summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-03-29nfsd: add a runtime switch for disabling delegated timestampsJeff Layton
The delegated timestamp code seems to be working well enough now that we want to make it always be built in. In the event that there are problems though, we still want to be able to disable them for debugging purposes. Add a switch to debugfs to enable them at runtime. Signed-off-by: Jeff Layton <jlayton@kernel.org> Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
2026-03-29SUNRPC: Replace KUnit tests for memcmp() with KUNIT_EXPECT_MEMEQ_MSG()Ryota Sakamoto
Replace KUnit tests for memcmp() with KUNIT_EXPECT_MEMEQ_MSG() to improve debugging that prints the hex dump of the buffers when the assertion fails, whereas memcmp() only returns an integer difference. Signed-off-by: Ryota Sakamoto <sakamo.ryota@gmail.com> Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
2026-03-29NFSD: Track SCSI Persistent Registration Fencing per Client with xarrayDai Ngo
When a client holding pNFS SCSI layouts becomes unresponsive, the server revokes access by preempting the client's SCSI persistent reservation key. A layout recall is issued for each layout the client holds; if the client fails to respond, each recall triggers a fence operation. The first preempt for a given device succeeds and removes the client's key registration. Subsequent preempts for the same device fail because the key is no longer registered. Update the NFS server to handle SCSI persistent registration fencing on a per-client and per-device basis by utilizing an xarray associated with the nfs4_client structure. Each xarray entry is indexed by the dev_t of a block device registered by the client. The entry maintains a flag indicating whether this device has already been fenced for the corresponding client. When the server issues a persistent registration key to a client, it creates a new xarray entry at the dev_t index with the fenced flag initialized to 0. Before performing a fence via nfsd4_scsi_fence_client, the server checks the corresponding entry using the device's dev_t. If the fenced flag is already set, the fence operation is skipped; otherwise, the flag is set to 1 and fencing proceeds. The xarray is destroyed when the nfs4_client is released in __destroy_client. Signed-off-by: Dai Ngo <dai.ngo@oracle.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
2026-03-29sunrpc/cache: improve RCU safety in cache_list walking.NeilBrown
1/ consistently use hlist_add_head_rcu() when adding to the cachelist to reflect the fact that it can be concurrently walked using RCU. In fact hlist_add_head() has all the needed barriers so this is no safety issue, primarily a clarity issue. 2/ call cache_get() *before* adding the list with hlist_add_head_rcu(). It is generally safest to inc the refcount before publishing a reference. In this case it doesn't have any behavioural effect as code which does an RCU walk does not depend on precision of the refcount, and it will always be at least one. But it looks more correct to use this order. 3/ avoid possible races between NULL tests and hlist_entry_safe() calls. It is possible that a test will find that .next or .head is not NULL, but hlist_entry_safe() will find that it is NULL. This can lead to incorrect behaviour with the list-walk terminating early. It is safest to always call hlist_entry_safe() and test the result. Also simplify the *ppos calculation by simply assigning the hash shifted 32, rather than masking out low bits and incrementing high bits. Signed-off-by: NeilBrown <neil@brown.name> Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
2026-03-29nfsd/sunrpc: move rq_cachetype into struct nfsd_thread_local_infoJeff Layton
The svc_rqst->rq_cachetype field is only accessed by nfsd. Move it into the nfsd_thread_local_info instead. Signed-off-by: Jeff Layton <jlayton@kernel.org> Reviewed-by: Benjamin Coddington <bcodding@hammerspace.com> Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
2026-03-29nfsd/sunrpc: add svc_rqst->rq_private pointer and remove rq_lease_breakerJeff Layton
rq_lease_breaker has always been a NFSv4 specific layering violation in svc_rqst. The reason it's there though is that we need a place that is thread-local, and accessible from the svc_rqst pointer. Add a new rq_private pointer to struct svc_rqst. This is intended for use by the threads that are handling the service. sunrpc code doesn't touch it. In nfsd, define a new struct nfsd_thread_local_info. nfsd declares one of these on the stack and puts a pointer to it in rq_private. Add a new ntli_lease_breaker field to the new struct and convert all of the places that access rq_lease_breaker to use the new field instead. Signed-off-by: Jeff Layton <jlayton@kernel.org> Reviewed-by: Benjamin Coddington <bcodding@hammerspace.com> Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
2026-03-30kbuild: rust: provide an option to inline C helpers into RustGary Guo
A new experimental Kconfig option, `RUST_INLINE_HELPERS` is added to allow C helpers (which were created to allow Rust to call into inline/macro C functions without having to re-implement the logic in Rust) to be inlined into Rust crates without performing global LTO. If the option is enabled, the following is performed: * For helpers, instead of compiling them to an object file to be linked into vmlinux, they're compiled to LLVM IR bitcode. Two versions are generated: one for built-in code (`helpers.bc`) and one for modules (`helpers_module.bc`, with -DMODULE defined). This ensures that C macros/inlines that behave differently for modules (e.g. static calls) function correctly when inlined. * When a Rust crate or object is compiled, instead of generating an object file, LLVM bitcode is generated. * llvm-link is invoked with --internalize to combine the helper bitcode with the crate bitcode. This step is similar to LTO, but this is much faster since it only needs to inline the helpers. * clang is invoked to turn the combined bitcode