summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-08-06drm/amdgpu: fix JPEG v4.0.5 queue reset failure in DPG modeJesse Zhang
Like jpeg_v5_0_0, in DPG mode the ring reset path only clears the JPEG_PG_MODE bit and never resets a hung JRBC, so the post-reset ring test times out and the driver falls back to a full MODE1 reset. Temporarily force the static power-gating path during the reset so the stop/start sequence power-cycles the JPEG block (JMI soft reset + power off/on), matching the jpeg_v4_0 reset. Acked-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-06drm/amdgpu: fix JPEG v5.0.0 queue reset failure in DPG modeJesse Zhang
In DPG mode jpeg_v5_0_0_ring_reset() takes the DPG stop path, which only clears the JPEG_PG_MODE bit and never resets the JRBC. A hung ring is not recovered: the post-reset ring test times out and the driver falls back to a full MODE1 reset. Temporarily force the static power-gating path during the reset so the stop/start sequence power-cycles the JPEG block (JMI soft reset + power off/on), matching the jpeg_v4_0 reset which has no DPG path. Acked-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-06perf/arm-cmn: Support CMN S3 r2Robin Murphy
If you were disappointed at how minimal the initial CMN S3 support looked compared to previous versions, then oh boy is it time to put your party hats on... The biggest batch of incompatible changes yet comes not with a new CMN product, but a point release of an existing one. We've got new filters, loads of changes to existing events, register fields moved around for no good reason, and much, much more! On the upside, we do at least gain a means of working around the isolation feature. As such, for the sake of sanity in the driver it is easiest to split it into a distict "model" for our internal abstractions despite it bearing the same part number as r0/r1. Signed-off-by: Robin Murphy <robin.murphy@arm.com> Reviewed-by: Ilkka Koskinen <ilkka@os.amperecomputing.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06perf/arm-cmn: Plumb in new filter typesRobin Murphy
Add the logic to handle events with the upcoming new filter controls. Since for now we will have the sole invariant of all EVICT_STATE_SEL events having HBT_LBT_SEL as a secondary filter, for the sake of simplicity we can just special-case that, and save the complication of a full multi-filter abstraction until unavoidably necessary. Reviewed-by: Leo Yan <leo.yan@arm.com> Signed-off-by: Robin Murphy <robin.murphy@arm.com> Reviewed-by: Ilkka Koskinen <ilkka@os.amperecomputing.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06perf/arm-cmn: Refactor event filter dataRobin Murphy
The ABI hole I have dug myself into requires the driver to know which event encodings are associated with which particular filter control. Since we will soon have a notion of multiple filters per event, refactor the event data to encapsulate filters in an explicit structure, which can then more easily scale as an array in future. Signed-off-by: Robin Murphy <robin.murphy@arm.com> Reviewed-by: Ilkka Koskinen <ilkka@os.amperecomputing.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06perf/arm-cmn: Refactor event filter programmingRobin Murphy
We're soon going to need to cope with events having multiple filters, plus the filter fields themselves moving around, wherein any more inline if/else logic will struggle to scale. Add a more general abstraction for the node-specific filter controls, and rejig the pmu_event_sel filter programming around it in a more extensible manner. Reviewed-by: Ilkka Koskinen <ilkka@os.amperecomputing.com> Signed-off-by: Robin Murphy <robin.murphy@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06perf/arm-cmn: Rename filter variables for clarityRobin Murphy
CMN has already grown many more event-specific filters than the original Occupancy ID, but since they are all independent of each other we've just overloaded them onto the same name. Before we add yet more, and they begin to overlap, rename all our "occupid" variables to "filter" so that things can be a bit clearer and more consistent (but leaving the format attribute itself, to avoid UAPI concerns). Reviewed-by: Ilkka Koskinen <ilkka@os.amperecomputing.com> Signed-off-by: Robin Murphy <robin.murphy@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06arm64: mm: fix accidental linear mapping of no-map reserved memoryliulhong617
