summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2026-07-16scsi: ufs: Switch WriteBooster missing free space message as warn_onceNeil Armstrong1-2/+2
Once the UFS WriteBooster fails to allocate memory, the situation will stay until fstrim or equivalent is ran. Mark is as a warning since it impacts the performance but only print it once for the lifetime of the kernel since it's not fatal. Otherwise it will be printed each time the device is resumed: [ 31.666880] ufshcd-qcom 1d84000.ufshc: dCurWBBuf: 0 WB disabled until free-space is available [ 52.655594] ufshcd-qcom 1d84000.ufshc: dCurWBBuf: 0 WB disabled until free-space is available [ 62.890469] ufshcd-qcom 1d84000.ufshc: dCurWBBuf: 0 WB disabled until free-space is available ... Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/20260618-topic-ufs-wb-empty-warn-v1-1-ec744a153e0e@linaro.org Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-16Merge patch series "ufs: Add callback for vendor-specific RTT capability"Martin K. Petersen4-9/+21
ed.tsai@mediatek.com says: The first patch adds the get_hba_nortt() callback to the UFS core layer, allowing vendor drivers to provide dynamic, platform-specific RTT capability handling. The second patch implements this callback in the MediaTek UFS driver, distinguishing between legacy platforms (which require the RTT to be limited to 2) and newer MT6995 B0+ platforms (which can use the value from the capability register directly). The third patch removes the max_num_rtt field from ufs_hba_variant_ops as it is now replaced by the get_hba_nortt() callback. Link: https://patch.msgid.link/20260615055802.105479-1-ed.tsai@mediatek.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-16Merge patch series "scsi: ufs: Harden TX EQTR error handling paths"Martin K. Petersen2-14/+28
Can Guo <can.guo@oss.qualcomm.com> says: TX Equalization training currently has a few error-path gaps that can make the flow brittle and can leave variant/device cleanup incomplete. This series hardens TX EQTR in three places: 1. ufs-qcom: route SW FOM setup failures through the shared cleanup path so temporary device TX EQ settings are restored and link recovery is always attempted before exit. 2. core: treat RX_FOM DME read failures as best effort so TX EQTR can continue, and force failed lanes to deterministic 0 FOM. 3. core: always run tx_eqtr POST_CHANGE notify once PRE_CHANGE succeeds, even when TX EQTR fails, so variant cleanup is not skipped. Together these changes improve TX EQTR robustness without changing the normal success path. Link: https://patch.msgid.link/20260625121306.1655467-1-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-16scsi: ufs: core: Always run tx_eqtr POST_CHANGE notifyCan Guo1-4/+10
ufshcd_tx_eqtr() skips POST_CHANGE notify when __ufshcd_tx_eqtr() fails. That can leave variant cleanup incomplete when PRE_CHANGE saved temporary state that POST_CHANGE is expected to restore. Always call POST_CHANGE once PRE_CHANGE has succeeded. Keep the TX EQTR result as the primary return value, and only propagate POST_CHANGE failure when TX EQTR itself succeeded. Log PRE_CHANGE and POST_CHANGE notify failures to make variant callback failures visible in TX EQTR error paths. Reviewed-by: Manivannan Sadhasivam <mani@kernel.org> Reviewed-by: Peter Wang <peter.wang@mediatek.com> Signed-off-by: Can Guo <can.guo@oss.qualcomm.com> Reviewed-by: Bean Huo <beanhuo@micron.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Ziqi Chen <ziqi.chen@oss.qualcomm.com> Link: https://patch.msgid.link/20260625121306.1655467-4-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-16scsi: ufs: core: Tolerate RX_FOM read failures in TX EQTRCan Guo1-5/+14
ufshcd_get_rx_fom() aborted TX EQTR when a per-lane RX_FOM DME read failed. That makes the whole training flow fragile even though these reads can be treated as best effort. Keep TX EQTR running by logging RX_FOM read failures and continuing. Make failed lanes deterministic by initializing each lane FOM to 0 before reading and only updating it when the DME read succeeds. This avoids propagating stale or uninitialized values into EQTR evaluation. Also update the kerneldoc return description to match behavior: RX_FOM DME read failures are handled as warnings, while get_rx_fom() vops failures are still propagated to the caller. Signed-off-by: Can Guo <can.guo@oss.qualcomm.com> Reviewed-by: Peter Wang <peter.wang@mediatek.com> Reviewed-by: Bean Huo <beanhuo@micron.com> Reviewed-by: Ziqi Chen <ziqi.chen@oss.qualcomm.com> Link: https://patch.msgid.link/20260625121306.1655467-3-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-16scsi: ufs: ufs-qcom: Restore TX Equalization settings on FOM failureCan Guo1-5/+4
ufs_qcom_get_rx_fom() applies temporary device TX Equalization values before forcing HS mode and running the EOM-based SW FOM scan. When one of these steps fails, the function can bypass the shared cleanup path and leave temporary TX Equalization settings programmed. Route those failures through the cleanup label so the original TX EQ settings are restored and link recovery runs before exit. This path also reuses ret for cleanup, so it may overwrite the original error. Keep that on purpose: if cleanup succeeds, the caller can proceed with the FOM result for the current iteration. Signed-off-by: Can Guo <can.guo@oss.qualcomm.com> Reviewed-by: Bean Huo <beanhuo@micron.com> Reviewed-by: Ziqi Chen <ziqi.chen@oss.qualcomm.com> Link: https://patch.msgid.link/20260625121306.1655467-2-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-16scsi: ufs: core: Avoid possible memory reclaim deadlock in TX EQTR contextCan Guo1-6/+21
