Commit graph

1,461,726 commits

Author SHA1 Message Date
Len Bao
b12e12ee41 gpiolib: Mark gpio_devt, gpiolib_initialized and gpio_stub_drv as __ro_after_init
The 'gpio_devt' and 'gpiolib_initialized' variables are initialized only
during the init phase in the 'gpiolib_dev_init' function and never
changed. So, mark these as __ro_after_init.

The 'gpio_stub_drv' variable is initialized only in the declaration and
never changed. So, this variable could be 'const', but using the
'driver_register' and 'driver_unregister' functions discards the 'const'
qualifier. Therefore, as an alternative, mark it as a __ro_after_init.

Signed-off-by: Len Bao <len.bao@gmx.us>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20260516105737.45174-1-len.bao@gmx.us
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-05-26 10:35:24 +02:00
Jouni Högander
3549a9649d drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable
We are observing following warnings:

*ERROR* power well DC_off state mismatch (refcount 0/enabled 1)

gen9_dc_off_power_well_enabled is considering target state DC_STATE_DISABLE
as DC_OFF power well being enabled. Fix this by using wakeref for the
purpose.

To achieve this we need to modify notification code as well. Currently it
is possible that PSR gets notified vblank enable/disable twice on same
status. This is currently not a problem as it is just triggering call to
intel_display_power_set_target_dc_state with same target state as a
parameter. When using wakeref this becomes a problem due to reference
counting. Fix this storing vbank status on last notification and use that
to ensure there are no more than one notification with same vblank status.

v2: ensure there is no subsequent notifications with same status

Fixes: aa451abcff ("drm/i915/display: Prevent DC6 while vblank is enabled for Panel Replay")
Cc: <stable@vger.kernel.org> # v6.13+
Signed-off-by: Jouni Högander <jouni.hogander@intel.com>
Reviewed-by: Michał Grzelak <michal.grzelak@intel.com>
Link: https://patch.msgid.link/20260520104944.239797-2-jouni.hogander@intel.com
(cherry picked from commit 35485ac56d)
Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
2026-05-26 09:31:48 +01:00
Jouni Högander
8bb9093df5 drm/i915/psr: Block DC states on vblank enable when Panel Replay supported
Currently we are blocking DC states only when Panel Replay is enabled on
vblank enable. It may happen that Panel Replay is getting enabled when
vblank is already enabled. Fix this by blocking DC states always if Panel
Replay is supported.

While at it take care of possible dual eDP case by looping all encoders
supporting PSR.

Fixes: 0c427ac78a ("drm/i915/psr: Add interface to notify PSR of vblank enable/disable")
Cc: <stable@vger.kernel.org> # v6.16+
Signed-off-by: Jouni Högander <jouni.hogander@intel.com>
Reviewed-by: Michał Grzelak <michal.grzelak@intel.com>
Link: https://patch.msgid.link/20260520104944.239797-1-jouni.hogander@intel.com
(cherry picked from commit eb5911f990)
Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
2026-05-26 09:31:46 +01:00
Pranay Samala
d196136a98 drm/i915/color: Fix HDR pre-CSC LUT programming loop
The integer lut programming loop never executes completely due to
incorrect condition (i++ > 130).

Fix to properly program 129th+ entries for values > 1.0.

Cc: <stable@vger.kernel.org> #v6.19
Fixes: 82caa1c881 ("drm/i915/color: Program Pre-CSC registers")
Signed-off-by: Pranay Samala <pranay.samala@intel.com>
Signed-off-by: Chaitanya Kumar Borah <chaitanya.kumar.borah@intel.com>
Reviewed-by: Uma Shankar <uma.shankar@intel.com>
Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com>
Link: https://patch.msgid.link/20260519075308.383877-1-pranay.samala@intel.com
(cherry picked from commit f33862ec3e)
Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
2026-05-26 09:31:44 +01:00
Michał Grzelak
202e77cf2e drm/i915/aux: use polling when irqs are unavailable
PTL with physically disconnected display was observed to have 40s longer
execution time when testing xe_fault_injection@xe_guc_mmio_send_recv.
The issue has not been seen when reverting commit 40a9f77a28 ("Revert
"drm/i915/dp: change aux_ctl reg read to polling read"").

Apparently the configuration suffers from not having AUX enabled when
using interrupts. One probable cause can be xe enabling interrupts too
late: interrupts need memory allocations which currently can't be done
before the display FB takeover is done.

As for now, use polling for AUX in case interrupts are unavailable.

Fixes: 40a9f77a28 ("Revert "drm/i915/dp: change aux_ctl reg read to polling read"")
Suggested-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: Michał Grzelak <michal.grzelak@intel.com>
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patch.msgid.link/20260416163744.288107-1-michal.grzelak@intel.com
(cherry picked from commit 05e0550b65)
Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
2026-05-26 09:31:42 +01:00
Janusz Krzysztofik
5c4063c87a drm/i915: Fix potential UAF in TTM object purge
TLDR: The bo->ttm object might be changed by calling ttm_bo_validate(),
      move casting it to an i915_tt object later to actually get the right
      pointer.

A user reported hitting the following bug under heavy use on DG2:

