summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-04-06ALSA: gusextreme: add ISA suspend and resume callbacksCássio Gabriel
gusextreme still leaves its ISA PM callbacks disabled because the shared GF1 core had no suspend and resume path suitable for PM recovery. Resume on this board needs one extra step before the shared GF1 path can touch the chip again: the ES1688 side must restore the GF1 routing. Split that routing sequence into a helper, reuse it for probe and resume, reset the ES1688 side first on resume, and then wire the driver up to the shared GUS PM helpers. This restores usable post-resume GF1 operation on GUS Extreme without rerunning probe-only detection in the shared GF1 path. Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260406-b4-alsa-gus-isa-pm-v1-3-b6829a7457cd@gmail.com
2026-04-06ALSA: gusclassic: add ISA suspend and resume callbacksCássio Gabriel
gusclassic still leaves its ISA PM callbacks disabled because the shared GF1 core had no suspend and resume path suitable for PM recovery. Wire the driver up to the new shared GUS suspend and resume helpers so a suspend/resume cycle restores usable GF1 operation without rerunning probe-only detection or tearing down the runtime bookkeeping kept by the card instance. Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260406-b4-alsa-gus-isa-pm-v1-2-b6829a7457cd@gmail.com
2026-04-06ALSA: gus: add shared GF1 suspend and resume helpersCássio Gabriel
gusclassic and gusextreme still leave their ISA PM callbacks disabled because the shared GF1 core only provides probe-time startup and full shutdown paths. Those helpers are not suitable for suspend and resume. They reset software handlers and tear down runtime state such as the DRAM allocator, timer state, DMA queues, PCM state and UART setup. Resume instead needs a narrower recovery path that rebuilds the GF1 hardware state without rerunning probe-only detection or discarding the bookkeeping kept by the card instance. Add shared GF1 suspend and resume helpers for that recovery path. Suspend now quiesces GF1 PCM, aborts queued GF1 DMA work, resets the UART and powers the chip down without tearing down allocator, timer or rawmidi bookkeeping. Resume rebuilds the GF1 hardware state, restores timer and UART handlers, and brings the chip back to a usable post-resume state for the ISA front-ends. The scope is limited to restoring post-resume usability. It does not attempt transparent continuation of active GF1 PCM or synth state across suspend, and userspace may still need to reprepare streams or reload onboard sample data after resume. Open rawmidi substreams are restored only to a usable post-resume state. Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260406-b4-alsa-gus-isa-pm-v1-1-b6829a7457cd@gmail.com
2026-04-06ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10songxiebing
The bass speakers are not working, and add the following entry in /etc/modprobe.d/snd.conf: options snd-sof-intel-hda-generic hda_model=alc287-yoga9-bass-spk-pin Fixes the bass speakers. So add the quick ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN here. Reported-by: Fernando Garcia Corona <fgarcor@gmail.com> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221317 Signed-off-by: songxiebing <songxiebing@kylinos.cn> Link: https://patch.msgid.link/20260405012651.133838-1-songxiebing@kylinos.cn Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-06ALSA: ctxfi: Add fallback to default RSR for S/PDIFHarin Lee
spdif_passthru_playback_get_resources() uses atc->pll_rate as the RSR for the MSR calculation loop. However, pll_rate is only updated in atc_pll_init() and not in hw_pll_init(), so it remains 0 after the card init. When spdif_passthru_playback_setup() skips atc_pll_init() for 32000 Hz, (rsr * desc.msr) always becomes 0, causing the loop to spin indefinitely. Add fallback to use atc->rsr when atc->pll_rate is 0. This reflects the hardware state, since hw_card_init() already configures the PLL to the default RSR. Fixes: 8cc72361481f ("ALSA: SB X-Fi driver merge") Cc: stable@vger.kernel.org Signed-off-by: Harin Lee <me@harin.net> Link: https://patch.msgid.link/20260406074913.217374-1-me@harin.net Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-06ALSA: ctxfi: Limit PTP to a single pageHarin Lee
