summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)AuthorLines
2026-03-10build_bug.h: correct function parameters names in kernel-docRandy Dunlap-1/+3
Use the correct function (or macro) names to avoid kernel-doc warnings: Warning: include/linux/build_bug.h:38 function parameter 'cond' not described in 'BUILD_BUG_ON_MSG' Warning: include/linux/build_bug.h:38 function parameter 'msg' not described in 'BUILD_BUG_ON_MSG' Warning: include/linux/build_bug.h:76 function parameter 'expr' not described in 'static_assert' Link: https://lkml.kernel.org/r/20260302005144.3467019-1-rdunlap@infradead.org Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Reviewed-by: SeongJae Park <sj@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-03-10crash_dump: don't log dm-crypt key bytes in read_key_from_user_keyingThorsten Blum-2/+2
When debug logging is enabled, read_key_from_user_keying() logs the first 8 bytes of the key payload and partially exposes the dm-crypt key. Stop logging any key bytes. Link: https://lkml.kernel.org/r/20260227230008.858641-2-thorsten.blum@linux.dev Fixes: 479e58549b0f ("crash_dump: store dm crypt keys in kdump reserved memory") Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Cc: Baoquan He <bhe@redhat.com> Cc: Coiby Xu <coxu@redhat.com> Cc: Dave Young <dyoung@redhat.com> Cc: Vivek Goyal <vgoyal@redhat.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-03-10rust: task: use `as_char_ptr` instead of `as_ptr().cast()`Gary Guo-4/+3
`as_char_ptr` would provide the correct (unsigned char) type without needing to convert to an intermediate type and cast the pointer. The `as_ptr()` function is going to be disallowed by clippy warning, so fix this usage. This is used only if CONFIG_DEBUG_ATOMIC_SLEEP=y. Instead of conditionally importing `CStrExt`, import it via prelude instead, and remove other imports that are already available via the prelude. Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202601221157.89t3Sqbl-lkp@intel.com/ Signed-off-by: Gary Guo <gary@garyguo.net> Link: https://patch.msgid.link/20260203130745.868762-1-gary@kernel.org Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-03-10smb/client: only export symbol for 'smb2maperror-test' moduleYe Bin-3/+6
Only export smb2_get_err_map_test smb2_error_map_table_test and smb2_error_map_num symbol for 'smb2maperror-test' module. Fixes: 7d0bf050a587 ("smb/client: make SMB2 maperror KUnit tests a separate module") Signed-off-by: Ye Bin <yebin10@huawei.com> Reviewed-by: ChenXiaoSong <chenxiaosong@kylinos.cn> Signed-off-by: Steve French <stfrench@microsoft.com>
2026-03-10smb: client: fix in-place encryption corruption in SMB2_write()Bharath SM-1/+4
SMB2_write() places write payload in iov[1..n] as part of rq_iov. smb3_init_transform_rq() pointer-shares rq_iov, so crypt_message() encrypts iov[1] in-place, replacing the original plaintext with ciphertext. On a replayable error, the retry sends the same iov[1] which now contains ciphertext instead of the original data, resulting in corruption. The corruption is most likely to be observed when connections are unstable, as reconnects trigger write retries that re-send the already-encrypted data. This affects SFU mknod, MF symlinks, etc. On kernels before 6.10 (prior to the netfs conversion), sync writes also used this path and were similarly affected. The async write path wasn't unaffected as it uses rq_iter which gets deep-copied. Fix by moving the write payload into rq_iter via iov_iter_kvec(), so smb3_init_transform_rq() deep-copies it before encryption. Cc: stable@vger.kernel.org #6.3+ Acked-by: Henrique Carvalho <henrique.carvalho@suse.com> Acked-by: Shyam Prasad N <sprasad@microsoft.com> Acked-by: Paulo Alcantara (Red Hat) <pc@manguebit.org> Signed-off-by: Bharath SM <bharathsm@microsoft.com> Signed-off-by: Steve French <stfrench@microsoft.com>
2026-03-10smb: client: fix sbflags initializationArnd Bergmann-2/+1
The newly introduced variable is initialized in an #ifdef block but used outside of it, leading to undefined behavior when CONFIG_CIFS_ALLOW_INSECURE_LEGACY is disabled: fs/smb/client/dir.c:417:9: error: variable 'sbflags' is uninitialized when used here [-Werror,-Wuninitialized] 417 | if (sbflags & CIFS_MOUNT_DYNPERM) | ^~~~~~~ Move the initialization into the declaration, the same way as the other similar function do it. Fixes: 4fc3a433c139 ("smb: client: use atomic_t for mnt_cifs_flags") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org> Signed-off-by: Steve French <stfrench@microsoft.com>
2026-03-10smb: client: fix atomic open with O_DIRECT & O_SYNCPaulo Alcantara-15/+15
