summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-03-11dt-bindings: interrupt-controller: apple,aic2: Add AICv3Janne Grunau
AIC version 3 as found on the Apple M3 (t8122) is very similar to AICv2 in its base functionality. It can use the same device tree bindings as AICv2 so add it to the AICv2 bindings. This interrupt controller is used on all Apple SoCs starting with M3 up to at least M5. The only apparent difference is the increased IRQ config offset. Apple's device tree codes this new offset as property of the "aic" node but the value stayed constant for all SoCs with "aic,3". Since the SoC specific compatible "apple,t8122-aic3" will be only used in the driver this offset can remain a driver implementation detail. Signed-off-by: Janne Grunau <j@jannau.net> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Reviewed-by: Rob Herring (Arm) <robh@kernel.org> Link: https://patch.msgid.link/20260223-irq-apple-aic3-v3-1-2b7328076b8d@jannau.net
2026-03-11irqchip/imx-irqsteer: Add NXP S32N79 supportCiprian Marian Costea
Add support for the interrupt steering controller found in NXP S32N79 series automotive SoCs. The S32N79 IRQ_STEER variant differs from the i.MX version by not implementing the CHANCTRL register. To handle this hardware difference, introduce a device type data structure with quirks field. The IRQSTEER_QUIRK_NO_CHANCTRL quirk skips CHANCTRL register access for S32N79 variants. The interrupt routing functionality and register layout are otherwise identical between the two variants. Co-developed-by: Larisa Grigore <larisa.grigore@nxp.com> Signed-off-by: Larisa Grigore <larisa.grigore@nxp.com> Signed-off-by: Ciprian Marian Costea <ciprianmarian.costea@oss.nxp.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260311081154.381881-4-ciprianmarian.costea@oss.nxp.com
2026-03-11tracing: selftests: Add hypervisor trace remote testsVincent Donnefort
Run the trace remote selftests with the trace remote 'hypervisor', This trace remote is most likely created when the arm64 KVM nVHE/pKVM hypervisor is in use. Cc: Shuah Khan <skhan@linuxfoundation.org> Cc: linux-kselftest@vger.kernel.org Signed-off-by: Vincent Donnefort <vdonnefort@google.com> Link: https://patch.msgid.link/20260309162516.2623589-31-vdonnefort@google.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-03-11KVM: arm64: Add selftest event support to nVHE/pKVM hypVincent Donnefort
Add a selftest event that can be triggered from a `write_event` tracefs file. This intends to be used by trace remote selftests. Signed-off-by: Vincent Donnefort <vdonnefort@google.com> Link: https://patch.msgid.link/20260309162516.2623589-30-vdonnefort@google.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-03-11KVM: arm64: Add hyp_enter/hyp_exit events to nVHE/pKVM hypVincent Donnefort
The hyp_enter and hyp_exit events are logged by the hypervisor any time it is entered and exited. Signed-off-by: Vincent Donnefort <vdonnefort@google.com> Link: https://patch.msgid.link/20260309162516.2623589-29-vdonnefort@google.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-03-11KVM: arm64: Add event support to the nVHE/pKVM hyp and trace remoteVincent Donnefort
Allow the creation of hypervisor and trace remote events with a single macro HYP_EVENT(). That macro expands in the kernel side to add all the required declarations (based on REMOTE_EVENT()) as well as in the hypervisor side to create the trace_<event>() function. Signed-off-by: Vincent Donnefort <vdonnefort@google.com> Link: https://patch.msgid.link/20260309162516.2623589-28-vdonnefort@google.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-03-11KVM: arm64: Add trace reset to the nVHE/pKVM hypVincent Donnefort
Make the hypervisor reset either the whole tracing buffer or a specific ring-buffer, on remotes/hypervisor/trace or per_cpu/<cpu>/trace write access. Signed-off-by: Vincent Donnefort <vdonnefort@google.com> Link: https://patch.msgid.link/20260309162516.2623589-27-vdonnefort@google.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-03-11KVM: arm64: Sync boot clock with the nVHE/pKVM hypVincent Donnefort
Configure the hypervisor tracing clock with the kernel boot clock. For tracing purposes, the boot clock is interesting: it doesn't stop on suspend. However, it is corrected on a regular basis, which implies the need to re-evaluate it every once in a while. Cc: John Stultz <jstultz@google.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Stephen Boyd <sboyd@kernel.org> Cc: Christopher S. Hall <christopher.s.hall@intel.com> Cc: Richard Cochran <richardcochran@gmail.com> Signed-off-by: Vincent Donnefort <vdonnefort@google.com> Link: https://patch.msgid.link/20260309162516.2623589-26-vdonnefort@google.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-03-11KVM: arm64: Add trace remote for the nVHE/pKVM hypVincent Donnefort
