Commit graph

1,412,004 commits

Author SHA1 Message Date
Salah Triki
086e410063 staging: iio: adc: ad7816: Drop unnecessary dev_set_drvdata() call
Remove the call to `dev_set_drvdata()` and the associated comment
since private data is never read.

Signed-off-by: Salah Triki <salah.triki@gmail.com>
Reviewed-by: David Lechner <dlechner@baylibre.com>
Link: https://patch.msgid.link/aKSRpTuwA0P-ZaUS@pc
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2025-08-25 09:24:19 +01:00
Dan Carpenter
d20a8a8ecd iio: proximity: vl53l0x-i2c: Fix error code in probe()
Commit 65e8202f03 ("iio: Remove error prints for
devm_add_action_or_reset()") accidentally introduced a bug where we
returned "ret" but the error code was stored in "error" if
devm_add_action_or_reset() failed.  Using two variables to store error
codes is unnecessary and confusing.  Delete the "error" variable and use
"ret" everywhere instead.

Fixes: 65e8202f03 ("iio: Remove error prints for devm_add_action_or_reset()")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Andy Shevchenko <andy@kernel.org>
Link: https://patch.msgid.link/aKSSHTdJf5QoYiRx@stanley.mountain
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2025-08-25 09:24:19 +01:00
Thomas Hellström
358ee50ab5 drm/xe/vm: Clear the scratch_pt pointer on error
Avoid triggering a dereference of an error pointer on cleanup in
xe_vm_free_scratch() by clearing any scratch_pt error pointer.

Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Fixes: 06951c2ee7 ("drm/xe: Use NULL PTEs as scratch PTEs")
Cc: Brian Welty <brian.welty@intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Cc: Lucas De Marchi <lucas.demarchi@intel.com>
Cc: <stable@vger.kernel.org> # v6.8+
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Link: https://lore.kernel.org/r/20250821143045.106005-4-thomas.hellstrom@linux.intel.com
2025-08-25 10:24:13 +02:00
Thomas Hellström
b5dd1505a3 drm/xe/tests/xe_dma_buf: Set the drm_object::dma_buf member
This member is set when exporting using prime. However
the xe_gem_prime_export() alone doesn't set it, since it's done
later in the prime export flow.
For the test, set it manually and remove the hack that set it
temporarily when it was really needed.

Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Link: https://lore.kernel.org/r/20250821143045.106005-3-thomas.hellstrom@linux.intel.com
2025-08-25 10:23:55 +02:00
Thomas Hellström
0a51bf3e54 drm/xe/vm: Don't pin the vm_resv during validation
The pinning has the odd side-effect that unlocking *any* resv
during validation triggers an "unlocking pinned lock" warning.

Cc: Matthew Brost <matthew.brost@intel.com>
Fixes: 9d5558649f ("drm/xe: Rework eviction rejection of bound external bos")
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Link: https://lore.kernel.org/r/20250821143045.106005-2-thomas.hellstrom@linux.intel.com
2025-08-25 10:23:42 +02:00
Greg Kroah-Hartman
5b9057cfaf Merge 6.17-rc3 into char-misc-next
We need the char/misc/iio fixes in here as well to build on.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-08-25 09:20:17 +02:00
Greg Kroah-Hartman
b71763a0a3 Merge 6.17-rc3 into driver-core-next
We need the driver core and rust fixes in here as well to build on top
of.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-08-25 09:18:23 +02:00
Greg Kroah-Hartman
3474a19736 Merge 6.17-rc3 into usb-next
We need the USB fixes in here as well.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-08-25 09:16:46 +02:00
Jouni Högander
9cc10041e9 drm/i915/psr: Check drm_dp_dpcd_read return value on PSR dpcd init
Currently we are ignoriong drm_dp_dpcd_read return values when reading PSR
and Panel Replay capability DPCD register. Rework intel_psr_dpcd a bit to
take care of checking the return value.

v2: use drm_dp_dpcd_read_data

Signed-off-by: Jouni Högander <jouni.hogander@intel.com>
Reviewed-by: Jani Nikula <jani.nikula@intel.com>
Link: https://lore.kernel.org/r/20250821045918.17757-1-jouni.hogander@intel.com
2025-08-25 09:12:46 +03:00
Zbigniew Kempczyński
8ae04fe9ff drm/xe/xe_sync: avoid race during ufence signaling
Marking ufence as signalled after copy_to_user() is too late.
Worker thread which signals ufence by memory write might be raced
with another userspace vm-bind call. In map/unmap scenario unmap
may still see ufence is not signalled causing -EBUSY. Change the
order of marking / write to user-fence fixes this issue.