into a final object file. * Since clang may produce LLVM bitcode when LTO is enabled, and objtool requires ELF input, $(cmd_ld_single) is invoked to ensure the object is converted to ELF before objtool runs. The --internalize flag tells llvm-link to treat all symbols in helpers.bc using `internal` linkage [1]. This matches the behavior of `clang` on `static inline` functions, and avoids exporting the symbol from the object file. To ensure that RUST_INLINE_HELPERS is not incompatible with BTF, we pass the -g0 flag when building helpers. See commit 5daa0c35a1f0 ("rust: Disallow BTF generation with Rust + LTO") for details. We have an intended triple mismatch of `aarch64-unknown-none` vs `aarch64-unknown-linux-gnu`, so we pass --suppress-warnings to llvm-link to suppress it. I considered adding some sort of check that KBUILD_MODNAME is not present in helpers_module.bc, but this is actually not so easy to carry out because .bc files store strings in a weird binary format, so you cannot just grep it for a string to check whether it ended up using KBUILD_MODNAME anywhere. [ Andreas writes: For the rnull driver, enabling helper inlining with this patch gives an average speedup of 2% over the set of 120 workloads that we publish on [2]. Link: https://rust-for-linux.com/null-block-driver [2] This series also uncovered a pre-existing UB instance thanks to an `objtool` warning which I noticed while testing the series (details in the mailing list). - Miguel ] Link: https://github.com/llvm/llvm-project/pull/170397 [1] Co-developed-by: Boqun Feng <boqun.feng@gmail.com> Signed-off-by: Boqun Feng <boqun.feng@gmail.com> Co-developed-by: Matthew Maurer <mmaurer@google.com> Signed-off-by: Matthew Maurer <mmaurer@google.com> Signed-off-by: Gary Guo <gary@garyguo.net> Co-developed-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Alice Ryhl <aliceryhl@google.com> Reviewed-by: Nathan Chancellor <nathan@kernel.org> Tested-by: Nathan Chancellor <nathan@kernel.org> Tested-by: Andreas Hindborg <a.hindborg@kernel.org> Reviewed-by: Andreas Hindborg <a.hindborg@kernel.org> Link: https://patch.msgid.link/20260203-inline-helpers-v2-3-beb8547a03c9@google.com [ Some changes, apart from the rebase: - Added "(EXPERIMENTAL)" to Kconfig as the commit mentions. - Added `depends on ARM64 || X86_64` and `!UML` for now, since this is experimental, other architectures may require other changes (e.g. the issues I mentioned in the mailing list for ARM and UML) and they are not really tested so far. So let arch maintainers pick this up if they think it is worth it. - Gated the `cmd_ld_single` step also into the new mode, which also means that any possible future `objcopy` step is done after the translation, as expected. - Added `.gitignore` for `.bc` with exception for existing script. - Added `part-of-*` for helpers bitcode files as discussed, and dropped `$(if $(filter %_module.bc,$@),-DMODULE)` since `-DMODULE` is already there (would be duplicated otherwise). - Moved `LLVM_LINK` to keep binutils list alphabetized. - Fixed typo in title. - Dropped second `cmd_ld_single` commit message paragraph. - Miguel ] Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-03-30rust: helpers: #define __rust_helperGary Guo
Because of LLVM inling checks, it's generally not possible to inline a C helper into Rust code, even with LTO: * LLVM doesn't want to inline functions compiled with `-fno-delete-null-pointer-checks` with code compiled without. The C CGUs all have this enabled and Rust CGUs don't. Inlining is okay since this is one of the hardening features that does not change the ABI, and we shouldn't have null pointer dereferences in these helpers. * LLVM doesn't want to inline functions with different list of builtins. C side has `-fno-builtin-wcslen`; `wcslen` is not a Rust builtin, so they should be compatible, but LLVM does not perform inlining due to attributes mismatch. * clang and Rust doesn't have the exact target string. Clang generates `+cmov,+cx8,+fxsr` but Rust doesn't enable them (in fact, Rust will complain if `-Ctarget-feature=+cmov,+cx8,+fxsr` is used). x86-64 always enable these features, so they are in fact the same target string, but LLVM doesn't understand this and so inlining is inhibited. This can be bypassed with `--ignore-tti-inline-compatible`, but this is a hidden option. To fix this, we can add __always_inline on every helper, which skips these LLVM inlining checks. For this purpose, introduce a new __rust_helper macro that needs to be added to every helper. Most helpers already have __rust_helper specified, but there are a few missing. The only consequence of this is that those specific helpers do not get inlined. Signed-off-by: Gary Guo <gary@garyguo.net> Signed-off-by: Alice Ryhl <aliceryhl@google.com> Reviewed-by: Nathan Chancellor <nathan@kernel.org> Tested-by: Nathan Chancellor <nathan@kernel.org> Tested-by: Andreas Hindborg <a.hindborg@kernel.org> Reviewed-by: Andreas Hindborg <a.hindborg@kernel.org> Link: https://patch.msgid.link/20260203-inline-helpers-v2-2-beb8547a03c9@google.com Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-03-30kbuild: rust: add `CONFIG_RUSTC_CLANG_LLVM_COMPATIBLE`Gary Guo
This config detects if Rust and Clang have matching LLVM major version. All IR or bitcode operations (e.g. LTO) rely on LLVM major version to be matching, otherwise it may generate errors, or worse, miscompile silently due to change of IR semantics. It's usually suggested to use the exact same LLVM version, but this can be difficult to guarantee. Rust's suggestion [1] is also major-version only, so I think this check is sufficient for the kernel. Link: https://doc.rust-lang.org/rustc/linker-plugin-lto.html [1] Reviewed-by: Andreas Hindborg <a.hindborg@kernel.org> Signed-off-by: Gary Guo <gary@garyguo.net> Signed-off-by: Matthew Maurer <mmaurer@google.com> Signed-off-by: Alice Ryhl <aliceryhl@google.com> Reviewed-by: Nathan Chancellor <nathan@kernel.org> Tested-by: Nathan Chancellor <nathan@kernel.org> Reviewed-by: Nicolas Schier <nsc@kernel.org> Tested-by: Nicolas Schier <nsc@kernel.org> Tested-by: Andreas Hindborg <a.hindborg@kernel.org> Link: https://patch.msgid.link/20260203-inline-helpers-v2-1-beb8547a03c9@google.com [ Fixed typo. - Miguel ] Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-03-30rust: rework `build_assert!` documentationGary Guo