When reserved-memory regions with the "no-map" property are not page-aligned, the kernel may accidentally map them into the linear mapping, contradicting the no-map semantics. The root cause is a mismatch between /proc/iomem's address boundaries and the actual page table mapping boundaries: 1. /proc/iomem derives its ranges from memblock via memblock_region_reserved_base_pfn/memblock_region_reserved_end_pfn, which perform PFN rounding so the displayed boundaries are page-aligned. This gives the impression that the no-map region occupies whole pages. 2. However, memblock_mark_nomap() splits memblock.memory regions at exact byte boundaries (memblock_isolate_range preserves raw DT base/size with no alignment). When for_each_mem_range iterates the non-NOMAP regions adjacent to a no-map region, it returns start/end values that are NOT page-aligned — they are the precise byte boundaries from the memblock split. 3. These sub-page-aligned values are passed to __create_pgd_mapping_locked(), which does: phys &= PAGE_MASK; addr = virt & PAGE_MASK; end = PAGE_ALIGN(virt + size); The downward rounding of phys via PAGE_MASK extends the mapped range backward into the adjacent no-map region, effectively including no-map memory in the linear mapping. For example, with 64K pages, reserved_region@A2000000 (base=0xA2000000, size=0x8000, no-map) causes for_each_mem_range to return start=0xA2008000 for the next mappable region. After phys &= PAGE_MASK, the actual mapping starts at 0xA2000000 — the entire no-map region is incorrectly mapped. Fix this by rounding the mappable range inward to PAGE_SIZE boundaries before passing it to __map_memblock: start is rounded UP and end is rounded DOWN. This ensures the mapped area never overlaps with adjacent no-map regions. The cost is at most one page of unmapped gap at each boundary, which is preferable to violating no-map semantics. Signed-off-by: liulhong617 <liulhong617@gmail.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06dt-bindings: mfd: qcom,spmi-pmic: Document haptics deviceFenglin Wu
Some of the Qualcomm SPMI PMIC has haptics device in it, add it in the device list. Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Fenglin Wu <fenglin.wu@oss.qualcomm.com> Link: https://patch.msgid.link/20260804-qcom-spmi-haptics-v5-2-77128ebbdd2d@oss.qualcomm.com Signed-off-by: Lee Jones <lee@kernel.org>
2026-08-06net: octeontx2-pf: Fix UB in shift operationSergey V. Frolov
In function otx2_get_egress_burst_cfg, when the parameter `burst` is 255 and the max mantissa is 255 (0xFFULL), `burst_exp` is set to `ilog2(255) - 1`, which equals 6. This results in an unsigned wrap-around when calculating `(1ULL << (*burst_exp - 7))`, since `*burst_exp - 7` becomes -1, which makes the shift operand 0xFFFFFFFF. This value is greater than the width of the left operand. According to standard 6.5.7 p.3: "The type of the result is that of the promoted left operand. If the value of the right operand is negative or is greater than or equal to the width of the promoted left operand, the behavior is undefined." Fix the off-by-one boundary condition. Add a WARN_ON(*burst_exp < 7) before the else branch as an explicit safeguard. This ensures that if max_mantissa ever changes in a way that reintroduces this condition, it will be immediately caught at runtime rather than silently triggering UB. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: e638a83f167e ("octeontx2-pf: TC_MATCHALL egress ratelimiting offload") Signed-off-by: Sergey V. Frolov <Sergey.V.Frolov@kaspersky.com> Cc: stable@vger.kernel.org Reviewed-by: Ratheesh Kannoth <rkannoth@marvell.com> Reviewed-by: Sunil Goutham <sgoutham@marvell.com> Link: https://patch.msgid.link/20260804120446.1955448-1-Sergey.V.Frolov@kaspersky.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-06mfd: iqs62x: Reject zero-length firmware recordsPengpeng Hou
struct iqs62x_fw_rec includes the first data byte in its fixed-size header, so the parser advances by len - 1 bytes after that header. A zero len makes the size_t cursor update move back by one byte, so the next record overlaps the current record instead of following a valid declared extent. Reject zero-length records and express the remaining-size check without an offset addition. Fixes: 4d9cf7df8d35 ("mfd: Add support for Azoteq IQS620A/621/622/624/625") Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Link: https://lore.kernel.org/all/20260706091034.75865-1-pengpeng@iscas.ac.cn/ Link: https://patch.msgid.link/20260720115423.94994-1-pengpeng@iscas.ac.cn Signed-off-by: Lee Jones <lee@kernel.org>
2026-08-06tools: Ensure tools copy of linux/filter.h exports the UAPIMark Brown
Normally when there is an include/foo.h and an include/uapi/foo.h the non-UAPI copy includes the UAPI copy. This is the case for the in kernel copy of linux/filter.h but not for the copy in tools/ which results in build breaks for the newly added arm64 seccomp_ptrace_x0_bypass selftest. Add an explicit include of the uapi to fix the test and avoid future surprises. Fixes: 2fcbc4adf997 ("kselftest/arm64: Add seccomp ptrace x0 bypass test") Fixes: f143c11bb7b9 ("tools: bpf: Use local copy of headers including uapi/linux/filter.h") Signed-off-by: Mark Brown <broonie@kernel.org> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06kselftest/arm64: Fix abi test compilation errorsJinjie Ruan
