summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-03-13Merge tag 'perf-tools-fixes-for-v7.0-1-2026-03-13' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools Pull perf tools fixes from Arnaldo Carvalho de Melo: - Fix stale build ID in module MMAP2 records in events synthesized for pre-existing processes - Fix rust cross compilation - hashmap__new() error pointer return handling fixes - Fix off-by-one bug in outside of functions check on the disasm code - Update header copies of kernel headers, including prctl.h, mount.h, fs.h, irq_vectors.h, perf_event.h, gfp_types.h, kvm.h, cpufeatures.h msr-index.h, also the syscall tables files that introduced the 'rseq_slice_yield' syscall - Finish removal of ETM_OPT_* on the ARM coresight support, needed to sync the coresight-pmu.h header with the kernel sources - Make in-target rule robust against too long argument error * tag 'perf-tools-fixes-for-v7.0-1-2026-03-13' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools: (22 commits) perf synthetic-events: Fix stale build ID in module MMAP2 records perf annotate loongarch: Fix off-by-one bug in outside check perf ftrace: Fix hashmap__new() error checking perf annotate: Fix hashmap__new() error checking perf cs-etm: Sync coresight-pmu.h header with the kernel sources perf cs-etm: Finish removal of ETM_OPT_* tools headers UAPI: Update tools' copy of linux/coresight-pmu.h tools headers: Update the syscall tables and unistd.h, to support the new 'rseq_slice_yield' syscall perf disasm: Fix off-by-one bug in outside check tools arch x86: Sync msr-index.h to pick MSR_{OMR_[0-3],CORE_PERF_GLOBAL_STATUS_SET} tools headers UAPI: Sync x86's asm/kvm.h with the kernel sources tools headers x86 cpufeatures: Sync with the kernel sources tools headers UAPI: Sync linux/kvm.h with the kernel sources tools headers: Update the linux/gfp_types.h copy with the kernel sources perf beauty: Update the linux/perf_event.h copy with the kernel sources perf beauty: Update the arch/x86/include/asm/irq_vectors.h copy with the kernel sources perf beauty: Sync UAPI linux/fs.h with kernel sources perf beauty: Sync linux/mount.h copy with the kernel sources tools build: Fix rust cross compilation perf build: Prevent "argument list too long" error ...
2026-03-13Merge tag 's390-7.0-5' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Vasily Gorbik: - Revert IRQ entry/exit path optimization that incorrectly cleared some PSW bits before irqentry_exit(), causing boot failures with linux-next and HRTIMER_REARM_DEFERRED (which only uncovered the problem) - Fix zcrypt code to show CCA card serial numbers even when the default crypto domain is offline by selecting any domain available, preventing empty sysfs entries * tag 's390-7.0-5' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute s390: Revert "s390/irq/idle: Remove psw bits early"
2026-03-13perf branch: Avoid incrementing NULLIan Rogers
If the entry is NULL the value is meaningless so early return NULL to avoid an increment of NULL. This was happening in calls from has_stitched_lbr when running the "perf record LBR tests". The return value isn't used in that case, so returning NULL as no effect. Fixes: 42bbabed09ce ("perf tools: Add hw_idx in struct branch_stack") Signed-off-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-03-13MAINTAINERS: Update maintainers for Hyper-V DRM driverSaurabh Sengar
Add myself, Dexuan, and Long as maintainers. Deepak is stepping down from these responsibilities. Signed-off-by: Saurabh Sengar <ssengar@linux.microsoft.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-03-13mshv: Fix use-after-free in mshv_map_user_memory error pathStanislav Kinsburskii
In the error path of mshv_map_user_memory(), calling vfree() directly on the region leaves the MMU notifier registered. When userspace later unmaps the memory, the notifier fires and accesses the freed region, causing a use-after-free and potential kernel panic. Replace vfree() with mshv_partition_put() to properly unregister the MMU notifier before freeing the region. Fixes: b9a66cd5ccbb9 ("mshv: Add support for movable memory regions") Signed-off-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-03-13Merge tag 'ceph-for-7.0-rc4' of https://github.com/ceph/ceph-clientLinus Torvalds
Pull ceph fixes from Ilya Dryomov: "A small pile of CephFS and messenger bug fixes, all marked for stable" * tag 'ceph-for-7.0-rc4' of https://github.com/ceph/ceph-client: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() libceph: Use u32 for non-negative values in ceph_monmap_decode() MAINTAINERS: update email address of Dongsheng Yang libceph: reject preamble if control segment is empty libceph: admit message frames only in CEPH_CON_S_OPEN state libceph: prevent potential out-of-bounds reads in process_message_header() ceph: do not skip the first folio of the next object in writeback ceph: fix memory leaks in ceph_mdsc_build_path() ceph: add a bunch of missing ceph_path_info initializers ceph: fix i_nlink underrun during async unlink