Fixes: 977e5b82e0 ("drm/xe: Expose user fence from xe_sync_entry")
Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/5536
Signed-off-by: Zbigniew Kempczyński <zbigniew.kempczynski@intel.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Matthew Auld <matthew.auld@intel.com>
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Signed-off-by: Matthew Brost <matthew.brost@intel.com>
Link: https://lore.kernel.org/r/20250820083903.2109891-2-zbigniew.kempczynski@intel.com
2025-08-24 22:15:25 -07:00
Radim Krčmář
799766208f RISC-V: KVM: fix stack overrun when loading vlenb
The userspace load can put up to 2048 bits into an xlen bit stack
buffer.  We want only xlen bits, so check the size beforehand.

Fixes: 2fa290372d ("RISC-V: KVM: add 'vlenb' Vector CSR")
Cc: stable@vger.kernel.org
Signed-off-by: Radim Krčmář <rkrcmar@ventanamicro.com>
Reviewed-by: Nutty Liu <liujingqi@lanxincomputing.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Link: https://lore.kernel.org/r/20250805104418.196023-4-rkrcmar@ventanamicro.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2025-08-25 10:26:20 +05:30
Quan Zhou
e61a12a4ba RISC-V: KVM: Correct kvm_riscv_check_vcpu_requests() comment
Correct `check_vcpu_requests` to `kvm_riscv_check_vcpu_requests` in
comments.

Fixes: f55ffaf896 ("RISC-V: KVM: Enable ring-based dirty memory tracking")
Signed-off-by: Quan Zhou <zhouquan@iscas.ac.cn>
Reviewed-by: Nutty Liu <nutty.liu@hotmail.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Link: https://lore.kernel.org/r/49680363098c45516ec4b305283d662d26fa9386.1754326285.git.zhouquan@iscas.ac.cn
Signed-off-by: Anup Patel <anup@brainfault.org>
2025-08-25 10:26:17 +05:30
Fangyu Yu
9bca8be646 RISC-V: KVM: Fix pte settings within kvm_riscv_gstage_ioremap()
Currently, kvm_riscv_gstage_ioremap() is used to map IMSIC gpa to the
spa of IMSIC guest interrupt file.

The PAGE_KERNEL_IO property includes global setting whereas it does not
include user mode settings, so when accessing the IMSIC address in the
virtual machine, a guest page fault will occur, this is not expected.

According to the RISC-V Privileged Architecture Spec, for G-stage address
translation, all memory accesses are considered to be user-level accesses
as though executed in U-mode.

Fixes: 659ad6d82c ("RISC-V: KVM: Use PAGE_KERNEL_IO in kvm_riscv_gstage_ioremap()")
Signed-off-by: Fangyu Yu <fangyu.yu@linux.alibaba.com>
Reviewed-by: Radim Krčmář <rkrcmar@ventanamicro.com>
Reviewed-by: Nutty Liu <nutty.liu@hotmail.com>
Link: https://lore.kernel.org/r/20250807070729.89701-1-fangyu.yu@linux.alibaba.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2025-08-25 10:26:16 +05:30
Suraj Kandpal
2dbb3d70af drm/i915/edp: eDP Data Overrride
We need override certain link rates in favour of the next available
higher link rate. The Link rates that need to be overridden are
indicated by a mask in VBT. To make sure these modes are skipped we
don't add them in them in the sink rates array.

--v2
-Update the link rates after we have a final set of link rates [Ankit]
-Break this patch up [Ankit]
-Optimize the assingment during loop [Ankit]

--v3
-Add protection against broken VBTs [Jani]

--v4
-Fix build errors
-Create a seprate function to check if edp data override is selected
and using the correct vbt

--v5
-Use correct number to check the num of edp rates [Ankit]

--v6
-No seprate function check if vbt is broken in the reject rate function
[Jani]

Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com>
Reviewed-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
Link: https://lore.kernel.org/r/20250821042653.269227-4-suraj.kandpal@intel.com
2025-08-25 10:06:47 +05:30
Suraj Kandpal
835a0d544d drm/i915/bios: Add function to check if edp data override is needed
Add a function that helps identify if the rate provided needs to
be overridden. For this we need a function that compares the rate
provided and bitmask of rates provided in VBT.

--v2
-Rename functions [Jani]
-Return the mask instead of parsing it in function [Jani]
-Move the declaration in header [Jani]

--v3
-Change function name to depict what the function does [Ankit]

--v4
-Lets not use hweight [Ankit]

Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com>
Reviewed-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
Link: https://lore.kernel.org/r/20250821042653.269227-3-suraj.kandpal@intel.com
2025-08-25 09:53:11 +05:30
Suraj Kandpal
4d33c77cf2 drm/i915/vbt: Add eDP Data rate overrride field in VBT
Add edp_data_rate_override field VBT which gives us a mask
of rates which needs to be skipped in favour of
subsequent higher rate.

