summaryrefslogtreecommitdiff
path: root/include
AgeCommit message (Collapse)Author
2026-07-28mm/vmalloc: honor GFP constraints in pcpu_get_vm_areas()Kaitao Cheng
Patch series "mm/percpu: Fix possible NOFS/NOIO reclaim recursion", v4. Commit 9a5b183941b5 ("mm, percpu: do not consider sleepable allocations atomic") allowed GFP_NOFS and GFP_NOIO percpu allocations to use pcpu_alloc_mutex and the chunk creation slow path. This restored the allocation capability that was lost when those constrained allocations were treated as atomic, but it also makes the percpu slow path visible to callers from constrained reclaim contexts. There are two related problems. First, the create and populate slow paths do not fully preserve the caller's allocation constraints. pcpu_alloc_noprof() derives pcpu_gfp from the caller supplied GFP mask and passes it down to the percpu backing page allocator. However, chunk creation calls pcpu_get_vm_areas(), and chunk population can allocate temporary metadata or vmalloc page tables while mapping backing pages. Those internal allocations can still use GFP_KERNEL, so a caller using GFP_NOFS or GFP_NOIO can enter unconstrained FS or IO reclaim while holding pcpu_alloc_mutex. One possible case is blk-cgroup after commit 5d726c4dbeed ("blk-cgroup: fix possible deadlock while configuring policy"). blkg_conf_prep() now serializes against blkcg_deactivate_policy() with q->blkcg_mutex, and blkg_alloc() uses GFP_NOIO because queue freeze and IO reclaim dependencies can otherwise deadlock. If the percpu slow path loses that GFP_NOIO context, direct reclaim or writeback can issue IO to a frozen queue while q->blkcg_mutex is held. Second, allowing sleepable GFP_NOFS/GFP_NOIO allocations to take pcpu_alloc_mutex means that unconstrained backing allocations made under the mutex can create an FS/IO reclaim dependency against a constrained caller which already holds an FS or IO lock and then waits for pcpu_alloc_mutex. This series fixes those issues in three steps: - pass the caller supplied GFP mask into pcpu_get_vm_areas() and use it for vmalloc metadata and KASAN shadow allocations; - pass the GFP mask through the chunk population path, including the temporary pages array and vmalloc page table allocation scope; - restrict percpu backing allocations performed while holding pcpu_alloc_mutex to GFP_NOIO, so they cannot recurse into IO or FS reclaim. This keeps sleepable GFP_NOFS/GFP_NOIO percpu allocations working, while avoiding the reclaim recursion risks introduced by making those allocations eligible for the mutex-protected slow path. This patch (of 4): pcpu_alloc_noprof() derives pcpu_gfp from the caller supplied GFP mask and passes it down to the backing percpu allocator. However, when the percpu vmalloc allocator has to create a new chunk, pcpu_create_chunk() calls pcpu_get_vm_areas() to allocate the corresponding vmalloc areas. pcpu_get_vm_areas() currently performs its internal allocations with GFP_KERNEL, including vmap area metadata, vm_struct metadata and KASAN vmalloc shadow population. This means that a caller which deliberately uses GFP_NOFS or GFP_NOIO can still enter FS or IO reclaim while creating the vmalloc areas for a new percpu chunk. One possible case is blk-cgroup after commit 5d726c4dbeed ("blk-cgroup: fix possible deadlock while configuring policy"). blkg_conf_prep() now serializes against blkcg_deactivate_policy() with q->blkcg_mutex, and blkg_alloc() was changed to GFP_NOIO for that reason: CPU0: blkg_conf_prep() mutex_lock(q->blkcg_mutex) blkg_alloc(..., GFP_NOIO) alloc_percpu_gfp(..., GFP_NOIO) pcpu_alloc_noprof(..., GFP_NOIO) pcpu_create_chunk(GFP_NOIO) pcpu_get_vm_areas() -> if percpu chunks are exhausted, chunk create may do internal GFP_KERNEL allocations -> direct reclaim / writeback can issue IO to this queue -> IO waits because the queue is frozen CPU1: blkcg_deactivate_policy() blk_mq_freeze_queue(q) mutex_lock(q->blkcg_mutex) -> waits for CPU0 ... unfreeze only happens after q->blkcg_mutex is acquired/released So the concern is that the caller deliberately uses GFP_NOIO because it may hold a lock which can be acquired after queue freeze, but the percpu slow path can temporarily lose that allocation context. Pass the caller supplied GFP mask from pcpu_create_chunk() to pcpu_get_vm_areas(), and use it for the internal vmalloc metadata and KASAN shadow allocations. Link: https://lore.kernel.org/20260618130414.96383-1-kaitao.cheng@linux.dev Link: https://lore.kernel.org/20260618130414.96383-2-kaitao.cheng@linux.dev Fixes: 9a5b183941b5 ("mm, percpu: do not consider sleepable allocations atomic") Signed-off-by: Kaitao Cheng <chengkaitao@kylinos.cn> Reviewed-by: Uladzislau Rezki (Sony) <urezki@gmail.com> Reviewed-by: Shivam Kalra <shivamkalra98@zohomail.in> Acked-by: Dennis Zhou <dennis@kernel.org> Acked-by: Michal Hocko <mhocko@suse.com> Cc: Christoph Lameter <cl@gentwo.org> Cc: Pedro Falcato <pfalcato@suse.de> Cc: Tejun Heo <tj@kernel.org> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-07-28mm: replace __ASSEMBLY__ with __ASSEMBLER__ in memory management header filesThomas Huth
While the GCC and Clang compilers already define __ASSEMBLER__ automatically when compiling assembly code, __ASSEMBLY__ is a macro that only gets defined by the Makefiles in the kernel. This can be very confusing when switching between userspace and kernelspace coding, or when dealing with uapi headers that rather should use __ASSEMBLER__ instead. So let's standardize now on the __ASSEMBLER__ macro that is provided by the compilers. This is a completely mechanical patch (done with a simple "sed -i" statement). Link: https://lore.kernel.org/20260619131830.229804-1-thuth@redhat.com Signed-off-by: Thomas Huth <thuth@redhat.com> Cc: Arnd Bergmann <arnd@arndb.de> Cc: Axel Rasmussen <axelrasmussen@google.com> Cc: Barry Song <baohua@kernel.org> Cc: David Hildenbrand <david@kernel.org> Cc: Kairui Song <kasong@tencent.com> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Shakeel Butt <shakeel.butt@linux.dev> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Cc: Wei Xu <weixugc@google.com> Cc: Yuanchu Xie <yuanchu@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-07-28mm/lruvec: trace LRU add drains and drain-all requestsJP Kobryn
