMnYGOdJKQbBNKYeN7oyEwyN/oW/JF6JGVuWctvJQuigVz
 xDw2g7cnI/CMh+gAQumd1H23Rnwy+kL16Ld9z27ih4PB54Vq7VlTxbpJCdREDxU6
 y8c3C09AKOjMfOPXwqnJ/2HH+y4IpYW9WykuaKJFRKekx87irKuc8BOC5cGwXL8H
 WXZbxqLrQM9GkPXiu+w=
 =zG3/
 -----END PGP SIGNATURE-----

Merge tag 'mmc-v7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc

Pull MMC fixes from Ulf Hansson:
 "MMC core:
   - Avoid bitfield RMW for claim/retune flags

  MMC host:
   - dw_mmc-rockchip: Fix runtime PM support for internal phase support
   - mmci: Fix device_node reference leak in of_get_dml_pipe_index()
   - sdhci-brcmstb: Use correct register offset for V1 pin_sel restore"

* tag 'mmc-v7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
  mmc: core: Avoid bitfield RMW for claim/retune flags
  mmc: sdhci-brcmstb: use correct register offset for V1 pin_sel restore
  mmc: dw_mmc-rockchip: Fix runtime PM support for internal phase support
  mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index()
2026-02-27 10:49:54 -08:00
Linus Torvalds
78d964c47f block-7.0-20260227
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmmhxjgQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgpqZND/9ZHjUX2BhtEHWayTLpgBl5JYeYvNnxgeKw
 MsQjmkDBJDdpxz5s5Y6zY+OKDhWv+o4VgfgykK5bpn5/kXgwqvKSK9QroVSl6OPk
 JTFo3PQ0KhuZQyBxX+zZPNjgV/Kzop4j7NuNrovrIEJtvgVZuwJx/0h/DdpLez3N
 +l9jWQcjLjFJHHnTuV9Tv1jqhcPU5vxkkEWlZgwkWMxdghMWWw5JDHxGt1w3g6c8
 4Qmn1G3SqAPEItQ+ugU+BL+vYVKVm9/Gaa4JWJTm8d1ADmQxd1xXfkDLSBL2L4EQ
 VU+lkHwFDhx8hjFSeOTps90lTlrUzIaAqYn532VVsU/RMWFzcdUbPJdED7QddUNG
 gGj40sUu5XaMoBKzCRJ6KznYMCK3x15gptz8MAj2hfqcUk+GRLKO9crXj0tU35iP
 sBVMlC66+nVDNQRybqVUMTpizARoFHiRCKSwaFjbsnoe1DkIayn8ghDLhMm9W8Ea
 hgroXlmgafB7Ad/Kt5SSYv0Nw644Zw4bLTrIO1G+OuQf6DRMGt6z5dmmo9arsgjU
 fKNs7Dwb+1d0cpKFNHpnQOc4htO3G1B1stGT6WEJUpd5MXDurw4VoNdaRkOSbi75
 hd+VM+dyJEDHpc/QuRSFBQQqbFLJ4Hfi3z/+oUP8x1FVbDb2u7b+2H7BFgrn08Y+
 EEKRaIQ6PQ==
 =gtEI
 -----END PGP SIGNATURE-----

Merge tag 'block-7.0-20260227' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

Pull block fixes from Jens Axboe:
 "Two sets of fixes, one for drbd, and one for the zoned loop driver"

* tag 'block-7.0-20260227' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  zloop: check for spurious options passed to remove
  zloop: advertise a volatile write cache
  drbd: fix null-pointer dereference on local read error
  drbd: Replace deprecated strcpy with strscpy
  drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock()
2026-02-27 10:42:02 -08:00
Linus Torvalds
530b0b61df io_uring-7.0-20260227
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmmhxlEQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgpot9EACmBXos2lXMkiFN5TcSOLKW9Lh7PNAuDUns
 oflfPVkS/F17muPnQIHzn5wqHpbWijx2uH0ehUXNJi+6U7OBdvZyZvEfdslh2ewZ
 TAPnTFDZZbvdPqnGw7MJ1fLqGOB0RLoMJ72GkwIPhV6SQqmfu6U89ppplyMxybLK
 MPLOx3j8HK/pX/3uLEyOpZ6XIfZjGyGiiMj8lEN+UZ5a9b5G3W87LnGPTRitl6SL
 j5QTC5abGVk0vOqEPjm6Qws1icU9MumNAqTBTGL12WVlDRw0bQfSsZQzwySLXQpc
 pbT3CUurt3jgU873S8xPnbc0v5g/YMLuGv7morMRHJ13h4g1lTR3Q5u5+KX3RTBQ
 /I+R6C0uptLity+mBymdf0ZSgFOG7J7vfI6MzlqjUXSUqCfF3QVqrw5GrSDiDbI7
 oO+JjSExM01w6kf1dcxk1ROJxxNiNWPpuP958poDydpD9jnp+Mr6jHuN66Es0Ctd
 fBvVMa1w2MzYopIeclN4KNvuPQV+HxITMt9RgNW+6iXo7Fwqy1SCyGbuOr6t1f4Y
 SD8s6xVYw47OilvGyaFZrERIq0xe8SjoCaNeVgDk9sX8g2XCZL1Utop9FbkzgPWW
 WzH6Y9by3UobHoCB2iehIbglaQtCKSwJou76Z7nXi15luZNL5MlQbQzYEaDcSlea
 i1dBMOmi+w==
 =lbcV
 -----END PGP SIGNATURE-----

Merge tag 'io_uring-7.0-20260227' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

Pull io_uring fixes from Jens Axboe:
 "Just two minor patches in here, ensuring the use of READ_ONCE() for
  sqe field reading is consistent across the codebase. There were two
  missing cases, now they are covered too"

* tag 'io_uring-7.0-20260227' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  io_uring/timeout: READ_ONCE sqe->addr
  io_uring/cmd_net: use READ_ONCE() for ->addr3 read
2026-02-27 10:39:11 -08:00
Sebastian Andrzej Siewior
0bd96853ba efi: Allow to expose the workqueue via sysfs
Exposing the efi_rts_wq workqueue via sysfs provides an easy mechanism
to restrict EFI firmware invocation to certain CPU(s).
This can be used to restrict EFI invocations to specific CPUs while
allowing other workqueue to use the remaning CPUs.

Expose the workqueue via sysfs. Change the name to efi_runtime which is
what will be visible under sysfs.

Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Tejun Heo <tj@kernel.org>
2026-02-27 08:21:37 -10:00
Sebastian Andrzej Siewior
a4aa8d94f2 workqueue: Allow to expose ordered workqueues via sysfs
Ordered workqueues are not exposed via sysfs because the 'max_active'
attribute changes the number actives worker. More than one active worker
can break ordering guarantees.

This can be avoided by forbidding writes the file for ordered
workqueues. Exposing it via sysfs allows to alter other attributes such
as the cpumask on which CPU the worker can run.

The 'max_active' value shouldn't be changed for BH worker because the
core never spawns additional worker and the worker itself can not be
preempted. So this make no sense.

Allow to expose ordered workqueues via sysfs if requested and forbid
changing 'max_active' value for ordered and BH worker.

Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Acked-by: Tejun Heo <tj@kernel.org>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Tejun Heo <tj@kernel.org>
2026-02-27 08:21:18 -10:00
Linus Torvalds
764a167f54 xfs: fixes for v7.0-rc2
Signed-off-by: Carlos Maiolino <cem@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iJUEABMJAB0WIQSmtYVZ/MfVMGUq1GNcsMJ8RxYuYwUCaaG5hAAKCRBcsMJ8RxYu
 Yzr8AX41j614+T5Vce4nA1ZVaRagshb7P7kg+uKB24OVUQtZG+ceF0XBRAX8gUWB
 wsj4DQYBf3ePyUvD+XlrX7ZZ9jjYAGWj7bUh8UY0BIgqKXZNOwpM58e6bw2sEX78
 PaO+LXil6A==
 =sLv/
 -----END PGP SIGNATURE-----

Merge tag 'xfs-fixes-7.0-rc2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux

Pull xfs fixes from Carlos Maiolino:
 "Nothing reeeally stands out here: a few bug fixes, some refactoring to
  easily fit the bug fixes, and a couple cosmetic changes"

* tag 'xfs-fixes-7.0-rc2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
  xfs: add static size checks for ioctl UABI
  xfs: remove duplicate static size checks
  xfs: Add comments for usages of some macros.
  xfs: Update lazy counters in xfs_growfs_rt_bmblock()
  xfs: Add a comment in xfs_log_sb()
  xfs: Fix xfs_last_rt_bmblock()
  xfs: don't report half-built inodes to fserror
  xfs: don't report metadata inodes to fserror
  xfs: fix potential pointer access race in xfs_healthmon_get
  xfs: fix xfs_group release bug in xfs_dax_notify_dev_failure
  xfs: fix xfs_group release bug in xfs_verify_report_losses
  xfs: fix copy-paste error in previous fix
  xfs: Fix error pointer dereference
  xfs: remove metafile inodes from the active inode stat
  xfs: cleanup inode counter stats
  xfs: fix code alignment issues in xfs_ondisk.c
  xfs: Replace &rtg->rtg_group with rtg_group()
  xfs: Refactoring the nagcount and delta calculation
  xfs: Replace ASSERT with XFS_IS_CORRUPT in xfs_rtcopy_summary()
2026-02-27 10:21:06 -08:00
Romain Sioen
ab05515757 HID: mcp2221: use mcp_i2c_smbus_read for block reads
Refactor mcp_smbus_xfer() to use the mcp_i2c_smbus_read() helper function
for I2C_SMBUS_BLOCK_DATA and I2C_SMBUS_I2C_BLOCK_DATA read operations.

This replaces the manual setup of the receive buffer and explicit calls
to mcp_send_data_req_status(), making the code cleaner and more consistent
with other read paths in the driver.

Signed-off-by: Romain Sioen <romain.sioen@microchip.com>
Signed-off-by: Marius Cristea <marius.cristea@microchip.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-02-27 18:55:22 +01:00
Romain Sioen
e31b556c0b HID: mcp2221: cancel last I2C command on read error
When an I2C SMBus read operation fails, the MCP2221 internal state machine
may not reset correctly, causing subsequent transactions to fail.

By adding a short delay and explicitly cancelling the last command,
we ensure the device is ready for the next operation.

Fix an issue where i2cdetect was not able to detect all devices correctly
on the bus.

Signed-off-by: Romain Sioen <romain.sioen@microchip.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-02-27 18:54:09 +01:00
Linus Torvalds
3feb464fb7 slab fixes for 7.0-rc1
-----BEGIN PGP SIGNATURE-----
 
 iQFPBAABCAA5FiEEe7vIQRWZI0iWSE3xu+CwddJFiJoFAmmhvA4bFIAAAAAABAAO
 bWFudTIsMi41KzEuMTEsMiwyAAoJELvgsHXSRYiaqPEIAJAN0BlnFoaWew6YSiEO
 RjVx1G14Xdp4H9Vc93cg3pXXTvBlAMgNSxEhyiXXCwFTGjnsUqowDqDU6+cJCr7k
 KqVLPh1gHR4aIsXcgufOqu9W9hv/vQrd2d9/8qSD+k2jwcOEIk/oFyjRPrzxCrxg
 sH4hWy+zfJW1mllMXbMRj3RVRIrvITmnLK0J0ByzuTXjrswyHhsY+6Bl2G5Q7F4V
 MuHLZcUAcav/gi4r0d/RoK3m37lC7mGUBT7xsGvt/vRCTCgQvwHbKu47Wq7c+ozd
 dP2Dz3qNIR/q2BdDx5ftC8bacR+QE2E3EcYhraOVjLcEsMUO3e7n83umgOixyIT+
 fNU=
 =FjaS
 -----END PGP SIGNATURE-----

Merge tag 'slab-for-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab

Pull slab fixes from Vlastimil Babka:

 - Fix for spurious page allocation warnings on sheaf refill (Harry Yoo)

 - Fix for CONFIG_MEM_ALLOC_PROFILING_DEBUG warnings (Suren
   Baghdasaryan)

 - Fix for kernel-doc warning on ksize() (Sanjay Chitroda)

 - Fix to avoid setting slab->stride later than on slab allocation.
   Doesn't yet fix the reports from powerpc; debugging is making
   progress (Harry Yoo)

* tag 'slab-for-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab:
  mm/slab: initialize slab->stride early to avoid memory ordering issues
  mm/slub: drop duplicate kernel-doc for ksize()
  mm/slab: mark alloc tags empty for sheaves allocated with __GFP_NO_OBJ_EXT
  mm/slab: pass __GFP_NOWARN to refill_sheaf() if fallback is available
2026-02-27 09:54:02 -08:00
Mika Westerberg
e1092d5e15 PCI/PTM: Do not enable PTM automatically for Root and Switch Upstream Ports
Currently we enable PTM automatically for Root and Switch Upstream Ports if
the advertised capabilities support the relevant role. However, there are a
few issues with this. First of all, if there is no Endpoint that actually
needs the PTM functionality, this is just wasting link bandwidth. There are
just a couple of drivers calling pci_ptm_enable() in the tree.