[26620.095550] Oops: general protection fault, probably for non-canonical address 0xa56b6b6b6b6b6b8b: 0000 1 SMP NOPTI
[26620.095556] CPU: 2 UID: 0 PID: 631 Comm: Xorg Not tainted 6.18.8 #1 PREEMPT(lazy)
[26620.095558] Hardware name: ASRock B850M Steel Legend WiFi/B850M Steel Legend WiFi, BIOS 3.50 09/18/2025
[26620.095559] RIP: 0010:i915_ttm_purge+0x84/0x100 [i915]
[26620.095604] Code: 00 00 00 48 8d 54 24 10 48 89 e6 48 89 fb e8 83 aa ae ff 85 c0 75 6f 48 83 bb a8 01 00 00 00 74 2c 48 8b 45 78 48 85 c0 74 23 <48> 8b 78 20 48 c7 c2 ff ff ff ff 31 f6 e8 7a 73 e3 e0 48 8b 7d 78
[26620.095605] RSP: 0018:ffffc90005fd7430 EFLAGS: 00010282
[26620.095607] RAX: a56b6b6b6b6b6b6b RBX: ffff8881f46c3dc0 RCX: 0000000000000000
[26620.095608] RDX: 0000000000000000 RSI: 0000000000000246 RDI: 00000000ffffffff
[26620.095609] RBP: ffff888289610f00 R08: 0000000000000001 R09: ffff88823b022000
[26620.095609] R10: ffff888103029b28 R11: ffff8881fc7f3800 R12: ffff88810b6150d0
[26620.095609] R13: ffff888289610f00 R14: 0000000000000000 R15: ffff8881f46c3dc0
[26620.095610] FS: 00007f1004d86900(0000) GS:ffff88901c858000(0000) knlGS:0000000000000000
[26620.095611] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[26620.095611] CR2: 00007f0fdf489000 CR3: 000000035b0c1000 CR4: 0000000000750ef0
[26620.095612] PKRU: 55555554
[26620.095612] Call Trace:
[26620.095615] <TASK>
[26620.095615] i915_ttm_move+0x2b9/0x420 [i915]
[26620.095642] ? ttm_tt_init+0x65/0x80 [ttm]
[26620.095644] ? i915_ttm_tt_create+0xc6/0x150 [i915]
[26620.095667] ttm_bo_handle_move_mem+0xb6/0x160 [ttm]
[26620.095669] ttm_bo_evict+0x100/0x150 [ttm]
[26620.095671] ? preempt_count_add+0x64/0xa0
[26620.095673] ? _raw_spin_lock+0xe/0x30
[26620.095675] ? _raw_spin_unlock+0xd/0x30
[26620.095675] ? i915_gem_object_evictable+0xb7/0xd0 [i915]
[26620.095704] ttm_bo_evict_cb+0x6e/0xd0 [ttm]
[26620.095705] ttm_lru_walk_for_evict+0xa6/0x200 [ttm]
[26620.095708] ttm_bo_alloc_resource+0x185/0x4f0 [ttm]
[26620.095709] ? init_object+0x62/0xd0
[26620.095712] ttm_bo_validate+0x7a/0x180 [ttm]
[26620.095713] ? _raw_spin_unlock_irqrestore+0x16/0x30
[26620.095714] __i915_ttm_get_pages+0xb0/0x170 [i915]
[26620.095737] i915_ttm_get_pages+0x9f/0x150 [i915]
[26620.095759] ? i915_gem_do_execbuffer+0xedc/0x2b40 [i915]
[26620.095786] ? alloc_debug_processing+0xd0/0x100
[26620.095787] ? _raw_spin_unlock_irqrestore+0x16/0x30
[26620.095788] ? i915_vma_instance+0xa0/0x4e0 [i915]
[26620.095822] __i915_gem_object_get_pages+0x2f/0x40 [i915]
[26620.095848] i915_vma_pin_ww+0x706/0x980 [i915]
[26620.095875] ? i915_gem_do_execbuffer+0xedc/0x2b40 [i915]
[26620.095904] eb_validate_vmas+0x170/0xa00 [i915]
[26620.095930] i915_gem_do_execbuffer+0x1201/0x2b40 [i915]
[26620.095953] ? alloc_debug_processing+0xd0/0x100
[26620.095954] ? _raw_spin_unlock_irqrestore+0x16/0x30
[26620.095955] ? i915_gem_execbuffer2_ioctl+0xc9/0x240 [i915]
[26620.095977] ? __wake_up_sync_key+0x32/0x50
[26620.095979] ? i915_gem_execbuffer2_ioctl+0xc9/0x240 [i915]
[26620.096001] ? __slab_alloc.isra.0+0x67/0xc0
[26620.096003] i915_gem_execbuffer2_ioctl+0x11a/0x240 [i915]

Results from decode_stacktrace.sh pointed to dereference of a file pointer
field of a i915 TTM page vector container associated with an object being
purged on eviction.  That path is taken when the object is marked as no
longer needed.

Code analysis revealed a possibility of the i915 TTM page vector container
being replaced with a new instance inside a function that purges content
of the object, should it be still busy.  That function is called,
indirectly via a more general function that changes the object's placement
and caching policy, before the problematic dereference, but still after
a pointer to the container is captured, rendering the pointer no longer
valid.

Fix the issue by capturing the pointer to the container only after its
potential replacement.

v2: Move the container_of() inside the if block (Sebastian),
  - a simplified version of the commit description that explains briefly
    why the change is necessary (Christian).

Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/work_items/14882
Fixes: 7ae034590c ("drm/i915/ttm: add tt shmem backend")
Signed-off-by: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
Cc: stable@vger.kernel.org # v5.17+
Cc: Matthew Auld <matthew.auld@intel.com>
Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Cc: Sebastian Brzezinka <sebastian.brzezinka@intel.com>
Cc: Christian König <christian.koenig@amd.com>
Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Andi Shyti <andi.shyti@linux.intel.com>
Link: https://lore.kernel.org/r/20260508122612.469227-2-janusz.krzysztofik@linux.intel.com
(cherry picked from commit 4462966a93)
Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
2026-05-26 09:31:40 +01:00
Icenowy Zheng
e07761b936 drm: verisilicon: fix build failure of cursor plane code
The cursor plane patch was stalled for a too long time that the
struct drm_atomic_state parameter of atomic modeset hooks has been
changed to struct drm_atomic_commit.

Fix this by replacing the parameter's type. All helpers that retrieve
information from this struct are also changed so simply replacing the
type works.

Fixes: 8c4ae21891 ("drm: verisilicon: add support for cursor planes")
Signed-off-by: Icenowy Zheng <zhengxingda@iscas.ac.cn>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patch.msgid.link/20260525153618.1336239-1-zhengxingda@iscas.ac.cn
2026-05-26 16:05:53 +08:00
Alexander Stein
dac917ed5a gpio: mxc: fix irq_high handling
If port->irq_high is -1 (fsl,imx21-gpio compatible) and gpio_idx is >= 16
enable_irq_wake() is called with -1 which is wrong.

Fixes: 5f6d1998ad ("gpio: mxc: release the parent IRQ in runtime suspend")
Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260526063504.25916-1-alexander.stein@ew.tq-group.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-05-26 10:04:47 +02:00
Jun Yan
820017813b dt-bindings: gpio: meson-axg: Fix whitespace issue
Clean up whitespace misalignment in meson-axg-gpio.h

Signed-off-by: Jun Yan <jerrysteve1101@gmail.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patch.msgid.link/20260524154954.385778-1-jerrysteve1101@gmail.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-05-26 10:02:53 +02:00
Pratyush Yadav (Google)
8fd2f26fa2 kho: fix order calculation for kho_unpreserve_pages()
Commit 91e74fa8b1 ("kho: make sure preservations do not span multiple
NUMA nodes") made sure preservations from kho_preserve_pages() do not
span multiple NUMA nodes. If they do, the order is reduced and tried
again.

The same logic was not implemented for kho_unpreserve_pages(). This can
result in unpreserve calculating a different order than preserve, and
thus not actually unpreserving the pages.

Fix this by moving the order calculation logic to
__kho_preserve_pages_order() and use it from both preserve and
unpreserve paths.

Move __kho_unpreserve() down to avoid having a forward declaration. Its
users are further down in the file anyway. Also, it results in grouping
for all the page-level preservation and unpreservation functions. This
unfortunately makes the diff hard to read, but the main change in
__kho_unpreserve() is to call __kho_preserve_pages_order() instead of
open-coding the order calculation.

Fixes: 91e74fa8b1 ("kho: make sure preservations do not span multiple NUMA nodes")
Cc: stable@vger.kernel.org
Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org>
Reviewed-by: Samiullah Khawaja <skhawaja@google.com>
Reviewed-by: Pasha Tatashin <pasha.tatashin@soleen.com>
Link: https://patch.msgid.link/20260519133332.2498092-1-pratyush@kernel.org
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-05-26 11:01:49 +03:00
George Guo
d64b037276 kho: fix KHO_TREE_MAX_DEPTH for non-4KB page sizes
KHO_TREE_MAX_DEPTH is calculated as:

  DIV_ROUND_UP(KHO_ORDER_0_LOG2 - KHO_BITMAP_SIZE_LOG2,
               KHO_TABLE_SIZE_LOG2) + 1

For systems with 16KB pages (e.g. arm64 with CONFIG_ARM64_16K_PAGES=y or
LoongArch), this gives a depth of 4. Since levels are 0 based, with
depth = 4 the effective top level is 3 and the top-level shift at bit 39.

