summaryrefslogtreecommitdiff
path: root/include/linux
AgeCommit message (Collapse)Author
13 daysKVM: Introduce file_to_kvm_<arch>() infrastructureSteffen Eiden
Add a macro mechanism that generates an opt-in and arch-namespaced file_to_kvm_<arch>() to convert a file reference to a kvm object if the file handle represents a kvm handle. Activate for x86 and for s390 (native KVM only). Suggested-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Steffen Eiden <seiden@linux.ibm.com> Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Acked-by: Janosch Frank <frankja@linux.ibm.com> Acked-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
13 daysbraille: nbcon: Allow to use a serial console with NBCON API as Braille consolePetr Mladek
The Braille console is not registered in console_list. Instead, it is integrated with the virtual terminal (VT) and shows what is displayed on the terminal. It writes the data using con->write*() callback of the associated serial console driver. braille_write() is called from the VT code under console_lock(). The associated serial console driver can be converted to the NBCON API though. The situation is similar to flushing nbcon consoles in the legacy loop when some boot consoles are still registered, see nbcon_legacy_emit_next_record(). But there is a big difference though. braille_write() is not directly called from the code paths flushing registered consoles. The VT code expects that braille_write() succeeds. It does not replay the message when it can't acquire the ownership. As a result, braille_write(): + must try harder to get the ownership. + has to be synchronized only against non-printk serial console which depend nbcon_device_try_acquire() using NBCON_PRIO_NORMAL. Let's look at it from another side and try to simulate the original locking using the NBCON API: 1. Take con->device_lock(), aka the port->lock in the legacy serial console driver. 2. Acquire nbcon context to provide some synchronization for a panic() context. Use NBCON_PRIO_NORMAL because it contends only with nbcon_device_try_acquire() users. Do it in a busy loop. It should always succeed when con->device_lock() succeeded because all other users do the same. The only exception is when the context get acquired by a CPU handling panic. 3. In panic, disable interrupts and try to acquire the nbcon context. Use NBCON_PRIO_PANIC. And try even an unsafe takeover because otherwise the Braille console won't see the text shown during panic(). It is similar to the oops_in_progress/trylock handling in the legacy serial console driver. Finally, avoid the newline prepending logic in the existing serial console drivers when they are used as a Braille console. As explained above, the Braille console shows the last modified line on the terminal (VT). braille_write() is called when single characters are added. Most messages are not ended by newline. Anyway, the VT code does not have logic to reply partially printed messages. Fixes: 13189fa73afa ("printk: nbcon: Rely on kthreads for normal operation") Reviewed-by: John Ogness <john.ogness@linutronix.de> [pmladek@suse.com: Remove white space changes in braille_register_console(). Typo fix.] Link: https://patch.msgid.link/20261001140727.124398-2-pmladek@suse.com Signed-off-by: Petr Mladek <pmladek@suse.com>
13 daysrhashtable: specialize default comparison for constant parametersUsama Arif
The inline lookup and insert helpers receive the rhashtable parameters by value. With a static const parameter block, key_offset and key_len are compile-time constants at the call site. The default comparison throws that information away by reading both fields back from ht->p. Fixed-size keys consequently load the parameters and call bcmp() for every object in the bucket, even when the compiler could use scalar comparisons instead. The commit "sched_ext: Specialize the DSQ hashtable compare" [1] resulted in a 2.9x faster DSQ lookup after replacing this path for its u64 key with a scalar comparison. Doing that through obj_cmpfn requires every fixed-key user to provide its own callback. Pass the call-site parameters to rhashtable_compare(), as rht_key_get_hash() already does. Use them when key_len is a compile-time constant. Retain the ht->p path for dynamic parameter blocks. A constant zero key_len continues to take the runtime length from ht->p.key_len. This specializes the default comparison for all fixed-size users. With Clang 22 on x86-64, bcmp() disappears from sched_ext, mac80211, NFSd, TIPC, NFQUEUE, VFS superblock, pidfs, SysV IPC and hardware-breakpoint table paths. The affected build_policy.o, sta_info.o and nfsd filecache.o text shrinks by 512, 400 and 352 bytes respectively. Four- and eight-byte keys become direct scalar comparisons; six-byte MAC addresses become a four-byte and a two-byte comparison. Measure the VFS case with ustat() on a mounted ramfs. This exercises user_get_super() and its super_dev lookup. Across ten interleaved baseline and patched VM boot pairs, with five 3 million call samples per boot, the average per-boot median latency drops from 477.2 to 462.6 ns per call, or 3.0%. All ten pairs improved. No functional change intended. [1] https://lore.kernel.org/all/20260921171928.1639407-1-usama.arif@linux.dev/ Suggested-by: Mykola Lysenko <nickolay.lysenko@gmail.com> Signed-off-by: Usama Arif <usama.arif@linux.dev> Acked-by: Tejun Heo <tj@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
13 dayscrypto: hisilicon/qm - add __counted_by_ptr to dfx_diff_registersBill Wendling
Annotate the pointer field 'regs' in 'struct dfx_diff_registers' with the '__counted_by_ptr' attribute, referencing the 'reg_len' member which holds the element count of the allocated memory. In 'drivers/crypto/hisilicon/debugfs.c', the 'dfx_regs_init' function allocates the 'diff_regs' array and initializes each element's 'regs' pointer after setting its 'reg_len'. Since 'reg_len' is set before 'regs' is assigned, the compiler's bounds sanitizer can correctly associate the pointer with its allocated size. Cc: codemender-patching+linux@google.com Assisted-by: LLM Signed-off-by: Bill Wendling <morbo@google.com> Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
13 dayscrypto: hisilicon/qm - annotate cap_tables with __counted_by_ptrBill Wendling
Annotate the 'qm_cap_table' and 'dev_cap_table' pointer fields in 'struct hisi_qm_cap_tables' with the '__counted_by_ptr' attribute. This improves bounds checking via CONFIG_UBSAN_BOUNDS and CONFIG_FORTIFY_SOURCE, allowing KASAN and compiler diagnostics to detect out-of-bounds accesses. The 'qm_cap_table' pointer is associated with 'qm_cap_size' which specifies its element count. Similarly, 'dev_cap_table' is associated with 'dev_cap_size'. To ensure safety under compiler instrumentation, the assignments in the initialization paths have been updated to set the 'size'/'count' fields prior to setting the pointer fields. This prevents any transient state where the pointer is valid but the count is 0 (or uninitialized), ensuring that subsequent accesses to these tables do not trigger false-positive bounds check panics. Cc: codemender-patching+linux@google.com Assisted-by: LLM Signed-off-by: Bill Wendling <morbo@google.com> Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> Reviewed-by: Longfang Liu <liulongfang@huawei.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
14 dayssrcu: Make Tiny call_srcu() safe to call from any contextPuranjay Mohan
Give Tiny call_srcu() the same treatment as Tree SRCU. When interrupts are disabled and the scheduler is up, stage the callback on the srcu_struct's lockless list for an irq_work to re-issue later. Tiny SRCU is uniprocessor, so there is no CPU-offline drain. A draining flag drops a deferring call_srcu() that re-enters mid-drain (unless from an NMI), as in Tree SRCU; such a drop can strand state the caller tied to the callback, not just the callback itself. Interrupts stay off for the whole batch. TINY_SRCU implies !SMP, where arch_irq_work_has_interrupt() is false, so the drain always waits for the tick and a batch is whatever one tick's worth of interrupts-disabled call_srcu()s staged. Unlike the other three flavors srcu_do_enqueue() here has no debug_rcu_head_queue(), so nothing reports a double call_srcu(); termination of the drain rests on srcu_do_enqueue() clearing ->next, and the callback list self-links at the tail exactly as a double call_srcu() made it before. srcu_barrier() (now out of line) and cleanup_srcu_struct() drain the deferred list first, so a deferred callback is re-issued onto the callback list and invoked by the grace-period work that cleanup_srcu_struct() flushes, rather than stranded on a soon-to-be-freed srcu_struct. cleanup_srcu_struct() also syncs ->defer_iw, since that irq_work is embedded in the srcu_struct the caller is about to free. The draining flag is global rather than per-srcu_struct: a re-entrant call_srcu(B) inside a drain of A raises B's own ->defer_iw, whose drain can stage back onto A, so a per-srcu_struct flag would not break the chain. The cost is that a drain of A also drops a non-NMI call_srcu() to any other srcu_struct for its duration. Gated by CONFIG_RCU_DEFER like Tree SRCU, though the srcu_struct members are unconditional. Suggested-by: Paul E. McKenney <paulmck@kernel.org> Signed-off-by: Puranjay Mohan <puranjay@kernel.org> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
14 dayssrcu: Make call_srcu() safe to call from any contextPuranjay Mohan