The arm64 ABI selftests fail to compile due to missing include paths for kernel headers, causing errors like incomplete type struct sock_filter and implicit BPF macro declarations. Add $(KHDR_INCLUDES) and -I$(top_srcdir)/tools/include to CFLAGS to resolve the header search path. Also remove the hardcoded __NR_write macro and include <asm/unistd.h> to obtain the correct syscall number. Fixes: 21e37da12071 ("kselftest/arm64: Add testcase for SECCOMP_RET_TRACE orig_x0 bypass") Fixes: 2fcbc4adf997 ("kselftest/arm64: Add seccomp ptrace x0 bypass test") Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/r/202608021842.jp6IBrFi-lkp@intel.com/ Suggested-by: Mark Brown <broonie@kernel.org> Reviewed-by: Mark Brown <broonie@kernel.org> Tested-by: Mark Brown <broonie@kernel.org> Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06arch: arm64: add early_param idle=<wfi|yield|nop>Yureka Lilian
Overriding the idle mechanism might be useful for debugging and performance testing. Add a cmdline parameter for it, similar to the existing idle= parameter already present for the x86 and ppc architectures. It is also useful on platforms where the WFI instruction misbehaves, such as Apple Silicon SoCs. Generally, a misbehaving instruction should be treated as an erratum and patched using the alternatives framework. However, in the Apple Silicon case we need more flexibility because it is difficult to detect whether the erratum applies. For example, Linux VMs inside macOS have the same MIDR and may even seem like they're running in EL2 in the case of NV, but should continue using WFI (it's trapped and handled correctly by the hypervisor there). Thus, we prefer to let the m1n1 bootloader add the idle=nop parameter[1]. Link[1]: https://lore.kernel.org/all/99b69262-e54b-424e-baa2-96ef7013b87a@kernel.org/ Suggested-by: Will Deacon <will@kernel.org> Signed-off-by: Yureka Lilian <yureka@cyberchaos.dev> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06Merge branch 'openvswitch-remove-support-for-legacy-tunnel-ports'Paolo Abeni
Ilya Maximets says: ==================== openvswitch: remove support for legacy tunnel ports ovs-vswitchd doesn't use OVS_VPORT_TYPE_GRE/VXLAN/GENEVE with the Linux kernel module since adding support for standard tunnel devices with COLLECT_METADATA back in 2017. The code to use them was only activated as a fallback for old kernels, so not used in practice. And it is now fully removed in the upcoming OVS 4.0 release. Modern way to use tunnels with OVS is to create standard tunnel ports with RTM_NEWLINK + COLLECT_METADATA and add them as OVS_VPORT_TYPE_NETDEV. Device reference management and the netlink options parsing for these legacy port types is complicated and was a CVE magnet in the previous release cycles. Existence of these modules also makes locking analysis for geneve module and other core tunnel devices unnecessarily more complicated, especially in light of migration to per-netns locking: https://lore.kernel.org/r/CAAVpQUDmZEaQNDSySLayqexgTrUbhBaL7XPCt9XNQzh+NGQ=UQ@mail.gmail.com Since there are no actual users for these port types for a very long time, let's just remove the support entirely. There is no practical reason to run OVS from 2017 on a recent kernel. While it's technically a uAPI change in some sense, from the user's perspective this removal looks indistinguishable from the kernel built with CONFIG_OPENVSWITCH_GENEVE/VXLAN/GRE disabled. And it seems like removal of unused drivers/modules is not a rare event these days. There are 3 parts to this set: 1. The first patch does the tunnel port removal, which is the primary goal here. 2. Patches 2 and 3 remove extra infrastructure that is no longer in use by anything inside the openvswitch module. 3. Patches 4-6 remove functions from gre/vxlan/geneve modules that were added for openvswitch in the past to support the tunnel types. openvswitch is the only in-tree consumer of these functions. Version 1: - Rebased. - Removed the tunnel modules from the new OVS selftest config. - Addressed RFC review from Sashiko: * Made ovs_netdev_link() static. * Restored -EOPNOTSUPP if OVS_VPORT_ATTR_OPTIONS was provided. * Removed retry in ovs_vport_cmd_new() as not needed anymore. RFC: - https://lore.kernel.org/r/20260513183559.2141010-1-i.maximets@ovn.org ==================== Link: https://patch.msgid.link/20260804182049.2289754-1-i.maximets@ovn.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-06net: vxlan: remove unused vxlan_dev_createIlya Maximets
The vport-vxlan in openvswitch was the last user and it is now gone. And we can now rename the internal function to have a better name. Signed-off-by: Ilya Maximets <i.maximets@ovn.org> Link: https://patch.msgid.link/20260804182049.2289754-7-i.maximets@ovn.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-06net: gre: remove unused gretap_fb_dev_createIlya Maximets
The only user was vport-gre in openvswitch and now it is gone. Signed-off-by: Ilya Maximets <i.maximets@ovn.org> Link: https://patch.msgid.link/20260804182049.2289754-6-i.maximets@ovn.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-06net: geneve: remove unused geneve_dev_create_fbIlya Maximets