--v2
-Rename vbt field [Jani]
-Fix comment to 263+ [Jani]
-Use BIT_U32 [Jani]
-Fix the bits assignment in vbt [Jani]

--v3
-Add a mask which represents all link rates [Ankit]

Bspec: 20124
Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com>
Reviewed-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
Link: https://lore.kernel.org/r/20250821042653.269227-2-suraj.kandpal@intel.com
2025-08-25 09:53:10 +05:30
Xichao Zhao
f840737d17
ASoC: SOF: imx: Remove the use of dev_err_probe()
The dev_err_probe() doesn't do anything when error is '-ENOMEM'.
Therefore, remove the useless call to dev_err_probe(), and just
return the value instead.

Signed-off-by: Xichao Zhao <zhao.xichao@vivo.com>
Reviewed-by: Laurentiu Mihalcea <laurentiu.mihalcea@nxp.com>
Message-ID: <20250819112654.588527-1-zhao.xichao@vivo.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2025-08-24 22:41:10 +01:00
Shengjiu Wang
bc017f28b1
ASoC: imx-hdmi: remove cpu_pdev related code
If a defer probe happens for the cpu device, the return value for
cpu_pdev "ret = -EINVAL" breaks defer probe. As the cpus->dai_name
can be replaced by cpus->of_node, to simplify the code, remove related
code for cpu_pdev.

Fixes: 6a5f850aa8 ("ASoC: fsl: Add imx-hdmi machine driver")
Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Message-ID: <20250820031641.2158261-1-shengjiu.wang@nxp.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2025-08-24 22:41:09 +01:00
Kamal Wadhwa
ef3e9c91ed
regulator: pm8008: fix probe failure due to negative voltage selector
In the current design, the `pm8008_regulator_get_voltage_sel()` callback
can return a negative value if the raw voltage value is read as 0 uV from
the PMIC HW register. This can cause the probe to fail when the
`machine_constraints_voltage()` check is called during the regulator
registration flow.

Fix this by using the helper `regulator_map_voltage_linear_range()` to
convert the raw value to a voltage selector inside the mentioned get
voltage selector function. This ensures that the value returned is always
within the defined range.

Signed-off-by: Kamal Wadhwa <kamal.wadhwa@oss.qualcomm.com>
Message-ID: <20250823-pm8008-negitive-selector-v1-1-52b026a4b5e8@quicinc.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2025-08-24 22:41:04 +01:00
Cryolitia PukNgae
b1c99d5bd2
ASoC: codecs: idt821034: fix wrong log in idt821034_chip_direction_output()
Change `dir in` to `dir out`

Suggested-by: Jun Zhan <zhanjun@uniontech.com>
Signed-off-by: Cryolitia PukNgae <cryolitia@uniontech.com>
Acked-by: Herve Codina <herve.codina@bootlin.com>
Message-ID: <20250822-idt821034-v1-1-e2bfffbde56f@uniontech.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2025-08-24 22:40:59 +01:00
Kuninori Morimoto
b833b412a5
ASoC: soc-core: tidyup snd_soc_lookup_component_nolocked()
snd_soc_lookup_component_nolocked() is very complex today.
Let's tidyup the code.

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Message-ID: <87cy8sysuy.wl-kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2025-08-24 22:40:54 +01:00
Kuninori Morimoto
168873ca17
ASoC: soc-core: care NULL dirver name on snd_soc_lookup_component_nolocked()
soc-generic-dmaengine-pcm.c uses same dev for both CPU and Platform.
In such case, CPU component driver might not have driver->name, then
snd_soc_lookup_component_nolocked() will be NULL pointer access error.
Care NULL driver name.

	Call trace:
	 strcmp from snd_soc_lookup_component_nolocked+0x64/0xa4
	 snd_soc_lookup_component_nolocked from snd_soc_unregister_component_by_driver+0x2c/0x44
	 snd_soc_unregister_component_by_driver from snd_dmaengine_pcm_unregister+0x28/0x64
	 snd_dmaengine_pcm_unregister from devres_release_all+0x98/0xfc
	 devres_release_all from device_unbind_cleanup+0xc/0x60
	 device_unbind_cleanup from really_probe+0x220/0x2c8
	 really_probe from __driver_probe_device+0x88/0x1a0
	 __driver_probe_device from driver_probe_device+0x30/0x110
	driver_probe_device from __driver_attach+0x90/0x178
	__driver_attach from bus_for_each_dev+0x7c/0xcc
	bus_for_each_dev from bus_add_driver+0xcc/0x1ec
	bus_add_driver from driver_register+0x80/0x11c
	driver_register from do_one_initcall+0x58/0x23c
	do_one_initcall from kernel_init_freeable+0x198/0x1f4
	kernel_init_freeable from kernel_init+0x1c/0x12c
	kernel_init from ret_from_fork+0x14/0x28