Secondly, we do the enablement in pci_ptm_init() that is called pretty
early for the Switch Upstream Port before Downstream Ports are even
enumerated. Since the Upstream Port configuration affects the whole Switch,
enabling it this early might cause PTM requests to be sent. We actually do
see effects of this:

  pcieport 0000:00:07.1: pciehp: Slot(6-1): Card present
  pcieport 0000:00:07.1: pciehp: Slot(6-1): Link Up
  pci 0000:2c:00.0: [8086:5786] type 01 class 0x060400 PCIe Switch Upstream Port
  ...
  pci 0000:2c:00.0: PTM enabled, 4ns granularity

At this point we have only enumerated the Switch Upstream Port and now
PTM got enabled which immediately triggers a flood of errors:

  pcieport 0000:00:07.1: AER: Multiple Uncorrectable (Non-Fatal) error message received from 0000:00:07.1
  pcieport 0000:00:07.1: PCIe Bus Error: severity=Uncorrectable (Non-Fatal), type=Transaction Layer, (Receiver ID)
  pcieport 0000:00:07.1:   device [8086:d44f] error status/mask=00200000/00000000
  pcieport 0000:00:07.1:    [21] ACSViol                (First)
  pcieport 0000:00:07.1: AER:   TLP Header: 0x34000000 0x00000052 0x00000000 0x00000000
  pcieport 0000:00:07.1: AER: device recovery successful
  pcieport 0000:00:07.1: AER: Uncorrectable (Non-Fatal) error message received from 0000:00:07.1

In the above TLP Header the Requester ID is 0 which causes an error as we
have ACS Source Validation enabled.

Change the PTM enablement to happen at the time pci_enable_ptm() is called.
It will try to enable PTM first for upstream devices before enabling for
the Endpoint itself. For disable path we need to keep count of how many
times PTM has been enabled and disable it only on the last, so change the
dev->ptm_enabled to a counter (and rename it to dev->ptm_enable_cnt
analogous to dev->pci_enable_cnt).

Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20260224111044.3487873-6-mika.westerberg@linux.intel.com
2026-02-27 11:48:09 -06:00
Linus Torvalds
d5a8e4be46 gpio fixes for v7.0-rc2
- fix memory leaks in shared GPIO management
 - normalize the return values of gpio_chip::get() in GPIO core on behalf
   of drivers that return invalid values (this is done because adding
   stricter sanitization of callback retvals led to breakages in existing
   users, we'll revert that once all are fixed)
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEkeUTLeW1Rh17omX8BZ0uy/82hMMFAmmhWe4ACgkQBZ0uy/82
 hMP+0w//bZbeziFmQFmPsUYAdlmWrA21XSRmnoiz3Q+b8NLd2xapliAXNf7mg4fA
 XP2NAHKmua+WmiIDTPD5qQ1kXZsjHZWvuZDHbolIUmYdjVOd6zhwGxfUk3MkI3gR
 wa4+W4U95YJBKo4JWs+o+7U9/VChVUkRQV2Lm+2EOK+qkzDORe9FNsuzqsQhHUX4
 pV+AdOX6bggbRC7yrdROFiaAvWR/mj/N6RMluMgR0471irab6t1t/T4dvhdVwGam
 5wqi453Y/4171bEcXydCO6mElxNEW+Eko612mmU4dhP5skdrIgElOe++5X10TOTm
 lMHo97AYgy1A2kx5kDPUvuBeMaoK9JeDjLmCQuRIAy9KGaIx+/p0z2Xl8tU705Gj
 3Be4ebTVxqqO6ztkbJZuUBwOKktYqrlOEPGNSh6rmCee1XNZeGTYNzohl5e8PSr/
 jzuKIHFlrwgCa/0a1MJu02RTnSmhSwK91aQM6QNj4KzghuzCYaHSpVG5qFdE2jZl
 KxpoNJhwC8xMSmZLuYnPZ/hRHratVr0O5VkJsbNozEsOgnxTXz7Ql569GMuVfpVQ
 n4RtBT75bhbhnmN4ApKzd3eURcMJOAfGlUIyA9Ljhmh8MRDjAIynd7CsY4UpdlTp
 sHjRG5I2WKI88uXPTcnJ0dprSV1gSxC8fvLjY7uswfXGKwHOlII=
 =0k76
 -----END PGP SIGNATURE-----

Merge tag 'gpio-fixes-for-v7.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux

Pull gpio fixes from Bartosz Golaszewski:

 - fix memory leaks in shared GPIO management

 - normalize the return values of gpio_chip::get() in GPIO core on
   behalf of drivers that return invalid values (this is done because
   adding stricter sanitization of callback retvals led to breakages in
   existing users, we'll revert that once all are fixed)

* tag 'gpio-fixes-for-v7.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
  gpiolib: normalize the return value of gc->get() on behalf of buggy drivers
  gpio: shared: fix memory leaks
2026-02-27 09:42:17 -08:00
Mallesh Koujalagi
4a91a33f15 workqueue: Update documentation as per system_percpu_wq naming
Update documentation to use "per-CPU workqueue" instead of
"global workqueue" to match the system_wq to system_percpu_wq
rename. The workqueue behavior remains unchanged; this just
aligns terminology with the clearer naming.