Add a detailed comparison and recommendation of the three types of build-time assertion macro as module documentation (and un-hide the module to render them). The documentation on the macro themselves are simplified to only cover the scenarios where they should be used; links to the module documentation is added instead. Reviewed-by: Yury Norov <ynorov@nvidia.com> Signed-off-by: Gary Guo <gary@garyguo.net> Reviewed-by: Alexandre Courbot <acourbot@nvidia.com> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Reviewed-by: Danilo Krummrich <dakr@kernel.org> Link: https://patch.msgid.link/20260319121653.2975748-4-gary@kernel.org [ Added periods on comments. - Miguel ] Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-03-30rust: add `const_assert!` macroGary Guo
The macro is a more powerful version of `static_assert!` for use inside function contexts. This is powered by inline consts, so enable the feature for old compiler versions that does not have it stably. While it is possible already to write `const { assert!(...) }`, this provides a short hand that is more uniform with other assertions. It also formats nicer with rustfmt where it will not be formatted into multiple lines. Two users that would route via the Rust tree are converted. Reviewed-by: Yury Norov <ynorov@nvidia.com> Signed-off-by: Gary Guo <gary@garyguo.net> Reviewed-by: Alexandre Courbot <acourbot@nvidia.com> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Reviewed-by: Danilo Krummrich <dakr@kernel.org> Link: https://patch.msgid.link/20260319121653.2975748-3-gary@kernel.org [ Rebased. Fixed period typo. - Miguel ] Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-03-29Linux 7.0-rc6v7.0-rc6Linus Torvalds
2026-03-29Merge tag 'vfs-7.0-rc6.fixes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: - Fix netfs_limit_iter() hitting BUG() when an ITER_KVEC iterator reaches it via core dump writes to 9P filesystems. Add ITER_KVEC handling following the same pattern as the existing ITER_BVEC code. - Fix a NULL pointer dereference in the netfs unbuffered write retry path when the filesystem (e.g., 9P) doesn't set the prepare_write operation. - Clear I_DIRTY_TIME in sync_lazytime for filesystems implementing ->sync_lazytime. Without this the flag stays set and may cause additional unnecessary calls during inode deactivation. - Increase tmpfs size in mount_setattr selftests. A recent commit bumped the ext4 image size to 2 GB but didn't adjust the tmpfs backing store, so mkfs.ext4 fails with ENOSPC writing metadata. - Fix an invalid folio access in iomap when i_blkbits matches the folio size but differs from the I/O granularity. The cur_folio pointer would not get invalidated and iomap_read_end() would still be called on it despite the IO helper owning it. - Fix hash_name() docstring. - Fix read abandonment during netfs retry where the subreq variable used for abandonment could be uninitialized on the first pass or point to a deleted subrequest on later passes. - Don't block sync for filesystems with no data integrity guarantees. Add a SB_I_NO_DATA_INTEGRITY superblock flag replacing the per-inode AS_NO_DATA_INTEGRITY mapping flag so sync kicks off writeback but doesn't wait for flusher threads. This fixes a suspend-to-RAM hang on fuse-overlayfs where the flusher thread blocks when the fuse daemon is frozen. - Fix a lockdep splat in iomap when reads fail. iomap_read_end_io() invokes fserror_report() which calls igrab() taking i_lock in hardirq context while i_lock is normally held with interrupts enabled. Kick failed read handling to a workqueue. - Remove the redundant netfs_io_stream::front member and use stream->subrequests.next instead, fixing a potential issue in the direct write code path. * tag 'vfs-7.0-rc6.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: netfs: Fix the handling of stream->front by removing it iomap: fix lockdep complaint when reads fail writeback: don't block sync for filesystems with no data integrity guarantees netfs: Fix read abandonment during retry vfs: fix docstring of hash_name() iomap: fix invalid folio access when i_blkbits differs from I/O granularity selftests/mount_setattr: increase tmpfs size for idmapped mount tests fs: clear I_DIRTY_TIME in sync_lazytime netfs: Fix NULL pointer dereference in netfs_unbuffered_write() on retry netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators
2026-03-29Merge branch 'net-hsr-subsystem-cleanups-and-modernization'Jakub Kicinski
Luka Gejak says: ==================== net: hsr: subsystem cleanups and modernization This series contains two focused HSR cleanups with practical benefit. It constifies protocol operation tables and replaces a hardcoded function name with __func__ to keep diagnostics correct across refactoring. ==================== Link: https://patch.msgid.link/20260326174600.136232-1-luka.gejak@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-29net: hsr: use __func__ instead of hardcoded function nameLuka Gejak
Replace the hardcoded string "hsr_get_untagged_frame" with the standard __func__ macro in netdev_warn_once() call to make the code more robust to refactoring. Signed-off-by: Luka Gejak <luka.gejak@linux.dev> Reviewed-by: Felix Maurer <fmaurer@redhat.com> Link: https://patch.msgid.link/20260326174600.136232-3-luka.gejak@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-29net: hsr: constify hsr_ops and prp_ops protocol operation structuresLuka Gejak