TX EQTR may run while devfreq gear scaling has quiesced the UFS tagset. In that context, functions ufshcd_tx_eqtr(), __ufshcd_tx_eqtr() and ufs_qcom_get_rx_fom() allocate memory with GFP_KERNEL. If direct reclaim is triggered, reclaim/writeback can depend on I/O to UFS device. Because the queue is quiesced, this can cause deadlock. Use memalloc_noio_save/restore() in ufshcd_tx_eqtr() to cover all allocations in the TX EQTR call tree, including: - params->eqtr_record in ufshcd_tx_eqtr() - eqtr_data in __ufshcd_tx_eqtr() - params in ufs_qcom_get_rx_fom() This is preferred over tagging individual call sites with GFP_NOIO, as it automatically covers any future allocations added anywhere in the call tree without requiring each caller to be aware of this constraint. [mkp: fix label as suggested by Bart] Fixes: 03e5d38e2f98 ("scsi: ufs: core: Add support for TX Equalization") Closes: https://sashiko.dev/#/patchset/20260615132834.2985346-1-can.guo@oss.qualcomm.com?part=2 Signed-off-by: Can Guo <can.guo@oss.qualcomm.com> Reviewed-by: Ziqi Chen <ziqi.chen@oss.qualcomm.com> Reviewed-by: Manivannan Sadhasivam <mani@kernel.org> Link: https://patch.msgid.link/20260618140941.902000-1-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-16Merge patch series "scsi: ufs: Add support for static TX Equalization settings"Martin K. Petersen4-1/+228
Can Guo <can.guo@oss.qualcomm.com> says: Hi, This series adds support for board-specific static TX Equalization settings provided through Device Tree. This series is based on the earlier TX Equalization enablement work and persistent storage/retrieval of optimal TX Equalization settings work: https://lore.kernel.org/all/20260325152154.1604082-1-can.guo@oss.qualcomm.com https://lore.kernel.org/all/20260424151420.111675-1-can.guo@oss.qualcomm.com Background ========== UFS v5.0/UFSHCI v5.0 adds HS-G6 support (46.6 Gbps/lane) via UniPro v3.0 and M-PHY v6.0. These specs define TX Equalization for all High-Speed Gears (not only HS-G6) to compensate channel loss and improve signal integrity at high speed. For HS-G6, M-PHY uses PAM4 1b1b line coding. Pre-Coding may also be required depending on channel characteristics. This series adds vendor-neutral DT properties: - patternProperties: txeq-preshoot-g[1-6], txeq-deemphasis-g[1-6] - fixed property: tx-precode-enable-g6 All properties use per-lane Host/Device tuples and accept 2 or 4 values for x1/x2 lane configurations: - txeq-preshoot-g[1-6]: values 0..7 - txeq-deemphasis-g[1-6]: values 0..7 - tx-precode-enable-g6: values 0/1 These properties carry board-level SI characterization data used as static TX Equalization settings for each High-Speed Gear. Example DTS snippet =================== The following x2-lane example shows the expected DT encoding: ufs@1d84000 { lanes-per-direction = <2>; txeq-preshoot-g6 = <1 2>, <3 4>; txeq-deemphasis-g6 = <0 1>, <2 3>; tx-precode-enable-g6 = <1 0>, <0 1>; }; Relationship with Adaptive TX Equalization ========================================== Adaptive TX Equalization remains the primary path when enabled. Static TX Equalization settings from DT are board-specific baseline values, but when adaptive TX Equalization is used, static settings are not final: - If valid settings are retrieved from qTxEQGnSettings/wTxEQGnSettingsExt, those retrieved settings override static DT settings. - If retrieval is not available/valid, TX EQTR runs and trained settings override static DT settings. So static DT settings are a fallback and are intended for cases where adaptive TX Equalization is not enabled/used. No behavior changes for platforms that do not provide these properties. What this series adds ===================== 1. dt-bindings: - Document txeq-preshoot-g[1-6], txeq-deemphasis-g[1-6], and tx-precode-enable-g6 in ufs-common.yaml. - Define tuple encoding for host/device values per lane. - Add per-property value validation ranges in schema. 2. UFS core/platform integration: - Parse and validate per-gear DT TX EQ settings during platform init. - Store parsed values into per-gear TX EQ params and track DT origin using the from_dt flag. - Integrate static-state handling in TX EQ flow so DT-provided entries are fed through the adaptive TX Equalization path and then converted to normal runtime params. Link: https://patch.msgid.link/20260616113348.1168248-1-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-16scsi: ufs: sysfs: Add HS_GEAR6 string in power_info/gear sysfs outputHimanshu Batra1-0/+1
In power_info/gear sysfs, currently it supports output only till gear 5. If operating mode is gear 6, it outputs "UNKNOWN". Add support for HS_GEAR6 string in sysfs output when operating mode is gear 6. Signed-off-by: Himanshu Batra <himanshubatra@google.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/20260616100121.548759-1-himanshubatra@google.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-16scsi: MAINTAINERS: Update HiSilicon hisi_sas driver maintainer to Xingui YangYihang Li1-1/+1
