summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-08-19irqchip/ast2700-intc: Avoid allocating in the irq_domain activate() callbackRyan Chen
The interrupt core calls the irq_domain_activate() callback from __setup_irq() with desc->lock held and interrupts disabled. Both aspeed_intc1_irq_domain_activate() and aspeed_intc0_resolve_route() test a compatible string with fwnode_device_is_compatible(). fwnode_device_is_compatible() invokes fwnode_property_match_string(), which allocates with GFP_KERNEL. That's obviously not possible with interrupts disabled and a raw spinlock held. Both call sites are only ever handed OF nodes, so use of_device_is_compatible() instead: it walks the property in place and does not allocate. Fixes: 07825e41519a ("irqchip/ast2700-intc: Add AST2700-A2 support") Reported-by: Andrew Jeffery <andrew@codeconstruct.com.au> Signed-off-by: Ryan Chen <ryan_chen@aspeedtech.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Tested-by: Andrew Jeffery <andrew@codeconstruct.com.au> Link: https://patch.msgid.link/20260819-fix-ast2700-intc-atomic-alloc-v1-1-d92a02e2a239@aspeedtech.com
2026-08-19Merge tag 'for-linus-iommufd' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd Pull iommufd updates from Jason Gunthorpe: "One small feature this cycle, the noiommu mode is useful in single-purpose VMs running something like DPDK. It avoids the double translation overhead and it seems to be commonly used with some hacks. Summary: - Formal API for "no iommu" mode in VFIO. iommufd now works in this environment and provides page pinning and phyiscal address services to userspace. This avoids nasty fragile tricks with mprotect and pgmap - Fix sykzaller crash racing change_process with map_pages - Various skyzkaller/AI fixes for the selftests" * tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd: iommufd: Fix UAF in selftest IOPF reporting iommu/iommufd: Fix NULL pointer deref in iommufd_ioas_change_process when racing with iopt_map_file_pages Documentation: Update VFIO NOIOMMU mode vfio: Enable cdev noiommu mode under iommufd iommufd: Add an ioctl to query PA from IOVA for noiommu mode iommufd: Allow binding to a noiommu device iommufd: Move igroup allocation to a function iommufd: Support a HWPT without an iommu driver for noiommu iommufd: Simplify iommufd_device_remove_vdev() iommufd: Fix grammar and spelling in comments iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add iommufd/selftest: Fix dmabuf leak in iommufd_test_dmabuf_get() iommufd/selftest: Avoid selftest dirty bitmap size wrap
2026-08-19irqchip/renesas-rzg2l: Fix loss of interruptBiju Das
rzg2l_clear_irq_int() and rzg2l_clear_tint_int() perform a read-modify-write on the ISCR/TSCR status registers to clear the bit for the interrupt just handled. Since these registers are write-0-to-clear per bit, this is racy: If another interrupt's status bit gets set between the read and the write, that bit is written back as 0 by the software-constructed value, clearing an interrupt that hasn't been serviced yet and losing it. This can be reproduced by triggering multiple interrupts at once, e.g.: gpioset -c gpiochip0 355=0 353=0 328=0 352=0 Fix this by writing back only the bit being cleared, with all other bits set to 1, instead of read-modify-writing the whole register. Since 1-bits are left unchanged by hardware, concurrently-set status bits for other interrupts are preserved. Fixes: 3fed09559cd8 ("irqchip: Add RZ/G2L IA55 Interrupt Controller driver") Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260818110937.5816-1-biju.das.jz@bp.renesas.com
2026-08-19Merge tag 'iommu-updates-v7.3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux Pull iommu updates from Joerg Roedel: "ARM SMMUv2: - Device-tree binding updates for Qualcomm Eliza, Maili, Shikra and IPQ9650 SoCs - Add support for Qualcomm SM8450 - Numerous fixes for lifetime and ordering issues found by Sashiko in the Qualcomm driver ARM SMMUv3: - Fix interrupt type in device-tree binding example for NVIDIA CMDQV - Numerous fixes for issues identified by Sashiko in the NVIDIA CMDQV driver - Work around TLB erratum T264-SMMU-3 on Tegra264 by repeating the invalidation sequence - Add support for HAFT (hardware access flag in table entries) when using SVA - Probe for 52-bit addressing with a page size smaller than 64k ('DS') but don't do anything with it for now - Minor driver improvements (remove sort_nonatomic(), use readl_relaxed_poll_timeout_atomic(), fix IOPF teardown ordering) Intel VT-d: - Consolidation of complex enablement logic into a clean, priority-based state machine - Support for the DMA_REMAP_OPT_OUT flag from the VT-d v5.2 specification - An update to cache_tag_flush_devtlb_psi() to use full-range constants instead of modifying shared variables for CACHE_TAG_NESTING_DEVTLB - A fix for the UCTP context-table slot when copying root entries - Fixes for several pre-existing issues reported by Sashiko - General code cleanup and refinement AMD IOMMU: - Add SNP page-mode-0 support, enabling passthrough, v2 DMA page tables and host SVA on supporting systems - Fix invalid PPR handling, COMPLETE_PPR responses and guest-mode reporting - Improve Southbridge IOAPIC validation and remove the dependency on hard-coded device IDs - Fix PCI-device lifetime, debugfs and diagnostic issues IOMMU core and IOMMUFD: - Restore serialization of the shared MSI-page list - Fix SVA-handle publication and several IOMMUFD reference and error path leaks - Return the expected zero result for invalid generic page-table translations - Allocate per-CPU IOVA magazines lazily to reduce memory use on large systems PCI ATS: - Make VF support checks account for the associated PF and validate that VF and PF Smallest Translation Unit settings agree Platform drivers: - Fix Qualcomm runtime-PM, probe unwind, fault reporting and page table initialization races - Rework Rockchip state handling and fix clock, probe and stale-fault handling - Fix smaller issues in the MSM and MediaTek drivers Device-tree bindings: - Add new Qualcomm SMMU compatibles, convert the OMAP IOMMU binding to YAML, and fix the Tegra264 CMDQV interrupt example Various smaller cleanups, documentation fixes and a Rust IOMMU safety/readability improvement" * tag 'iommu-updates-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: (93 commits) iommu/amd: Add SNP page mode 0 support iommu/amd: Fix GN bit setting in COMPLETE_PPR_REQUEST command iommu/amd: Rate limit INVALID_PPR_REQUEST error logging iommu/amd: Fix missing CMD_COMPLETE_PPR response for invalid PPR requests iommu/amd: Introduce PPR_TAG_LAST_PAGE() macro iommu/amd: Fix incorrect device ID in invalid PASID error message iommu/vt-d: Flush context cache with correct SID when tearing down aliases iommu/vt-d: Tear down scalable-mode context on probe failure iommu/vt-d: Fix iopf_refcount leak on RID domain replacement iommu/vt-d: Clear Present bit before tearing down copied context entry iommu/vt-d: Fix copied_tables bitmap leak on error in copy_translation_tables iommu/vt-d: Cache max domain ID to avoid redundant calculation iommu/vt-d: Support the new DMA_REMAP_OPT_OUT flag bit iommu/vt-d: Remove dmar_disabled iommu/vt-d: Remove the 'force_on' variable iommu/vt-d: Call dmar_can_force_on() for tboot opt-in iommu/vt-d: Use dmar_can_force_on() for platform opt-in iommu/vt-d: Consolidate dmar policy management and force_on logic iommu/vt-d: Remove dead code when CONFIG_INTEL_IOMMU is not set iommu/vt-d: Force requesting ACS when tboot is enabled ...