	PAGE_SHIFT = 14
	KHO_BITMAP_SIZE_LOG2 = PAGE_SHIFT + 3 = 17
	KHO_TABLE_SIZE_LOG2  = log(2; (1 << PAGE_SHIFT) / 8) = 11
	shift = ((3 - 1) * KHO_TABLE_SIZE_LOG2) + KHO_BITMAP_SIZE_LOG2 = 39

The order-0 bit sits at bit 50 (KHO_ORDER_0_LOG2 = 64 - PAGE_SHIFT =
50).  When inserting or reading a key, the index extracted at the top
level is:

	(1 << 50) >> 39 = 2048

2048 is exactly the table size (PAGE_SIZE / sizeof(phys_addr_t) = 2048
for 16KB pages), so it wraps to 0, aliasing the order bit to index 0
and losing it silently.

On the second kernel, kho_radix_decode_key() sees a key without the
order bit, calls fls64() on the wrong bit, computes a wrong order and
thus a garbage physical address. phys_to_page() of that address faults
in kho_preserved_memory_reserve(), causing a kernel panic early in boot.

Fix by adding +1 to the DIV_ROUND_UP numerator so the formula accounts
for the order bit itself, giving depth 5 for 16KB pages. The top-level
shift becomes 50, and (1 << 50) >> 50 = 1, which is nonzero and
unambiguous. For 4KB and 64KB page sizes the depth is unchanged.

Link: https://patch.msgid.link/20260509024415.33190-1-dongtai.guo@linux.dev
Fixes: 3f2ad90060 ("kho: adopt radix tree for preserved memory tracking")
Tested-by: Kexin Liu <liukexin@kylinos.cn>
Signed-off-by: George Guo <guodongtai@kylinos.cn>
Reviewed-by: Pasha Tatashin <pasha.tatashin@soleen.com>
[rppt: added actual math to the changelog]
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-05-26 11:01:48 +03:00
Alice Ryhl
4a44b17406 rust: kasan/kbuild: fix rustc-option when cross-compiling
The Makefile version of rustc-option currently checks whether the option
exists for the host target instead of the target actually being compiled
for. It was done this way in commit 46e24a545c ("rust: kasan/kbuild:
fix missing flags on first build") to avoid a circular dependency on
target.json. However, because of this, rustc-option currently does not
function when cross-compiling from x86_64 to aarch64 if
CONFIG_SHADOW_CALL_STACK is enabled. This is because KBUILD_RUSTFLAGS
contains -Zfixed-x18 under this configuration. Since that flag does not
exist on the host target, rustc-option runs into a compilation failure
every time, leading to all flags being rejected as unsupported.

To fix this, update rustc-option to pass a --target parameter so that
the host target is not used. For targets using target.json, use a
built-in target that is as close as possible to the target created with
target.json to avoid the circular dependency on target.json.

One scenario where this causes a boot failure:
* Cross-compiled from x86_64 to aarch64.
* With CONFIG_SHADOW_CALL_STACK=y
* With CONFIG_KASAN_SW_TAGS=y
* With CONFIG_KASAN_INLINE=n
Then the resulting kernel image will fail to boot when it first calls
into Rust code with a crash along the lines of "Unable to handle kernel
paging request at virtual address 0ffffffc08541796". This is because the
call threshold is not specified, so rustc will inline kasan operations,
but the kasan shadow offset is not specified, which leads to the inlined
kasan instructions being incorrect.

Note that the -Zsanitizer=kernel-hwaddress parameter itself does not
lead to a rustc-option failure despite being aarch64-specific because
RUSTFLAGS_KASAN has not yet been added to KBUILD_RUSTFLAGS when
rustc-option is evaluated by the kasan Makefile.

Cc: stable@vger.kernel.org
Fixes: 46e24a545c ("rust: kasan/kbuild: fix missing flags on first build")
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Link: https://patch.msgid.link/20260507-rustc-option-cross-v2-1-2f650a49c2b5@google.com
[ Edited slightly:
    - Reset variable to avoid using the environment.
    - Use a simply expanded variable flavor for simplicity.
    - Export variable so that behavior in sub-`make`s is consistent.

  This matches other variables. - Miguel ]
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-05-26 09:44:54 +02:00
Sven Schnelle
29eb8a7b6e s390/tracing: Add s390-tod clock
In order to allow comparing trace timestamps between different
systems or virtual machines on s390, add a s390-tod trace clock.
This clock just uses the returned TOD clock value from stcke
directly.

Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
2026-05-26 08:15:41 +02:00
Julian Braha
30cc5e2ad8 s390/Kconfig: Cleanup defaults for selftests
Remove unconditional 'n' defaults from def_tristate statements,
as they override the later 'KUNIT_ALL_TESTS' default, rendering
it dead Kconfig code.

This dead code was identified by kconfirm, a static analysis tool
for Kconfig.

Also include S390_KPROBES_SANITY_TEST in KUNIT_ALL_TESTS.

Signed-off-by: Julian Braha <julianbraha@gmail.com>
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
2026-05-26 08:15:40 +02:00
Heiko Carstens
cb3852f3e5 s390/zcore: Use octal permission
Replace symbolic permissions with octal permissions, which are preferred.

Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
2026-05-26 08:15:40 +02:00
Heiko Carstens
0a2aa995c0 s390/zcore: Removed unused variables
allmodconfig with clang W=1 points out unused global variables:

drivers/s390/char/zcore.c:49:23: error: variable
 'zcore_reipl_file' set but not used [-Werror,-Wunused-but-set-global]
drivers/s390/char/zcore.c:50:23: error: variable
 'zcore_hsa_file' set but not used [-Werror,-Wunused-but-set-global]

Remove both of them, since there is no point in keeping them.

Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
2026-05-26 08:15:40 +02:00
Heiko Carstens
a3211cad56 s390/sclp: Remove unused sclp_vt220_buffered_chars variable
allmodconfig with clang W=1 points out an unused global variable:

drivers/s390/char/sclp_vt220.c:85:12: error: variable
 'sclp_vt220_buffered_chars' set but not used [-Werror,-Wunused-but-set-global]

Just remove it.

Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
2026-05-26 08:15:40 +02:00
Heiko Carstens
3f90f58eb7 s390/debug: Remove s390dbf_sysctl_header variable
allmodconfig with clang W=1 points out an unused global variable:

arch/s390/kernel/debug.c:1237:33: error: variable
 's390dbf_sysctl_header' set but not used [-Werror,-Wunused-but-set-global]

Just remove the variable. There is no point in adding error handling for a
failing register_sysctl() call.

Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
2026-05-26 08:15:39 +02:00
Heiko Carstens
e648e004e4 s390/appldata: Remove unused appldata_sysctl_header variable
allmodconfig with clang W=1 points out an unused global variable:

arch/s390/appldata/appldata_base.c:54:33: error: variable
 'appldata_sysctl_header' set but not used [-Werror,-Wunused-but-set-global]

Just remove the variable. There is no point in adding error handling for a
failing register_sysctl() call.