Fixes: 144d6dfc74 ("ASoC: soc-core: merge snd_soc_unregister_component() and snd_soc_unregister_component_by_driver()")
Reported-by: J. Neuschäfer <j.ne@posteo.net>
Closes: https://lore.kernel.org/r/aJb311bMDc9x-dpW@probook
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Reported-by: Ondřej Jirman <megi@xff.cz>
Closes: https://lore.kernel.org/r/arxpwzu6nzgjxvsndct65ww2wz4aezb5gjdzlgr24gfx7xvyih@natjg6dg2pj6
Tested-by: J. Neuschäfer <j.ne@posteo.net>
Message-ID: <87ect8ysv8.wl-kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2025-08-24 22:40:50 +01:00
Dave Airlie
1cd0c7afef drm-misc-next for v6.18:
Core Changes:
 
 bridge:
 - Support Content Protection property
 
 gpuvm:
 - Support madvice in Xe driver
 
 mipi:
 - Add more multi-read/write helpers for improved error handling
 
 Driver Changes:
 
 amdxdna:
 - Refactoring wrt. hardware contexts
 
 bridge:
 - display-connector: Improve DP display detection
 
 panel:
 - Fix includes in various drivers
 
 panthor:
 - Add support for Mali G710, G510, G310, Gx15, Gx20, Gx25
 - Improve cache flushing
 -----BEGIN PGP SIGNATURE-----
 
 iQFPBAABCgA5FiEEchf7rIzpz2NEoWjlaA3BHVMLeiMFAmimzDEbFIAAAAAABAAO
 bWFudTIsMi41KzEuMTEsMiwyAAoJEGgNwR1TC3oj9asIAKoMJBvOQ6MgfrlyKk+T
 zyv9jZgPWXBlzDzwBBY2pILIqfMjQXPWKj+I6A1Jfw1bm/+LFJo3CdHhynntbpF2
 QLgsGvZSFqAT/+0BBgM059KiKRRQ2u5IMVnxgV1Mzfw8zn/blf+AUhyW9fCQCU5Q
 1qtfR00wDj8q1Oij7Mvb4+LNHxYBgSMKAjsCWGZ7So/t3Mz6kVPs9Be6P5RLoakV
 22JVdnwVz2FYw0Dzw9s/C+onYjiv3EZmllJ9HouysrOFUpr18yuxGdoITRzqyMAK
 3GFpTapT6A+4+hadV2f9U9Xulx2xsdrHkR2IHMzYk7CXTTuEmcDjLRalQmyYhGHB
 D6M=
 =ysw0
 -----END PGP SIGNATURE-----

Merge tag 'drm-misc-next-2025-08-21' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next

drm-misc-next for v6.18:

Core Changes:

bridge:
- Support Content Protection property

gpuvm:
- Support madvice in Xe driver

mipi:
- Add more multi-read/write helpers for improved error handling

Driver Changes:

amdxdna:
- Refactoring wrt. hardware contexts

bridge:
- display-connector: Improve DP display detection

panel:
- Fix includes in various drivers

panthor:
- Add support for Mali G710, G510, G310, Gx15, Gx20, Gx25
- Improve cache flushing

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://lore.kernel.org/r/20250821073822.GA45904@2a02-2454-fd5e-fd00-8f09-b5f-980b-a7ef.dyn6.pyur.net
2025-08-25 06:38:49 +10:00
Jens Axboe
89a8859721 io_uring/trace: support completion tracing of mixed 32b CQEs
Check for IORING_CQE_F_32 as well, not just if the ring was setup with
IORING_SETUP_CQE32 to only support big CQEs.

Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-08-24 11:41:13 -06:00
Jens Axboe
82ceb7fcc5 io_uring/fdinfo: handle mixed sized CQEs
Ensure that the CQ ring iteration handles differently sized CQEs, not
just a fixed 16b or 32b size per ring. These CQEs aren't possible just
yet, but prepare the fdinfo CQ ring dumping for handling them.

Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-08-24 11:41:13 -06:00
Jens Axboe
b69458735d io_uring: add UAPI definitions for mixed CQE postings
This adds the CQE flags related to supporting a mixed CQ ring mode, where
both normal (16b) and big (32b) CQEs may be posted.

No functional changes in this patch.

Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-08-24 11:41:12 -06:00
Jens Axboe
d0201c4436 io_uring: remove io_ctx_cqe32() helper
It's pretty pointless and only used for the tracing helper, get rid
of it.

Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-08-24 11:41:12 -06:00
Caleb Sander Mateos
e5c717e795 io_uring/cmd: consolidate REQ_F_BUFFER_SELECT checks
io_uring_cmd_prep() checks that REQ_F_BUFFER_SELECT is set in the
io_kiocb's flags iff IORING_URING_CMD_MULTISHOT is set in the SQE's
uring_cmd_flags. Consolidate the IORING_URING_CMD_MULTISHOT and
!IORING_URING_CMD_MULTISHOT branches into a single check that the
IORING_URING_CMD_MULTISHOT flag matches the REQ_F_BUFFER_SELECT flag.

Signed-off-by: Caleb Sander Mateos <csander@purestorage.com>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Link: https://lore.kernel.org/r/20250821163308.977915-4-csander@purestorage.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-08-24 11:41:12 -06:00
Caleb Sander Mateos
3484f530f8 io_uring/cmd: deduplicate uring_cmd_flags checks
io_uring_cmd_prep() currently has two checks for whether
IORING_URING_CMD_FIXED and IORING_URING_CMD_MULTISHOT are both set in
uring_cmd_flags. Remove the second check.

Signed-off-by: Caleb Sander Mateos <csander@purestorage.com>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Link: https://lore.kernel.org/r/20250821163308.977915-3-csander@purestorage.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-08-24 11:41:12 -06:00
Ming Lei
620a50c927 io_uring: uring_cmd: add multishot support
Add UAPI flag IORING_URING_CMD_MULTISHOT for supporting multishot
uring_cmd operations with provided buffer.

This enables drivers to post multiple completion events from a single
uring_cmd submission, which is useful for:

- Notifying userspace of device events (e.g., interrupt handling)
- Supporting devices with multiple event sources (e.g., multi-queue devices)
- Avoiding the need for device poll() support when events originate
  from multiple sources device-wide

The implementation adds two new APIs:
- io_uring_cmd_select_buffer(): selects a buffer from the provided
  buffer group for multishot uring_cmd
- io_uring_mshot_cmd_post_cqe(): posts a CQE after event data is
  pushed to the provided buffer

Multishot uring_cmd must be used with buffer select (IOSQE_BUFFER_SELECT)
and is mutually exclusive with IORING_URING_CMD_FIXED for now.

The ublk driver will be the first user of this functionality:

	https://github.com/ming1/linux/commits/ublk-devel/

Signed-off-by: Ming Lei <ming.lei@redhat.com>
Link: https://lore.kernel.org/r/20250821040210.1152145-3-ming.lei@redhat.com
[axboe: fold in fix for !CONFIG_IO_URING]
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-08-24 11:41:12 -06:00
Ming Lei
d589bcddaa io-uring: move struct io_br_sel into io_uring_types.h
Move `struct io_br_sel` into io_uring_types.h and prepare for supporting
provided buffer on uring_cmd.

Signed-off-by: Ming Lei <ming.lei@redhat.com>
Link: https://lore.kernel.org/r/20250821040210.1152145-2-ming.lei@redhat.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-08-24 11:41:12 -06:00
Jens Axboe
fe524b0684 io_uring/kbuf: check for ring provided buffers first in recycling
This is the most likely of paths if a provided buffer is used, so offer
it up first and push the legacy buffers to later.

Link: https://lore.kernel.org/r/20250821020750.598432-14-axboe@kernel.dk
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-08-24 11:41:12 -06:00
Jens Axboe
e973837b54 io_uring: remove async/poll related provided buffer recycles
These aren't necessary anymore, get rid of them.

Link: https://lore.kernel.org/r/20250821020750.598432-13-axboe@kernel.dk
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-08-24 11:41:12 -06:00
Jens Axboe
5fda512554 io_uring/kbuf: switch to storing struct io_buffer_list locally
Currently the buffer list is stored in struct io_kiocb. The buffer list
can be of two types:

1) Classic/legacy buffer list. These don't need to get referenced after
   a buffer pick, and hence storing them in struct io_kiocb is perfectly
   fine.

2) Ring provided buffer lists. These DO need to be referenced after the
   initial buffer pick, as they need to get consumed later on. This can
   be either just incrementing the head of the ring, or it can be
   consuming parts of a buffer if incremental buffer consumptions has
   been configured.

For case 2, io_uring needs to be careful not to access the buffer list
after the initial pick-and-execute context. The core does recycling of
these, but it's easy to make a mistake, because it's stored in the
io_kiocb which does persist across multiple execution contexts. Either
because it's a multishot request, or simply because it needed some kind
of async trigger (eg poll) for retry purposes.

Add a struct io_buffer_list to struct io_br_sel, which is always on
stack for the various users of it. This prevents the buffer list from
leaking outside of that execution context, and additionally it enables
kbuf to not even pass back the struct io_buffer_list if the given
context isn't appropriately locked already.