In both protected and nVHE mode, the hypervisor is capable of writing events into tracefs compatible ring-buffers. Create a trace remote so the kernel can read those buffers. This currently doesn't provide any event support which will come later. Signed-off-by: Vincent Donnefort <vdonnefort@google.com> Link: https://patch.msgid.link/20260309162516.2623589-25-vdonnefort@google.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-03-11KVM: arm64: Add tracing capability for the nVHE/pKVM hypVincent Donnefort
There is currently no way to inspect or log what's happening at EL2 when the nVHE or pKVM hypervisor is used. With the growing set of features for pKVM, the need for tooling is more pressing. And tracefs, by its reliability, versatility and support for user-space is fit for purpose. Add support to write into a tracefs compatible ring-buffer. There's no way the hypervisor could log events directly into the host tracefs ring-buffers. So instead let's use our own, where the hypervisor is the writer and the host the reader. Signed-off-by: Vincent Donnefort <vdonnefort@google.com> Link: https://patch.msgid.link/20260309162516.2623589-24-vdonnefort@google.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-03-11KVM: arm64: Support unaligned fixmap in the pKVM hypVincent Donnefort
Return the fixmap VA with the page offset, instead of the page base address. This allows to use hyp_fixmap_map() seamlessly regardless of the address alignment. While at it, do the same for hyp_fixblock_map(). Signed-off-by: Vincent Donnefort <vdonnefort@google.com> Link: https://patch.msgid.link/20260309162516.2623589-23-vdonnefort@google.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-03-11KVM: arm64: Initialise hyp_nr_cpus for nVHE hypVincent Donnefort
Knowing the number of CPUs is necessary for determining the boundaries of per-cpu variables, which will be used for upcoming hypervisor tracing. hyp_nr_cpus which stores this value, is only initialised for the pKVM hypervisor. Make it accessible for the nVHE hypervisor as well. With the kernel now responsible for initialising hyp_nr_cpus, the nr_cpus parameter is no longer needed in __pkvm_init. Signed-off-by: Vincent Donnefort <vdonnefort@google.com> Link: https://patch.msgid.link/20260309162516.2623589-22-vdonnefort@google.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-03-11KVM: arm64: Add clock support to nVHE/pKVM hypVincent Donnefort
In preparation for supporting tracing from the nVHE hyp, add support to generate timestamps with a clock fed by the CNTCVT counter. The clock can be kept in sync with the kernel's by updating the slope values. This will be done later. As current we do only create a trace clock, make the whole support dependent on the upcoming CONFIG_NVHE_EL2_TRACING. Signed-off-by: Vincent Donnefort <vdonnefort@google.com> Link: https://patch.msgid.link/20260309162516.2623589-21-vdonnefort@google.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-03-11KVM: arm64: Add PKVM_DISABLE_STAGE2_ON_PANICVincent Donnefort
On NVHE_EL2_DEBUG, when using pKVM, the host stage-2 is relaxed to grant the kernel access to the stacktrace, hypervisor bug table and text to symbolize addresses. This is unsafe for production. In preparation for adding more debug options to NVHE_EL2_DEBUG, decouple the stage-2 relaxation into a separate option. While at it, rename PROTECTED_NVHE_STACKTRACE into PKVM_STACKTRACE, following the same naming scheme as PKVM_DISABLE_STAGE2_ON_PANIC. Reviewed-by: Kalesh Singh <kaleshsingh@google.com> Signed-off-by: Vincent Donnefort <vdonnefort@google.com> Link: https://patch.msgid.link/20260309162516.2623589-20-vdonnefort@google.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-03-11drm/panthor: Fix the "done_fence is initialized" detection logicBoris Brezillon
After commit 541c8f2468b9 ("dma-buf: detach fence ops on signal v3"), dma_fence::ops == NULL can't be used to check if the fence is initialized. Use dma_fence_was_initialized() instead. v2: - Use dma_fence_was_initialized() instead of open-coding it Cc: Nicolas Frattaroli <nicolas.frattaroli@collabora.com> Cc: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Cc: Philipp Stanner <phasta@kernel.org> Cc: Christian König <christian.koenig@amd.com> Reported-by: Steven Price <steven.price@arm.com> Reported-by: Nicolas Frattaroli <nicolas.frattaroli@collabora.com> Fixes: 541c8f2468b9 ("dma-buf: detach fence ops on signal v3") Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com> Reviewed-by: Christian König <christian.koenig@amd.com> Tested-by: Nicolas Frattaroli <nicolas.frattaroli@collabora.com> Reviewed-by: Steven Price <steven.price@arm.com> Reviewed-by: Liviu Dudau <liviu.dudau@arm.com> Signed-off-by: Steven Price <steven.price@arm.com> Link: https://patch.msgid.link/20260309124318.222902-1-boris.brezillon@collabora.com