When user application requests O_DIRECT|O_SYNC along with O_CREAT on open(2), CREATE_NO_BUFFER and CREATE_WRITE_THROUGH bits were missed in CREATE request when performing an atomic open, thus leading to potentially data integrity issues. Fix this by setting those missing bits in CREATE request when O_DIRECT|O_SYNC has been specified in cifs_do_create(). Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.org> Reviewed-by: David Howells <dhowells@redhat.com> Acked-by: Henrique Carvalho <henrique.carvalho@suse.com> Cc: Tom Talpey <tom@talpey.com> Cc: linux-cifs@vger.kernel.org Cc: stable@vger.kernel.org Signed-off-by: Steve French <stfrench@microsoft.com>
2026-03-10drm/xe: Translate C-state "reset value" into RC6Gustavo Sousa-0/+9
There are higher level sleep states that will cause RC6 state readout to come back with an "in-reset" value. That is the case with NVL-P. As those states are only possible if the GT is already in C6, let's just translate the "reset value" into C6 when doing the readout. Bspec: 67651 Reviewed-by: Matt Roper <matthew.d.roper@intel.com> Link: https://patch.msgid.link/20260309-extra-nvl-p-enabling-patches-v5-7-be9c902ee34e@intel.com Signed-off-by: Gustavo Sousa <gustavo.sousa@intel.com>
2026-03-10drm/xe/xe3p: Drop Wa_16028780921Gustavo Sousa-7/+0
Wa_16028780921 involves writing to a register that is locked by firmware prior to driver loading and doesn't have any effect if implemented by the KMD. Since the implementation of the workaround actually belongs the firmware, just drop the ineffective implementation by the KMD. Reviewed-by: Matt Roper <matthew.d.roper@intel.com> Link: https://patch.msgid.link/20260309-extra-nvl-p-enabling-patches-v5-6-be9c902ee34e@intel.com Signed-off-by: Gustavo Sousa <gustavo.sousa@intel.com>
2026-03-10drm/xe/nvlp: Implement Wa_14026539277Gustavo Sousa-0/+44
Implement the KMD part of Wa_14026539277, which applies to NVL-P A0. The KMD implementation is just one component of the workaround, which also depends on Pcode to implement its part in order to be complete. v2: - Add FUNC(xe_rtp_match_not_sriov_vf) to skip applying the workaround to SRIOV VFs. (Matt) v3: - Make Wa_14026539277 a device workaround instead of a GT workaround. (Matt) v4: - Drop FUNC(xe_rtp_match_not_sriov_vf) and use a direct check with IS_SRIOV_VF() in the workaround implementation. (Matt) Reviewed-by: Matt Roper <matthew.d.roper@intel.com> # v3 Link: https://patch.msgid.link/20260309-extra-nvl-p-enabling-patches-v5-5-be9c902ee34e@intel.com Signed-off-by: Gustavo Sousa <gustavo.sousa@intel.com>
2026-03-10drm/xe/rtp: Add support for matching platform-level steppingGustavo Sousa-0/+28
Add support for matching platform-level stepping, which will be used for an upcoming NVL-P workaround. As support for reading platform-level stepping information is added only as needed in the driver, add a warning when the rule finds a STEP_NONE value, which is an indication that the driver is missing such a support. Reviewed-by: Matt Roper <matthew.d.roper@intel.com> Link: https://patch.msgid.link/20260309-extra-nvl-p-enabling-patches-v5-4-be9c902ee34e@intel.com Signed-off-by: Gustavo Sousa <gustavo.sousa@intel.com>
2026-03-10drm/xe/nvlp: Read platform-level stepping infoGustavo Sousa-0/+27
There will be a NVL-P workaround for which we will need to know the platform-level stepping information in order to decide whether to apply it or not. While NVL-P has a nice mapping between the PCI revid and our symbolic stepping enumeration, not all platforms are like that: (i) Some platforms will have a single PCI revid used for a set platform level steppings (ii) and some might even require specific mappings. To make things simpler, let's include stepping information in the device info only on demand, for those platforms where it is needed for workaround checks. v2: - Call xe_step_platform_get() very early, to allow device workarounds to use it in early stages of device initialization. (Matt) Bspec: 74201 Reviewed-by: Matt Roper <matthew.d.roper@intel.com> # v1 Link: https://patch.msgid.link/20260309-extra-nvl-p-enabling-patches-v5-3-be9c902ee34e@intel.com Signed-off-by: Gustavo Sousa <gustavo.sousa@intel.com>
2026-03-10drm/xe: Drop unused IS_PLATFORM_STEP() and IS_SUBPLATFORM_STEP()Gustavo Sousa-10/+0
The macros IS_PLATFORM_STEP() and IS_SUBPLATFORM_STEP() are unused since commit 87c299fa3a97 ("drm/xe/guc: Port Wa_14014475959 to xe_wa and fix it") and commit 63bbd800ff01 ("drm/xe/guc: Port Wa_22012727170/Wa_22012727685 to xe_wa"), respectively, and we can drop them now. Furthermore, in upcoming changes we will add logic to read platform-level step information from PCI RevID and keeping those macros around would potentially cause confusion. v2: - Cite commits that made the macros unused. (Matt) Reviewed-by: Matt Roper <matthew.d.roper@intel.com> Link: https://patch.msgid.link/20260309-extra-nvl-p-enabling-patches-v5-2-be9c902ee34e@intel.com Signed-off-by: Gustavo Sousa <gustavo.sousa@intel.com>
2026-03-10drm/xe: Modify stepping info directly in xe_step_*_get()Gustavo Sousa-30/+36
