summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-06-12net: hsr: simplify fill_last_seq_nrs()Yury Norov
The function checks the HSR_PT_SLAVE_A and HSR_PT_SLAVE_B bitmaps for emptiness right before calling find_last_bit(). This pass may be avoided, because if the bitmap is empty, the find_last_bit() returns >= HSR_SEQ_BLOCK_SIZE Signed-off-by: Yury Norov <ynorov@nvidia.com> Reviewed-by: Felix Maurer <fmaurer@redhat.com> Link: https://patch.msgid.link/20260609171545.1051322-1-ynorov@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-12tcp: clear sock_ops cb flags before force-closing a child socketSechang Lim
A child socket inherits the listener's bpf_sock_ops_cb_flags via sk_clone_lock(). If its setup fails in tcp_v4_syn_recv_sock() / tcp_v6_syn_recv_sock(), the child is freed through put_and_exit, where inet_csk_prepare_forced_close() drops the socket lock and tcp_done() runs without it. If BPF_SOCK_OPS_STATE_CB_FLAG was inherited, tcp_done() -> tcp_set_state() calls tcp_call_bpf(), which expects the lock and trips sock_owned_by_me(): WARNING: include/net/sock.h:1799 at tcp_set_state+0x433/0x550 RIP: 0010:tcp_set_state+0x433/0x550 include/net/sock.h:1799 Call Trace: <IRQ> tcp_done+0xba/0x250 net/ipv4/tcp.c:5095 tcp_v4_syn_recv_sock+0x850/0xa50 net/ipv4/tcp_ipv4.c:1787 tcp_check_req+0xf30/0x1360 net/ipv4/tcp_minisocks.c:926 tcp_v4_rcv+0x1047/0x1b50 net/ipv4/tcp_ipv4.c:2164 </IRQ> The child is freed before it is ever established, so it should run no sock_ops callback. Clear its cb flags in inet_csk_prepare_for_destroy_sock(), the common point for the IPv4, IPv6 and chtls forced-close paths and for the MPTCP ->syn_recv_sock() failure path (dispose_child), which reaches tcp_done() on a child that was never established too. Suggested-by: Jiayuan Chen <jiayuan.chen@linux.dev> Fixes: d44874910a26 ("bpf: Add BPF_SOCK_OPS_STATE_CB") Signed-off-by: Sechang Lim <rhkrqnwk98@gmail.com> Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev> Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20260611092923.1895982-1-rhkrqnwk98@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-12net: ethernet: sis900: correct CONFIG_VLAN_8021Q macro name in commentEthan Nelson-Moore
A comment in drivers/net/ethernet/sis/sis900.h incorrectly refers to CONFIG_VLAN_802_1Q instead of CONFIG_VLAN_8021Q. Correct it. Discovered while searching for CONFIG_* symbols referenced in code but not defined in any Kconfig file. Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com> Link: https://patch.msgid.link/20260609175656.20574-1-enelsonmoore@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-12docs: net: fix minor issues with XDP metadata docsJakub Kicinski
Minor updates to the XDP metadata documentation: - s/union/struct/ for xsk_tx_metadata - document nested request and completion metadata fields - point capability queries at the xsk-features attribute - fix grammar in the XDP RX metadata guide - typos Acked-by: Stanislav Fomichev <sdf@fomichev.me> Acked-by: Jesper Dangaard Brouer <hawk@kernel.org> Link: https://patch.msgid.link/20260609201224.1191391-2-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-12bnxt: fix head underflow on XDP head-growJoe Damato
The xdp.py test test_xdp_native_adjst_head_grow_data crashes when run on a bnxt machine (and also crashes in NIPA). It seems that the bug is an underflow in bnxt_rx_multi_page_skb, which builds the skb head: napi_build_skb(data_ptr - bp->rx_offset, rxr->rx_page_size); The problem with this expression is that in page mode, rx_offset is: bp->rx_offset = NET_IP_ALIGN + XDP_PACKET_HEADROOM; Which evaluates (at least on x86_64) to 258. The test test_xdp_native_adjst_head_grow_data tests a case where the head is adjusted by -256. When this test runs, data_ptr is shifted to frag_start + 2 (where frag_start = page_address(page) + offset). Then, bnxt_rx_multi_page_skb is invoked and the napi_build_skb expression subtracts 258, landing at an address before frag_start. This could be either the previous fragment or the previous physical page when the offset is < 256 (e.g. if the fragment started at offset 0). When the skb is freed, the page pool fragment reference is dropped on either the wrong page or the wrong frag of the right page. In either case, the corrupted reference count can lead to the page being prematurely recycled while still in use. Once (incorrectly) recycled, it can be handed out again and on driver teardown this would result in a double free. The commit under fixes updated this code to handle the case where the native page size is >= 64k, but it unintentionally broke the head grow case. To fix this, add an offset field to struct bnxt_sw_rx_bd, mirroring the existing offset field in struct bnxt_sw_rx_agg_bd. Populate it on allocation and preserve it on reuse. In bnxt_rx_multi_page_skb, use the newly added offset field to compute the fragment start and pass that to napi_build_skb. Adjust the