summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-08-11KVM: arm64: Drop %pB on nVHE panic when stage-2 is activeVincent Donnefort
With pKVM, the host stage-2 is lazily mapped. kallsyms, accessed via the modifier %pB is therefore potentially unmapped. If the hyp panic occurred while the host stage-2 lock was held, handling this fault deadlocks. Skip %pB formatting unless the host stage-2 is disabled. Fixes: 6ccf9cb557bd ("KVM: arm64: Symbolize the nVHE HYP addresses") Signed-off-by: Vincent Donnefort <vdonnefort@google.com> Reviewed-by: Fuad Tabba <fuad.tabba@linux.dev> Tested-by: Fuad Tabba <fuad.tabba@linux.dev> Link: https://patch.msgid.link/20260803093906.3531699-1-vdonnefort@google.com Signed-off-by: Oliver Upton <oupton@kernel.org>
2026-08-11KVM: arm64: vgic: Reset in_kernel on private IRQ allocation failureFuad Tabba
kvm_vgic_create() sets vgic.in_kernel before allocating the per-vCPU private IRQs, but the allocation-failure path resets only vgic_model and leaves in_kernel set. As irqchip_in_kernel() is !!in_kernel, the VM is left with an in-kernel irqchip but no model, and the -EEXIST guard at the top of kvm_vgic_create() rejects every retry, so userspace cannot recover from a transient -ENOMEM. Reset in_kernel alongside vgic_model on the failure path. Fixes: 9435c1e1431003 ("KVM: arm64: gic: Set vgic_model before initing private IRQs") Cc: stable@vger.kernel.org Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev> Acked-by: Marc Zyngier <maz@kernel.org> Link: https://patch.msgid.link/20260802150845.3485757-1-fuad.tabba@linux.dev Signed-off-by: Oliver Upton <oupton@kernel.org>
2026-08-11KVM: arm64: GICv2: Don't WARN on out-of-range GICV_DIR INTIDKarl Mehltretter
vgic_v2_deactivate() passes the INTID a guest wrote to GICV_DIR straight to vgic_get_vcpu_irq(), and treats a failed lookup as a "can't happen" condition with WARN_ON_ONCE(). The guest can make it happen at will, though: for any INTID outside of the implemented SGI, PPI and SPI ranges the lookup returns NULL, since GICv2 has no LPIs. A guest running with EOImode==1 writing such an INTID to GICV_DIR triggers the WARN, and panics hosts running with panic_on_warn. Drop the WARN and ignore failed lookups. Fixes: 255de897e7fb ("KVM: arm64: GICv2: Handle deactivation via GICV_DIR traps") Cc: stable@vger.kernel.org Suggested-by: Marc Zyngier <maz@kernel.org> Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Link: https://patch.msgid.link/20260726174803.5880-1-kmehltretter@gmail.com Signed-off-by: Oliver Upton <oupton@kernel.org>
2026-08-11KVM: arm64: Preserve GPRs for AArch32 CP64 reads generating an UNDEFKarl Mehltretter
kvm_handle_cp_64() only seeds params.regval for writes. If a CP64 read is decoded but UNDEFs, emulate_cp() still returns handled and the caller writes params.regval back to Rt/Rt2. This can happen for PMU counter read accesses generating an UNDEF. KVM injects the exception into the guest, so the MRRC GPRs must remain unchanged. Instead, the uninitialised regval is copied into the guest GPRs. With stack auto-initialisation this is a deterministic zero or pattern value. With CONFIG_INIT_STACK_NONE it may be stale host stack data. Match kvm_handle_cp_32() and kvm_handle_sys_reg() by seeding regval from the GPRs before emulation. Fixes: 62a89c44954f0 ("arm64: KVM: 32bit handling of coprocessor traps") Assisted-by: Claude:claude-opus-5 Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Reviewed-by: Marc Zyngier <maz@kernel.org> Link: https://patch.msgid.link/20260802182222.2239-1-kmehltretter@gmail.com Signed-off-by: Oliver Upton <oupton@kernel.org>
2026-08-11RDMA/ucma: Lock the handler in ucma_set_ib_path()Norbert Szetei
ucma_set_ib_path() calls ucma_event_handler() straight from the write() path, without the handler lock that keeps ctx->file stable while a uevent is queued. The handler re-reads ctx->file for every dereference: mutex_lock(&ctx->file->mut); /* file A */ list_add_tail(&uevent->list, &ctx->file->event_list); /* file B */ mutex_unlock(&ctx->file->mut); /* file B */ wake_up_interruptible(&ctx->file->poll_wait); /* file B */ A concurrent ucma_migrate_id() reassigns ctx->file while the SET_OPTION caller sleeps in mutex_lock(), so the list_add_tail() lands on file B's event_list while only file A's mutex is held, racing every other user of that list: BUG: KASAN: slab-use-after-free in __list_add_valid_or_report+0x1aa/0x1c0 Read of size 8 at addr ffff888153c6a418 by task poc_corr/486 Call Trace: __list_add_valid_or_report+0x1aa/0x1c0 ucma_event_handler+0x1be/0xc00 ucma_set_ib_path+0x45e/0x710 ucma_set_option+0x32e/0x590 ucma_write+0x1f9/0x330 Allocated by task 505: ucma_write_cm_event+0x1a1/0x660 Freed by task 505: kfree+0x1da/0x4c0 ucma_get_event+0x5d5/0x7e0 The freed object is a ucma_event that another thread dequeued from file B's list under file B's mutex. File A's mut is left held on top of that, wedging its next writer in uninterruptible sleep. This path needs a bound and address-resolved cm_id, so it requires an RDMA device to be present. Take the handler lock around the call. Fixes: 09e328e47a69 ("RDMA/ucma: Fix the locking of ctx->file") Link: https://patch.msgid.link/r/2823D190-92D5-4714-8769-4FB643C64FF3@doyensec.com Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-5 Signed-off-by: Norbert Szetei <norbert@doyensec.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-08-11RDMA/ucma: Lock the handler in ucma_write_cm_event()Norbert Szetei