2026-08-19Merge tag 'for-7.3/dm-changes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper updates from Mikulas Patocka: - minor cleanups found by Claude Opus 4.6 - small cleanups in dm core, dm-cache, dm-switch, dm-inlinecrypt, dm-vdo - improve validation of metadata in dm-pcache - fix resume-vs-remove ioctl race condition - fix race condition when issuing table load ioctls concurrently - fix dm-raid1 and dm-io, so that they work with unaligned bio vectors - dm-integrity: use keyed markers as discard fillers - improve metadata validation in dm-array - fix dm-stats crash on memory allocation failure - fix dm-dust, so that it works if it is not the first target in a table - dm-era: fix superblock refcount leak on snapshot failure * tag 'for-7.3/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: (46 commits) dm-era: fix shadowed superblock leak on take-snap failure dm dust: make badblock messages target-relative dm-stats: fix a crash if allocation of per-cpu data fails dm array: reject an array block whose value size is not the caller's dm array: validate array block headers on read dm-integrity: replace forgeable discard filler with a keyed sector marker dm vdo indexer: embed geometry in parent structures dm vdo indexer: simplify sub-index parameter calculations dm-pcache: remove unused 'cache' parameter from cache_key_gc() docs: device-mapper: dm-inlinecrypt: fix 'bellow' spelling dm-pcache: remove unused miss_read_end_work_fn declaration dm-io: report non-retryable errors separatedly dm-io: clone the source bio instead of copying its biovec dm: fix race when loading and unloading a table dm: fix resume-vs-remove race dm-pcache: remove unused 'allocated' variable in cache_data_alloc() dm-pcache: replace tabs with spaces in comments to fix ASCII diagram alignment dm-pcache: fix use-after-free and invalid seg operations in kset_replay() dm-pcache: fix implicit u8 truncation of gc_percent in message handler dm raid1: reserve space for NUL-terminator in build_constructor_string() ...
2026-08-19Merge tag 'ata-7.3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux Pull ata updates from Damien Le Moal: - Some code cleanups to rename the function used to identify ZAC devices and declare some local functions static (me) - Refactoring and improvement of the translation of the SCSI REPORT SUPPORTED OPCODES command to allow users access to the entire list of supported commands (me) - Fix the translation of the WRITE SAME command with UNMAP bit set (DSM TRIM) for devices with a sector size larger than 2K and devices that support multiple TRIM segments (Niklas) - Add support detecting support for and translating the SCSI commands related to the storage elements depopulation feature (GET PHYSICAL ELEMENT STATUS, REMOVE ELEMENT AND TRUCATE, REMOVE ELEMENT AND MODIFY ZONES and RESTORE ELEMENTS AND REBUILD) (me) - Improvements to the sata_mv driver probe code (clocks and IRQ initialization) (Rosen) - Improve resource initialization in the pata_rb532_cf, pata_pxa, sata_highbank and ahci_da850 drivers (Rosen) - Improve PIO data-in command completions to better hndle slow devices, e.g. CF cards (Richard) - Improve the DMA channel management using device resources in the pata_pxa driver (Rosen) - Fix the pata_ep93xx driver to correctly fallback to PIO mode if DMA initialization fails (Rosen) - Use named initializers to define the match tables of the ahci_xgene, ahci_qoriq and ahci_platform drivers (Pawel) * tag 'ata-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux: (28 commits) ata: use named initializers for acpi_device_id ata: pata_ep93xx: fix PIO fallback when DMA init fails ata: pata_pxa: use devres for DMA channel management ata: libata-sff: don't busy-wait for PIO data-in command completion ata: ahci_da850: use devm_platform_ioremap_resource() ata: sata_highbank: use devm_platform_ioremap_resource ata: pata_pxa: use devm_platform_ioremap_resource ata: pata_rb532_cf: use devm_platform_ioremap_resource() ata: sata_mv: use devm clock helpers ata: sata_mv: Use platform_get_irq() to get interrupt ata: pata_mpc52xx: Remove redundant dev_err() ata: libata-eh: make ata_eh_qc_complete() and ata_eh_qc_retry() static ata: libata-scsi: add support for the REMOVE ELEMENT AND MODIFY ZONES command ata: libata-scsi: add support for the RESTORE ELEMENTS AND REBUILD command ata: libata-scsi: add support for the REMOVE ELEMENT AND TRUNCATE command ata: libata-scsi: add support for the GET PHYSICAL ELEMENT STATUS command ata: libata-core: detect support for depopulation capabilities ata: libata-scsi: improve ata_get_xlat_func ata: libata: improve the definition of device flags scsi: define depopulation capabilities related service actions ...
2026-08-19Merge branch 'kvm-arm64/vncr-fixes' into nextOliver Upton
* kvm-arm64/vncr-fixes: : Fixes for handling L1 VNCR mappings, courtesy of Marc Zyngier : : - Recompute the VNCR software TLB when the MMU is toggled at stage-1 : : - Improve TLB invalidation intersection to handle TLBIs affecting the : end of the VA space : : - Fix race to invalidate the VNCR fixmap between TLBI emulation and : vcpu_put() : : - Add missing sign extension for computing TLBI ranges : : - Make VNCR invalidation participate in the MMU notifier seqcount, : preventing a concurrent VNCR TLB fill from consuming a stale : translation KVM: arm64: Correctly cap TLBI Range to the architural limit KVM: arm64: Add VNCR TLB tracking again KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry KVM: arm64: Sign-extend VA for range-based TLBI invalidation KVM: arm64: Handle VNCR TLB invalidation race with vcpu_put() VNCR unmapping KVM: arm64: Correctly handle end of VA space TLBI invalidation KVM: arm64: Consider SCTLR_EL2.M when mapping the L1 VNCR page KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation KVM: arm64: Remove VM-wide VNCR mapping counter Signed-off-by: Oliver Upton <oupton@kernel.org>
2026-08-19Merge branch 'kvm-arm64/feat-nv3' into nextOliver Upton
* kvm-arm64/feat-nv3: (29 commits) : Support for FEAT_NV2p1 and FEAT_NV3, courtesy of Marc Zyngier : : Couple of accelerations for nested virtualization: : : - Elide traps for EL1 alias registers when hardware guarantees that : EL2-only bits are stateful (NV2p1) : : - Use TGE-aware hardware to avoid unnecesary ERET/TLBI traps that : remain 'in-context' (i.e. L1 kernel/userspace) arm64: Add override for ID_AA64MMFR4_EL1.NV_frac KVM: arm64: selftest: Add NVHCR_EL2 to get-reg-list KVM: arm64: Expose FEAT_NV3 to guests KVM: arm64: Add FEAT_NV3 detection KVM: arm64: Engage NV3 TLBI trap elision KVM: arm64: Engage NV3 ERET trap elision KVM: arm64: Add NVHCR_EL2 context switching KVM: arm64: Add routing for NVHCR_EL2 trap KVM: arm64: Add NVHCR_EL2 handling to the sysreg array KVM: arm64: Add sanitisation for NVHCR_EL2 KVM: arm64: Make HCR_EL2 a non-VNCR register KVM: arm64: Add kvm_has_nv{2,3}() predicates KVM: arm64: Add NV3 control bits to HCRX_EL2 sanitisation KVM: arm64: Split NV-specific exit fixups from the non-NV handling arm64: Add ARM64_HAS_NV3 capability arm64: sysreg: Add HCRX_EL2 bits related to FEAT_NV3 arm64: sysreg: Add NVHCR_EL2 description as a mirror of HCR_EL2 arm64: Add FEAT_NV2p1 detection KVM: arm64: Expose FEAT_NV2p1 to NV guests KVM: arm64: Relax CNTHCTL_EL2 handling when FEAT_NV2p1 is present ... Signed-off-by: Oliver Upton <oupton@kernel.org>
2026-08-19Merge branch 'kvm-arm64/pkvm-7.3' into nextOliver Upton