Replace myself with Xingui Yang who is very familiar with the HiSilicon hisi_sas drivers. Signed-off-by: Yihang Li <liyihang9@huawei.com> Reviewed-by: Jason Yan <yanaijie@huawei.com> Link: https://patch.msgid.link/20260616032051.1268608-1-liyihang9@huawei.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-16drm/xe/multi_queue: Reject PXP usage on multi-queue exec queuesJagmeet Randhawa1-0/+11
HWDRM is currently the only supported PXP type, and it is display related, so it cannot be combined with multi-queue exec queue groups. Reject exec queue creation that requests both multi-queue and PXP, returning -EINVAL. The secondary queue path already rejects any PXP property, so this adds the missing check for the multi-queue primary, which would otherwise allow the combination. Validated with igt@xe_exec_multi_queue@sanity, which exercises both the PXP-unsupported (-ENODEV) and PXP-supported (-EINVAL) paths. v3: - Change commit title prefix to drm/xe/multi_queue:. - Add Niranjana's Reviewed-by. v2: - Move the multi-queue + PXP check to exec_queue_user_ext_check() to bail out early, keyed off the properties bitmask (Niranjana). Signed-off-by: Jagmeet Randhawa <jagmeet.randhawa@intel.com> Reviewed-by: Niranjana Vishwanathapura <niranjana.vishwanathapura@intel.com> Signed-off-by: Niranjana Vishwanathapura <niranjana.vishwanathapura@intel.com> Link: https://patch.msgid.link/4d369249d52384bc93663055a3757a50614ebbfd.1784238312.git.jagmeet.randhawa@intel.com
2026-07-17Merge tag 'drm-intel-gt-next-2026-07-16' of ↵Dave Airlie6-25/+32
https://gitlab.freedesktop.org/drm/i915/kernel into drm-next Driver Changes: Fixes/improvements/new stuff: - Fix phys BO pread/pwrite with offset [gem] (Joonas Lahtinen) - Add missing nospec on parallel submit slot [gem] (Joonas Lahtinen) - Return NULL on error in active_instance (Joonas Lahtinen) - Fix NULL deref in I915_CONTEXT_PARAM_SSEU [gem] (Joonas Lahtinen) - Fix NULL deref on sched_engine alloc failure [gt] (Joonas Lahtinen) - Do not leak siblings[] on proto context error [gem] (Joonas Lahtinen) Miscellaneous: - Return bool values from a boolean helper [gt] (Andi Shyti) - Use correct selftest config symbol [gt] (Pengpeng Hou) - Fix GT PM sort comparators [selftests] (Emre Cecanpunar) - Return NULL for missing multi-lrc parent [guc] (Linmao Li) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Tvrtko Ursulin <tursulin@igalia.com> Link: https://patch.msgid.link/aliZXnfbOV-Mh8gZ@linux
2026-07-16Merge branch 'fixes-for-tailcall-with-subprog-and-callback'Eduard Zingerman3-8/+92
Pu Lehui says: ==================== Fixes for tailcall with subprog and callback From: Pu Lehui <pulehui@huawei.com> This series fix two issues related to tailcall: patch 1: Fix tail_call_reachable state leak across call branches. patch 2: Reject callback subprogs invoke tailcall. patch 3: testcases for patch 1 and 2. v3: - Fix tail_call_reachable state leak across call branches. (Sashiko) - Add testcase for the above issue. v2: https://lore.kernel.org/bpf/20260714024459.420075-1-pulehui@huaweicloud.com - Remove redantant testcase. - Add ACK tag by Eduard. v1: https://lore.kernel.org/bpf/20260711104727.4023420-1-pulehui@huaweicloud.com ==================== Link: https://patch.msgid.link/20260716120157.835937-1-pulehui@huaweicloud.com Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-07-16selftests/bpf: Add testcases for callback with tailcallPu Lehui2-0/+88
Add 2 testcases for callback with tailcall: 1. failure case: callback->subprog->tailcall. 2. success case: subprog with tailcall do not affect no-tailcall callback. Signed-off-by: Pu Lehui <pulehui@huawei.com> Link: https://patch.msgid.link/20260716120157.835937-4-pulehui@huaweicloud.com Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-07-16bpf: Reject callback subprogs invoke tailcallPu Lehui1-6/+2
Some JIT compilers, such as x86_64, rely on a register to pass the TCC. When subprograms of synchronous callback invoke tailcall, C helpers invoking bpf callback clobber this register, and the corrupted TCC may bypass the TCC limit, leading to infinite tailcall. Fix this by rejecting tailcall inside all subprogs of sync callback. This also cleanly consolidates the existing async and exception callback checks into a single unified `is_cb` check. Reported-by: Sashiko <sashiko-bot@kernel.org> Reported-by: Björn Töpel <bjorn@kernel.org> Signed-off-by: Pu Lehui <pulehui@huawei.com> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://patch.msgid.link/20260716120157.835937-3-pulehui@huaweicloud.com Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-07-16bpf: Sync tail_call_reachable with callee state on entryPu Lehui1-2/+2
Currently in check_max_stack_depth_subprog, when the verifier enters a new callee branch, the local tail_call_reachable is not properly synchronized with the callee's state. Consider a main prog branching into multiple subprogs: subprog0 -> tailcall main < subprog1 -> subprog2 When the verifier finishes checking subprog0 and backtracks to main prog, the local tail_call_reachable state is left as true. As it proceeds to subprog1, this uncleared state leaks into the new branch, falsely marking subprog1 and subprog2 as tailcall reachable. Fix this by explicitly syncing tail_call_reachable with the callee's has_tail_call state on entry. The caller's state is safely preserved and restored via the existing backtracking logic. Fixes: ebf7d1f508a7 ("bpf, x64: rework pro/epilogue and tailcall handling in JIT") Reported-by: Sashiko <sashiko-bot@kernel.org> Signed-off-by: Pu Lehui <pulehui@huawei.com> Link: https://patch.msgid.link/20260716120157.835937-2-pulehui@huaweicloud.com Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-07-17Merge tag 'drm-misc-next-2026-07-16' of ↵Dave Airlie63-616/+726