ctx->file may only be changed under the handler lock and the xa_lock, which is what stops uevents being queued for a ctx while ucma_migrate_id() moves it to another file. The CM core takes that lock before invoking ucma_event_handler(), but the write() paths that queue uevents themselves do not. ucma_write_cm_event() re-reads ctx->file for each of its four dereferences, so ucma_migrate_id() can swap it mid-sequence: mutex_lock(&ctx->file->mut); /* file A */ list_add_tail(&uevent->list, &ctx->file->event_list); /* file B */ mutex_unlock(&ctx->file->mut); /* file B */ wake_up_interruptible(&ctx->file->poll_wait); /* file B */ The window is the mutex_lock() itself: the writer sleeps in it while the migration reassigns ctx->file. The list_add_tail() then runs on file B's event_list holding only file A's mutex: list_add corruption. prev->next should be next (ffff888101320f30), but was ffff88814a08c418. (prev=ffff88814a075c18). kernel BUG at lib/list_debug.c:32! Call Trace: ucma_write_cm_event+0x36e/0x5e0 and file A's mut is left held forever, wedging its next writer in D state. The uevent is also stranded on a list ucma_cleanup_ctx_events() will not walk, so it outlives its context. /dev/infiniband/rdma_cm is 0666 and no RDMA device is involved, so an unprivileged user reaches all of this. Take the handler lock, as ucma_cleanup_mc_events() does; ctx->cm_id is pinned by the ucma_get_ctx() reference. Fixes: a3c9d0fcd371 ("RDMA/ucma: Support write an event into a CM") Link: https://patch.msgid.link/r/60544A67-EFD6-4D5D-974C-D983445F1070@doyensec.com Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-5 Signed-off-by: Norbert Szetei <norbert@doyensec.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-08-11nvme: ratelimit the completion-path messages driven by device dataChao Shi
nvme_find_rq() and nvme_handle_cqe() print an unratelimited message for every completion queue entry whose command id does not resolve to an in-flight request. Both are reached from the completion interrupt path (nvme_irq() -> nvme_poll_cq() -> nvme_handle_cqe()) and the decision to print is made entirely from device-supplied data, so a controller that posts a stream of bogus command ids drives unbounded printk from hard interrupt context. This is not hypothetical. A single boot under an emulated controller that posts invalid completions produced 846 "could not locate request for tag 0x0", 846 "invalid id 0 completed on queue 2" and 123 "genctr mismatch" lines. Once the tag set has been torn down every subsequent completion resolves to nothing, so the print rate is bounded only by how fast the device can post entries. Ratelimit the three messages. The information they carry is diagnostic and repeats, so the suppression count printed by the ratelimit helpers is enough to tell that the condition persists. This matches how the other device-driven error prints in the driver are already handled, for example the status messages in nvme_log_error() and nvme_log_err_passthru(). nvme_find_rq() lives in nvme.h and is shared by pci, tcp, rdma, apple and target-loop, so all transports are covered. Found by FuzzNvme. Signed-off-by: Chao Shi <coshi036@gmail.com> Signed-off-by: Keith Busch <kbusch@kernel.org>
2026-08-11MAINTAINERS: Add Manivannan Sadhasivam as the Reviewer for Generic PHY FrameworkManivannan Sadhasivam
I'm volunteering to review the PHY patches. Hence, add myself as the Reviewer. Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Link: https://patch.msgid.link/20260811143417.336664-1-mani@kernel.org Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-08-11phy: rockchip-samsung-dcphy: fix out-of-range max_registerJason Yang
The PHY register block is 64KB, so with a register stride of 4 the last accessible register sits at offset 0xfffc. max_register names 0x10000, one register past the end of the mapping: dumping the registers through the regmap debugfs interface reads beyond the ioremapped region and oopses on the unmapped page. The oops fires with the regmap lock held, so later PHY operations deadlock. Fixes: b2a1a2ae7818 ("phy: rockchip: Add Samsung MIPI D-/C-PHY driver") Cc: stable@vger.kernel.org Signed-off-by: Jason Yang <jason98166@gmail.com> Assisted-by: Claude:claude-opus-5 Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com> Link: https://patch.msgid.link/20260811-dcphy-maxreg-v1-v1-1-aa63f6a63a64@gmail.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-08-11phy: qcom: qmp-pcie: Add QMP PCIe Multi-PHY driverQiang Yu