In an upcoming change, we will add a member to struct xe_step_info to represent the platform-level stepping. As such, we should stop assigning the value returned by functions xe_step_pre_gmdid_get() and xe_step_gmdid_get() directly to xe->info.step. Since there are no other users for those functions, let's simply update them to modify xe->info.step directly. Reviewed-by: Matt Roper <matthew.d.roper@intel.com> Link: https://patch.msgid.link/20260309-extra-nvl-p-enabling-patches-v5-1-be9c902ee34e@intel.com Signed-off-by: Gustavo Sousa <gustavo.sousa@intel.com>
2026-03-10efi: Enable BGRT loading under XenMarek Marczykowski-Górecki-2/+5
The BGRT table can be parsed if EFI_PARAVIRT is enabled, even if EFI_MEMMAP is not. Xen will take care of preserving the image even if EfiBootServicesData memory is reclaimed already, or invalidate the table if it didn't preserve it - in both cases accesing the table itself under virt is safe. Also allow the ESRT to be in reclaimable memory, as that is where future Xen versions will put it. This is similar approach as was taken for ESRT table in 01de145dc7fb "efi: Actually enable the ESRT under Xen". Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
2026-03-10efi: make efi_mem_type() and efi_mem_attributes() work on Xen PVMarek Marczykowski-Górecki-18/+9
Xen doesn't give direct access to the EFI memory map, but provides a hypercall interface for it. efi_mem_desc_lookup() was already adjusted in aca1d27ac38a "efi: xen: Implement memory descriptor lookup based on hypercall" to (optionally) use it. Now make efi_mem_type() and efi_mem_attributes() use common efi_mem_desc_lookup() too. This also reduces code duplication a bit. efi_mem_type() retains separate check for -ENOTSUPP error case (even though no caller seems to rely on this currently). Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com> [ardb: Drop erroneous 'const' qualifier] Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
2026-03-10e1000/e1000e: Fix leak in DMA error cleanupMatt Vollrath-4/+0
If an error is encountered while mapping TX buffers, the driver should unmap any buffers already mapped for that skb. Because count is incremented after a successful mapping, it will always match the correct number of unmappings needed when dma_error is reached. Decrementing count before the while loop in dma_error causes an off-by-one error. If any mapping was successful before an unsuccessful mapping, exactly one DMA mapping would leak. In these commits, a faulty while condition caused an infinite loop in dma_error: Commit 03b1320dfcee ("e1000e: remove use of skb_dma_map from e1000e driver") Commit 602c0554d7b0 ("e1000: remove use of skb_dma_map from e1000 driver") Commit c1fa347f20f1 ("e1000/e1000e/igb/igbvf/ixgb/ixgbe: Fix tests of unsigned in *_tx_map()") fixed the infinite loop, but introduced the off-by-one error. This issue may still exist in the igbvf driver, but I did not address it in this patch. Fixes: c1fa347f20f1 ("e1000/e1000e/igb/igbvf/ixgb/ixgbe: Fix tests of unsigned in *_tx_map()") Assisted-by: Claude:claude-4.6-opus Signed-off-by: Matt Vollrath <tactii@gmail.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-03-10i40e: fix src IP mask checks and memcpy argument names in cloud filterAlok Tiwari-7/+7
Fix following issues in the IPv4 and IPv6 cloud filter handling logic in both the add and delete paths: - The source-IP mask check incorrectly compares mask.src_ip[0] against tcf.dst_ip[0]. Update it to compare against tcf.src_ip[0]. This likely goes unnoticed because the check is in an "else if" path that only executes when dst_ip is not set, most cloud filter use cases focus on destination-IP matching, and the buggy condition can accidentally evaluate true in some cases. - memcpy() for the IPv4 source address incorrectly uses ARRAY_SIZE(tcf.dst_ip) instead of ARRAY_SIZE(tcf.src_ip), although both arrays are the same size. - The IPv4 memcpy operations used ARRAY_SIZE(tcf.dst_ip) and ARRAY_SIZE (tcf.src_ip), Update these to use sizeof(cfilter->ip.v4.dst_ip) and sizeof(cfilter->ip.v4.src_ip) to ensure correct and explicit copy size. - In the IPv6 delete path, memcmp() uses sizeof(src_ip6) when comparing dst_ip6 fields. Replace this with sizeof(dst_ip6) to make the intent explicit, even though both fields are struct in6_addr. Fixes: e284fc280473 ("i40e: Add and delete cloud filter") Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-03-11arm64: dts: allwinner: sun55i-t527: avaota-a1: Add SPI NANDChen-Yu Tsai-0/+15
The Avaota A1 board has a SPI NAND chip connected to spi0 on the PJ pins with support for QSPI. Enable spi0 and add a device node for the SPI NAND chip. Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com> Link: https://patch.msgid.link/20260302153559.3199783-4-wens@kernel.org Signed-off-by: Chen-Yu Tsai <wens@kernel.org>