* kvm-arm64/pkvm-7.3: (26 commits) : pKVM updates for 7.3 : : - Avoid name collision on trace_clock() when CONFIG_NVHE_EL2_TRACING is : disabled (Mostafa Saleh) : : - Clean up state tracking for whether the EL2 shadow VM has been : created (Fuad Tabba) : : - Synchronize SCTLR_EL1 when injecting an exception to use current : PAN/SSBS state (Fuad Tabba) : : - Avoid unnecessary cache maintenance when I/D-cache are known to be : coherent in pKVM (Mostafa Saleh) : : - Lazy vCPU context save/restore for pKVM (Fuad Tabba) : : - Various fixes to the stage-2 MMU for pKVM (Fuad Tabba) : : - Allow counter offsetting of non-protected guests in protected mode : (Mostafa Saleh) : : - Condition the 'broken CNTVOFF' mitigation on a VM actually having a : nonzero offset, fixing boot failures of pVMs on affected hardware : (Mostafa Saleh) KVM: arm64: Fix hvhe and broken CNTVOFF_EL2 KVM: arm64: Fix timer offsets for non-protected VMs KVM: arm64: Make timer_get_offset() work in all contexts KVM: arm64: selftests: Add stage-2 block transition test KVM: arm64: Don't advertise eager page splitting under pKVM KVM: arm64: Don't WARN on pKVM stage-2 map failures KVM: arm64: Skip pKVM stage-2 flush when FWB is enabled KVM: arm64: Top up stage-2 memcache for dirty logging faults KVM: arm64: Top up the memcache for pKVM permission faults KVM: arm64: Skip cache maintenance for non-cacheable pKVM mappings KVM: arm64: Implement lazy vCPU state sync for non-protected guests KVM: arm64: Add primitives to flush/sync the VGIC state at EL2 KVM: arm64: Minimise EL2's exposure of host VGIC state during world switch KVM: arm64: Add host and hypervisor vCPU lookup primitives KVM: arm64: Move PSCI helper functions to a shared header KVM: arm64: Factor out reusable vCPU reset helpers KVM: arm64: Make vcpu_{read,write}_sys_reg available to HYP code KVM: arm64: Extract MPIDR computation into a shared header KVM: arm64: selftests: Add a userspace watchpoint test KVM: arm64: Flush external_mdscr_el1 to the pKVM hyp vCPU ... Signed-off-by: Oliver Upton <oupton@kernel.org>
2026-08-19Merge branch 'kvm-arm64/pmu-7.3' into nextOliver Upton
* kvm-arm64/pmu-7.3: : vPMU updates for 7.3 : : - Support for slot-based PMU events, relying on new UAPI that makes : selection of a vPMU implementation mandatory (Congkai Tan) KVM: arm64: Add KVM_ARM_VCPU_PMU_V3_STRICT vCPU feature KVM: arm64: Ignore writes to PMCR_EL0.N when using strict UAPI KVM: arm64: Advertise STALL_SLOT* in PMCEID1 under strict PMUv3 UAPI KVM: arm64: Expose PMMIR_EL1.SLOTS under strict PMUv3 UAPI Signed-off-by: Oliver Upton <oupton@kernel.org>
2026-08-19KVM: arm64: Validate GICv5 timer PPIs before claiming ownershipSascha Bischoff
With GICv5, timer PPIs use architecturally defined IDs, and therefore we require userspace to use the architected IDs too. We perform this validation in timer_irqs_are_valid(), which validates the configured PPI after claiming it with kvm_vgic_set_owner(). This is obviously the wrong order, and could both result in a NULL pointer dereference for an ID >= 64 and in an incorrect ownership claim. Switch the order to first validate the PPI before setting the owner. This both prevents an invalid GICv5 timer PPI from reaching the IRQ lookup, and avoids claiming an IRQ for a timer configuration that will be rejected. Fixes: 06c85b58e0b1 ("KVM: arm64: Move GICv5 timer PPI validation into timer_irqs_are_valid()") Link: https://sashiko.dev/#/message/20260810111614.DDC731F000E9%40smtp.kernel.org Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Reviewed-by: Joey Gouly <joey.gouly@arm.com> Reviewed-by: Marc Zyngier <maz@kernel.org> Link: https://patch.msgid.link/20260811150941.941295-5-sascha.bischoff@arm.com Signed-off-by: Oliver Upton <oupton@kernel.org>
2026-08-19KVM: arm64: vgic: Reject out-of-range GICv5 PPI IDsSascha Bischoff
GICv5 supports up to 128 PPIs, but KVM currently implements only the first 64, which contain the architected PPIs it supports. An encoded PPI with an ID outside that range passes irq_is_ppi(), which only checks the encoded interrupt type. vgic_get_vcpu_irq() therefore looks it up in private_irqs[], where array_index_nospec() clamps the out-of-range index to zero and aliases PPI 0. Include the supported PPI range in irq_is_ppi() so that KVM interfaces reject unsupported PPIs. Also reject an out-of-range PPI in the lookup as a safeguard against callers bypassing the predicate. Fixes: 4d591252bacb ("KVM: arm64: gic-v5: Implement PPI interrupt injection") Fixes: eb8bce08ecb1 ("KVM: arm64: gic: Introduce interrupt type helpers") Link: https://sashiko.dev/#/patchset/20260724104819.1296803-1-sascha.bischoff@arm.com?part=27 Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Reviewed-by: Joey Gouly <joey.gouly@arm.com> Reviewed-by: Marc Zyngier <maz@kernel.org> Link: https://patch.msgid.link/20260811150941.941295-4-sascha.bischoff@arm.com Signed-off-by: Oliver Upton <oupton@kernel.org>
2026-08-19KVM: arm64: vgic: Prevent speculative SPI array underflowSascha Bischoff
For a non-GICv5 VM, SPI interrupt IDs include the private-interrupt offset, while KVM's SPI array is indexed from zero. The lookup applies array_index_nospec() to the absolute interrupt ID and subtracts the private-interrupt offset afterwards. On a speculative bypass of the range check for an interrupt ID below the private range, the clamp preserves the small absolute value and the subtraction underflows to an out-of-bounds SPI array index. Convert the interrupt ID to a zero-based index into the SPI array before applying array_index_nospec(). This way, we ensure that we clamp to a reachable SPI ID, rather than an out-of-range SPI index. Fixes: 41b87599c743 ("KVM: arm/arm64: vgic: fix possible spectre-v1 in vgic_get_irq()") Link: https://sashiko.dev/#/patchset/20260724104819.1296803-1-sascha.bischoff@arm.com?part=27 Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Reviewed-by: Joey Gouly <joey.gouly@arm.com> Reviewed-by: Marc Zyngier <maz@kernel.org> Link: https://patch.msgid.link/20260811150941.941295-3-sascha.bischoff@arm.com Signed-off-by: Oliver Upton <oupton@kernel.org>
2026-08-19KVM: arm64: vgic: Free gic_kvm_info on initialization failureSascha Bischoff
vgic_set_kvm_info() allocates gic_kvm_info for use by kvm_vgic_hyp_init(). When a maintenance interrupt is mandatory but not provided, kvm_vgic_hyp_init() returns -ENXIO before reaching the common cleanup path, leaking said allocation. Route this error through that cleanup path so that gic_kvm_info is freed and the global pointer is cleared. Fixes: 0e5cb7770684 ("irqchip/gic: Split vGIC probing information from the GIC code") Link: https://sashiko.dev/#/patchset/20260724104819.1296803-1-sascha.bischoff@arm.com?part=1 Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Reviewed-by: Joey Gouly <joey.gouly@arm.com> Reviewed-by: Marc Zyngier <maz@kernel.org> Link: https://patch.msgid.link/20260811150941.941295-2-sascha.bischoff@arm.com Signed-off-by: Oliver Upton <oupton@kernel.org>
2026-08-19KVM: arm64: Avoid mismatched accesses to 'struct kvm_nvhe_init_params'Will Deacon
When running with hVHE enabled, ___kvm_hyp_init() calls __kvm_init_el2_state() on the CPU initialisation path during onlining and resume from suspend. In order to avoid clobbering the link register across this call, it is stashed away in the 'tmp' member of 'struct kvm_nvhe_init_params', however this save/restore operation is performed with the stage-1 MMU disabled at EL2 and therefore gives rise to coherency problems because the field is not aligned or padded to the CWG. For example, a cacheable write to a physically-adjacent structure sharing the same cacheline could lead to an eviction and subsequent write-back, overwriting the saved LR while the incoming CPU is executing __kvm_init_el2_state(). Save the lr in far_el2 and remove the 'tmp' member from 'struct kvm_nvhe_init_params' altogether. Cc: Oliver Upton <oupton@kernel.org> Cc: Marc Zyngier <maz@kernel.org> Fixes: afa9b48f327c ("KVM: arm64: Shave a few bytes from the EL2 idmap code") Signed-off-by: Will Deacon <will@kernel.org> Reviewed-by: Marc Zyngier <maz@kernel.org> Link: https://patch.msgid.link/20260813131717.5885-1-will@kernel.org Signed-off-by: Oliver Upton <oupton@kernel.org>