Some QMP PCIe PHY hardware blocks support multiple link topologies (e.g. x8 or x4+x4) selected via a TCSR register. The existing single-instance QMP PCIe PHY driver has no way to model this: it assumes a single cfg per DT node and instantiates exactly one PHY. Add a dedicated driver for this class of PHY. Match data carries a per-mode cfg table; qmp_pcie_multiphy_probe() reads the current link mode from the TCSR register pointed to by "qcom,link-mode", looks up the corresponding cfg array, and instantiates one qmp_pcie per sub-PHY required by that link mode, registering the clock and #phy-cells = <1> phy providers so consumers can address individual sub-PHYs by index. The driver inherits the phy setting and link-mode programmed by firmware, so only the no_csr reset is used and no phy setting tables are provided. Add the first match data and compatible, qcom,glymur-qmp-gen5x8-pcie-phy, for the Glymur Gen5 PCIe PHY that can bifurcate into two x4 links or operate as a single x8 link. Reviewed-by: Manivannan Sadhasivam <mani@kernel.org> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Qiang Yu <qiang.yu@oss.qualcomm.com> Link: https://patch.msgid.link/20260807-glymur_linkmode_0807-v9-2-dd1c7e236e29@oss.qualcomm.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-08-11dt-bindings: phy: qcom: Add Glymur QMP PCIe multiple link-mode PHYQiang Yu
Add qcom,glymur-qmp-gen5x8-pcie-phy.yaml as a standalone binding for the Glymur Gen5 PCIe PHY hardware block. This block supports two link modes, selected at runtime via a TCSR syscon register: 1. x8 - a single 8-lane PHY instance is exposed 2. x4+x4 - two independent 4-lane PHY instances are exposed Keep this as a separate schema from qcom,sc8280xp-qmp-pcie-phy.yaml rather than folding it into the shared compatible list there, since the two PHY instances active in x8 mode require twice as many clocks, resets, and power-domains as any other entry in that file, and adding Glymur-specific properties like qcom,link-mode and reg-names there would only apply to this one compatible. Document the required clocks, resets, and power-domains for both PHY instances, and use #phy-cells = <1>, where the cell value is the PHY index within the active link mode. Acked-by: Manivannan Sadhasivam <mani@kernel.org> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Qiang Yu <qiang.yu@oss.qualcomm.com> Link: https://patch.msgid.link/20260807-glymur_linkmode_0807-v9-1-dd1c7e236e29@oss.qualcomm.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-08-11phy: rockchip: samsung-hdptx: Consistently use bitfield macrosCristian Ciocaltea
Make the code more robust and improve readability by using the available bitfield macros (e.g. FIELD_PREP, FIELD_GET) whenever possible, instead of open coding the related bit operations. Tested-by: Thomas Niederprüm <dubito@online.de> Tested-by: Simon Wright <simon@symple.nz> Tested-by: Diederik de Haas <diederik@cknow-tech.com> # NanoPC-T6 LTS Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com> Link: https://patch.msgid.link/20260811-hdptx-clk-fixes-v6-10-75bca0ee5753@collabora.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-08-11phy: rockchip: samsung-hdptx: Simplify GRF access with FIELD_PREP_WM16()Cristian Ciocaltea
The 16 most significant bits of the general-purpose register (GRF) are used as a write-enable mask for the remaining 16 bits. Make use of the recently introduced FIELD_PREP_WM16() macro to avoid open-coding the bit shift operations and improve code readability. Tested-by: Thomas Niederprüm <dubito@online.de> Tested-by: Simon Wright <simon@symple.nz> Tested-by: Diederik de Haas <diederik@cknow-tech.com> # NanoPC-T6 LTS Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com> Link: https://patch.msgid.link/20260811-hdptx-clk-fixes-v6-9-75bca0ee5753@collabora.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-08-11phy: rockchip: samsung-hdptx: Drop restrict_rate_change handlingCristian Ciocaltea
Since commit 6efbd0f46dd8 ("phy: rockchip: samsung-hdptx: Restrict altering TMDS char rate via CCF"), adjusting the rate via the Common Clock Framework API has been disallowed. To avoid breaking existing users until switching to the PHY config API, it introduced a temporary exception to the rule, controlled via the 'restrict_rate_change' flag. As the API transition completed, remove the now deprecated exception logic. Tested-by: Thomas Niederprüm <dubito@online.de> Tested-by: Simon Wright <simon@symple.nz> Tested-by: Diederik de Haas <diederik@cknow-tech.com> # NanoPC-T6 LTS Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com> Link: https://patch.msgid.link/20260811-hdptx-clk-fixes-v6-8-75bca0ee5753@collabora.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-08-11phy: rockchip: samsung-hdptx: Consolidate consumer_put on error pathCristian Ciocaltea