2026-03-13drm/v3d: Remove dedicated fence_lockMaíra Canal
Commit adefb2ccea1e ("drm/v3d: create a dedicated lock for dma fence") split `fence_lock` from `queue_lock` because v3d_job_update_stats() was taking `queue_lock` to protect `job->file_priv` during stats collection in the IRQ handler. Using the same lock for both DMA fence signaling and stats protection in a IRQ context caused issues on PREEMPT_RT. Since then, the stats infrastructure has been reworked: v3d_stats is now refcounted and jobs hold their own references to stats objects, so v3d_job_update_stats() no longer takes `queue_lock` at all. With the original reason for the split gone, merge `fence_lock` back into `queue_lock` to simplify the locking scheme. Reviewed-by: Iago Toral Quiroga <itoral@igalia.com> Link: https://patch.msgid.link/20260306-v3d-reset-locking-improv-v3-6-49864fe00692@igalia.com Signed-off-by: Maíra Canal <mcanal@igalia.com>
2026-03-13drm/v3d: Attach per-fd reset counters to v3d_statsTvrtko Ursulin
To remove the file_priv NULL-ing dance needed to check if the file descriptor is open, move the per-fd reset counter into v3d_stats, which is heap-allocated and refcounted, outliving the fd as long as jobs reference it. This change allows the removal of the last `queue_lock` usage to protect `job->file_priv` and avoids possible NULL ptr dereference issues due to lifetime mismatches. Also, to simplify locking, replace both the global and per-fd locked reset counters with atomics. Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Reviewed-by: Iago Toral Quiroga <itoral@igalia.com> Link: https://patch.msgid.link/20260306-v3d-reset-locking-improv-v3-5-49864fe00692@igalia.com Co-developed-by: Maíra Canal <mcanal@igalia.com> Signed-off-by: Maíra Canal <mcanal@igalia.com>
2026-03-13drm/v3d: Hold v3d_stats references in each jobTvrtko Ursulin
Have each job hold its own references to the per-fd and global stats objects. This eliminates the need for `queue_lock` protection in the stats update path, since the job's stats pointers are guaranteed to remain valid for the job's entire lifetime regardless of file descriptor closure. Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Reviewed-by: Iago Toral Quiroga <itoral@igalia.com> Link: https://patch.msgid.link/20260306-v3d-reset-locking-improv-v3-4-49864fe00692@igalia.com Co-developed-by: Maíra Canal <mcanal@igalia.com> Signed-off-by: Maíra Canal <mcanal@igalia.com>
2026-03-13drm/v3d: Refcount v3d_statsTvrtko Ursulin
Convert `v3d_stats` from embedded structs to heap-allocated, refcounted objects. This decouples the stats lifetime from the containing structures (this is, `v3d_queue_state` and `v3d_file_priv`), allowing jobs to safely hold their own references to stats objects even after the file descriptor is closed. Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Reviewed-by: Iago Toral Quiroga <itoral@igalia.com> Link: https://patch.msgid.link/20260306-v3d-reset-locking-improv-v3-3-49864fe00692@igalia.com Co-developed-by: Maíra Canal <mcanal@igalia.com> Signed-off-by: Maíra Canal <mcanal@igalia.com>
2026-03-13drm/v3d: Use raw seqcount helpers instead of fighting with lockdepTvrtko Ursulin
The `v3d_stats` sequence counter uses regular seqcount helpers, which carry lockdep annotations that expect a consistent IRQ context between all writers. However, lockdep is unable to detect that v3d's readers are never in IRQ or softirq context, and that for CPU job queues, even the write side never is. This led to false positive that were previously worked around by conditionally disabling local IRQs under IS_ENABLED(CONFIG_LOCKDEP). Switch to the raw seqcount helpers which skip lockdep tracking entirely. This is safe because jobs are fully serialized per queue: the next job can only be queued after the previous one has been signaled, so there is no scope for the start and update paths to race on the same seqcount. Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Reviewed-by: Iago Toral Quiroga <itoral@igalia.com> Link: https://patch.msgid.link/20260306-v3d-reset-locking-improv-v3-2-49864fe00692@igalia.com Co-developed-by: Maíra Canal <mcanal@igalia.com> Signed-off-by: Maíra Canal <mcanal@igalia.com>
2026-03-13drm/v3d: Handle error from drm_sched_entity_init()Maíra Canal