https://gitlab.freedesktop.org/drm/misc/kernel into drm-next drm-misc-next for 7.3: UAPI Changes: Cross-subsystem Changes: Core Changes: - blend: allow blend mode property without PREMULTI - bridges: - Rename drm_for_each_bridge_in_chain_scoped to drm_for_each_bridge_in_chain - Drop legacy bridges support - gpusvm: Code reorganization to give drivers more flexibility Driver Changes: - etnaviv: Check if a reset has been successful - nouveau: Create instmem iomapping at first use - panthor: Remove redundant cleanup - qxl: Convert to a simple encoder to a regular one - bridges: - Convert all remaining legacy bridges to atomic - tc358767: clamp the reported AUX read size to the request - panels: - novatek-nt37801: Use mipi_dsi_*_multi() functions - samsung-s6d16d0: Fix prepare error handling Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maxime Ripard <mripard@redhat.com> Link: https://patch.msgid.link/20260716-famous-pastel-ostrich-a1aaef@houat
2026-07-16Merge tag 'v7.2-rc3-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6Linus Torvalds11-56/+240
Pull smb client fixes from Steve French: - fallocate fixes - unit test fixes - fix allocation size after duplicate extents - fix check for overlapping data areas * tag 'v7.2-rc3-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: smb/client: flush dirty data before punching a hole smb/client: Use EXPORT_SYMBOL_IF_KUNIT() to export symbols in SMB2 smb/client: Use EXPORT_SYMBOL_IF_KUNIT() to export symbols smb: client: reject overlapping data areas in SMB2 responses smb/client: refresh allocation after EOF-extending fallocate smb/client: emulate small EOF-extending mode 0 fallocate ranges smb/client: reduce fallocate zero buffer allocation smb/client: handle overlapping allocated ranges in fallocate smb/client: refresh allocation size after duplicate extents smb: client: use kvzalloc() for megabyte buffer in simple fallocate
2026-07-16cpupower: Print kernel and hardware frequency informationJeremy Linton1-4/+4
The kernel asserted frequency from scaling_cur_freq may not always match the hardware reported frequency from cpuinfo_cur_freq. Print both values when they are available, and only print the unavailable message on x86 when the hardware frequency can't be read. Link: https://lore.kernel.org/r/20260709221344.1919794-4-jeremy.linton@arm.com Signed-off-by: Jeremy Linton <jeremy.linton@arm.com> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
2026-07-16cpupower: Build and call CPPC information on non-AMD processorsJeremy Linton3-2/+5
Now that we have a generic CPPC printout, call it on !AMD processors. If it fails to detect CPPC, or the registers don't look reasonable then it will exit without printing anything. Link: https://lore.kernel.org/r/20260709221344.1919794-3-jeremy.linton@arm.com Signed-off-by: Jeremy Linton <jeremy.linton@arm.com> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
2026-07-16cpupower: Add generic CPPC performance displayJeremy Linton1-0/+56
Arm64 machines, and possibly others, use the standard ACPI defined CPPC infrastructure. cpupower has CPPC support, but it's largely written around the intricacies of AMD processors, using platform MSRs to avoid shortcomings in the specification. Add a generic CPPC display that depends only on standardized fields. The computed frequency values are best effort and rely on the FW providing optional values that can be used to derive a meaningful frequency at a given unique performance level. Link: https://lore.kernel.org/r/20260709221344.1919794-2-jeremy.linton@arm.com Signed-off-by: Jeremy Linton <jeremy.linton@arm.com> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
2026-07-16Merge branch 'bpf-fix-tracing-of-kfuncs-with-implicit-args'Eduard Zingerman5-13/+196
Ihor Solodrai says: ==================== bpf: Fix tracing of kfuncs with implicit args Tejun reported an issue where a BPF program tracing a kfunc with KF_IMPLICIT_ARGS can crash the kernel [1]. This is caused by a bug in bpf_check_attach_target(): the btf_func_model for such a kfunc is computed from a wrong BTF prototype. For more details see the commit message of patch #1. The second patch adds a selftest that can catch this situation. The fix is a candidate for 7.1 backport. [1] https://github.com/sched-ext/scx/issues/3687#issuecomment-4906694106 --- v2->v3: * Replace btf_kfunc_accumulated_flags() with btf_kfunc_check_flag() following a discussion with Eduard. Inlining the hook walk is a worse option than a helper, because BTF_KFUNC_HOOK_MAX and co are internal to btf.c and exposing them is uglier. * remove reduntant btf_is_func check (Jiri) * formatting nit (Eduard) v2: https://lore.kernel.org/bpf/20260710192940.3020280-1-ihor.solodrai@linux.dev/ v1->v2: * Take a module reference in btf_attach_func_proto() around the btf_kfunc_accumulated_flags() call (sashiko) v1: https://lore.kernel.org/bpf/20260710005902.2234832-1-ihor.solodrai@linux.dev/ --- ==================== Link: https://patch.msgid.link/20260713235223.1639022-1-ihor.solodrai@linux.dev Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-07-16selftests/bpf: Cover tracing implicit kfunc argsKumar Kartikeya Dwivedi2-0/+113