layout with skb_reserve. There are two cases, the non-adjustment case and the adjustment case. In both cases, the skb is built at page_address(page) + offset to account for the case where the native page size >= 64K and skb_reserve is called with data_ptr - (page_address(page) + offset). That difference equals bp->rx_offset when data_ptr was not moved, or bp->rx_offset + xdp_adjust when XDP adjusted the head. Re-running the failing test with this commit applied causes the test to run successfully to completion. The other rx_skb_func implementations don't have this issue. Fixes: f6974b4c2d8e ("bnxt_en: Fix page pool logic for page size >= 64K") Signed-off-by: Joe Damato <joe@dama.to> Reviewed-by: Michael Chan <michael.chan@broadcom.com> Link: https://patch.msgid.link/20260609204458.2237787-2-joe@dama.to Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-12net: stmmac: xgmac2: disable RBUE in default RX interrupt maskNazim Amirul
Enabling the RX Buffer Unavailable (RBUE) interrupt is counterproductive and can trigger a MAC interrupt storm under heavy RX pressure. When the DMA runs out of RX descriptors it fires RBUE continuously until software refills the ring. However, RBUE is redundant: the normal RX completion interrupt (RIE) already triggers NAPI, which processes completed descriptors and refills the ring, causing the DMA to resume. The RBUE handler itself only sets handle_rx - the same outcome as RIE. On Agilex5 under heavy RX pressure, the MAC interrupt (which includes RBUE) was observed firing 1,821,811,555 times against only 2,618,627 actual RX completions - a ~695x ratio - confirming the severity of the storm. RBUE does not provide OOM recovery. If page_pool is exhausted, stmmac_rx_refill() cannot advance the DMA tail pointer, the DMA stays suspended, and RBUE fires again on the next NAPI completion - a storm with no forward progress. This patch trades that storm for a clean stall with the same RX outcome. Proper OOM recovery is a pre-existing gap outside the scope of this fix. Note: as a consequence of disabling RBUE, the rx_buf_unav_irq ethtool counter will always read 0 on XGMAC2 devices. This behaviour is already inconsistent across DWMAC core versions. Remove RBUE from XGMAC_DMA_INT_DEFAULT_EN and XGMAC_DMA_INT_DEFAULT_RX to prevent the interrupt storm while keeping normal RX handling intact. Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Signed-off-by: Nazim Amirul <muhammad.nazim.amirul.nazle.asmade@altera.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260609121703.9736-1-muhammad.nazim.amirul.nazle.asmade@altera.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-12Merge tag 'drm-fixes-2026-06-13' of https://gitlab.freedesktop.org/drm/kernelLinus Torvalds
Pull drm fixes from Dave Airlie: "Looks like it's settled down a bit more thankfully. Small changes across the board, amdgpu/xe leading with some colorop changes in the core/amd. Otherwise some misc driver fixes. colorop: - make lut interpolation mutable - track colorop updates correctly amdgpu: - UserQ fix - Userptr fix - MCCS freesync fix - track colorop changes correctly amdkfd: - Fix an event information leak - Events bounds check fix - Trap cleanup fix i915: - Check supported link rates DPCD read - Fix phys BO pread/pwrite with offset xe: - fix oops in suspend/shutdown without display - RAS fixes - Use HW_ERR prefix in log - include all registered queues in TLB invalidation - Fix refcount leak in xe_range_tree in error paths - fix job timeout recovery for unstarted jobs and kernel queues amdxdna: - fix possible leak of mm_struct ivpu: - fix integer truncation vc4: - fix leak in krealloc() error handling virtio: - fix dma_fence ref-count leak" * tag 'drm-fixes-2026-06-13' of https://gitlab.freedesktop.org/drm/kernel: (24 commits) accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range() drm/xe: fix job timeout recovery for unstarted jobs and kernel queues drm/xe: fix refcount leak in xe_range_fence_insert() drm/xe: include all registered queues in TLB invalidation drm/xe/hw_error: Use HW_ERR prefix in log drm/xe/drm_ras: Add per node cleanup action drm/xe/drm_ras: Make counter allocation drm managed drm/xe/display: fix oops in suspend/shutdown without display drm/amd/display: use plane color_mgmt_changed to track colorop changes drm/atomic: track individual colorop updates drm/colorop: make lut(1/3)d_interpolation props correctly behave as mutable drm/colorop: Remove read-only comments from interpolation fields drm/i915/gem: Fix phys BO pread/pwrite with offset drm/vc4: fix krealloc() memory leak drm/virtio: Fix driver removal with disabled KMS drm/i915/edp: Check supported link rates DPCD read accel/ivpu: Fix signed integer truncation in IPC receive drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() drm/amd/display: Consult MCCS FreeSync cap only if requested & supported drm/amdkfd: Unwind debug trap enable on copy_to_user failure ...