Fixes: a2be943b46 ("workqueue: replace use of system_wq with system_percpu_wq")
Signed-off-by: Mallesh Koujalagi <mallesh.koujalagi@intel.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
2026-02-27 07:40:44 -10:00
Linus Torvalds
bbcb2cd675 sound fixes for 7.0-rc2
A bunch of small device-specific fixes.  Mostly quirks and fix-ups
 for USB- and HD-audio at this time, in addition to a couple of ASoC
 AMD and Cirrus fixes.
 -----BEGIN PGP SIGNATURE-----
 
 iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmmge60OHHRpd2FpQHN1
 c2UuZGUACgkQLtJE4w1nLE9+mRAAypQ4MWa9u7WYjfVWdLAV2E0ak6kLHTeMpp2Z
 04EQotgPIIGq8L0PP+YYeX0XdWBfyXp39U/8/Tbq1XhJv5Pnu046qWVgPYDx9Apq
 TGZXBalgg/KRVfP4dSI+w8M7BP7n4eUPeHYtdlBp0qFD17VhVkPQvcDuOtRQI1vI
 jTbIOBfliKDs2xe+QuGUExa4TZsQhKFPGNTe/+0uzh2fOpZfCrxJ2eja451GWdNJ
 Fv/tHgEEbTINOd3mVIkLispvMfdXNdY/b00rjbPvSb9j2vFK2R41zsb4AsZGyJpR
 jcbDMeE1zP7Gjopie+B2ElEZCM4ByLVy+Gf2HZbg371aioi1le9l2YiezvFIVP5l
 uueu4U4k+gFFuh/665AzY5WZ9KJ49yc3KRTgLvT8tFN0CtQfEhI5wZ8D0DIPuwn6
 LwJNQCE8gUbOF8/PT9msWYI9ToPvMLrWSvLmnUpCtUc+lTzXfPv8YkXJ8Wv5pNZq
 P7/9aTDv8YS7f/QBp8QbeLUQSiEO5KnzyNkV+kWRQAIaD5niKSWILk1jZDyKjEcK
 QLyZekvmyLJGzP4WM33wjCaY3c1mAQZ4QgFFbjlOQZ+TwKB1xb3DgWo2K2ARgw26
 cjVsqnMHc+Dqu56TAo40NSIWq3Ly1ii/9+fvVnvEPoB7w/M5pQ1jyyW/gLJGcNid
 Se78Mt0=
 =UOkZ
 -----END PGP SIGNATURE-----

Merge tag 'sound-7.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "A bunch of small device-specific fixes. Mostly quirks and fix-ups for
  USB- and HD-audio at this time, in addition to a couple of ASoC AMD
  and Cirrus fixes"

* tag 'sound-7.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (24 commits)
  ASoC: SDCA: Fix comments for sdca_irq_request()
  ALSA: us144mkii: Drop kernel-doc markers
  ALSA: usb: qcom: Correct parameter comment for uaudio_transfer_buffer_setup()
  ALSA: usb-audio: Drop superfluous kernel-doc markers
  ALSA: hda: cs35l56: Remove unnecessary struct cs_dsp_client_ops
  ALSA: hda: cs35l56: Fix signedness error in cs35l56_hda_posture_put()
  ALSA: usb-audio: Use correct version for UAC3 header validation
  ALSA: hda/realtek: add quirk for Acer Nitro ANV15-51
  ALSA: hda/intel: increase default bdl_pos_adj for Nvidia controllers
  ALSA: usb-audio: Use inclusive terms
  ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0
  ALSA: usb-audio: Check max frame size for implicit feedback mode, too
  ALSA: usb-audio: Cap the packet size pre-calculations
  ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table
  ASoC: cs42l43: Report insert for exotic peripherals
  ALSA: usb-audio: Skip clock selector for Focusrite devices
  ALSA: usb-audio: Add QUIRK_FLAG_SKIP_IFACE_SETUP
  ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices
  ALSA: usb-audio: Improve Focusrite sample rate filtering
  ALSA: hda/realtek: add quirk for Samsung Galaxy Book Flex (NT950QCT-A38A)
  ...
2026-02-27 09:34:02 -08:00
Maíra Canal
550bae2c09 pmdomain: bcm: bcm2835-power: Fix broken reset status read
bcm2835_reset_status() has a misplaced parenthesis on every PM_READ()
call. Since PM_READ(reg) expands to readl(power->base + (reg)), the
expression:

    PM_READ(PM_GRAFX & PM_V3DRSTN)

computes the bitwise AND of the register offset PM_GRAFX with the
bitmask PM_V3DRSTN before using the result as a register offset, reading
from the wrong MMIO address instead of the intended PM_GRAFX register.
The same issue affects the PM_IMAGE cases.

Fix by moving the closing parenthesis so PM_READ() receives only the
register offset, and the bitmask is applied to the value returned by
the read.

Fixes: 670c672608 ("soc: bcm: bcm2835-pm: Add support for power domains under a new binding.")
Signed-off-by: Maíra Canal <mcanal@igalia.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Reviewed-by: Stefan Wahren <wahrenst@gmx.net>
Cc: stable@vger.kernel.org
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-02-27 18:02:35 +01:00
Tomasz Lis
c692ae39e9 drm/xe/vf: Redo LRC creation while in VF fixups
If the xe module within a VM was creating a new LRC during save/
restore, this LRC will be invalid. The fixups procedure may not
be able to reach it, as there will be a race to add the new LRC
reference to an exec queue.

Even if the new LRC which was being created during VM migration is
added to EQ in time for fixups, said LRC may still remain damaged.
In a small percentage of specially crafted test cases, the resulting
LRC was still damaged and caused GPU hang.

Any LRC which could be created in such a situation, have to be
re-created.

Due to VM having arbitrarily set amount of CPU cores, it is possible
to limit the amount to 1. In such case, there is a possibility that
kernel will switch CPU contexts in a way which allows to miss
VF migration recovery running in parallel (by simply not switching
to the LRC creation thread during recovery). Therefore checking
if the migration is in progress just after LRC creation, is not
enough to ensure detection.

Free the incorrectly created LRC, and trigger a re-run of the
creation, but only after waiting for default LRC to get fixups.
Use additional atomic value increased after fixups, to ensure any VF
migration that avoided detection by just checking for recovery in
progress, will be caught.

v2: Merge marker and wait for default LRC, reducing amount of calls
  within xe_init_eq(). Alter the LRC creation loop to remove a race
  with post-migration fixups worker.
v3: Kerneldoc fixes. Rename fixups_complete_count.

Signed-off-by: Tomasz Lis <tomasz.lis@intel.com>
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
Link: https://patch.msgid.link/20260226212701.2937065-5-tomasz.lis@intel.com
2026-02-27 18:02:07 +01:00
Tomasz Lis
f3fb5f1ebb drm/xe/vf: Wait for all fixups before using default LRCs
When a context is being created during save/restore, the LRC creation
needs to wait for GGTT address space to be shifted. But it also needs
to have fixed default LRCs. This is mandatory to avoid the situation
where LRC will be created based on data from before the fixups, but
reference within exec queue will be set too late for fixups.