call_srcu() has the same constraint as call_rcu(): srcu_gp_start_if_needed() enqueues under raw_spin_lock_irqsave() and may walk the srcu_node tree, as do callback invocation and grace-period work, so a call_srcu() with interrupts already disabled can race an operation in flight on this CPU. call_rcu_tasks_trace() is call_srcu() under the hood, so a sleepable BPF program freeing an object can reach this. Defer as call_rcu() does: stage the callback on the srcu_data's ->defer_cbs, chain that srcu_data onto a per-CPU list, and raise a per-CPU irq_work that re-issues it straight to the enqueue helper, never back through __call_srcu(). The irqs-enabled path is unchanged; as for call_rcu() the gate is bare irqs_disabled(), so callers that merely hold interrupts off are deferred too and pay one irq_work hop, including call_rcu_tasks_trace() from the BPF memalloc irq_work. The irq_work is per-CPU rather than per-srcu_struct and statically initialized, so deferral never runs check_init_srcu_struct(); it is IRQ_WORK_INIT_HARD as for call_rcu(). srcu_barrier() flushes it first, and rcutree_migrate_callbacks() calls srcu_offline_drain() for an outgoing CPU. cleanup_srcu_struct() drains before its "just leak it" early returns, and srcu_module_going() before freeing any ->sda, since a staged srcu_data left chained on a per-CPU list would dangle. Staging is two steps, the callback onto ->defer_cbs and then the srcu_data onto the per-CPU list, so a flusher can find the per-CPU list empty while a callback whose call_srcu() has not returned sits on ->defer_cbs; the staging CPU's own irq_work takes that one. The per-CPU srcu_defer ->lock, not any srcu_data's, is held with interrupts off across the whole nested drain: the chain of srcu_datas staged on that CPU and, for each, its callbacks, with srcu_do_enqueue() taking that srcu_data's ->lock and possibly starting a grace period for every one. That is what serializes the drainers. The bound is as for call_rcu(): what one interrupts-disabled region could stage, normally a single callback, or whatever accumulates before the tick where arch_irq_work_has_interrupt() is false. Both lists are drained newest-first; nothing depends on call_srcu() ordering. The drain clears ->next before re-issuing, which bounds a node self-linked by a double call_srcu(); a longer cycle is not bounded, and a double call_srcu() stays undefined, as for call_rcu(). A callback deferred past the CPUHP_AP_SMPCFD_DYING irq_work flush leaves that CPU's srcu_defer ->iw claimed with its self-IPI lost, as for call_rcu(). srcu_offline_drain() still re-issues the callback, but the irq_work cannot be un-queued, and here the claim is shared by every srcu_struct on the CPU. As in call_rcu(), the re-issue runs with interrupts disabled and can be re-entered by instrumentation, so a per-CPU flag, set only while that CPU is inside its own irq_work drain, drops a deferring call_srcu() seen mid-drain unless it comes from an NMI. Such a drop can strand state the caller associated with the callback, not just the callback itself. Staging records only the callback, so a deferred expedited call_srcu() completes as a normal grace period. Only srcu_expedite_current() can hit that, and only when invoked with interrupts already disabled. Gated by CONFIG_RCU_DEFER, though the srcu_data members and the per-CPU srcu_defer are unconditional. Under CONFIG_PROVE_RCU, warn if the direct path is reached from an NMI. Suggested-by: Paul E. McKenney <paulmck@kernel.org> Signed-off-by: Puranjay Mohan <puranjay@kernel.org> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
14 daysgpu: host1x: Add host1x_fence_extract()Mikko Perttunen
Syncpoint fences are backed by a hardware syncpoint / threshold, which various hardware is capable of waiting for directly without CPU intervention. Add a function to allow drivers for such devices to extract the details to allow programming the hardware accordingly. The function also provides the host1x instance corresponding to the syncpoint since a system may contain multiple instances of host1x with separate sets of syncpoints. Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com> Signed-off-by: Thierry Reding <treding@nvidia.com> Link: https://patch.msgid.link/20260730-b4-host1x-syncobj-wait-v1-5-afa730410392@nvidia.com
14 daysgpu: host1x: Add option for disabling context stealingMikko Perttunen
Add kernel module parameter to allow disabling context stealing in cases where reliability and consistency is preferred. Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com> Signed-off-by: Thierry Reding <treding@nvidia.com> Link: https://patch.msgid.link/20260710-b4-host1x-ctxsteal-v1-2-b1f8f6b37cc5@nvidia.com
14 daysgpu: host1x: Memory context stealingMikko Perttunen
Currently, each process holding an open TegraDRM channel reserves for itself one of the limited number of hardware memory contexts. Attempting to allocate a channel when all contexts are in use results in failure. While we cannot have more contexts than the hardware supports in active use, idle channels don't necessarily need to have a backing memory context. As such, in this patch, we add another layer to allow hardware memory contexts to be "stolen away" by channels that are in active use, from idle processes. The way this is implemented, is by keeping track of memory mappings on each abstracted memory context. If we need to steal that memory context's backing hardware context, we unmap everything from it and give it away. When that abstracted memory context is needed again (re-activated), we attempt to allocate or steal another hardware context and re-map the previously unmapped buffers. Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com> Signed-off-by: Thierry Reding <treding@nvidia.com> Link: https://patch.msgid.link/20260710-b4-host1x-ctxsteal-v1-1-b1f8f6b37cc5@nvidia.com
14 daysMerge tag 'pm-7.3-rc6' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fix from Rafael Wysocki: "Restore the previous behavior on systems where the cpufreq pressure was not visible in the scheduler and is not expected to be visible there. It became visible after a change made during the 7.2 development cycle that had gone too far" * tag 'pm-7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpufreq: intel_pstate: Fix max_freq fallback in cpufreq_update_pressure()
14 daysACPI: bus: Drop acpi_get_first_physical_node()Rafael J. Wysocki
Fold acpi_get_first_physical_node() into acpi_primary_dev_companion() that is its only remaining caller and drop its signature from the header file. No intentional functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Sudeep Holla <sudeep.holla@kernel.org> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://patch.msgid.link/4537440.ejJDZkT8p0@rafael.j.wysocki
14 daysMerge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski
Cross-merge networking fixes after downstream PR (net-7.3-rc6). Conflicts: net/mac80211/tx.c net/mac80211/ieee80211_i.h 8effab902fa34 ("wifi: mac80211: prevent AP VLAN tx from other interfaces") 78b843974fb83 ("wifi: mac80211: report multicast transmission from lookup_ra_sta()") https://lore.kernel.org/arJmcuhpJ69wAvYK@sirena.co.uk drivers/net/ethernet/realtek/r8169_main.c 3cdeaef1754ab ("r8169: disable EEE on RTL8168h/8111h") 8a3c76523e449 ("r8169: add support for phylink") https://lore.kernel.org/ar5vAxEqS8tO8aVT@sirena.org.uk Adjacent changes: rust/kernel/net/netlink.rs 5e5916923759 ("rust: net: netlink: Migrate to zerocopy's IntoBytes") 0923198be4ae ("rust: net: netlink: validate attribute length before casting to `c_int`") Signed-off-by: Jakub Kicinski <kuba@kernel.org>
14 daysMerge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvmLinus Torvalds
Pull kvm fixes from Paolo Bonzini: "The most intrusive change is reverting a commit from 7.3-rc1 that made struct kvm a bit too large, and fixing the same issue otherwise. There are again a lot of selftests lines; the sheer number of commits is not small but I don't expect much more for 7.3 due to people travelling to Plumbers next week. ARM: - Take a reference on the last IRQ loaded into an LR to prevent it from being freed while running the guest (Marc Zyngier) - Ensure that the ITS MOVALL command only affects LPIs that were previously affined to the source redistributor (Marc Zyngier) - Fix + test for honoring the host's trap configuration when running non-protected VMs while KVM is in protected mode (Fuad Tabba) - Use the host stage-1 mapping granularity for VM_PFNMAP mappings at stage-2 (Mostafa Saleh) x86: Various bugfixes where the guest could do stupid things on purpose to cause problems in the host: - Failed VMRUNs can cause pending TLB flushes to be dropped, and in general some actions done through VMCB control fields have to be redone if VMRUN fails - Toggling MSR interceptions or eVMCS execution controls can cause the host to use a stale MSR permission bitmap - Bad page tables can cause a WARN. Also fix issues in last week's pull request (my fault, for changing email workflow and thus missing feedback sent to kvm@ but not LKML). Generic: - Take kvm_lock when creating vCPUs. For almost two decades everybody thought it was not done for some unspecified performance reasons, but in reality it was only done because kvm_lock was originally a spinlock. This is a better fix than 97d65b544f48 ("KVM: Check for duplicate vcpu_id as early as possible", from the 7.3 merge window), and does not waste 2K per VM, hence its inclusion here" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (29 commits) KVM: arm64: Use stage-1 leaf size for VM_PFNMAP KVM: arm64: selftests: Check a feature hidden in an ID register is UNDEF KVM: arm64: Use the host's HCR_EL2 for non-protected VMs in pKVM KVM: arm64: Clear HCR_EL2.RW for 32-bit non-protected vCPUs KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT KVM: arm64: vgic-its: Fix MOVALL handling of source redistributor KVM: arm64: vgic: Take a refcount on IRQs referenced by last_lr_irq KVM: arm64: vgic: Allow last_lr_irq to be NULL when LRs are not overflowing KVM: SEV: Do cache maintenance on the source VM *before* clearing SEV state KVM: SEV: Nullify "have run CPUs" mask pointer when freeing it KVM: selftests: Extend nested x2APIC test to validate using eVMCS for vmcs12 KVM: selftests: Extend nested x2APIC test to validate disabling x2APIC virt KVM: selftests: Verify that L0's TPR doesn't get clobbered KVM: selftests: Run the nested x2APIC with and without APICv being inhibited in L2 KVM: selftests: Add x2APIC MSR test for inhibiting APICv while nested KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted KVM: SVM: Sync guest's PERF_CNTR_GLOBAL_CTL from h/w only on successful VMRUN KVM: SVM: Don't mark ASID fields as dirty when setting control.tlb_ctl KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded ...