The hsr_ops and prp_ops structures are assigned to hsr->proto_ops during device initialization and are never modified at runtime. Declaring them as const allows the compiler to place these structures in read-only memory, which improves security by preventing accidental or malicious modification of the function pointers they contain. The proto_ops field in struct hsr_priv is also updated to a const pointer to maintain type consistency. Signed-off-by: Luka Gejak <luka.gejak@linux.dev> Reviewed-by: Felix Maurer <fmaurer@redhat.com> Link: https://patch.msgid.link/20260326174600.136232-2-luka.gejak@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-29Merge branch 'macb-usrio-tsu-patches'Jakub Kicinski
Conor Dooley says: ==================== macb usrio/tsu patches At the very least, it'd be good of the soc vendor folks could check their platforms and see if their usrio stuff actually lines up with what the driver currently calls "macb_default_usrio". Ours didn't and it was a nasty surprise. Ryan and I figured out that the sama7g5 stuff is not actually using the same usrio bits as earlier devices, so there's now more patches in this series to split them apart. I've not tested the split or the new property due to lack of hardware, but Ryan has. Marking this stuff net-next, because although they're fixes I don't see any particular urgency, and it avoids creating some dependencies between cleanup items and the fixes. ==================== Link: https://patch.msgid.link/20260325-unsterile-flail-4c7729750dc4@spud Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-29net: macb: drop usrio pointer on EyeQ5 configThéo Lebrun
USRIO is disabled on this platform, drop its inherited usrio config. We will end up with MACB_CAPS_USRIO_DISABLED on this platform: - We have no config->usrio so macb_configure_caps() deduces that the feature is disabled. - Anecdotally, we would also land in the runtime detection codepath that reads DCFG1. Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com> Signed-off-by: Conor Dooley <conor.dooley@microchip.com> Link: https://patch.msgid.link/20260325-stillness-undertake-d83054057b8d@spud Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-29net: macb: set MACB_CAPS_USRIO_DISABLED if no usrio config is providedThéo Lebrun
bp->usrio is copied directly from dt_conf->usrio in macb_probe(). If dt_conf->usrio is NULL, we do not want to land in USRIO write codepaths which dereference bp->usrio. Inherit automatically MACB_CAPS_USRIO_DISABLED to avoid those. This means a macb_config that wants to disable usrio can simply drop its .usrio field, rather than add the disabled capability explicitly. Nit: drop the dt_conf NULL check because the pointer is always valid. Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com> Signed-off-by: Conor Dooley <conor.dooley@microchip.com> Link: https://patch.msgid.link/20260325-husband-cape-ec4945b9184c@spud Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-29net: macb: runtime detect MACB_CAPS_USRIO_DISABLEDThéo Lebrun
DCFG1 (design config 1 register) carries a bit indicating whether User I/O feature has been enabled or not. The MACB/GEM driver has a cap flag indicating that HW has the feature disabled (default is enabled). Add the missing connection between DCFG1 bit and MACB_CAPS_USRIO_DISABLED. Indirect impact: avoid useless writel() on USERIO register; this is not an important fix because USERIO is anyway read-only when feature is disabled. If for some reason a compatible sets USRIO_DISABLED but DCFG1 indicates it is enabled, we still keep the disabled capability flag. This ensures we don't break "cdns,np4-macb" that sets the flag from compatible match data. Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com> Signed-off-by: Conor Dooley <conor.dooley@microchip.com> Link: https://patch.msgid.link/20260325-compactly-glue-f426a2e68904@spud Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-29net: macb: timer adjust mode is not supportedConor Dooley
The ptp portion of this driver controls the tsu's timer using the controls for "increment mode", which is not compatible with the hardware trying to control it via the gem_tsu_inc_ctrl and gem_tsu_ms inputs in "timer adjust mode". Abort probe if the property signalling that the relevant signals have been wired up is present. Signed-off-by: Conor Dooley <conor.dooley@microchip.com> Link: https://patch.msgid.link/20260325-facebook-chop-cf792c53f1da@spud Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-29dt-bindings: net: macb: add property indicating timer adjust modeConor Dooley
The GEM IP has two methods for modifying the ptp timer. The first of these, named "increment mode", relies on software controlling the timer by setting tsu_timer_incr and tsu_timer_incr_sub_nsec and performing once-off adjustments via the tsu_timer_adjust register. This is what the macb driver uses. The second mechanism, "timer adjust mode" uses the gem_tsu_inc_ctrl and gem_tsu_ms signals to control the timer. These modes are not intended to be used in parallel, but both can be possible on the same device and which mode is used cannot be determined from the compatible on all devices, because some users of the GEM IP are SoC FPGAs that permit configuring how the IP is wired up. Add a property to indicate that gem_tsu_inc_ctrl and gem_tsu_ms are wired up for timer adjust mode. Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Conor Dooley <conor.dooley@microchip.com> Link: https://patch.msgid.link/20260325-daily-entitle-3640f7254da4@spud Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-29net: macb: clean up tsu clk rate acquisitionConor Dooley
tsu_clk is grabbed during probe, so doesn't need to be re-grabbed here. pclk is mandatory, probe will fail if it is err/NULL, so there's no need to check it here or have a !pclk 3rd arm. Simplify gem_get_tsu_rate() to account for these facts. Signed-off-by: Conor Dooley <conor.dooley@microchip.com> Link: https://patch.msgid.link/20260325-hazing-penniless-14ba803efbb6@spud Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-29net: macb: warn on pclk use as a tsu_clk fallbackConor Dooley