Commit 391e69143d0a increased CT_PTP_NUM from 1 to 4 to support 256 playback streams, but the additional pages are not used by the card correctly. The CT20K2 hardware already has multiple VMEM_PTPAL registers, but using them separately would require refactoring the entire virtual memory allocation logic. ct_vm_map() always uses PTEs in vm->ptp[0].area regardless of CT_PTP_NUM. On AMD64 systems, a single PTP covers 512 PTEs (2M). When aggregate memory allocations exceed this limit, ct_vm_map() tries to access beyond the allocated space and causes a page fault: BUG: unable to handle page fault for address: ffffd4ae8a10a000 Oops: Oops: 0002 [#1] SMP PTI RIP: 0010:ct_vm_map+0x17c/0x280 [snd_ctxfi] Call Trace: atc_pcm_playback_prepare+0x225/0x3b0 ct_pcm_playback_prepare+0x38/0x60 snd_pcm_do_prepare+0x2f/0x50 snd_pcm_action_single+0x36/0x90 snd_pcm_action_nonatomic+0xbf/0xd0 snd_pcm_ioctl+0x28/0x40 __x64_sys_ioctl+0x97/0xe0 do_syscall_64+0x81/0x610 entry_SYSCALL_64_after_hwframe+0x76/0x7e Revert CT_PTP_NUM to 1. The 256 SRC_RESOURCE_NUM and playback_count remain unchanged. Fixes: 391e69143d0a ("ALSA: ctxfi: Bump playback substreams to 256") Cc: stable@vger.kernel.org Signed-off-by: Harin Lee <me@harin.net> Link: https://patch.msgid.link/20260406074857.216034-1-me@harin.net Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-06ALSA: scarlett2: Add missing sentinel initializer fieldPanagiotis Petrakopoulos
A "-Wmissing-field-initializers" warning was emitted when compiling the module using the W=2 option. There is a sentinel initializer field missing in the end of scarlett2_devices[]. Tested using a Scarlett Solo 4th gen. Fixes: d98cc489029d ("ALSA: scarlett2: Move USB IDs out from device_info struct") Signed-off-by: Panagiotis Petrakopoulos <npetrakopoulos2003@gmail.com> Link: https://patch.msgid.link/20260405222548.8903-1-npetrakopoulos2003@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-06ALSA: hda/realtek: Fix code style errorsongxiebing
Output of checkpatch shows error: ERROR: else should follow close brace '}' 2168: FILE: sound/hda/codecs/realtek/realtek.c:2168: + } + else So fix it. Signed-off-by: songxiebing <songxiebing@kylinos.cn> Link: https://patch.msgid.link/20260405014208.167364-1-songxiebing@kylinos.cn Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-06ALSA: aoa: onyx: Update IEC958 sample-rate status for PCM playbackCássio Gabriel
onyx_prepare() accepts 32/44.1/48 kHz PCM playback, but it leaves the Onyx IEC958 sample-rate status bits at the driver's initial 44.1 kHz setting in DIG_INFO3. As a result, 32 kHz and 48 kHz PCM streams advertise a stale IEC958 sample rate unless userspace rewrites IEC958 Playback Default first. Update only the consumer sample-frequency bits in DIG_INFO3 from the PCM runtime during prepare, resolving the long-standing FIXME in the PCM playback path while leaving the other user-controlled IEC958 status bits unchanged. Mark IEC958 Playback Default as volatile as well, since prepare() now changes the exposed register contents outside the control put callback. Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com> Link: https://patch.msgid.link/20260403-onyx-spdif-pcm-rate-v1-1-dcfaf931cf83@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-06Merge tag 'v7.0-rc7' into usb-nextGreg Kroah-Hartman
We need the USB fixes in here to build on and for testing Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-04-06Merge tag 'v7.0-rc7' into char-misc-nextGreg Kroah-Hartman
We need the char/misc/iio/comedi fixes in here as well for testing Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-04-05perf test: Skip sched stats test for !rootNamhyung Kim