KF_IMPLICIT_ARGS kfuncs have a BPF-call prototype and a real kernel target prototype. Add a tracing selftest that attaches fentry and fexit programs to bpf_kfunc_implicit_arg(), runs a syscall BPF program that calls it, and checks that the tracing context exposes both the explicit argument and the implicit prog aux pointer. Co-developed-by: Ihor Solodrai <ihor.solodrai@linux.dev> Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev> Link: https://patch.msgid.link/20260713235223.1639022-3-ihor.solodrai@linux.dev Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-07-16bpf: Fix tracing of kfuncs with implicit argsIhor Solodrai3-13/+83
A kfunc marked with KF_IMPLICIT_ARGS flag takes implicit arguments (such as bpf_prog_aux) that the verifier injects at load time. resolve_btfids strips those from the kfunc's BTF-visible prototype and keeps the real kernel ABI in a counterpart _impl prototype [1]. fentry/fexit/fmod_ret/fsession programs may attach to the BPF kernel functions, including those with implicit args. However bpf_check_attach_target() and bpf_check_attach_btf_id_multi() extract the struct btf_func_model from the wrong BTF prototype of the kfunc. The btf_func_model is later read to construct the trampoline, which then causes the injected implicit argument to be clobbered and the kfunc dereferencing garbage. Add btf_attach_func_proto() to resolve the real ABI prototype of the kfunc the way the call site does: by looking up the _impl prototype for a KF_IMPLICIT_ARGS kfunc. Use it at both attach-target model construction sites. To enable this, make two supporting changes: * pass bpf_verifier_log instead of bpf_verifier_env to find_kfunc_impl_proto(), so it can be reused from the attach path * add btf_kfunc_check_flag() to test a flag across all of a kfunc's hook sets, because a program attaching to a kfunc is not in the kfunc's call-set KF_IMPLICIT_ARGS must be consistent across the sets, so btf_kfunc_check_flag() returns -EINVAL on inconsistency. btf_kfunc_check_flag() reads the kfunc's flags from the target's kfunc_set_tab. For a module BTF that table is stable only after the module is live, so take a module reference around the read, mirroring how the kfunc call path gates the same lookup with btf_try_get_module(). The remaining call sites of btf_distill_func_proto() are safe as is. The BPF_TRACE_ITER case distills a registered iterator's prototype, and bpf_struct_ops_desc_init() distills the function-pointer members of a struct_ops type. Neither is a kfunc, and so can't have implicit arguments. [1] https://lore.kernel.org/all/20260120222638.3976562-1-ihor.solodrai@linux.dev/ Fixes: 64e1360524b9 ("bpf: Verifier support for KF_IMPLICIT_ARGS") Reported-by: Tejun Heo <tj@kernel.org> Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev> Link: https://github.com/sched-ext/scx/issues/3687#issuecomment-4906694106 Link: https://patch.msgid.link/20260713235223.1639022-2-ihor.solodrai@linux.dev Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-07-17rhashtable: clear stale iter->p on table restartCen Zhang (Microsoft)1-0/+1
rhashtable_walk_start_check() has two restart paths when resuming a walk. When iter->walker.tbl is valid, it re-validates iter->p against the table and sets iter->p = NULL if the object is gone. When iter->walker.tbl is NULL (table was freed during resize), it resets slot and skip but forgets to clear iter->p. rhashtable_walk_next() then dereferences the stale iter->p, reading freed memory. This is a use-after-free. Any caller that does multi-fragment rhashtable walks across walk_stop/walk_start boundaries is affected. Concrete cases include netlink_diag (__netlink_diag_dump in net/netlink/diag.c) and TIPC (tipc_nl_sk_walk in net/tipc/socket.c). Crash stack (netlink_diag): BUG: KASAN: slab-use-after-free in rhashtable_walk_next+0x365/0x3c0 Read of size 8 at addr ffff88801a9d2438 (freed kmalloc-2k, offset 1080) Call Trace: rhashtable_walk_next+0x365/0x3c0 (lib/rhashtable.c:1016) __netlink_diag_dump+0x160/0x760 (net/netlink/diag.c:122) netlink_diag_dump+0xc2/0x240 netlink_dump+0x5bc/0x1270 netlink_recvmsg+0x7a3/0x980 sock_recvmsg+0x1bc/0x200 __sys_recvfrom+0x1d4/0x2c0 Fixes: 5d240a8936f6 ("rhashtable: improve rhashtable_walk stability when stop/start used.") Cc: <stable@vger.kernel.org> Reported-by: AutonomousCodeSecurity@microsoft.com Reported-by: Yuan Tan <yuantan098@gmail.com> Closes: https://lore.kernel.org/linux-crypto/CAB8m9Wh559e+=n8z51gB8DrbEyCc2mc0MgGjrRR6_VXBmU=2AQ@mail.gmail.com Signed-off-by: Cen Zhang (Microsoft) <blbllhy@gmail.com> Reviewed-by: NeilBrown <neil@brown.name> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-16docs: pt_BR: Translate deprecated interfaces guide to PortugueseDaniel Pereira2-1/+423
Translate the deprecated interfaces, language features, attributes, and conventions document (deprecated.rst) to Portuguese (pt_BR). This ensures Portuguese-speaking developers have access to local guidelines on deprecated APIs (like BUG(), strcpy(), and VLAs), correct usage of safe alternatives (like WARN(), strscpy(), and flexible array members), and modern object allocator macros (kmalloc_obj). Signed-off-by: Daniel Pereira <danielmaraboo@gmail.com> Signed-off-by: Jonathan Corbet <corbet@lwn.net> Message-ID: <20260716021013.48025-5-danielmaraboo@gmail.com>