2026-10-01cgroup: Track the effective css in each cgroupPeng Yu
cgroup_e_css() and cgroup_get_e_css() find the effective css by walking up the hierarchy until they reach a cgroup that has the subsystem enabled. Per-I/O users such as nvmet need this lookup to be O(1). Track the effective css in each cgroup and make cgroup_e_css() and cgroup_get_e_css() use it. When a css is brought online or offline, update the effective css of its cgroup and of all descendants. Signed-off-by: Peng Yu <yupeng0921@gmail.com> Assisted-by: Claude:claude-fable-5 [Claude Code] Assisted-by: Claude:claude-opus-5-5 [Claude Code] Signed-off-by: Tejun Heo <tj@kernel.org>
2026-10-01PCI/AER: Map a raw AER Capability image field by fieldDave Jiang
struct aer_capability_regs is not the hardware layout: the embedded struct pcie_tlp_log spans 60 bytes where the Header Log it stands in for is 16, so a flat copy misplaces everything behind it. extlog_print_pcie(), ghes_handle_aer() and cxl_rch_get_aer_info() work around that by stopping at the Header Log, dropping everything past offset 44. Flit mode is never decoded either: the Flit bit and Logged TLP Size sit at offset 0x18, unread, so the Flit DWORDs at 0x38 are lost and the log prints as non-Flit. Add aer_cap_regs_unpack() to map the registers individually, taking the TLP Log layout from the Flit bit as pcie_read_tlp_log() does. Clamp the logged length: Logged TLP Size is 5 bits wide, so an untrusted value reaches 31 where dw[] holds 14 and pcie_print_tlp_log() walks header_len unbounded. Take the image little-endian, as both sources are: CPER by definition, PCIe registers on the wire. Read it with get_unaligned_le32(), since a CPER section sits wherever firmware put it, and take the two source IDs out of the Error Source Identification register by bit position rather than byte offset. cxl_rch_get_aer_info() uses readl(), so it hands back __le32. Convert all three callers. cxl_rch_get_aer_info() now reads the whole MMIO block, so size its ioremap by the hardware registers (96 bytes) rather than by sizeof(struct aer_capability_regs) (100). Shrinking the mapping is safe: the read it replaces stopped at 44 bytes. Reported-by: sashiko-bot@kernel.org Closes: https://sashiko.dev/#/patchset/20260904172337.1409775-1-dave.jiang@intel.com?part=5 Link: https://lore.kernel.org/linux-cxl/CAJZ5v0hDv11cPuztPZsaDd7uwD_49KznJy=tzuRO+dZc=CnAEQ@mail.gmail.com/ Assisted-by: LLM Signed-off-by: Dave Jiang <dave.jiang@intel.com> Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com> Link: https://patch.msgid.link/20260911164705.841407-1-dave.jiang@intel.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-10-01mlx5: Move data direct infrastructure to mlx5_coreLeon Romanovsky
Data direct support currently lives in mlx5_ib, which owns the data direct PCI driver, device matching and resource management. To prepare for data direct support in netdev, move this infrastructure to mlx5_core and provide a common interface for its consumers. The series first replaces the direct IB unbind callback with a blocking notifier chain, allowing multiple consumers to receive unbind events. It then separates consumer registration from initialization, consolidates the per-device state and resources, and keeps IB-specific locking and MR teardown in mlx5_ib. With these preparations in place, the final patch moves the shared implementation and PCI driver to mlx5_core. Data direct initialization and resource creation run during core load, before consumers attach; cleanup runs during core unload, after consumers detach. The data direct PCI driver is also explicitly named "mlx5_dd", replacing the previous "mlx5_ib" name derived from KBUILD_MODNAME. This series by Dragos prepares the shared infrastructure for netdev support. The netdev consumer will follow in a separate series. Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-10-01mlx5: Move data direct implementation to mlx5_coreDragos Tatulea
As data direct will also be used by netdev devices, move the data direct code to mlx5_core. Now mlx5_core is responsible for data direct initialization and resource creation. Now data_direct is initialized in mlx5_load() before attaching consumers and clean it up in mlx5_unload() after detaching them. The data direct PCI driver is moved and registered in mlx5_core. IB specific work stays in mlx5_ib: notifier registration, mutex initialization and MR list initialization. Failure to query the VUID is now fatal because this is done only on devices that support data direct. Other than this, this patch has no additional functional changes. Signed-off-by: Dragos Tatulea <dtatulea@nvidia.com> Link: https://patch.msgid.link/20260930114227.139274-11-tariqt@nvidia.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-10-01RDMA/mlx5: Consolidate data direct state into one objectDragos Tatulea
There are three per device data direct objects: mlx5_data_direct_dev, mlx5_data_direct_resources and mlx5_data_direct_registration with separate allocations. This patch consolidates all of them into the registration object. For this, a few things needed to happen: - mlx5_ib_dev keeps a pointer to mlx5_data_direct. - mlx5_data_direct_dev is now accessible from mlx5_data_direct. mlx5_data_direct_get_dev() is added as a helper to access the device pointer. - Since mlx5_data_direct is part of mlx5_data_direct_registration, getting to the registration is a simple container_of. No need for searching the list. Since mlx5_data_direct_resources no longer has an accurate name, this patch renames it. This is a preparation for the upcoming move of data_direct to mlx5_core. This patch has no functional changes. Signed-off-by: Dragos Tatulea <dtatulea@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260930114227.139274-9-tariqt@nvidia.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-10-01RDMA/mlx5: Add new registration stage for data direct usersDragos Tatulea
For the upcoming move of data direct to mlx5_core driver, the API needs to be split into init and register stages. That's because only the core will do the init phase but both IB and netdev devices will need to register. While data direct still lives in mlx5_ib, do all steps in mlx5_ib_data_direct_init(). While at it, make mlx5_data_direct_query_vuid() private as it is no longer needed. This patch has no functional changes. It is a preparation for moving data direct infrastructure to mlx5_core. For this reason the new functions are added to the new header. Signed-off-by: Dragos Tatulea <dtatulea@nvidia.com> Reviewed-by: Leon Romanovsky <leonro@nvidia.com> Reviewed-by: Cosmin Ratiu <cratiu@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260930114227.139274-7-tariqt@nvidia.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-10-01RDMA/mlx5: Make the data direct VUID query self-containedDragos Tatulea
mlx5_cmd_query_vuid() in cmd.c is generic over the data_direct flag but its only caller is the data direct init path, which always passes data_direct=true. Move it into data_direct.c as mlx5_data_direct_query_vuid(), dropping the always-true parameter and hardcoding data_direct=1. This groups the query with the rest of the data direct code so that it travels together when the data direct matching code is relocated to mlx5_core, and lets it become static there once the query is folded into the core bind path. This function will become private in a subsequent patch. No functional change. Signed-off-by: Dragos Tatulea <dtatulea@nvidia.com> Reviewed-by: Leon Romanovsky <leonro@nvidia.com> Reviewed-by: Cosmin Ratiu <cratiu@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260930114227.139274-4-tariqt@nvidia.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-10-01RDMA/mlx5: Add mlx5_data_direct_supported() helperDragos Tatulea
The data direct capability FW checks are duplicated inline in mlx5_ib_data_direct_init() and mlx5_ib_data_direct_cleanup(). Wrap it in a mlx5_data_direct_supported() helper and use it in both places, in preparation for moving the data direct matching code to mlx5_core. For the same reason put it in driver.h instead of data_direct.h. No functional change. Signed-off-by: Dragos Tatulea <dtatulea@nvidia.com> Reviewed-by: Leon Romanovsky <leonro@nvidia.com> Reviewed-by: Cosmin Ratiu <cratiu@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260930114227.139274-3-tariqt@nvidia.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-10-01can: fix unique skb identifier regression under RPSOliver Hartkopp
