summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2026-04-09Merge branch 'net-lan966x-fix-page_pool-error-handling-and-error-paths'Paolo Abeni1-4/+24
David Carlier says: ==================== net: lan966x: fix page_pool error handling and error paths This series fixes error handling around the lan966x page pool: 1/3 adds the missing IS_ERR check after page_pool_create(), preventing a kernel oops when the error pointer flows into xdp_rxq_info_reg_mem_model(). 2/3 plugs page pool leaks in the lan966x_fdma_rx_alloc() and lan966x_fdma_init() error paths, now reachable after 1/3. 3/3 fixes a use-after-free and page pool leak in the lan966x_fdma_reload() restore path, where the hardware could resume DMA into pages already returned to the page pool. ==================== Link: https://patch.msgid.link/20260405055241.35767-1-devnexen@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-04-09net: lan966x: fix use-after-free and leak in lan966x_fdma_reload()David Carlier1-3/+18
When lan966x_fdma_reload() fails to allocate new RX buffers, the restore path restarts DMA using old descriptors whose pages were already freed via lan966x_fdma_rx_free_pages(). Since page_pool_put_full_page() can release pages back to the buddy allocator, the hardware may DMA into memory now owned by other kernel subsystems. Additionally, on the restore path, the newly created page pool (if allocation partially succeeded) is overwritten without being destroyed, leaking it. Fix both issues by deferring the release of old pages until after the new allocation succeeds. Save the old page array before the allocation so old pages can be freed on the success path. On the failure path, the old descriptors, pages and page pool are all still valid, making the restore safe. Also ensure the restore path re-enables NAPI and wakes the netdev, matching the success path. Fixes: 89ba464fcf54 ("net: lan966x: refactor buffer reload function") Cc: stable@vger.kernel.org Signed-off-by: David Carlier <devnexen@gmail.com> Link: https://patch.msgid.link/20260405055241.35767-4-devnexen@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-04-09net: lan966x: fix page pool leak in error pathsDavid Carlier1-1/+4
lan966x_fdma_rx_alloc() creates a page pool but does not destroy it if the subsequent fdma_alloc_coherent() call fails, leaking the pool. Similarly, lan966x_fdma_init() frees the coherent DMA memory when lan966x_fdma_tx_alloc() fails but does not destroy the page pool that was successfully created by lan966x_fdma_rx_alloc(), leaking it. Add the missing page_pool_destroy() calls in both error paths. Fixes: 11871aba1974 ("net: lan96x: Use page_pool API") Cc: stable@vger.kernel.org Signed-off-by: David Carlier <devnexen@gmail.com> Link: https://patch.msgid.link/20260405055241.35767-3-devnexen@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-04-09net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool()David Carlier1-0/+2
page_pool_create() can return an ERR_PTR on failure. The return value is used unconditionally in the loop that follows, passing the error pointer through xdp_rxq_info_reg_mem_model() into page_pool_use_xdp_mem(), which dereferences it, causing a kernel oops. Add an IS_ERR check after page_pool_create() to return early on failure. Fixes: 11871aba1974 ("net: lan96x: Use page_pool API") Cc: stable@vger.kernel.org Signed-off-by: David Carlier <devnexen@gmail.com> Link: https://patch.msgid.link/20260405055241.35767-2-devnexen@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-04-09drm/atomic: Increase timeout in drm_atomic_helper_wait_for_vblanks()Thomas Zimmermann1-1/+1
Increase the timeout for vblank events from 100 ms to 1000 ms. This is the same fix as in commit f050da08a4ed ("drm/vblank: Increase timeout in drm_wait_one_vblank()") for another vblank timeout. After merging generic DRM vblank timers [1] and converting several DRM drivers for virtual hardware, these drivers synchronize their vblank events to the display refresh rate. This can trigger timeouts within the DRM framework. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Link: https://lore.kernel.org/dri-devel/20250904145806.430568-1-tzimmermann@suse.de/ # [1] Reported-by: syzbot+fcede535e7eb57cf5b43@syzkaller.appspotmail.com Closes: https://lore.kernel.org/dri-devel/69381d6c.050a0220.4004e.0017.GAE@google.com/ Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Fixes: 74afeb812850 ("drm/vblank: Add vblank timer") Link: https://patch.msgid.link/20251209143325.102056-1-tzimmermann@suse.de