The only user was vport-geneve in openvswitch and now it is gone. This also removes the last exported function in geneve module, significantly reducing complexity of the locking analysis. Signed-off-by: Ilya Maximets <i.maximets@ovn.org> Link: https://patch.msgid.link/20260804182049.2289754-5-i.maximets@ovn.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-06openvswitch: vport: remove infrastructure for separate modulesIlya Maximets
Since removal of legacy tunnel vport types only the built-in ones remain. So, there is no need for the extra infrastructure for dynamic module loading. Can be reinstated in the future if we need a new vport type. Note: It is technically possible that someone has an out-of-tree module named vport-type-N that implements a different vport type. At this time we're not aware of anyone doing that. People running out-of-tree modules normally just have an out-of-tree openvswitch module as a whole. And there are actually no supported out-of-tree implementations of the openvswitch module known to the community. Signed-off-by: Ilya Maximets <i.maximets@ovn.org> Link: https://patch.msgid.link/20260804182049.2289754-4-i.maximets@ovn.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-06openvswitch: vport: remove infrastructure for vport optionsIlya Maximets
Since removal of tunnel vport types, there aren't any vports that support options. Let's remove the options-related infrastructure. Can be reinstated if we ever need a new vport type or if we need extra options for the existing ones. The uAPI attribute remains. Clarification comment is added to highlight that none of the supported vports support options at the moment. If the options are provided, the code now directly replies with -EOPNOTSUPP to keep the behavior the same for remaining vport types. Note: It is technically possible that someone has an out-of-tree module named vport-type-N that implements a different vport type and they have options for this vport type. However, our message size calculations do not account for whatever options such a port would have and so it is dangerous to load such a module without modifying the code in the main datapath.c, unless the options are smaller than the ones we had for vxlan. A more robust solution would be to have a different version of the entire openvswitch module instead, so the use case of a separate vport-type-N loaded with the upstream openvswitch module is unlikely. At this time we're not aware of anyone doing that. Signed-off-by: Ilya Maximets <i.maximets@ovn.org> Link: https://patch.msgid.link/20260804182049.2289754-3-i.maximets@ovn.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-06openvswitch: remove support for legacy tunnel typesIlya Maximets
ovs-vswitchd doesn't use OVS_VPORT_TYPE_GRE/VXLAN/GENEVE with the Linux kernel module since adding support for standard tunnel devices with COLLECT_METADATA back in 2017. The code to use them was only activated as a fallback for old kernels, so not used in practice. And it is now fully removed in the upcoming OVS 4.0 release. Modern way to use tunnels with OVS is to create standard tunnel ports with RTM_NEWLINK + COLLECT_METADATA and add them as OVS_VPORT_TYPE_NETDEV. Device reference management and the netlink options parsing for these legacy port types is complicated and was a CVE magnet in the previous release cycles. Existence of these modules also makes locking analysis for geneve module and other core tunnel devices unnecessarily more complicated, especially in light of migration to per-netns locking. Since there are no actual users for these port types for a very long time, let's just remove the support entirely. There is no practical reason to run OVS from 2017 on a recent kernel. While it's technically a uAPI change in some sense, from the user's perspective this removal looks indistinguishable from the kernel built with CONFIG_OPENVSWITCH_GENEVE/VXLAN/GRE disabled. And it seems like removal of unused drivers/modules is not a rare event these days. A comment is added to the uAPI header noting that standard RTM_NEWLINK with COLLECT_METADATA followed by OVS_VPORT_CMD_NEW with the simple OVS_VPORT_TYPE_NETDEV should be used instead. Modules responsible for these tunnel ports are removed as well as selftests covering this functionality. Further cleanups will follow. Signed-off-by: Ilya Maximets <i.maximets@ovn.org> Link: https://patch.msgid.link/20260804182049.2289754-2-i.maximets@ovn.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-06mfd: rave-sp: validate received frame payload lengthsPengpeng Hou