2026-08-19accel/amdxdna: return early from a zero-length flushTaimuraz Kaitmazov
SYNC_BO does not constrain its size, so a request for zero bytes reaches drm_clflush_virt_range(), which ends with an unconditional clflushopt(end - 1). For an empty range that is the byte before the mapping, and abo->mem.kva comes from vmap(), so the access lands in the guard page below the vmalloc area and faults: BUG: unable to handle page fault for address: ffffd16fbbc70fff #PF: supervisor read access in kernel mode Oops: Oops: 0000 [#1] SMP NOPTI CPU: 7 UID: 1000 Comm: sync_bo_probe RIP: 0010:drm_clflush_virt_range+0x3c/0x70 Call Trace: amdxdna_drm_sync_bo_ioctl+0x124/0x430 [amdxdna] drm_ioctl+0x301/0x4c0 __x64_sys_ioctl+0x115/0x2f0 do_syscall_64+0xa6/0x3d0 Any process that can open the render node can do this. Reproduced 3 of 3 times on a Strix Point NPU (1022:17f0), by calling SYNC_BO with size 0 on an AMDXDNA_BO_SHARE object. The import arm takes the same request but flushes the whole scatterlist, so it survives it. Nothing needs flushing for an empty range, so answer before choosing a path. Fixes: e252e3f3488a ("accel/amdxdna: Revise device bo creation and free") Cc: stable@vger.kernel.org Signed-off-by: Taimuraz Kaitmazov <taimuraz@kaitmazov.com> Reviewed-by: Lizhi Hou <lizhi.hou@amd.com> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com> Link: https://patch.msgid.link/20260817230655.356785-1-taimuraz@kaitmazov.com
2026-08-19Merge tag 'driver-core-7.3-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core Pull driver core updates from Danilo Krummrich: "container_of: - Apply typeof_member(), remove the local __mptr variable to eliminate variable shadowing warnings on nested container_of() calls, and remove unnecessary parentheses core: - Add driver name to probe debug print for initcall_debug - Avoid repeatedly printing the same 'Fixed dependency cycle' log - Unwind device_add() on attribute creation failure in attribute_container_add_class_device() - Remove statistics group if encryption group creation fails in transport_add_class_device() debugfs: - Fix lockdown check for mmap_prepare() - Warn if file creation failed due to uninitialized debugfs device property: - Implement fw_devlink support for software nodes by adding software_node_add_links(), which creates fwnode links from DEV_PROP_REF properties to enable automatic probe ordering. Add kunit-managed fwnode helpers and test coverage - Fix infinite loop in fwnode_for_each_child_node() when the secondary fwnode has more than one child. Add test cases - Fix out-of-bounds access in software_node_get_reference_args() when called with index -1 (UINT_MAX) - Refactor to use RAII approach with __free() - Add Bartosz Golaszewski as software node reviewer firmware loader: - Fix race where a sysfs fallback request can complete before being queued as pending, leading to a use-after-free on the next fallback request - Reject 0-size built-in firmware and fail the build on empty firmware files in CONFIG_EXTRA_FIRMWARE kobject: - Provide __KOBJ_ATTR() and __KOBJ_ATTR_RO/WO() initialization macros and allow the constification of kobject attributes, enabling them to reside in read-only memory platform: - Provide platform_device_set_of_node(), platform_device_set_fwnode(), and platform_device_set_of_node_from_dev() helpers that encapsulate firmware node reference counting for dynamically allocated platform devices Convert all in-tree users that manually assigned dev.of_node or dev.fwnode, fixing a pre-existing refcount bug in powermac. Switch to counting references of all firmware node types, not only OF nodes - Unify the release path for dynamically allocated platform devices by removing platform_device_release_full(). Amend the fwnode setter API contract to warn if a primary software node is overwritten. Add KUnit tests for correct software node removal on device unregistration Rust: - Auxiliary: - Add registration_data_with() closure-based API for invariant ForLt types - Debugfs: - Migrate BinaryWriter and BinaryReaderMut trait requirements from kernel::transmute traits to zerocopy traits - Device: - Add BoundInternal device context and InternalBoundContext trait for bus abstractions that need internal access to a bound device. - Make the lifetime on Core and CoreInternal invariant to prevent coercion to shorter lifetimes - Devres: - Fix race between concurrent revokers where the losing revoker could return before the winning revoker finished dropping the inner data, causing use-after-free. - Ensure revocation is complete before the device finishes unbinding by making the synchronization bidirectional. - Add DevresLt<F: ForLt>, a wrapper around Devres that shortens 'static back to the caller's borrow scope. Implement ForLt and CovariantForLt for Bar, IoMem, and ExclusiveIoMem - Driver: - Switch from index-based to pointer-based device ID info lookup, storing static references in driver_data. Centralize device ID handling in device_id.rs, removing the open-coded ACPI/OF matching logic and duplicate ID table from driver.rs - I/O: - Make I/O regions typed (with a dynamically-sized Region type for the existing untyped case), create view types representing subregions of a mapped I/O region, and add io_project!() for safely creating subviews. - Split Io into a base trait (IoBase) and an extension trait (Io) with a blanket implementation, preventing implementers from overriding provided methods that unsafe code relies on. - Add a SysMem backend for shared system memory with volatile access, and make Coherent implement Io via an I/O view type. Add IoSysMap as sum type of Mmio and SysMem. Add copying methods (memcpy_{from,to}io()) and read_val()/write_val() for typed access. - Replace dma_read!()/dma_write!() with io_read!()/io_write!() for primitives and copying methods for aggregates; drop the old macros. Convert nova-core to use I/O projection. - Fix internal shortcut rule dispatch in the register!