2026-04-09platform/x86: thinkpad_acpi: remove obsolete TODO commentDaniil Bulgar1-3/+0
This patch removes the obsolete TODO comment regarding fan speed presets in fan_write_cmd_speed. After discussion with the maintainers, it was decided that fixed presets (low/medium/high) are not suitable due to platform-specific variations. Signed-off-by: Daniil Bulgar <bulgardaniil18@gmail.com> Reviewed-by: Mark Pearson <mpearson-lenovo@squebb.ca> Link: https://patch.msgid.link/20260407190546.109900-1-bulgardaniil18@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-04-09leds: class: Make led_remove_lookup() NULL-awareAndy Shevchenko1-0/+3
It is a usual pattern in the kernel to make releasing functions be NULL-aware so they become a no-op. This helps reducing unneeded checks in the code where the given resource is optional. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://patch.msgid.link/20260327102729.797254-1-andriy.shevchenko@linux.intel.com Signed-off-by: Lee Jones <lee@kernel.org>
2026-04-09platform/x86: dell-wmi-sysman: bound enumeration string aggregationPengpeng Hou1-6/+28
populate_enum_data() aggregates firmware-provided value-modifier and possible-value strings into fixed 512-byte struct members. The current code bounds each individual source string but then appends every string and separator with raw strcat() and no remaining-space check. Switch the aggregation loops to a bounded append helper and reject enumeration packages whose combined strings do not fit in the destination buffers. Fixes: e8a60aa7404b ("platform/x86: Introduce support for Systems Management Driver over WMI for Dell Systems") Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Link: https://patch.msgid.link/20260408084501.1-dell-wmi-sysman-v2-pengpeng@iscas.ac.cn [ij: add include] Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-04-09kernfs: make directory seek namespace-awareChristian Brauner1-0/+5
The rbtree backing kernfs directories is ordered by (hash, ns_id, name) but kernfs_dir_pos() only searches by hash when seeking to a position during readdir. When two nodes from different namespaces share the same hash value, the binary search can land on a node in the wrong namespace. The subsequent skip-forward loop walks rb_next() and may overshoot the correct node, silently dropping an entry from the readdir results. With the recent switch from raw namespace pointers to public namespace ids as hash seeds, computing hash collisions became an offline operation. An unprivileged user could unshare into a new network namespace, create a single interface whose name-hash collides with a target entry in init_net, and cause a victim's seekdir/readdir on /sys/class/net to miss that entry. Fix this by extending the rbtree search in kernfs_dir_pos() to also compare namespace ids when hashes match. Since the rbtree is already ordered by (hash, ns_id, name), this makes the seek land directly in the correct namespace's range, eliminating the wrong-namespace overshoot. Signed-off-by: Christian Brauner <brauner@kernel.org>
2026-04-09kernfs: use namespace id instead of pointer for hashing and comparisonChristian Brauner1-7/+26
kernfs uses the namespace tag as both a hash seed (via init_name_hash()) and a comparison key in the rbtree. The resulting hash values are exposed to userspace through directory seek positions (ctx->pos), and the raw pointer comparisons in kernfs_name_compare() encode kernel pointer ordering into the rbtree layout. This constitutes a KASLR information leak since the hash and ordering derived from kernel pointers can be observed from userspace. Fix this by using the 64-bit namespace id (ns_common::ns_id) instead of the raw pointer value for both hashing and comparison. The namespace id is a stable, non-secret identifier that is already exposed to userspace through other interfaces (e.g., /proc/pid/ns/, ioctl NS_GET_NSID). Introduce kernfs_ns_id() as a helper that extracts the namespace id from a potentially-NULL ns_common pointer, returning 0 for the no-namespace case. All namespace equality checks in the directory iteration and dentry revalidation paths are also switched from pointer comparison to ns_id comparison for consistency. Signed-off-by: Christian Brauner <brauner@kernel.org>