drm_sched_entity_init() can fail but its return value is currently being ignored in v3d_open(). Check the return value and properly unwind on failure by destroying any already-initialized scheduler entities. Fixes: 57692c94dcbe ("drm/v3d: Introduce a new DRM driver for Broadcom V3D V3.x+") Reviewed-by: Iago Toral Quiroga <itoral@igalia.com> Link: https://patch.msgid.link/20260306-v3d-reset-locking-improv-v3-1-49864fe00692@igalia.com Signed-off-by: Maíra Canal <mcanal@igalia.com>
2026-03-13arm64: dts: rockchip: enable vicap dvp on wolfvision pf5 io expanderMichael Riesch
The Digital Video Port (DVP, the 16-bit variant) of the RK3568 VICAP is broken out to the PF5 mainboard expansion header. Enable it in the device tree overlay for the WolfVision PF5 IO Expander board. Signed-off-by: Michael Riesch <michael.riesch@wolfvision.net> Reviewed-by: Gerald Loacker <gerald.loacker@wolfvision.net> Tested-by: Gerald Loacker <gerald.loacker@wolfvision.net> Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Signed-off-by: Michael Riesch <michael.riesch@collabora.com> Link: https://patch.msgid.link/20260313-wv-io-expander-vicap-v1-1-11001fb3b744@collabora.com Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-03-13KVM: SVM: Add a helper to get LBR field pointer to dedup MSR accessesSean Christopherson
Add a helper to get a pointer to the corresponding VMCB field given an LBR MSR index, and use it to dedup the handling in svm_{g,s}et_msr(). No functional change intended. Suggested-by: Yosry Ahmed <yosry@kernel.org> Reviewed-by: Yosry Ahmed <yosry@kernel.org> Link: https://patch.msgid.link/20260310220414.2569208-1-seanjc@google.com [sean: use KVM_BUG_ON() instead of BUILD_BUG(), clang ain't smart enough] Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-03-13drm/colorop: Fix blob property reference tracking in state lifecycleHarry Wentland
The colorop state blob property handling had memory leaks during state duplication, destruction, and reset operations. The implementation failed to follow the established pattern from drm_crtc's handling of DEGAMMA/GAMMA blob properties. Issues fixed: - drm_colorop_atomic_destroy_state() was freeing state memory without releasing the blob reference, causing a leak - drm_colorop_reset() was directly freeing old state with kfree() instead of properly destroying it, leaking blob references - drm_colorop_cleanup() had duplicate blob cleanup code Changes: - Add __drm_atomic_helper_colorop_destroy_state() helper to properly release blob references before freeing state memory - Update drm_colorop_atomic_destroy_state() to call the helper - Fix drm_colorop_reset() to use drm_colorop_atomic_destroy_state() for proper cleanup of old state - Simplify drm_colorop_cleanup() to use the common destruction path This matches the well-tested pattern used by drm_crtc since 2016 and ensures proper reference counting throughout the state lifecycle. Co-developed by Claude Sonnet 4.5. Fixes: cfc27680ee20 ("drm/colorop: Introduce new drm_colorop mode object") Cc: Simon Ser <contact@emersion.fr> Cc: Alex Hung <alex.hung@amd.com> Cc: Harry Wentland <harry.wentland@amd.com> Cc: Daniel Stone <daniels@collabora.com> Cc: Melissa Wen <mwen@igalia.com> Cc: Sebastian Wick <sebastian.wick@redhat.com> Cc: Uma Shankar <uma.shankar@intel.com> Cc: Ville Syrjälä <ville.syrjala@linux.intel.com> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Cc: Jani Nikula <jani.nikula@intel.com> Cc: Louis Chauvet <louis.chauvet@bootlin.com> Cc: Chaitanya Kumar Borah <chaitanya.kumar.borah@intel.com> Cc: <stable@vger.kernel.org> #v6.19+ Signed-off-by: Harry Wentland <harry.wentland@amd.com> Reviewed-by: Alex Hung <alex.hung@amd.com> Link: https://patch.msgid.link/20260312204145.829714-1-harry.wentland@amd.com
2026-03-13sched_ext: Use schedule_deferred_locked() in schedule_dsq_reenq()Tejun Heo
schedule_dsq_reenq() always uses schedule_deferred() which falls back to irq_work. However, callers like schedule_reenq_local() already hold the target rq lock, and scx_bpf_dsq_reenq() may hold it via the ops callback. Add a locked_rq parameter so schedule_dsq_reenq() can use schedule_deferred_locked() when the target rq is already held. The locked variant can use cheaper paths (balance callbacks, wakeup hooks) instead of always bouncing through irq_work. Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-03-13sched_ext: Add SCX_OPS_ALWAYS_ENQ_IMMED ops flagTejun Heo