This fixes an issue where contexts created during save/restore have
a large chance of having one unfixed LRC, due to the xe_lrc_create()
being synced for equal start to race with default LRC fixups.

v2: Move the fixups confirmation further, behind all fixups.
  Revert some renames.

Signed-off-by: Tomasz Lis <tomasz.lis@intel.com>
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
Link: https://patch.msgid.link/20260226212701.2937065-4-tomasz.lis@intel.com
2026-02-27 18:02:06 +01:00
Tomasz Lis
ec172c7bef drm/xe: Wrappers for setting and getting LRC references
There is a small but non-zero chance that VF post migration fixups
are running on an exec queue during teardown. The chances are
decreased by starting the teardown by releasing guc_id, but remain
non-zero. On the other hand the sync between fixups and EQ creation
(wait_valid_ggtt) drastically increases the chance for such parallel
teardown if queue creation error path is entered (err_lrc label).

The exec queue itself is not going to cause an issue, but LRCs have
a small chance of getting freed during the fixups.

Creating a setter and a getter makes it easier to protect the fixup
operations with a lock. For other driver activities, the original
access method (without any protection) can still be used.

v2: Separate lock, only for LRCs. Kerneldoc fixes. Subject tag fix.

Signed-off-by: Tomasz Lis <tomasz.lis@intel.com>
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
Link: https://patch.msgid.link/20260226212701.2937065-3-tomasz.lis@intel.com
2026-02-27 18:02:04 +01:00
Tomasz Lis
393e5fea6f drm/xe/queue: Call fini on exec queue creation fail
Every call to queue init should have a corresponding fini call.
Skipping this would mean skipping removal of the queue from GuC list
(which is part of guc_id allocation). A damaged queue stored in
exec_queue_lookup list would lead to invalid memory reference,
sooner or later.

Call fini to free guc_id. This must be done before any internal
LRCs are freed.

Since the finalization with this extra call became very similar to
__xe_exec_queue_fini(), reuse that. To make this reuse possible,
alter xe_lrc_put() so it can survive NULL parameters, like other
similar functions.

v2: Reuse _xe_exec_queue_fini(). Make xe_lrc_put() aware of NULLs.

Fixes: 3c1fa4aa60 ("drm/xe: Move queue init before LRC creation")
Signed-off-by: Tomasz Lis <tomasz.lis@intel.com>
Reviewed-by: Matthew Brost <matthew.brost@intel.com> (v1)
Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
Link: https://patch.msgid.link/20260226212701.2937065-2-tomasz.lis@intel.com
2026-02-27 18:02:03 +01:00
Xin Wang
223b2f51ba drm/xe: restrict multi-lrc to VCS/VECS engines
Tighten uapi validation to restrict multi-lrc support to VIDEO_DECODE and
VIDEO_ENHANCE engines only. This check should have been in place from the
start, as the driver typically avoids allowing uapi cases that we have
no userspace consumer for.

Additionally, the GuC firmware on ModSched platforms no longer supports
multi-lrc on non-media engines.

V4:
 - use a unified mask for all platforms since engine instance count
   is an independent runtime check (Matt Roper, Matthew Brost)

V3:
 - store a multi-lrc enable class mask in xe->info and populate from
   xe_device_desc in xe_pci.c (Matthew Brost)

V2:
 - correct the typo (Shuicheng)
 - move the check earlier to avoid VM lookup (Shuicheng, Matt Roper)
 - remove the graphics version check (Matt Roper)
 - input more details in the commit info (Matt Roper)

Cc: Shuicheng Lin <shuicheng.lin@intel.com>
Cc: Matt Roper <matthew.d.roper@intel.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Signed-off-by: Xin Wang <x.wang@intel.com>
Reviewed-by: Shuicheng Lin <shuicheng.lin@intel.com>
Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
Link: https://patch.msgid.link/20260225022014.45394-1-x.wang@intel.com
Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
2026-02-27 08:58:02 -08:00
Linus Torvalds
466d6175e3 drm fixes for 7.0-rc2
i915/display:
 - Fix Panel Replay stuck with X during mode transitions on Panther Lake
 
 xe:
 - W/a fix for multi-cast registers
 - Fix xe_sync initialization issues
 
 amdgpu:
 - UserQ fixes
 - DC fix
 - RAS fixes
 - VCN 5 fix
 - Slot reset fix
 - Remove MES workaround that's no longer needed
 
 amdxdna:
 - deadlock fix
 - NULL ptr deref fix
 - suspend failure fix
 - OOB access fix
 - buffer overflow fix
 - input sanitiation fix
 - firmware loading fix
 
 dw-dp:
 - An error handling fix
 
 ethosu:
 - A binary shift overflow fix
 
 imx:
 - An error handling fix
 
 logicvc:
 - A dt node reference leak fix
 
 nouveau:
 - A WARN_ON removal
 
 samsung-dsim:
 - A memory leak fix
 
 tiny:
 - sharp-memory: NULL pointer deref fix
 
 vmwgfx:
 - A reference count and error handling fix
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmmhNZoACgkQDHTzWXnE
 hr4F0hAAoc+Lbq0tePa+I6Pf6Yjq/ufzqBSWvEjN+5mXjBuY2oUytpGrGzqASczr
 03Q6zGVFzdXA5mJtRPxlhUVUn/SVbTGauTHs5wzZejiylw2+xngGAt81kIFab4km
 y2BLkOOCn96JhE/VqjrisydfwwXQD4TAbzpF12EZ4t+zyqmuEnuJ9TDTLcFDrOxn
 WfOY5neXtmntHavZ14IqghQNPUcj0x8KLC65BldNUfLdhnk5JwdsqdLwrID80fYW
 OBPGW1g1/4Ee4AKv+aKUB+1dm3fQGWh1K9C4Xh6g+OWIhn30Oo7BnTbu6N15GPN6
 rle+t5jnxkxhNcxEQNA8l1WJgexBJz4wKixwf7XwrF21OMom+QhS9hboCwhunQt6
 BTtw5HJubFXHRgEnTXiMeTLgW80TppDUjt5nEsy5CzP+5G8gqi1Xh3qMF0SjJHki
 Spxvt7Fh0qxHctzecOJi5aqVq2PiTeKNihI7OfZ5604OLlhbZE2WL556upJRLMz+
 u5CrdB3gCJ5aSNQyi3bP0Rg25jE8/mobdWJSgn3n2Z8v/XKdFX+s7cxyZiyTBEYu
 aQuQAfVOh5l1VT1ydQ0tki/sHyZ2cWDTukKHR7li8rJPC0kkZc28IE8T2YML8+A8
 1zgKhVHnTKoa/ngmTvmhBAfKaoLr+wgf646JGTllDw1z8hk5+3k=
 =/AzA
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-2026-02-27' of https://gitlab.freedesktop.org/drm/kernel