2026-04-09kernfs: pass struct ns_common instead of const void * for namespace tagsChristian Brauner30-148/+175
kernfs has historically used const void * to pass around namespace tags used for directory-level namespace filtering. The only current user of this is sysfs network namespace tagging where struct net pointers are cast to void *. Replace all const void * namespace parameters with const struct ns_common * throughout the kernfs, sysfs, and kobject namespace layers. This includes the kobj_ns_type_operations callbacks, kobject_namespace(), and all sysfs/kernfs APIs that accept or return namespace tags. Passing struct ns_common is needed because various codepaths require access to the underlying namespace. A struct ns_common can always be converted back to the concrete namespace type (e.g., struct net) via container_of() or to_ns_common() in the reverse direction. This is a preparatory change for switching to ns_id-based directory iteration to prevent a KASLR pointer leak through the current use of raw namespace pointers as hash seeds and comparison keys. Signed-off-by: Christian Brauner <brauner@kernel.org>
2026-04-09Merge branches 'fixes', 'arm/smmu/updates', 'arm/smmu/bindings', 'riscv', ↵Will Deacon43-798/+2166
'intel/vt-d', 'amd/amd-vi' and 'core' into next
2026-04-09iommu: Ensure .iotlb_sync is called correctlyRobin Murphy1-0/+6
Many drivers have no reason to use the iotlb_gather mechanism, but do still depend on .iotlb_sync being called to properly complete an unmap. Since the core code is now relying on the gather to detect when there is legitimately something to sync, it should also take care of encoding a successful unmap when the driver does not touch the gather itself. Fixes: 90c5def10bea ("iommu: Do not call drivers for empty gathers") Reported-by: Jon Hunter <jonathanh@nvidia.com> Closes: https://lore.kernel.org/r/8800a38b-8515-4bbe-af15-0dae81274bf7@nvidia.com Signed-off-by: Robin Murphy <robin.murphy@arm.com> Tested-by: Jon Hunter <jonathanh@nvidia.com> Reviewed-by: Jason Gunthorpe <jgg@nvidia.com> Tested-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Signed-off-by: Will Deacon <will@kernel.org>
2026-04-09iommu/vt-d: Restore IOMMU_CAP_CACHE_COHERENCYAlex Williamson1-0/+1
In removing IOMMU_CAP_DEFERRED_FLUSH, the below referenced commit was over-eager in removing the return, resulting in the test for IOMMU_CAP_CACHE_COHERENCY falling through to an irrelevant option. Restore dropped return. Fixes: 1c18a1212c77 ("iommu/dma: Always allow DMA-FQ when iommupt provides the iommu_domain") Signed-off-by: Alex Williamson <alex.williamson@nvidia.com> Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com> Reviewed-by: Jason Gunthorpe <jgg@nvidia.com> Reviewed-by: Kevin Tian <kevin.tian@intel.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-04-09platform/x86: hp-wmi: Ignore backlight and FnLock eventsKrishna Chomal1-0/+5
On HP OmniBook 7 the keyboard backlight and FnLock keys are handled directly by the firmware. However, they still trigger WMI events which results in "Unknown key code" warnings in dmesg. Add these key codes to the keymap with KE_IGNORE to silence the warnings since no software action is needed. Tested-by: Artem S. Tashkinov <aros@gmx.com> Reported-by: Artem S. Tashkinov <aros@gmx.com> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221181 Signed-off-by: Krishna Chomal <krishna.chomal108@gmail.com> Link: https://patch.msgid.link/20260403080155.169653-1-krishna.chomal108@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-04-09platform/x86: uniwill-laptop: Fix signedness bugEthan Tidmore1-3/+4
The function sysfs_match_string() can return negative error codes and the variable assigned to it is the enum 'option'. Which could be an unsigned int due to different compiler implementations. Assign signed variable 'ret' to sysfs_match_string(), check for error, then assign ret to option. Detected by Smatch: drivers/platform/x86/uniwill/uniwill-acpi.c:919 usb_c_power_priority_store() warn: unsigned 'option' is never less than zero. Fixes: 03ae0a0d0973b ("platform/x86: uniwill-laptop: Implement USB-C power priority setting") Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com> Link: https://patch.msgid.link/20260403070928.802196-1-ethantidmore06@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-04-09platform/x86: dell_rbu: avoid uninit value usage in packet_size_write()Fedor Pchelkin1-1/+5