rk_hdptx_phy_consumer_put() is invoked in both branches of the mode check conditional in rk_hdptx_phy_power_on() on the error path. Simplify the code by moving the single call to the end of the function. No functional change intended. Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com> Link: https://patch.msgid.link/20260811-hdptx-clk-fixes-v6-7-75bca0ee5753@collabora.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-08-11phy: rockchip: samsung-hdptx: Drop TMDS rate setup workaroundCristian Ciocaltea
Since commit ba9c2fe18c17 ("drm/rockchip: dw_hdmi_qp: Switch to phy_configure()") the TMDS rate setup doesn't rely anymore on the unconventional usage of the bus width, instead it is managed exclusively through the HDMI PHY configuration API. Drop the now obsolete workaround to retrieve the TMDS character rate via phy_get_bus_width() during power_on(). Tested-by: Thomas Niederprüm <dubito@online.de> Tested-by: Simon Wright <simon@symple.nz> Tested-by: Diederik de Haas <diederik@cknow-tech.com> # NanoPC-T6 LTS Reviewed-by: Andy Yan <andy.yan@rock-chips.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com> Link: https://patch.msgid.link/20260811-hdptx-clk-fixes-v6-6-75bca0ee5753@collabora.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-08-11phy: rockchip: samsung-hdptx: Handle uncommitted PHY config changesCristian Ciocaltea
Any changes to the PHY link rate and/or color depth done via the HDMI PHY configuration API are not immediately programmed into the hardware, but are delayed until the PHY usage count gets incremented from 0 to 1, that is when it is powered on or when the PLL clock exposed through the CCF API is prepared, whichever comes first. Since the clock might remain in prepared state after subsequent PHY config changes, the programming can also be triggered via clk_ops.set_rate(). However, from the clock consumer perspective (i.e. VOP2 display controller), the (pixel) clock rate doesn't vary with bpc, as that is handled internally by the PHY and reflected in the TDMS character rate only. As a consequence, changing the bpc while preserving the modeline may lead to out-of-sync issues between CCF and HDMI PHY config state, because the .set_rate() callback is not invoked when clock rate remains constant. This may also happen when the PHY PLL has been pre-programmed by an external entity, e.g. the bootloader, which is actually a regression introduced by the recent FRL-related changes. Introduce a pll_config_dirty flag to keep track of uncommitted PHY config changes and use it in clk_ops.determine_rate() to invalidate the current clock rate (as known by CCF) and, consequently, ensure those changes are programmed into hardware via clk_ops.set_rate(). Moreover, proceed with a similar fix in phy_ops.power_on() callback, to handle the scenario where the CCF API is not used due to operating in FRL mode, while the clock is still in a prepared state and thus preventing rk_hdptx_phy_consumer_get() to apply the updated PHY configuration. Fixes: de5dba833118 ("phy: rockchip: samsung-hdptx: Add HDMI 2.1 FRL support") Fixes: 9d0ec51d7c22 ("phy: rockchip: samsung-hdptx: Add high color depth management") Tested-by: Thomas Niederprüm <dubito@online.de> Tested-by: Simon Wright <simon@symple.nz> Tested-by: Diederik de Haas <diederik@cknow-tech.com> # NanoPC-T6 LTS Reviewed-by: Andy Yan <andy.yan@rock-chips.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com> Link: https://patch.msgid.link/20260811-hdptx-clk-fixes-v6-5-75bca0ee5753@collabora.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-08-11phy: rockchip: samsung-hdptx: Fix rate recalculation for 3.2GHz FRLCristian Ciocaltea
rk_hdptx_phy_clk_calc_rate_from_pll_cfg() is currently unable to handle cascade mode for the 3.2GHz FRL operating mode, as it relies solely on LCPLL_LCVCO_MODE_EN_MASK to determinate the rate from the rk_hdptx_frl_lcpll_cfg array. Since there is no entry for this particular rate, the function returns 0. This is the only rate which requires LC_REF_CLK_SEL to be set in GRF_HDPTX_CON0, hence extend the FRL matching accordingly. Reported-by: Sashiko <sashiko-bot@kernel.org> Closes: https://sashiko.dev/#/patchset/20260611-hdptx-clk-fixes-v3-0-67b1b0c00e16@collabora.com?part=1 Fixes: de5dba833118 ("phy: rockchip: samsung-hdptx: Add HDMI 2.1 FRL support") Tested-by: Diederik de Haas <diederik@cknow-tech.com> # NanoPC-T6 LTS Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Andy Yan <andy.yan@rock-chips.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com> Link: https://patch.msgid.link/20260811-hdptx-clk-fixes-v6-4-75bca0ee5753@collabora.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-08-11phy: rockchip: samsung-hdptx: Guard against clk rate integer underflowCristian Ciocaltea