Pull drm fixes from Dave Airlie:
 "Regular fixes pull, amdxdna and amdgpu are the main ones, with a
  couple of intel fixes, then a scattering of fixes across drivers,
  nothing too major.

  i915/display:
   - Fix Panel Replay stuck with X during mode transitions on Panther
     Lake

  xe:
   - W/a fix for multi-cast registers
   - Fix xe_sync initialization issues

  amdgpu:
   - UserQ fixes
   - DC fix
   - RAS fixes
   - VCN 5 fix
   - Slot reset fix
   - Remove MES workaround that's no longer needed

  amdxdna:
   - deadlock fix
   - NULL ptr deref fix
   - suspend failure fix
   - OOB access fix
   - buffer overflow fix
   - input sanitiation fix
   - firmware loading fix

  dw-dp:
   - An error handling fix

  ethosu:
   - A binary shift overflow fix

  imx:
   - An error handling fix

  logicvc:
   - A dt node reference leak fix

  nouveau:
   - A WARN_ON removal

  samsung-dsim:
   - A memory leak fix

  tiny:
   - sharp-memory: NULL pointer deref fix

  vmwgfx:
   - A reference count and error handling fix"

* tag 'drm-fixes-2026-02-27' of https://gitlab.freedesktop.org/drm/kernel: (39 commits)
  drm/amd: Disable MES LR compute W/A
  drm/amdgpu: Fix error handling in slot reset
  drm/amdgpu/vcn5: Add SMU dpm interface type
  drm/amdgpu: Fix locking bugs in error paths
  drm/amdgpu: Unlock a mutex before destroying it
  drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink
  drm/amdgpu: add upper bound check on user inputs in wait ioctl
  drm/amdgpu: add upper bound check on user inputs in signal ioctl
  drm/amdgpu/userq: Do not allow userspace to trivially triger kernel warnings
  drm/amdgpu/userq: Fix reference leak in amdgpu_userq_wait_ioctl
  accel/amdxdna: Use a different name for latest firmware
  drm/client: Do not destroy NULL modes
  drm/gpusvm: Fix drm_gpusvm_pages_valid_unlocked() kernel-doc
  drm/xe/sync: Fix user fence leak on alloc failure
  drm/xe/sync: Cleanup partially initialized sync on parse failure
  drm/xe/wa: Steer RMW of MCR registers while building default LRC
  accel/amdxdna: Validate command buffer payload count
  accel/amdxdna: Prevent ubuf size overflow
  accel/amdxdna: Fix out-of-bounds memset in command slot handling
  accel/amdxdna: Fix command hang on suspended hardware context
  ...
2026-02-27 08:56:07 -08:00
Matt Roper
8ccf5f6b22 drm/xe/tuning: Apply windower hardware filtering setting on Xe3 and Xe3p
A recent bspec tuning guide update asks us to program
COMMON_SLICE_CHICKEN4[5] on Xe3 and Xe3p platforms.  Add this setting to
our LRC tuning RTP table so that the setting will become part of each
context's LRC.

Bspec: 72161, 55902
Reviewed-by: Shuicheng Lin <shuicheng.lin@intel.com>
Link: https://patch.msgid.link/20260224235055.3038710-2-matthew.d.roper@intel.com
Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
2026-02-27 08:54:21 -08:00
Bjorn Helgaas
39195990e4 PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value
fb82437fdd ("PCI: Change capability register offsets to hex") incorrectly
converted the PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value from decimal 52 to hex
0x32:

  -#define PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 52      /* v2 endpoints with link end here */
  +#define PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 0x32    /* end of v2 EPs w/ link */

This broke PCI capabilities in a VMM because subsequent ones weren't
DWORD-aligned.

Change PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 to the correct value of 0x34.

fb82437fdd was from Baruch Siach <baruch@tkos.co.il>, but this was not
Baruch's fault; it's a mistake I made when applying the patch.

Fixes: fb82437fdd ("PCI: Change capability register offsets to hex")
Reported-by: David Woodhouse <dwmw2@infradead.org>
Closes: https://lore.kernel.org/all/3ae392a0158e9d9ab09a1d42150429dd8ca42791.camel@infradead.org
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
2026-02-27 10:24:25 -06:00
Thorsten Blum
f505a45776 smb: client: Use snprintf in cifs_set_cifscreds
Replace unbounded sprintf() calls with the safer snprintf(). Avoid using
magic numbers and use strlen() to calculate the key descriptor buffer
size. Save the size in a local variable and reuse it for the bounded
snprintf() calls. Remove CIFSCREDS_DESC_SIZE.

Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Acked-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
2026-02-27 10:19:54 -06:00
Ravi Bangoria
e267b41781 perf/amd/ibs: Add new MSRs and CPUID bits definitions
IBS on upcoming microarch introduced two new control MSRs and couple of
new features. Define macros for them.

New capabilities:

 o IBS_CAPS_DIS: Alternate Fetch and Op IBS disable bits
 o IBS_CAPS_FETCHLAT: Fetch Latency filter
 o IBS_CAPS_BIT63_FILTER: Virtual address bit 63 based filters for Fetch
   and Op
 o IBS_CAPS_STRMST_RMTSOCKET: Streaming store filter and indicator,
   remote socket indicator

New control MSRs for above features:

 o MSR_AMD64_IBSFETCHCTL2
 o MSR_AMD64_IBSOPCTL2

Also do cosmetic alignment changes.

Signed-off-by: Ravi Bangoria <ravi.bangoria@amd.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Link: https://patch.msgid.link/20260216042530.1546-3-ravi.bangoria@amd.com
2026-02-27 16:40:24 +01:00
Ravi Bangoria
f9d55ccf01 perf/amd/ibs: Define macro for ldlat mask and shift
Load latency filter threshold is encoded in config1[11:0]. Define a mask
for it instead of hardcoded 0xFFF. Unlike "config" fields whose layout
maps to PERF_{FETCH|OP}_CTL MSR, layout of "config1" is custom defined
so a new set of macros are needed for "config1" fields.