Commit d4fb6514ff8e ("can: use skb hash instead of private variable in headroom") moved the per-skb unique identifier used for raw_rcv() duplicate detection into skb->hash. With RPS enabled, get_rps_cpu() calls skb_get_hash() before the frame reaches the CAN subsystem. Since CAN skbs have no L3/L4 headers, the flow dissector assigns every CAN frame the same non-zero software hash. can_set_skb_uid() only generated a new identifier when skb->hash was 0, so it kept this constant hash. When the SLAB allocator later reused the same skb address, raw_rcv() mistook the next legitimate frame for a duplicate and dropped it. Fix this by storing the CAN UID in the CAN skb extension (struct can_skb_ext::can_skb_uid) instead of skb->hash, decoupling it from any hash the network stack may compute. can_set_skb_uid() keeps its "assign only if unset" behaviour, which preserves UIDs set before transmission (e.g. by isotp to identify echo frames) across the local loopback path. Frames whose extension is shared with another clone (e.g. via tc mirred or netem duplicate) are given a private extension copy before the UID is assigned, so that independently received skb clones from real CAN interfaces (can_skb_uid = 0) don't end up with the same UID. The limitation that tc mirred/netem skb duplicates might be dropped in raw_rcv for looped back isotp echo frame skbs is accepted. There is no valid use-case for tc mirred or netem together with isotp which is not capable to operate on different CAN interfaces simultaneously. For routing and modifying CAN frames together with isotp use can-gw. can-gw and vxcan additionally clear the UID of forwarded/duplicated frames so each newly routed frame gets its own unique identifier. Fixes: d4fb6514ff8e ("can: use skb hash instead of private variable in headroom") Reported-by: Joerg Willmann <joe@clnt.de> Closes: https://lore.kernel.org/linux-can/2859AD3D-C805-41A0-9036-C5E8EE152419@clnt.de/ Cc: stable@vger.kernel.org Tested-by: Oliver Hartkopp <socketcan@hartkopp.net> Tested-by: Joerg Willmann <joe@clnt.de> Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net> Link: https://patch.msgid.link/20261001115724.27192-1-socketcan@hartkopp.net Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2026-10-01module: Remove the error-injection.h include from linux/module.hPetr Pavlu
linux/module.h appears in roughly 15k #include directives across the kernel. This makes it a "hot" header, so it should avoid pulling in unnecessary definitions. The header currently includes linux/error-injection.h to obtain the definition of `struct error_injection_entry`. However, this is unnecessary because the type is only referenced in the file as a pointer, for which an incomplete type is sufficient. Remove the linux/error-injection.h include from linux/module.h and add it to kernel/module/main.c instead, where `sizeof(struct error_injection_entry)` is actually needed. Reviewed-by: Aaron Tomlin <atomlin@atomlin.com> Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
2026-10-01syscalls: Include error-injection.h for ALLOW_ERROR_INJECTION()Petr Pavlu
include/linux/compat.h and include/linux/syscalls.h use ALLOW_ERROR_INJECTION(), which is defined in asm-generic/error-injection.h. They currently rely on that header being included indirectly through other files, typically via linux/module.h -> linux/error-injection.h. Add the missing include in preparation for removing the linux/error-injection.h include from linux/module.h. Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
2026-10-01coresight: trbe: Hide enable_sink sysfs fileJames Clark
TRBE doesn't support sysfs mode, but the enable_sink file can still be successfully written to enable the device, and only attempting to enable the source would later fail. Avoid misleading users by adding a flag that devices can use to hide either the enable_sink or enable_source files, and set it for TRBE. Don't set it for ETE as it's possible that ETE could appear on the legacy bus and work with sysfs, and writing to enable_source already reports EINVAL if the device doesn't support sysfs mode. Signed-off-by: James Clark <james.clark@linaro.org> Reviewed-by: Leo Yan <leo.yan@arm.com> Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com> Link: https://lore.kernel.org/r/20260807-james-cs-hide-trbe-enable-v2-1-0b2af223feed@linaro.org
2026-10-01pps: generators: don't use the driver's info after unregisterDanish Khateeb
A file that was opened before pps_gen_unregister_source() keeps pps_gen, and with it the pointer to the driver's pps_gen_source_info. PPS_GEN_SETENABLE and PPS_GEN_USESYSTEMCLOCK keep using that pointer after the driver has gone: - pps_gen_tio allocates its info with devm_kzalloc(), so after an unbind both ioctls read freed memory, and SETENABLE calls the driver's enable() with its freed private data. - pps_gen-dummy does not set info->owner, so it can be unloaded while the file is open, and the ioctls then read the unloaded module's data and call its code. TIO can't probe in a VM, as it needs ART. A test driver that registers its info in devm memory like TIO does, unbound while /dev/pps-gen0 is open, gives: BUG: KASAN: slab-use-after-free in pps_gen_cdev_ioctl+0x4c1/0x580 Read of size 1 at addr ffff88800e647f38 by task ppsgen64/145 ... Freed by task 146: kfree+0x25a/0x6d0 release_nodes+0xd1/0x140 devres_release_all+0x10e/0x1a0 device_unbind_cleanup+0x71/0x250 device_release_driver_internal+0x41b/0x570 unbind_store+0xd9/0x100 and unloading pps_gen-dummy while its file is open oopses: BUG: unable to handle page fault for address: ffffffffa0203040 Oops: Oops: 0000 [#1] SMP KASAN NOPTI RIP: 0010:pps_gen_cdev_ioctl+0x372/0x580 Protect info in the ioctl handler with a mutex, and clear it under the mutex on unregister, so that unregister waits for the ioctls using it and later ones fail with -ENODEV. PPS_KC_BIND does the same for a removed PPS device since commit 3649f9a6b897 ("pps: don't allow PPS_KC_BIND on removed devices"). The sysfs attributes need nothing new: they are removed, and their callbacks drained, before info is cleared. Fixes: 86b525bed275 ("drivers pps: add PPS generators support") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Danish Khateeb <danishkhateeb03@gmail.com> Acked-by: Rodolfo Giometti <giometti@enneenne.com> Link: https://patch.msgid.link/20260929124937.51114-3-danishkhateeb03@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-10-01pps: generators: fix use-after-free when closing a removed deviceDanish Khateeb
The cdev of a PPS generator is embedded in struct pps_gen_device, but nothing ties the lifetime of that structure to the cdev: pps_gen is freed by the release function of its device, and an open file holds a device reference only until pps_gen_cdev_release() drops it. When the generator is unregistered while /dev/pps-genN is open, that put_device() drops the last reference and frees pps_gen, and __fput() then calls cdev_put() on the freed cdev: BUG: KASAN: slab-use-after-free in cdev_put+0x53/0x60 Read of size 8 at addr ffff88801383e138 by task ppsgen64/149 Call Trace: cdev_put+0x53/0x60 __fput+0x745/0xad0 fput_close_sync+0xd9/0x1b0 __x64_sys_close+0x86/0xf0 ... Freed by task 149: kfree+0x25a/0x6d0 device_release+0xca/0x3c0 kobject_put+0x169/0x320 pps_gen_cdev_release+0x51/0x80 __fput+0x36a/0xad0 pps.c had the same bug, fixed in commit c79a39dc8d06 ("pps: Fix a use-after-free"). Fix it the usual way: embed the struct device in pps_gen_device and register both with cdev_device_add(). This makes the device the parent of the cdev, so the cdev holds a device reference until the last file is closed. Fixes: 86b525bed275 ("drivers pps: add PPS generators support") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Danish Khateeb <danishkhateeb03@gmail.com> Acked-by: Rodolfo Giometti <giometti@enneenne.com> Link: https://patch.msgid.link/20260929124937.51114-2-danishkhateeb03@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-10-01Merge tag 'net-7.3-rc6' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from Bluetooth, WiFi and netfilter. We are actively retargeting several non-urgent fixes towards next, but the traffic on the ML looks ever-increasing, and propagating the push-back towards subsystems is not immediate. No known outstanding regressions. Current release - regressions: - netfilter: nft_set_rbtree: skip transaction elements during GC Previous releases - regressions: - sched: cls_api: reclaim an empty proto on the error path - core: - fix checksum offsets in skb_splice_from_iter() - cap skb->queue_mapping when the tx queue is picked - page_pool: fix use-after-free in page_pool_recycle_ring_bulk() - wifi: - mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue() - mac80211: drop oversized fragments to avoid extra_len overflow - netfilter: - flowtable: restore ieee80211 forward path - bluetooth: hci_conn: Lock parent access during enhanced SCO setup - eth: - bcmgenet: allocate RX buffers as page fragments - stmmac: fix rx Scatter-Gather support - octeontx2-pf: fix aura BPID assignment when CONFIG_DCB is enabled - gve: DQO: accept TSO packets with non-protocol gso_type bits - r8169: disable EEE on RTL8168h/8111h Previous releases - always broken: - tcp: refresh TS.Recent for accepted old ACKs - wifi: - ath11k: reset ar->num_stations on hardware start - cfg80211: fix RTS threshold setting for single-radio PHY - bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame() - eth: bcmgenet: fix NULL dereference in set_coalesce before first open Misc: - Eric is retiring from google and updating his contact info" * tag 'net-7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (96 commits) net: phy: aquantia: fix system interface type not updated in forced mode net: usb: qmi_wwan: add Rolling Wireless RN947R net: mvneta: clear XDP pfmemalloc flag between frames ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel() net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference r8169: disable EEE on RTL8168h/8111h octeontx2-pf: Fix RSS indirection table size sctp: check RCV_SHUTDOWN after the sendmsg connect wait net: sparx5: make ports inherit the switch base mac address type net: microchip: vcap: stop scanning after deleting key field netfilter: flowtable: restore ieee80211 forward path netfilter: flowtable: generalize pending status bit netfilter: bpf: reject invalid NAT manipulation types netfilter: nft_set_rbtree: skip transaction elements during GC ipvs: filter some flags received in the backup server ipvs: do not create invisible templates ipvs: bound LBLCR and LBLC cache growth ipvs: fix missing counter decrement in lblc netfilter: nft_flow_offload: drop flowtable reference on init error path selftests: net: check timestamp echo after an old ACK ...