2026-03-11arm64: dts: allwinner: sun55i-a523: Add pinmux for spi0 on PJ pinsChen-Yu Tsai-0/+35
The Avaota A1 board uses spi0 on the PJ pins to connect a SPI NAND chip. Add the full set of pins. Even though this board doesn't use CS1, other boards may do so in the future. Reviewed-by: Jernej Skrabec <jernej.skrabec@gmail.com> Link: https://patch.msgid.link/20260302153559.3199783-3-wens@kernel.org Signed-off-by: Chen-Yu Tsai <wens@kernel.org>
2026-03-10Merge tag 'mm-hotfixes-stable-2026-03-09-16-36' of ↵Linus Torvalds-73/+163
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "15 hotfixes. 6 are cc:stable. 14 are for MM. Singletons, with one doubleton - please see the changelogs for details" * tag 'mm-hotfixes-stable-2026-03-09-16-36' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: MAINTAINERS, mailmap: update email address for Lorenzo Stoakes mm/mmu_notifier: clean up mmu_notifier.h kernel-doc uaccess: correct kernel-doc parameter format mm/huge_memory: fix a folio_split() race condition with folio_try_get() MAINTAINERS: add co-maintainer and reviewer for SLAB ALLOCATOR MAINTAINERS: add RELAY entry memcg: fix slab accounting in refill_obj_stock() trylock path mm/hugetlb.c: use __pa() instead of virt_to_phys() in early bootmem alloc code zram: rename writeback_compressed device attr tools/testing: fix testing/vma and testing/radix-tree build Revert "ptdesc: remove references to folios from __pagetable_ctor() and pagetable_dtor()" mm/cma: move put_page_testzero() out of VM_WARN_ON in cma_release() mm/damon/core: clear walk_control on inactive context in damos_walk() mm: memfd_luo: always dirty all folios mm: memfd_luo: always make all folios uptodate
2026-03-10spi: tegra210-quad: Remove redundant pm_runtime_mark_last_busy() callsFelix Gu-3/+0
pm_runtime_put_autosuspend() already internally updates the last_busy timestamp before scheduling the autosuspend, making explicit pm_runtime_mark_last_busy() calls immediately before it redundant. Fixes: 7c12f6ead467 ("spi: tegra210-quad: Add runtime autosuspend support") Signed-off-by: Felix Gu <ustc.gu@gmail.com> Signed-off-by: Mark Brown <broonie@kernel.org> Link: https://patch.msgid.link/20260307-quad-v1-1-f103515db501@gmail.com
2026-03-10spi: axiado: Remove redundant pm_runtime_mark_last_busy() callFelix Gu-1/+0
The pm_runtime_mark_last_busy() call is redundant in the probe function as pm_runtime_put_autosuspend() already calls pm_runtime_mark_last_busy() internally to update the last access time of the device before queuing autosuspend. Fixes: e75a6b00ad79 ("spi: axiado: Add driver for Axiado SPI DB controller") Signed-off-by: Felix Gu <ustc.gu@gmail.com> Signed-off-by: Mark Brown <broonie@kernel.org> Link: https://patch.msgid.link/20260307-axiado-1-v1-1-e90aa1b6dd9b@gmail.com
2026-03-10ASoC: codecs: rt1011: Use component to get the dapm context in spk_mode_putPeter Ujfalusi-1/+1
The correct helper to use in rt1011_recv_spk_mode_put() to retrieve the DAPM context is snd_soc_component_to_dapm(), from kcontrol we will receive NULL pointer. Closes: https://github.com/thesofproject/linux/issues/5691 Fixes: 5b35bb517f27 ("ASoC: codecs: rt1011: convert to snd_soc_dapm_xxx()") Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com> Link: https://patch.msgid.link/20260310065350.18921-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-10ASoC: da7219: scope AAD suspend and resume helpers to CONFIG_PMPengpeng Hou-1/+7
In current linux.git, da7219_aad_suspend() and da7219_aad_resume() are defined and declared unconditionally. However, their only in-tree callers are the component PM callbacks in da7219.c, which are already guarded by #ifdef CONFIG_PM. This inconsistency leads to unnecessary code inclusion and potential compiler warnings when CONFIG_PM is disabled. Match the helper declarations and definitions to the callers' scope and provide no-op !CONFIG_PM stubs in the header. Signed-off-by: Pengpeng Hou <pengpeng.hou@isrc.iscas.ac.cn> Link: https://patch.msgid.link/20260310082348.743716-1-pengpeng.hou@isrc.iscas.ac.cn Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-10audit: handle unknown status requests in audit_receive_msg()Ricardo Robaina-0/+11
Currently, audit_receive_msg() ignores unknown status bits in AUDIT_SET requests, incorrectly returning success to newer user space tools querying unsupported features. This breaks forward compatibility. Fix this by defining AUDIT_STATUS_ALL and returning -EINVAL if any unrecognized bits are set (s.mask & ~AUDIT_STATUS_ALL). This ensures invalid requests are safely rejected, allowing user space to reliably test for and gracefully handle feature detection on older kernels. Suggested-by: Steve Grubb <sgrubb@redhat.com> Signed-off-by: Ricardo Robaina <rrobaina@redhat.com> [PM: subject line tweak] Signed-off-by: Paul Moore <paul@paul-moore.com>