Ensure the temp value has been properly parsed from the user-provided buffer and initialized to be used in later operations. While at it, prefer a convenient kstrtoul() helper. Found by Linux Verification Center (linuxtesting.org) with Svace static analysis tool. Fixes: ad6ce87e5bd4 ("[PATCH] dell_rbu: changes in packet update mechanism") Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru> Link: https://patch.msgid.link/20260403134240.604837-1-pchelkin@ispras.ru [ij: add include] Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-04-09nfc: pn533: allocate rx skb before consuming bytesPengpeng Hou1-3/+8
pn532_receive_buf() reports the number of accepted bytes to the serdev core. The current code consumes bytes into recv_skb and may already hand a complete frame to pn533_recv_frame() before allocating a fresh receive buffer. If that alloc_skb() fails, the callback returns 0 even though it has already consumed bytes, and it leaves recv_skb as NULL for the next receive callback. That breaks the receive_buf() accounting contract and can also lead to a NULL dereference on the next skb_put_u8(). Allocate the receive skb lazily before consuming the next byte instead. If allocation fails, return the number of bytes already accepted. Fixes: c656aa4c27b1 ("nfc: pn533: add UART phy driver") Cc: stable@vger.kernel.org Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Link: https://patch.msgid.link/20260405094003.3-pn533-v2-pengpeng@iscas.ac.cn Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-04-09platform/x86: hp-wmi: add locking for concurrent hwmon accessEmre Cecanpunar1-2/+13
hp_wmi_hwmon_priv.mode and .pwm are written by hp_wmi_hwmon_write() in sysfs context and read by hp_wmi_hwmon_keep_alive_handler() in a workqueue. A concurrent write and keep-alive expiry can observe an inconsistent mode/pwm pair (e.g. mode=MANUAL with a stale pwm). Add a mutex to hp_wmi_hwmon_priv protecting mode and pwm. Hold it in hp_wmi_hwmon_write() across the field update and apply call, and in hp_wmi_hwmon_keep_alive_handler() before calling apply. In hp_wmi_hwmon_read(), only the pwm_enable path reads priv->mode; use scoped_guard() there to avoid holding the lock across unrelated WMI calls. Fixes: c203c59fb5de ("platform/x86: hp-wmi: implement fan keep-alive") Suggested-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Emre Cecanpunar <emreleno@gmail.com> Link: https://patch.msgid.link/20260407142515.20683-6-emreleno@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-04-09platform/x86: hp-wmi: fix u8 underflow in gpu_delta calculationEmre Cecanpunar1-3/+3
gpu_delta was declared as u8. If the firmware specifies a GPU RPM lower than the CPU RPM, subtracting them causes an underflow (e.g. 10 - 20 = 246), which forces the GPU fan to remain clamped at U8_MAX (100% speed) during operation. Change gpu_delta to int and use signed arithmetic. Existing signed logic in hp_wmi_fan_speed_set() correctly handles negative deltas. Fixes: 46be1453e6e6 ("platform/x86: hp-wmi: add manual fan control for Victus S models") Suggested-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Emre Cecanpunar <emreleno@gmail.com> Link: https://patch.msgid.link/20260407142515.20683-5-emreleno@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-04-09platform/x86: hp-wmi: use mod_delayed_work to reset keep-alive timerEmre Cecanpunar1-4/+4
Currently, schedule_delayed_work() is used to queue the 90s keep-alive timer. If a user manually changes the fan speed at T=85s, schedule_delayed_work() leaves the existing timer in place as it is a no-op if the work is already pending. This results in the keep-alive timer firing unnecessarily at T=90s, just 5 seconds after the user action. Replace schedule_delayed_work() with mod_delayed_work() to reset the 90s timer whenever fan settings are applied. This guarantees a full 90s delay after every user interaction, preventing redundant keep-alive executions and improving efficiency. Fixes: c203c59fb5de ("platform/x86: hp-wmi: implement fan keep-alive") Signed-off-by: Emre Cecanpunar <emreleno@gmail.com> Link: https://patch.msgid.link/20260407142515.20683-4-emreleno@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-04-09platform/x86: hp-wmi: avoid cancel_delayed_work_sync from work handlerEmre Cecanpunar1-1/+1