The Candence GEM IP has a configuration parameter which determines the source of the clock used for the timestamp unit (if it is enabled), switching it between using the pclk and a dedicated input. When ptp support was added to the macb driver, a new tsu_clk was added to represent the dedicated input. While this is understandable, I think it is bug prone and that the tsu_clk should represent whatever clock is used for the timestamper and not just that specific input. >From a driver point of view, the benefit of taking the conceptual approach is avoiding misconfiguring the driver when the hardware supports ptp (and it is set as a capability in the relevant per-device structure) but no tsu_clk is provided in devicetree. At the moment, the timestamper will be registered and programmed with an increment that reflects the pclk in these cases, but will malfunction if the pclk and tsu_clk frequencies do not match. Obviously, this means the devicetree incorrectly represents the hardware, but this change in approach would make the driver more resilient without meaningfully impacting correctly described users. Out of the devices that claim MACB_CAPS_GEM_HAS_PTP the fu540, mpfs, sama5d2 and sama7g5-emac (but not sama7g5-gem) are at risk of having this problem with the in-kernel devicetrees. mpfs and sama7g5-emac have been confirmed to be incorrect, and sama5d2 is correct. It may be that the other platforms actually do use the pclk for the timestamper (either by supplying pclk to the tsu_clk input of the IP, or by having the IP block configured to use pclk instead of the tsu_clk input), but at least two are wrong, as they do not use pclk for the tsu_clk, so the driver is registering the ptp clock incorrectly. Add a warning if no tsu_clk is provided on a platform that uses the timerstamper, to encourage people to specifically provide a tsu_clk and avoid silently registering the timerstamper with the wrong clock. If the pclk is actually used, it can be provided as a tsu_clk for improved clarity in devicetrees. While this changes the meaning of the devicetree property, it is backwards compatible as there's no functional change for platforms that didn't provide a tsu_clk and the changed meaning of providing a tsu_clk in the devicetree does not impact platforms that already provided one as the decision about the tsu clock source is at IP instantiation time rather than at runtime, so there's no driver behaviour that needs to change based on the input to the IP used for the timestamping unit. Signed-off-by: Conor Dooley <conor.dooley@microchip.com> Link: https://patch.msgid.link/20260325-dust-revision-368053e82d0e@spud Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-29net: macb: add mpfs specific usrio configurationConor Dooley
On mpfs the driver needs to make sure the tsu clock source is not the fabric, as this requires that the hardware is in Timer Adjust mode, which is not compatible with the linux driver trying to control the hardware. It is unlikely that this will be set, as the peripheral is reset during probe, but if the resets are not provided in devicetree it's probable that this bit is set incorrectly, as U-Boot's macb driver has the same issue with using usrio settings for at91 platforms as the default. Fixes: 8aad66aa59be5 ("net: macb: add polarfire soc reset support") Signed-off-by: Conor Dooley <conor.dooley@microchip.com> Link: https://patch.msgid.link/20260325-excavate-jester-798e7cfe02b5@spud Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-29net: macb: np4 doesn't need a usrio pointerConor Dooley
USRIO is disabled on this platform, having a pointer to a usrio config structure doesn't actually do anything other than look weird. Signed-off-by: Conor Dooley <conor.dooley@microchip.com> Link: https://patch.msgid.link/20260325-passover-rimless-73c19c67d94b@spud Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-29net: macb: rework usrio refclk selection codeConor Dooley
The USRIO based refclk selection code abuses a capability flag to set the refclk to an external source based on match data/compatible on sama7g5-emac and use an internal source for the gmac. Ryan previously added a property in an attempt to decouple the refclk source from the compatible, because this is not fixed by compatible and there's variance based on the choices made by board designers. Originally when Ryan added it, he removed the capability flag entirely from match data, but this changed the default for the sama7g5-emac and the removal had to be reverted for these devices. Because these devices default to an external refclk, and the current property is only capable of communicating external refclks, there's no way to make the sama7g5-emac use an internal refclk. Additionally, this property has no limiting based on compatible, and if used on a platform with an external refclk that is not controlled by USRIO the capability would be erroneously set. Because of the reuse of the at91_default_usrio struct by non-at91 devices, this could cause the refclk bit to be set in error, on a system where the refclk is externally provided without usrio settings being required. Change the new capability flag so that it actually represents the hardware being capable of controlling the refclk source via USRIO, and move the selection of default behaviour into the macb_usrio_config struct provided as part of match data. Modify the devicetree code to support a new property, "cdns,refclk-source" which will support devices with either default, retaining support for "cdns,refclk-external" for compatibility reasons. Signed-off-by: Conor Dooley <conor.dooley@microchip.com> Link: https://patch.msgid.link/20260325-tarantula-bullring-6ac44b39dd52@spud Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-29dt-bindings: net: cdns,macb: replace cdns,refclk-ext with cdns,refclk-sourceConor Dooley