2026-03-10selftests/bpf: Fix pkg-config call on static buildsPaul Chaignon-1/+1
For commit b0dcdcb9ae75 ("resolve_btfids: Fix linker flags detection"), I suggested setting HOSTPKG_CONFIG to $PKG_CONFIG when compiling resolve_btfids, but I forgot the quotes around that variable. As a result, when running vmtest.sh with static linking, it fails as follows: $ LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh [...] make: unrecognized option '--static' Usage: make [options] [target] ... [...] This worked when I tested it because HOSTPKG_CONFIG didn't have a default value in the resolve_btfids Makefile, but once it does, the quotes aren't preserved and it fails on the next make call. Fixes: b0dcdcb9ae75 ("resolve_btfids: Fix linker flags detection") Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com> Acked-by: Mykyta Yatsenko <yatsenko@meta.com> Acked-by: Ihor Solodrai <ihor.solodrai@linux.dev> Link: https://lore.kernel.org/r/abADBwn_ykblpABE@mail.gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-03-10tools/power turbostat: Fix illegal memory access when SMT is present and ↵Zhang Rui-3/+2
disabled When SMT is present and disabled, turbostat may under-size the thread_data array. This can corrupt results or cause turbostat to exit with a segmentation fault. [lenb: commit message] Fixes: a2b4d0f8bf07 ("tools/power turbostat: Favor cpu# over core#") Signed-off-by: Zhang Rui <rui.zhang@intel.com> Signed-off-by: Len Brown <len.brown@intel.com>
2026-03-10bpf: Fix constant blinding for PROBE_MEM32 storesSachin Kumar-0/+21
BPF_ST | BPF_PROBE_MEM32 immediate stores are not handled by bpf_jit_blind_insn(), allowing user-controlled 32-bit immediates to survive unblinded into JIT-compiled native code when bpf_jit_harden >= 1. The root cause is that convert_ctx_accesses() rewrites BPF_ST|BPF_MEM to BPF_ST|BPF_PROBE_MEM32 for arena pointer stores during verification, before bpf_jit_blind_constants() runs during JIT compilation. The blinding switch only matches BPF_ST|BPF_MEM (mode 0x60), not BPF_ST|BPF_PROBE_MEM32 (mode 0xa0). The instruction falls through unblinded. Add BPF_ST|BPF_PROBE_MEM32 cases to bpf_jit_blind_insn() alongside the existing BPF_ST|BPF_MEM cases. The blinding transformation is identical: load the blinded immediate into BPF_REG_AX via mov+xor, then convert the immediate store to a register store (BPF_STX). The rewritten STX instruction must preserve the BPF_PROBE_MEM32 mode so the architecture JIT emits the correct arena addressing (R12-based on x86-64). Cannot use the BPF_STX_MEM() macro here because it hardcodes BPF_MEM mode; construct the instruction directly instead. Fixes: 6082b6c328b5 ("bpf: Recognize addr_space_cast instruction in the verifier.") Reviewed-by: Puranjay Mohan <puranjay@kernel.org> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Signed-off-by: Sachin Kumar <xcyfun@protonmail.com> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/r/Y6IT5VvNRchPBLI5D7JZHBzZrU9rb0ycRJPJzJSXGj7kJlX8RJwZFSM2YZjcDxoQKABkxt1T8Os2gi23PYyFuQe6KkZGWVyfz8K5afdy9ak=@protonmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-03-10Merge branch 'fix-test_cgroup_iter_memcg-issues-found-during-back-porting'Alexei Starovoitov-36/+12
Hui Zhu says: ==================== Fix test_cgroup_iter_memcg issues found during back-porting While back-porting "mm: bpf kfuncs to access memcg data", I encountered issues with test_cgroup_iter_memcg, specifically in test_kmem. The test_cgroup_iter_memcg test would falsely pass when bpf_mem_cgroup_page_state() failed due to incompatible enum values across kernel versions. Additionally, test_kmem would fail on systems with cgroup.memory=nokmem enabled. These patches are my fixes for the problems I encountered. Changelog: v5: According to the comments of Emil Tsalapatis and JP Kobryn, dropped "selftests/bpf: Check bpf_mem_cgroup_page_state return value". v4: Fixed wrong git commit log in "bpf: Use bpf_core_enum_value for stats in cgroup_iter_memcg". v3: According to the comments of JP Kobryn, remove kmem subtest from cgroup_iter_memcg and fix assertion string in test_pgfault. v2: According to the comments of JP Kobryn, added bpf_core_enum_value() usage in the BPF program to handle cross-kernel enum value differences at load-time instead of compile-time. Dropped the mm/memcontrol.c patch. Modified test_kmem handling: instead of skipping when nokmem is set, verify that kmem value is zero as expected. According to the comments of bot, fixed assertion message: changed "bpf_mem_cgroup_page_state" to "bpf_mem_cgroup_vm_events" for PGFAULT check. ==================== Link: https://patch.msgid.link/cover.1772505399.git.zhuhui@kylinos.cn Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-03-10selftests/bpf: Use bpf_core_enum_value for stats in cgroup_iter_memcgHui Zhu-5/+12