hp_wmi_apply_fan_settings() uses cancel_delayed_work_sync() to stop the keep-alive timer in AUTO mode. However, since hp_wmi_apply_fan_settings() is also called from the keep-alive handler, a race condition with a sysfs write can cause the handler to wait on itself, leading to a deadlock. Replace cancel_delayed_work_sync() with cancel_delayed_work() in hp_wmi_apply_fan_settings() to avoid the self-flush deadlock. Fixes: c203c59fb5de ("platform/x86: hp-wmi: implement fan keep-alive") Signed-off-by: Emre Cecanpunar <emreleno@gmail.com> Link: https://patch.msgid.link/20260407142515.20683-3-emreleno@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-04-09platform/x86: hp-wmi: fix ignored return values in fan settingsEmre Cecanpunar1-7/+16
hp_wmi_get_fan_count_userdefine_trigger() can fail, but its return value was silently ignored in hp_wmi_apply_fan_settings() for PWM_MODE_MAX/AUTO. Propagate these errors consistently. Additionally, handle the return value of hp_wmi_apply_fan_settings() in its callers by adding appropriate warnings on failure, and remove an unreachable "return 0" at the end of the function. Fixes: 46be1453e6e6 ("platform/x86: hp-wmi: add manual fan control for Victus S models") Signed-off-by: Emre Cecanpunar <emreleno@gmail.com> Link: https://patch.msgid.link/20260407142515.20683-2-emreleno@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-04-09arm64: dts: ti: k3: Use memory-region-names for r5fMarkus Schneider-Pargmann (TI)10-0/+38
Add the newly introduced memory-region-names to all occurences of ti,*-r5f. This helps adding a name to each memory-region so it is easier to see what memory regions are for. Signed-off-by: Markus Schneider-Pargmann (TI) <msp@baylibre.com> Link: https://patch.msgid.link/20260318-topic-am62a-ioddr-dt-v6-19-v3-3-c41473cb23c3@baylibre.com Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
2026-04-09KVM: LoongArch: selftests: Add PMU overflow interrupt testSong Gao3-0/+60
Extend the PMU test suite to cover overflow interrupts. The test enables the PMI (Performance Monitor Interrupt), sets counter 0 to one less than the overflow value, and verifies that an interrupt is raised when the counter overflows. A guest interrupt handler checks the interrupt cause and disables further PMU interrupts upon success. Signed-off-by: Song Gao <gaosong@loongson.cn> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2026-04-09KVM: LoongArch: selftests: Add basic PMU event counting testSong Gao5-2/+223
Introduce a basic PMU test that verifies hardware event counting for four performance counters. The test enables the events for CPU cycles, instructions retired, branch instructions, and branch misses, runs a fixed number of loops, and checks that the counter values fall within expected ranges. It also validates that the host supports PMU and that the VM feature is enabled. Signed-off-by: Song Gao <gaosong@loongson.cn> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2026-04-09KVM: LoongArch: selftests: Add cpucfg read/write helpersSong Gao2-0/+19
Add helper macros and functions to read and write CPU configuration registers (cpucfg) from the guest and from the VMM. This interface is required in upcoming selftests for querying and setting CPU features, such as PMU capabilities. Signed-off-by: Song Gao <gaosong@loongson.cn> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2026-04-09LoongArch: KVM: Add DMSINTC inject msi to vCPUSong Gao6-8/+99
Implement irqfd that deliver msi to vCPU and vCPU dmsintc irq injection. Add pch_msi_set_irq() choice dmsintc to set msi irq by the msg_addr and implement dmsintc set msi irq. Signed-off-by: Song Gao <gaosong@loongson.cn> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2026-04-09LoongArch: KVM: Add DMSINTC device supportSong Gao7-0/+148
Add device model for DMSINTC interrupt controller, implement basic create/destroy/set_attr interfaces, and register device model to kvm device table. Reviewed-by: Bibo Mao <maobibo@loongson.cn> Signed-off-by: Song Gao <gaosong@loongson.cn> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2026-04-09LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than functionBibo Mao2-18/+24