Acked-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
2026-05-26 08:15:39 +02:00
Niklas Schnelle
539b7cf1f7 s390/configs: Enable IOMMUFD and VFIO cdev in defconfigs
Enable IOMMUFD and VFIO cdev such that PCI pass-through to QEMU/KVM can
optionally utilize native IOMMUFD. Note that because the defconfigs do
not enable IOMMUFD_VFIO_CONTAINER the default PCI pass-through using
VFIO with the existing container interface is not affected.

Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Acked-by: Heiko Carstens <hca@linux.ibm.com>
Acked-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
2026-05-26 08:05:44 +02:00
Dan Carpenter
44e151be23 accel/ivpu: prevent uninitialized data bug in debugfs
The simple_write_to_buffer() will only initialize data starting from
the *pos offset so if it's non-zero then the first part of the buffer
uninitialized.  Really, if *pos is non-zero then this code won't work
so just check for that at the start of the function.

Fixes: 320323d2e5 ("accel/ivpu: Add debugfs interface for setting HWS priority bands")
Signed-off-by: Dan Carpenter <error27@gmail.com>
Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com>
Signed-off-by: Karol Wachowski <karol.wachowski@linux.intel.com>
Link: https://patch.msgid.link/ahP24m6Mii9EDL7Q@stanley.mountain
2026-05-26 08:04:07 +02:00
Takashi Iwai
dd1bfaf941 Revert "ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware 2417"
This reverts commit db37cf47b6.

The fix was needed only for 7.1, while 7.2 devel branch already
received a better fix series (732a6397a526..a895279d060d), hence it's
superfluous.

Link: https://lore.kernel.org/ahUytAir51SvJjd7@m.b4.vu
Link: https://patch.msgid.link/20260526054923.210493-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-05-26 08:00:51 +02:00
Cássio Gabriel
3fcc84f1f8 ALSA: seq: Remove arbitrary prioq insertion limit
The sequencer priority queue insertion path uses a hardcoded traversal
limit of 10000 entries.  The value is intended to catch a corrupted list,
but it also becomes a real limit for valid queues.

The event pool limit is per client, while a sequencer queue can be shared
by multiple clients.  A queue can therefore legitimately contain more than
10000 events.  In that case, inserting an event that has to be placed past
the arbitrary limit fails with -EINVAL.

Use the queue's own cell count as the traversal bound instead.  This keeps
the protection against inconsistent list accounting or cyclic lists without
rejecting valid large queues.

Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
Link: https://patch.msgid.link/20260525-alsa-seq-prioq-limit-v1-1-16c348df5ff7@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-05-26 07:54:36 +02:00
Zhang Heng
20587302f8 ALSA: hda/realtek: Fix speaker output on ASUS ROG Strix G615LP
Add quirk for ALC294 codec on ASUS ROG Strix G615LP
(SSID 1043:1214) using ALC287_FIXUP_TXNW2781_I2C_ASUS to
fix speaker output.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=221173
Cc: <stable@vger.kernel.org>
Signed-off-by: Zhang Heng <zhangheng@kylinos.cn>
Link: https://patch.msgid.link/20260526013611.1954949-1-zhangheng@kylinos.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-05-26 07:52:09 +02:00
Manish Baing
5b5e33c44a dt-bindings: pwm: stmpe: Drop legacy binding
The st,stmpe-pwm binding is already covered by the MFD schema
Documentation/devicetree/bindings/mfd/st,stmpe.yaml. Remove the
obsolete and redundant text binding file.

Signed-off-by: Manish Baing <manishbaing2789@gmail.com>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Acked-by: Rob Herring (Arm) <robh@kernel.org>
Link: https://patch.msgid.link/20260523173251.72540-3-manishbaing2789@gmail.com
Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
2026-05-26 07:50:42 +02:00
Uwe Kleine-König (The Capable Hub)
ff558108c0 pwm: pca9685: Use named initializers for struct i2c_device_id
While being less compact, using named initializers allows to more easily
see which members of the structs are assigned which value without having
to lookup the declaration of the struct. And it's also more robust
against changes to the struct definition.

This patch doesn't modify the compiled arrays, only their representation
in source form benefits. The former was confirmed with x86 and arm64
builds.

Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Link: https://patch.msgid.link/20260518172323.932774-2-u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
2026-05-26 07:50:42 +02:00
Yixun Lan
74bca0f2d3 pwm: pxa: Add optional bus clock
Add one secondary optional bus clock for the PWM PXA driver, also keep it
compatible with old single clock.

The SpacemiT K3 SoC require a bus clock for PWM controller, acquire and
enable it during probe phase.

Signed-off-by: Yixun Lan <dlan@kernel.org>
Link: https://patch.msgid.link/20260428-03-k3-pwm-drv-v2-2-a532bbe45556@kernel.org
Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
2026-05-26 07:50:42 +02:00
Yixun Lan
e7abbff5e8 dt-bindings: pwm: marvell,pxa-pwm: Add SpacemiT K3 PWM support
The PWM controller in SpacemiT K3 SoC reuse the same IP as previous K1
generation, while the difference is that one additional bus clock is
added.

Signed-off-by: Yixun Lan <dlan@kernel.org>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Link: https://patch.msgid.link/20260428-03-k3-pwm-drv-v2-1-a532bbe45556@kernel.org
Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
2026-05-26 07:50:42 +02:00
Rosen Penev
3c8cec6dda pwm: ipq: Add missing module description
Add a MODULE_DESCRIPTION() entry to fix the modpost warning:

WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/pwm/pwm-ipq.o

Assisted-by: Codex:GPT-5.5
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Fixes: 728796fc4193 ("pwm: Driver for qualcomm ipq6018 pwm block")
Link: https://patch.msgid.link/20260509023609.1007698-1-rosenp@gmail.com
Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
2026-05-26 07:50:42 +02:00
Uwe Kleine-König
35ce15049e pwm: stm32: Make use of mul_u64_u64_div_u64_roundup()
When the driver was converted to the waveform API the need for this
function arised but at that time this function didn't exist yet. In the
meantime it's available, so switch to the global function and drop the
driver specific implementation.

Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
Link: https://patch.msgid.link/788319f0fff963feca4df3c5fcdd471dcf70ccdf.1776264104.git.u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
2026-05-26 07:50:42 +02:00
Uwe Kleine-König (The Capable Hub)
5ac9b13e3f pwm: Consistently define pci_device_ids using named initializers
The .driver_data member in the various struct pci_device_id arrays were
initialized by list expressions. This isn't easily readable if you're
not into PCI. Using named initializers is more explicit and thus easier
to parse.

The secret plan is to make struct pci_device_id::driver_data an
anonymous union (similar to
https://lore.kernel.org/all/cover.1776579304.git.u.kleine-koenig@baylibre.com/)
and that requires named initializers. But it's also a nice cleanup on
its own.

This change doesn't introduce changes to the compiled pci_device_id
arrays. Tested on x86 and arm64.

Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Link: https://patch.msgid.link/20260504085535.1914668-2-u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
2026-05-26 07:50:42 +02:00
Devi Priya
c436e3e9c2 pwm: Driver for qualcomm ipq6018 pwm block
Driver for the PWM block in Qualcomm IPQ6018 line of SoCs. Based on
driver from downstream Codeaurora kernel tree. Removed support for older
(V1) variants because I have no access to that hardware.

Tested on IPQ5018 and IPQ6010 based hardware.

Co-developed-by: Baruch Siach <baruch.siach@siklu.com>
Signed-off-by: Baruch Siach <baruch.siach@siklu.com>
Signed-off-by: Devi Priya <quic_devipriy@quicinc.com>
Reviewed-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: George Moussalem <george.moussalem@outlook.com>
Link: https://patch.msgid.link/20260406-ipq-pwm-v21-2-6ed1e868e4c2@outlook.com
[ukleinek: Fixed a few nitpicks as agreed on the mailing list]
Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
2026-05-26 07:50:42 +02:00
Yixun Lan
844c291973 riscv: dts: spacemit: k3: Add pwm support
Populate all pwm device tree nodes for SpacemiT K3 SoC, also documents
the pinctrl info which would easily help to enable them in future.

Link: https://patch.msgid.link/20260521-04-k3-pwm-dts-v4-1-04d4de0f2fc8@kernel.org
Signed-off-by: Yixun Lan <dlan@kernel.org>
2026-05-26 04:26:07 +00:00
Borislav Petkov (AMD)
80501dff81 Documentation/arch/x86: Hide clearcpuid=
This option was never meant to be used in production because it solely
clears the X86_FEATURE kernel-internal representation of what CPUID bits
it has detected and doesn't do any *proper* feature disablement like
clearing CR4.CET in the user shadow stack case, for example.

So remove its documentation so that it doesn't get used in production
and people get silly ideas. It is meant strictly for debugging; and if
a chicken bit for properly disabling a feature is warranted, then that
would need proper enablement.

No functional changes.

Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Cc: Mathias Krause <minipli@grsecurity.net>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Link: https://patch.msgid.link/20260520202508.160112-1-bp@kernel.org
2026-05-26 05:37:20 +02:00
Guo Ren (Alibaba DAMO Academy)
11a713db43 RISC-V: KVM: AIA: Make HGEI number management fully per-CPU
Previously, the number of Hypervisor Guest External Interrupt (HGEI)
lines was stored in a single global variable `kvm_riscv_aia_nr_hgei`
and assumed to be the same for all HARTs. This assumption does not
hold on heterogeneous RISC-V SoCs where different cores may expose
different HGEIE CSR widths.

Introduce `nr_hgei` field into the per-CPU `struct aia_hgei_control`
and probe the actual supported HGEI count for the current HART in
`kvm_riscv_aia_enable()` using the standard RISC-V CSR probe technique:

    csr_write(CSR_HGEIE, -1UL);
    nr = fls_long(csr_read(CSR_HGEIE));
    if (nr)
        nr--;

All HGEI allocation, free and disable paths (`kvm_riscv_aia_free_hgei()`,
`kvm_riscv_aia_disable()`, etc.) now use the per-CPU value instead of
the global one.

The global `kvm_riscv_aia_nr_hgei` now represents the minimum number
of HGEI lines across HARTs and can be used to check whether HGEI
support is available or not.

This makes KVM AIA robust on big.LITTLE-style asymmetric platforms.

Signed-off-by: Guo Ren (Alibaba DAMO Academy) <guoren@kernel.org>
Signed-off-by: Anup Patel <anup.patel@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260525094945.3721783-3-anup.patel@oss.qualcomm.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-05-26 09:05:10 +05:30
Guo Ren (Alibaba DAMO Academy)
59ebc16276 irqchip/riscv-imsic: Add nr_guest_files in per-HART local config
Add nr_guest_files in per-HART local config to represent the number of
guest files available on a particular HART whereas the nr_guest_files
in the global config represents the number of guest files available
across all HARTs.

This allows KVM RISC-V to use nr_guest_files from per-HART local
config for asymmetric big.Little systems.

Signed-off-by: Guo Ren (Alibaba DAMO Academy) <guoren@kernel.org>
Acked-by: Thomas Gleixner <tglx@kernel.org>
Signed-off-by: Anup Patel <anup.patel@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260525094945.3721783-2-anup.patel@oss.qualcomm.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-05-26 09:05:10 +05:30
Mayuresh Chitale
5eb6d68fe2 RISC-V: KVM: Fix ebreak self test failure
The ebreak self test enables/disables guest debugging as a part of the
test. However the KVM_SET_GUEST_DEBUG ioctl doesn't actually do it.
Fixing it by calling kvm_riscv_vcpu_config_guest_debug.

Fixes: 6ed523e2b6 ("RISC-V: KVM: Factor-out VCPU config into separate sources")
Signed-off-by: Mayuresh Chitale <mayuresh.chitale@oss.qualcomm.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260525095930.3924905-1-mayuresh.chitale@oss.qualcomm.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-05-26 09:04:22 +05:30
Adrian Ng Ho Yin
1e7f562058 clk: socfpga: agilex: implement l3_main_free_clk
The AGILEX_L3_MAIN_FREE_CLK is defined in the dt-bindings header but
was never implemented in the clock driver. Per the Agilex TRM,
l3_main_free_clk has no divider or mux and is a fixed 1:1 derivative
of noc_free_clk that clocks most of the interconnect datapath.

Signed-off-by: Adrian Ng Ho Yin <adrian.ho.yin.ng@altera.com>
Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
2026-05-25 21:46:56 -05:00
Dave Airlie
a97a23ce34 New feature and cleanup for Exynos fbdev
- Move fbdev emulation to DRM client buffers
   . Reuses standard ADDFB2/GEM paths and simplifies cleanup.
 - Use DRM format helpers for geometry and size
   . Applies 4CC-based format/pitch/size calculation with stronger checks and PAGE_SIZE alignment.
   . Sets screen_size and fix.smem_len from actual allocated size.
 
 Exynos DRM internal cleanup
 - Adopt DRM core DMA tracking and drop redundant code
   . Removes private DMA tracking, exynos_drm_gem_prime_import(), and obsolete iommu_dma_init_domain() stub.
 - Reduce duplication and tighten local scope
   . Replaces MAX_FB_BUFFER with DRM_FORMAT_MAX_PLANES.
   . Drops redundant exynos_drm_gem.size and internalizes local-only helpers.
 