() macro, remove unused rule arguments, and use path fragments for alias destinations - IRQ: - Make irq::Registration compatible with lifetime-bound drivers by removing the 'static bound on Handler/ThreadedHandler and replacing Devres<RegistrationInner> with direct request_irq()/free_irq() calls. Handlers can now directly own lifetime-bound device resources - PCI: - Convert IrqVectorRegistration to a lifetime-annotated owning type, giving drivers explicit control over the allocation lifetime. IrqVector embeds a resolved IrqRequest, making the conversion infallible. Remove the redundant request_irq()/request_threaded_irq() wrappers from pci::Device. - Add pci_irq_type() C helper and expose it via irq_type() on IrqVectorRegistration and IrqVector, returning PCI_IRQ_MSIX, PCI_IRQ_MSI, or PCI_IRQ_INTX. - Mark pci::Device refcount methods inline - Serdev: - Add Rust abstractions for the serial device bus, including serdev::Driver trait, serdev::Device wrapping struct serdev_device, and serdev::Adapter implementing RegistrationOps. Includes a sample driver. Markus Probst takes over as serdev maintainer for both C and Rust code - Misc: - Split ForLt into a base trait (providing the Of<'a> GAT) and an unsafe CovariantForLt subtrait guaranteeing covariance, enabling invariant types (e.g. those containing Mutex<&'bound T>) to participate in the ForLt abstraction. - Fix Coherent read past EOF returning -ERANGE instead of zero. - Fix firmware example UB by avoiding null-pointer ARef misc: - Avoid iattr allocation in kernfs listxattr by using kernfs_iattrs_noalloc(). - Unregister SoC bus on early device registration failure. - Remove unused DMA_FENCE_TRACE Kconfig symbol. - Fix /sys/module path in comment. - Refactor ISA bus init to remove nested blocks. - Remove redundant nodemask clears in numa_init(). - Add kernel-doc for fwnode_operations and sys_soc.h, mark internal property data as private for kernel-doc, and add property.h/fwnode.h to driver-api infrastructure docs. - Add MAINTAINERS entry for sys_soc.h" * tag 'driver-core-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: (129 commits) rust: pci: expose the allocated interrupt type PCI: Add pci_irq_type() to query the allocated interrupt type rust: pci: remove request_irq() and request_threaded_irq() from Device rust: pci: resolve IRQ in index() and embed IrqRequest in IrqVector rust: pci: convert IrqVectorRegistration to a lifetime-managed owning type kernfs: avoid iattr allocation in listxattr rust: serdev: use ThisModule::as_ptr() instead of field access ACPI/IORT: use platform_device_set_fwnode() ACPI/APMT: use platform_device_set_fwnode() firmware_loader: do not queue completed sysfs fallback requests rust: pci: Mark Device refcount methods inline rust: irq: make Registration compatible with lifetime-bound drivers rust: net/phy: remove expansion from doc rust: dma: return zero for Coherent reads past EOF rust: io: register: use path fragment for alias destination rust: io: register: remove unused rule arguments rust: io: register: dispatch shortcut rules internally MAINTAINERS: add sys_soc.h to DRIVER CORE rust: debugfs: remove unsafe blocks from traits impl for Vec rust: debugfs: migrate debugfs traits requirements to zerocopy ...
2026-08-19PCI: vmd: Add Nova Lake (NVL) and Dunlow (DNL) Device IDsSzymon Durawa
Add VMD Device ID Support for Intel NVL/DNL processors. Suggested-by: Nirmal Patel <nirmal.patel@linux.intel.com> Signed-off-by: Szymon Durawa <szymon.durawa@linux.intel.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Cc: Nirmal Patel <nirmal.patel@linux.intel.com> Cc: Jonathan Derrick <jonathan.derrick@linux.dev> Link: https://patch.msgid.link/20260819130523.398493-1-szymon.durawa@linux.intel.com
2026-08-19Merge tag 'devicetree-for-7.3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree updates from Rob Herring: - Add a DT maintainer profile document - Various dt-check-style improvements - Add a devres managed reserved memory region init function - Print node name on any skipped reserved memory regions - Correctly handle optional argument in of_parse_phandle_with_args_map() - Convert ti,keystone-reset, ti,da850-vpif, TI L4 interconnect, TI SmartReflex, microchip,pic32mzda-dmt, microchip,pic32mzda-wdt, TI DA8XX MSTPRI bus, and Xen VM bindings to DT schema format - Add bindings for StarFive JHB100 plic, Allwinner A733 NMI controller, MediaTek MT8173 GPU, QCom Shikra, Eliza, and Maili cpu-bwmon, and QCom Shikra SCM firmware - A couple of syntax fixes found using PoC Rust implementation of dtschema tools - Clean-ups for typos, brackets, incorrect "::" usages, and white-space style * tag 'devicetree-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (40 commits) dt-bindings: interconnect: qcom-bwmon: Add Maili cpu-bwmon compatible dtc: dt-check-style: Simplify setting depth of DtsLine dtc: dt-check-style: Add missing /dts-v1/ to few test cases dt-bindings: power: reset: ti,keystone-reset: Convert to DT schema media: dt-bindings: ti,da850-vpif: Convert to dt-schema dt-bindings: devfreq: samsung,exynos-ppmu: Use standard regex syntax dt-bindings: interrupt-controller: mediatek,mt6577-sysirq: Drop invalid JSON pointer dt-bindings: arm: omap: Convert L4 interconnect to DT schema dt-bindings: power: Convert TI SmartReflex to DT schema of: reserved_mem: Introduce devres-managed initialization function dt-bindings: interrupt-controller: Add StarFive JHB100 plic dt-bindings: irq: sun7i-nmi: Document the Allwinner A733 NMI controller dt-bindings: Correct white-space style dt-bindings: fix typos and brackets docs: dt: submitting-patches: Mention expectation about dt-check-style docs: dt: maintainer: Add Devicetree and OF maintainer profile document docs: dt: writing-schema: Extend expectations about example part of binding dt-bindings: gpu: powervr-rogue: Add MediaTek MT8173 GPU of: base: Handle optional argument in of_parse_phandle_with_args_map() dt-bindings: update Sudeep Holla's email address ...
2026-08-19PCI: tegra264: Add Tegra264 supportThierry Reding
Add a driver for the PCIe controller found on NVIDIA Tegra264 SoCs. The driver is very basic, with its main purpose being to set up the address translation registers and then registering a standard PCIe Host Bridge making use of ECAM. Co-developed-by: Manikanta Maddireddy <mmaddireddy@nvidia.com> Signed-off-by: Manikanta Maddireddy <mmaddireddy@nvidia.com> Signed-off-by: Thierry Reding <treding@nvidia.com> [mani: tweaked MAINTAINERS entry to support this new driver and binding] Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://patch.msgid.link/20260814-tegra264-pcie-v10-3-05d08c592b05@nvidia.com
2026-08-19Merge tag 'media/v7.3-1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media updates from Mauro Carvalho Chehab: - v4l2-core: added ISP statistics support and per-block validation - v4l2-core: Allow unknown HDR10 white point and luminance - New camera sensors: Sony IMX678 and IMX471m, Himax HM1092 IR sensor - New codec: Milos: VPU v2.0 codec support - isp driver: gained support for Dreamchip RPPX1 ISP framework - vsp1 driver: gained support for RZ/T2H and RZ/N2H - Novalake driver: gained CVS support for new NVL hardware - dvb-core: fix feed leak on failed DMX_ADD_PID - several driver fixes, cleanups and minor improvements * tag 'media/v7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (308 commits) media: ipu-bridge: check all DMI entries when overriding sensor rotation media: v4l2-async: avoid deleting unlinked ASC entry on link error media: rzg2l-cru: Align bytesperline to hardware DMA stride requirement media: intel/ipu6: fix async notifier cleanup leak on parse error media: staging/ipu7: fix async notifier UAF on probe error path media: amd: isp4: fix self-deadlock in isp4sd_pwron_and_init() error path media: amd: isp4: release partial allocations in isp4if_alloc_fw_gpumem() media: rcar-isp: Fix VSPX reference leaks media: rcar-isp: Release ISPCORE resources media: i2c: imx415: Release runtime PM reference on VBLANK error media: i2c: imx415: Return test pattern write errors media: renesas: vsp1: Declare index variables in for loop statement media: renesas: vsp1: Make reset control optional to support platforms without a reset line media: dt-bindings: media: renesas,vsp1: Document RZ/T2H and RZ/N2H SoCs media: dt-bindings: media: renesas,fcp: Document RZ/T2H and RZ/N2H SoCs media: nxp: imx8-isi: Add additional 32-bit RGB format support media: nxp: imx8-isi: Add 16-bit raw Bayer format support media: nxp: imx8-isi: Implement per-stream reference counting for multiplexed streams media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks media: nxp: imx8-isi: Correct color map between V4L2 and ISI ...