2026-03-11gpiolib: clear requested flag if line is invalidBarnabás Pőcze
If `gpiochip_line_is_valid()` fails, then `-EINVAL` is returned, but `desc->flags` will have `GPIOD_FLAG_REQUESTED` set, which will result in subsequent calls misleadingly returning `-EBUSY`. Fix that by clearing the flag in case of failure. Fixes: a501624864f3 ("gpio: Respect valid_mask when requesting GPIOs") Signed-off-by: Barnabás Pőcze <pobrn@protonmail.com> Reviewed-by: Matti Vaittinen <mazziesaccount@gmail.com> Link: https://patch.msgid.link/20260310204359.1202451-1-pobrn@protonmail.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-03-11gpio: tegra186: allocate irqs with the main structRosen Penev
Remove an extra kcalloc call by using a flexible array member. Add __counted_by for extra runtime analysis. Assign counting variable immediately after allocation as required by __counted_by. Signed-off-by: Rosen Penev <rosenp@gmail.com> Link: https://patch.msgid.link/20260309232804.331882-1-rosenp@gmail.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-03-11gpio: htc-egpio: allocate irq with the main structRosen Penev
Use a flexible array member to combinwe allocations. Add __counted_by for extra runtime analysis. Signed-off-by: Rosen Penev <rosenp@gmail.com> Link: https://patch.msgid.link/20260309225204.44789-1-rosenp@gmail.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-03-11gpio: bcm-kona: reduce the number of memory allocationsRosen Penev
Simplify allocation by using a flexible array member. Use __counted_by for extra runtime analysis. Shuffle some code as __counted_by requires the counting variable to be set right after allocation. Signed-off-by: Rosen Penev <rosenp@gmail.com> Link: https://patch.msgid.link/20260311003431.31881-1-rosenp@gmail.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-03-11drm/loongson: use drm_gem_ttm_dumb_map_offset()Amin GATTOUT
Replace the open-coded lsdc_dumb_map_offset() with the generic drm_gem_ttm_dumb_map_offset() helper, which is functionally identical. This removes unnecessary boilerplate and aligns with the DRM convention for TTM-based drivers. Signed-off-by: Amin GATTOUT <amin.gattout@gmail.com> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patch.msgid.link/20260308-master-v1-1-af32d71c8a1d@gmail.com
2026-03-11drm/gem-shmem: Track folio accessed/dirty status in vmapThomas Zimmermann
On successful vmap, set the page_mark_accessed_on_put and _dirty_on_put flags in the gem-shmem object. Signals that the contained pages require LRU and dirty tracking when they are being released back to SHMEM. Clear these flags on put, so that the buffer remains quiet until the next call to vmap. There's no means of handling dirty status in vmap as there's no write-only mapping available. Both flags, _accessed_on_put and _dirty_on_put, have always been part of the gem-shmem object, but never used much. So most drivers did not track the page status correctly. Only the v3d and imagination drivers make limited use of _dirty_on_put. In the case of imagination, move the flag setting from init to cleanup. This ensures writeback of modified pages but does not interfere with the internal vmap/vunmap calls. V3d already implements this behaviour. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com> # gem-shmem Acked-by: Frank Binns <frank.binns@imgtec.com> # imagination Tested-by: Frank Binns <frank.binns@imgtec.com> # imagination Link: https://patch.msgid.link/20260227114509.165572-7-tzimmermann@suse.de
2026-03-11drm/gem-shmem: Track folio accessed/dirty status in mmapThomas Zimmermann
Invoke folio_mark_accessed() in mmap page faults to add the folio to the memory manager's LRU list. Userspace invokes mmap to get the memory for software rendering. Compositors do the same when creating the final on-screen image, so keeping the pages in LRU makes sense. Avoids paging out graphics buffers when under memory pressure. In pfn_mkwrite, further invoke the folio_mark_dirty() to add the folio for writeback should the underlying file be paged out from system memory. This rarely happens in practice, yet it would corrupt the buffer content. This has little effect on a system's hardware-accelerated rendering, which only mmaps for an initial setup of textures, meshes, shaders, etc. v4: - test for VM_FAULT_NOPAGE before marking folio as accessed (Boris) - test page-array bounds in mkwrite handler (Boris) v3: - rewrite for VM_PFNMAP v2: - adapt to changes in drm_gem_shmem_try_mmap_pmd() Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com> Link: https://patch.msgid.link/20260227114509.165572-6-tzimmermann@suse.de
2026-03-11drm/gem-shmem: Refactor drm_gem_shmem_try_map_pmd()Thomas Zimmermann