A received RAVE-SP frame contains protocol data followed by a variant-specific one- or two-byte checksum. rave_sp_receive_frame() derives a checksum pointer before proving that the frame contains the checksum, then passes the checksum-inclusive length to handlers that index the command, acknowledgment ID and event-data bytes or derive a reply payload length. Name those protocol field offsets, prove the checksum extent before deriving the protocol-data length, pass only that data length to the handlers, and require the complete event or reply prefix before consuming it. Fixes: 538ee27290fa ("mfd: Add driver for RAVE Supervisory Processor") Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Link: https://lore.kernel.org/all/20260706092337.78754-1-pengpeng@iscas.ac.cn/ Link: https://patch.msgid.link/20260720115523.99956-1-pengpeng@iscas.ac.cn Signed-off-by: Lee Jones <lee@kernel.org>
2026-08-06arm64: entry: mask DAIF before returning from C EL1 handlersAda Couprie Diaz
Most EL1 exceptions already call local_daif_mask() before returning, with the exception of debug exception handlers which do not change DAIF, and the IRQ/FIQ/Error handlers. However, DAIF get masked in kernel_exit() in all cases when returning from EL1 C handlers anyway. Move this masking from assembly to C by calling local_daif_mask() before irqentry_nmi_exit(). Unlike the raw DAIF masking helper, local_daif_mask() invokes trace_hardirqs_off(), so it must execute while RCU is still watching. Remove the disable_daif assembly macro, as this was its only use. Signed-off-by: Ada Couprie Diaz <ada.coupriediaz@arm.com> Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com> Reviewed-by: Jinjie Ruan <ruanjinjie@huawei.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06arm64: suspend: Initialize PMR on resumeVladimir Murzin
When we resume from cpu_suspend() context tracking, specially, ct_idle_exit() performs IRQ save/restore sequence. It doesn't cause any functional issues since we have masked all exceptions prior suspend and have not restored them. However, in case of pseudo-NMI PMR can be set by firmware to arbitrary value, thus IRQ save/restore routines manipulates this arbitrary value. Again, it doesn't cause any issues since PMR variant of IRQ save helper carries a __pmr_irqs_disabled_flags() guard. Going forward __pmr_irqs_disabled_flags() guard will be gone and we will call __pmr_local_irq_disable() unconditionally - that would cause warning in case CONFIG_ARM64_DEBUG_PRIORITY_MASKING is set. Initialize PMR to a value known to Linux on resume until the normal exception restore path restores the saved DAIF and PMR state. Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06arm64: suspend: rely on daif helpers to handle PMRAda Couprie Diaz
Commit 77345ef70445 ("arm64: suspend: Use cpuidle context helpers in cpu_suspend()") added cpuidle helpers to handle PMR manipulation and restoration to ensure that the CPU receives interrupts when suspended and pseudo-NMIs are enabled. However, those helpers are called in between a pair of `local_daif_save()` and `local_daif_restore()`, which already configure the PMR as expected. Effectively, `arm_cpuidle_save_irq_context()` is a no-op here, even when using pseudo-NMIs, and `arm_cpuidle_restore_irq_context()` would not restore proper interrupt masking configuration early enough if there were unexpected changes during suspend or resume. (This can be observed with Trusted Firmware A (TF-A) at EL3 handling suspend through PSCI. Even though it should not be the case, TF-A can reset `ICC_PMR_EL1` during CPU_SUSPEND, thus resuming the kernel with an inconsistent priority mask value on hardware implementing more than the minimum number of priority levels, such as Morello.) Thus : remove the cpuidle context helpers as they do not do anything, but keep the comment mentioning the need for interrupts to reach the CPU if we are using pseudo-NMIs. Signed-off-by: Ada Couprie Diaz <ada.coupriediaz@arm.com> Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com> Reviewed-by: Jinjie Ruan <ruanjinjie@huawei.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06arm64: hibernate: Restore DAIF state on errorVladimir Murzin
Sashiko AI has reported that if swsusp_mte_save_tags() for some reason fails we return from swsusp_arch_suspend() with DAIF being masked - that is not what we'd expect. Restore the saved DAIF state before returning from the error path. Fixes: ee11f332af96 ("arm64: mte: Save tags when hibernating") Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com> Reviewed-by: Jinjie Ruan <ruanjinjie@huawei.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06arm64: hibernate: mask DAIF before restoring hibernated kernelAda Couprie Diaz