Replace hardcoded enum values with bpf_core_enum_value() calls in cgroup_iter_memcg test to improve portability across different kernel versions. The change adds runtime enum value resolution for: - node_stat_item: NR_ANON_MAPPED, NR_SHMEM, NR_FILE_PAGES, NR_FILE_MAPPED - vm_event_item: PGFAULT This ensures the BPF program can adapt to enum value changes between kernel versions. Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Reviewed-by: JP Kobryn <jp.kobryn@linux.dev> Signed-off-by: Hui Zhu <zhuhui@kylinos.cn> Link: https://lore.kernel.org/r/ca6eb1a1a4fd7a17ffe995acf52c9a4ceb7bac13.1772505399.git.zhuhui@kylinos.cn Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-03-10selftests/bpf: Remove kmem subtest from cgroup_iter_memcgHui Zhu-31/+0
When cgroup.memory=nokmem is set in the kernel command line, kmem accounting is disabled. This causes the test_kmem subtest in cgroup_iter_memcg to fail because it expects non-zero kmem values. Remove the kmem subtest altogether since the remaining subtests (shmem, file, pgfault) already provide sufficient coverage for the cgroup iter memcg functionality. Reviewed-by: JP Kobryn <jp.kobryn@linux.dev> Signed-off-by: Hui Zhu <zhuhui@kylinos.cn> Link: https://lore.kernel.org/r/35fa32a019361ec26265c8a789ee31e448d4dbda.1772505399.git.zhuhui@kylinos.cn Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-03-10Merge branch ↵Alexei Starovoitov-3/+60
'bpf-support-for-non_null-ptr-detection-with-jeq-jne-with-register-operand' Cupertino Miranda says: ==================== bpf: support for non_null ptr detection with JEQ/JNE with register operand Changes from v1: - Corrected typos in commit messages. - Fixed indentation. - Replaced text by simpler version suggested by Eduard. Changes from v2: - Small fixes after AI patch checker complaints. Changes from v3: - Removed log file. No idea how that got added. ==================== Link: https://patch.msgid.link/20260304195018.181396-1-cupertino.miranda@oracle.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-03-10selftests/bpf: tests to non_null ptr detection using register operand in JEQ/JNECupertino Miranda-0/+54
This patch adds two tests to check non_null ptr detection when using JEQ and JNE have a register in second operand, and its value is known to be 0. Signed-off-by: Cupertino Miranda <cupertino.miranda@oracle.com> Cc: David Faust <david.faust@oracle.com> Cc: Jose Marchesi <jose.marchesi@oracle.com> Cc: Elena Zannoni <elena.zannoni@oracle.com> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/r/20260304195018.181396-4-cupertino.miranda@oracle.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-03-10bpf: detect non null pointer with register operand in JEQ/JNE.Cupertino Miranda-3/+6
This patch adds support to validate a pointer as not null when its value is compared to a register whose value the verifier knows to be null. Initial pattern only verifies against an immediate operand. Signed-off-by: Cupertino Miranda <cupertino.miranda@oracle.com> Cc: David Faust <david.faust@oracle.com> Cc: Jose Marchesi <jose.marchesi@oracle.com> Cc: Elena Zannoni <elena.zannoni@oracle.com> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/r/20260304195018.181396-3-cupertino.miranda@oracle.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-03-10Merge branch 'bpf-reset-register-id-for-bpf_end-value-tracking'Alexei Starovoitov-0/+29
Yazhou Tang says: ==================== bpf: Reset register ID for BPF_END value tracking This patchset fixes a register's scalar ID issue for BPF_END operations reported by Guillaume Laporte. Please see commit log of 1/2 for more details. Changes v1 => v2: 1. Reset register ID inside scalar_byte_swap() conditionally. (Eduard) v1: https://lore.kernel.org/bpf/20260303093956.395076-1-tangyazhou@zju.edu.cn/ ==================== Link: https://patch.msgid.link/20260304083228.142016-1-tangyazhou@zju.edu.cn Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-03-10accel/amdxdna: Fix runtime suspend deadlock when there is pending jobLizhi Hou-12/+12
The runtime suspend callback drains the running job workqueue before suspending the device. If a job is still executing and calls pm_runtime_resume_and_get(), it can deadlock with the runtime suspend path. Fix this by moving pm_runtime_resume_and_get() from the job execution routine to the job submission routine, ensuring the device is resumed before the job is queued and avoiding the deadlock during runtime suspend. Fixes: 063db451832b ("accel/amdxdna: Enhance runtime power management") Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com> Link: https://patch.msgid.link/20260310180058.336348-1-lizhi.hou@amd.com
2026-03-10selftests/bpf: Add test for BPF_END register ID resetYazhou Tang-0/+22