2026-07-16docs: pt_BR: Translate Code of Conduct to PortugueseDaniel Pereira2-0/+91
Translate the Contributor Covenant Code of Conduct document from Documentation/process/code-of-conduct.rst to Portuguese (pt_BR) to ensure the community guidelines are accessible in the local language. Also, add the newly translated file to the main index in the pt_BR translation directory to ensure it compiles correctly within the Sphinx build. Signed-off-by: Daniel Pereira <danielmaraboo@gmail.com> Signed-off-by: Jonathan Corbet <corbet@lwn.net> Message-ID: <20260716021013.48025-4-danielmaraboo@gmail.com>
2026-07-16docs: pt_BR: Translate code-of-conduct-interpretation to PortugueseDaniel Pereira2-0/+258
Translate the code-of-conduct-interpretation.rst document from Documentation/process/ to Portuguese (pt_BR) to make the kernel guidelines on community standards and enforcement more accessible to Portuguese-speaking developers. Signed-off-by: Daniel Pereira <danielmaraboo@gmail.com> Signed-off-by: Jonathan Corbet <corbet@lwn.net> Message-ID: <20260716021013.48025-3-danielmaraboo@gmail.com>
2026-07-16docs: pt_BR: Translate submit-checklist to PortugueseDaniel Pereira2-0/+146
Translate the submit-checklist document from Documentation/process/ to Portuguese (pt_BR) to make the kernel contribution guidelines more accessible to Portuguese-speaking developers. Also, add the newly translated file to the main index in the pt_BR translation directory to ensure it compiles and links correctly within the Sphinx build. Signed-off-by: Daniel Pereira <danielmaraboo@gmail.com> Signed-off-by: Jonathan Corbet <corbet@lwn.net> Message-ID: <20260716021013.48025-2-danielmaraboo@gmail.com>
2026-07-16docs/ja_JP: submitting-patches: Refine wording etc for "splitting changes" ↵Akira Yokosawa1-74/+74
and later Resolve rough edges in translation text added since commit 61e4155c81d1 ("docs/ja_JP: translate more of submitting-patches.rst"). As with commit 999084ee0b11 ("docs/ja_JP: submitting-patches: Amend "Describe your changes""), do the following tweaks: - Rewording and rephrasing. - Suppress extra white spaces rendered before and after strong emphasis in HTML and PDF by using espcaped spaces. - Provide translation words for "embargo", "word-wrap", "top-posting", etc. - Rather than keep "interleaved replies", use only 「インライン返信」 ("inline reply"), which is a popular term in Japanese. Signed-off-by: Akira Yokosawa <akiyks@gmail.com> Cc: Akiyoshi Kurita <weibu@redadmin.org> Signed-off-by: Jonathan Corbet <corbet@lwn.net> Message-ID: <20260715120545.99917-1-akiyks@gmail.com>
2026-07-16drm/radeon: Only define radeon_acpi_vfct_match when actually usedUwe Kleine-König1-1/+1
This fixes the build failure drivers/gpu/drm/radeon/radeon_bios.c:614:12: error: ‘radeon_acpi_vfct_match’ defined but not used [-Werror=unused-function] 614 | static int radeon_acpi_vfct_match(struct radeon_device *rdev, | ^~~~~~~~~~~~~~~~~~~~~~ for builds with CONFIG_ACPI unset. Fixes: 4059e2f02c8a ("drm/radeon: Fix VFCT bus number matching with soft filter") Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-16drm/amdgpu: dont pin wptr bo instead use eviction fenceSunil Khatri2-12/+24
Instead of pinning the wptr bo attach the eviction fence to the bo to make sure it remains valid all the time. Signed-off-by: Sunil Khatri <sunil.khatri@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-16drm/amdkfd: Add bounds check for CRAT subtype lengthWilliam Palacek1-0/+9
The CRAT parser validates that the subtype header fits within the image, but does not verify that the advertised subtype length fits. A malformed CRAT table with an oversized length field causes out-of-bounds reads when kfd_parse_subtype() casts the header to specific subtype structures. Add validation that sub_type_hdr + length does not exceed the image boundary before parsing the subtype contents. Signed-off-by: William Palacek <William.Palacek@amd.com> Reviewed-by: Alysa Liu <Alysa.Liu@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-16drm/amdgpu: Use just sriov capability bit for xgmi ext peer link supportWill Aitken3-8/+13
The legacy xgmi ta without EXTEND_PEER_LINKS support in sriov still reports it as enabled. It then fails when the command is called. Rely on the host capability bit instead. v2: Replace other instances of supports_ext_link_info with this method. Including sysfs emission for xgmi_port_num. Now amd-smi xgmi --metric will output N/A for all cells when port_nums cannot be mapped in sriov Signed-off-by: Will Aitken <will.aitken@amd.com> Signed-off-by: Victor Skvortsov <victor.skvortsov@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-16drm/amdkfd: Clean up debug runlist printingKent Russell1-3/+13