Ryan added cdns,refclk-ext with the intent of decoupling the source of the reference clock on sama7g5 (and related platforms) from the compatible. Unfortunately, the default for sama7g5-emac is an external reference clock, so this property had no effect there, so that compatibility with older devicetrees is preserved. Replace cdns,refclk-ext with one that supports both default states and therefore is usable for sama7g5-emac. For now, limit it to only the platforms that have USRIO controlled reference clock selection, but this could be generalised in the future. The existing property only works on devices that are compatible with sama7g5-gem, so mark it deprecated, and limit its use to that specific scenario. Signed-off-by: Conor Dooley <conor.dooley@microchip.com> Link: https://patch.msgid.link/20260325-savior-untainted-03057ee0a917@spud Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-29net: macb: split USRIO_HAS_CLKEN capability in twoConor Dooley
While trying to rework the internal/external refclk selection on sama7g5, Ryan and I noticed that the sama7g5 was "overloading" the meaning of MACB_CAPS_USRIO_HAS_CLKEN, using it differently to how it was originally intended. Originally, on the macb hardware on sam9620 et al, MACB_CAPS_USRIO_HAS_CLKEN represented the hardware having a bit that needed to be set to turn on the input clock to the transceivers. The sama7g5 doesn't have this bit, so for some reason the decision was made to reuse this capability flag to control selection of internal/external references. Split the caps in two, so that capabilities do what they say on the tin, and allow reworking the refclk selection handling without impacting the older devices that use MACB_CAPS_USRIO_CLKEN for its original purpose. Signed-off-by: Conor Dooley <conor.dooley@microchip.com> Link: https://patch.msgid.link/20260325-gradient-grading-b23b9e6ef9ff@spud Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-29net: macb: rename macb_default_usrio to at91_default_usrio as not all ↵Conor Dooley
platforms have mii mode control in usrio Calling this structure macb_default_usrio is misleading, I believe, as it implies that it should be used if your platform has nothing special to do in usrio. Since usrio is platform dependent, the default here is probably for each usrio to do nothing, with the macb documentation I have access to prescribing no standard behaviour here. We noticed that this was problematic because on mpfs, a bit that macb_default_usrio sets to deal with the MII mode actually changes the source for the tsu_clk to something with how the majority of mpfs devices are actually configured! Rename it to at91_default_usrio, since that's where the values actually come from for these. I have no idea if any of the other platforms that use the default actually copied at91's usrio configuration or if they have usrio configurations where what the driver does has no impact. Gate touching these bits behind a capability, like the clken refclock usrio knob, so that platforms without the MII mode stuff can avoid running this code. Signed-off-by: Conor Dooley <conor.dooley@microchip.com> Link: https://patch.msgid.link/20260325-landowner-preformed-2922ce736337@spud Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-29Revert "net: macb: Clean up the .usrio settings in macb_config instances"Conor Dooley
Commit 0ae998c4efd69 ("net: macb: Clean up the .usrio settings in macb_config instances") was a misguided attempt to clean up the driver that actually just propagated problematic code. The default for usrio is actually no usrio, and already there are issues with people using the problematically named "macb_default_usrio" on platforms where the usrio does not have this so-called default behaviour. usrio is platform specific and using the default at91 usrio settings should be opt-in only. Revert the "cleanup" patch. Signed-off-by: Conor Dooley <conor.dooley@microchip.com> Link: https://patch.msgid.link/20260325-rundown-unrushed-dd82c9f5c56c@spud Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-29net: wan/fsl_ucc_hdlc: cleanup ucc_hdlc_pollTomas Alvarez Vanoli
Immediately after setting to 0 we are adding to it, and subtracting 0 from budget. Replace with just assignment and no subtraction. Signed-off-by: Tomas Alvarez Vanoli <tomas.alvarez-vanoli@hitachienergy.com> Reviewed-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org> Link: https://patch.msgid.link/20260326100232.904289-1-tomas.alvarez-vanoli@hitachienergy.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-29Merge branch 'bnxt_en-add-xdp-rss-hash-metadata-support'Jakub Kicinski
Chris J Arges says: ==================== bnxt_en: Add XDP RSS hash metadata support This series adds XDP RSS hash metadata extraction support for the bnxt_en driver and includes selftests to validate the functionality. I was able to test this on a BCM57414 NIC. ==================== Link: https://patch.msgid.link/20260325201139.2501937-1-carges@cloudflare.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-29selftests: drv-net: xdp: Add rss_hash metadata testsChris J Arges
This test loads xdp_metadata.bpf which calls bpf_xdp_metadata_rx_hash() on incoming packets. The metadata from that packet is then sent to a BPF map for validation. It borrows structure from xdp.py, reusing common functions. The test checks the device's xdp-rx-metadata-features via netlink before running and skips on devices that do not advertise hash support. This can be run on veth devices as well as real hardware. The test is fairly simple and just verifies that a TCP or UDP packet can be identified as an L4 flow. This minimal test also passes if run on a veth device. Signed-off-by: Chris J Arges <carges@cloudflare.com> Link: https://patch.msgid.link/20260325201139.2501937-7-carges@cloudflare.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-29selftests: net: move common xdp.py functions into libChris J Arges
This moves a few functions which can be useful to other python programs that manipulate XDP programs. This also refactors xdp.py to use the refactored functions. Signed-off-by: Chris J Arges <carges@cloudflare.com> Link: https://patch.msgid.link/20260325201139.2501937-6-carges@cloudflare.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-29bnxt_en: Implement XDP RSS hash metadata extraction for V3_CMPChris J Arges