LRU add batches can be drained before they reach capacity. This can be a source of LRU lock contention, but it is not currently possible to attribute these drains to callers with existing tracepoints. Add mm_lru_add_drain to report the CPU and lru_add batch count when an lru_add batch is drained. This allows tracing to distinguish full drains from partial drains and attribute them to the calling stack. Add mm_lru_add_drain_all to capture callers of __lru_add_drain_all and whether they set the force flag for all CPUs. The tracepoint resembles the signature of the enclosing function, but is needed because of potential inlining. Note that DECLARE_TRACE() is used for these new trace hooks to avoid creating a new trace event ABI. Link: https://lore.kernel.org/20260622185127.24579-1-jp.kobryn@linux.dev Signed-off-by: JP Kobryn <jp.kobryn@linux.dev> Reviewed-by: Barry Song <baohua@kernel.org> Acked-by: Shakeel Butt <shakeel.butt@linux.dev> Cc: Axel Rasmussen <axelrasmussen@google.com> Cc: Baoquan He <baoquan.he@linux.dev> Cc: Chris Li <chrisl@kernel.org> Cc: Kairui Song <kasong@tencent.com> Cc: Kemeng Shi <shikemeng@huaweicloud.com> Cc: "Masami Hiramatsu (Google)" <mhiramat@kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Cc: Matthew Wilcox (Oracle) <willy@infradead.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Nhat Pham <nphamcs@gmail.com> Cc: Steven Rostedt <rostedt@goodmis.org> Cc: Vlastimil Babka <vbabka@kernel.org> Cc: Wei Xu <weixugc@google.com> Cc: Yuanchu Xie <yuanchu@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-07-28Merge zorro updates from Uwe Kleine-König.Martin K. Petersen
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-28firmware: stratix10-svc: add async HWMON read commands and register ↵Tze Yee Ng
socfpga-hwmon device Add asynchronous Stratix 10 service layer support for hardware monitor temperature and voltage read commands in stratix10_svc_async_send() and stratix10_svc_async_prepare_response(). Register a socfpga-hwmon platform device from the service layer driver when hardware monitor support is enabled, similar to the RSU device. Signed-off-by: Nazim Amirul <muhammad.nazim.amirul.nazle.asmade@altera.com> Signed-off-by: Tze Yee Ng <tze.yee.ng@altera.com> Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
2026-07-29clk: spacemit: k3: fix i2s clock topologyTroy Mitchell
The K3 i2s clocks were modelled as a single path behind one MPMU register: pll1_d96_25p6 / i2s_153p6_base `-- i2s_sysclk_src (mux+gate, MPMU_ISCCR) `-- i2s1_sysclk (DDN, MPMU_ISCCR) |-- i2s_bclk (div+gate, MPMU_ISCCR) `-- i2s2_sysclk (mux, parent 0) The hardware actually has two i2s clock control registers, ISCCR0 (0x0040) and ISCCR1 (0x0044): ISCCR1 drives the common sysclk shared by i2s0/2/3/4/5 and the common bclk, whose divider always implies a fixed 1/2 factor in front, while ISCCR0 drives a dedicated path for i2s1: pll1_d96_25p6 / i2s_153p6_base |-- i2s_sysclk_src (mux+gate, MPMU_ISCCR1) | `-- i2s_sysclk (DDN, MPMU_ISCCR1) | |-- i2s_bclk_factor (fixed factor, /2) | | `-- i2s_bclk (div+gate, MPMU_ISCCR1) | `-- i2s2_sysclk (mux, parent 0) `-- i2s1_sysclk_src (mux+gate, MPMU_ISCCR0) `-- i2s1_sysclk (DDN, MPMU_ISCCR0) Because of this mismatch, i2s_bclk reported twice the real rate, and the dedicated i2s1 clock path could not be described in DT at all. Model the tree as above: split the MPMU_ISCCR register macro into MPMU_ISCCR0 and MPMU_ISCCR1 to match the hardware register names, rename the common DDN to i2s_sysclk, insert the fixed 1/2 factor i2s_bclk_factor in front of i2s_bclk, and add the i2s1_sysclk_src mux and i2s1_sysclk DDN backed by MPMU_ISCCR0. CLK_MPMU_I2S1_SYSCLK now refers to the dedicated i2s1 clock; no in-tree user references this ID, so nothing is affected by the change of meaning. Fixes: e371a77255b8 ("clk: spacemit: k3: add the clock tree") Signed-off-by: Troy Mitchell <troy.mitchell@linux.spacemit.com> Reviewed-by: Yixun Lan <dlan@kernel.org> Link: https://patch.msgid.link/20260717-k3-clk-fix-i2s-v1-2-e95001a692ee@linux.spacemit.com Signed-off-by: Yixun Lan <dlan@kernel.org>
2026-07-29dt-bindings: soc: spacemit: k3: add i2s_sysclk, i2s_bclk_factor and ↵Troy Mitchell
i2s1_sysclk_src IDs Add three new clock IDs to expose clocks introduced by the topology fix: - CLK_MPMU_I2S_SYSCLK (51): the common i2s sysclk DDN at MPMU_ISCCR1 - CLK_MPMU_I2S_BCLK_FACTOR (52): the implicit /2 factor feeding i2s_bclk - CLK_MPMU_I2S1_SYSCLK_SRC (53): the dedicated i2s1 sysclk source mux CLK_MPMU_I2S1_SYSCLK keeps its existing ID (34) but will be repointed to the real per-instance i2s1 clock in a subsequent patch. No in-tree user references this ID so the semantic change is contained. Fixes: efe897b557e2 ("dt-bindings: soc: spacemit: k3: add clock support") Signed-off-by: Troy Mitchell <troy.mitchell@linux.spacemit.com> Reviewed-by: Yixun Lan <dlan@kernel.org> Link: https://patch.msgid.link/20260717-k3-clk-fix-i2s-v1-1-e95001a692ee@linux.spacemit.com Signed-off-by: Yixun Lan <dlan@kernel.org>
2026-07-28Merge patch series "smartpqi: fixes and updates for 2.1.42-011"Martin K. Petersen
David Strahan <david.strahan@microchip.com> says: These patches are based on Martin Petersen's 7.2/scsi-queue tree https://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git 7.2/scsi-queue This patch series includes four patches, with two main functional changes: 1. smartpqi-Fix-AIO-retry-marker-cleared-by-SCSI-core-between-dispatches On recent Linux kernels the driver can enter a retry loop on the AIO fast path when a request is retried, looping until timeout, and a diagnostic path that takes a physical drive offline on AIO-bypass failure is never entered. Registers a per-command initialization callback with the SCSI core so its presence causes the core to skip the per-dispatch clear of the retry marker, letting it survive the requeue so the AIO-to-RAID fallback proceeds as intended. 2. smartpqi-add-support-for-CCISS_BIG_PASSTHRU-ioctl Adds pqi_big_passthru_ioctl() to handle CCISS_BIG_PASSTHRU ioctl requests. The existing passthru ioctl uses a 16-bit integer for the I/O buffer size, limiting transfers to 64KB. The big passthru ioctl uses BIG_IOCTL_Command_struct, which stores the buffer size as a 32-bit integer, allowing the larger transfers required by some management utilities. The other two patches: 3. smartpqi-add-new-pci-device-ids Adds PCI IDs for new Hurray Data, ZTE, and Ramaxel controllers. No functional changes. 4. smartpqi-update-driver-version-to-2.1.42-011 Updates the driver version string. No functional changes. Link: https://patch.msgid.link/20260722220401.6357-1-david.strahan@microchip.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-28scsi: smartpqi: Add support for CCISS_BIG_PASSTHRU ioctlDavid Strahan