Running perf sched stats requires root and it fails to open the schedstat file for regular users. Let's skip the test. $ perf sched stats true Failed to open /proc/sys/kernel/sched_schedstats Reviewed-by: Ian Rogers <irogers@google.com> Tested-by: Swapnil Sapkal <swapnil.sapkal@amd.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-04-05perf cgroup: Update metric leader in evlist__expand_cgroupIan Rogers
When the evlist is expanded the metric leader wasn't being updated. As the original evsel is deleted this creates a use-after-free in stat-shadow's prepare_metric. This was detected running the "perf stat --bpf-counters --for-each-cgroup test" with sanitizers. The change itself puts the copied evsel into the priv field (known unused because of evsel__clone use) and then in a second pass over the list updates the copied values using the priv pointer. Fixes: d1c5a0e86a4e ("perf stat: Add --for-each-cgroup option") Signed-off-by: Ian Rogers <irogers@google.com> Acked-by: Sun Jian <sun.jian.kdev@gmail.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-04-05perf sample: Add evsel to struct perf_sampleIan Rogers
Add the evsel from evsel__parse_sample into the struct perf_sample. Sometimes we want to alter the evsel associated with a sample, such as with off-cpu bpf-output events. In general the evsel and perf_sample are passed as a pair, but this makes an altered evsel something of a chore to keep checking for and setting up. Later patches will remove passing an evsel with the perf_sample and switch to just using the perf_sample's value. Signed-off-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-04-05perf sample: Make sure perf_sample__init/exit are usedIan Rogers
The deferred stack trace code wasn't using perf_sample__init/exit. Add the deferred stack trace clean up to perf_sample__exit which requires proper NULL initialization in perf_sample__init. Make the perf_sample__exit robust to being called more than once by using zfree. Make the error paths in evsel__parse_sample exit the sample. Add a merged_callchain boolean to capture that callchain is allocated, deferred_callchain doen't suffice for this. Pack the struct variables to avoid padding bytes for this. Similiarly powerpc_vpadtl_sample wasn't using perf_sample__init/exit, use it for consistency and potential issues with uninitialized variables. Similarly guest_session__inject_events in builtin-inject wasn't using perf_sample_init/exit. The lifetime management for fetched events is somewhat complex there, but when an event is fetched the sample should be initialized and needs exiting on error. The sample may be left in place so that future injects have access to it. Signed-off-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-04-05perf sample: Document struct perf_sampleIan Rogers
Add kernel-doc for struct perf_sample capturing the somewhat unusual population of fields and lifetime relationships. Signed-off-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-04-05perf tools: Save cln_size headerRicky Ringler
Store cacheline size during perf record in header, so that cacheline size can be used for other features, like sort keys for perf report. Testing example with feat enabled: $ perf record ./Example $ perf report --header-only | grep -C 3 cacheline CPU_DOMAIN_INFO info available, use -I to display e_machine : 62 e_flags : 0 cacheline size: 64 missing features: TRACING_DATA BUILD_ID BRANCH_STACK GROUP_DESC AUXTRACE \ STAT CLOCKID DIR_FORMAT COMPRESSED CLOCK_DATA ======== [namhyung: Update the commit message and remove blank lines] Signed-off-by: Ricky Ringler <ricky.ringler@proton.me> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-04-05perf tests sched stats: Write output to temp fileIan Rogers
Writing to the perf.data file can fail in various contexts such as continual test. Other tests write to a mktemp-ed file, make the "perf sched stats tests" follow this convention. Signed-off-by: Ian Rogers <irogers@google.com> Tested-by: Swapnil Sapkal <swapnil.sapkal@amd.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-04-05perf sched: Avoid crash for unexpected perf sched stats reportNamhyung Kim