The arm64 hibernate code manages the exception masking in an unsound way, leading to potential crashes and/or warnings during resume. When a hibernation image is saved in `swsusp_arch_suspend()`, all DAIF exceptions are masked (by virtue of `local_daif_save()`), and the suspended image is saved assuming that all DAIF exceptions will remain masked when the image is restored. When a hibernation image is resumed by `swsusp_arch_resume()`, only interrupts are masked (by virtue of `local_irq_disable()` in `resume_target_kernel()`). When pseudo-NMI is enabled the DAIF.IF bits will be clear, and regardless of pseudo-NMI the DAIF.DA bits will be clear. This means that there are two problems: (1) It is possible to take Debug, SError, or pseudo-NMI exceptions during the resume process. This is unsafe, as during the resume process both the old ane new kernels will tranisently be in an inconsistent state, and swsusp_arch_suspend_exit() won't retain an executable mapping of any exception vectors. Any exception taken here will be fatal and silent. (2) When re-entering the resumed kernel, some DAIF bits will be clear unexpectedly. This permits Debug, SError, or pseudo-NMI exceptions to be taken for a short period while the resumed kernel is not yet in a consistent state. This is detected by CONFIG_ARM64_DEBUG_PRIORITY_MASKING. Avoid these issues by masking all DAIF exceptions during resume. Fixes: 82869ac57b5d ("arm64: kernel: Add support for hibernate/suspend-to-disk") Signed-off-by: Ada Couprie Diaz <ada.coupriediaz@arm.com> Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com> Reviewed-by: Jinjie Ruan <ruanjinjie@huawei.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06arm64: debug: don't mask DAIF for mdscr_write()Ada Couprie Diaz
Masking DAIF around the write to MDSCR_EL1 doesn't do anything: we can write to sysregs with interrupts unmasked, and writing to PSTATE is not a context synchronization event so it does not synchronize it. This is done in the context of a general interrupt handling cleanup, so it does not address the missing context synchronization for the MDSCR_EL1 write, staying consistent with the current state. This should be addressed in a future patch. Signed-off-by: Ada Couprie Diaz <ada.coupriediaz@arm.com> Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06arm64: ptrace: Remove INIT_PSTATE_EL2Vladimir Murzin
Last user of INIT_PSTATE_EL2 has gone with ae4b7e38e9a9 ("arm64: Allow sticky E2H when entering EL1"), so remove it. Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com> Reviewed-by: Jinjie Ruan <ruanjinjie@huawei.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06exfat: fix overflow in cluster-to-dentry conversionYang Wen
The cluster-to-dentry calculation is performed as u32 and may overflow and wrap around on large volumes. This can result in an incorrect max_dentries value, causing readdir to stop early and omit directory entries. Cast nr_clusters to u64 before shifting to avoid the overflow. Signed-off-by: Yang Wen <anmuxixixi@gmail.com> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
2026-08-06mfd: sm501: Fix potential memory leaks during removeAbdun Nihaal
The memory allocated for struct sm501_devdata in sm501_pci_probe() and sm501_plat_probe() is not freed by the corresponding remove functions sm501_pci_remove() and sm501_plat_remove(). Fix that by adding a call to kfree(). Fixes: b6d6454fdb66 ("[PATCH] mfd: SM501 core driver") Cc: stable@vger.kernel.org Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in> Link: https://patch.msgid.link/20260720113836.73133-1-nihaal@cse.iitm.ac.in Signed-off-by: Lee Jones <lee@kernel.org>
2026-08-06spi: dt-bindings: snps,dw-apb-ssi: Document Axiado AX3005Swark Yang
The Axiado AX3005 SPI controller is software-compatible with the Synopsys DesignWare APB SSI 1.01a programming interface. Document the "axiado,ax3005-spi" SoC-specific compatible with "snps,dwc-ssi-1.01a" as its fallback. This preserves identification of the AX3005 integration while allowing the controller to use the existing DesignWare APB SSI support. Signed-off-by: Swark Yang <syang@axiado.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://patch.msgid.link/20260805-upstrea-ax3005-spi-v4-v4-1-5b8bc11cb841@axiado.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-06drm/ssd130x: Add per-family update backlight logicAmit Barzilai
ssd130x_update_bl() runs for every SSD13xx panel, but it only works for SSD130x and SSD132x: it writes the single global SSD13XX_CONTRAST (0x81) command, which those two families expose. SSD133x has no such command -- it has three per-channel contrast registers (CONTRAST_A/B/C) that must be scaled together -- so ssd130x_update_bl() has no effect on it. Make backlight_ops.update_status a per-family choice. SSD130x and SSD132x keep ssd130x_update_bl() because they share the SSD13XX_CONTRAST interface, while SSD133x gets ssd133x_update_bl(), which drives the three channels through ssd133x_set_contrast(). Signed-off-by: Amit Barzilai <amit.barzilai22@gmail.com> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Link: https://patch.msgid.link/20260729053054.29374-3-amit.barzilai22@gmail.com Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2026-08-06drm/ssd130x: Scale ssd133x per-channel contrast by brightness on initAmit Barzilai