Add pqi_big_passthru_ioctl() to handle CCISS_BIG_PASSTHRU ioctl requests. The existing passthru ioctl uses a 16-bit integer for the I/O buffer size, limiting transfers to 64KB. The big passthru ioctl uses BIG_IOCTL_Command_struct which stores the buffer size as a 32-bit integer, allowing larger transfers required by some management utilities. Add CCISS_BIG_PASSTHRU_SUPPORTED to uapi/linux/cciss_ioctl.h and return 0 from pqi_ioctl() to advertise driver support. Userspace tools can send this ioctl to probe whether the driver supports CCISS_BIG_PASSTHRU before issuing it. Co-developed-by: Mike McGowen <mike.mcgowen@microchip.com> Signed-off-by: Mike McGowen <mike.mcgowen@microchip.com> Signed-off-by: David Strahan <david.strahan@microchip.com> Acked-by: Don Brace <don.brace@microchip.com> Link: https://lore.kernel.org/linux-scsi/20260722220401.6357-3-david.strahan@microchip.com/ Link: https://lore.kernel.org/linux-scsi/20260722220401.6357-1-david.strahan@microchip.com/ Link: https://patch.msgid.link/20260722220401.6357-3-david.strahan@microchip.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-29scsi: libsas: terminate deferred commands on time outDamien Le Moal
If a command times out while we have deferred non-NCQ commands waiting to be issued, the SCSI EH task is not immediately woken up as the waiting deferred commands are never issued nor completed, thus leaving the SCSI host in a busy state (shost->host_failed != scsi_host_busy(shost)) which prevents the SCSI EH task from being woken up. Eventually, when the deferred commands also time out, the SCSI EH task is woken up and the timeout processing occurs. Avoid this unnecessary additional SCSI EH wake up time with the same method as implemented in libata-scsi, using the eh_timed_out SCSI host template operation. The function sas_eh_timed_out() implements this operation and executes the function ata_scsi_retry_deferred_qc() for SATA devices. Co-developed-by: Igor Pylypiv <ipylypiv@google.com> Signed-off-by: Igor Pylypiv <ipylypiv@google.com> Fixes: 0ea84089dbf6 ("ata: libata-scsi: avoid Non-NCQ command starvation") Cc: stable@vger.kernel.org Signed-off-by: Damien Le Moal <dlemoal@kernel.org> Reviewed-by: John Garry <john.g.garry@oracle.com> Reviewed-by: Hannes Reinecke <hare@kernel.org> Tested-by: Igor Pylypiv <ipylypiv@google.com> Reviewed-by: Niklas Cassel <cassel@kernel.org> Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-29ata: libata-scsi: terminate deferred commands on time outDamien Le Moal
If a command times out while we have deferred non-NCQ commands waiting to be issued, the SCSI EH task is not immediately woken up as the waiting deferred commands are never issued nor completed, thus leaving the SCSI host in a busy state (shost->host_failed != scsi_host_busy(shost)) which prevents the SCSI EH task from being woken up. Eventually, when the deferred commands also time out, the SCSI EH task is woken up and the timeout processing occurs. Avoid this unnecessary SCSI EH task wake-up additional time by scheduling a retry of all waiting deferred QCs, using the eh_timed_out SCSI host template operation. The function ata_scsi_eh_timed_out() is introduced to implement this operation. However, terminating deferred commands with DID_REQUEUE to force a retry by calling the function ata_scsi_requeue_deferred_qc() may still keep the SCSI host in a busy state because the block layer may immediately re-issue these commands. The solution to this is to schedule libata EH for the port which suffered the command timeout to prevent accepting any new command. ata_scsi_requeue_deferred_qc() is modified to add a call to ata_port_schedule_eh() for this purpose. In addition to this change, ata_scsi_requeue_deferred_qc() is also modified to take a new timedout_scmd scsi command argument which indicates the SCSI command that timed out. With this additional argument, ata_scsi_requeue_deferred_qc() can now also terminate with DID_TIME_OUT any timed out deferred qc, which simplifies ata_scsi_cmd_error_handler(). In this case, ata_scsi_requeue_deferred_qc() returns SCSI_EH_DONE, with this return value propagated back to the ata_scsi_eh_timed_out() operation to indicate to scsi_timeout() that the timed out command was handled and no further processing is needed. For non-timed out deferred qc that need to be retried, ata_scsi_requeue_deferred_qc() returns SCSI_EH_NOT_HANDLED, thus indicating to scsi_timeout() that the timed out command needs to go through the SCSI EH (and libata EH) processing by adding it to the EH work queue with scsi_eh_scmd_add(). One side effect of these changes is that the function atapi_qc_complete() needs to be modified to ensure that a deferred ATAPI command that needs to be retried is completed with DID_REQUEUE instead of the default SAM_STAT_GOOD status, and a command that timed out is completed with DID_TIME_OUT instead of SAM_STAT_CHECK_CONDITION. Fixes: 0ea84089dbf6 ("ata: libata-scsi: avoid Non-NCQ command starvation") Cc: stable@vger.kernel.org Signed-off-by: Damien Le Moal <dlemoal@kernel.org> Reviewed-by: Igor Pylypiv <ipylypiv@google.com> Tested-by: Igor Pylypiv <ipylypiv@google.com> Reviewed-by: Niklas Cassel <cassel@kernel.org> Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-28net_shaper: add some notes on re-parentingJakub Kicinski
Clarify the re-parenting expectations. Specifically that @delete on a queue removes it from the hierarchy which is a bit unusual in the overall API structure. IIRC the implicit delete behavior was introduced because otherwise it would not be possible to remove a queue from the hierarchy without changing at least one handle of the shapers. Normally "removal" is done by "adding" to the new parent, but "outside the hierarchy" does not have a parent we can point at. Link: https://patch.msgid.link/20260724210756.1553565-4-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-28net_shaper: clarify the kernel API / commentsJakub Kicinski
The shaper API takes some getting used to. Try to improve the doc on struct net_shaper_ops to help driver developers. Link: https://patch.msgid.link/20260724210756.1553565-3-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-28net_shaper: remove incorrect comment about group leavesJakub Kicinski