Doing a `perf sched record` then `perf sched stats report` crashes as the tp_handler isn't set. Add a dummy tp_handler for it rather than adding an extra check. Reported-by: Ian Rogers <irogers@google.com> Reviewed-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-04-06RISC-V: KVM: Fix shift-out-of-bounds in make_xfence_request()Jiakai Xu
The make_xfence_request() function uses a shift operation to check if a vCPU is in the hart mask: if (!(hmask & (1UL << (vcpu->vcpu_id - hbase)))) However, when the difference between vcpu_id and hbase is >= BITS_PER_LONG, the shift operation causes undefined behavior. This was detected by UBSAN: UBSAN: shift-out-of-bounds in arch/riscv/kvm/tlb.c:343:23 shift exponent 256 is too large for 64-bit type 'long unsigned int' Fix this by adding a bounds check before the shift operation. This bug was found by fuzzing the KVM RISC-V interface. Fixes: 13acfec2dbcc ("RISC-V: KVM: Add remote HFENCE functions based on VCPU requests") Signed-off-by: Jiakai Xu <jiakaiPeanut@gmail.com> Signed-off-by: Jiakai Xu <xujiakai2025@iscas.ac.cn> Reviewed-by: Andrew Jones <andrew.jones@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260403232011.2394966-1-xujiakai2025@iscas.ac.cn Signed-off-by: Anup Patel <anup@brainfault.org>
2026-04-06md: fix array_state=clear sysfs deadlockYu Kuai
When "clear" is written to array_state, md_attr_store() breaks sysfs active protection so the array can delete itself from its own sysfs store method. However, md_attr_store() currently drops the mddev reference before calling sysfs_unbreak_active_protection(). Once do_md_stop(..., 0) has made the mddev eligible for delayed deletion, the temporary kobject reference taken by sysfs_break_active_protection() can become the last kobject reference protecting the md kobject. That allows sysfs_unbreak_active_protection() to drop the last kobject reference from the current sysfs writer context. kobject teardown then recurses into kernfs removal while the current sysfs node is still being unwound, and lockdep reports recursive locking on kn->active with kernfs_drain() in the call chain. Reproducer on an existing level: 1. Create an md0 linear array and activate it: mknod /dev/md0 b 9 0 echo none > /sys/block/md0/md/metadata_version echo linear > /sys/block/md0/md/level echo 1 > /sys/block/md0/md/raid_disks echo "$(cat /sys/class/block/sdb/dev)" > /sys/block/md0/md/new_dev echo "$(($(cat /sys/class/block/sdb/size) / 2))" > \ /sys/block/md0/md/dev-sdb/size echo 0 > /sys/block/md0/md/dev-sdb/slot echo active > /sys/block/md0/md/array_state 2. Wait briefly for the array to settle, then clear it: sleep 2 echo clear > /sys/block/md0/md/array_state The warning looks like: WARNING: possible recursive locking detected bash/588 is trying to acquire lock: (kn->active#65) at __kernfs_remove+0x157/0x1d0 but task is already holding lock: (kn->active#65) at sysfs_unbreak_active_protection+0x1f/0x40 ... Call Trace: kernfs_drain __kernfs_remove kernfs_remove_by_name_ns sysfs_remove_group sysfs_remove_groups __kobject_del kobject_put md_attr_store kernfs_fop_write_iter vfs_write ksys_write Restore active protection before mddev_put() so the extra sysfs kobject reference is dropped while the mddev is still held alive. The actual md kobject deletion is then deferred until after the sysfs write path has fully returned. Fixes: 9e59d609763f ("md: call del_gendisk in control path") Reviewed-by: Xiao Ni <xni@redhat.com> Link: https://lore.kernel.org/linux-raid/20260330055213.3976052-1-yukuai@fnnas.com/ Signed-off-by: Yu Kuai <yukuai@fnnas.com>
2026-04-05bpf: Fix stale offload->prog pointer after constant blindingMingTao Huang