2026-06-12handshake: Require admin permission for DONE commandChuck Lever
ACCEPT and DONE are the two downcalls of the handshake genl family, both intended for use by the trusted handshake agent (tlshd). ACCEPT already requires GENL_ADMIN_PERM; DONE has no privilege check at all. The fd-lookup in handshake_nl_done_doit() only confirms that some pending handshake request exists for the supplied sockfd; it does not authenticate the sender. An unprivileged process that guesses or observes a valid sockfd can therefore submit a DONE with HANDSHAKE_A_DONE_STATUS == 0, leaving the kernel consumer to proceed as if the handshake succeeded. A non-zero status on a forged DONE tears down a legitimate in-flight handshake before tlshd can report its real result. Fixes: 3b3009ea8abb ("net/handshake: Create a NETLINK service for handling handshake requests") Reviewed-by: Jeff Layton <jlayton@kernel.org> Reviewed-by: Hannes Reinecke <hare@kernel.org> Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Link: https://patch.msgid.link/20260609141831.90694-1-cel@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-12Merge branch 'selftests-xsk-simplify-umem-setup'Jakub Kicinski
Tushar Vyavahare says: ==================== selftests/xsk: simplify UMEM setup This series simplifies UMEM handling in selftests/xsk. It centralizes UMEM property setup through helpers, moves UMEM ownership from ifobject to socket-owned state, and normalizes umem_size/mmap_size usage across the touched paths. ==================== Link: https://patch.msgid.link/20260608130938.958793-1-tushar.vyavahare@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-12selftests/xsk: Introduce mmap_size in umem structTushar Vyavahare
UMEM teardown currently recomputes the munmap() length from frame geometry, shared-UMEM adjustment, and hugepage rounding. This duplicates setup-time logic in cleanup and relies on re-deriving the mapping size instead of using the size originally established for the mapping. Store the final mapping length in xsk_umem_info as mmap_size when the UMEM mapping is created, and use that value during teardown. Also join the RX worker thread before cleanup in the single-thread path. This establishes synchronization before reading umem->mmap_size in teardown and avoids a potential visibility race. This removes duplicated size arithmetic in cleanup and makes munmap() use the canonical mapping size recorded at setup time. Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com> Signed-off-by: Tushar Vyavahare <tushar.vyavahare@intel.com> Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Link: https://patch.msgid.link/20260608130938.958793-5-tushar.vyavahare@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-12selftests/xsk: Use umem_size() helper consistentlyTushar Vyavahare
Replace remaining open-coded `umem->num_frames * umem->frame_size` calculations in test_xsk.c with the existing `umem_size()` helper. This keeps UMEM size computation centralized, avoids duplicated arithmetic, and improves readability with no intended behavior change. Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com> Signed-off-by: Tushar Vyavahare <tushar.vyavahare@intel.com> Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Link: https://patch.msgid.link/20260608130938.958793-4-tushar.vyavahare@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-12selftests/xsk: Move UMEM state from ifobject to xsk_socket_infoTushar Vyavahare
Move UMEM ownership from ifobject to xsk_socket_info and access it through xsk->umem. Allocate one shared umem_real in ifobject_create() and let all sockets reference it through xsk->umem, while keeping ownership in xsk_arr[0]. Keep the existing goto-based error path in ifobject_create() and free the allocation once in ifobject_delete(). Reset the existing umem_real in __test_spec_init() with memset() instead of reallocating it. Preserve shared-UMEM behavior by copying RX UMEM state into a TX-local UMEM state in thread_common_ops_tx() and reset base_addr/next_buffer before TX socket configuration. Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com> Signed-off-by: Tushar Vyavahare <tushar.vyavahare@intel.com> Link: https://patch.msgid.link/20260608130938.958793-3-tushar.vyavahare@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-12selftests/xsk: Introduce helpers for setting UMEM propertiesTushar Vyavahare
UMEM properties are set via open-coded field assignments in multiple test paths, which makes updates noisy and error-prone. Introduce two helpers to set UMEM properties through a single interface. This keeps setup logic consistent across tests and makes future refactoring simpler. No functional behavior change is intended. Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com> Signed-off-by: Tushar Vyavahare <tushar.vyavahare@intel.com> Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Link: https://patch.msgid.link/20260608130938.958793-2-tushar.vyavahare@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13pinctrl: Match DT helper typesRob Herring (Arm)
The affected pinctrl drivers either check for the presence of a standard property or read a property documented with an 8-bit cell encoding. Using boolean or u32 helpers for those cases disagrees with the binding. Use a presence helper for "gpio-ranges" and read "microchip,spi-present-mask" with the u8 helper documented by the binding. Assisted-by: Codex:gpt-5-5 Signed-off-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-06-12dt-bindings: embedded-controller: Add Qualcomm reference device EC descriptionMaya Matuszczyk