2026-10-01unshare: don't drop active namespace references that were never takenChristian Brauner
Active references on the namespaces of an nsproxy are taken when the nsproxy is installed into a task in switch_task_namespaces() and copy_namespaces() and dropped again by put_nsproxy() through deactivate_nsproxy(). But ksys_unshare() calls put_nsproxy() on an nsproxy that was never installed when set_cred_ucounts() fails. The new namespaces of that nsproxy go from zero to minus one and the namespaces shared with the caller lose a reference that belongs to the nsproxy the caller keeps using: WARNING: kernel/nscommon.c:171 at __ns_ref_active_put+0x1cd/0x230 nsproxy_ns_active_put deactivate_nsproxy ksys_unshare Afterwards the namespaces the caller lives in aren't listed by listns() anymore. set_cred_ucounts() only fails when alloc_ucounts() can't allocate and it only allocates when the real uid of the caller differs from its effective uid. Commit cefd55bd2159 ("nsproxy: fix free_nsproxy() and simplify create_new_namespaces()") separated the two cases on purpose. nsproxy_free() frees an nsproxy that was prepared but never installed and that's what a failed setns() uses in put_nsset(). Export it and use it for a failed unshare() as well. Fixes: a98621a0f187 ("unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure") Cc: stable@vger.kernel.org # v7.1+ Link: https://patch.msgid.link/20260930-work-mount-fixes-3-v1-16-be34c83956ae@kernel.org Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-10-01perf: Replace perf_event_header__init_id with full header initIan Rogers
perf_iterate_sb() invokes its callback for each matching perf_event on the CPU and task context, passing a shared caller-allocated event structure. perf_event_header__init_id() mutated header->size in place by adding event->id_header_size, requiring sideband output callbacks to save and restore header fields across iterations. Three sideband callbacks failed to save and restore header.size around perf_event_header__init_id(): - perf_event_ksymbol_output() - perf_event_bpf_output() - perf_event_text_poke_output() When multiple events with attr.ksymbol, attr.bpf_event, or attr.text_poke and sample_id_all are active on the same CPU, each subsequent event receives a record whose header.size is inflated by all preceding events' id_header_size values while only a single id_sample is written, leaving uninitialized ring-buffer bytes at the end of the record and causing userspace perf to fail with -EFAULT ("Bad address") when parsing the sample_id trailer. Similarly, perf_event_mmap_output() set PERF_RECORD_MISC_MMAP_BUILD_ID in mmap_event->event_id.header.misc when event->attr.build_id was enabled, but only saved and restored header.size and header.type. If an event with attr.build_id was followed by an event with attr.mmap2 and !attr.build_id, the second event received PERF_RECORD_MISC_MMAP_BUILD_ID in header.misc while its payload contained maj/min/ino/ino_generation instead of a build ID. Rather than splitting header initialization between callers and output callbacks and saving/restoring mutated header fields, replace perf_event_header__init_id() with perf_event_header__init(), which initializes header->type, header->misc, and header->size alongside the sample_id fields on each invocation. Fixes: 76193a94522f ("perf, bpf: Introduce PERF_RECORD_KSYMBOL") Fixes: 6ee52e2a3fe4 ("perf, bpf: Introduce PERF_RECORD_BPF_EVENT") Fixes: e17d43b93e54 ("perf: Add perf text poke event") Fixes: 88a16a130933 ("perf: Add build id data in mmap2 event") Assisted-by: Antigravity:gemini-3.1-pro Signed-off-by: Ian Rogers <irogers@google.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://patch.msgid.link/20260929222332.973435-1-irogers@google.com Cc: stable@vger.kernel.org
2026-10-01irq_work: Flush lazy work CPU down on PREEMPT_RTSebastian Andrzej Siewior
PREEMPT_RT invokes IRQ_WORK_LAZY callbacks and callbacks which are not explicitly marked IRQ_WORK_HARD_IRQ from thread context. If a CPU gets shutdown, the irq_work is flushed during smpcfd_dying_cpu() which is invoked on the target CPU with disabled interrupts. The callbacks enqueued on lazy_list on PREEMPT_RT are not flushed because they require thread context. The callbacks remain and get processed once the CPU gets back online. per-CPU irq_work items continue to work for enqueues on their local-CPU, only the work on the "offline" CPU get stuck. "Single" irq_work are worse because they remain "claimed" and can not be used again. One "symptom" is the late printk() in CPU down path which enqueues the irq_work for printing but it never gets scheduled. Further prints don't print to the console because the irq_work is "pending" of the offline CPU. Another problem is the canceling/ flushing of the irq_work which is stuck. Since the irq_work will not continue, the task waiting for its completion will block waiting. While looking through the users of irq_work, it does not matter if the callback is enqueued on another CPU. This makes it possible to invoke the callbacks from a remote CPU by smpcfd_dead_cpu(). This is invoked from the control CPU with enabled interrupts shortly after the hotplugged CPU is shutdown so the llist can be accessed safely. Add irq_work_run_cpu() which invokes the irq_work callbacks of the specified dead CPU. Invoke it from smpcfd_dead_cpu(). Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://patch.msgid.link/20260911143815.997254-3-bigeasy@linutronix.de
2026-10-01sched: Set TIF_NEED_RESCHED before calling __trace_set_need_resched()Sechang Lim
set_tsk_need_resched() tests TIF_NEED_RESCHED, calls __trace_set_need_resched() if the flag is clear, then sets it via set_tsk_thread_flag(). A BPF raw_tp program attached to sched_set_need_resched executes synchronously inside __bpf_trace_run(). On return, __bpf_trace_run() drops the RCU lock with rcu_read_unlock_migrate(), which on the preempt-or-BH-disabled path calls set_need_resched_current() -> set_tsk_need_resched() again. set_tsk_thread_flag() follows the tracepoint call, so every re-entrant frame sees TIF_NEED_RESCHED clear and calls __trace_set_need_resched() again: BUG: TASK stack guard page was hit at ffffc9001224ff98 Oops: stack guard page: 0000 [#1] SMP KASAN PTI RIP: 0010:__bpf_trace_sched_set_need_resched_tp+0x1c/0x190 Call Trace: trace_sched_set_need_resched_tp+0x110/0x130 set_tsk_need_resched include/linux/sched.h:2076 set_need_resched_current include/linux/sched.h:2094 rcu_read_unlock_special+0x43a/0x440 __rcu_read_unlock+0x9e/0x120 rcu_read_unlock_migrate+0xa9/0x240 __bpf_trace_run+0x131/0x180 bpf_trace_run3+0x333/0x430 __bpf_trace_sched_set_need_resched_tp+0x13a/0x190 trace_sched_set_need_resched_tp+0x110/0x130 set_tsk_need_resched include/linux/sched.h:2076 ... __resched_curr() has the same ordering, firing the tracepoint before setting the flag via set_ti_thread_flag() or set_nr_and_not_polling(). Fix it for consistency. Replace the separate test_tsk_thread_flag() + set_tsk_thread_flag() pair in set_tsk_need_resched() with test_and_set_tsk_thread_flag(). In __resched_curr(), move the tracepoint call after the flag is set in each path. Fixes: adcc3bfa8806 ("sched: Adapt sched tracepoints for RV task model") Signed-off-by: Sechang Lim <rhkrqnwk98@gmail.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Andrea Righi <arighi@nvidia.com> Acked-by: Gabriele Monaco <gmonaco@redhat.com> Link: https://patch.msgid.link/20260630084750.2792851-1-rhkrqnwk98@gmail.com
2026-10-01Merge tag 'iio-for-7.4a' of ↵Greg Kroah-Hartman
ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-next Jonathan writes: IIO: 1st set of device support, features and cleanup for 7.4 2 merges - v7.3-rc4 to get a x86 build fix needed by the ad9910 driver. - devm_notifier_chain_register to pick up the IIO specific users of this new infrastructure. New device support ------------------ Major refactors or new drivers needed: adi,ad3530r - Support for the AD5710R and AD5711R 8 channel IDAC / VDAC parts. Needed substantial driver rework to support channel type controls. adi,ad5529r - New driver for this 16 channel DAC with 12 and 16 bit variants. adi,ad7768 - New driver for the 8 (AD7768) and 4 (AD7768-4) channel variants of this 24-bit simultaneous sampling ADC family. They are very different from the 1 channel variant that has as separate driver. adi,ad9910 - New driver for this DDS (Direct Digital Synthesizer). This was a large undertaking is it is a complex chip requiring quite a lot of new IIO ABI. Delayed from last cycle by an x86 bug that was fixed in rc4. adi,ade9000 - Add support for the ADE9078 polyphase energy metering device. Required significant changes to introduce multiple part support into this driver. adi,adis16201 - Add support for the ADIS16203 device, replacing the driver in staging. axiado,saradc - New driver for the SARADC found on the AX3000 and ADX3005 SoCs. liteon,ltr501 - Add support for the LTR-329ALS-01 ambient light sensor. Included various bits of driver modernization. microchip,mcp48fev02 - Split previously I2C specific mcp47feb02 into core and I2C specific parts. - Add an SPI specific part for the many parts in the MCP48FxBy1/2/4/8 series of SPI DACS 24 different part numbers covering: - 8, 10 and 12 bit resolutions - 1, 2, 4, and 8 channels - EEPROM and no non volatile storage variants. - Substantial driver modification and cleanup was needed prior to the new support. maxim,max40080 - New driver for this current-sense amplifier with integrated ADC. renesas,rzg2l_adc - Support the RZ/G3L ADC 1 that is dedicate to the on-chip thermal sensor unit. The thermal parts of this support will be going through that tree. sensortek,stk3310 - Add support for the STK36C61 Ambient Light, proximity and RGB color sensor. Handling had to be added for RGB elements and the driver in general had to be made ready for support multiple parts. ti,ads1100 - Add support for the ADS1110 with faster data rate and 2.048V reference. ti,ads112c04 - New driver to support this 16bit sigma-delta ADC. vishay,veml6031x00 - New driver for this ambient light sensor that was built in in stages. - Add triggered buffer data capture. - Add support for events and triggers. - Enable mysterious 'internal calibration' setting. Minor additions such as IDs, compatibles or device specific data. adi,ad3530r - Support the AD3536R which is low resolution equivalent of the already supported AD3532R. adi,ad4080 - Support the AD4885 - only needed chip specific data. aosong,am2315 - Add support for the AM2320, fully compatible wth the AM2315. invensense,icm42600 - Minor tweaks + addition of compatible for the ICM42630 IMU. mediatek,mt2701-adc - Compatible for the MT6572 rockchip,saradc - Support the RV1106. Features -------- IIO Core - Add a helper to discover if timestamps are enabled. In a few cases (typically when there is batching involved) we may have to refuse to start the buffer if timestamps are enabled. Provided a helper to allow that to be queried. IIO backend - CRC support. infineon,dps310 - Add triggered buffer support. linear,ltc2497 - Add 2x conversion speed mode. - Add the internal temperature channel. renesas,r9a09g077 - Add missing DMA properties to DT and enable use of DMA - Expose the sampling frequency as per channel attributes. ti,ad1015 - Add per channel labels from DT support. ti,ads112c14 - Add dataready trigger using continuous mode if only one channel is enabled. - Add burnout current control including new IIO ABI. - Add filter control. - Add new ABI for settling time. Cleanup and minor or late breaking fixes ---------------------------------------- Only calling out the more significant changes or ones that were carried on out on several drivers. multiple drivers - Add sanity check for spi_device_get_match_data() returning NULL due to use of driver_override. - Add some useful __counted_by_ptr markings. - Add some missing MODULE_DEVICE_TABLE() calls. - Use dmaenginge_get_dma_device() instead of chan->device->dev - A few precursor cleanups for planed devm_ object allocators. - Disable autosuspend on exit. Note there is work ongoing to make this unnecessary. - Header reorders and IWYU being applied to what was included. - Use devm_blocking_notifier_chain_register() to replace open coded equivalent. - Ensure some clk related structures are always fully initialized. - Use the size checked iio_push_to_buffers_with_ts() replacement for iio_push_to_buffers_with_timestamp(). - Avoid shadowing various error codes from store() callbacks. adi,axi-adc - Fix missing mutex_init() adi,ad4080 - Ensure autoincrement is set for multi register reads. adi,ad5758 - Fix wrong offset calculation - Reject out of range values rather than truncating values. - Make sure buffer used for bulk acceses is DMA safe. adi,ad7816 - Local lock to protect state by serializing accesses. A few extra locations were added much later in the cycle. - Stop using non DMA safe buffers by using spi_write_then_read() to ensure the data was bounce buffered. adi,adxl367 - Ensure interrupt mapping is resolved before device setup reducing work done before potential deferral. - Support INT2 pin. asahi-kasei,ak8975 - Use BIT() and GENMASK() to improve readability of defines. - Add an enum for scan mask elements. - Switch to devm_ for all resources. avago,apds9306 - Fix the default sampling frequency. awinc,aw96103 - Fix an early return that stopped all channels being checked. broadcom,iproc-adc - General modernization and conversion to devm managed cleanup. - Use dev_err_probe(), local dev pointer and drop some duplicate error messages. capella,cm32181 - Add device specific dt-binding as trivial-devices doesn't provide vdd-supply or interrupt properties. freescale,mma8452 - Modernize driver via guard(), IIO specific cleanup helpers and bulk regulator handling. infineon,dps310 - Add context analysis lock markings. - Single local acquire / release per raw read. - Replace opencoded get_unaligned_be24(). - Fix incorrect CFG_REG bit definitions. invensense,icm42600 - Ensure ODR is updated when switching power mode to paper over a hardware bug. - Fix detecting ODR change in invalid data packets. - Optimize high frequency data readback by not bothering to read the FIFO count when the watermark is known to have been passed. - Various other minor fixes. isil,isl29028 - Fix a runtime pm reference leak. liteon,ltr501 - Make the dt-binding property proximit-near-level only available on parts that support it. kionix,kx022a - Use as structure to make the channel layout explicit and use that for all cases (previously there were two similar buffers). pulsed-light,lidar-lite-v2 - Move binding from trivial-devices to it's own file as there are power enable and mode control pins that needs describing. renesas,r9a09g077 - Drop some interrupt descriptions for interrupts that aren't connected to the interrupt controller. - Avoid direct reads when buffer enabled. - Store the device PA and IRQ in state ready for the DMA support. st,hts221 - Fix a potential division by zero if calibration data corrupted. - Allow an unknown Who Am I value to support fallback dt-compatibles. - Replace opencoded oversampling_ration_available handling with read_avail callback. st,stm32-adc - Fix up some wrong minimum sample times. ti,ads1100 - Fix readings after datarate change by ensuring a long enough wait for a new sample. ti,tmp117 - Fix case where cached state was updated before we know if the write to the device succeeds. vishay,veml3328 - Reshape the scale array to improve readability as it is made up of value pairs. * tag 'iio-for-7.4a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio: (270 commits) iio: dac: ad5758: Fix the offset calculation iio: dac: ad5758: Reject out-of-range raw values iio: dac: ad5758: Fix alignment for DMA safety iio: pressure: dps310: check the lock markings with context analysis iio: core: add an accessor for scan_timestamp iio: pressure: dps310: add triggered buffer support iio: pressure: dps310: take the lock once per raw read iio: pressure: dps310: use get_unaligned_be24() for the 24-bit results iio: pressure: dps310: use a local device pointer in probe iio: pressure: dps310: fix CFG_REG bit definitions staging: iio: adc: ad7816: Protect sysfs attributes with mutex dt-bindings: iio: Add dedicated CM32181 schema iio: adc: stm32: fix minimum sampling time values iio: light: veml6031x00: Enable internal calibration iio: dac: add support for Microchip MCP48FEB02 dt-bindings: iio: dac: add support for MCP48FEB02 SPI iio: dac: mcp47feb02: refactor MCP47FEB02 I2C driver into two modules iio: dac: mcp47feb02: protect EEPROM store sequence with mutex iio: dac: mcp47feb02: Avoid unjustified probe error on missing label iio: adc: rzg2l_adc: Add RZ/G3L ADC support for TSU ...