When a dev-bound-only BPF program (BPF_F_XDP_DEV_BOUND_ONLY) undergoes JIT compilation with constant blinding enabled (bpf_jit_harden >= 2), bpf_jit_blind_constants() clones the program. The original prog is then freed in bpf_jit_prog_release_other(), which updates aux->prog to point to the surviving clone, but fails to update offload->prog. This leaves offload->prog pointing to the freed original program. When the network namespace is subsequently destroyed, cleanup_net() triggers bpf_dev_bound_netdev_unregister(), which iterates ondev->progs and calls __bpf_prog_offload_destroy(offload->prog). Accessing the freed prog causes a page fault: BUG: unable to handle page fault for address: ffffc900085f1038 Workqueue: netns cleanup_net RIP: 0010:__bpf_prog_offload_destroy+0xc/0x80 Call Trace: __bpf_offload_dev_netdev_unregister+0x257/0x350 bpf_dev_bound_netdev_unregister+0x4a/0x90 unregister_netdevice_many_notify+0x2a2/0x660 ... cleanup_net+0x21a/0x320 The test sequence that triggers this reliably is: 1. Set net.core.bpf_jit_harden=2 (echo 2 > /proc/sys/net/core/bpf_jit_harden) 2. Run xdp_metadata selftest, which creates a dev-bound-only XDP program on a veth inside a netns (./test_progs -t xdp_metadata) 3. cleanup_net -> page fault in __bpf_prog_offload_destroy Dev-bound-only programs are unique in that they have an offload structure but go through the normal JIT path instead of bpf_prog_offload_compile(). This means they are subject to constant blinding's prog clone-and-replace, while also having offload->prog that must stay in sync. Fix this by updating offload->prog in bpf_jit_prog_release_other(), alongside the existing aux->prog update. Both are back-pointers to the prog that must be kept in sync when the prog is replaced. Fixes: 2b3486bc2d23 ("bpf: Introduce device-bound XDP programs") Signed-off-by: MingTao Huang <mintaohuang@tencent.com> Link: https://lore.kernel.org/r/tencent_BCF692F45859CCE6C22B7B0B64827947D406@qq.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-05selftests/bpf: remove unused toggle in tc_tunnelAlexis Lothoré (eBPF Foundation)
tc_tunnel test is based on a send_and_test_data function which takes a subtest configuration, and a boolean indicating whether the connection is supposed to fail or not. This boolean is systematically passed to true, and is a remnant from the first (not integrated) attempts to convert tc_tunnel to test_progs: those versions validated for example that a connection properly fails when only one side of the connection has tunneling enabled. This specific testing has not been integrated because it involved large timeouts which increased quite a lot the test duration, for little added value. Remove the unused boolean from send_and_test_data to simplify the generic part of subtests. Signed-off-by: Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com> Acked-by: Paul Chaignon <paul.chaignon@gmail.com> Link: https://lore.kernel.org/r/20260403-tc_tunnel_cleanup-v1-1-4f1bb113d3ab@bootlin.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-05Merge branch 'bpf-fix-end-of-list-detection-in-cgroup_storage_get_next_key'Alexei Starovoitov
Weiming Shi says: ==================== bpf: fix end-of-list detection in cgroup_storage_get_next_key() list_next_entry() never returns NULL, so the NULL check in cgroup_storage_get_next_key() is dead code. When iterating past the last element, the function reads storage->key from a bogus pointer that aliases internal map fields and copies the result to userspace. Patch 1 replaces the NULL check with list_entry_is_head() so the function correctly returns -ENOENT when there are no more entries. Patch 2 adds a selftest to cover this corner case, as suggested by Sun Jian and Paul Chaignon. v2: - Added selftest (Paul Chaignon) - Collected Reviewed-by and Acked-by tags ==================== Link: https://patch.msgid.link/20260403132951.43533-1-bestswngs@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-05selftests/bpf: add get_next_key boundary test for cgroup_storageWeiming Shi