ssd133x_init() wrote the SSD133X_CONTRAST_A/B/C commands with magic hex values (0x91/0x50/0x7d). These are a per-channel white-balance calibration: the A/B/C channels drive sub-pixels whose OLED materials differ in luminous efficiency, so the values set the white point at full brightness. Extract them into ssd133x_set_contrast(), which scales each channel by a requested brightness via ssd130x_scale_contrast(), instead of writing the calibration unconditionally. This makes the sequence readable, avoids repetition, and is a prerequisite for wiring up an ssd133x backlight controller that dims while preserving the white point. Note this changes the ssd133x power-on brightness. Previously the init wrote the calibration unscaled and ignored ssd130x->contrast, so the panel always booted at full brightness. It now scales by the shared default contrast of 127, i.e. half of MAX_CONTRAST (255). This is intentional and matches ssd130x, whose contrast register also defaults to 127 (mid-scale), so all families now power on at ~50% and report props.brightness = 127 / max_brightness = 255 to userspace. Assisted-by: Claude:claude-fable-5 Signed-off-by: Amit Barzilai <amit.barzilai22@gmail.com> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Link: https://patch.msgid.link/20260729053054.29374-2-amit.barzilai22@gmail.com Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2026-08-06net: phy: mediatek: fix TX blink masks using the RX bitsAhmed Naseef
MTK_GPHY_LED_TX_BLINK_SET and MTK_2P5GPHY_LED_TX_BLINK_SET are built from the RX blink bits instead of the TX ones, so both TX masks are identical to their RX counterparts. The TX bits they should be using, MTK_PHY_LED_BLINK_{10,100,1000,2500}TX, are otherwise only referenced by the per-speed branch of mtk_phy_led_hw_ctrl_set(). A TX trigger selected without a link trigger therefore programs the RX blink bits, and the LED blinks on received traffic. The masks are also used to decode the blink register in mtk_phy_led_hw_ctrl_get(), which as a result cannot tell the two triggers apart: an RX-only configuration reads back as RX and TX, and a TX-only configuration reads back as neither. Fixes: 7f9c320c98db ("net: phy: mediatek: Move LED helper functions into mtk phy lib") Cc: stable@vger.kernel.org Signed-off-by: Ahmed Naseef <naseefkm@gmail.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260804113511.3371248-1-naseefkm@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-06block: rename bi_bvec_donePavel Begunkov
struct bvec_iter::bi_bvec_done is used an offset in the current bvec, let's rename it accordingly for better clarity. I also plan to use it for non-bvec based iteration in the future like dma-buf, so drop the "bvec" part. Suggested-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Link: https://patch.msgid.link/4e4c21858705a200bd8848ffe4080522e3eb5c1c.1786018753.git.asml.silence@gmail.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-08-06ASoC: Rework the SDCA HID codeMark Brown
Charles Keepax <ckeepax@opensource.cirrus.com> says: This series reworks the SDCA HID code, the primary goals being to no longer store runtime HID data in the DisCo data structures and remove the need to pass the soundwire device into the ACPI parsing code. To achieve this the HID device registration is moved to the IRQ work flow rather than the ACPI work flow. Also a few small issues are fixed up along the way, some formatting, some missing cleanup/docs. Link: https://patch.msgid.link/20260805124205.4152543-1-ckeepax@opensource.cirrus.com
2026-08-06ASoC: SDCA: Pass swft table through sdca_dev_register()Charles Keepax
Rather than passing the SoundWire slave into find_sdca_filesets(), stash the swift table whilst processing sdca_dev_register(). This allows us to completely remove the passing of the sdw_slave into the ACPI parsing code. Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev> Link: https://patch.msgid.link/20260805124205.4152543-9-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-06ASoC: SDCA: Add missing HID kernel docCharles Keepax
Add missing kernel doc for the function sdca_add_hid_device() Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev> Link: https://patch.msgid.link/20260805124205.4152543-8-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-06ASoC: SDCA: Add missing destroy for HID deviceCharles Keepax
The SDCA code is currently missing a cleanup for HID devices when the drivers are unbound. Add the missing HID cleanup as part of the IRQ cleanup to mirror when the HID device is created. Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev> Link: https://patch.msgid.link/20260805124205.4152543-7-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-06ASoC: SDCA: Update HID DisCo parsingCharles Keepax
Add more error checking on the parsing of the HID DisCo and bring the code more inline with the rest of the DisCo parsing. Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev> Link: https://patch.msgid.link/20260805124205.4152543-6-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-06ASoC: SDCA: Move HID descriptors to functionCharles Keepax