vcpu_is_preempted() is performance sensitive that called in function osq_lock(), here make it as a macro. So that parameter is not parsed at most time, it can avoid cache line thrashing across numa nodes. Here is part of UnixBench result on Loongson-3C5000 DualWay machine with 32 cores and 2 numa nodes. original inline macro execl 7025.7 6991.2 7242.3 fstime 474.6 703.1 1071 From the test result, making vcpu_is_preempted() as a macro is the best, and there is some improvment compared with the original function method. Signed-off-by: Bibo Mao <maobibo@loongson.cn> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2026-04-09LoongArch: KVM: Move host CSR_GSTAT save and restore in context switchBibo Mao2-4/+6
CSR register LOONGARCH_CSR_GSTAT stores guest VMID information. With existing implementation method, VMID is per vCPU, similar with ASID in kernel. LOONGARCH_CSR_GSTAT is written at VM entry even if VMID is not changed. Here move LOONGARCH_CSR_GSTAT save/restore in vCPU context switch, and update LOONGARCH_CSR_GSTAT only when VMID is updated at VM entry. At most time VM enter/exit is much more frequent than vCPU thread context switch. Signed-off-by: Bibo Mao <maobibo@loongson.cn> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2026-04-09LoongArch: KVM: Move host CSR_EENTRY save and restore in context switchBibo Mao1-3/+4
CSR register LOONGARCH_CSR_EENTRY is shared between host CPU and guest vCPU, KVM need save and restore LOONGARCH_CSR_EENTRY register. Here move LOONGARCH_CSR_EENTRY saving in to context switch function rather than VM entry. At most time VM enter/exit is much more frequent than vCPU thread context switch. Signed-off-by: Bibo Mao <maobibo@loongson.cn> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2026-04-09LoongArch: KVM: Check kvm_request_pending() in kvm_late_check_requests()Bibo Mao1-9/+9
Add kvm_request_pending() checking firstly in kvm_late_check_requests(), at most time there is no pending request, then the following pending bit checking can be skipped. Also embed function kvm_check_pmu() in to kvm_late_check_requests(), and put it after the kvm_request_pending() checking. Signed-off-by: Bibo Mao <maobibo@loongson.cn> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2026-04-09LoongArch: KVM: Use CSR_CRMD_PLV in kvm_arch_vcpu_in_kernel()Tao Cui1-1/+1
The function reads LOONGARCH_CSR_CRMD but uses CSR_PRMD_PPLV to extract the privilege level. While both masks have the same value (0x3), CSR_CRMD_PLV is the semantically correct constant for CRMD. Cc: stable@vger.kernel.org Reviewed-by: Bibo Mao <maobibo@loongson.cn> Signed-off-by: Tao Cui <cuitao@kylinos.cn> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2026-04-09ARM: 9471/1: module: fix unwind section relocation out of range errorWilliam Zhang1-0/+12
In an armv7 system that uses non-3G/1G split and with more than 512MB physical memory, driver load may fail with following error: section 29 reloc 0 sym '': relocation 42 out of range (0xc2ab9be8 -> 0x7fad5998) This happens when relocation R_ARM_PREL31 from the unwind section .ARM.extab and .ARM.exidx are allocated from the VMALLOC space while .text section is from MODULES_VADDR space. It exceeds the +/-1GB relocation requirement of R_ARM_PREL31 hence triggers the error. The fix is to mark .ARM.extab and .ARM.exidx sections as executable so they can be allocated along with .text section and always meet range requirement. Co-developed-by: Ard Biesheuvel <ardb@kernel.org> Signed-off-by: Ard Biesheuvel <ardb@kernel.org> Signed-off-by: William Zhang <william.zhang@broadcom.com> Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
2026-04-09fs/adfs: validate nzones in adfs_validate_bblk()Bae Yeonju1-0/+3
Reject ADFS disc records with a zero zone count during boot block validation, before the disc record is used. When nzones is 0, adfs_read_map() passes it to kmalloc_array(0, ...) which returns ZERO_SIZE_PTR, and adfs_map_layout() then writes to dm[-1], causing an out-of-bounds write before the allocated buffer. adfs_validate_dr0() already rejects nzones != 1 for old-format images. Add the equivalent check to adfs_validate_bblk() for new-format images so that a crafted image with nzones == 0 is rejected at probe time. Found by syzkaller. Fixes: f6f14a0d71b0 ("fs/adfs: map: move map-specific sb initialisation to map.c") Signed-off-by: Bae Yeonju <iwasbaeyz@gmail.com> Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