Verify that bpf_map__get_next_key() correctly returns -ENOENT when called on the last (and only) key in a cgroup_storage map. Before the fix in the previous patch, this would succeed with bogus key data instead of failing. Suggested-by: Paul Chaignon <paul.chaignon@gmail.com> Signed-off-by: Weiming Shi <bestswngs@gmail.com> Acked-by: Paul Chaignon <paul.chaignon@gmail.com> Link: https://lore.kernel.org/r/20260403132951.43533-3-bestswngs@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-05bpf: fix end-of-list detection in cgroup_storage_get_next_key()Weiming Shi
list_next_entry() never returns NULL -- when the current element is the last entry it wraps to the list head via container_of(). The subsequent NULL check is therefore dead code and get_next_key() never returns -ENOENT for the last element, instead reading storage->key from a bogus pointer that aliases internal map fields and copying the result to userspace. Replace it with list_entry_is_head() so the function correctly returns -ENOENT when there are no more entries. Fixes: de9cbbaadba5 ("bpf: introduce cgroup storage maps") Reported-by: Xiang Mei <xmei5@asu.edu> Signed-off-by: Weiming Shi <bestswngs@gmail.com> Reviewed-by: Sun Jian <sun.jian.kdev@gmail.com> Acked-by: Paul Chaignon <paul.chaignon@gmail.com> Link: https://lore.kernel.org/r/20260403132951.43533-2-bestswngs@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-05Merge branch 'bpf-fix-torn-writes-in-non-prealloc-htab-with-bpf_f_lock'Alexei Starovoitov
Mykyta Yatsenko says: ==================== bpf: Fix torn writes in non-prealloc htab with BPF_F_LOCK A torn write issue was reported in htab_map_update_elem() with BPF_F_LOCK on hash maps. The BPF_F_LOCK fast path performs a lockless lookup and copies the value under the element's embedded spin_lock. A concurrent delete can free the element via bpf_mem_cache_free(), which allows immediate reuse. When alloc_htab_elem() recycles the same memory, it writes the value with plain copy_map_value() without taking the spin_lock, racing with the stale lock holder and producing torn writes. Patch 1 fixes alloc_htab_elem() to use copy_map_value_locked() when BPF_F_LOCK is set. Patch 2 adds a selftest that reliably detects the torn writes on an unpatched kernel. Reported-by: Aaron Esau <aaron1esau@gmail.com> Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com> ==================== Link: https://patch.msgid.link/20260401-bpf_map_torn_writes-v1-0-782d071c55e7@meta.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-05selftests/bpf: Add torn write detection test for htab BPF_F_LOCKMykyta Yatsenko
Add a consistency subtest to htab_reuse that detects torn writes caused by the BPF_F_LOCK lockless update racing with element reallocation in alloc_htab_elem(). The test uses three thread roles started simultaneously via a pipe: - locked updaters: BPF_F_LOCK|BPF_EXIST in-place updates - delete+update workers: delete then BPF_ANY|BPF_F_LOCK insert - locked readers: BPF_F_LOCK lookup checking value consistency Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com> Link: https://lore.kernel.org/r/20260401-bpf_map_torn_writes-v1-2-782d071c55e7@meta.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-05bpf: Use copy_map_value_locked() in alloc_htab_elem() for BPF_F_LOCKMykyta Yatsenko
When a BPF_F_LOCK update races with a concurrent delete, the freed element can be immediately recycled by alloc_htab_elem(). The fast path in htab_map_update_elem() performs a lockless lookup and then calls copy_map_value_locked() under the element's spin_lock. If alloc_htab_elem() recycles the same memory, it overwrites the value with plain copy_map_value(), without taking the spin_lock, causing torn writes. Use copy_map_value_locked() when BPF_F_LOCK is set so the new element's value is written under the embedded spin_lock, serializing against any stale lock holders. Fixes: 96049f3afd50 ("bpf: introduce BPF_F_LOCK flag") Reported-by: Aaron Esau <aaron1esau@gmail.com> Closes: https://lore.kernel.org/all/CADucPGRvSRpkneb94dPP08YkOHgNgBnskTK6myUag_Mkjimihg@mail.gmail.com/ Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com> Link: https://lore.kernel.org/r/20260401-bpf_map_torn_writes-v1-1-782d071c55e7@meta.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-05ARM: dts: imx: Add DT overlays for DH i.MX6 DHCOM SoM and boardsMarek Vasut