This doesn't fix any bugs, it's simply a defensive measure to prevent
any issues with reuse of a buffer list.

Link: https://lore.kernel.org/r/20250821020750.598432-12-axboe@kernel.dk
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-08-24 11:41:12 -06:00
Jens Axboe
461382a51f io_uring/net: use struct io_br_sel->val as the send finish value
Currently a pointer is passed in to the 'ret' in the send mshot handler,
but since we already have a value field in io_br_sel, just use that.
This is also in preparation for needing to pass in struct io_br_sel
to io_send_finish() anyway.

Link: https://lore.kernel.org/r/20250821020750.598432-11-axboe@kernel.dk
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-08-24 11:41:12 -06:00
Jens Axboe
58d8150918 io_uring/net: use struct io_br_sel->val as the recv finish value
Currently a pointer is passed in to the 'ret' in the receive handlers,
but since we already have a value field in io_br_sel, just use that.
This is also in preparation for needing to pass in struct io_br_sel
to io_recv_finish() anyway.

Link: https://lore.kernel.org/r/20250821020750.598432-10-axboe@kernel.dk
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-08-24 11:41:12 -06:00
Jens Axboe
429884ff35 io_uring/kbuf: use struct io_br_sel for multiple buffers picking
The networking side uses bundles, which is picking multiple buffers at
the same time. Pass in struct io_br_sel to those helpers.

Link: https://lore.kernel.org/r/20250821020750.598432-9-axboe@kernel.dk
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-08-24 11:41:12 -06:00
Jens Axboe
d8e1dec2f8 io_uring/rw: recycle buffers manually for non-mshot reads
The mshot side of reads already does this, but the regular read path
does not. This leads to needing recycling checks sprinkled in various
spots in the "go async" path, like arming poll. In preparation for
getting rid of those, ensure that read recycles appropriately.

Link: https://lore.kernel.org/r/20250821020750.598432-8-axboe@kernel.dk
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-08-24 11:41:12 -06:00
Jens Axboe
ab6559bdbb io_uring/kbuf: introduce struct io_br_sel
Rather than return addresses directly from buffer selection, add a
struct around it. No functional changes in this patch, it's in
preparation for storing more buffer related information locally, rather
than in struct io_kiocb.

Link: https://lore.kernel.org/r/20250821020750.598432-7-axboe@kernel.dk
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-08-24 11:41:12 -06:00
Jens Axboe
1b5add75d7 io_uring/kbuf: pass in struct io_buffer_list to commit/recycle helpers
Rather than have this implied being in the io_kiocb, pass it in directly
so it's immediately obvious where these users of ->buf_list are coming
from.

Link: https://lore.kernel.org/r/20250821020750.598432-6-axboe@kernel.dk
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-08-24 11:41:12 -06:00
Jens Axboe
b22743f29b io_uring/net: clarify io_recv_buf_select() return value
It returns 0 on success, less than zero on error.

Link: https://lore.kernel.org/r/20250821020750.598432-5-axboe@kernel.dk
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-08-24 11:41:12 -06:00
Jens Axboe
15ba5e51e6 io_uring/net: don't use io_net_kbuf_recyle() for non-provided cases
A previous commit used io_net_kbuf_recyle() for any network helper that
did IO and needed partial retry. However, that's only needed if the
opcode does buffer selection, which isnt support for sendzc, sendmsg_zc,
or sendmsg. Just remove them - they don't do any harm, but it is a bit
confusing when reading the code.

Link: https://lore.kernel.org/r/20250821020750.598432-4-axboe@kernel.dk
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-08-24 11:41:11 -06:00
Jens Axboe
5e73b402cb io_uring/kbuf: drop 'issue_flags' from io_put_kbuf(s)() arguments
Picking multiple buffers always requires the ring lock to be held across
the operation, so there's no need to pass in the issue_flags to
io_put_kbufs(). On the single buffer side, if the initial picking of a
ring buffer was unlocked, then it will have been committed already. For
legacy buffers, no locking is required, as they will simply be freed.

Link: https://lore.kernel.org/r/20250821020750.598432-3-axboe@kernel.dk
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-08-24 11:41:11 -06:00
Pavel Begunkov
ab3ea6eac5 io_uring/zctx: check chained notif contexts
Send zc only links ubuf_info for requests coming from the same context.
There are some ambiguous syz reports, so let's check the assumption on
notification completion.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/fd527d8638203fe0f1c5ff06ff2e1d8fd68f831b.1755179962.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-08-24 11:41:11 -06:00
Pavel Begunkov
92a96b0a22 io_uring: add request poisoning
Poison various request fields on free. __io_req_caches_free() is a slow
path, so can be done unconditionally, but gate it on kasan for
io_req_add_to_cache(). Note that some fields are logically retained
between cache allocations and can't be poisoned in
io_req_add_to_cache().