The 'fout' subtraction in rk_hdptx_phy_clk_calc_rate_from_pll_cfg() could result in an integer underflow, if the hardware registers are misconfigured or contain uninitialized values, such that the computed sigma-delta modulator offset sdm exceeds the base frequency fout. This might lead to an absurdly high clock rate being returned to the Common Clock Framework, with unpredictable effects on downstream clk consumers. Provide the necessary sanitization to avoid trusting the hardware state. Reported-by: Sashiko <sashiko-bot@kernel.org> Closes: https://lore.kernel.org/all/20260611235702.0E9691F000E9@smtp.kernel.org/ Fixes: 3481fc04d969 ("phy: rockchip: samsung-hdptx: Compute clk rate from PLL config") Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com> Link: https://patch.msgid.link/20260811-hdptx-clk-fixes-v6-3-75bca0ee5753@collabora.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-08-11phy: rockchip: samsung-hdptx: Prevent divide-by-zero when computing clk rateCristian Ciocaltea
Calculating 'sdm' fraction in rk_hdptx_phy_clk_calc_rate_from_pll_cfg() could trigger a divide-by-zero, as it uses div_u64() with a denominator read directly from hardware: the values ropll_hw.sdm_deno, ropll_hw.sdc_deno, ropll_hw.sdc_n, and ropll_hw.sdc_num are populated from PLL registers which, in theory, could be left by the bootloader uninitialized/misconfigured. Provide the necessary sanitization to avoid trusting the hardware state. Reported-by: Sashiko <sashiko-bot@kernel.org> Closes: https://sashiko.dev/#/patchset/20260611-hdptx-clk-fixes-v3-0-67b1b0c00e16@collabora.com?part=1 Fixes: 3481fc04d969 ("phy: rockchip: samsung-hdptx: Compute clk rate from PLL config") Tested-by: Diederik de Haas <diederik@cknow-tech.com> # NanoPC-T6 LTS Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Andy Yan <andy.yan@rock-chips.com> Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com> Link: https://patch.msgid.link/20260811-hdptx-clk-fixes-v6-2-75bca0ee5753@collabora.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-08-11phy: rockchip: samsung-hdptx: Fix rate recalculation for high bpcCristian Ciocaltea
The PHY PLL can be programmed by an external component, e.g. the bootloader, just before the recalc_rate() callback is invoked during devm_clk_hw_register() in the probe path. Therefore rk_hdptx_phy_clk_recalc_rate() finds the PLL enabled and attempts to compute the clock rate, while making use of the bpc value from the HDMI PHY configuration, which always defaults to 8 because phy_configure() was not run at that point. As a consequence, the (re)calculated rate is incorrect when the actual bpc was higher than 8. Do not rely on any of the hdmi_cfg members when computing the clock rate and, instead, read the required input data (i.e. bpc), directly from the hardware registers. Fixes: 3481fc04d969 ("phy: rockchip: samsung-hdptx: Compute clk rate from PLL config") Tested-by: Thomas Niederprüm <dubito@online.de> Tested-by: Simon Wright <simon@symple.nz> Tested-by: Diederik de Haas <diederik@cknow-tech.com> # NanoPC-T6 LTS Reviewed-by: Andy Yan <andyshrk@gmail.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com> Link: https://patch.msgid.link/20260811-hdptx-clk-fixes-v6-1-75bca0ee5753@collabora.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-08-11docs: conf.py: fix the 'utf-8' typoRandy Dunlap
"encoding" should be 'utf-8'. Fix the typo. Fixes: 7ea9a550f710 ("docs: conf.py: several coding style fixes") Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Jonathan Corbet <corbet@lwn.net> Message-ID: <20260806051115.1235789-1-rdunlap@infradead.org>
2026-08-11doc tools: fix 'path' typosRandy Dunlap
Correct "patch" or "patches" to "path" or "paths" in comments. Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Jonathan Corbet <corbet@lwn.net> Message-ID: <20260806055634.1293294-1-rdunlap@infradead.org>
2026-08-11Documentation: real-time: Add kernel configuration guideAhmed S. Darwish
Add a configuration guide for real-time kernels. List all Kconfig options that are recommended to be either enabled or disabled. Explicitly add a table of contents at the top of the document, so that all the options can be seen in a glance. Whenever appropriate, link to other kernel guides; e.g. cpuidle, cpufreq, power management, workqueues, and no_hz. Add a summary at the end of the document warning users that there is no "one size fits all solution" for configuring a real-time system. Signed-off-by: Ahmed S. Darwish <darwi@linutronix.de> Signed-off-by: Jonathan Corbet <corbet@lwn.net> Message-ID: <20260804141541.747704-2-darwi@linutronix.de>
2026-08-11docs: python: abi_regex: convert adjacent index placeholdersAlison Schofield