Add DT overlays to support DH i.MX6 DHCOM SoM carrier board expansion modules. The following DT overlays are implemented: - PDK2: - DH 497-200 Display board in edge connector X12 - DH 505-200 Display board in edge connector X12 - DH 531-100 SPI/I2C board in header X21 - DH 531-200 SPI/I2C board in header X22 - DH 560-200 Display board in edge connector X12 - PicoITX: - DH 626-100 Display board in edge connector X2 Signed-off-by: Marek Vasut <marex@nabladev.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-04-05ARM: dts: imx6sx: remove fallback compatible string fsl,imx28-lcdifFrank Li
The i.MX6SX LCDIF is not fully compatible with the i.MX28 LCDIF. The i.MX6SX controller provides additional overlay registers (AS_CTRL) which are not present on i.MX28. Linux has supported the dedicated compatible string since commit 45d59d704080 ("drm: Add new driver for MXSFB controller"). Other known DT users such as U-Boot and Barebox already support "fsl,imx6sx-lcdif", so removing the fallback compatible string is low risk since this device is used for display output only. Fix the following CHECK_DTB warning: /arch/arm/boot/dts/nxp/imx/imx6sx-nitrogen6sx.dtb: lcdif@2220000 (fsl,imx6sx-lcdif): compatible: 'oneOf' conditional failed, one must be fixed: ['fsl,imx6sx-lcdif', 'fsl,imx28-lcdif'] is too long Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-04-05ARM: dts: imx25: rename node name tcq to touchscreenFrank Li
Rename node name tcq to touchscreen to fix below CHECK_DTBS warnings: arch/arm/boot/dts/nxp/imx/imx25-karo-tx25.dtb: tscadc@50030000 (fsl,imx25-tsadc): 'tcq@50030400' does not match any of the regexes: '^adc@[0-9a-f]+$', '^pinctrl-[0-9]+$', '^touchscreen@[0-9a-f]+$' from schema $id: http://devicetree.org/schemas/mfd/fsl,imx25-tsadc.yaml Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-04-05ARM: dts: imx: b850v3: Disable unused usdhc4Ian Ray
Disable the unused interface, to fix print an error message during boot: mmc3: Failed to initialize a non-removable card Signed-off-by: Ian Ray <ian.ray@gehealthcare.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-04-05ARM: dts: imx: b850v3: Define GPIO line namesIan Ray
Define GPIO line names for gpio4. Signed-off-by: Ian Ray <ian.ray@gehealthcare.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-04-05ARM: dts: imx: b850v3: Use alphabetical sortingIan Ray
Use alphabetical sorting of references modification. Signed-off-by: Ian Ray <ian.ray@gehealthcare.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-04-05ARM: dts: imx: bx50v3: Configure phy-mode to eliminate a warningIan Ray
Set `phy-mode' on network switch CPU ports to eliminate a warning: mv88e6085 gpio-0:00: OF node /mdio-gpio/switch@0/ports/port@4 of CPU port 4 lacks the required "phy-mode" property Signed-off-by: Ian Ray <ian.ray@gehealthcare.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-04-05ARM: dts: imx: bx50v3: Configure switch PHY max-speed to 100MbpsIan Ray
Configure maximum speed for the switch PHYs according to the electrical connections from PHY to RJ45 connector. Signed-off-by: Ian Ray <ian.ray@gehealthcare.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-04-05ARM: dts: imx7ulp: Add CPU clock and OPP table supportPeng Fan
Add missing CPU clock definitions and operating-points-v2 table for the Cortex-A7 on i.MX7ULP to enable proper CPU frequency scaling and integration with the cpufreq/OPP frameworks. Signed-off-by: Peng Fan <peng.fan@nxp.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-04-05ARM: dts: imx7-mba7: Deassert BOOT_EN after bootAlexander Feilke
Deassert BOOT_EN after boot to separate BOOT_CFG circuits from LCD signals. Signed-off-by: Alexander Feilke <Alexander.Feilke@ew.tq-group.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-04-05ARM: dts: tqma7: add boot phase propertiesAlexander Feilke