It is true that the user-facing group() operation can only be invoked with queues as leaves (see net_shaper_parse_leaf()), but the driver facing op is also called when we delete a node. When we delete a node we conceptually call group(parent, node.list_of_leaves) to add node's leaves to the parent. Node deletion "mid-hierarchy" is supported so some of the leaves may themselves be nodes. Therefore the driver facing group() may be called with nodes. Remove the incorrect comment, and add a comment about differences between the Netlink API and driver facing API. Link: https://patch.msgid.link/20260724210756.1553565-2-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-28drm/fourcc: Add modifiers for AMD GFX6-8Timur Kristóf
GFX6-8 are the oldest GPUs supported by the amdgpu kernel driver, and the last ones that didn't support DRM format modifiers until now. These are the Southern Islands, Sea Islands and Volcanic Islands families of GPUs. On GFX6-8, the GFX block can only use pre-determined tiling modes which are programmed by the kernel according to the tiling mode table. GFX6 uses the GB_TILE_MODE0...31 registers, and GFX7-8 also has GB_MACROTILE_MODE0...15 registers. DCC is also supported on GFX8, albeit not displayable. Note that the tiling table is uAPI and userspace relies on specific modes being present at specific indices. How the tiling works is primarily determined by the so-called array mode. Use the TILE field to specify the array mode. Pixel data is organized into micro tiles. Each micro tile may be 8x8 / 8x8x4 / 8x8x8 pixels, depending on the array mode. Add the MICROTILE field to specify microtile mode. Microtiles may be further organized into macro tiles, which have many configurable parameters. Macro tile mode selection depends on how many bits per pixel an image has. Add the PIPE_CONFIG, TILE_SPLIT, BANK_WIDTH, BANK_HEIGHT, MACRO_TILE_ASPECT, NUM_BANKS fields to specify parameters of macro tiled modes. Furthermore, tiling is also influenced by memory configuration. Old RFC patches received feedback concerning that, so I looked into it specifically: GB_ADDR_CONFIG.ROW_SIZE needs to be considered when calculating TILE_SPLIT, but does not need to be included in the modifiers, and also PIPE_INTERLEAVE matters, but it's hardcoded to the same value on all GFX6-8 GPUs and changing it would break userspace, so let's assume it isn't going to change. Therefore we don't need to include that in modifiers. Mesa also reads NUM_RANKS but actually doesn't use its value on GFX6-8. As a side note, tiling works similarly on GFX4-5 (that is Evergreen and Northern Islands). But that will need some additional PIPE_CONFIG enum values as well as some extra fields not relevant to GFX6-8. Initially, let's only expose the tiling modes that are most relevant to sharing buffers between different processes: Exposed array modes (TILE field): - 1D_TILED_THIN1: micro tiled only - 2D_TILED_THIN1: macro tiled Exposed micro tile modes (MICROTILE field): - DISPLAY: supported by DCE (the display engine) - THIN: more efficient but not displayable Exposed macro tile modes: All possible parameters (25088 permutations). More modes may be exposed in the future as needed. Technically, the amount of possible combinations of all possible tiling parameters is in the range of hundreds of thousands, but in practice, there are just a handful of possible modifiers for a surface. For example on GFX8, a surface would have these modifiers, from best to worst performance: - 2D_TILED_THIN1 + THIN + DCC + macrotile params [1] - 2D_TILED_THIN1 + THIN + macrotile params [1] - 2D_TILED_THIN1 + DISPLAY + macrotile params [1] - 1D_TILED_THIN1 + THIN - 1D_TILED_THIN1 + DISPLAY - LINEAR [1] The macro tiling parameters depend on how many bits per pixel of the specific surface has and how the chip is configured. There is only one set of valid macrotile params for a given surface. DCC is only supported by GFX8 and newer, and only with non-displayable macrotiling modes. When sharing buffers between different GFX6-8 GPUs, it is very unlikely that they support the exact same macrotiling configuration, so they will likely need to use micro tiled modes, which are still much better than using linear buffers. (Note that currently Mesa always uses LINEAR when copying between two GPUs.) Suggested-by: Bas Nieuwenhuizen <bas@basnieuwenhuizen.nl> Signed-off-by: Timur Kristóf <timur.kristof@gmail.com> Reviewed-by: Marek Olšák <maraeo@gmail.com> Reviewed-by: Daniel Stone <daniels@collabora.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Acked-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-28i2c: qcom-geni: trace: Add trace events for Qualcomm GENI I2CPraveen Talari
Add trace event support to the Qualcomm GENI I2C driver to enable detailed runtime debugging and analysis. The trace events capture I2C clock configuration, interrupt status and error code and message. Signed-off-by: Praveen Talari <praveen.talari@oss.qualcomm.com> Reviewed-by: Steven Rostedt <rostedt@goodmis.org> Signed-off-by: Andi Shyti <andi.shyti@kernel.org> Link: https://lore.kernel.org/r/20260703-add-tracepoints-for-qcom-geni-i2c-v2-1-e8bf8b178290@oss.qualcomm.com
2026-07-28KVM: nSVM: Add CLASS()es for automagically handling local kvm_vcpu_map() usageSean Christopherson
Add CLASS() definitions for locally mapping a PFN using kvm_vcpu_map() given a vCPU+gfn pair. In addition to eliminating the need to manually do unmap(), e.g. in error paths, this will allow hardening KVM against double-mapping without having to manually ensure every on-stack declaration is zero-initialized. Use "map local" as the primary terminology as the basic concept is more or less the same as kmap_local(): ensure the current context has a kernel mapping to the underlying memory. Immediately convert the relatively straightforward nested SVM flows, and defer converting the more involved SMM flows to a separate change. No functional change intended. Cc: Yosry Ahmed <yosry@kernel.org> Link: https://patch.msgid.link/20260724004757.131420-3-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-28Bluetooth: ISO: fix race of kfree vs kref_get_unless_zeroPauli Virtanen
hci_conn::iso_data is accessed and modified without lock or RCU. This leads to a race [Task hdev->workqueue] [Task 2] iso_recv iso_conn_put(conn) conn = LOAD hcon->iso_data iso_conn_free(conn) iso_conn_hold_unless_zero(conn) hcon->iso_data = NULL kfree(conn) kref_get_unless_zero(&conn->ref) /* UAF */ and also to races in iso_conn_add() vs. iso_conn_free(). Fix by adding spinlock hci_conn::proto_lock and using it to guard hci_conn::iso_data. Fixes: dc26097bdb86 ("Bluetooth: ISO: Use kref to track lifetime of iso_conn") Signed-off-by: Pauli Virtanen <pav@iki.fi> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-07-28drm/msm: Fix stale comments in uapi/drm/msm_drm.hHans de Goede