SCX_ENQ_IMMED makes enqueue to local DSQs succeed only if the task can start running immediately. Otherwise, the task is re-enqueued through ops.enqueue(). This provides tighter control but requires specifying the flag on every insertion. Add SCX_OPS_ALWAYS_ENQ_IMMED ops flag. When set, SCX_ENQ_IMMED is automatically applied to all local DSQ enqueues including through scx_bpf_dsq_move_to_local(). scx_qmap is updated with -I option to test the feature and -F option for IMMED stress testing which forces every Nth enqueue to a busy local DSQ. v2: - Cover scx_bpf_dsq_move_to_local() path (now has enq_flags via ___v2). - scx_qmap: Remove sched_switch and cpu_release handlers (superseded by kernel-side wakeup_preempt_scx()). Add -F for IMMED stress testing. Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-03-13sched_ext: Add enq_flags to scx_bpf_dsq_move_to_local()Tejun Heo
scx_bpf_dsq_move_to_local() moves a task from a non-local DSQ to the current CPU's local DSQ. This is an indirect way of dispatching to a local DSQ and should support enq_flags like direct dispatches do - e.g. SCX_ENQ_HEAD for head-of-queue insertion and SCX_ENQ_IMMED for immediate execution guarantees. Add scx_bpf_dsq_move_to_local___v2() with an enq_flags parameter. The original becomes a v1 compat wrapper passing 0. The compat macro is updated to a three-level chain: v2 (7.1+) -> v1 (current) -> scx_bpf_consume (pre-rename). All in-tree BPF schedulers are updated to pass 0. Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-03-13sched_ext: Plumb enq_flags through the consume pathTejun Heo
Add enq_flags parameter to consume_dispatch_q() and consume_remote_task(), passing it through to move_{local,remote}_task_to_local_dsq(). All callers pass 0. No functional change. This prepares for SCX_ENQ_IMMED support on the consume path. Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-03-13sched_ext: Implement SCX_ENQ_IMMEDTejun Heo
Add SCX_ENQ_IMMED enqueue flag for local DSQ insertions. Once a task is dispatched with IMMED, it either gets on the CPU immediately and stays on it, or gets reenqueued back to the BPF scheduler. It will never linger on a local DSQ behind other tasks or on a CPU taken by a higher-priority class. rq_is_open() uses rq->next_class to determine whether the rq is available, and wakeup_preempt_scx() triggers reenqueue when a higher-priority class task arrives. These capture all higher class preemptions. Combined with reenqueue points in the dispatch path, all cases where an IMMED task would not execute immediately are covered. SCX_TASK_IMMED persists in p->scx.flags until the next fresh enqueue, so the guarantee survives SAVE/RESTORE cycles. If preempted while running, put_prev_task_scx() reenqueues through ops.enqueue() with SCX_TASK_REENQ_PREEMPTED instead of silently placing the task back on the local DSQ. This enables tighter scheduling latency control by preventing tasks from piling up on local DSQs. It also enables opportunistic CPU sharing across sub-schedulers - without this, a sub-scheduler can stuff the local DSQ of a shared CPU, making it difficult for others to use. v2: - Rewrite is_curr_done() as rq_is_open() using rq->next_class and implement wakeup_preempt_scx() to achieve complete coverage of all cases where IMMED tasks could get stranded. - Track IMMED persistently in p->scx.flags and reenqueue preempted-while-running tasks through ops.enqueue(). - Bound deferred reenq cycles (SCX_REENQ_LOCAL_MAX_REPEAT). - Misc renames, documentation. Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-03-13sched_ext: Add scx_vet_enq_flags() and plumb dsq_id into preambleTejun Heo
Add scx_vet_enq_flags() stub and call it from scx_dsq_insert_preamble() and scx_dsq_move(). Pass dsq_id into preamble so the vetting function can validate flag and DSQ combinations. No functional change. This prepares for SCX_ENQ_IMMED which will populate the vetting function. Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-03-13sched_ext: Split task_should_reenq() into local and user variantsTejun Heo
Split task_should_reenq() into local_task_should_reenq() and user_task_should_reenq(). The local variant takes reenq_flags by pointer. No functional change. This prepares for SCX_ENQ_IMMED which will add IMMED-specific logic to the local variant. Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-03-13arm64: mm: Provide level hint for flush_tlb_page()Ryan Roberts