Add description for the EC firmware running on Hamoa/Purwa and Glymur reference devices. Signed-off-by: Maya Matuszczyk <maccraft123mc@gmail.com> Co-developed-by: Sibi Sankar <sibi.sankar@oss.qualcomm.com> Signed-off-by: Sibi Sankar <sibi.sankar@oss.qualcomm.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Co-developed-by: Anvesh Jain P <anvesh.p@oss.qualcomm.com> Signed-off-by: Anvesh Jain P <anvesh.p@oss.qualcomm.com> Link: https://patch.msgid.link/20260511-add-driver-for-ec-v9-1-e5437c39b7f8@oss.qualcomm.com Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2026-06-12dt-bindings: pwm: add IPQ6018 bindingDevi Priya
DT binding for the PWM block in Qualcomm IPQ6018 SoC. Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Co-developed-by: Baruch Siach <baruch.siach@siklu.com> Signed-off-by: Baruch Siach <baruch.siach@siklu.com> Signed-off-by: Devi Priya <quic_devipriy@quicinc.com> Signed-off-by: George Moussalem <george.moussalem@outlook.com> Link: https://patch.msgid.link/20260406-ipq-pwm-v21-1-6ed1e868e4c2@outlook.com Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2026-06-12selftests: tc: act_pedit: require matching IPv4 L4 protocolVictor Nogueira
Add a tdc test that checks the act_pedit extended L4 header mode does not edit a packet whose IPv4 protocol does not match the selected transport header. The test installs an ingress pedit rule that sets the UDP destination port, then injects a TCP packet with dport 2222. The UDP and TCP destination ports sit at the same L4 offset, so a buggy kernel rewrites the TCP dport. A second flower filter matches TCP dport 2222 and drops the packet through an indexed gact action; the test then verifies via JSON that this action saw exactly one packet, i.e. the dport was left untouched and still matched 2222. Signed-off-by: Victor Nogueira <victor@mojatatu.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-12net/sched: act_pedit: require matching IPv4 L4 protocolSamuel Moelius
The extended IPv4 L4 header mode in act_pedit can select TCP or UDP header fields without confirming that the IPv4 protocol field matches the selected transport header. That lets a rule written for TCP or UDP modify unrelated payload bytes in a packet carrying a different protocol. Verify that the IPv4 header is long enough, that the protocol matches the selected TCP or UDP header, and that the packet is not a non-initial fragment before applying TCP or UDP extended header edits. Cc: stable+noautosel@kernel.org # in real rule sets the match confirms this before calling the action Signed-off-by: Samuel Moelius <sam.moelius@trailofbits.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13Merge tag 'drm-misc-next-fixes-2026-06-11' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/misc/kernel into drm-next drm-misc-next-fixes for v7.2: - Fix agp_amd64_probe error propagation. - Require carveout when PASID is not enabled amdxdna. - Clear variable to prevent second unbind in amdxdna. - Add separate Kconfig option for DMABUF_HEAPS_SYSTEM_CC_SHARED. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Link: https://patch.msgid.link/c7a9dbb0-a5c8-4e67-904e-1a52b3de9bb4@linux.intel.com
2026-06-12dt-bindings: hwmon: Add Apple System Management Controller hwmon schemaJames Calligeros
Apple Silicon devices integrate a vast array of sensors, monitoring current, power, temperature, and voltage across almost every part of the system. The sensors themselves are all connected to the System Management Controller (SMC). The SMC firmware exposes the data reported by these sensors via its standard FourCC-based key-value API. The SMC is also responsible for monitoring and controlling any fans connected to the system, exposing them in the same way. For reasons known only to Apple, each device exposes its sensors with an almost totally unique set of keys. This is true even for devices which share an SoC. An M1 Mac mini, for example, will report its core temperatures on different keys to an M1 MacBook Pro. Worse still, the SMC does not provide a way to enumerate the available keys at runtime, nor do the keys follow any sort of reasonable or consistent naming rules that could be used to deduce their purpose. We must therefore know which keys are present on any given device, and which function they serve, ahead of time. Add a schema so that we can describe the available sensors for a given Apple Silicon device in the Devicetree. Reviewed-by: Neal Gompa <neal@gompa.dev> Reviewed-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: James Calligeros <jcalligeros99@gmail.com> Acked-by: Guenter Roeck <linux@roeck-us.net> Link: https://patch.msgid.link/20251215-macsmc-subdevs-v6-1-0518cb5f28ae@gmail.com Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2026-06-13Documentation: ABI: sysfs-class-reboot-mode-reboot_modes: fix doc warningsRandy Dunlap