While validating recent CXL ABI documentation updates with get_abi.py, every decoderX.Y entry was reported as undocumented. The placeholder conversion mishandles adjacent index placeholders, producing patterns that cannot match the corresponding sysfs paths. As a result, valid ABI entries are reported as undocumented. Handle adjacent placeholders independently so generated patterns match the documented paths. This fixes decoderX.Y entries in the CXL ABI and other ABI documentation that uses the same naming convention. Signed-off-by: Alison Schofield <alison.schofield@intel.com> Signed-off-by: Jonathan Corbet <corbet@lwn.net> Message-ID: <cc893dca3aaa3ec833ba70d1f32c3e7342b7faf2.1786139549.git.alison.schofield@intel.com>
2026-08-11docs: python: abi_regex: catch the right exception for a bad regexAlison Schofield
While validating recent CXL ABI documentation updates with get_abi.py, the 'undefined' mode was found to abort instead of reporting undocumented ABI entries. Older Python releases raise re.error, while newer releases expose re.PatternError. Catching the compatible re.error exception handles both cases. Use re.error so the scan continues and reports the remaining results. Signed-off-by: Alison Schofield <alison.schofield@intel.com> Signed-off-by: Jonathan Corbet <corbet@lwn.net> Message-ID: <9f6fa7a9aa6ba9a26b484b911976713356b3fd44.1786139549.git.alison.schofield@intel.com>
2026-08-11drm/sched: Mark fair policy as experimentalTvrtko Ursulin
Mark the fair policy as experimental until reported regressions are addressed. Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Cc: Luke.Wildhardt@proton.me Cc: Matthew Brost <matthew.brost@intel.com> Cc: Danilo Krummrich <dakr@kernel.org> Cc: Philipp Stanner <phasta@kernel.org> Cc: Christian König <ckoenig.leichtzumerken@gmail.com> Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net> Link: https://lore.kernel.org/r/20260811163139.99746-20-tvrtko.ursulin@igalia.com
2026-08-11Revert "drm/sched: Switch default policy to fair"Tvrtko Ursulin
This reverts commit 45c211ddf92a1f9b4214ffadaf70d9037f53aaf6. Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Cc: Luke.Wildhardt@proton.me Cc: Matthew Brost <matthew.brost@intel.com> Cc: Danilo Krummrich <dakr@kernel.org> Cc: Philipp Stanner <phasta@kernel.org> Cc: Christian König <ckoenig.leichtzumerken@gmail.com> Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net> Link: https://lore.kernel.org/r/20260811163139.99746-19-tvrtko.ursulin@igalia.com
2026-08-11Revert "drm/sched: Remove FIFO and RR and simplify to a single run queue"Tvrtko Ursulin
This reverts commit 77a6809f1dc39376116f8d769a0d2630dc95ad79. Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Cc: Luke.Wildhardt@proton.me Cc: Matthew Brost <matthew.brost@intel.com> Cc: Danilo Krummrich <dakr@kernel.org> Cc: Philipp Stanner <phasta@kernel.org> Cc: Christian König <ckoenig.leichtzumerken@gmail.com> Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net> Link: https://lore.kernel.org/r/20260811163139.99746-18-tvrtko.ursulin@igalia.com
2026-08-11Revert "drm/sched: Embed run queue singleton into the scheduler"Tvrtko Ursulin
This reverts commit 16e7698bc04d3dd19d95a688e4b0297a0e28a93b. Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Cc: Luke.Wildhardt@proton.me Cc: Matthew Brost <matthew.brost@intel.com> Cc: Danilo Krummrich <dakr@kernel.org> Cc: Philipp Stanner <phasta@kernel.org> Cc: Christian König <ckoenig.leichtzumerken@gmail.com> Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net> Link: https://lore.kernel.org/r/20260811163139.99746-17-tvrtko.ursulin@igalia.com
2026-08-11Revert "accel/amdxdna: Remove drm_sched_init_args->num_rqs usage"Tvrtko Ursulin
This reverts commit ac58121339db0178186d256a956bb65feb8b6e45. Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Cc: Luke.Wildhardt@proton.me Cc: Matthew Brost <matthew.brost@intel.com> Cc: Danilo Krummrich <dakr@kernel.org> Cc: Philipp Stanner <phasta@kernel.org> Cc: Christian König <ckoenig.leichtzumerken@gmail.com> Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net> Link: https://lore.kernel.org/r/20260811163139.99746-16-tvrtko.ursulin@igalia.com
2026-08-11Revert "accel/rocket: Remove drm_sched_init_args->num_rqs usage"Tvrtko Ursulin
This reverts commit 4f335bba019958e59c2a02c4d71b72a8457cc595. Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Cc: Luke.Wildhardt@proton.me Cc: Matthew Brost <matthew.brost@intel.com> Cc: Danilo Krummrich <dakr@kernel.org> Cc: Philipp Stanner <phasta@kernel.org> Cc: Christian König <ckoenig.leichtzumerken@gmail.com> Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net> Link: https://lore.kernel.org/r/20260811163139.99746-15-tvrtko.ursulin@igalia.com
2026-08-11Revert "accel/ethosu: Remove drm_sched_init_args->num_rqs usage"Tvrtko Ursulin
This reverts commit 06879a9ad55bc4a7aa2e1bb7ee9fa658cdddee79. Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Cc: Luke.Wildhardt@proton.me Cc: Matthew Brost <matthew.brost@intel.com> Cc: Danilo Krummrich <dakr@kernel.org> Cc: Philipp Stanner <phasta@kernel.org> Cc: Christian König <ckoenig.leichtzumerken@gmail.com> Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net> Link: https://lore.kernel.org/r/20260811163139.99746-14-tvrtko.ursulin@igalia.com