Previously tlb invalidations issued by __flush_tlb_page() did not contain a level hint. From the core API documentation, this function is clearly only ever intended to target level 3 (PTE) tlb entries: | 4) ``void flush_tlb_page(struct vm_area_struct *vma, unsigned long addr)`` | | This time we need to remove the PAGE_SIZE sized translation | from the TLB. However, the arm64 documentation is more relaxed allowing any last level: | this operation only invalidates a single, last-level page-table | entry and therefore does not affect any walk-caches It turns out that the function was actually being used to invalidate a level 2 mapping via flush_tlb_fix_spurious_fault_pmd(). The bug was benign because the level hint was not set so the HW would still invalidate the PMD mapping, and also because the TLBF_NONOTIFY flag was set, the bounds of the mapping were never used for anything else. Now that we have the new and improved range-invalidation API, it is trival to fix flush_tlb_fix_spurious_fault_pmd() to explicitly flush the whole range (locally, without notification and last level only). So let's do that, and then update __flush_tlb_page() to hint level 3. Reviewed-by: Linu Cherian <linu.cherian@arm.com> Signed-off-by: Ryan Roberts <ryan.roberts@arm.com> [catalin.marinas@arm.com: use "level 3" in the __flush_tlb_page() description] [catalin.marinas@arm.com: tweak the commit message to include the core API text] Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2026-03-13drm/xe/guc: Fail immediately on GuC load errorDaniele Ceraolo Spurio
By using the same variable for both the return of poll_timeout_us and the return of the polled function guc_wait_ucode, the return value of the latter is overwritten and lost after exiting the polling loop. Since guc_wait_ucode returns -1 on GuC load failure, we lose that information and always continue as if the GuC had been loaded correctly. This is fixed by simply using 2 separate variables. Fixes: a4916b4da448 ("drm/xe/guc: Refactor GuC load to use poll_timeout_us()") Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Signed-off-by: Vinay Belgaumkar <vinay.belgaumkar@intel.com> Link: https://patch.msgid.link/20260303001732.2540493-2-daniele.ceraolospurio@intel.com
2026-03-13arm64: dts: imx8mp-sr-som: build dtbs with symbols for overlay supportJosua Mayer
Build all dtbs based on SolidRun i.MX8MP SoM with symbols (adding -@ to dtc flags) to allow applying of device-tree overlays e.g. by the bootloader. The SoM has a basler camera connector that can be configured for a particular camera by device-tree overlay. By extension all boards based on this SoM have this connector and should support device-tree overlays. Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Josua Mayer <josua@solid-run.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-03-13arm64: dts: imx8mp-hummingboard-pulse: fix mini-hdmi dsi port referenceJosua Mayer
imx8mp.dtsi includes a default port@1 node with an empty placeholder endpoint intended for linking to a dsi bridge or panel. HummingBoard Pulse mini-hdmi dtsi described a new endpoint node with a different label attached. This duplicate label causes confusion and is suspected to also cause errors during dsi_attach. Remove the duplicate node and link to the one defined in soc dtsi. Further remove the unnecessary attach-bridge property. Fixes: 2a222aa2bee9 ("arm64: dts: add description for solidrun imx8mp hummingboard variants") Signed-off-by: Josua Mayer <josua@solid-run.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-03-13arm64: dts: imx8mp-hummingboard-pulse/cubox-m: fix vmmc gpio polarityJosua Mayer
Fix the polarity in vmmc regulator node for the gpio from active-high to active-low. This is a cosmetic change as regulator default to active-low unless property enable-active-high was also specified - ignoring the flag on gpio handle. Fixes: a009c0c66ecb ("arm64: dts: add description for solidrun imx8mp som and cubox-m") Fixes: 2a222aa2bee9 ("arm64: dts: add description for solidrun imx8mp hummingboard variants") Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Josua Mayer <josua@solid-run.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-03-13arm64: dts: imx8qm-ss-hsio: Wire up DMA IRQ for PCIeAlexander Stein
IRQ mapping is already present. Add the missing DMA interrupt. This is similar to commit 0b4c46f9ad79c ("arm64: dts: imx8qm-ss-hsio: Wire up DMA IRQ for PCIe") Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-03-13arm64: dts: freescale: add pixpaper display overlay for i.MX93 FRDMWig Cheng
Add device tree overlay to support the MayQueen PixPaper e-paper display on the NXP i.MX93 FRDM board. The display is connected via LPSPI3 interface and uses GPIO pins for reset, busy and DC control. The overlay configures: - LPSPI3 pinmux for SPI communication (MOSI, MISO, CLK, CE0) - PixPaper display device with proper GPIO assignments - SPI frequency set to 1MHz for stable operation Enable Open-EP Community pixpaper-213-c support on NXP i.MX93. Signed-off-by: Wig Cheng <onlywig@gmail.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-03-13arm64: dts: tqma8mpql-mba8mp-ras314: Configure multiple queues on eqosAlexander Stein