2026-10-01Merge tag 'nf-26-09-30' of ↵Paolo Abeni
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter/IPVS fixes for net The following batch contains Netfilter fixes for net. This batch fixes crashes as recent feature regression, one of the due to a dependency that has been pulled into -stable: 1) Expand existing ipset fix for bitmap sets to disallow comments updates from kernel-side adds, from Florian Westphal. 2) Drop flowtable reference if nf_ct_netns_get() fails, otherwise flowtable cannot ever be removed, from Aohan Mei. 3) nft_rbtree GC should collect end elements that contained in this transaction batch, new or deleted elements are never expired. From Weiming Shi. 4) Restrict nf_nat_bpf so it does not set unknown NF_NAT_MANIP_* values, from Fernando F. Mancera. 5) Flowtable GC must skip flows that are pending hardware updates, generalize the PENDING flag and use it to inhibit GC. 6) Restore flowtable with ieee80211 which broke due to a relatively recent commit, which was pulled in by -stable, causing a regression in 6.18 kernels. And the following IPVS fixes: 1) Fix accounting of cache entries in IPVS LBLC for destinations, which eventually fills up the table and trigger recurrent resizing, from Julian Anastasov. 2) Limit IPVS cache growth for LBLCR and LBLC schedulers, from Zhiling Zou. 3) Restrict IP_VS_CONN_F_ONE_PACKET for normal connections, do not allow to use it with templates. Also from Julian. 4) Sanitize flags in IPVS sync messages received in the backup. From Julian Anastasov. netfilter pull request 26-09-30 * tag 'nf-26-09-30' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: flowtable: restore ieee80211 forward path netfilter: flowtable: generalize pending status bit netfilter: bpf: reject invalid NAT manipulation types netfilter: nft_set_rbtree: skip transaction elements during GC ipvs: filter some flags received in the backup server ipvs: do not create invisible templates ipvs: bound LBLCR and LBLC cache growth ipvs: fix missing counter decrement in lblc netfilter: nft_flow_offload: drop flowtable reference on init error path netfilter: ipset: do not update comments from kernel-side adds ==================== Link: https://patch.msgid.link/20260930074142.298353-1-pablo@netfilter.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-10-01tty: fix saved termios reset raceJohan Hovold
Resetting saved termios state on device registration is needed where a minor number can be reused for an entirely different device and where the old settings may prevent the port from even being opened (e.g. when CLOCAL is not set). Not all TTY drivers guarantee that the minor number is no longer in use when registering devices however, something which can lead to a use-after-free when closing a TTY (and saving its termios) races with re-registration. Add a new TTY_DRIVER_RESET_SAVED_TERMIOS flag to request that any saved termios state is reset on registration and only set it for drivers that make sure that the minor number is no longer in use. Fixes: 93857edd9829 ("tty: reset termios state on device registration") Reported-by: Chengfeng Ye <nicoyip.dev@gmail.com> Link: https://lore.kernel.org/20260926184154.3017929-1-nicoyip.dev@gmail.com Cc: stable@kernel.org # 4.12 Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260930131845.1809256-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-10-01llc: move the type 2 sockets out of treeJakub Kicinski
802.2 LLC is only used in tree by protocols which need the connectionless type 1 subset: STP, which carries the bridge's BPDUs, GARP, which sends its own UI PDUs, and SNAP. The llc2 module on top of the core - the type 2 connection state machine, the type 1 SAP state machine, the station component and the PF_LLC socket family - has no in-kernel users and nobody who can test it; what we get instead is a slow trickle of drive-by fixes. There was a recent patch from Ernestas Kulik indicating potential real life use, but it was new/experimental and that person is not responding to off-list pings. Let LLC2 follow AX.25, hamradio and AppleTalk out of the Linux tree. We will maintain the code at: github.com/linux-netdev/mod-orphan for anyone interested in playing with it. PF_LLC goes in full, both the class two SOCK_STREAM and the class one SOCK_DGRAM half, and so do /proc/net/llc/ and /proc/sys/net/llc/. Note that the kernel also stops answering XID and TEST commands, addressed to a SAP or to the station - those are type 1, but they lived in the module, and they got answered whether or not any socket was open. Nothing in tree asks for them; what the core keeps is SAP registration and the UI path the in-tree users need. Retain the uAPI for now, like we did for AppleTalk. Only the socket ABI half of it is vestigial: STP, GARP, the bridge and openvswitch use the SAP numbers it defines. Cleaning up what the core no longer needs follows in the next patch. Signed-off-by: Jakub Kicinski <kuba@kernel.org> Link: https://patch.msgid.link/20260928190800.2521749-2-kuba@kernel.org Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-09-30x86,fs/resctrl: Add event group descriptions for Intel Diamond RapidsTony Luck
Intel Diamond Rapids exposes Application Energy Telemetry through two new PMT aggregator GUIDs: one covering the "energy" feature, and one covering the "perf" feature, both documented in the Intel-PMT XML repository at https://github.com/intel/Intel-PMT The "perf" aggregator references two events not previously enumerated by resctrl: retired instructions (INST_RETIRED), and a count of unhalted core clock cycles perceived by hardware as contributing to instruction execution (PCNT). Add definitions for both aggregators, and add the two new events to the resctrl filesystem so they can be exposed to user space. Signed-off-by: Tony Luck <tony.luck@intel.com> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Reviewed-by: Reinette Chatre <reinette.chatre@intel.com> Link: https://patch.msgid.link/20260930171554.12794-1-tony.luck@intel.com
2026-10-01Merge tag 'topic/pci-vgaarb-rework-2026-10-01' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/kernel into drm-next pci/vgaarb rework for drm/vfio This reworks the vgaarb API to be a bit more sane. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Dave Airlie <airlied@gmail.com> Link: https://patch.msgid.link/CAPM=9tzd3LteJG-Au=na-_X5Rff4tacFZ3X_cp5g0bCcQkV_jA@mail.gmail.com
2026-09-30s390/ism: Zerorize dmb at allocationAlexandra Winter
Sashiko reported [1] that 'Missing __GFP_ZERO in folio_alloc() causes uninitialized kernel memory to be exposed in the receive message buffer'. An ism dmb is receive-only, so the data is not leaked to a remote peer. In general the smc kernel module (dibs client) will only push newly received data to userspace. We still should not have uninitialized data in a receive buffer. Since commit 750afb08ca71 ("cross-tree: phase out dma_zalloc_coherent()") dma_alloc_coherent no longer required the __GFP_ZERO flag, but when commit 83781384a96b ("s390/ism: Properly fix receive message buffer allocation") switched to folio_alloc(), it should have added back the __GFP_ZERO flag. Add __GFP_ZERO flag and state in dibs.h that register_dbm() provides a zerorized buffer (dibs_lo already does). Link: https://lore.kernel.org/linux-s390/20260903143746.A5CC41F00A3A@smtp.kernel.org/ [1] Fixes: 83781384a96b ("s390/ism: Properly fix receive message buffer allocation") Signed-off-by: Alexandra Winter <wintera@linux.ibm.com> Reviewed-by: Julian Ruess <julianr@linux.ibm.com> Link: https://patch.msgid.link/20260928151420.383105-1-wintera@linux.ibm.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-30net: Revalidate queue config for ringparam changesBjörn Töpel
Memory-provider queue configuration is validated when the provider is bound. A later ethtool ring change may invalidate it because drivers can size queue memory from both ring depth and RX page size. The fbnic consumer is added in the following patch. Keep configured RX ring depths in netdev_config and stage proposed values in cfg_pending. Validate every RX queue before calling the driver. Each check validates the device defaults, then any queue memory-provider override. Commit the values only after the driver accepts them. Drivers which consume stored ring depths through queue configuration must initialize every RX depth before registering the netdev. Stored values override callback defaults, including when zero. The callback receives a rendered configuration rather than a queue ID. Validation should depend on the configuration, not queue identity. Checking defaults also covers the case where every queue has a memory-provider override. Drivers may normalize ring depths when applying them. Require the validation callback to use the same normalization. Drivers must report the applied depths through the ethtool_ringparam argument so the core records the result. Use the same transaction for ioctl and netlink. Drivers without ndo_validate_qcfg skip the new validation. Link: https://lore.kernel.org/all/20250421222827.283737-14-kuba@kernel.org/ Signed-off-by: Björn Töpel <bjorn@kernel.org> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Joe Damato <joe@dama.to> Link: https://patch.msgid.link/20260925104417.2325213-4-bjorn@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-01pinctrl: pinconf-generic: Add property 'input-debounce-ns'Changhuang Liang
Add 'input-debounce-ns' to the generic parameters used for parsing DT files, along with the corresponding configuration parameter PIN_CONFIG_INPUT_DEBOUNCE_NS. This allows debounce time to be specified in nanoseconds as an alternative to the existing 'input-debounce' property which uses microseconds Signed-off-by: Changhuang Liang <changhuang.liang@starfivetech.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-09-30Merge tag 'wireless-next-2026-09-30' of ↵Jakub Kicinski