Signed-off-by: Ravi Bangoria <ravi.bangoria@amd.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Link: https://patch.msgid.link/20260216042530.1546-2-ravi.bangoria@amd.com
2026-02-27 16:40:24 +01:00
Ravi Bangoria
1b044ff3c1 perf/amd/ibs: Avoid race between event add and NMI
Consider the following race:

  --------
  o OP_CTL contains stale value: OP_CTL[Val]=1, OP_CTL[En]=0
  o A new IBS OP event is being added
  o [P]: Process context, [N]: NMI context

  [P] perf_ibs_add(event) {
  [P]     if (test_and_set_bit(IBS_ENABLED, pcpu->state))
  [P]         return;
  [P]     /* pcpu->state = IBS_ENABLED */
  [P]
  [P]     pcpu->event = event;
  [P]
  [P]     perf_ibs_start(event) {
  [P]         set_bit(IBS_STARTED, pcpu->state);
  [P]         /* pcpu->state = IBS_ENABLED | IBS_STARTED */
  [P]         clear_bit(IBS_STOPPING, pcpu->state);
  [P]         /* pcpu->state = IBS_ENABLED | IBS_STARTED */

  [N] --> NMI due to genuine FETCH event. perf_ibs_handle_irq()
  [N]     called for OP PMU as well.
  [N]
  [N] perf_ibs_handle_irq(perf_ibs) {
  [N]     event = pcpu->event; /* See line 6 */
  [N]
  [N]     if (!test_bit(IBS_STARTED, pcpu->state)) /* false */
  [N]         return 0;
  [N]
  [N]     if (WARN_ON_ONCE(!event)) /* false */
  [N]         goto fail;
  [N]
  [N]     if (!(*buf++ & perf_ibs->valid_mask)) /* false due to stale
  [N]                                            * IBS_OP_CTL value */
  [N]         goto fail;
  [N]
  [N]         ...
  [N]
  [N]     perf_ibs_enable_event() // *Accidentally* enable the event.
  [N] }
  [N]
  [N] /*
  [N]  * Repeated NMIs may follow due to accidentally enabled IBS OP
  [N]  * event if the sample period is very low. It could also lead
  [N]  * to pcpu->state corruption if the event gets throttled due
  [N]  * to too frequent NMIs.
  [N]  */

  [P]         perf_ibs_enable_event();
  [P]     }
  [P] }
  --------

We cannot safely clear IBS_{FETCH|OP}_CTL while disabling the event,
because the register might be read again later. So, clear the register
in the enable path - before we update pcpu->state and enable the event.
This guarantees that any NMI that lands in the gap finds Val=0 and
bails out cleanly.

Signed-off-by: Ravi Bangoria <ravi.bangoria@amd.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Namhyung Kim <namhyung@kernel.org>
Link: https://patch.msgid.link/20260216042216.1440-6-ravi.bangoria@amd.com
2026-02-27 16:40:23 +01:00
Ravi Bangoria
b0a0914262 perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler
Calling perf_allow_kernel() from the NMI context is unsafe and could be
fatal. Capture the permission at event-initialization time by storing it
in event->hw.flags, and have the NMI handler rely on that cached flag
instead of making the call directly.

Fixes: 50a53b60e1 ("perf/amd/ibs: Prevent leaking sensitive data to userspace")
Reported-by: Sadasivan Shaiju <sadasivan.shaiju2@amd.com>
Signed-off-by: Ravi Bangoria <ravi.bangoria@amd.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Namhyung Kim <namhyung@kernel.org>
Link: https://patch.msgid.link/20260216042216.1440-5-ravi.bangoria@amd.com
2026-02-27 16:40:23 +01:00
Ravi Bangoria
723a290326 perf/amd/ibs: Preserve PhyAddrVal bit when clearing PhyAddr MSR
Commit 50a53b60e1 ("perf/amd/ibs: Prevent leaking sensitive data to
userspace") zeroed the physical address and also cleared the PhyAddrVal
flag before copying the value into a perf sample to avoid exposing
physical addresses to unprivileged users.

Clearing PhyAddrVal, however, has an unintended side-effect: several
other IBS fields are considered valid only when this bit is set. As a
result, those otherwise correct fields are discarded, reducing IBS
functionality.

Continue to zero the physical address, but keep the PhyAddrVal bit
intact so the related fields remain usable while still preventing any
address leak.

Fixes: 50a53b60e1 ("perf/amd/ibs: Prevent leaking sensitive data to userspace")
Signed-off-by: Ravi Bangoria <ravi.bangoria@amd.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Namhyung Kim <namhyung@kernel.org>
Link: https://patch.msgid.link/20260216042216.1440-4-ravi.bangoria@amd.com
2026-02-27 16:40:23 +01:00
Ravi Bangoria
898138efc9 perf/amd/ibs: Limit ldlat->l3missonly dependency to Zen5
The ldlat dependency on l3missonly is specific to Zen 5; newer generations
are not affected. This quirk is documented as an erratum in the following
Revision Guide.

  Erratum: 1606 IBS (Instruction Based Sampling) OP Load Latency Filtering
           May Capture Unwanted Samples When L3Miss Filtering is Disabled

  Revision Guide for AMD Family 1Ah Models 00h-0Fh Processors,
  Pub. 58251 Rev. 1.30 July 2025
  https://bugzilla.kernel.org/attachment.cgi?id=309193

Signed-off-by: Ravi Bangoria <ravi.bangoria@amd.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Namhyung Kim <namhyung@kernel.org>
Link: https://patch.msgid.link/20260216042216.1440-3-ravi.bangoria@amd.com
2026-02-27 16:40:22 +01:00
Ravi Bangoria
01336b5559 perf/amd/ibs: Account interrupt for discarded samples
Add interrupt throttling accounting for below cases:

  o IBS Op PMU: A software filter (in addition to the hardware filter)
    drops samples whose load latency is below the user-specified
    threshold.

  o IBS Fetch PMU: Samples discarded due to the zero-RIP erratum (#1197).

Although these samples are discarded, the NMI cost is still incurred, so
they should be counted for interrupt throttling.