The MBa8MP-RAS314 mainboard has an integrated PHY connected to the EQOS ethernet controller which can support up to five queues. Configure these queues in the same manor as done on the imx8mp-evk. Setting DMA to threas mode is necessary to prevent FIFO overflows, see commit 0bc3e333a0c82 ("arm64: dts: imx8mp-evk: configure multiple queues on eqos") Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-03-13arm64: dts: tqma8mpql-mba8mpxl: Configure multiple queues on eqosAlexander Stein
The MBa8MPxL mainboard has an integrated PHY connected to the EQOS ethernet controller which can support up to five queues. Configure these queues in the same manor as done on the imx8mp-evk. Setting DMA to threas mode is necessary to prevent FIFO overflows, see commit 0bc3e333a0c82 ("arm64: dts: imx8mp-evk: configure multiple queues on eqos") Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-03-13arm64: dts: imx8mp-kontron: Use GPIO/IRQ defines in DL devicetreeFrieder Schrempf
To make the code more readable, use the macros for the GPIO and IRQ settings. Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de> Reviewed-by: Frank Li <Frank.Li@nxp.com> Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-03-13arm64: dts: imx8mp-kontron: Drop vmmc-supply to fix SD card on SMARC eval ↵Frieder Schrempf
carrier The SMARC evaluation carrier provides an SD card power switch that complies with the OSM standard definition. The OSM base devicetree already describes this correctly. Stop overriding the vmmc-supply in the board devicetree and rely on the definition from the OSM base DTS instead to fix the power supply configuration for the SD card. Fixes: 6fe1ced5ccab7 ("arm64: dts: Add support for Kontron i.MX8MP SMARC module and eval carrier") Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-03-13arm64: dts: imx8mp-kontron: Fix touch reset configuration on DL devicesFrieder Schrempf
The reset signal needs a pullup, but there is no hardware pullup. As a workaround, enable the internal pullup to fix the touchscreen. As this deviates from the default generic GPIO settings in the OSM devicetree, add a new node for the touch pinctrl and redefine the generic gpio1 pinctrl. Fixes: 946ab10e3f40f ("arm64: dts: Add support for Kontron OSM-S i.MX8MP SoM and BL carrier board") Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de> Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-03-13Merge tag 'xfs-fixes-7.0-rc4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linuxLinus Torvalds
Pull xfs fixes from Carlos Maiolino: "A couple race fixes found on the new healthmon mechanism, and another flushing dquots during filesystem shutdown" * tag 'xfs-fixes-7.0-rc4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: fix integer overflow in bmap intent sort comparator xfs: fix undersized l_iclog_roundoff values xfs: ensure dquot item is deleted from AIL only after log shutdown xfs: remove redundant set null for ip->i_itemp xfs: fix returned valued from xfs_defer_can_append xfs: Remove redundant NULL check after __GFP_NOFAIL xfs: fix race between healthmon unmount and read_iter xfs: remove scratch field from struct xfs_gc_bio
2026-03-13Merge tag 'v7.0-rc3-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6Linus Torvalds
Pull smb client fixes from Steve French: - Fix reconnect when using non-default port - Fix default retransmission behavior - Fix open handle reuse in cifs_open - Fix export for smb2-mapperror-test - Fix potential corruption on write retry - Fix potentially uninitialized superblock flags - Fix missing O_DIRECT and O_SYNC flags on create * tag 'v7.0-rc3-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: make default value of retrans as zero smb: client: fix open handle lookup in cifs_open() smb: client: fix iface port assignment in parse_server_interfaces smb/client: only export symbol for 'smb2maperror-test' module smb: client: fix in-place encryption corruption in SMB2_write() smb: client: fix sbflags initialization smb: client: fix atomic open with O_DIRECT & O_SYNC
2026-03-13workqueue: fix parse_affn_scope() prefix matching bugBreno Leitao
parse_affn_scope() uses strncasecmp() with the length of the candidate name, which means it only checks if the input *starts with* a known scope name. Given that the upcoming diff will create "cache_shard" affinity scope, writing "cache_shard" to a workqueue's affinity_scope sysfs attribute always matches "cache" first, making it impossible to select "cache_shard" via sysfs, so, this fix enable it to distinguish "cache" and "cache_shard" Fix by replacing the hand-rolled prefix matching loop with sysfs_match_string(), which uses sysfs_streq() for exact matching (modulo trailing newlines). Also add the missing const qualifier to the wq_affn_names[] array declaration. Note that sysfs_streq() is case-sensitive, unlike the previous strncasecmp() approach. This is intentional and consistent with how other sysfs attributes handle string matching in the kernel. Signed-off-by: Breno Leitao <leitao@debian.org> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-03-13Merge tag 'spi-fix-v7.0-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A couple of device ID and quirk updates, plus a bunch of small fixes most of which (other than the Cadence one) are unremarkable error handling fixes" * tag 'spi-fix-v7.