 Bug fix for Exynos fbdev behavior
 - Fix screen_buffer offset handling
   . Keeps screen_buffer at framebuffer base and avoids applying scanout offset.
   . Includes Fixes and stable Cc for backporting.
 -----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEEoxi+6c5pRPV/gdXcxWAb7Og/+bYFAmoPFggACgkQxWAb7Og/
 +bbqFgv/SdNJlCKvpjgfOIDv39OTSWguFLJI9iAbeXMcAJUVMGC7oUQQdtKDVee+
 mzEombaTQpToKB3BPifIYJUM30tAJ+/hZ4VpDGBqZT/sdEbFmVWJ/fU4iKHnyT71
 TfJsczwR1xy5PEoiQk2cX40LoFXNu0r0eLV5OQo27P45aMsVKsXni3LvNQP67ItJ
 wpEswGAZnqk72eZEDdKdxAyU6kL95nhvvG81dxJXdHoO0xUh86vjp9oCB/0SQaM9
 qtfZAQyheXHzaVnWSdmHMz2uAaY5tflP2IrqSvebdGUuySreQ7AZTcw36MrWss2v
 YFvdQR+R6cJ/5iorGFXWkQzY5zpusZDVxnGdgRQaE1CNUeI4MqyCfDqCfRZvr1hU
 sn1HKzCcwL3PoE5bee/IwiiFhGCked+1cCOSyx9phzwns+iBt71jBP2z9MHLWgKS
 gge8Vs8643TGfGqdtBnJbCJdRjUKKz61pPKUEw4T+zN0XeEkMQS3L2lQ1K5zyB8W
 +Y2/q9vE
 =sUUs
 -----END PGP SIGNATURE-----

Merge tag 'exynos-drm-next-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-next

New feature and cleanup for Exynos fbdev
- Move fbdev emulation to DRM client buffers
  . Reuses standard ADDFB2/GEM paths and simplifies cleanup.
- Use DRM format helpers for geometry and size
  . Applies 4CC-based format/pitch/size calculation with stronger checks and PAGE_SIZE alignment.
  . Sets screen_size and fix.smem_len from actual allocated size.

Exynos DRM internal cleanup
- Adopt DRM core DMA tracking and drop redundant code
  . Removes private DMA tracking, exynos_drm_gem_prime_import(), and obsolete iommu_dma_init_domain() stub.
- Reduce duplication and tighten local scope
  . Replaces MAX_FB_BUFFER with DRM_FORMAT_MAX_PLANES.
  . Drops redundant exynos_drm_gem.size and internalizes local-only helpers.

Bug fix for Exynos fbdev behavior
- Fix screen_buffer offset handling
  . Keeps screen_buffer at framebuffer base and avoids applying scanout offset.
  . Includes Fixes and stable Cc for backporting.

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Inki Dae <inki.dae@samsung.com>
Link: https://patch.msgid.link/20260521143624.56906-1-inki.dae@samsung.com
2026-05-26 11:01:23 +10:00
Dave Airlie
f12f8a5780 Mediatek DRM Next - 20260521
1. hdmi: Convert DRM_ERROR() to drm_err()
 2. Simplify mtk_crtc allocation
 3. mtk_dpi: Open-code drm_simple_encoder_init()
 4. Convert legacy DRM logging to drm_* helpers in mtk_dsi.c
 5. dsi: Add compatible for mt8167-dsi
 -----BEGIN PGP SIGNATURE-----
 
 iQJMBAABCgA2FiEEACwLKSDmq+9RDv5P4cpzo8lZTiQFAmoPD/kYHGNodW5rdWFu
 Zy5odUBrZXJuZWwub3JnAAoJEOHKc6PJWU4ksD0P/iyXICh0ilWG3Z2GVxFgCWqf
 rpWvC2t9WI+EUJzV7Ggxou9qF0gkUB7TvRZpHCo9E09EhQ/JB58h+ChDmfao0QBX
 XwxF+SLxWPoSnNYodrMt3tLroOVn6KTPnUzr6MUITZPlfbQkErKQAjMe2VXflV7f
 8jcwO9B0/aK9ntfeOvdAu1pUyS3gBTjSF07xzTKrlCRcYqmJ3NmqtQZORIoClhDT
 CSW50dn47cEpHrUiUkH/544aNad6ZW4u12LRW6dKo9BO8yUvM+5nii+9TpdivmvF
 4P+L0Cy18V2IHcXdWdHx3uHyIkYY/TIC7igYKTbe2GJXFJKx/8GtlZRRSDq8wKll
 kwMbUf2x6Vljrzepi+AV8gsQ0d0IJv3yAlDGo1xLVeZR4BLCbToEY9gTBScQoA3p
 fFAPV8D4K8XRg+3tqLCTUrUKuDHNsMzP/eVj0S1ely2bdJ92UhLbk8k0C6+h0qG7
 vbI5E6vOnJqYXoBc2OlfBFonopJmBfWF/rxtWiVrcVKC9OfjLyuPDMNiqjvn4353
 5LNecCG/+xcCP020YajpI7PIAWr/wHk9uA42bM4pp9BGCws/LsO1yU4k0YjMnqkC
 MsDsHduSADk0rk/LutT3aC9qawSwY2iXtkH2S6sYMcjj31WNNjGn1YE5o3HS971z
 CLbOtDjkNV1oLtJAe4XJ
 =QRD1
 -----END PGP SIGNATURE-----

Merge tag 'mediatek-drm-next-20260521' of https://git.kernel.org/pub/scm/linux/kernel/git/chunkuang.hu/linux into drm-next

Mediatek DRM Next - 20260521

1. hdmi: Convert DRM_ERROR() to drm_err()
2. Simplify mtk_crtc allocation
3. mtk_dpi: Open-code drm_simple_encoder_init()
4. Convert legacy DRM logging to drm_* helpers in mtk_dsi.c
5. dsi: Add compatible for mt8167-dsi

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Chun-Kuang Hu <chunkuang.hu@kernel.org>
Link: https://patch.msgid.link/20260521140841.5103-1-chunkuang.hu@kernel.org
2026-05-26 10:46:58 +10:00
Dave Airlie
57b5fd7cb2 Driver Changes:
- drm/xe/oa: Fix exec_queue leak on width check in stream open (Shuicheng Lin)
 - drm/xe/memirq: Drop cached iosys_map for MEMIRQ status (Michal Wajdeczko)
 - drm/xe/memirq: Drop cached iosys_map for MEMIRQ mask (Michal Wajdeczko)
 - drm/xe/memirq: Dump all source pages if MSI-X (Michal Wajdeczko)
 - drm/xe/memirq: Update diagnostic message (Michal Wajdeczko)
 - drm/xe/memirq: Reduce buffer size (Michal Wajdeczko)
 - drm/xe/memirq: Use IRQ page from HW engine definition (Michal Wajdeczko)
 - drm/xe/memirq: Update GuC initialization and IRQ handler (Michal Wajdeczko)
 - drm/xe/memirq: Make page layout macros private (Michal Wajdeczko)
 - drm/xe: Add IRQ page to HW engine definition (Michal Wajdeczko)
 - drm/xe/guc: Use xe_device_is_l2_flush_optimized() (Gustavo Sousa)
 - drm/xe/multi_queue: Fix secondary queue error case (Niranjana Vishwanathapura)
 - drm/xe/reg_sr: Do sanity check for MCR vs non-MCR (Gustavo Sousa)
 - drm/xe/mcr: Extract reg_in_steering_type_ranges() (Gustavo Sousa)
 - drm/xe/kunit: Use KUNIT_EXPECT_EQ() in xe_wa_gt() (Gustavo Sousa)
 - drm/xe: Extract xe_hw_engine_setup_reg_lrc() (Gustavo Sousa)
 - drm/xe: Define and use MCR version of COMMON_SLICE_CHICKEN4 (Gustavo Sousa)
 - drm/xe: Define and use MCR version of COMMON_SLICE_CHICKEN1 (Gustavo Sousa)
 - drm/xe: Define CACHE_MODE_1 as MCR register (Gustavo Sousa)
 - drm/xe/pf: Fix CFI failure in debugfs access (Mohanram Meenakshisundaram)
 - drm/xe/vf: Fix signature of print functions (Michal Wajdeczko)
 - drm/xe: Make drm_driver const (Michal Wajdeczko)
 - drm/xe/display: Drop xe_display_driver_set_hooks() (Michal Wajdeczko)
 - drm/xe/display: Add macro with display driver features (Michal Wajdeczko)
 - drm/xe/display: Add macro with display driver ops (Michal Wajdeczko)
 - drm/xe/display: Prefer forward declarations (Michal Wajdeczko)
 - drm/xe/display: Drop xe_display_driver_remove() stub (Michal Wajdeczko)
 - drm/xe: Drop unused drm/drm_atomic_helper.h include (Michal Wajdeczko)
 - drm/xe/sriov: Mark NVL as SR-IOV capable (Jakub Kolakowski)
 - drm/xe/gt_idle: Use NSEC_PER_MSEC instead of float literal (Shuicheng Lin)
 - drm/xe/gsc: Fix double-free of managed BO in error path (Shuicheng Lin)
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRskUM7w1oG5rx2IZO4FpNVCsYGvwUCag9PtAAKCRC4FpNVCsYG
 v6jqAQDZuKtO+Zihz29VR9xD2xqm1C0AoC5IrT1Q4yxl5HXAUwD+LnHLl4dhvHuV
 zQ+NjGWmaWV3fdOKcZGowUdlR3/j9go=
 =bUe0
 -----END PGP SIGNATURE-----