Repair the docs build warnings in this file by unindenting the description, adding blank lines, and using `` to quote *arg. WARNING: Documentation/ABI/testing/sysfs-class-reboot-mode-reboot_modes:36: abi_sys_class_reboot_mode_driver_reboot_modes doesn't have a description Documentation/ABI/testing/sysfs-class-reboot-mode-reboot_modes:1: ERROR: Unexpected indentation. [docutils] Documentation/ABI/testing/sysfs-class-reboot-mode-reboot_modes:1: ERROR: Unexpected indentation. [docutils] Documentation/ABI/testing/sysfs-class-reboot-mode-reboot_modes:1: WARNING: Inline emphasis start-string without end-string. [docutils] Documentation/ABI/testing/sysfs-class-reboot-mode-reboot_modes:1: ERROR: Unexpected indentation. [docutils] Fixes: d3da03025e6d ("Documentation: ABI: Add sysfs-class-reboot-mode-reboot_modes") Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Link: https://patch.msgid.link/20260426232705.422938-1-rdunlap@infradead.org Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-06-13power: supply: charger-manager: fix refcount leak in is_full_charged()WenTao Liang
In is_full_charged(), power_supply_get_by_name() is called to obtain a reference to the fuel_gauge power supply. If the voltage check (uV >= desc->fullbatt_uV) succeeds, the function returns true directly without releasing the reference, leaking the refcount. Fix this by setting a flag and jumping to the out label where power_supply_put() properly drops the reference. Cc: stable@vger.kernel.org Fixes: e132fc6bb89b ("power: supply: charger-manager: Make decisions focussed on battery status") Signed-off-by: WenTao Liang <vulab@iscas.ac.cn> Link: https://patch.msgid.link/20260611005322.53096-1-vulab@iscas.ac.cn Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-06-12power: supply: core: fix supplied_from allocationsLucas Tsai
If dts property power-supplies has multiple values, then accessing to psy->supplied_from[i-1] in __power_supply_populate_supplied_from will overrun supplied_from array. Fixes: f6e0b081fb30 ("power_supply: Populate supplied_from hierarchy from the device tree") Signed-off-by: Lucas Tsai <lucas_tsai@richtek.com> Link: https://patch.msgid.link/20260609114403.3896073-1-lucas_tsai@richtek.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-06-13Merge tag 'drm-misc-fixes-2026-06-12' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes Short summary of fixes pull: amd: - track colorop changes correctly amdxdna: - fix possible leak of mm_struct colorop: - make lut interpolation mutable - track colorop updates correctly ivpu: - fix integer truncation vc4: - fix leak in krealloc() error handling virtio: - fix dma_fence ref-count leak Signed-off-by: Dave Airlie <airlied@redhat.com> From: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patch.msgid.link/20260612081418.GA17001@2a02-2455-9062-2500-e496-5a17-62ba-545e.dyn6.pyur.net
2026-06-12fbdev: modedb: Fix misaligned fields in the 1920x1080-60 modeSteffen Persvold
The 1920x1080@60 modedb entry has one too many initializers before its sync field: a stray "0" occupies the sync slot, which shifts the remaining values by one field. The entry therefore decodes as sync = 0, vmode = FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT (0x3, i.e. FB_VMODE_INTERLACED | FB_VMODE_DOUBLE), and flag = FB_VMODE_NONINTERLACED, instead of the intended sync = positive H/V, vmode = non-interlaced. fb_find_mode() then returns a 1920x1080 mode flagged as interlaced + doublescan with active-low syncs. Drivers that honour var->vmode and var->sync when programming display timing enable doublescan and the wrong sync polarity, corrupting the output. Drop the stray initializer so sync and vmode hold their intended values (positive H/V sync, non-interlaced), matching the adjacent 1920x1200 entry. Fixes: c8902258b2b8 ("fbdev: modedb: Add 1920x1080 at 60 Hz video mode") Cc: stable@vger.kernel.org Signed-off-by: Steffen Persvold <spersvold@gmail.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-06-12Merge tag 'pci-v7.1-fixes-3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull pci fix from Bjorn Helgaas: - Add Frank Li as PCI endpoint reviewer (Frank Li) * tag 'pci-v7.1-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: MAINTAINERS: Add Frank Li as PCI endpoint reviewer
2026-06-12Merge branch 'for-7.2/cxl-type2-attach-region' into cxl-for-nextDave Jiang
cxl: Add dummy function for cxl_memdev_attach_region for !CONFIG_CXL_REGION cxl/region: Introduce devm_cxl_probe_mem() cxl/memdev: Introduce cxl_class_memdev_type cxl/memdev: Pin parents for entire memdev lifetime cxl/region: Resolve region deletion races cxl/region: Block region delete during region creation
2026-06-12cxl: Add dummy function for cxl_memdev_attach_region for !CONFIG_CXL_REGIONDave Jiang
Add a dummy function that returns -EOPNOTSUPP for cxl_memdev_attach_region when CONFIG_CXL_REGION is not enabled. This allow sbuilding when cxl/core/region.o isn't built. Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202606100401.GOjzpKHo-lkp@intel.com/ Fixes: 9b1e70e8f9ec ("cxl/region: Introduce devm_cxl_probe_mem()") Reviewed-by: Alison Schofield <alison.schofield@intel.com> Reviewed-by: Dan Williams <djbw@kernel.org> Link: https://patch.msgid.link/20260610001324.260268-1-dave.jiang@intel.com Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-06-12cxl/region: Introduce devm_cxl_probe_mem()Dan Williams