The current mmap page-fault handler requires some changes before it can track folio access. Call to folio_test_pmd_mappable() into the mmap page-fault handler before calling drm_gem_shmem_try_map_pmd(). The folio will become useful for tracking the access status. Also rename drm_gem_shmem_try_map_pmd() to _try_insert_pfn_pmd() and only pass the page fault and page-frame number. The new name and parameters make it similar to vmf_insert_pfn_pmd(). No functional changes. If PMD mapping fails or is not supported, insert a regular PFN as before. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com> Link: https://patch.msgid.link/20260227114509.165572-5-tzimmermann@suse.de
2026-03-11drm/gem-shmem: Return vm_fault_t from drm_gem_shmem_try_map_pmd()Thomas Zimmermann
Return the exact VM_FAULT_ mask from drm_gem_shmem_try_map_pmd(). Gives the caller better insight into the result. Return 0 if nothing was done. If the caller sees VM_FAULT_NOPAGE, drm_gem_shmem_try_map_pmd() added a PMD entry to the page table. As before, return early from the page-fault handler in that case. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Suggested-by: Matthew Wilcox <willy@infradead.org> Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com> Link: https://patch.msgid.link/20260227114509.165572-4-tzimmermann@suse.de
2026-03-11drm/gem-shmem: Test for existence of page in mmap fault handlerThomas Zimmermann
Not having a page pointer in the mmap fault handler is an error. Test for this situation and return VM_FAULT_SIGBUS if so. Also replace several lookups of the page with a local variable. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com> Link: https://patch.msgid.link/20260227114509.165572-3-tzimmermann@suse.de
2026-03-11drm/gem-shmem: Use obj directly where appropriate in fault handlerThomas Zimmermann
Replace shmem->base with obj in several places. It is the same value, but the latter is easier to read. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com> Link: https://patch.msgid.link/20260227114509.165572-2-tzimmermann@suse.de
2026-03-11drm/xe/userptr: Defer Waiting for TLB invalidation to the second pass if ↵Thomas Hellström
possible Now that the two-pass notifier flow uses xe_vma_userptr_do_inval() for the fence-wait + TLB-invalidate work, extend it to support a further deferred TLB wait: - xe_vma_userptr_do_inval(): when the embedded finish handle is free, submit the TLB invalidation asynchronously (xe_vm_invalidate_vma_submit) and return &userptr->finish so the mmu_notifier core schedules a third pass. When the handle is occupied by a concurrent invalidation, fall back to the synchronous xe_vm_invalidate_vma() path. - xe_vma_userptr_complete_tlb_inval(): new helper called from invalidate_finish when tlb_inval_submitted is set. Waits for the previously submitted batch and unmaps the gpusvm pages. xe_vma_userptr_invalidate_finish() dispatches between the two helpers via tlb_inval_submitted, making the three possible flows explicit: pass1 (fences pending) -> invalidate_finish -> do_inval (sync TLB) pass1 (fences done) -> do_inval -> invalidate_finish -> complete_tlb_inval (deferred TLB) pass1 (finish occupied) -> do_inval (sync TLB, inline) In multi-GPU scenarios this allows TLB flushes to be submitted on all GPUs in one pass before any of them are waited on. Also adds xe_vm_invalidate_vma_submit() which submits the TLB range invalidation without blocking, populating a xe_tlb_inval_batch that the caller waits on separately. v3: - Add locking asserts and notifier state asserts (Matt Brost) - Update the locking documentation of the notifier state members (Matt Brost) - Remove unrelated code formatting changes (Matt Brost) Assisted-by: GitHub Copilot:claude-sonnet-4.6 Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260305093909.43623-5-thomas.hellstrom@linux.intel.com
2026-03-11drm/xe: Split TLB invalidation into submit and wait stepsThomas Hellström
xe_vm_range_tilemask_tlb_inval() submits TLB invalidation requests to all GTs in a tile mask and then immediately waits for them to complete before returning. This is fine for the existing callers, but a subsequent patch will need to defer the wait in order to overlap TLB invalidations across multiple VMAs. Introduce xe_tlb_inval_range_tilemask_submit() and xe_tlb_inval_batch_wait() in xe_tlb_inval.c as the submit and wait halves respectively. The batch of fences is carried in the new xe_tlb_inval_batch structure. Remove xe_vm_range_tilemask_tlb_inval() and convert all three call sites to the new API. v3: - Don't wait on TLB invalidation batches if the corresponding batch submit returns an error. (Matt Brost) - s/_batch/batch/ (Matt Brost) Assisted-by: GitHub Copilot:claude-sonnet-4.6 Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260305093909.43623-4-thomas.hellstrom@linux.intel.com