Merge tag 'drm-xe-next-2026-05-21' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next

Driver Changes:
- drm/xe/oa: Fix exec_queue leak on width check in stream open (Shuicheng Lin)
- drm/xe/memirq: Drop cached iosys_map for MEMIRQ status (Michal Wajdeczko)
- drm/xe/memirq: Drop cached iosys_map for MEMIRQ mask (Michal Wajdeczko)
- drm/xe/memirq: Dump all source pages if MSI-X (Michal Wajdeczko)
- drm/xe/memirq: Update diagnostic message (Michal Wajdeczko)
- drm/xe/memirq: Reduce buffer size (Michal Wajdeczko)
- drm/xe/memirq: Use IRQ page from HW engine definition (Michal Wajdeczko)
- drm/xe/memirq: Update GuC initialization and IRQ handler (Michal Wajdeczko)
- drm/xe/memirq: Make page layout macros private (Michal Wajdeczko)
- drm/xe: Add IRQ page to HW engine definition (Michal Wajdeczko)
- drm/xe/guc: Use xe_device_is_l2_flush_optimized() (Gustavo Sousa)
- drm/xe/multi_queue: Fix secondary queue error case (Niranjana Vishwanathapura)
- drm/xe/reg_sr: Do sanity check for MCR vs non-MCR (Gustavo Sousa)
- drm/xe/mcr: Extract reg_in_steering_type_ranges() (Gustavo Sousa)
- drm/xe/kunit: Use KUNIT_EXPECT_EQ() in xe_wa_gt() (Gustavo Sousa)
- drm/xe: Extract xe_hw_engine_setup_reg_lrc() (Gustavo Sousa)
- drm/xe: Define and use MCR version of COMMON_SLICE_CHICKEN4 (Gustavo Sousa)
- drm/xe: Define and use MCR version of COMMON_SLICE_CHICKEN1 (Gustavo Sousa)
- drm/xe: Define CACHE_MODE_1 as MCR register (Gustavo Sousa)
- drm/xe/pf: Fix CFI failure in debugfs access (Mohanram Meenakshisundaram)
- drm/xe/vf: Fix signature of print functions (Michal Wajdeczko)
- drm/xe: Make drm_driver const (Michal Wajdeczko)
- drm/xe/display: Drop xe_display_driver_set_hooks() (Michal Wajdeczko)
- drm/xe/display: Add macro with display driver features (Michal Wajdeczko)
- drm/xe/display: Add macro with display driver ops (Michal Wajdeczko)
- drm/xe/display: Prefer forward declarations (Michal Wajdeczko)
- drm/xe/display: Drop xe_display_driver_remove() stub (Michal Wajdeczko)
- drm/xe: Drop unused drm/drm_atomic_helper.h include (Michal Wajdeczko)
- drm/xe/sriov: Mark NVL as SR-IOV capable (Jakub Kolakowski)
- drm/xe/gt_idle: Use NSEC_PER_MSEC instead of float literal (Shuicheng Lin)
- drm/xe/gsc: Fix double-free of managed BO in error path (Shuicheng Lin)

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Thomas Hellstrom <thomas.hellstrom@linux.intel.com>
Link: https://patch.msgid.link/ag9RLujZiYYnSc_F@fedora
2026-05-26 09:11:14 +10:00
Luka Gejak
f229426072 net: hsr: fix potential OOB access in supervision frame handling
Ensure the entire TLV header is linearized before access by adding
sizeof(struct hsr_sup_tlv) to the pskb_may_pull() calls. Without this,
a truncated frame could cause an out-of-bounds access.

Fixes: eafaa88b3e ("net: hsr: Add support for redbox supervision frames")
Signed-off-by: Luka Gejak <luka.gejak@linux.dev>
Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>
Link: https://patch.msgid.link/20260523130330.61880-1-luka.gejak@linux.dev
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-25 14:18:15 -07:00
Len Bao
3baa7ba4ab eth: dpaa2: constify dpaa2_ethtool_stats and dpaa2_ethtool_extras
The 'dpaa2_ethtool_stats' and 'dpaa2_ethtool_extras' structures are
initialized in their declarations and never changed. So, constify them
to reduce the attack surface.

Before the patch (size dpaa2-ethtool.o):

   text	   data	    bss	    dec	    hex
  33433	   5992	      0	  39425	   9a01

After the patch (size dpaa2-ethtool.o):

   text	   data	    bss	    dec	    hex
  34937	   4488	      0	  39425	   9a01

Signed-off-by: Len Bao <len.bao@gmx.us>
Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com>
Link: https://patch.msgid.link/20260523150737.36988-1-len.bao@gmx.us
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-25 14:17:40 -07:00
Rosen Penev
da91508bdd net: ibm: emac: Use napi_gro_receive() for Rx packets
emac_poll_rx() already runs in NAPI context and TAH-equipped EMACs set
CHECKSUM_UNNECESSARY on verified frames, which lets GRO coalesce TCP
segments without a software checksum on the merge path. Replace the
per-poll rx_list batched with netif_receive_skb_list() with direct
napi_gro_receive() calls so the stack can merge segments into super-skbs
and skip a full traversal per packet -- a meaningful win on the slow
4xx-class CPUs this driver targets.