2026-08-11Revert "drm/amdgpu: Remove drm_sched_init_args->num_rqs usage"Tvrtko Ursulin
This reverts commit 2462a0ce23b0ba1c2195beccf39bc8608cdbd84e. Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Cc: Luke.Wildhardt@proton.me Cc: Matthew Brost <matthew.brost@intel.com> Cc: Danilo Krummrich <dakr@kernel.org> Cc: Philipp Stanner <phasta@kernel.org> Cc: Christian König <ckoenig.leichtzumerken@gmail.com> Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net> Link: https://lore.kernel.org/r/20260811163139.99746-13-tvrtko.ursulin@igalia.com
2026-08-11Revert "drm/etnaviv: Remove drm_sched_init_args->num_rqs usage"Tvrtko Ursulin
This reverts commit adfb5deba567045d74bfd75482b8d4f89d073004. Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Cc: Luke.Wildhardt@proton.me Cc: Matthew Brost <matthew.brost@intel.com> Cc: Danilo Krummrich <dakr@kernel.org> Cc: Philipp Stanner <phasta@kernel.org> Cc: Christian König <ckoenig.leichtzumerken@gmail.com> Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net> Link: https://lore.kernel.org/r/20260811163139.99746-12-tvrtko.ursulin@igalia.com
2026-08-11Revert "drm/imagination: Remove drm_sched_init_args->num_rqs usage"Tvrtko Ursulin
This reverts commit f84d73d2a08498174d950ba5935930dd94df7d3c. Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Cc: Luke.Wildhardt@proton.me Cc: Matthew Brost <matthew.brost@intel.com> Cc: Danilo Krummrich <dakr@kernel.org> Cc: Philipp Stanner <phasta@kernel.org> Cc: Christian König <ckoenig.leichtzumerken@gmail.com> Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net> Link: https://lore.kernel.org/r/20260811163139.99746-11-tvrtko.ursulin@igalia.com
2026-08-11Revert "drm/lima: Remove drm_sched_init_args->num_rqs usage"Tvrtko Ursulin
This reverts commit 098fe077ec029a1c8ded65af3c2b2a4190d93e9d. Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Cc: Luke.Wildhardt@proton.me Cc: Matthew Brost <matthew.brost@intel.com> Cc: Danilo Krummrich <dakr@kernel.org> Cc: Philipp Stanner <phasta@kernel.org> Cc: Christian König <ckoenig.leichtzumerken@gmail.com> Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net> Link: https://lore.kernel.org/r/20260811163139.99746-10-tvrtko.ursulin@igalia.com
2026-08-11Revert "drm/msm: Remove drm_sched_init_args->num_rqs usage"Tvrtko Ursulin
This reverts commit 9c44ff055965f2f75eee2ac95a7692600cf026a8. Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Cc: Luke.Wildhardt@proton.me Cc: Matthew Brost <matthew.brost@intel.com> Cc: Danilo Krummrich <dakr@kernel.org> Cc: Philipp Stanner <phasta@kernel.org> Cc: Christian König <ckoenig.leichtzumerken@gmail.com> Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net> Link: https://lore.kernel.org/r/20260811163139.99746-9-tvrtko.ursulin@igalia.com
2026-08-11Revert "drm/nouveau: Remove drm_sched_init_args->num_rqs usage"Tvrtko Ursulin
This reverts commit 79005e34bdcbb4a0b7f512bc32981fb60041767b. Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Cc: Luke.Wildhardt@proton.me Cc: Matthew Brost <matthew.brost@intel.com> Cc: Danilo Krummrich <dakr@kernel.org> Cc: Philipp Stanner <phasta@kernel.org> Cc: Christian König <ckoenig.leichtzumerken@gmail.com> Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net> Link: https://lore.kernel.org/r/20260811163139.99746-8-tvrtko.ursulin@igalia.com
2026-08-11Revert "drm/panfrost: Remove drm_sched_init_args->num_rqs usage"Tvrtko Ursulin
This reverts commit 285eab7f55ae3d961bfa4e759c3d2d0033e72294. Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Cc: Luke.Wildhardt@proton.me Cc: Matthew Brost <matthew.brost@intel.com> Cc: Danilo Krummrich <dakr@kernel.org> Cc: Philipp Stanner <phasta@kernel.org> Cc: Christian König <ckoenig.leichtzumerken@gmail.com> Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net> Link: https://lore.kernel.org/r/20260811163139.99746-7-tvrtko.ursulin@igalia.com
2026-08-11Revert "drm/panthor: Remove drm_sched_init_args->num_rqs usage"Tvrtko Ursulin
This reverts commit 30c4a19cf71f040462254dcb8b2d3c3e7232b99b. Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Cc: Luke.Wildhardt@proton.me Cc: Matthew Brost <matthew.brost@intel.com> Cc: Danilo Krummrich <dakr@kernel.org> Cc: Philipp Stanner <phasta@kernel.org> Cc: Christian König <ckoenig.leichtzumerken@gmail.com> Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net> Link: https://lore.kernel.org/r/20260811163139.99746-6-tvrtko.ursulin@igalia.com
2026-08-11Revert "drm/sched: Remove drm_sched_init_args->num_rqs usage"Tvrtko Ursulin
This reverts commit 2833a0512b4cd55d9fea7ec18be85ef82e69ad3b. Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Cc: Luke.Wildhardt@proton.me Cc: Matthew Brost <matthew.brost@intel.com> Cc: Danilo Krummrich <dakr@kernel.org> Cc: Philipp Stanner <phasta@kernel.org> Cc: Christian König <ckoenig.leichtzumerken@gmail.com> Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net> Link: https://lore.kernel.org/r/20260811163139.99746-5-tvrtko.ursulin@igalia.com