2026-08-19dt-bindings: PCI: tegra264: Switch to PCIe Root Port bindingsThierry Reding
Switch to using the PCIe Root Port bindings in preparation for using the standard WAKE# handling. Signed-off-by: Thierry Reding <treding@nvidia.com> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Reviewed-by: Rob Herring (Arm) <robh@kernel.org> Link: https://patch.msgid.link/20260814-tegra264-pcie-v10-2-05d08c592b05@nvidia.com
2026-08-19dt-bindings: PCI: tegra264: Strictly distinguish C0 from C1-C5Thierry Reding
Instead of using the ECAM registers as the first entry, strictly make a distinction between C0 and C1-C5. This is needed because otherwise the unit address doesn't match the first "reg" entry. The ordering of these nodes cannot be changed to follow the ECAM addresses because that would put them outside of their "control bus" hierarchy since the ECAM address space is a global one outside of any of the control busses. Signed-off-by: Thierry Reding <treding@nvidia.com> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Reviewed-by: Rob Herring (Arm) <robh@kernel.org> Link: https://patch.msgid.link/20260814-tegra264-pcie-v10-1-05d08c592b05@nvidia.com
2026-08-19Merge tag 'sound-7.3-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound updates from Takashi Iwai: "It was a fairly busy development cycle - the changes spread over from the core side to leaf drivers, with lots of cleanups and enhancements. Here we go, some highlights: ALSA core: - Extension of ALSA control component list ABI - Locking optimization and RCU conversion of ALSA sequencer core - A few hardening fixes for UMP and sequencer core - Drop __bitwise and __force prefix from UAPI definitions ASoC: - Automatic DAI format selection code deployment across many drivers - Sorting of register default tables to prevent ordering issues in many drivers - Lots of code cleanups and refactoring - Updates in Qualcomm driver stack - New platforms: AMD ACP7.B/F, Cirrus Logic CS35L62, Loongson 2K0300, Meson GX, Qualcomm LPI MI2S, SM8475, WSA855X, Realtek RT1321 VA1/2 and RT766/7 HD-audio: - Support for AW88399 HD-audio side codec for Lenovo Legion laptops - Support for Hygon and Lisuan HDMI controllers - Robustness fixes for wild device binding - Lots of quirks/fixups: Realtek and Conexant codecs for ASUS, Lenovo, Acer, etc USB-audio: - Support for Pioneer DJ DJM-S11 - Scarlett2/FCP private URB notification fixes - Extended quirk_flags to 64bit - Hardening fixes for 6fire, bcd2000, usx2y - Device-specific quirks for Mackie, Valeton, SPACETOUCH General: - Auto-cleanup for put_device() and firmware loading across multiple platforms" * tag 'sound-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (791 commits) ALSA: hda: Fix connection list comparison in proc output ALSA: docs: fix dead link to Intel HD-audio spec ALSA: usb-audio: Add delay quirk for SPACETOUCH USB Audio ALSA: hda: Add Lisuan HDMI controller and codec support ALSA: hda/realtek: Fix Lenovo Yoga Slim 7 14AKP10 quirk ordering ALSA: hda/tas2781: Add hardware stabilization delay during firmware load retries ALSA: hda/realtek: Fix mute LED for HP Victus 15-fa1xxx (MB 8C3F) ALSA: hda/realtek: Add micmute LED quirk for Acer Aspire A515-57 ASoC: tas2783-sdw: do not treat read-only Controls as writable ASoC: SOF: validate topology volume range before allocation ASoC: cs35l56: Use IRQ provided by the SoundWire core soundwire: bus_type: Create IRQ mapping before calling driver probe() ASoC: cs35l56: Move cs35l56_irq_request() after cs35l56_irq() ASoC: cs35l56: Request IRQ in cs35l56_common_probe() ALSA: core: Fix use-after-free in snd_card_do_free() ALSA: hda/realtek: Drop duplicate quirk for Lenovo 0x17aa:0x38df ALSA: usb-audio: Rename the Audient iD14 monitor mix volume control ASoC: tas2781: Refactor calibration start kcontrol creation to separate helper ASoC: dt-bindings: es8316: Fix supply property constraints ALSA: seq: midi: Serialize input teardown with event_input ...
2026-08-19Merge tag 'hid-for-linus-2026081901' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID updates from Jiri Kosina: "Core: - fix long-standing force-feedback initialization race across the subsystem (Dmitry Torokhov) - switch to system_dfl_wq (Marco Crivellari) AMD-SFH: - support for tablet-mode switch for AMD SFH-based systems (Basavaraj Natikar) HyperX: - support for HyperX QuadCast 2 (Benjamin Blume) I2C-HID: - support for devices that provide HID descriptor solely through the ACPI _DSM method (XIE Zhibang) Intel-THC-HID: - support for full I2C bus config parameters (Even Xu) Logitech: - HID++ 2.0 repogrammable button support (Elliot Douglas) - Bolt receiver support for HID++ devices (Erik Håkansson) MSI: - support for MSI Claw (Derek J. Clark) Steam: - initial support for 2026 Steam Controller (Vicki Pfau) - support for sensor events on the 2025 Steam Controller (Vicki Pfau) And many, many other fixes for various long standing issues that were found by new modern tools, and quite a few device ID additions" * tag 'hid-for-linus-2026081901' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (146 commits) HID: tmff: Use 64-bit arithmetic for force feedback scaling HID: multitouch: reclassify HTIX5288 to WIN_8_FORCE_MULTI_INPUT_NSMU HID: sensor: custom: Fix field sysfs group cleanup on failure HID: sensor: custom: Fix use-after-free in enable_sensor HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer HID: haptic: don't write an uninitialized value to unhandled usages HID: intel-thc-hid: intel-quickspi: fix autosuspend cleanup during teardown HID: intel-thc-hid: intel-quicki2c: fix autosuspend cleanup during teardown HID: steam: Zero out inputs when disabling gamepad mode HID: steam: Clean up locking HID: steam: Don't set feature reports when disconnecting HID: steam: Fix wording of connect/disconnect logs HID: steam: Initial 2026 Steam Controller support HID: steam: Refactor registration HID: logitech: add Bolt receiver support for Logitech HID++ devices HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature HID: universal-pidff: stop the device when force-feedback init fails HID: haptic: move FF initialization into .input_configured() HID: logitech-hidpp: move FF initialization to .input_configured() HID: megaworld: move FF initialization to .input_configured() ...