2026-04-09Merge branch 'r8152-add-support-for-the-rtl8157-5gbit-usb-ethernet-chip'Paolo Abeni1-202/+811
Birger Koblitz says: ==================== r8152: Add support for the RTL8157 5Gbit USB Ethernet chip Add support for the RTL8157, which is a 5GBit USB-Ethernet adapter chip in the RTL815x family of chips. The RTL8157 uses a different frame descriptor format, and different SRAM/ADV access methods, plus offers 5GBit/s Ethernet, so support for these features is added in addition to chip initialization and configuration. The module was tested with an OEM RTL8157 USB adapter: [25758.328238] usb 4-1: new SuperSpeed Plus Gen 2x1 USB device number 2 using xhci_hcd [25758.345565] usb 4-1: New USB device found, idVendor=0bda, idProduct=8157, bcdDevice=30.00 [25758.345585] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=7 [25758.345593] usb 4-1: Product: USB 10/100/1G/2.5G/5G LAN [25758.345599] usb 4-1: Manufacturer: Realtek [25758.345605] usb 4-1: SerialNumber: 000300E04C68xxxx [25758.534241] r8152-cfgselector 4-1: reset SuperSpeed Plus Gen 2x1 USB device number 2 using xhci_hcd [25758.603511] r8152 4-1:1.0: skip request firmware [25758.653351] r8152 4-1:1.0 eth0: v1.12.13 [25758.689271] r8152 4-1:1.0 enx00e04c68xxxx: renamed from eth0 [25763.271682] r8152 4-1:1.0 enx00e04c68xxxx: carrier on The RTL8157 adapter was tested against an AQC107 PCIe-card supporting 10GBit/s and an RTL8126 5Gbit PCIe-card supporting 5GBit/s for performance, link speed and EEE negotiation. Using USB3.2 Gen 1 with the RTL8157 USB adapter and running iperf3 against the AQC107 PCIe card resulted in 3.47 Gbits/sec, whereas using USB3.2 Gen2 resulted in 4.70 Gbits/sec, speeds against the RTL8126-card were the same. As the code integrates the RTL8157-specific code with existing RTL8156 code in order to improve code maintainability (instead of adding RTL8157-specific functions duplicaing most of the RTL8156 code), regression tests were done with an Edimax EU-4307 V1.0 USB-Ethernet adapter with RTL8156. The code is based on the out-of-tree r8152 driver published by Realtek under the GPL. This patch is on top of linux-next as the code re-uses the 2.5 Gbit EEE recently added in r8152.c. Signed-off-by: Birger Koblitz <mail@birger-koblitz.de> ==================== Link: https://patch.msgid.link/20260404-rtl8157_next-v7-0-039121318f23@birger-koblitz.de Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-04-09r8152: Add support for the RTL8157 hardwareBirger Koblitz1-184/+729
The RTL8157 uses a different packet descriptor format compared to the previous generation of chips. Add support for this format by adding a descriptor format structure into the r8152 structure and corresponding desc_ops functions which abstract the vlan-tag, tx/rx len and tx/rx checksum algorithms. Also, add support for the ADV indirect access interface of the RTL8157 and PHY setup. For initialization of the RTL8157, combine the existing RTL8156B and RTL8156 init functions and add RTL8157-specific functinality in order to improve code readability and maintainability. r8156_init() is now called with RTL_VER_10 and RTL_VER_11 for the RTL8156, with RTL_VER_12, RTL_VER_13 and RTL_VER_15 for the RTL8156B and with RTL_VER_16 for the RTL8157 and checks the version for chip-specific code. Also add USB power control functions for the RTL8157. Add support for the USB device ID of Realtek RTL8157-based adapters. Detect the RTL8157 as RTL_VER_16 and set it up. Signed-off-by: Birger Koblitz <mail@birger-koblitz.de> Link: https://patch.msgid.link/20260404-rtl8157_next-v7-2-039121318f23@birger-koblitz.de Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-04-09r8152: Add support for 5Gbit Link Speeds and EEEBirger Koblitz1-18/+82
The RTL8157 supports 5GBit Link speeds. Add support for this speed in the setup and setting/getting through ethtool. Also add 5GBit EEE. Add functionality for setup and ethtool get/set methods. Signed-off-by: Birger Koblitz <mail@birger-koblitz.de> Link: https://patch.msgid.link/20260404-rtl8157_next-v7-1-039121318f23@birger-koblitz.de Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-04-09ALSA: hda/senarytech: Clean up with the new GPIO helperTakashi Iwai1-8/+2
Use the new GPIO helper function to clean up the open code. Merely a code refactoring, and no behavior change. Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260409093826.1317626-11-tiwai@suse.de