At some point drm_msm_gem_syncobj was renamed to drm_msm_syncobj and MSM_SUBMIT_SYNCOBJ_FLAGS was renamed to MSM_SYNCOBJ_FLAGS but some comments still refer to the old names. Update the comments with the new names. Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/742717/ Message-ID: <20260728092609.22049-1-johannes.goede@oss.qualcomm.com> Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
2026-07-28regulator: dt-bindings: Add fan53555 allowed modesVictor Krawiec
Fairchild FAN53555 and its clone from Rockchip, Silergy and TCS support two modes of operation: - Auto-PFM: Allow automatic PFM during light load (default mode) - Forced PWM Some boards require forced PWM mode to keep the supply ripple within acceptable limits under light load conditions. Regulator mode indexes are starting from 1 to keep backward compatibility with existing device trees Signed-off-by: Victor Krawiec <victor.krawiec@arturia.com> Link: https://patch.msgid.link/20260723094001.120264-2-victor.krawiec@arturia.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-28list: Permit context-unguarded access with list_empty_careful()Marco Elver
With Context Analysis (viz. Clang's Thread Safety Analysis), list_heads that are __guarded_by(..) require holding the appropriate context lock when accessing and manipulating them via the list API. Because Clang's warning diagnostics do not perform inter-procedural analysis, this is enforced by Clang with -Wthread-safety-pointer in the caller at the call boundary; a warning is produced when passing a pointer to a guarded variable without holding the appropriate context locks: warning: passing pointer to variable 'list' requires holding [...] [-Wthread-safety-pointer] if (list_empty(&ctrl->list)) An exception is list_empty_careful(), which is like list_empty(), except that it is permitted to use without holding any context lock (carefully). Mark list_empty_careful() __context_unsafe, which disables context analysis within list_empty_careful(), but also suppresses warnings generated in callers related to its pointer arguments. Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Marco Elver <elver@google.com> Signed-off-by: Nilay Shroff <nilay@linux.ibm.com> Signed-off-by: Keith Busch <kbusch@kernel.org>
2026-07-28list: introduce LIST_HEAD_GUARDEDNilay Shroff
Introduce LIST_HEAD_GUARDED(name, lock) to define a struct list_head annotated with __guarded_by(lock). This provides a convenient shorthand for defining lock-protected list heads and allows compiler context analysis to validate accesses to the list against the associated lock. The new helper also reduces boilerplate and improves consistency across callers that annotate struct list_head objects with __guarded_by(). This is a preparatory change for subsequent patches that annotate LIST_HEAD() instances with their protecting lock. Suggested-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Nilay Shroff <nilay@linux.ibm.com> Signed-off-by: Keith Busch <kbusch@kernel.org>
2026-07-28PCI: Fix UAF when probe runs concurrent to dyn ID removalGary Guo
Dynamic IDs are only guaranteed to be valid when dynids.lock is held, as remove_id_store() can free the node. Thus, make a copy in pci_match_device(). Also, clarify that the id parameter is only valid during probe. Fixes: 0994375e9614 ("PCI: add remove_id sysfs entry") Reported-by: Sashiko <sashiko-bot@kernel.org> Link: https://lore.kernel.org/all/20260619170503.518F61F00A3A@smtp.kernel.org/ Signed-off-by: Gary Guo <gary@garyguo.net> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Reviewed-by: Danilo Krummrich <dakr@kernel.org> Link: https://patch.msgid.link/20260723-pci_id_fix-v4-9-3580726844e1@garyguo.net
2026-07-28Merge tag 'kvmarm-fixes-7.2-3' of ↵Paolo Bonzini
git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 7.2, take #3 - Fix a tiny buglet when propagating the deactivation of an interrupt from a nested guest, which happened to trigger a gold plated CPU bug on a particular implementation - Fix a race between LPI unmapping and mapping, resulting in leaked LPIs - Make LPI mapping more robust on memory allocation failure - Fix the handling of the EL2 tracing clock being disabled - A couple of Sashiko-driven fixes for corner cases in the EL2 tracing code - Add missing sysreg tracepoint for the EL2 code - Tidy-up the mutual exclusion of guest-memfd and MTE - Update Fuad's email address to point to @linux.dev
2026-07-28dt-bindings: clock: ast2700: add PECI clockRyan Chen
Add SCU1_CLK_PECI for the SoC1 PECI controller clock source, and SCU1_CLK_HPLL_DIV4 which serves as one of the PECI clock mux parents. Signed-off-by: Ryan Chen <ryan_chen@aspeedtech.com> Acked-by: Conor Dooley <conor.dooley@microchip.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28dt-bindings: clock: mediatek: Add mt8173 mfgtopChen-Yu Tsai
The MFG (GPU) block on the MT8173 has a small glue layer, named MFG_TOP in the datasheet, that contains clock gates, some power sequence signal delays, and other unknown registers that get toggled when the GPU is powered on. The clock gates are exposed as clocks provided by a clock controller, while the power sequencing bits are exposed as one singular power domain. Reviewed-by: Conor Dooley <conor.dooley@microchip.com> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Chen-Yu Tsai <wenst@chromium.org> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: Add devm_clk_bulk_get_enable()Suraj Gupta
devm_clk_bulk_get_optional_enable() gets, prepares and enables a set of clocks with device-managed cleanup, but treats every clock as optional: a missing clock is silently returned as NULL instead of failing. Consumers that need a fixed set of mandatory clocks enabled for the lifetime of the device currently have to open-code devm_clk_bulk_get() followed by clk_bulk_prepare_enable(), which loses the managed disable on unbind, or fall back to per-clock devm_clk_get_enabled() calls. Add devm_clk_bulk_get_enable() as the non-optional counterpart. The underlying __devm_clk_bulk_get_enable() helper already supports the required (optional = false) path, so only export a thin wrapper for it. Signed-off-by: Suraj Gupta <suraj.gupta2@amd.com> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28dt-bindings: clock: airoha: Add additional reset for PCIe PERSTOUTChristian Marangi