The HID descriptors are defined at the function level in DisCo and as such it makes more sense to parse and store them at that level in the SDCA code. This shouldn't really make much practical difference but is conceptually better and avoids passing the function node down to the entity parsing code. Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev> Link: https://patch.msgid.link/20260805124205.4152543-5-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-06ASoC: SDCA: Move HID registration to IRQ timeCharles Keepax
Currently, the SDCA code registers the HID device whilst parsing the DisCo information. This necessitates storing the HID device in the DisCo structs, which are intended to only store the parsed DisCo. Having the HID device registered so early in the process also causes some issues with cleaning up. Update the code to register the HID device as the IRQs are handled, this alleviates the previous concerns and brings the support inline with the other SDCA event handling. As part of this move the naming for the SDCA HID is also updated, it saves some complexity around the passing of the SoundWire device to include this in this patch. Update to using the dev_name for the phys, which is more consistent with other HID users, and use the actual function name/address for the HID name itself. Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev> Link: https://patch.msgid.link/20260805124205.4152543-4-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-06ASoC: SDCA: Remove unused dev pointer argumentCharles Keepax
Remove the now unused device pointer from sdca_asoc_pde_poll_actual_ps(). Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev> Link: https://patch.msgid.link/20260805124205.4152543-3-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-06ASoC: SDCA: Tidy up error messageCharles Keepax
Bring the entity_pde_event() error message slightly more in line with the other SDCA error messages. Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev> Link: https://patch.msgid.link/20260805124205.4152543-2-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-06drm/tests/gpu_buddy: fix interleaving in buffer clearance testArunpravin Paneer Selvam
The resume clearance test skipped every other allocation, expecting an interleaved clear/dirty layout. But the buddy allocator hands out blocks contiguously, so this just allocated half the pages in one chunk and never exercised gpu_buddy_reset_clear()'s force-merge of opposite-state buddies. Allocate all pages into two lists instead and free one cleared, one dirty, to build a truly interleaved pattern. v2: Use for loops instead of do-while for the allocation loops (Jani Nikula) Fixes: e3335ccbf4da ("drm/tests/gpu_buddy: add a new test case for buffer clearance during resume") Reported-by: Sashiko-bot <sashiko-bot@kernel.org> Closes: https://sashiko.dev/#/patchset/20260721114236.507578-1-Arunpravin.PaneerSelvam@amd.com?part=1 Cc: Matthew Auld <matthew.auld@intel.com> Cc: Christian König <christian.koenig@amd.com> Assisted-by: GitHub_Copilot:claude-opus-4.8 Signed-off-by: Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam@amd.com> Reviewed-by: Matthew Auld <matthew.auld@intel.com> Link: https://patch.msgid.link/20260803065656.2960810-1-Arunpravin.PaneerSelvam@amd.com
2026-08-06ASoC: dt-bindings: cirrus,cs42l43: Add CS42L44 variantCharles Keepax
The cs42l44 is a cost optimised variant of cs42l43b. Acked-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Link: https://patch.msgid.link/20260805131942.45729-1-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-06arm64: cpufeature: Detect BBML3 based on ID_AA64MMFR2_EL1.BBMLinu Cherian
Add ID_AA64MMFR2_EL1.BBM based BBML3 feature detection in cpu_supports_bbml3() so that cpus with the feature would not have to be added into MIDR based supports_bbml3_list. Reviewed-by: Gavin Shan <gshan@redhat.com> Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com> Signed-off-by: Linu Cherian <linu.cherian@arm.com> [will: Tidy up cpu_supports_bbml3()] Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06arm64: cpufeature: Rename BBML2_NOABORT as BBML3Linu Cherian
- As bbml2_noabort is functionally equivalent to bbml3, rename cpu/system_supports_bbml2_noabort to cpu/system_supports_bbml3. The ARM64 capability name is also renamed accordingly. - As BBML2_NOABORT or the equivalent BBML3 is the kernel requirement for setting up linear map with block/contpte mappings and not BBML2, replace all bbml2 references with bbml3. FEAT_BBML3, is introduced as part of 2025 Architecture Extensions. https://developer.arm.com/documentation/109697/2026_03/2025-Architecture-Extensions No functional changes are introduced with this patch. Reviewed-by: Gavin Shan <gshan@redhat.com> Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com> Signed-off-by: Linu Cherian <linu.cherian@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06arm64: sysreg: Add BBM_3Linu Cherian
Add BBM_3 definition for ID_AA64MMFR2_EL1 register. Reviewed-by: Gavin Shan <gshan@redhat.com> Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com> Signed-off-by: Linu Cherian <linu.cherian@arm.com> Signed-off-by: Will Deacon <will@kernel.org>