2026-03-11drm/xe/userptr: Convert invalidation to two-pass MMU notifierThomas Hellström
In multi-GPU scenarios, asynchronous GPU job latency is a bottleneck if each notifier waits for its own GPU before returning. The two-pass mmu_interval_notifier infrastructure allows deferring the wait to a second pass, so all GPUs can be signalled in the first pass before any of them are waited on. Convert the userptr invalidation to use the two-pass model: Use invalidate_start as the first pass to mark the VMA for repin and enable software signalling on the VM reservation fences to start any gpu work needed for signaling. Fall back to completing the work synchronously if all fences are already signalled, or if a concurrent invalidation is already using the embedded finish structure. Use invalidate_finish as the second pass to wait for the reservation fences to complete, invalidate the GPU TLB in fault mode, and unmap the gpusvm pages. Embed a struct mmu_interval_notifier_finish in struct xe_userptr to avoid dynamic allocation in the notifier callback. Use a finish_inuse flag to prevent two concurrent invalidations from using it simultaneously; fall back to the synchronous path for the second caller. v3: - Add locking asserts in notifier components (Matt Brost) - Clean up newlines (Matt Brost) - Update the userptr notifier state member locking documentation (Matt Brost) Assisted-by: GitHub Copilot:claude-sonnet-4.6 Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260305093909.43623-3-thomas.hellstrom@linux.intel.com
2026-03-11mm/mmu_notifier: Allow two-pass struct mmu_interval_notifiersThomas Hellström
GPU use-cases for mmu_interval_notifiers with hmm often involve starting a gpu operation and then waiting for it to complete. These operations are typically context preemption or TLB flushing. With single-pass notifiers per GPU this doesn't scale in multi-gpu scenarios. In those scenarios we'd want to first start preemption- or TLB flushing on all GPUs and as a second pass wait for them to complete. One can do this on per-driver basis multiplexing per-driver notifiers but that would mean sharing the notifier "user" lock across all GPUs and that doesn't scale well either, so adding support for multi-pass in the core appears to be the right choice. Implement two-pass capability in the mmu_interval_notifier. Use a linked list for the final passes to minimize the impact for use-cases that don't need the multi-pass functionality by avoiding a second interval tree walk, and to be able to easily pass data between the two passes. v1: - Restrict to two passes (Jason Gunthorpe) - Improve on documentation (Jason Gunthorpe) - Improve on function naming (Alistair Popple) v2: - Include the invalidate_finish() callback in the struct mmu_interval_notifier_ops. - Update documentation (GitHub Copilot:claude-sonnet-4.6) - Use lockless list for list management. v3: - Update kerneldoc for the struct mmu_interval_notifier_finish::list member (Matthew Brost) - Add a WARN_ON_ONCE() checking for NULL invalidate_finish() op if if invalidate_start() is non-NULL. (Matthew Brost) v4: - Addressed documentation review comments by David Hildenbrand. Cc: Matthew Brost <matthew.brost@intel.com> Cc: Christian König <christian.koenig@amd.com> Cc: David Hildenbrand <david@kernel.org> Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com> Cc: Liam R. Howlett <Liam.Howlett@oracle.com> Cc: Vlastimil Babka <vbabka@kernel.org> Cc: Mike Rapoport <rppt@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Michal Hocko <mhocko@suse.com> Cc: Jason Gunthorpe <jgg@ziepe.ca> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Simona Vetter <simona.vetter@ffwll.ch> Cc: Dave Airlie <airlied@gmail.com> Cc: Alistair Popple <apopple@nvidia.com> Cc: <dri-devel@lists.freedesktop.org> Cc: <linux-mm@kvack.org> Cc: <linux-kernel@vger.kernel.org> Assisted-by: GitHub Copilot:claude-sonnet-4.6 # Documentation only. Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Acked-by: David Hildenbrand (Arm) <david@kernel.org> Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Link: https://patch.msgid.link/20260305093909.43623-2-thomas.hellstrom@linux.intel.com
2026-03-11ALSA: usb-audio: Add iface reset and delay quirk for SPACETOUCH USB AudioLianqin Hu
Setting up the interface when suspended/resumeing fail on this card. Adding a reset and delay quirk will eliminate this problem. usb 1-1: New USB device found, idVendor=0666, idProduct=0880 usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: USB Audio usb 1-1: Manufacturer: SPACETOUCH usb 1-1: SerialNumber: 000000000 Signed-off-by: Lianqin Hu <hulianqin@vivo.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/TYUPR06MB6217ACC80B70BE25D87456B0D247A@TYUPR06MB6217.apcprd06.prod.outlook.com
2026-03-11MAINTAINERS: adjust file entry in GPU BUDDY ALLOCATORLukas Bulwahn