2026-08-11Revert "drm/v3d: Remove drm_sched_init_args->num_rqs usage"Tvrtko Ursulin
This reverts commit a1bf9381fc62f3c4e26a2caedb8317046383a559. Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Cc: Luke.Wildhardt@proton.me Cc: Matthew Brost <matthew.brost@intel.com> Cc: Danilo Krummrich <dakr@kernel.org> Cc: Philipp Stanner <phasta@kernel.org> Cc: Christian König <ckoenig.leichtzumerken@gmail.com> Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net> Link: https://lore.kernel.org/r/20260811163139.99746-4-tvrtko.ursulin@igalia.com
2026-08-11Revert "drm/xe: Remove drm_sched_init_args->num_rqs usage"Tvrtko Ursulin
This reverts commit 4ca491d6ccf2daea813e67ed4b42e7b272f0687d. Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Cc: Luke.Wildhardt@proton.me Cc: Matthew Brost <matthew.brost@intel.com> Cc: Danilo Krummrich <dakr@kernel.org> Cc: Philipp Stanner <phasta@kernel.org> Cc: Christian König <ckoenig.leichtzumerken@gmail.com> Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net> Link: https://lore.kernel.org/r/20260811163139.99746-3-tvrtko.ursulin@igalia.com
2026-08-11Revert "drm/sched: Remove drm_sched_init_args->num_rqs"Tvrtko Ursulin
This reverts commit d09339388b778f04dd9e638befa2594c9cb4290b. Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Cc: Luke.Wildhardt@proton.me Cc: Matthew Brost <matthew.brost@intel.com> Cc: Danilo Krummrich <dakr@kernel.org> Cc: Philipp Stanner <phasta@kernel.org> Cc: Christian König <ckoenig.leichtzumerken@gmail.com> Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net> Link: https://lore.kernel.org/r/20260811163139.99746-2-tvrtko.ursulin@igalia.com
2026-08-11f2fs: call __add_ino_entry out of the eviction pathJaegeuk Kim
The f2fs_evict_inode() can be called during the direct reclaim path, but __add_ino_entry requires allocating some memory. Since we don't need to do that in that context, let's migrate it in other workqueue context. Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2026-08-11ALSA: seq: Don't leak the extension cell pointer in the bounce payloadHyeongJun An
The bounce_error_event() embeds the failed event in the bounce payload by pointing data.ext.ptr at it. When that event is a queued variable-length event, its own data.ext.ptr holds the address of its first extension cell, put there by snd_seq_event_dup(). The payload goes out verbatim through snd_seq_expand_var_event(), so the address reaches userspace. That is the same address commit 705dd6dcbc0e ("ALSA: seq: Clear variable event pointer on read") removed from the event header. The read path still clears it there, just above the call that expands the payload. Embed a sanitised copy instead, treated exactly as snd_seq_read() treats the header. A stack copy is enough because delivery is synchronous and snd_seq_event_dup() copies before returning. An unprivileged client reaches this by setting SNDRV_SEQ_FILTER_BOUNCE, queueing a variable-length event to a port that does not exist and reading the bounce back. Eight bytes on 64-bit, from its own pool. Fixes: efc86691e4d8 ("ALSA: seq: Fix kernel heap address leak in bounce_error_event()") Assisted-by: Claude:claude-opus-5 Signed-off-by: HyeongJun An <sammiee5311@gmail.com> Link: https://patch.msgid.link/20260811131835.3837024-1-sammiee5311@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-08-11dt-bindings: PCI: Correct white-space styleKrzysztof Kozlowski
Correct a few white-space issues, like double space after '=' or before bracket '{' characters, which will be flagged by dt-check-style. No functional changes. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Reviewed-by: Marek Vasut <marek.vasut+renesas@mailbox.org> Acked-by: Rob Herring (Arm) <robh@kernel.org> Link: https://patch.msgid.link/20260801195517.235161-2-krzysztof.kozlowski@oss.qualcomm.com
2026-08-11ASoC: Intel: NVL: Add entry for HDMI-In capture support to non-I2S codec boards.Balamurugan C
Adding HDMI-In capture support for the NVL products which doesn't have onboard I2S codec. But need to support HDMI-In capture via I2S and audio playback through HDMI/DP monitor. Signed-off-by: Balamurugan C <balamurugan.c@intel.com> Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com> Link: https://patch.msgid.link/20260811005354.2884137-1-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-11nfc: st95hf: switch to using sleeping variants of gpiod APIDmitry Torokhov
The driver does not use gpiod API calls in an atomic context. Switch to gpiod_set_value_cansleep() calls to allow using the driver with GPIO controllers that might need process context to operate. Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Link: https://patch.msgid.link/amPsnh9wDIG2CeSi@google.com Signed-off-by: David Heidelberg <david@ixit.cz>