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: atcspi200: Handle invalid buswidth and fix compiler warning spi: dt-bindings: sun6i: Allow Dual SPI and Quad SPI for newer SoCs spi: intel-pci: Add support for Nova Lake mobile SPI flash spi: cadence-qspi: Fix requesting of APB and AHB clocks on JH7110 spi: rockchip-sfc: Fix double-free in remove() callback spi: atcspi200: Fix double-free in atcspi_configure_dma() spi: amlogic: spifc-a4: Fix DMA mapping error handling
2026-03-13Merge tag 'regulator-fix-v7.0-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "A couple of small driver specific fixes for pca9450, cleaning up logging and fixing warnings due to confusion with interrupt type" * tag 'regulator-fix-v7.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: pca9450: Correct probed name for PCA9452 regulator: pca9450: Correct interrupt type
2026-03-13arm64: mm: Wrap flush_tlb_page() around __do_flush_tlb_range()Ryan Roberts
Flushing a page from the tlb is just a special case of flushing a range. So let's rework flush_tlb_page() so that it simply wraps __do_flush_tlb_range(). While at it, let's also update the API to take the same flags that we use when flushing a range. This allows us to delete all the ugly "_nosync", "_local" and "_nonotify" variants. Thanks to constant folding, all of the complex looping and tlbi-by-range options get eliminated so that the generated code for flush_tlb_page() looks very similar to the previous version. Reviewed-by: Linu Cherian <linu.cherian@arm.com> Signed-off-by: Ryan Roberts <ryan.roberts@arm.com> Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2026-03-13arm64: mm: More flags for __flush_tlb_range()Ryan Roberts
Refactor function variants with "_nosync", "_local" and "_nonotify" into a single __always_inline implementation that takes flags and rely on constant folding to select the parts that are actually needed at any given callsite, based on the provided flags. Flags all live in the tlbf_t (TLB flags) type; TLBF_NONE (0) continues to provide the strongest semantics (i.e. evict from walk cache, broadcast, synchronise and notify). Each flag reduces the strength in some way; TLBF_NONOTIFY, TLBF_NOSYNC and TLBF_NOBROADCAST are added to complement the existing TLBF_NOWALKCACHE. There are no users that require TLBF_NOBROADCAST without TLBF_NOWALKCACHE so implement that as BUILD_BUG() to avoid needing to introduce dead code for vae1 invalidations. The result is a clearer, simpler, more powerful API. Signed-off-by: Ryan Roberts <ryan.roberts@arm.com> Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2026-03-13arm64: mm: Refactor __flush_tlb_range() to take flagsRyan Roberts
We have function variants with "_nosync", "_local", "_nonotify" as well as the "last_level" parameter. Let's generalize and simplify by using a flags parameter to encode all these variants. As a first step, convert the "last_level" boolean parameter to a flags parameter and create the first flag, TLBF_NOWALKCACHE. When present, walk cache entries are not evicted, which is the same as the old last_level=true. Reviewed-by: Linu Cherian <linu.cherian@arm.com> Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com> Signed-off-by: Ryan Roberts <ryan.roberts@arm.com> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2026-03-13arm64: mm: Refactor flush_tlb_page() to use __tlbi_level_asid()Ryan Roberts
Now that we have __tlbi_level_asid(), let's refactor the *flush_tlb_page*() variants to use it rather than open coding. The emitted tlbi(s) is/are intended to be exactly the same as before; no TTL hint is provided. Although the spec for flush_tlb_page() allows for setting the TTL hint to 3, it turns out that flush_tlb_fix_spurious_fault_pmd() depends on local_flush_tlb_page_nonotify() to invalidate the level 2 entry. This will be fixed separately. Reviewed-by: Linu Cherian <linu.cherian@arm.com> Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com> Signed-off-by: Ryan Roberts <ryan.roberts@arm.com> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2026-03-13arm64: mm: Simplify __flush_tlb_range_limit_excess()Will Deacon