The commit 4a9671a03f2b ("gpu: Move DRM buddy allocator one level up (part one)") and commit ba110db8e1bc ("gpu: Move DRM buddy allocator one level up (part two)") split the majority of the file drivers/gpu/drm/drm_buddy.c into drivers/gpu/buddy.c, with some pieces remaining in the original location drivers/gpu/drm/drm_buddy.c. The commits also adjust the file entries in the GPU BUDDY ALLOCATOR section, but as part of that, change the file entry to the non-existing file drivers/gpu/drm_buddy.c instead of keeping the reference to the existing file drivers/gpu/drm/drm_buddy.c. Make the file entry in GPU BUDDY ALLOCATOR refer to the intended existing file. While at it, order the file entries in this section alphabetically. Signed-off-by: Lukas Bulwahn <lukas.bulwahn@redhat.com> Reviewed-by: Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam@amd.com> Reviewed-by: Joel Fernandes <joelagnelf@nvidia.com> Link: https://patch.msgid.link/20260311043314.265627-1-lukas.bulwahn@redhat.com Signed-off-by: Maxime Ripard <mripard@kernel.org>
2026-03-11scripts: kconfig: merge_config.sh: fix indentationDaniel Gomez
Replace spaces with tabs for consistency with the rest of the script. Fixes: 5fa9b82cbcfc5 ("scripts: kconfig: merge_config.sh: refactor from shell/sed/grep to awk") Signed-off-by: Daniel Gomez <da.gomez@samsung.com> Link: https://patch.msgid.link/20260310-fixes-merge-config-v1-2-beaeeaded6bd@samsung.com Signed-off-by: Nathan Chancellor <nathan@kernel.org>
2026-03-11scripts: kconfig: merge_config.sh: pass output file as awk variableDaniel Gomez
The refactoring commit 5fa9b82cbcfc5 ("scripts: kconfig: merge_config.sh: refactor from shell/sed/grep to awk") passes $TMP_FILE.new as ARGV[3] to awk, using it as both an output destination and an input file argument. When the base file is empty, nothing is written to ARGV[3] during processing, so awk fails trying to open it for reading: awk: cmd. line:52: fatal: cannot open file `./.tmp.config.grcQin34jb.new' for reading: No such file or directory mv: cannot stat './.tmp.config.grcQin34jb.new': No such file or directory Pass the output path via -v outfile instead and drop the FILENAME == ARGV[3] { nextfile }. Fixes: 5fa9b82cbcfc5 ("scripts: kconfig: merge_config.sh: refactor from shell/sed/grep to awk") Signed-off-by: Daniel Gomez <da.gomez@samsung.com> Link: https://patch.msgid.link/20260310-fixes-merge-config-v1-1-beaeeaded6bd@samsung.com Signed-off-by: Nathan Chancellor <nathan@kernel.org>
2026-03-11reset: don't overwrite fwnode_reset_n_cellsBartosz Golaszewski
Fix a logic bug in reset_controller_register() where we set fwnode_reset_n_cells to 1 if fwnode is set and fwnode_xlate is not but we do it after assigning of_fwnode_handle(of_node) to fwnode. Modify the logic to: assign fwnode from of_node if applicable, if fwnode is still not set, try to get it from the device and only then check of_xlate and fwnode_xlate and either assign fwnode_reset_n_cells from OF or default to fwnode_reset_simple_xlate and fwnode_reset_n_cells = 1. Fixes: ba8dbbb14b7e ("reset: convert the core API to using firmware nodes") Reported-by: Mark Brown <broonie@kernel.org> Closes: https://lore.kernel.org/all/0b72286b-33dd-4bc9-8c0e-161c2f4baed8@sirena.org.uk/ Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Tested-by: Mark Brown <broonie@kernel.org> Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de> Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
2026-03-11power: reset: reboot-mode: fix -Wformat-security warningArnd Bergmann
The device_create() function expects a format string to construct a device name, so passing a variable here introduces a possible vulnerability in case the string can contain '%' characters: drivers/power/reset/reboot-mode.c:148:22: error: format string is not a string literal (potentially insecure) [-Werror,-Wformat-security] drivers/power/reset/reboot-mode.c:148:22: note: treat the string as an argument to avoid this 148 | (void *)priv, reboot->dev->driver->name); Use an trivial "%s" format instead and pass the name as the string to be included here. Fixes: cfaf0a90789a ("power: reset: reboot-mode: Expose sysfs for registered reboot_modes") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Link: https://patch.msgid.link/20260306150738.497978-1-arnd@kernel.org Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-03-10perf disasm: Fix potential use-after-free on filelocIan Rogers