This adds another conditional when cmp_type is CMP_TYPE_RX_L2_V3_CMP for drivers that support this completion format. This re-uses bnxt_rss_ext_op to provide similar functionality. One limitation is for L4 hash-types, protocol-specific bits can't be determined. Reviewed-by: Joe Damato <joe@dama.to> Signed-off-by: Chris J Arges <carges@cloudflare.com> Link: https://patch.msgid.link/20260325201139.2501937-5-carges@cloudflare.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-29bnxt_en: Move bnxt_rss_ext_op into headerChris J Arges
This allows bnxt_rss_ext_op to be used by other functions. In addition this modifies the rxcmp argument to be const since the function only reads from this structure. Reviewed-by: Joe Damato <joe@dama.to> Signed-off-by: Chris J Arges <carges@cloudflare.com> Link: https://patch.msgid.link/20260325201139.2501937-4-carges@cloudflare.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-29bnxt_en: Implement XDP RSS hash metadata extractionChris J Arges
Add support for extracting RSS hash values and hash types from hardware completion descriptors in XDP programs for bnxt_en. Add IP_TYPE definition for determining if completion is ipv4 or ipv6. In addition add ITYPE_ICMP flag for identifying ICMP completions. Signed-off-by: Chris J Arges <carges@cloudflare.com> Reviewed-by: Joe Damato <joe@dama.to> Reviewed-by: Andy Gospodarek <gospo@broadcom.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-29bnxt_en: use bnxt_xdp_buff for xdp contextChris J Arges
This adds bnxt_xdp_buff which embeds the xdp_buff struct and stores pointers to hardware RX completion descriptors (rx_cmp and rx_cmp_ext) along with the completion type. Signed-off-by: Chris J Arges <carges@cloudflare.com> Link: https://patch.msgid.link/20260325201139.2501937-2-carges@cloudflare.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-29lib/crc: arm64: add NEON accelerated CRC64-NVMe implementationDemian Shulhan
Implement an optimized CRC64 (NVMe) algorithm for ARM64 using NEON Polynomial Multiply Long (PMULL) instructions. The generic shift-and-XOR software implementation is slow, which creates a bottleneck in NVMe and other storage subsystems. The acceleration is implemented using C intrinsics (<arm_neon.h>) rather than raw assembly for better readability and maintainability. Key highlights of this implementation: - Uses 4KB chunking inside scoped_ksimd() to avoid preemption latency spikes on large buffers. - Pre-calculates and loads fold constants via vld1q_u64() to minimize register spilling. - Benchmarks show the break-even point against the generic implementation is around 128 bytes. The PMULL path is enabled only for len >= 128. Performance results (kunit crc_benchmark on Cortex-A72): - Generic (len=4096): ~268 MB/s - PMULL (len=4096): ~1556 MB/s (nearly 6x improvement) Signed-off-by: Demian Shulhan <demyansh@gmail.com> Link: https://lore.kernel.org/r/20260329074338.1053550-1-demyansh@gmail.com Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-03-30Merge tag 'drm-xe-next-2026-03-26-1' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/xe/kernel into drm-next Hi Dave and Sima, Here goes our late, final drm-xe-next PR towards 7.1. We just purgeable BO uAPI in today, hence the late pull. In the big things we have: - Add support for purgeable buffer objects Thanks, Matt UAPI Changes: - Add support for purgeable buffer objects (Arvind, Himal) Driver Changes: - Remove useless comment (Maarten) - Issue GGTT invalidation under lock in ggtt_node_remove (Brost, Fixes) - Fix mismatched include guards in header files (Shuicheng) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/acX4fWxPkZrrfwnT@gsse-cloud1.jf.intel.com
2026-03-29io_uring/rsrc: reject zero-length fixed buffer importQi Tang
validate_fixed_range() admits buf_addr at the exact end of the registered region when len is zero, because the check uses strict greater-than (buf_end > imu->ubuf + imu->len). io_import_fixed() then computes offset == imu->len, which causes the bvec skip logic to advance past the last bio_vec entry and read bv_offset from out-of-bounds slab memory. Return early from io_import_fixed() when len is zero. A zero-length import has no data to transfer and should not walk the bvec array at all. BUG: KASAN: slab-out-of-bounds in io_import_reg_buf+0x697/0x7f0 Read of size 4 at addr ffff888002bcc254 by task poc/103 Call Trace: io_import_reg_buf+0x697/0x7f0 io_write_fixed+0xd9/0x250 __io_issue_sqe+0xad/0x710 io_issue_sqe+0x7d/0x1100 io_submit_sqes+0x86a/0x23c0 __do_sys_io_uring_enter+0xa98/0x1590 Allocated by task 103: The buggy address is located 12 bytes to the right of allocated 584-byte region [ffff888002bcc000, ffff888002bcc248) Fixes: 8622b20f23ed ("io_uring: add validate_fixed_range() for validate fixed buffer") Signed-off-by: Qi Tang <tpluszz77@gmail.com> Link: https://patch.msgid.link/20260329164936.240871-1-tpluszz77@gmail.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-03-29io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs()Junxi Qian
sqe->len is __u32 but gets stored into sr->len which is int. When userspace passes sqe->len values exceeding INT_MAX (e.g. 0xFFFFFFFF), sr->len overflows to a negative value. This negative value propagates through the bundle recv/send path: 1. io_recv(): sel.val = sr->len (ssize_t gets -1) 2. io_recv_buf_select(): arg.max_len = sel->val (size_t gets 0xFFFFFFFFFFFFFFFF) 3. io_ring_buffers_peek(): buf->len is not clamped because max_len is astronomically large 4. iov[].iov_len = 0xFFFFFFFF flows into io_bundle_nbufs() 5. io_bundle_nbufs(): min_t(int, 0xFFFFFFFF, ret) yields -1, causing ret to increase instead of decrease, creating an infinite loop that reads past the allocated iov[] array This results in a slab-out-of-bounds read in io_bundle_nbufs() from the kmalloc-64 slab, as nbufs increments past the allocated iovec entries. BUG: KASAN: slab-out-of-bounds in io_bundle_nbufs+0x128/0x160 Read of size 8 at addr ffff888100ae05c8 by task exp/145 Call Trace: io_bundle_nbufs+0x128/0x160 io_recv_finish+0x117/0xe20 io_recv+0x2db/0x1160 Fix this by rejecting negative sr->len values early in both io_sendmsg_prep() and io_recvmsg_prep(). Since sqe->len is __u32, any value > INT_MAX indicates overflow and is not a valid length. Fixes: a05d1f625c7a ("io_uring/net: support bundles for send") Cc: stable@vger.kernel.org Signed-off-by: Junxi Qian <qjx1298677004@gmail.com> Link: https://patch.msgid.link/20260329153909.279046-1-qjx1298677004@gmail.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-03-29Input: add keycodes for contextual AI usages (HUTRR119)Akshai Murari