Add a test case to ensure that BPF_END operations correctly break register's scalar ID ties. The test creates a scenario where r1 is a copy of r0, r0 undergoes a byte swap, and then r0 is checked against a constant. - Without the fix in the verifier, the bounds learned from r0 are incorrectly propagated to r1, making the verifier believe r1 is bounded and wrongly allowing subsequent pointer arithmetic. - With the fix, r1 remains an unbounded scalar, and the verifier correctly rejects the arithmetic operation between the frame pointer and the unbounded register. Co-developed-by: Tianci Cao <ziye@zju.edu.cn> Signed-off-by: Tianci Cao <ziye@zju.edu.cn> Co-developed-by: Shenghao Yuan <shenghaoyuan0928@163.com> Signed-off-by: Shenghao Yuan <shenghaoyuan0928@163.com> Signed-off-by: Yazhou Tang <tangyazhou518@outlook.com> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/r/20260304083228.142016-3-tangyazhou@zju.edu.cn Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-03-10bpf: Reset register ID for BPF_END value trackingYazhou Tang-0/+7
When a register undergoes a BPF_END (byte swap) operation, its scalar value is mutated in-place. If this register previously shared a scalar ID with another register (e.g., after an `r1 = r0` assignment), this tie must be broken. Currently, the verifier misses resetting `dst_reg->id` to 0 for BPF_END. Consequently, if a conditional jump checks the swapped register, the verifier incorrectly propagates the learned bounds to the linked register, leading to false confidence in the linked register's value and potentially allowing out-of-bounds memory accesses. Fix this by explicitly resetting `dst_reg->id` to 0 in the BPF_END case to break the scalar tie, similar to how BPF_NEG handles it via `__mark_reg_known`. Fixes: 9d2119984224 ("bpf: Add bitwise tracking for BPF_END") Closes: https://lore.kernel.org/bpf/AMBPR06MB108683CFEB1CB8D9E02FC95ECF17EA@AMBPR06MB10868.eurprd06.prod.outlook.com/ Link: https://lore.kernel.org/bpf/4be25f7442a52244d0dd1abb47bc6750e57984c9.camel@gmail.com/ Reported-by: Guillaume Laporte <glapt.pro@outlook.com> Co-developed-by: Tianci Cao <ziye@zju.edu.cn> Signed-off-by: Tianci Cao <ziye@zju.edu.cn> Co-developed-by: Shenghao Yuan <shenghaoyuan0928@163.com> Signed-off-by: Shenghao Yuan <shenghaoyuan0928@163.com> Signed-off-by: Yazhou Tang <tangyazhou518@outlook.com> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/r/20260304083228.142016-2-tangyazhou@zju.edu.cn Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-03-10IB/hfi1: kzalloc to kzalloc_flexRosen Penev-9/+2
Combine kzalloc and kcalloc with a flexible array member. Avoids having to free separately. Signed-off-by: Rosen Penev <rosenp@gmail.com> Link: https://patch.msgid.link/20260309215017.4753-1-rosenp@gmail.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-03-10x86/64/defconfig: Add CONFIG_IRQ_REMAPShashank Balaji-0/+1
x2apic is enabled in the defconfig, and interrupt remapping is an architectural dependency of x2apic as per the Intel SDM: Routing of device interrupts to local APIC units operating in x2APIC mode requires use of the interrupt-remapping architecture specified in the Intel® Virtualization Technology for Directed I/O (Revision 1.3 and/or later versions). Enable CONFIG_IRQ_REMAP in defconfig so that a defconfig kernel on bare metal actually uses x2apic. Co-developed-by: Rahul Bukte <rahul.bukte@sony.com> Signed-off-by: Rahul Bukte <rahul.bukte@sony.com> Signed-off-by: Shashank Balaji <shashank.mahadasyam@sony.com> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Reviewed-by: Sohil Mehta <sohil.mehta@intel.com> Acked-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260306-x2apic-fix-v2-2-bee99c12efa3@sony.com
2026-03-10vfio: selftests: fix crash in vfio_dma_mapping_mmio_testAlex Mastro-1/+0
Remove the __iommu_unmap() call on a region that was never mapped. When __iommu_map() fails (expected for MMIO vaddrs in non-VFIO modes), the region is not added to the dma_regions list, leaving its list_head zero-initialized. If the unmap ioctl returns success, __iommu_unmap() calls list_del_init() on this zeroed node and crashes. This fixes the iommufd_compat_type1 and iommufd_compat_type1v2 test variants. Fixes: 080723f4d4c3 ("vfio: selftests: Add vfio_dma_mapping_mmio_test") Signed-off-by: Alex Mastro <amastro@fb.com> Reviewed-by: David Matlack <dmatlack@google.com> Reviewed-by: Yuan Yao <yaoyuan@linux.alibaba.com> Link: https://lore.kernel.org/r/20260303-fix-mmio-test-v1-1-78b4a9e46a4e@fb.com Signed-off-by: Alex Williamson <alex@shazbot.org>
2026-03-10irqchip/riscv-aplic: Register syscore operations only onceJessica Liu-1/+11