To date, platform firmware maps accelerator memory and accelerator drivers simply want an address range that they can map themselves. This typically results in a single region being auto-assembled upon registration of a memory device. Use the @attach mechanism of devm_cxl_add_memdev() parameter to retrieve that region while also adhering to CXL subsystem locking and lifetime rules. As part of adhering to current object lifetime rules, if the region or the CXL port topology is invalidated, the CXL core arranges for the accelertor driver to be detached as well. The locking and lifetime rules were validated with Dave's work-in-progress cxl-type-2 support for cxl_test. devm_cxl_add_classdev() supports the general memory expansion flow where region assembly is optional, dynamic, and user controlled. Cc: Alejandro Lucero <alucerop@amd.com> Signed-off-by: Dan Williams <djbw@kernel.org> Reviewed-by: Alejandro Lucero <alucerop@amd.com> Tested-by: Alejandro Lucero <alucerop@amd.com> Reviewed-by: Dave Jiang <dave.jiang@intel.com> Link: https://patch.msgid.link/20260519210158.1499795-6-djbw@kernel.org Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-06-12cxl/memdev: Introduce cxl_class_memdev_typeDan Williams
In preparation for memdev's without mailbox related infrastructure, introduce cxl_class_memdev_type as a superset of a cxl_memdev_type. Effectively the only difference is that cxl_class_memdev_type exports common sysfs attributes where cxl_memdev_type has none. Related to this is all the cxl_mem_probe() paths that assume the presence of a class device mailbox are updated to skip that requirement. Co-developed-by: Alejandro Lucero <alucerop@amd.com> Signed-off-by: Alejandro Lucero <alucerop@amd.com> Signed-off-by: Dan Williams <djbw@kernel.org> Tested-by: ALejandro Lucero <alucerop@amd.com> Reviewed-by: Dave Jiang <dave.jiang@intel.com> Link: https://patch.msgid.link/20260519210158.1499795-5-djbw@kernel.org Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-06-12cxl/memdev: Pin parents for entire memdev lifetimeDan Williams
In order to be able to manage the driver that uses a memdev attach mechanism the parent needs to stick around for the device_release_driver(cxlmd->dev.parent) event. Fixes: 29317f8dc6ed ("cxl/mem: Introduce cxl_memdev_attach for CXL-dependent operation") Signed-off-by: Dan Williams <djbw@kernel.org> Reviewed-by: Alejandro Lucero <alucerop@amd.com> Tested-by: ALejandro Lucero <alucerop@amd.com> Reviewed-by: Dave Jiang <dave.jiang@intel.com> Link: https://patch.msgid.link/20260519210158.1499795-4-djbw@kernel.org Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-06-12cxl/region: Resolve region deletion racesDan Williams
Sungwoo noticed that the sysfs trigger to delete a region may try to delete a region multiple times. It also has no exclusion relative to the kernel releasing the region via CXL root device teardown. Instead of installing new cxl root devres actions per region, use the existing root decoder unregistration event to remove all remaining regions. An xarray of regions replaces a devres list of regions. This handles 3 separate issues with the old approach: 1/ sysfs users racing to delete the same region: no longer possible now that the regions_lock is held over the lookup and deletion. 2/ multiple actions triggering deletion of the same region: solved by erasing regions while holding @regions_lock, and only proceeding on successful erasure. 3/ userspace racing devres_release_all() to trigger the devres not found warning: solved by sysfs unregistration not requiring a release action Fixes: 779dd20cfb56 ("cxl/region: Add region creation support") Reported-by: Sungwoo Kim <iam@sung-woo.kim> Closes: http://lore.kernel.org/20260427032010.916681-2-iam@sung-woo.kim Signed-off-by: Dan Williams <djbw@kernel.org> Reviewed-by: Alejandro Lucero <alucerop@amd.com> Tested-by: ALejandro Lucero <alucerop@amd.com> Reviewed-by: Dave Jiang <dave.jiang@intel.com> Link: https://patch.msgid.link/20260519210158.1499795-3-djbw@kernel.org Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-06-12cxl/region: Block region delete during region creationDan Williams
Expand the range lock, rename it "regions_lock", to disable region deletion in the critical period between construct_region() and attach_target(), as well as the period between device_add() and registering the remove actions. Otherwise, userspace can confuse the kernel. It can violate the assumption the region stays registered through the completion of cxl_add_to_region(). It can violate the assumption that devm_add_action_or_reset() is working with a live 'struct cxl_region'. It is ok for the region to disappear outside of those windows as that mirrors device hotplug flows where the proper locks are held. Fixes: a32320b71f08 ("cxl/region: Add region autodiscovery") Signed-off-by: Dan Williams <djbw@kernel.org> Reviewed-by: Alejandro Lucero <alucerop@amd.com> Tested-by: ALejandro Lucero <alucerop@amd.com> Reviewed-by: Dave Jiang <dave.jiang@intel.com> Link: https://patch.msgid.link/20260519210158.1499795-2-djbw@kernel.org Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-06-12KVM: selftests: access_tracking_perf_test: bump number of NUMA nodes to 32Maxim Levitsky
It's rare to find a system that has more than 4 sockets, but a system can have more than 4 NUMA nodes if each socket exposes its chiplets as separate NUMA nodes. In particular, our CI caught a failure in this test on a system with two sockets, each containing an 'AMD EPYC 7601 32-Core Processor'. Bump the limit to 32, just in case. Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com> Message-ID: <20260612150038.1277394-1-mlevitsk@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-06-12MAINTAINERS: Add Frank Li as PCI endpoint reviewerFrank Li