HUTRR119 introduces new usages for keys intended to invoke AI agents based on the current context. These are useful with the increasing number of operating systems with integrated Large Language Models Add new key definitions for KEY_ACTION_ON_SELECTION, KEY_CONTEXTUAL_INSERT and KEY_CONTEXTUAL_QUERY Signed-off-by: Akshai Murari <akshaim@google.com> Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-03-29Merge tag 'phy-fixes-7.0' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy Pull phy fixes from Vinod Koul: - Qualcomm PCS table fix for ufs phy - TI device node reference fix - Common prop kconfig fix - lynx CDR lock workaround for lanes disabled - usb disconnect function fix of k1 driver * tag 'phy-fixes-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: phy: qcom: qmp-ufs: Fix SM8650 PCS table for Gear 4 phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types() phy: k1-usb: add disconnect function support phy: lynx-28g: skip CDR lock workaround for lanes disabled in the device tree phy: make PHY_COMMON_PROPS Kconfig symbol conditionally user-selectable
2026-03-29Merge tag 'dmaengine-fix-7.0' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine Pull dmaengine fixes from Vinod Koul: "A bunch of driver fixes with idxd ones being the biggest: - Xilinx regmap init error handling, dma_device directions, residue calculation, and reset related timeout fixes - Renesas CHCTRL updates and driver list fixes - DW HDMA cycle bits and MSI data programming fix - IDXD pile of fixes for memeory leak and FLR fixes" * tag 'dmaengine-fix-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: (21 commits) dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA dmaengine: xilinx: xilinx_dma: Fix dma_device directions dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock dmaengine: sh: rz-dmac: Protect the driver specific lists dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() dmaengine: xilinx: xdma: Fix regmap init error handling dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and CYCLE_BIT bits for HDMA. dmaengine: idxd: Fix leaking event log memory dmaengine: idxd: Fix freeing the allocated ida too late dmaengine: idxd: Fix memory leak when a wq is reset dmaengine: idxd: Fix not releasing workqueue on .release() dmaengine: idxd: Wait for submitted operations on .device_synchronize() dmaengine: idxd: Flush all pending descriptors dmaengine: idxd: Flush kernel workqueues on Function Level Reset dmaengine: idxd: Fix possible invalid memory access after FLR dmaengine: idxd: Fix crash when the event log is disabled dmaengine: idxd: Fix lockdep warnings when calling idxd_device_config() dmaengine: dw-edma: fix MSI data programming for multi-IRQ case ...
2026-03-29Merge tag 'i2c-for-7.0-rc6' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: - designware: fix resume-probe race causing NULL-deref in amdisp - imx: fix timeout on repeated reads and extra clock at end - MAINTAINERS: drop outdated I2C website * tag 'i2c-for-7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: MAINTAINERS: drop outdated I2C website i2c: designware: amdisp: Fix resume-probe race condition issue i2c: imx: ensure no clock is generated after last read i2c: imx: fix i2c issue when reading multiple messages
2026-03-29Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvmLinus Torvalds
Pull kvm fixes from Paolo Bonzini: "s390: - Lots of small and not-so-small fixes for the newly rewritten gmap, mostly affecting the handling of nested guests. x86: - Fix an issue with shadow paging, which causes KVM to install an MMIO PTE in the shadow page tables without first zapping a non-MMIO SPTE if KVM didn't see the write that modified the shadowed guest PTE. While commit a54aa15c6bda3 ("KVM: x86/mmu: Handle MMIO SPTEs directly in mmu_set_spte()") was right about it being impossible to miss such a write if it was coming from the guest, it failed to account for writes to guest memory that are outside the scope of KVM: if userspace modifies the guest PTE, and then the guest hits a relevant page fault, KVM will get confused" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE KVM: s390: Fix KVM_S390_VCPU_FAULT ioctl KVM: s390: vsie: Fix guest page tables protection KVM: s390: vsie: Fix unshadowing while shadowing KVM: s390: vsie: Fix refcount overflow for shadow gmaps KVM: s390: vsie: Fix nested guest memory shadowing KVM: s390: Correctly handle guest mappings without struct page KVM: s390: Fix gmap_link() KVM: s390: vsie: Fix check for pre-existing shadow mapping KVM: s390: Remove non-atomic dat_crstep_xchg() KVM: s390: vsie: Fix dat_split_ste()
2026-03-29Merge tag 'for-linus-7.0a-rc6-tag' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen fix from Juergen Gross: "A single fix for a very rare bug introduced in rc5" * tag 'for-linus-7.0a-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/privcmd: unregister xenstore notifier on module exit
2026-03-29net: dsa: qca8k: Use the right GPIO headerLinus Walleij
The driver header for qca8k includes the legacy GPIO header <linux/gpio.h> but does not use any symbols from it and actually wants <linux/gpio/consumer.h> so fix this up. Signed-off-by: Linus Walleij <linusw@kernel.org> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260327-net-dsa-qca8k-v1-1-94e613a5c369@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>