Since commit 95a8ddde3660 ("irqchip/riscv-aplic: Preserve APLIC states across suspend/resume"), when multiple NUMA nodes exist and AIA is not configured as "none", aplic_probe() is called multiple times. This leads to register_syscore(&aplic_syscore) being invoked repeatedly, causing the following Oops: list_add double add: new=ffffffffb91461f0, prev=ffffffffb91461f0, next=ffffffffb915c408. [<ffffffffb7b5c8ca>] __list_add_valid_or_report+0x60/0xc0 [<ffffffffb7cc3236>] register_syscore+0x3e/0x70 [<ffffffffb7b8d61c>] aplic_probe+0xc6/0x112 Fix this by registering syscore operations only once, using a static variable aplic_syscore_registered to track registration. [ tglx: Trim backtrace properly ] Fixes: 95a8ddde3660 ("irqchip/riscv-aplic: Preserve APLIC states across suspend/resume") Signed-off-by: Jessica Liu <liu.xuemei1@zte.com.cn> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260310141731145xMwLsyvXl9Gw-m6A4VRYj@zte.com.cn
2026-03-10irqchip/riscv-aplic: Do not clear ACPI dependencies on probe failureJessica Liu-4/+7
aplic_probe() calls acpi_dev_clear_dependencies() unconditionally at the end, even when the preceding setup (MSI or direct mode) has failed. This is incorrect because if the device failed to probe, it should not be considered as active and should not clear dependencies for other devices waiting on it. Fix this by returning immediately when the setup fails, skipping the ACPI dependency cleanup. Also, explicitly return 0 on success instead of relying on the value of 'rc' to make the success path clear. Fixes: 5122e380c23b ("irqchip/riscv-aplic: Add ACPI support") Signed-off-by: Jessica Liu <liu.xuemei1@zte.com.cn> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260310141600411Fu8H8-GXOOgKISU48Tjgx@zte.com.cn
2026-03-10fbdev: omapfb: Add missing error check for clk_get()Chen Ni-0/+4
The hwa742_init() function did not check the return value of clk_get(). This could lead to dereferencing an error pointer in subsequent clock operations, potentially causing a kernel crash. Fix this by adding a missing error check and ensuring proper clock resource cleanup on failure and driver removal. Signed-off-by: Chen Ni <nichen@iscas.ac.cn> Signed-off-by: Helge Deller <deller@gmx.de>
2026-03-10perf vendor events arm64: Add Tegra410 Olympus PMU eventsBesar Wicaksono-0/+2896
Add JSON files for NVIDIA Tegra410 Olympus core PMU events. Also updated the common-and-microarch.json. Signed-off-by: Besar Wicaksono <bwicaksono@nvidia.com> Reviewed-by: James Clark <james.clark@linaro.org> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-03-10genirq: Document interaction between <linux/irq.h> and DT binding definesGeert Uytterhoeven-0/+4
Document that the DT binding definitions in <dt-bindings/interrupt-controller/irq.h> shadow the first six IRQ_TYPE_* definitions in <linux/irq.h>. The values must be the same anyway, so this is harmless (as long as the latter is included first when both are included), but it is good to document this explicitly. Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/fbcc65dcee6c5437fab5ef18d21766bb4effb7cb.1772644406.git.geert+renesas@glider.be
2026-03-10irqchip: Use IS_ERR_OR_NULL() instead of NULL and IS_ERR() checksPhilipp Hahn-2/+2
Prefer using IS_ERR_OR_NULL() over using IS_ERR() and a open coded NULL pointer check. Change generated with coccinelle. To: Marc Zyngier <maz@kernel.org> To: Thomas Gleixner <tglx@kernel.org> To: Andrew Lunn <andrew@lunn.ch> To: Gregory Clement <gregory.clement@bootlin.com> To: Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com> Signed-off-by: Philipp Hahn <phahn-oss@avm.de> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260310-b4-is_err_or_null-v1-39-bd63b656022d@avm.de
2026-03-10irqchip/renesas-rzv2h: Handle ICU error IRQ and add SWPE triggerLad Prabhakar-2/+161
Handle the RZ/V2H ICU error interrupt to help diagnose latched bus, ECC RAM, and CA55/IP error conditions. Support error injection via ICU_SWPE to allow testing the pseudo error error interrupts. Account for SoC differences in ECC RAM error register coverage so the handler only iterates over valid ECC status/clear banks, and route the RZ/V2N compatible to a probe path with the correct ECC range while keeping the existing RZ/V2H and RZ/G3E handling. [ tglx: Convert to hwirq_within() and upgrade to pr_warn() for those errors ] Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260304113317.129339-8-prabhakar.mahadev-lad.rj@bp.renesas.com
2026-03-10irqchip/renesas-rzv2h: Add CA55 software interrupt supportLad Prabhakar-1/+94
The RZ/V2H ICU exposes four software-triggerable interrupts targeting the CA55 cores (int-ca55-0 to int-ca55-3). Add support for these interrupts to enable IRQ injection via the generic IRQ injection framework. Add a dedicated rzv2h_icu_swint_chip irq_chip for the CA55 region and implement rzv2h_icu_irq_set_irqchip_state() to handle software interrupt injection. [ tglx: Convert to hwirq_within() ] Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260304113317.129339-7-prabhakar.mahadev-lad.rj@bp.renesas.com