Add additional reset to control PCIe PERSTOUT reset line for each of the 3 PCIe lines. Signed-off-by: Christian Marangi <ansuelsmth@gmail.com> Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28dt-bindings: soc: cix: add sky1 audss cru controllerJoakim Zhang
The Cix Sky1 Audio Subsystem (AUDSS) Clock and Reset Unit (CRU) groups clock muxing, gating and block-level software reset control in a single register block. Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Joakim Zhang <joakim.zhang@cixtech.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28dt-bindings: clock: ultrarisc: Add DP1000 Clock ControllerJia Wang
Add doc for the clock controller on the UltraRISC DP1000 RISC-V SoC. Signed-off-by: Jia Wang <wangjia@ultrarisc.com> Reviewed-by: Conor Dooley <conor.dooley@microchip.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: document that clk_get_parent() returns NULLDan Carpenter
The documentation in the clk.h file says that clk_get_parent() returns error pointers but it doesn't. It's also not consistent with the comments next to the clk_get_parent() implementation which say that it returns NULL when the clk is NULL. Update the comments so they are consistent and accurate and say that it returns NULL. Signed-off-by: Dan Carpenter <error27@gmail.com> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28wifi: mac80211: add ieee80211_txq_aql_pending()Felix Fietkau
Add a function to allow drivers to query the pending AQL airtime for a given txq, for both unicast and broadcast. This will be used for mt76 to limit buffering in AP mode for power-save stations. Signed-off-by: Felix Fietkau <nbd@nbd.name> Link: https://patch.msgid.link/20260724115429.3921457-4-nbd@nbd.name Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-28wifi: mac80211: add AQL support for multicast packetsFelix Fietkau
Excessive multicast traffic with little competing unicast traffic can easily flood hardware queues, leading to throughput issues. Additionally, filling the hardware queues with too many packets breaks FQ for multicast data. Fix this by enabling AQL for multicast packets. Signed-off-by: Felix Fietkau <nbd@nbd.name> Link: https://patch.msgid.link/20260724115429.3921457-3-nbd@nbd.name Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-28rfkill: repair malformed kernel-doc and add some descriptionsRandy Dunlap
Use kernel-doc format for function descriptions and add the missing function parameter descriptions to avoid kernel-doc warnings: Warning: ../include/linux/rfkill.h:102 This comment starts with '/**', but isn't a kernel-doc comment. * rfkill_pause_polling(struct rfkill *rfkill) Warning: include/linux/rfkill.h:109 function parameter 'rfkill' not described in 'rfkill_pause_polling' Warning: ../include/linux/rfkill.h:112 This comment starts with '/**', but isn't a kernel-doc comment. * rfkill_resume_polling(struct rfkill *rfkill) Warning: include/linux/rfkill.h:117 function parameter 'rfkill' not described in 'rfkill_resume_polling' Warning: ../include/linux/rfkill.h:330 function parameter 'rfkill' not described in 'rfkill_get_led_trigger_name' Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Link: https://patch.msgid.link/20260723162750.167914-1-rdunlap@infradead.org Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-28wifi: cfg80211: change mesh_setup::ie_len to size_tSrinivas Achary
The ie_len field in struct mesh_setup stores the length of the information elements (IEs) buffer. It is currently defined as u8, which limits the maximum supported length to 255 bytes. The IE length is derived from memory buffers whose size is naturally represented by size_t. Using u8 may truncate larger values and can result in incorrect length handling. Change ie_len to size_t so it can represent the full buffer length and match the type commonly used for memory sizes throughout the kernel. Signed-off-by: Ramakrishnan Rathinasamy <ramakrishnan@aerlync.com> Signed-off-by: Srinivas Achary <srinivas@aerlync.com> Link: https://patch.msgid.link/20260723134550.35167-1-srinivas@aerlync.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-28netfs: Fix folio_queue ENOMEM in writeback by adding a mempoolDavid Howells
Fix the handling of folio_queue allocation failure in writeback by adding a mempool and passing in gfp_t flags to the rolling buffer functions that allocate memory, using the mempool if gfp != GFP_KERNEL. This is then extended upwards and the gfp to be used for a request is stored in the netfs_io_request struct and is then used for both requests and subrequests, eliminating the sleeping loops there. The failure caused: folio != NULL WARNING: fs/netfs/write_issue.c:603 at netfs_writepages+0x883/0xa10 fs/netfs/write_issue.c:603, CPU#3: syz.0.17/5919 Fixes: cd0277ed0c18 ("netfs: Use new folio_queue data type and iterator instead of xarray iter") Reported-by: syzbot+0da43efa72f88bd3a8af@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0da43efa72f88bd3a8af Signed-off-by: David Howells <dhowells@redhat.com> Link: https://patch.msgid.link/20260727130716.1099906-5-dhowells@redhat.com Tested-by: syzbot+0da43efa72f88bd3a8af@syzkaller.appspotmail.com cc: Paulo Alcantara <pc@manguebit.org> cc: Yun Zhou <yun.zhou@windriver.com> cc: Matthew Wilcox <willy@infradead.org> cc: Christoph Hellwig <hch@infradead.org> cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-07-28RDMA/bnxt_re: Add uverbs object handle path for CQ/SRQ toggle pageSelvin Xavier
The current GET_TOGGLE_MEM ioctl requires the caller to supply a type enum and a raw hardware queue ID (RES_ID). The kernel looks up the CQ or SRQ by that ID without verifying that the caller owns the resource. Add a new, preferred code path that accepts standard uverbs object handles (BNXT_RE_TOGGLE_MEM_CQ_HANDLE / BNXT_RE_TOGGLE_MEM_SRQ_HANDLE) instead. The uverbs core validates that the handle belongs to the calling context as part of resolving it, so this path no longer needs the driver's own XArray lookup for ownership checking. As with the legacy path, the toggle_entry's own mmap-entry refcount (not a CQ/SRQ uobject reference) is what pins the toggle page for the life of the GET_TOGGLE_MEM handle. Only newer rdma-core versions support this path, if the driver reports the supported resp mask (BNXT_RE_UCNTX_CMASK_TOGGLE_MEM_UOBJ_SUPPORT). The existing TYPE + RES_ID path is retained for backward compatibility with older rdma-core. Suggested-by: Jason Gunthorpe <jgg@nvidia.com> Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-28tracing: Expose tracepoint BTF ids via tracefsMykyta Yatsenko