Ideally, it'd be replaced with KASAN'ed caches, but that can't be
enabled because of some synchronisation nuances.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/7a78e8a7f5be434313c400650b862e36c211b312.1755459452.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-08-24 11:41:11 -06:00
Linus Torvalds
1b237f190e Linux 6.17-rc3 v6.17-rc3 2025-08-24 12:04:12 -04:00
Michal Wilczynski
5052d5cf13 riscv: dts: thead: th1520: Add IMG BXM-4-64 GPU node
Add a device tree node for the IMG BXM-4-64 GPU present in the T-HEAD
TH1520 SoC used by the Lichee Pi 4A board. This node enables support for
the GPU using the drm/imagination driver.

By adding this node, the kernel can recognize and initialize the GPU,
providing graphics acceleration capabilities on the Lichee Pi 4A and
other boards based on the TH1520 SoC.

Add fixed clock gpu_mem_clk, as the MEM clock on the T-HEAD SoC can't be
controlled programatically.

Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
Reviewed-by: Drew Fustini <fustini@kernel.org>
Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Acked-by: Matt Coster <matt.coster@imgtec.com>
Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>
Signed-off-by: Drew Fustini <fustini@kernel.org>
2025-08-24 07:37:42 -07:00
Linus Torvalds
c330cb6077 i2c-for-6.17-rc3
- hisi: update maintainership
 - rtl9300: fix several issues in xfer
   - check message length boundaries
   - correct multi-byte value composition on write
   - increase polling timeout
   - fix block transfer protocol
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEOZGx6rniZ1Gk92RdFA3kzBSgKbYFAmiq6uEACgkQFA3kzBSg
 KbbG3Q/9GUwocQhQhtHiV1qfcbS2Q2vqXozVzypT5t9UY960BtT+DSb0m2xxXxLh
 bU5LLYkl5IkomRZ0u8TUO70N+WdRM9zTgKMTfVPeWOoi3kdN6gEZbdWEfW9QCwo6
 gvyHKWJ7VlaTvvonqy/x0i5niKPrJ1CKpIXz77W663ViTrKssUIGRq8R/n1+BxPv
 SADAzuGawwF/UXR65K5/giKxsdMHRSNLasiAftF9zZgsK0d2xh74P++a9LWYobGD
 4d7hhLLkGtpgob1Ibn3hiFTrx/Z2n3mqKljeZ4bSbWRXOM97bv7Aq9CV44OJouc+
 OMxoT/AiteC0MtBciqDtd0E8kNt01mXI0tBhsgUJwSfz6pwbiuN2BqYkqjCO77SM
 IpUwSJycIA6AMHBdJ/gTHRY+mOc2fLTEHECPkdNOb4z22DQYRCdCccH6jq9zFmHU
 kv1Jrg+BKCPA/tm3FsPg7oj0lobB4tMB2TzKCkb8/HjxawA3mGq1KKP7ldiK4YZU
 WmpEZkVRPKVHVHucPAvLaOjrtbJ5RjmKPbGdbXfX4Yz3Z+IT6pMN4Az9LnmrPXIZ
 oDkPyZxxykhWp60NiUyHGz+lxudr+ayx8mVgFWkW0zHTARv8u3WqsXPxZEnzYEhg
 iEAm3XMCfzC1ipZjbY2VP5A01cFz3kHqnSHUDbAgyVTexIZ2zTU=
 =qg/x
 -----END PGP SIGNATURE-----

Merge tag 'i2c-for-6.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux

Pull i2c fixes from Wolfram Sang:

 - hisi: update maintainership

 - fix several issues in rtl9300 xfer:
     - check message length boundaries
     - correct multi-byte value composition on write
     - increase polling timeout
     - fix block transfer protocol