https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Johannes Berg says: ==================== More features: - ath10k: NVMEM device tree bindings - ath12k: QMI firmware alignments - mm81x: AP improvements - mac80211: - CIP (control frame integrity) support - NAN improvements - cfg80211: - improvements for AP regulatory checks * tag 'wireless-next-2026-09-30' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (67 commits) wifi: mac80211: Gracefully deauthenticate on association timeout wifi: libertas: fix RX OOB access from device-controlled pkt_ptr wifi: mwifiex: Reattach interfaces on suspend failure wifi: b43legacy: work around stack frame size warning wifi: cw1200: fix link_id_db OOB access via device-controlled link ID wifi: mwifiex: bound SDIO fw dump count by memory table size wifi: mac80211: start next ROC after purging an interface wifi: mac80211: fix potential ack-skb leak on error path wifi: mac80211: mesh: don't send peering close in listen wifi: mac80211_hwsim: Support NAN deferred schedule completion wifi: mac80211: Restrict probe request rates for minimal content wifi: nl80211: allow a NAN peer schedule with 2 channels in the same slot wifi: cfg80211: use sysfs_emit_at() in addresses_show wifi: cfg80211: require zero terminator in valid_regdb country table wifi: cfg80211: fix NAN local schedule update ordering and allocation wifi: mac80211: Fix a race when expiring a mesh path wifi: cfg80211: validate monitor channel set against radio usage wifi: nl80211: reject color-change requests that change 6 GHz power type wifi: nl80211: defer AP beacon regulatory check to start_ap wifi: radiotap: add definitions for UHR U-SIG ... ==================== Link: https://patch.msgid.link/20260930124547.228697-29-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-30netfs: clear post-EOF pagecache when extending a file via writePaulo Alcantara
Fix netfs to erase the contents of a hole created after the EOF by an ordinary write if dirty data has been previously left there by writes through an mmapped region. Neither the buffered nor the unbuffered/DIO write path clears that stale pagecache. Zero the tail of the folio straddling the EOF before an extending write. That is the only folio that can hold data written past the EOF through an mmap, as pages wholly beyond the EOF can't be faulted in. The folio is zeroed rather than dropped so a concurrent extending write can't lose data. Both write paths downgrade the i_rwsem to shared, so extending writes can run concurrently and the i_size read by the caller may be stale by the time the folio is locked. Re-read i_size under the folio lock and clamp the zeroed range up to it, so a racing write that already put data into the folio isn't clobbered. Wait for any writeback on the folio to finish before zeroing it so that the pagecache isn't modified while it may still be read by the transport during transmission. Honour IOCB_NOWAIT by returning -EAGAIN rather than blocking on the folio lock, on writeback, or in folio_mkclean()'s rmap walk when the folio is mapped. truncate_pagecache() can't be used here: it must be called with the i_rwsem held exclusively, but these write paths only hold it shared, and it would block unconditionally, breaking IOCB_NOWAIT. Callers that hold i_rwsem exclusively for the whole resize (truncate, setattr, fallocate, clone) exclude any genuine concurrent buffered writer, so staleness can instead be decided from the folio's dirty state, as pagecache_isize_extended() already does for filesystems that serialise writes against truncate/setattr via a single i_rwsem. Export netfs_clear_stale_post_isize() helper to handle such case. The helper is required by the CIFS client to fix generic/363. Closes: https://sashiko.dev/#/patchset/20260921230755.1133425-1-pc%40manguebit.org Fixes: 938e13a73b24 ("netfs: Implement buffered write API") Fixes: 153a9961b551 ("netfs: Implement unbuffered/DIO write support") Reviewed-by: David Howells <dhowells@redhat.com> Reviewed-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Paulo Alcantara <pc@manguebit.org> Cc: Christian Brauner <brauner@kernel.org> Cc: Matthew Wilcox <willy@infradead.org> Cc: Ronnie Sahlberg <ronniesahlberg@gmail.com> Cc: Shyam Prasad N <sprasad@microsoft.com> Cc: Tom Talpey <tom@talpey.com> Cc: Bharath SM <bharathsm@microsoft.com> Cc: stable@vger.kernel.org
2026-09-30spi: realtek: Add support for RTD1625 SPI NOR Flash ControllerMark Brown
Yu-Chun Lin <eleanor.lin@realtek.com> says: This patch series introduces support for the Realtek RTD1625 SPI NOR Flash controller. Link: https://patch.msgid.link/20260930065945.88008-1-eleanor.lin@realtek.com
2026-09-30rtc: mt6397: expose the spare bytes of the alarm registers as nvmemRyan Brue
Each alarm field lives in the low bits of its register and the driver masks its writes accordingly, so the high byte of four of them is storage the RTC never touches. MediaTek names these RTC_NEW_SPARE0 to RTC_NEW_SPARE3 and gives the first to a fuel gauge, which is how its PMIC battery drivers carry a state of charge over a reboot. Offer all four as a battery-backed nvmem provider, so that a consumer does not have to reach into this block behind the driver's back. Doing it here is what makes it safe: a write lands under the same lock the alarm paths take, so it can neither be lost inside mtk_rtc_set_alarm()'s read-modify-write nor fire the write trigger in the middle of one. The nvmem core does not range check a cell against the provider size, so the callbacks check the offset themselves. Tested on an MT6397; MediaTek's spare map for mt6323 matches, and the alarm field masks are common to every compatible this driver binds. Assisted-by: LLM Signed-off-by: Ryan Brue <ryanbrue.dev@gmail.com> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Link: https://patch.msgid.link/20260917-rbrue-suez-upstreaming-mt6397-rtc-nvmem-v1-2-558b8f95cfbc@gmail.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-09-30rtc: omap: remove unused argumentAlexandre Belloni
omap_rtc_power_off_program takes one argument that is never used. One call passes the struct device of the rtc but the other one passes its parent. To avoid confusion, stop taking any argument Reviewed-by: Nishanth Menon <nm@ti.com> Link: https://patch.msgid.link/20260917142654.2576889-1-alexandre.belloni@bootlin.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-09-30i3c: hub: Add support for the I3C interface in the I3C hubLakshay Piplani
Add virtual I3C bus support for the hub and provide interface to enable or disable downstream ports. Signed-off-by: Aman Kumar Pandey <aman.kumarpandey@nxp.com> Signed-off-by: Vikash Bansal <vikash.bansal@nxp.com> Signed-off-by: Lakshay Piplani <lakshay.piplani@nxp.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260922103551.2754613-7-lakshay.piplani@nxp.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-09-30i3c: master: Add APIs for I3C hub supportAman Kumar Pandey
Add CCC helpers to check CCC support and send CCC commands, address slot helpers to query and update I3C bus address slot state, registering virtual masters with an explicit firmware node, and exposing the bus maintenance lock helpers. These additions prepare for I3C hub support. A hub driver needs to reserve and query parent bus address slots, forward CCC commands, register virtual target port controllers using the target-port firmware node, and serialize operations against the parent bus maintenance lock. The hub also forwards private transfers via i3c_dev_do_xfers_locked() and serializes its IBI and private-transfer paths against the shared lock, so the normal-use lock/unlock pair is exposed alongside the maintenance-lock helpers. i3c_master_register_fwnode() allows virtual I3C masters to register using a firmware node different from their parent device node without temporarily modifying parent->of_node. The new helpers are: 1) i3c_master_send_ccc_cmd() 2) i3c_master_supports_ccc_cmd() 3) i3c_bus_get_addr_slot_status() 4) i3c_bus_set_addr_slot_status() 5) i3c_bus_maintenance_lock() 6) i3c_bus_maintenance_unlock() 7) i3c_master_register_fwnode() 8) i3c_bus_normaluse_lock() 9) i3c_bus_normaluse_unlock() 10) i3c_dev_do_xfers_locked() Signed-off-by: Aman Kumar Pandey <aman.kumarpandey@nxp.com> Signed-off-by: Lakshay Piplani <lakshay.piplani@nxp.com> Signed-off-by: Vikash Bansal <vikash.bansal@nxp.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260922103551.2754613-2-lakshay.piplani@nxp.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-09-30firmware: Move firmware attributes class helperSean Rhodes
Move the firmware attributes class helper from drivers/platform/x86 to drivers/firmware and expose its class declaration through a public Linux header. The helper is not x86-specific. Keeping it in drivers/firmware lets coreboot firmware drivers use the standard firmware-attributes ABI without living under platform/x86. Replace the affected drivers' relative helper includes directly with the new public header. Suggested-by: Derek J. Clark <derekjohn.clark@gmail.com> Reviewed-by: Mark Pearson <mpearson-lenovo@squebb.ca> Reviewed-by: Derek J. Clark <derekjohn.clark@gmail.com> Tested-by: Oliver Lin <oliver@liuxiaozhen.dev> Signed-off-by: Sean Rhodes <sean@starlabs.systems> Acked-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Link: https://lore.kernel.org/r/5682c2228fa4a784d3953664b56a06e0dd9ccdef.1788284852.git.sean@starlabs.systems Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>