Having single lines with random hex codes really doesn't help a user to know what's going on. Give it a title, and print 8 8-length hex values per line, instead of a single 2-length hex value per printed line. Previous output: ... amdgpu: 0x20000010 amdgpu: 0x3000 amdgpu: 0x12E6E00 amdgpu: 0xFF amdgpu: 0x207008 amdgpu: 0x 0 amdgpu: New output: amdgpu: Runlist dump: amdgpu: 0: 0xc00ea100 0x14008008 0x0f4fffc0 0x00000000 0x20002000 0x00000338 0x00000020 0x00080017 amdgpu: 8: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x03400000 0x00000000 0x00000000 amdgpu: 16: 0xc005a200 0x20000010 0x00003030 0x012ed000 0x000000ff 0x00252008 0x00000000 0xc005a200 amdgpu: 24: 0x20000010 0x0000302c 0x012ec800 0x000000ff 0x0024c008 0x00000000 0xc005a200 0x20000010 amdgpu: 32: 0x00003028 0x012ec000 0x000000ff 0x00246008 0x00000000 0xc005a200 0x20000010 0x00003024 amdgpu: 40: 0x012eb800 0x000000ff 0x00240008 0x00000000 0xc005a200 0x20000010 0x00003020 0x012eb000 amdgpu: 48: 0x000000ff 0x0023a008 0x00000000 0xc005a200 0x20000010 0x0000301c 0x012ea800 0x000000ff amdgpu: 56: 0x00234008 0x00000000 0xc005a200 0x20000010 0x00003018 0x012ea000 0x000000ff 0x0022e008 amdgpu: 64: 0x00000000 0xc005a200 0x20000010 0x00003014 0x012e9800 0x000000ff 0x00228008 0x00000000 amdgpu: 72: 0xc005a200 0x20000010 0x00003010 0x012e9000 0x000000ff 0x00222008 0x00000000 0xc005a200 amdgpu: 80: 0x20000010 0x0000300c 0x012e8800 0x000000ff 0x0021c008 0x00000000 0xc005a200 0x20000010 amdgpu: 88: 0x00003008 0x012e8000 0x000000ff 0x00216008 0x00000000 0xc005a200 0x20000010 0x00003004 amdgpu: 96: 0x012e7800 0x000000ff 0x00210008 0x00000000 0xc005a200 0x20000010 0x00003000 0x012e6e00 amdgpu: 104: 0x000000ff 0x00207008 0x00000000 Signed-off-by: Kent Russell <kent.russell@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-16drm/amdgpu: use correct gfp_t for job allocationChristian König6-7/+22
For job allocation in GPU reset and page fault handling we must use GFP_ATOMIC to guarantee that we don't cycle back and depend on a dma_fence submission for the memory allocation. Add gfp_flags argument to amdgpu_job_alloc() and expose the gfp_flags of IB pools with amdgpu_ib_pool_gfp_flags() so that we can use different flags when allocating jobs. Assisted-by: Claude:Sonnet 4 Signed-off-by: Christian König <christian.koenig@amd.com> Reviewed-by: Timur Kristóf <timur.kristof@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-16drm/amdgpu: move job parameter to the end in amdgpu_job_alloc() and *_with_ib()Christian König15-42/+57
Move the job output parameter to be the last parameter in the amdgpu_job_alloc() and amdgpu_job_alloc_with_ib() function signature. This aligns with the common kernel coding convention where output parameters typically come last. Assisted-by: Claude:Sonnet 4 Signed-off-by: Christian König <christian.koenig@amd.com> Reviewed-by: Timur Kristóf <timur.kristof@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-16drm/amdgpu: add gfp_flags to amdgpu_sa_manager v2Christian König3-9/+34
Make sure that we use the emmergency reserves for unrecoverable page faults and GPU resets. v2: improve code comments a bit based on Timur's feedback Signed-off-by: Christian König <christian.koenig@amd.com> Reviewed-by: Timur Kristóf <timur.kristof@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-16Documentation: usb: remove dead link to external USB programming guideUtsav Shankar1-3/+0
The "Programming Guide for Linux USB Device Drivers" was last hosted at lmu.web.psi.ch and is no longer reachable. The original source (TUM, cs.tum.edu) is also defunct. Remove the dead reference rather than link to a third-party archive of a 20+ year old, outdated guide. Signed-off-by: Utsav Shankar <utsaveshan0206@gmail.com> Signed-off-by: Jonathan Corbet <corbet@lwn.net> Message-ID: <20260713150544.20962-1-utsaveshan0206@gmail.com>
2026-07-16drm/amdgpu: give different sizes for each SA pool typeChristian König2-3/+6
The IMMEDIATE (page fault) and DIRECT (reset) pool should be used only very rarely and by a single thread. Saves roughly 1.25MiB of memory and GART space for each amdgpu device. Signed-off-by: Christian König <christian.koenig@amd.com> Reviewed-by: Timur Kristóf <timur.kristof@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-16drm/amdgpu: properly account for resets with user queuesAlex Deucher3-4/+35
We need to increment the reset counter, force fence completion, and set the wedged event when a user queue is reset, but only for the guilty queue. We don't want additional events for collateral damage. Only increment the reset counter and set the wedged event in the top level userq reset callers (both KGD and KFD). This aligns with how this is managed for kernel queue resets. v2: fix task info refcount handling, align with kfd error reporting. v3: check for has_reset_queue in KFD path (Prike) Cc: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> Cc: Prike Liang <Prike.Liang@amd.com> Cc: Sunil Khatri <sunil.khatri@amd.com> Cc: Lazar, Lijo <lijo.lazar@amd.com> Reviewed-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Reviewed-by: Prike Liang <Prike.Liang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-16drm/amdgpu/gfx9.4.3: Fix MEC rollback loop in EOP IRQ setupSrinivasan Shanmugam1-1/+1
Fix the error cleanup path in gfx_v9_4_3_set_userq_eop_interrupts() by using the correct loop condition. This ensures all previously enabled EOP IRQs are released if setup fails. Fixes: 832f0aa050ff ("drm/amdgpu/gfx9.4.3: add support for disabling kernel queues") Reported-by: Dan Carpenter <error27@gmail.com> Cc: Kent Russell <kent.russell@amd.com> Cc: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-16drm/amdgpu : update mmhub eco sec lvl for vcn5_3Suresh Guttula5-0/+79