2026-08-19Merge tag 'hwmon-for-v7.3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon updates from Guenter Roeck: "New drivers: - Kandou KB9002 retimer - PolarFire SoC temp/voltage sensor - Eswin EIC7700 PVT sensor - PMBus: - Analog Devices MAX16545/MAX16550 and Volterra VT7505 - Monolithic MPQ82D00 and MPQ8646 - Silergy SQ24860 Added support to existing drivers: - asus-ec-sensors: Support for ROG STRIX Z390-E GAMING, ProArt Z690-CREATOR WIFI, ROG STRIX X870E-E GAMING WIFI7 R2, ROG CROSSHAIR X870E HERO, and ROG Maximus Z790 Hero - asus_rog_ryujin: Siupport for ROG Ryujin III - ina2xx: Support for INA232 - k10temp: Per-CCD temperature monitoring for Zen5 Turin - nct6775: List NCT5585D as supported chip - nzxt-kraken3: Support for NZXT Kraken 2024 Elite - sht3x: Support for GXCAS GXHT30 - tmp102: Add device IDs for TMP110 and TMP113 - yogafan: Support for LOQ 15IAX9, XiaoXin Pro 13ARE 2020, IdeaPad 3 15ALC6, Legion Pro 7 16AFR10H, Yoga Pro 7 14IAH10, Yoga 7 16ARP8, and Lenovo LOQ 15IAX9 - PMBus: - max20830: Support for max20830c and max20840c - max34440: Support for MAX34452, and support for newer version of max34451 - adm1275: Support for ROHM BD12780 and BD12790 Other notable changes: - Constify various device attributes - Remove redundant dev_err() and dev_err_probe() from various drivers - applesmc: Convert to hwmon_device_register_with_info - adt7470: Add thermal zone sensor support - coretemp: Fix core_data leak on CPUs without PTS - emc1403: Drop hysteresis for low limit temperature - max6621: Fix various over- and underflow problems - PMBus: - Introduce pmbus_read_smbus_i2c_block_data() and use it in various drivers - Export and use pmbus_check_and_notify_faults() - Let PMBus drivers report the supported PMBus revision Various other minor fixes and improvements" * tag 'hwmon-for-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (110 commits) hwmon: (emc1403) Drop hysteresis for low limit temperature hwmon: (coretemp) Fix core_data leak on CPUs without PTS hwmon: (max6621) fix negative temperature offset and crit readings hwmon: (max6621) fix temperature clamp range hwmon: (asus_rog_ryujin) Add ROG Ryujin III White Edition hwmon: (asus_rog_ryujin) Add ROG Ryujin III support hwmon: (asus_rog_ryujin) Add per-device configuration hwmon: (k10temp) Add per-CCD temperature monitoring for Zen5 Turin hwmon: (tmp102) Add TMP113 device ID hwmon: (tmp102) Add TMP110 device ID hwmon: (nct6775) Add NCT5585D to list of supported chips Documentation: hwmon: (nct6775) Add missing NCT6797D and NCT6798D hwmon: (emc1403) Add regulator support hwmon: (emc1403) Convert to use OF bindings dt-bindings: hwmon: Document SMSC EMC1402/1403/1404/1428 hwmon: (asus-ec-sensors) add ROG STRIX Z390-E GAMING hwmon: (sysfs) Allow drivers to register const attributes hwmon: (corsair-psu) Update documentation hwmon: (core) Use const APIs for the dynamically allocated sysfs attributes hwmon: (core) Constify device attributes ...
2026-08-19Merge tag 'watchdog-for-v7.3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull watchdog updates from Guenter Roeck: "New Drivers: - Nuvoton MA35D1 - Lenovo SE30G2 and SE60 Added support to existing drivers: - snps,dw-wdt: Add RV1106 compatible - apple,wdt: Add t6030, t6031, and t8132 compatibles Other notable changes: - New "dump" pretimeout governor - Propagate errors from optional IRQ lookup - Remove redundant dev_err() and dev_err_probe() messages - npcm, qcom: Improved bootstatus reports - realtek-otto: Change to use regmap API - w83627hf_wdt: Report running watchdog, identify NCT6126 Various other minor fixes and improvements" * tag 'watchdog-for-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (40 commits) watchdog: orion_wdt: Propagate errors from optional IRQ lookup watchdog: qcom: Propagate errors from optional IRQ lookup watchdog: aspeed: Propagate errors from optional IRQ lookup watchdog: stm32_iwdg: Propagate errors from optional IRQ lookup watchdog: dw_wdt: Propagate errors from optional IRQ lookup watchdog: mediatek: Propagate errors from optional IRQ lookup watchdog: apple: Constify some structures watchdog: pretimeout: Convert dump pretimeout governor to tristate nmi: Export CPU backtrace APIs for loadable modules watchdog: booke_wdt: Document unused parameter of __booke_wdt_disable() watchdog: wdat_wdt: map registers that fall inside ACPI NVS watchdog: Add Nuvoton MA35D1 watchdog driver support dt-bindings: watchdog: Add MA35D1 Watchdog watchdog: qcom: report bootstatus on IPQ9574 and IPQ5332 watchdog: qcom: report WDIOF_POWERUNDER in bootstatus watchdog: sprd: Remove redundant dev_err() watchdog: sama5d4: Remove redundant dev_err() watchdog: realtek_otto: Remove redundant dev_err_probe() watchdog: orion: Remove redundant dev_err() watchdog: marvell_gti: Remove redundant dev_err_probe() ...
2026-08-19Merge tag 'spi-v7.3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi updates from Mark Brown: "Along with a lot of driver specific work we've got a couple of core features here. The bigger one is that we've now got support for instantiating devices from sysfs similarly to how it's already done for I2C, this is used with development boards with non-enumerable expansion headers since SPI devices need to be manually specified. We also have support for the DQS signal on higher end flash devices. - Support for instantiating devices from sysfs, useful for development boards with non-enumerable plugin modules, from Vishwaroop A. - Support for DQS in spi-mem, an additional signal used by flash devices to avoid clock skew from Miquel Raynal. - Support for more advanced SPI modes on DesignWare controllers from Sudip Mukherjee. - Changes from Jisheng Zhang to update to modern methods of specifying the PM callbacks. - Fixes for DMA mapping error handling, plus KUnit tests for this, from Honghui Jiang. - Substantial cleanup and performance work in the nxp-spi driver. - Support for Microchip LAN969x, Nuvoton MA35D1 QSPI, Qualcomm SA8255p and SA8797P, and StarFive JHB100 SFC" * tag 'spi-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (132 commits) spi: Add KUnit coverage for DMA mapping error paths spi: Clear current DMA devices when unmapping a message spi: Move __spi_unmap_msg() before __spi_map_msg() spi: Fix DMA mapping ownership on partial map failure spi: dt-bindings: sun6i: Add compatibles for A733's SPI controllers spi: ma35d1-qspi: Use the existing update helper spi: ma35d1-qspi: Add DTR support spi: ma35d1-qspi: Allow several command bytes spi: ma35d1-qspi: Move speed setting to bus configuration spi: ma35d1-qspi: Remove redundant reset operation spi: dw: Remove shadowed dws in dw_spi_setup() spi: img-spfi: don't disable runtime PM on DMA deferred probe spi: mtk-nor: Propagate errors from IRQ request spi: mtk-nor: Propagate errors from optional IRQ lookup spi: spi-qpic-snand: Handle Macronix quad read opcode 0x6b spi: spi-qpic-snand: add quad mode support spi: spi-qpic-snand: move command mapping helper spi: hisi-sfc-v3xx: Propagate errors from optional IRQ lookup spi: meson-spifc: use devm_pm_runtime_set_active_enabled spi: sprd-adi: Fix probe succeeding without registering the controller ...