Add events/<sys>/<event>/btf_ids, a per-template file that exposes the BTF ids resolve_btfids fills in for each tracepoint: btf_obj_id BTF object owning the ids below raw_btf_id FUNC_PROTO of __bpf_trace_<call> (named args), consumed by raw_tp / tp_btf BPF programs tp_btf_id trace_event_raw_<call> ring-buffer record, consumed by classic BPF_PROG_TYPE_TRACEPOINT programs DECLARE_EVENT_CLASS now emits a 2-entry BTF_ID_LIST (FUNC __bpf_trace_* and STRUCT trace_event_raw_*) and stores the pointer in trace_event_class. Per-syscall events under syscalls/ share the handcrafted classes event_class_syscall_{enter,exit} instead of going through DECLARE_EVENT_CLASS. Wire those classes to the BTF id lists generated for sys_enter / sys_exit so all ~700 per-syscall events expose the shared dispatcher prototype and record. The per-syscall events do not own their own tracepoint (they share sys_enter/sys_exit), so raw_btf_id is reported as 0 on those events; the meaningful raw_btf_id is exposed on raw_syscalls/sys_{enter,exit}/btf_ids where raw_tp / tp_btf programs can actually attach. Link: https://patch.msgid.link/20260518-generic_tracepoint-v2-2-b755a5cf67bb@meta.com Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2026-07-28bpf: Make btf_get_module_btf() and btf_relocate_id() non-staticMykyta Yatsenko
Drop the static qualifier and add prototypes to <linux/btf.h> so the tracing core can look up module BTF and translate ids stored by resolve_btfids (which are local to a module's split BTF) into the runtime ids used by the kernel. Used by the upcoming events/<sys>/<event>/btf_ids tracefs interface. Link: https://patch.msgid.link/20260518-generic_tracepoint-v2-1-b755a5cf67bb@meta.com Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2026-07-28iommu/arm-smmu-v3-iommufd: Report CFGI/TLBI-repeat erratumAshish Mhetre
A guest with access to VCMDQ generates its own invalidation commands and must apply any invalidation errata before submitting them. If the host also repeats those commands, each affected invalidation is issued four times instead of twice. Add IOMMU_HW_INFO_ARM_SMMUV3_ERRATA_REPEAT_TLBI_CFGI to report the CFGI/TLBI-repeat erratum to user space. This allows the VMM to expose the erratum to the guest or apply the workaround itself. Use the raw __arm_smmu_cmdq_issue_cmdlist() helper for user-provided invalidations so the host does not apply the workaround a second time. Add arm_smmu_erratum_repeat_tlbi_cfgi() to query the static key when populating the SMMUv3 hardware information. Signed-off-by: Ashish Mhetre <amhetre@nvidia.com> Reviewed-by: Nicolin Chen <nicolinc@nvidia.com> Reviewed-by: Jason Gunthorpe <jgg@nvidia.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-07-28Merge remote-tracking branch 'drm/drm-next' into drm-rust-nextDanilo Krummrich
Backmerge to pull in commit 21fcb222f0d1 ("drm: Remove DRIVER_GEM_GPUVA feature flag"), which a Tyr patch series depends on. Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-07-28media: mali-c55: Add support for RGB GammaJacopo Mondi
Add support for Gamma curve correction for the Mali C55 ISP. Define a new block in the uAPI using the extensible v4l2-isp format and implement support for configuring the RGB Gamma parameters in the mali-c55 parameters handler. While at it, rename the MALI_C55_REG_GAMMA_GAINS_[1|2] register name to MALI_C55_REG_GAMMA_GAINS_[RG|B] and the MALI_C55_REG_GAMMA_OFFSETS_[1|2] register name to MALI_C55_REG_GAMMA_OFFSETS_[RG|B] to better clarify their intent. Signed-off-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com> Reviewed-by: Vincenzo Frascino <vincenzo.frascino@arm.com> Reviewed-by: Linus Walleij <linusw@kernel.org> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-28media: mali-c55: Add support for CCMJacopo Mondi
Add support for the CCM (Color Correction Matrix) for the Mali C55 ISP. Define a new block in the uAPI using the extensible v4l2-isp format and implement support for configuring the CCM parameters in the mali-c55 ISP driver. Signed-off-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com> Reviewed-by: Vincenzo Frascino <vincenzo.frascino@arm.com> Reviewed-by: Linus Walleij <linusw@kernel.org> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-28ata: libata-eh: Increase STANDBY IMMEDIATE timeoutMatt Vollrath
Correct a previous change (see Fixes) which reduced the standby timeout from 30 to 5 seconds. Increase it to 15 seconds. I was troubleshooting an error spotted during system suspend: [ 1217.152867] ata1.00: Entering standby power mode [ 1222.322948] ata1.00: qc timeout after 5000 msecs (cmd 0xe0) [ 1222.324010] ata1.00: STANDBY IMMEDIATE failed (err_mask=0x4) This drive is a Samsung 870 EVO SSD in good SMART standing, and I wasn't aware of any reason it should be taking so long to standby. The issue is intermittent, but I observed it sometimes taking 7 seconds to manually standby. I assume this was interruption of background maintenance after a power outage. As a desktop user, I would prefer to wait the extra 2 seconds at suspend to let the drive finish its business rather than drop the rails from under it. The change from 30 to 5 seconds was implicit when switching suspend from START STOP UNIT to an internal command with no timeout table entry. No reason was stated for the change. Fixes: aa3998dbeb3a ("ata: libata-scsi: Disable scsi device manage_system_start_stop") Cc: stable@vger.kernel.org Signed-off-by: Matt Vollrath <tactii@gmail.com> Assisted-by: Claude:claude-5-fable Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
2026-07-28ata: libata: avoid kernel-doc warningsRandy Dunlap
Modify comments to prevent kernel-doc warnings: - use "/*" for a non-kernel-doc comment - add a Returns: section for ata_id_major_version() Warning: include/linux/ata.h:770 Cannot find identifier on line: * Warning: include/linux/ata.h:782 function parameter 'id' not described in 'ata_id_sct_data_tables' Warning: include/linux/ata.h:782 expecting prototype for Word(). Prototype was for ata_id_sct_data_tables() instead Warning: include/linux/ata.h:820 No description found for return value of 'ata_id_major_version' Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
2026-07-27ethtool: Embed FEC hist ranges as buffer in structEric Joyner