Small routing speed improvement tested on a Cisco Meraki MX60W:

Tested with iperf3

Before:

[ ID] Interval           Transfer     Bitrate         Retr
[  5]   0.00-10.00  sec   494 MBytes   414 Mbits/sec  839             sender
[  5]   0.00-10.04  sec   492 MBytes   411 Mbits/sec                  receiver

After:

[ ID] Interval           Transfer     Bitrate         Retr
[  5]   0.00-10.00  sec   510 MBytes   428 Mbits/sec  580             sender
[  5]   0.00-10.04  sec   508 MBytes   424 Mbits/sec                  receiver

Traffic to and from the router seems to be slow no matter what:

Tested with iperf3 --bidir

Before:

[ ID][Role] Interval           Transfer     Bitrate         Retr
[  8][TX-C]   0.00-10.00  sec   297 MBytes   249 Mbits/sec   35            sender
[  8][TX-C]   0.00-10.00  sec   293 MBytes   245 Mbits/sec                  receiver
[ 10][RX-C]   0.00-10.00  sec   184 MBytes   154 Mbits/sec    0            sender
[ 10][RX-C]   0.00-10.00  sec   184 MBytes   154 Mbits/sec                  receiver

After:

[ ID][Role] Interval           Transfer     Bitrate         Retr
[  8][TX-C]   0.00-10.00  sec   295 MBytes   248 Mbits/sec   31            sender
[  8][TX-C]   0.00-10.00  sec   294 MBytes   246 Mbits/sec                  receiver
[ 10][RX-C]   0.00-10.00  sec   181 MBytes   152 Mbits/sec    0            sender
[ 10][RX-C]   0.00-10.00  sec   181 MBytes   152 Mbits/sec                  receiver

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://patch.msgid.link/20260521215908.257118-1-rosenp@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-25 14:12:01 -07:00
Jakub Kicinski
0e235b1055 Merge branch 'octeontx2-af-npc-enhancements'
Ratheesh Kannoth says:

====================
octeontx2-af: npc: Enhancements. [part]

Patch 1 reduces stack usage in mlx5e_pcie_cong_get_thresh_config()
by reusing a single union devlink_param_value across four
devl_param_driverinit_value_get() calls (instead of
union devlink_param_value val[4] on the stack) and assigning each
vu16 into mlx5e_pcie_cong_thresh, so the helper stays under the
frame-size warning limit as the union grows.

Patch 2 changes devlink_nl_param_value_put() and
devlink_nl_param_value_fill_one() to pass union devlink_param_value
by pointer instead of by value. Passing two copies of the union
by value in the param netlink path consumes over 500 bytes of argument
stack and risks CONFIG_FRAME_WARN as the union grows beyond its
historical size.
====================

Picking a couple of uncontroversial changes from the series
since it's making very slow progress.

Link: https://patch.msgid.link/20260521095303.2395584-1-rkannoth@marvell.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-25 14:04:28 -07:00
Ratheesh Kannoth
d603517771 devlink: pass param values by pointer
union devlink_param_value grows substantially once U64 array
parameters are added to devlink (from 32 bytes to over 264 bytes).
devlink_nl_param_value_fill_one() and devlink_nl_param_value_put()
copy the union by value in several places. Passing two instances as
value arguments alone consumes over 528 bytes of stack; combined with
deeper call chains the parameter stack can approach 800 bytes and trip
CONFIG_FRAME_WARN more easily.

Switch internal helpers and exported driver APIs to pass pointers to
union devlink_param_value rather than passing the union by value.

Reviewed-by: Petr Machata <petrm@nvidia.com> # for mlxsw
Acked-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Reviewed-by: Arthur Kiyanovski <akiyano@amazon.com> #for ena
Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com>
Link: https://patch.msgid.link/20260521095303.2395584-4-rkannoth@marvell.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-25 14:03:06 -07:00
Ratheesh Kannoth
e57516529a net/mlx5e: Reduce stack use reading PCIe congestion thresholds
union devlink_param_value grew when U64 array parameters were added.
Keeping union devlink_param_value val[4] in
mlx5e_pcie_cong_get_thresh_config() exceeded the compiler's
-Wframe-larger-than limit.

Reuse one union: call devl_param_driverinit_value_get() once per
MLX5 PCIe congestion threshold and assign each vu16 to the
corresponding mlx5e_pcie_cong_thresh member.

Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com>
Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com>
Link: https://patch.msgid.link/20260521095303.2395584-3-rkannoth@marvell.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-25 14:03:06 -07:00
Dave Airlie
40149d887c Merge tag 'drm-misc-next-2026-05-21' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next
drm-misc-next for v7.2-rc1:

UAPI Changes:
- Add VIRTIO_GPU_F_BLOB_ALIGNMENT flag.

Cross-subsystem Changes:
- Add common TMDS character rate constants to video/hdmi and use those
  in bridge drivers.

Core Changes:
- Fix leak in drm_syncobj_find_fence.
- Fix OOB reads related to DP-MST.
- Create drm_get_bridge_by_endpoint and convert drivers to use it in
  preparation of hotplug.

Driver Changes:
- Assorted bugfixes and cleanups to accel/ethosu, imagination, virtio,
  rockchip.
- Expandable device heap support to amdxdna, bridge/chipone-icn6211.
- Add Surface Pro 12 panels.
- Convert ite-it6211 to use drm hdmi audio helpers.

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Link: https://patch.msgid.link/f4034e3c-8290-49e1-9410-dc1f449265f4@linux.intel.com
2026-05-26 06:51:31 +10:00
Jakub Kicinski
bfea46abf6 Merge branch 'net-mlx5-add-satellite-pf-support'
Tariq Toukan says:

====================
net/mlx5: Add satellite PF support

A satellite PF is a new SmartNIC configuration that adds another
physical function on the DPU that is not an eswitch manager and not a
page manager. The satellite PF can have its own SFs and can be passed
through to a VM on the DPU, providing an isolated function for users who
should not have access to the privileged ECPF. The ECPF handles the
satellite PF and the host PF in a similar way, using the same management
framework.

This series adds support for satellite PFs (SPFs) in the mlx5 eswitch.
SPFs are discovered through the v1 response layout of the
query_esw_functions command, introduced in the previous infrastructure
preparation series.

The first four patches discover satellite PFs, allocate eswitch vports
for them and their SFs, and extend the SF hardware table to manage SPF
SF entries.

The next five patches expose PF numbers from firmware, map SF
controllers to their pfnum, register devlink ports with proper
attributes, and register SF resource on satellite PF ports.

The final four patches add devlink port state management, FDB peer miss
rules, dedicated page accounting, and SF resource registration for
satellite PF vports.

This series builds on the eswitch infrastructure preparation series
previously submitted.
====================

Link: https://patch.msgid.link/20260521110843.367329-1-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-25 13:48:52 -07:00
Moshe Shemesh
ea0dada719 net/mlx5: Add SPF function type for page management
Add MLX5_SPF to enum mlx5_func_type so SPFs get their own page counter,
and add the corresponding WARN check at page cleanup. Wait for SPF pages
to be reclaimed during ECPF teardown, alongside the existing host PF and
VF page waits.

SPF page requests are always identified by vhca_id, so the legacy
func_id_to_type() path is not reached for satellite PFs.

Signed-off-by: Moshe Shemesh <moshe@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/20260521110843.367329-13-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-25 13:48:51 -07:00