The fileloc is a copy of a pointer to a string but in places like symbol_disassemble__llvm this string appears to be freed setting up potential use-after-frees: llvm.c: ``` dl = disasm_line__new(args); if (dl == NULL) goto err; annotation_line__add(&dl->al, &notes->src->source); free(args->fileloc); ``` disasm.c: ``` static void annotation_line__init(struct annotation_line *al, struct annotate_args *args, int nr) { al->offset = args->offset; al->line = strdup(args->line); al->line_nr = args->line_nr; al->fileloc = args->fileloc; al->data_nr = nr; } struct disasm_line *disasm_line__new(struct annotate_args *args) { struct disasm_line *dl = NULL; struct annotation *notes = symbol__annotation(args->ms->sym); int nr = notes->src->nr_events; dl = zalloc(disasm_line_size(nr)); if (!dl) return NULL; annotation_line__init(&dl->al, args, nr); ``` Fix this by making the fileloc a copy of the underlying string in its init/exit. Signed-off-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-03-10perf tools: Add layout support for --symfs optionChangbin Du
Add support for parsing an optional layout parameter in the --symfs command line option. The format is: --symfs <directory[,layout]> Where layout can be: - 'hierarchy': matches full path (default) - 'flat': only matches base name When debugging symbol files from a copy of the filesystem (e.g., from a container or remote machine), the debug files are often stored in a flat directory structure with only filenames, not the full original paths. In this case, using 'flat' layout allows perf to find debug symbols by matching only the filename rather than the full path. For example, given a binary path like: /build/output/lib/foo.so With 'perf report --symfs /debug/files,flat', perf will look for: /debug/files/foo.so Instead of: /debug/files/build/output/lib/foo.so This is particularly useful when: - Extracting debug files from containers with different directory layouts - Working with build systems that flatten directory structures Signed-off-by: Changbin Du <changbin.du@huawei.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-03-11power: supply: ipaq_micro: Simplify with devmKrzysztof Kozlowski
Simplify the driver by using devm interfaces, which allow to drop probe() error paths and the remove() callback. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://patch.msgid.link/20260305-workqueue-devm-v2-6-66a38741c652@oss.qualcomm.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-03-11power: supply: mt6370: Simplify with devm_alloc_ordered_workqueue()Krzysztof Kozlowski
Simplify the driver probe function by using devm_alloc_ordered_workqueue() which handles the cleanup already. Change is not equivalent in the workqueue itself: use non-legacy API which does not set (__WQ_LEGACY | WQ_MEM_RECLAIM). The workqueue is used to update power supply data (power_supply_changed()) status, thus there is no point to run it for memory reclaim. Note that dev_name() is not directly used in second argument to prevent possible unlikely parsing any "%" character in device name as format. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://patch.msgid.link/20260305-workqueue-devm-v2-5-66a38741c652@oss.qualcomm.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-03-11power: supply: max77705: Free allocated workqueue and fix removal orderKrzysztof Kozlowski
Use devm interface for allocating workqueue to fix two bugs at the same time: 1. Driver leaks the memory on remove(), because the workqueue is not destroyed. 2. Driver allocates workqueue and then registers interrupt handlers with devm interface. This means that probe error paths will not use a reversed order, but first destroy the workqueue and then, via devm release handlers, free the interrupt. The interrupt handler schedules work on this exact workqueue, thus if interrupt is hit in this short time window - after destroying workqueue, but before devm() frees the interrupt - the schedulled work will lead to use of freed memory. Change is not equivalent in the workqueue itself: use non-legacy API which does not set (__WQ_LEGACY | WQ_MEM_RECLAIM). The workqueue is used to update power supply (power_supply_changed()) status, thus there is no point to run it for memory reclaim. Note that dev_name() is not directly used in second argument to prevent possible unlikely parsing any "%" character in device name as format. Fixes: 11741b8e382d ("power: supply: max77705: Fix workqueue error handling in probe") Fixes: a6a494c8e3ce ("power: supply: max77705: Add charger driver for Maxim 77705") Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://patch.msgid.link/20260305-workqueue-devm-v2-4-66a38741c652@oss.qualcomm.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-03-11power: supply: max77705: Drop duplicated IRQ error messageKrzysztof Kozlowski
Core already prints error message on devm_request_threaded_irq() failure, so no need to do that second time. Suggested-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://patch.msgid.link/20260305-workqueue-devm-v2-3-66a38741c652@oss.qualcomm.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-03-11power: supply: cw2015: Free allocated workqueueKrzysztof Kozlowski