* tag 'i2c-for-6.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
  i2c: rtl9300: Add missing count byte for SMBus Block Ops
  i2c: rtl9300: Increase timeout for transfer polling
  i2c: rtl9300: Fix multi-byte I2C write
  i2c: rtl9300: Fix out-of-bounds bug in rtl9300_i2c_smbus_xfer
  MAINTAINERS: i2c: Update i2c_hisi entry
2025-08-24 10:32:04 -04:00
Linus Torvalds
69fd6b99b8 - Fix a case where the events throttling logic operates on inactive events
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmiq4usACgkQEsHwGGHe
 VUqytg/9GEznbpmRT2Byto488q6rBaxp+hpNL1xFubuZt9Xv0xbUKLGUInHwTx4I
 wcep6QXsS5k55vz7xV1Fw0gQMAeBlSTiyT3fq9cC97T5z+bT+tBXANEr6GzTXHGW
 2KesAWQo9QVyNs/jCxWPBoWJnzBAG8NTuMNsnXVFnFuK9nFvmYOfVz5fJBIYw0cZ
 JXCtzIJGsXUDSa5wYIfbpORhVyJbwA30OdKc/rXvOa3eYuOazArR/OkH8IYXEPD9
 kJsVAcOMNo5hJsOUrGle0O1AYtw1bqWCHOtdWkcDEL9zrodNXqeEfrJW4wymHo70
 oXPSn74ZXI23ukbpYp1KvE66LvBsOsRS0rLk9avpGuNAKDSa1hNYC2cOF/ABD1Ca
 I8irVQnEslSdkW0SFnJ1cjHNZpQJWXJRlvvTnrE9FxGJWM8MPOunke34Z7O1q6qE
 kxupGb/ApfVlfRM6mAsU4G5Ya4wWed+gbMATPhcvRLqIJjS4E+Xzp/2Xw5Jg4Lln
 fkSOv0a3/OI4rk4xPrrvr85awP7qfxdRIfefuYae2RQ8twzrhlX9MyRTgX92T3Lu
 WgajYbWN7GhABdrfvAUIu9YiXYGKFiox5vT10O8IB7NXH6w1TlGEHdUkC/UUrjwa
 NL+LHl/zVh68JlMHaGfgpQeb4fWUvM7D3+KaLvN6dTm9LWCnKUc=
 =AsFO
 -----END PGP SIGNATURE-----

Merge tag 'perf_urgent_for_v6.17_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull perf fix from Borislav Petkov:

 - Fix a case where the events throttling logic operates on inactive
   events

* tag 'perf_urgent_for_v6.17_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  perf: Avoid undefined behavior from stopping/starting inactive events
2025-08-24 10:13:05 -04:00
Linus Torvalds
0f74d9cf52 - Fix the GDS mitigation detection on some machines after the recent attack
vectors conversion
 
 - Filter out the invalid machine reset reason value -1 when running as a guest
   as in such cases the reason why the machine was rebooted does not make
   a whole lot of sense
 
 - Init the resource control machinery on Hygon hw, also in order to avoid
   a division by 0 in addition to actually enabling the feature on hw which
   supports it
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmiq5wkACgkQEsHwGGHe
 VUpYAQ/+Jfon30aae+VI8T4k96Q93GuQnplrtPgLsC4SN4NBd63NWOfFtcIayU2h
 O7FpqZOmoN2oVppmMyjaRKLDhETb3u3YHtiOE5pYvEzVg0g9XoHNEzvioOPga3sY
 5o/CrMGwWsUvGvZgxOzgptBppBbSYdz6+G6yAn+Kr4cb7TBNKdOMB3OJT2h0S1T7
 6DuqAn3jVtYFlVcxpJwYLX8wpsZPvDUjYNxvGpd4pPqFcsOZUPNuYgcveK6aHb9T
 8y3EWZcWPFNyiVXLxa0TsaA+iv8dSXZqw0JBMBcNQ7DYUtLBjHnQIPPYALQbErrY
 AZUj4AbYeBFcc8qXOmipPXqITRvH9tttCRAvoYI76P5a2IFEqhMOsiTstr4Zf50n
 lVx0RvDqbsbRTKSoiHWiR81tTugXD0Phdas4H0v4JwRVlOWQsuThSYqy6dEZSFQD
 graJHzJmcH+Wysrh8azBhzJa5FPDcmZo631+62CZCfFExTmT0GalbZ+1+Q7M5RRr
 U+HFpAmMQirnwzEoC8/BxgZAQEF40Sr14MsIeJfx59pBAP8FqZgjwxC1RXE2mRVS
 oyjpkgdPqmnz9N5yJDQxgev6SpB3nlEHyC6YZM+4Lv6nvWeNg6YjRrqF9esg88AQ
 fov1ZjmvHJ39CldlUETH4d1X4sRiRYgGcLPeG5cdfCwAGas3zxk=
 =VH8m
 -----END PGP SIGNATURE-----

Merge tag 'x86_urgent_for_v6.17_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull x86 fixes from Borislav Petkov:

 - Fix the GDS mitigation detection on some machines after the recent
   attack vectors conversion

 - Filter out the invalid machine reset reason value -1 when running as
   a guest as in such cases the reason why the machine was rebooted does
   not make a whole lot of sense

 - Init the resource control machinery on Hygon hw in order to avoid a
   division by zero and to actually enable the feature on hw which
   supports it

* tag 'x86_urgent_for_v6.17_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/bugs: Fix GDS mitigation selecting when mitigation is off
  x86/CPU/AMD: Ignore invalid reset reason value
  x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper
2025-08-24 09:52:28 -04:00