2026-04-09ALSA: hda/conexant: Clean up with the new GPIO helperTakashi Iwai1-11/+3
Use the new GPIO helper function to clean up the open code. Merely a code refactoring, and no behavior change. Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260409093826.1317626-10-tiwai@suse.de
2026-04-09ALSA: hda/cirrus: Clean up with the new GPIO helperTakashi Iwai3-32/+12
Use the new GPIO helper function to clean up the open code. Merely a code refactoring, and no behavior change. Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260409093826.1317626-9-tiwai@suse.de
2026-04-09ALSA: hda/ca0132: Clean up with the new GPIO helperTakashi Iwai1-12/+2
Use the new GPIO helper function to clean up the open code. Merely a code refactoring, and no behavior change. Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260409093826.1317626-8-tiwai@suse.de
2026-04-09ALSA: hda/sigmatel: Clean up with the new GPIO helperTakashi Iwai1-9/+1
Use the new GPIO helper function to clean up the open code. Merely a code refactoring, and no behavior change. Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260409093826.1317626-7-tiwai@suse.de
2026-04-09ALSA: hda/analog: Fix GPIO verb ordersTakashi Iwai1-9/+9
So far we used the verb cache to restore the GPIO mask, direction and data bits at PM resume. But, due to the nature of the cache resume mechanism, the calling order isn't guaranteed, and this might lead to some inconsistency at the restored state. For assuring the GPIO verb orders, use the new GPIO helper function to explicitly set up the GPIO bits, instead of using the codec verb caches, while keeping the current data bits in ad198x_spec. Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260409093826.1317626-6-tiwai@suse.de
2026-04-09ALSA: hda/alc662: Simplify the quirk for CSL Unity BF24BTakashi Iwai1-11/+3
The previous implementation of the quirk for CSL Unity BF24B in commit de65275fc94e ("ALSA: hda/realtek: Add quirk for CSL Unity BF24B") introduced the unnecessary GPIO caching which leads to a superfluous write at each init/resume. Use the new helper to write GPIO bits directly for optimization. Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260409093826.1317626-5-tiwai@suse.de
2026-04-09ALSA: hda/realtek: Clean up with snd_hda_codec_set_gpio()Takashi Iwai2-10/+4
Use a new helper function to clean up the code. Along with it, make alc_write_gpio() static as well, which is used only locally in realtek.c. Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260409093826.1317626-4-tiwai@suse.de
2026-04-09ALSA: hda: Add a simple GPIO setup helper functionTakashi Iwai2-0/+33
Introduce a common GPIO setup helper function, so that we can clean up the open code found in many codec drivers later. Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260409093826.1317626-3-tiwai@suse.de
2026-04-09ALSA: hda: Add sync version of snd_hda_codec_write()Takashi Iwai6-12/+21
We used snd_hda_codec_read() for the verb write when a synchronization is needed after the write, e.g. for the power state toggle or such cases. It works in principle, but it looks rather confusing and too hackish. For improving the code readability, introduce a new helper function, snd_hda_codec_write_sync(), which is another variant of snd_hda_codec_write(), and replace the existing snd_hda_codec_read() calls with this one. No behavior change but just the code refactoring. Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260409093826.1317626-2-tiwai@suse.de
2026-04-09ALSA: usb-audio: Add iface reset and delay quirk for HUAWEI USB-C HEADSETLianqin Hu1-2/+3
Setting up the interface when suspended/resumeing fail on this card. Adding a reset and delay quirk will eliminate this problem. usb 1-1: new full-speed USB device number 2 using xhci-hcd usb 1-1: New USB device found, idVendor=12d1, idProduct=3a07 usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: HUAWEI USB-C HEADSET usb 1-1: Manufacturer: bestechnic usb 1-1: SerialNumber: 0296C100000000000000000000000 Signed-off-by: Lianqin Hu <hulianqin@vivo.com> Link: https://patch.msgid.link/TYUPR06MB62176A18EA7A9DD0AC2826BCD2582@TYUPR06MB6217.apcprd06.prod.outlook.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
generated by cgit v1.2.3 (git 2.39.0) at 2026-05-28 08:48:41 +0300