Use devm interface so allocated workqueue will be freed during device removal and error paths, thus fixing a memory leak. Change is not equivalent in the workqueue itself: use non-legacy API which does not set (__WQ_LEGACY | WQ_MEM_RECLAIM). The workqueue is used to read updated data from the battery, thus there is no point to run it for memory reclaim. Cc: stable@vger.kernel.org Fixes: b4c7715c10c1 ("power: supply: add CellWise cw2015 fuel gauge driver") Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://patch.msgid.link/20260305-workqueue-devm-v2-2-66a38741c652@oss.qualcomm.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-03-11Merge branch 'for-7.1-devm-alloc-wq'Sebastian Reichel
Merge branch adding support for device-managed workqueue allocation, which allows cleaning up a couple of power-supply drivers. Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-03-10Merge tag 'v7.0-rc3-ksmbd-server-fixes' of git://git.samba.org/ksmbdLinus Torvalds
Pull smb server fixes from Steve French: - Fix potential use after free errors - Fix refcount leak in smb2 open error path - Prevent allowing logging signing or encryption keys * tag 'v7.0-rc3-ksmbd-server-fixes' of git://git.samba.org/ksmbd: ksmbd: Don't log keys in SMB3 signing and encryption key generation smb: server: fix use-after-free in smb2_open() ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close() ksmbd: fix use-after-free by using call_rcu() for oplock_info ksmbd: fix use-after-free in proc_show_files due to early rcu_read_unlock smb/server: Fix another refcount leak in smb2_open()
2026-03-10Merge branch 'net-stmmac-start-to-shrink-memory-usage'Jakub Kicinski
Russell King says: ==================== net: stmmac: start to shrink memory usage Start shrinking stmmac's memory usage by avoiding using "int" for members that are only used for 0/1 (boolean) values, or values that can't be larger than 255. In addition, as struct stmmac_dma_cfg is approximately a cache line, shrinks below a cache line as a result of this patch set, and is required, there is no point separately allocating this from struct plat_stmmacenet_data. Embed it into the end of this struct and set the existing pointer to avoid large wide-spread changes. Lastly, add documentation for struct stmmac_dma_cfg, and document the stmmac clocks as best we can given the driver history. ==================== Link: https://patch.msgid.link/aa6VEsmBK-S9eNYU@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-10net: stmmac: add documentation for clocksRussell King (Oracle)
Add documentation covering stmmac_clk, pclk, clk_ptp_ref and clk_tx_i in the hope that this will help understand what each of these clocks are for. There is confusion around stmmac_clk and pclk which can't be easily resolved today as the Imagination Technologies Pistachio board that pclk was introduced for has no public documentation and is likely now obsolete. So the origins of pclk are lost to the winds of time. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Tested-by: Mohd Ayaan Anwar <mohd.anwar@oss.qualcomm.com> Link: https://patch.msgid.link/E1vzX5Z-0000000CVsb-1XTm@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-10net: stmmac: add documentation for stmmac_dma_cfg membersRussell King (Oracle)
Add documentation of each of the struct stmmac_dma_cfg members. dche remains undocumented as I don't have documentation that covers this. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Tested-by: Mohd Ayaan Anwar <mohd.anwar@oss.qualcomm.com> Link: https://patch.msgid.link/E1vzX5U-0000000CVsQ-162V@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-10net: stmmac: use u8 for host_dma_width and similar struct membersRussell King (Oracle)
We aren't going to see >= 256-bit address busses soon, so reduce host_dma_width and associated other struct members that initialise this from u32 to u8. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Acked-by: Mohd Ayaan Anwar <mohd.anwar@oss.qualcomm.com> # qcom-ethqos Tested-by: Mohd Ayaan Anwar <mohd.anwar@oss.qualcomm.com> Link: https://patch.msgid.link/E1vzX5P-0000000CVsK-0iwX@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-10net: stmmac: use u8 for ?x_queues_to_use and number_?x_queuesRussell King (Oracle)
The maximum number of queues is a compile time constant of only eight. This makes using a 32-bit quantity wastefulf. Instead, use u8 for these and their associated variables. When reading the DT properties, saturdate at U8_MAX. Provided the core provides DMA capabilities to describe the number of queues, this will be capped by stmmac_hw_init() with a warning. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Tested-by: Mohd Ayaan Anwar <mohd.anwar@oss.qualcomm.com> Link: https://patch.msgid.link/E1vzX5K-0000000CVsE-0J0Y@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>