When a driver's .get_fec_stats() handler is called and the driver supports FEC histogram stats, the driver supplies the histogram bin ranges via a pointer. This pointer is assigned while under the netdev ops lock in fec_prepare_data(), but the actual data is only read after the lock is released; so this allows the driver to change the ranges (e.g. from another .get_fec_stats() call) while the current call chain is reading them in fec_fill_reply(). Fix this by adding an ethtool core-owned buffer, ranges_buf, to struct ethtool_fec_hist. Drivers whose ranges are built dynamically (currently just mlx5) fill ranges_buf and then point the existing ranges pointer at it, giving ethtool a consistent copy that stays valid after the netdev ops lock is dropped and later in fec_fill_reply(). Drivers whose ranges are compile-time constants (bnxt, netdevsim) are unaffected by the potential race and keep setting the existing ranges pointer to their constant array, without making copies. Fixes: cc2f08129925 ("ethtool: add FEC bins histogram report") Signed-off-by: Eric Joyner <eric.joyner@amd.com> Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> Link: https://patch.msgid.link/20260723041342.39238-1-eric.joyner@amd.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-27remoteproc: Prevent crash handling to race with rproc_del()Bjorn Andersson
There's no synchronization between rproc_crash_handler_work() and rproc_del(), as such it's possible for a driver to be removed while crash-handler work is scheduled, or even executing - resulting in use-after-free issues. To avoid this the scheduled work need to be cancelled and synchronized against before the removal proceeds. In order to ensure that this doesn't race with the reporting, and thereby scheduling new work, a "deleting" flag is introduced. This is similar to the RPROC_DELETE state that was introduced to ensure that "start" didn't race with rproc_del(), but the existing mechanism can not be used as it's valid to call rproc_report_crash() in atomic context - and the "state" is protected by a mutex. In the event that work is cancelled the pm_stay_awake() is left unbalanced and need to be unrolled. The blocking and cancelling of crash-handler work prior to the actual rproc_shutdown() call does have the explicit side-effect that crashes resulting from the shutdown process will not enter the crash-handling path, and as such will not generate devcoredumps etc. Due to the existing mutual exclusion between these code paths there's no concrete reduction in functionality, but further work would be needed to handle this case. Assisted-by: OpenCode:GPT-5.5 Fixes: 8afd519c3470 ("remoteproc: add rproc_report_crash function to notify rproc crashes") Signed-off-by: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com> Reviewed-by: Pradnya Dahiwale <pradnya.dahiwale@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260723-rproc-rmmod-not-crashing-v1-2-546dfd5de0e6@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-27Merge tag 'nf-next-26-07-24' of ↵Jakub Kicinski
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next Pablo Neira Ayuso says: ==================== Netfilter/IPVS updates for net-next The following patchset contains Netfilter/IPVS updates for net-next, just a small batch with accumulated pending updates: 1) In IPVS, use system_dfl_long_wq instead of system_long_wq, from Ismael Luceno. 2) Add missing .checkentry in xt_tcpmss for IPv6, this is a follow up to a recent harderning, from Florian Westphal. 3) Address a sashiko report in the NAT SIP helper, from Florian Westphal. 4) Tear down flow entries with stale routes using the GC, this is to detect route updates when hardware offload is enabled. 5) Pass master conntrack as parameter to functions instead of using exp->master as preparation work to turn exp->master into a cookie. 6) Move expectation event_mask to the nf_conntrack_expect object, again as preparation work to turn exp->master into a cookie. 7) In IPVS, use kzalloc_obj{s}() typesafe allocations, from Subasri S. * tag 'nf-next-26-07-24' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next: ipvs: use type-safe allocation helpers in ip_vs_rht_alloc netfilter: nf_conntrack_expect: store event cache in expectation netfilter: conntrack_helper: pass master conntrack to helper functions netfilter: flowtable: tear down flow entries with stale dst from GC netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet netfilter: xt_tcpmss: extend checkentry to ipv6 ipvs: Move defense_work and est_reload_work to system_dfl_long_wq ==================== Link: https://patch.msgid.link/20260724104932.437729-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-27net: enetc: improve MAFT entry management with bitmap trackingWei Fang
Replace the counter-based MAFT entry tracking (num_mfe/mac_filter_num) with a bitmap (maft_eid_bitmap) stored in struct ntmp_user, which is a more appropriate place for NTMP resource management. The bitmap approach brings two improvements. First, the entry deletion in enetc4_pf_clear_maft_entries() now checks the return value of ntmp_maft_delete_entry() and only clears the corresponding bit on success, keeping hardware and software state in sync. Previously, the counter was reset unconditionally regardless of whether the hardware deletion actually succeeded. Second, entry allocation in enetc4_pf_add_maft_entries() uses ntmp_lookup_free_eid() to find available IDs dynamically, with an upfront capacity check via bitmap_weight() to avoid partial failures. The MAFT entry count is moved into ntmp_user.maft_num_entries and initialized once during enetc4_init_ntmp_user(). Helper functions enetc4_ntmp_bitmap_init() and enetc4_ntmp_bitmap_free() manage the bitmap lifetime. The debugfs show function is updated accordingly to iterate over set bits under rtnl_lock(). Signed-off-by: Wei Fang <wei.fang@nxp.com> Link: https://patch.msgid.link/20260720014317.1059359-5-wei.fang@oss.nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-27Merge tag 'wireless-2026-07-26' of ↵Jakub Kicinski
https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Johannes Berg says: ==================== wireless-next-2026-07-26 Mostly driver changes this time: - new driver mm81x for an S1G device - new driver nxpwifi for NXP devices (mostly forked off from mwifiex) - ath12k: much kernel infrastructure integration work - brcmfmac: DPP support, some Cypress part update - nl80211: per-link statistics support ==================== Link: https://patch.msgid.link/20260726105205.942922-60-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>