dtschema/schemas/bootph.yaml describe various node usage during boot phases with DT. Adds boot phase properties to essential resources in tqma7 device trees. This includes UART, SD-Card, eMMC and QSPI. Signed-off-by: Alexander Feilke <Alexander.Feilke@ew.tq-group.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-04-05ARM: dts: imx7s: add boot phase propertiesAlexander Feilke
dtschema/schemas/bootph.yaml describe various node usage during boot phases with DT. Adds boot phase properties to essential resources in imx7s device trees. This includes the buses aips1-3, iomuxc and SOC access. Signed-off-by: Alexander Feilke <Alexander.Feilke@ew.tq-group.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-04-05ARM: dts: tqma6ul[l]: correct spelling of TQ-SystemsMax Merchel
TQ-Systems is written with a hyphen. Correct the spelling. Signed-off-by: Max Merchel <Max.Merchel@ew.tq-group.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-04-05ARM: dts: mba6ulx: add boot phase propertiesMax Merchel
dtschema/schemas/bootph.yaml describe various node usage during boot phases with DT. MBa6ULx need regulator, SD-Card, UART and watchdog access during boot process. Signed-off-by: Max Merchel <Max.Merchel@ew.tq-group.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-04-05ARM: dts: imx6ul[l]-tqma6ul[l]: add boot phase propertiesMax Merchel
dtschema/schemas/bootph.yaml describe various node usage during boot phases with DT. TQMa6UL need eMMC, I2C, GPIO and QSPI access during boot process. Signed-off-by: Max Merchel <Max.Merchel@ew.tq-group.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-04-05ARM: dts: imx6ul/imx6ull: add boot phase propertiesMax Merchel
dtschema/schemas/bootph.yaml describe various node usage during boot phases with DT. All SoCs require buses (aips and spba), clock, iomuxc and SOC access during boot process. Signed-off-by: Max Merchel <Max.Merchel@ew.tq-group.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-04-05ARM: dts: imx6qdl-mba6: add boot phase propertiesMax Merchel
dtschema/schemas/bootph.yaml describe various node usage during boot phases with DT. MBa6 need I2C, GPIO, SD-Card, UART and watchdog access during boot process. Signed-off-by: Max Merchel <Max.Merchel@ew.tq-group.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-04-05ARM: dts: imx6qdl-tqma6: add boot phase propertiesMax Merchel
dtschema/schemas/bootph.yaml describe various node usage during boot phases with DT. TQMa6 need eMMC, I2C, GPIO, regulator and QSPI access during boot process. Signed-off-by: Max Merchel <Max.Merchel@ew.tq-group.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-04-05ARM: dts: imx6qdl: add boot phase propertiesMax Merchel
dtschema/schemas/bootph.yaml describe various node usage during boot phases with DT. All SoCs require buses (aips and spba), clock, iomuxc, ipu and SOC access during boot process. Signed-off-by: Max Merchel <Max.Merchel@ew.tq-group.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-04-05ARM: dts: imx6qdl-tqma6: add missing labelsMax Merchel
Add the missing labels for the temperature sensor and the EEPROM. In SoM variants A and B, the components are connected to different I2C buses. These labels are needed to reference them in subsequent device trees. Signed-off-by: Max Merchel <Max.Merchel@ew.tq-group.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-04-05ARM: dts: imx: add required clocks and clock-names for ccmFrank Li
Add required clocks and clock-names for ccm to fix below CHECK_DTBS warnings: arch/arm/boot/dts/nxp/imx/imx6dl-alti6p.dtb: clock-controller@20c4000 (fsl,imx6q-ccm): clock-names:0: 'osc' was expected from schema $id: http://devicetree.org/schemas/clock/imx6q-clock.yaml# Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com> Reviewed-by: Peng Fan <peng.fan@nxp.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
generated by cgit v1.2.3 (git 2.25.1) at 2026-09-14 21:02:54 +0000