Fixes: 26db2e0c51 ("perf/x86/amd/ibs: Work around erratum #1197")
Fixes: d20610c19b ("perf/amd/ibs: Add support for OP Load Latency Filtering")
Signed-off-by: Ravi Bangoria <ravi.bangoria@amd.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Namhyung Kim <namhyung@kernel.org>
Link: https://patch.msgid.link/20260216042216.1440-2-ravi.bangoria@amd.com
2026-02-27 16:40:22 +01:00
Namhyung Kim
da45c8d5f0 perf/core: Simplify __detach_global_ctx_data()
Like in the attach_global_ctx_data() it has a O(N^2) loop to delete task
context data for each thread.  But perf_free_ctx_data_rcu() can be
called under RCU read lock, so just calls it directly rather than
iterating the whole thread list again.

Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://patch.msgid.link/20260211223222.3119790-4-namhyung@kernel.org
2026-02-27 16:40:22 +01:00
Namhyung Kim
bec2ee2390 perf/core: Try to allocate task_ctx_data quickly
The attach_global_ctx_data() has O(N^2) algorithm to allocate the
context data for each thread.  This caused perfomance problems on large
systems with O(100k) threads.

Because kmalloc(GFP_KERNEL) can go sleep it cannot be called under the
RCU lock.  So let's try with GFP_NOWAIT first so that it can proceed in
normal cases.

Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://patch.msgid.link/20260211223222.3119790-3-namhyung@kernel.org
2026-02-27 16:40:21 +01:00
Namhyung Kim
28c75fbfec perf/core: Pass GFP flags to attach_task_ctx_data()
This is a preparation for the next change to reduce the computational
complexity in the global context data handling for LBR callstacks.

Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://patch.msgid.link/20260211223222.3119790-2-namhyung@kernel.org
2026-02-27 16:40:21 +01:00
Bart Van Assche
3dcef70e41 ww-mutex: Fix the ww_acquire_ctx function annotations
The ww_acquire_done() call is optional. Reflect this in the annotations of
ww_acquire_done().

Fixes: 47907461e4 ("locking/ww_mutex: Support Clang's context analysis")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Acked-by: Marco Elver <elver@google.com>
Link: https://patch.msgid.link/20260225183244.4035378-4-bvanassche@acm.org
2026-02-27 16:40:20 +01:00
Bart Van Assche
39be7b21af signal: Fix the lock_task_sighand() annotation
lock_task_sighand() may return NULL. Make this clear in its lock context
annotation.

Fixes: 04e49d926f ("sched: Enable context analysis for core.c and fair.c")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Marco Elver <elver@google.com>
Link: https://patch.msgid.link/20260225183244.4035378-3-bvanassche@acm.org
2026-02-27 16:40:19 +01:00
Bart Van Assche
38e18d825f locking: Fix rwlock and spinlock lock context annotations
Fix two incorrect rwlock_t lock context annotations. Add the raw_spinlock_t
lock context annotations that are missing.

Fixes: f16a802d40 ("locking/rwlock, spinlock: Support Clang's context analysis")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Marco Elver <elver@google.com>
Link: https://patch.msgid.link/20260225183244.4035378-2-bvanassche@acm.org
2026-02-27 16:40:19 +01:00
Peter Zijlstra
9213aa4784 sched: Default enable HRTICK when deferred rearming is enabled
The deferred rearm of the clock event device after an interrupt and and
other hrtimer optimizations allow now to enable HRTICK for generic entry
architectures.

This decouples preemption from CONFIG_HZ, leaving only the periodic
load-balancer and various accounting things relying on the tick.

Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://patch.msgid.link/20260224163431.937531564@kernel.org
2026-02-27 16:40:17 +01:00
Thomas Gleixner
343f2f4dc5 hrtimer: Try to modify timers in place
When modifying the expiry of a armed timer it is first dequeued, then the
expiry value is updated and then it is queued again.

This can be avoided when the new expiry value is within the range of the
previous and the next timer as that does not change the position in the RB
tree.

The linked timerqueue allows to peak ahead to the neighbours and check
whether the new expiry time is within the range of the previous and next
timer. If so just modify the timer in place and spare the enqueue and
requeue effort, which might end up rotating the RB tree twice for nothing.

This speeds up the handling of frequently rearmed hrtimers, like the hrtick
scheduler timer significantly.

Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://patch.msgid.link/20260224163431.873359816@kernel.org
2026-02-27 16:40:17 +01:00
Thomas Gleixner
b7418e6e9b hrtimer: Use linked timerqueue
To prepare for optimizing the rearming of enqueued timers, switch to the
linked timerqueue. That allows to check whether the new expiry time changes
the position of the timer in the RB tree or not, by checking the new expiry
time against the previous and the next timers expiry.

Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://patch.msgid.link/20260224163431.806643179@kernel.org
2026-02-27 16:40:16 +01:00
Thomas Gleixner
1339eeb73d timerqueue: Provide linked timerqueue
The hrtimer subsystem wants to peak ahead to the next and previous timer to
evaluated whether a to be rearmed timer can stay at the same position in
the RB tree with the new expiry time.

The linked RB tree provides the infrastructure for this as it maintains
links to the previous and next nodes for each entry in the tree.

Provide timerqueue wrappers around that.

Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://patch.msgid.link/20260224163431.734827095@kernel.org
2026-02-27 16:40:16 +01:00
Thomas Gleixner
671047943d rbtree: Provide rbtree with links
Some RB tree users require quick access to the next and the previous node,
e.g. to check whether a modification of the node results in a change of the
nodes position in the tree. If the node position does not change, then the
modification can happen in place without going through a full enqueue
requeue cycle. A upcoming use case for this are the timer queues of the
hrtimer subsystem as they can optimize for timers which are frequently
rearmed while enqueued.

This can be obviously achieved with rb_next() and rb_prev(), but those
turned out to be quite expensive for hotpath operations depending on the
tree depth.

Add a linked RB tree variant where add() and erase() maintain the links
between the nodes. Like the cached variant it provides a pointer to the
left most node in the root.

It intentionally does not use a [h]list head as there is no real need for
true list operations as the list is strictly coupled to the tree and
and cannot be manipulated independently.

It sets the nodes previous pointer to NULL for the left most node and the
next pointer to NULL for the right most node. This allows a quick check
especially for the left most node without consulting the list head address,
which creates better code.

Aside of the rb_leftmost cached pointer this could trivially provide a
rb_rightmost pointer as well, but there is no usage for that (yet).

Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://patch.msgid.link/20260224163431.668401024@kernel.org
2026-02-27 16:40:16 +01:00