This patch requests PSP to set the sec lvl for vcn and jpeg. Signed-off-by: Suresh Guttula <suresh.guttula@amd.com> Reviewed-by: McRae Geoffrey<Geoffrey.McRae@amd.com> Acked-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-16docs: pt_BR: process: Translate the kernel driver statementIgor Giamoniano2-0/+206
Translate Documentation/process/kernel-driver-statement.rst into Brazilian Portuguese, keeping the reStructuredText formatting and the list of signatories unchanged. Signed-off-by: Igor Giamoniano <igorgphotoarte@gmail.com> Acked-by: Daniel Pereira <danielmaraboo@gmail.com> Signed-off-by: Jonathan Corbet <corbet@lwn.net> Message-ID: <20260709222953.9900-1-igorgphotoarte@gmail.com>
2026-07-16dt-bindings: gpu: host1x: Fix email addressThierry Reding4-4/+4
These bindings had mixed up local and domain parts, the combination of which doesn't exist. Fix them up. Acked-by: Conor Dooley <conor.dooley@microchip.com> Signed-off-by: Thierry Reding <treding@nvidia.com>
2026-07-16docs: custom.css: don't limit rendering to old 800px monitorsMauro Carvalho Chehab1-0/+2
Right now, base.css style imposes a maximum limit of 800 horizontal pixels to be compatible with very old SVGA monitors. This is not enough to display some tables like pixformat ones on media. Instead, use a more realistic maximum limit. Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Message-ID: <20260711094821.5e262356@foz.lan> Signed-off-by: Jonathan Corbet <corbet@lwn.net>
2026-07-16dt-bindings: iommu: Fix interrupt type in exampleAshish Mhetre1-1/+1
The CMDQV interrupt on Tegra264 is edge-triggered per the hardware interrupt documentation, but the binding example describes it as level-triggered. Correct the example to use IRQ_TYPE_EDGE_RISING so that it does not propagate the wrong trigger type. Fixes: 8a59954192eb ("dt-bindings: iommu: Add NVIDIA Tegra CMDQV support") Reported-by: Nicolin Chen <nicolinc@nvidia.com> Signed-off-by: Ashish Mhetre <amhetre@nvidia.com> Acked-by: Jon Hunter <jonathanh@nvidia.com> Acked-by: Nicolin Chen <nicolinc@nvidia.com> Acked-by: Conor Dooley <conor.dooley@microchip.com> Signed-off-by: Thierry Reding <treding@nvidia.com>
2026-07-16docs: maintainers_include: fix entry namesMauro Carvalho Chehab1-2/+5
Right now, it is printing duplicated values as profile entries, as it is not properly handling subsystem name. Fix it. Reported-by: Manuel Ebner <manuelebner@mailbox.org> Closes: https://lore.kernel.org/linux-doc/98a558a87a07ab641f47c66c372ee7ed0735f4f5.camel@mailbox.org/ Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Signed-off-by: Jonathan Corbet <corbet@lwn.net> Message-ID: <bb00e9ba66f2d95306e7ca88fdf0f39fcc570cff.1783884625.git.mchehab+huawei@kernel.org>
2026-07-16rust: device: avoid trailing ; in printing macrosAlice Ryhl1-11/+9
These macros are used like expressions, so they should not emit a semicolon. This is being turned into a hard error in a future release of Rust. error: trailing semicolon in macro used in expression position --> drivers/gpu/nova-core/firmware/fsp.rs:79:34 | 79 | .inspect_err(|_| dev_err!(dev, "FMC firmware missing '{}' section\n", name)) | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ | = warning: this was previously accepted by the compiler but is being phased out; it will become a hard error in a future release! = note: for more information, see issue #79813 <https://github.com/rust-lang/rust/issues/79813> = note: this error originates in the macro `dev_err` (in Nightly builds, run with -Z macro-backtrace for more info) [ I was doubly surprised since upstream made it a deny-by-default lint a year ago for Rust 1.91.0, and yet we didn't see it; plus I hadn't seen this in my CI even yesterday. It turns out this just landed into today's nightly (nightly-2026-07-16, using upstream commit d0babd8b6): Link: https://github.com/rust-lang/rust/pull/159222 which says: "The `semicolon_in_expressions_from_macros` lint previously suppressed warnings about non-local macros. This masks a lint that will subsequently become a hard error." So that explains it. And this is the PR that will make it a hard error at some point in the future: Link: https://github.com/rust-lang/rust/pull/159218 Thus starting with Rust 1.99.0 (expected 2026-10-01), we will be seeing the deny-by-default lint above, so clean it up already. - Miguel ] Cc: stable@vger.kernel.org # Needed in 6.18.y and later. Link: https://github.com/rust-lang/rust/issues/79813 Signed-off-by: Alice Ryhl <aliceryhl@google.com> Reviewed-by: Gary Guo <gary@garyguo.net> Acked-by: Danilo Krummrich <dakr@kernel.org> Link: https://github.com/rust-lang/rust/pull/159218 Link: https://github.com/rust-lang/rust/pull/159222 Link: https://patch.msgid.link/20260716-device-trail-semicolon-v1-1-f48e9dcfae15@google.com [ Fixed typo. ] Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-07-16overlayfs.rst: remove mention of workdir needing to be emptyJesse Van Gavere1-2/+1
This requirement has not been true since v4.8 when automatic cleanup was added in commit eea2fb4851e9 ("ovl: proper cleanup of workdir") Signed-off-by: Jesse Van Gavere <jesse.vangavere@teledyne.com> Reviewed-by: Amir Goldstein <amir73il@gmail.com> Signed-off-by: Jonathan Corbet <corbet@lwn.net> Message-ID: <20260716-overlayfs-rst-update-v2-1-ba25393ea7a3@teledyne.com>
generated by cgit (git 2.54.0.dirty) at 2026-10-01 09:31:27 +0000