I have volunteered to review PCI endpoint-related changes. Add myself as a reviewer to be notified when related patches are posted. Signed-off-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Reviewed-by: Krzysztof Wilczyński <kwilczynski@kernel.org> Link: https://patch.msgid.link/20260611210007.529205-1-Frank.Li@oss.nxp.com
2026-06-12docs: pt_BR: Translate 3.Early-stage.rst into PortugueseDaniel Pereira
Translate the documentation file '3.Early-stage.rst' into Portuguese. This section addresses corporate kernel development constraints, the balance between company secrecy and the open-loop approach, and the use of NDAs or Linux Foundation programs to avoid integration issues. Signed-off-by: Daniel Pereira <danielmaraboo@gmail.com> Signed-off-by: Jonathan Corbet <corbet@lwn.net> Message-ID: <20260601192346.192752-1-danielmaraboo@gmail.com>
2026-06-12docs: pt_BR: update "Purpose of Defconfigs" section in maintainer-soc.rstAmanda Corrêa
This update includes the "Purpose of Defconfigs" section translated to Brazilian Portuguese. Signed-off-by: Amanda Corrêa <amandacorreasilvax@gmail.com> Acked-by: Daniel Pereira <danielmaraboo@gmail.com> Signed-off-by: Jonathan Corbet <corbet@lwn.net> Message-ID: <20260604031840.17236-1-amandacorreasilvax@gmail.com>
2026-06-12Documentation: bug-hunting.rst: fix grammarManuel Ebner
Fix a grammar issue to improve readability Signed-off-by: Manuel Ebner <manuelebner@mailbox.org> Acked-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Jonathan Corbet <corbet@lwn.net> Message-ID: <20260605190055.15921-2-manuelebner@mailbox.org>
2026-06-12docs/ja_JP: translate submitting-patches.rst (interleaved-replies)Akiyoshi Kurita
Translate the "Use trimmed interleaved replies in email discussions" and "Don't get discouraged - or impatient" sections in Documentation/translations/ja_JP/process/submitting-patches.rst. Keep the wording close to the English text and wrap lines to match the style used in the surrounding Japanese translation. Signed-off-by: Akiyoshi Kurita <weibu@redadmin.org> Acked-by: Akira Yokosawa <akiyks@gmail.com> Signed-off-by: Jonathan Corbet <corbet@lwn.net> Message-ID: <20260606035954.27605-1-weibu@redadmin.org>
2026-06-12docs: Fix minor grammatical errorBrigham Campbell
Fix minor grammatical error in the administration guide. Signed-off-by: Brigham Campbell <me@brighamcampbell.com> Acked-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Jonathan Corbet <corbet@lwn.net> Message-ID: <20260609070618.12566-1-me@brighamcampbell.com>
2026-06-12docs/{it_it,sp_SP,zh_CN,zh_TW}: update references to removed CONFIG_DEBUG_SLABEthan Nelson-Moore
CONFIG_DEBUG_SLAB was removed in commit 2a19be61a651 ("mm/slab: remove CONFIG_SLAB from all Kconfig and Makefile"), but references to it remained in documentation. The English documentation was updated to refer to CONFIG_SLUB_DEBUG in commit 5969fbf30274 ("docs: submit-checklist: structure by category"), but these translations were never similarly updated. Update them. Discovered while searching for CONFIG_* symbols referenced in the kernel but not defined in any Kconfig file. Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com> Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn> Reviewed-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Jonathan Corbet <corbet@lwn.net> Message-ID: <20260611010014.412841-1-enelsonmoore@gmail.com>
2026-06-12Documentation: process: fix bracketsManuel Ebner
Fix missing ')' and needless ')' Signed-off-by: Manuel Ebner <manuelebner@mailbox.org> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Jonathan Corbet <corbet@lwn.net> Message-ID: <20260611064311.117023-2-manuelebner@mailbox.org>
2026-06-12Documentation: arch: fix bracketsManuel Ebner
Add missing and remove needless parentheses, brackets and curly braces. Fix typos. Signed-off-by: Manuel Ebner <manuelebner@mailbox.org> Reviewed-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Jonathan Corbet <corbet@lwn.net> Message-ID: <20260612095432.177759-2-manuelebner@mailbox.org>
2026-06-12Merge tag 'spi-fix-v7.1-rc7' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A couple of driver specific fixes: a small targeted fix for hardware error handling on DesignWare controllers and another for handling of custom chip select management on Qualcomm GENI controllers" * tag 'spi-fix-v7.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: dw: fix race between IRQ handler and error handler on SMP spi: qcom-geni: Fix cs_change handling on the last transfer
2026-06-12ASoC: don't use array if single patternMark Brown
Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> says: Current ASoC supports snd_soc_daifmt_parse_format() which can specify DAI format by "dai-format" property from DT. But strictly speaking, it is SW settings, so doesn't match to DT's policy. Current ASoC is supporting auto format select via snd_soc_dai_ops :: .auto_selectable_formats. But the user is very few today. DT doesn't need to specify the DAI format via "dai-format", if both CPU and Codec drivers were supporting .auto_selectable_formats. It will be automatically selected from .auto_selectable_formats. But, I noticed that current auto format select method can't handle all cases. For example, current .auto_selectable_formats is like below static u64 xxx_auto_formats[] = { (A) /* First Priority */ SND_SOC_POSSIBLE_DAIFMT_I2S | SND_SOC_POSSIBLE_DAIFMT_LEFT_J | SND_SOC_POSSIBLE_DAIFMT_NB_NF | SND_SOC_POSSIBLE_DAIFMT_NB_IF | (x) SND_SOC_POSSIBLE_DAIFMT_IB_NF | SND_SOC_POSSIBLE_DAIFMT_IB_IF, (x) /* Second Priority */ (B) SND_SOC_POSSIBLE_DAIFMT_DSP_A | (y) SND_SOC_POSSIBLE_DAIFMT_DSP_B, (y) }; It try to find DAI format from (A) first, and next it will use (A | B). But it can't handle the format if some format were independent. For example, DSP_x (y) can't use with xB_IF (x), etc. So, I would like to update the method. New method doesn't use OR. It try to find DAI format from (a), next it will use (b). static u64 xxx_auto_formats[] = { (a) /* First Priority */ SND_SOC_POSSIBLE_DAIFMT_I2S | SND_SOC_POSSIBLE_DAIFMT_LEFT_J | SND_SOC_POSSIBLE_DAIFMT_NB_NF | SND_SOC_POSSIBLE_DAIFMT_NB_IF | SND_SOC_POSSIBLE_DAIFMT_IB_NF | SND_SOC_POSSIBLE_DAIFMT_IB_IF, /* Second Priority */ (b) SND_SOC_POSSIBLE_DAIFMT_DSP_A | SND_SOC_POSSIBLE_DAIFMT_DSP_B | SND_SOC_POSSIBLE_DAIFMT_NB_NF | SND_SOC_POSSIBLE_DAIFMT_IB_NF, }; Switch old method to new method, Current auto select user need to update .auto_selectable_formats. Fortunately, current few users doesn't have above limitation. update (A)(B) to (a)(b) style is possible. a = A b = A | B I would like to update method, and add .auto_selectable_formats support on all drivers. One note is that auto select might not find best format on some CPU/Codec combination. So "dai-format" is necessary anyway. And, there haven't been any big problems on .auto_selectable_formats, because there were few users. But if all drivers try to use this, it cannot be denied that they may encounter unknown problems... In such case, "dai-format" can help, though. Link: https://patch.msgid.link/87v7bs36m0.wl-kuninori.morimoto.gx@renesas.com
2026-06-12ASoC: audio-graph-card2: recommend to use auto select DAI formatKuninori Morimoto
"Simple Audio Card", "Audio Graph Card", "Audio Graph Card2" are possible to set DAI format via DT. OTOH, ASoC is supporting .auto_selectable_formats to select DAI format automatically. Let's recommend to use it on "Audio Graph Card2". One note is that it keeps supporting DAI format setting via DT. Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87ik7s36k2.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-06-12ASoC: update auto format selection methodKuninori Morimoto
Current DAI supports auto format selection. It allow to have array like below. (X) static u64 xxx_auto_formats[] = { (A) /* First Priority */ SND_SOC_POSSIBLE_DAIFMT_I2S | SND_SOC_POSSIBLE_DAIFMT_LEFT_J, /* Second Priority */ (B) SND_SOC_POSSIBLE_DAIFMT_DSP_A | SND_SOC_POSSIBLE_DAIFMT_DSP_B, }; It try to find available format from I2S/LEFT_J first (A). Then, try to find from I2S/LEFT_J/DSP_A/DSP_B if couldn't find (A)+(B). (OR:ed) In this method, it can't handle if there is format combination. For example, some driver has pattern. Pattern1 I2S/RIFHT_J/LEFT_J (FORMAT) and NB_NF/IB_IF/IB_NF/NB_IF (INV)_ Pattern2 DSP_A/DSP_B (FORMAT) and NB_NF/ IB_NF Because it will try to OR Pattern1 and Pattern2, un-supported pattern might be selected. This patch update method not to use OR, and assumes full format array. Above sample (X) need to be static u64 xxx_auto_formats[] = { /* First Priority */ SND_SOC_POSSIBLE_DAIFMT_I2S | SND_SOC_POSSIBLE_DAIFMT_LEFT_J, /* Second Priority */ SND_SOC_POSSIBLE_DAIFMT_I2S | SND_SOC_POSSIBLE_DAIFMT_LEFT_J | SND_SOC_POSSIBLE_DAIFMT_DSP_A | SND_SOC_POSSIBLE_DAIFMT_DSP_B, }; Note: It doesn't support Multi CPU/Codec for now Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87jys836k8.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-06-12ASoC: renesas: rcar: update auto select formatKuninori Morimoto
Current auto select format start with the highest priority format and gradually add lower priority formats one by one, and search matched format. Like A+X -> A+B+X -> A+B+C+X+Y... (a) But in this method, we can't handle format if HW has some kind of patterns, like A+X or B+Y etc (b). Current drivers are using (a) style, this patch switch to use (b) style. This is needed before update auto select format method. Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87ldco36kf.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-06-12ASoC: codecs: pcm3168a: update auto select formatKuninori Morimoto
Current auto select format start with the highest priority format and gradually add lower priority formats one by one, and search matched format. Like A+X -> A+B+X -> A+B+C+X+Y... (a) But in this method, we can't handle format if HW has some kind of patterns, like A+X or B+Y etc (b). Current drivers are using (a) style, this patch switch to use (b) style. This is needed before update auto select format method. Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87mrx436kl.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-06-12ASoC: codecs: ak4619: update auto select formatKuninori Morimoto
Current auto select format start with the highest priority format and gradually add lower priority formats one by one, and search matched format. Like A+X -> A+B+X -> A+B+C+X+Y... (a) But in this method, we can't handle format if HW has some kind of patterns, like A+X or B+Y etc (b). Current drivers are using (a) style, this patch switch to use (b) style. This is needed before update auto select format method. Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87o6hk36kp.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-07-13 20:12:35 +0000