__flush_tlb_range_limit_excess() is unnecessarily complicated: - It takes a 'start', 'end' and 'pages' argument, whereas it only needs 'pages' (which the caller has computed from the other two arguments!). - It erroneously compares 'pages' with MAX_TLBI_RANGE_PAGES when the system doesn't support range-based invalidation but the range to be invalidated would result in fewer than MAX_DVM_OPS invalidations. Simplify the function so that it no longer takes the 'start' and 'end' arguments and only considers the MAX_TLBI_RANGE_PAGES threshold on systems that implement range-based invalidation. Signed-off-by: Will Deacon <will@kernel.org> Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com> Signed-off-by: Ryan Roberts <ryan.roberts@arm.com> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2026-03-13arm64: mm: Simplify __TLBI_RANGE_NUM() macroWill Deacon
Since commit e2768b798a19 ("arm64/mm: Modify range-based tlbi to decrement scale"), we don't need to clamp the 'pages' argument to fit the range for the specified 'scale' as we know that the upper bits will have been processed in a prior iteration. Drop the clamping and simplify the __TLBI_RANGE_NUM() macro. Signed-off-by: Will Deacon <will@kernel.org> Reviewed-by: Ryan Roberts <ryan.roberts@arm.com> Reviewed-by: Dev Jain <dev.jain@arm.com> Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com> Signed-off-by: Ryan Roberts <ryan.roberts@arm.com> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2026-03-13arm64: mm: Re-implement the __flush_tlb_range_op macro in CRyan Roberts
The __flush_tlb_range_op() macro is horrible and has been a previous source of bugs thanks to multiple expansions of its arguments (see commit f7edb07ad7c6 ("Fix mmu notifiers for range-based invalidates")). Rewrite the thing in C. Suggested-by: Linus Torvalds <torvalds@linux-foundation.org> Co-developed-by: Will Deacon <will@kernel.org> Signed-off-by: Will Deacon <will@kernel.org> Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com> Signed-off-by: Ryan Roberts <ryan.roberts@arm.com> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2026-03-13arm64: mm: Inline __TLBI_VADDR_RANGE() into __tlbi_range()Will Deacon
The __TLBI_VADDR_RANGE() macro is only used in one place and isn't something that's generally useful outside of the low-level range invalidation gubbins. Inline __TLBI_VADDR_RANGE() into the __tlbi_range() function so that the macro can be removed entirely. Signed-off-by: Will Deacon <will@kernel.org> Reviewed-by: Linu Cherian <linu.cherian@arm.com> Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com> Signed-off-by: Ryan Roberts <ryan.roberts@arm.com> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2026-03-13arm64: mm: Push __TLBI_VADDR() into __tlbi_level()Will Deacon
The __TLBI_VADDR() macro takes an ASID and an address and converts them into a single argument formatted correctly for a TLB invalidation instruction. Rather than have callers worry about this (especially in the case where the ASID is zero), push the macro down into __tlbi_level() via a new __tlbi_level_asid() helper. Signed-off-by: Will Deacon <will@kernel.org> Reviewed-by: Linu Cherian <linu.cherian@arm.com> Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com> Signed-off-by: Ryan Roberts <ryan.roberts@arm.com> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2026-03-13arm64: mm: Implicitly invalidate user ASID based on TLBI operationRyan Roberts
When kpti is enabled, separate ASIDs are used for userspace and kernelspace, requiring ASID-qualified TLB invalidation by virtual address to invalidate both of them. Push the logic for invalidating the two ASIDs down into the low-level tlbi-op-specific functions and remove the burden from the caller to handle the kpti-specific behaviour. Co-developed-by: Will Deacon <will@kernel.org> Signed-off-by: Will Deacon <will@kernel.org> Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com> Signed-off-by: Ryan Roberts <ryan.roberts@arm.com> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2026-03-13arm64: mm: Introduce a C wrapper for by-range TLB invalidationRyan Roberts
As part of efforts to reduce our reliance on complex preprocessor macros for TLB invalidation routines, introduce a new C wrapper for by-range TLB invalidation which can be used instead of the __tlbi() macro and can additionally be called from C code. Each specific tlbi range op is implemented as a C function and the appropriate function pointer is passed to __tlbi_range(). Since everything is declared inline and is statically resolvable, the compiler will convert the indirect function call to a direct inline execution. Suggested-by: Linus Torvalds <torvalds@linux-foundation.org> Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com> Signed-off-by: Ryan Roberts <ryan.roberts@arm.com> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>