2026-08-19Merge tag 'regulator-v7.3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator updates from Mark Brown: "This is a relatively quiet release for the regulator API, we've had no major core work and not really that much driver work either. There's a bunch of activity, including several new devices, but nothing hugely remarkable here. - Reworking of the mode handling in the max14577 driver to fix issues with collisions with enables - Support for onsemi FAN53555BUC23X, Qualcomm IPQ9650, PM4125 VBUS and PM8150B and Unisoc SC2730" * tag 'regulator-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (36 commits) regulator: fan53555: Add support for FAN53555BUC23X type regulator: qcom-rpmh: Fix coding style issues regulator: qcom-rpmh: readback voltage/bypass/mode set during bootup regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling soc: qcom: rpmh: Add support to read back resource settings regulator: dt-bindings: ti,pbias-omap: Convert to DT schema regulator: ab8500: Remove stale expand_register kernel-doc entry regulator: dt-bindings: Correct white-space style regulator: pfuze100: add set_suspend_disable for LDO ops regulator: core: use system_freezable_wq for init complete work regulator: rt6245: Restore state on enable failure regulator: tps65185: handle gpiod_get_value_cansleep() error returns regulator: fan53555: Add support for mode operations on Silergy devices regulator: dt-bindings: Add fan53555 allowed modes regulator: wm831x-isink: remove conditional return with no effect regulator: dt-bindings: Convert ltc3589.txt to yaml format regulator: dt-bindings: tps51632: Convert to DT schema regulator: mcp16502: Convert to dev_err_probe() in mcp16502_probe() regulator: adp5055: Fix error code in adp5055_of_parse_cb() regulator: qcom_usb_vbus: add support for qcom,pm4125-vbus-reg ...
2026-08-19Merge tag 'regmap-v7.3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap updates from Mark Brown: "This is a relatively busy release, though it's mostly cleanup work. We did add some new hooks for regmap-irq to support some driver work, that should also come in as part of a shared branch with the relevant driver work in the GPIO subsystem" * tag 'regmap-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap: clean up kernel-doc comments regcache: Validate cache_only state in regcache_sync_region() regcache: Warn if regcache_sync() is called in cache_only mode regcache: Mark cache dirty if selector register rewrite fails regcache: Preserve cache synchronization errors in regcache_sync() regmap: maple: Workaround for another false-positive compiler warning regcache: Make ->exit() callback return void
2026-08-19Merge tag 'pmdomain-v7.3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm Pull pmdomain updates from Ulf Hansson: - amlogic: Add support for A9 power domains - bcm: Raise ASB poll timeout to 100us for bcm2835-power - imx: Allow building power domain drivers as a modules - mediatek: - Add support for the MT6858 power domains - Add support for the MT8196 HFRP DirectCTL power domains - qcom: - Add support for RPMh power domains for Maili - Skip retention by default for rpmhpd - renesas: Add support for R-Car X5H Module Controller - rockchip: Add a regulator to the RK3568 NPU power domain - tegra: Add support for multi-socket platforms * tag 'pmdomain-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: (24 commits) pmdomain: renesas: Add R-Car X5H MDLC driver dt-bindings: power: Document Renesas R-Car X5H Module Controller pmdomain: amlogic: Add support for A9 power domains controller dt-bindings: power: Add Amlogic A9 power domains clk: imx: imx8qxp: add soft dependency on SCU power domain driver pmdomain: imx: scu-pd: allow building as a module of: export of_stdout symbol pmdomain: imx8m{p,}-blk-ctrl: Add MODULE_DESCRIPTION pmdomain: mediatek: Add support for MT6858 SoC pmdomain: mediatek: Add support for secure modem power domain control dt-bindings: power: Add MediaTek MT6858 power domain controller pmdomain: rockchip: Add a regulator to the RK3568 NPU power domain pmdomain: imx: Make IMX8M/IMX9 BLK_CTRL tristate dt-bindings: power: qcom,rpmpd: document RPMh power domain for Maili pmdomain: tegra: Add support for multi-socket platforms pmdomain: bcm: bcm2835-power: Raise ASB poll timeout to 100us pmdomain: mediatek: Add support for MT8196 HFRP DirectCTL domains pmdomain: mediatek: Add support for Direct CTL simple power sequence pmdomain: mediatek: Respect PD relationships during error cleanup dt-bindings: power: mediatek: Add support for MT8196 direct HFRP ...
2026-08-19Merge tag 'i2c-7.3-part1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux Pull i2c updates from Andi Shyti: "The main changes are support for shared SCL lines in i2c-gpio, a larger qcom-geni update covering tracing and transfer recovery and support for R-Car Gen5. The rest is mostly smaller driver, core and DT binding updates. Core and helpers: - support bus recovery with single-ended GPIOs - acpi: clean up resource handling - acpi: force ELAN1300 to 100 kHz - algo-bit: allow consumers to skip the optional bus test Drivers: - use generic bus frequency definitions in nomadik, octeon-core, microchip-corei2c, k1, davinci and pnx - i2c-gpio: support multiple buses sharing the same SCL line - qup: propagate clock enable failures - spacemit: configure SCL timing and clean up clock handling - amd-asf: guard against oversized firmware length qcom-geni: - add tracepoints for bus setup, interrupts and errors - use dedicated completion events for abort and reset - distinguish address and data NACK handling - cancel transfers before falling back to abort - simplify runtime PM and resource management - refactor resource and serial engine initialization DT bindings: - convert Altera bindings to DT schema - convert Axxia bindings to DT schema New support: - R-Car Gen5 and R-Car X5H - Axiado AX3005 - Qualcomm Nord SA8797P - Qualcomm SA8255p" * tag 'i2c-7.3-part1' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux: (33 commits) i2c: core: support recovery for single-ended GPIOs i2c: rcar: add R-Car Gen5 support dt-bindings: i2c: rcar-i2c: Document R-Car X5H support i2c: i2c-gpio: Enhance driver for buses with shared SCL i2c: algo: bit: Allow to skip bit test i2c: qcom-geni: Add trace events for Qualcomm GENI I2C driver i2c: qcom-geni: trace: Add trace events for Qualcomm GENI I2C i2c: qup: Propagate clock enable failures i2c: qcom-geni: distinguish address-phase and data-phase NACK i2c: qcom-geni: use dedicated completions for abort and reset events i2c: qcom-geni: use cancel command before abort on transfer timeout dt-bindings: i2c: cdns: add Axiado AX3005 I2C variant i2c: qcom-geni: Use devm_pm_runtime_enable() for PM management dt-bindings: i2c: qcom,sa8255p-geni-i2c: Add compatible for Nord SA8797P i2c: nomadik: Use generic definitions for bus frequencies i2c: octeon-core: Use generic definitions for bus frequencies i2c: microchip-corei2c: Use generic definitions for bus frequencies i2c: k1: Use generic definitions for bus frequencies i2c: davinci: Use generic definitions for bus frequencies i2c: pnx: Use generic definitions for bus frequencies ...
2026-08-19rtc: st-lpc: get IRQ via platform_get_irq()Rosen Penev
Replace irq_of_parse_and_map() with platform_get_irq(), which resolves the interrupt from pdev->dev.of_node directly and returns a positive IRQ or a negative errno (it never returns 0). Propagate the error on failure instead of the previous open-coded "IRQ missing or invalid" / -EINVAL message, so -EPROBE_DEFER is handled correctly. The rtc->irq field is a signed short, so the negative error code is preserved. np is still used by of_property_read_u32() for "st,lpc-mode", so it is not removed. Built for ARM (multi_v7_defconfig + CONFIG_RTC_DRV_ST_LPC) with LLVM=1; drivers/rtc/rtc-st-lpc.o compiles cleanly. Assisted-by: opencode:hy3-free Signed-off-by: Rosen Penev <rosenp@gmail.com> Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com> Link: https://patch.msgid.link/20260714002259.1392655-1-rosenp@gmail.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-08-19rtc: mv: remove mv_rtc_removeAlexandre Belloni
Use devm_device_init_wakeup() so we can avoid having to explicitly teardown of module removal. Link: https://patch.msgid.link/20260625130202.1621692-2-alexandre.belloni@bootlin.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-08-19rtc: mv: fix potential race conditionAlexandre Belloni
Since the driver allocates the IRQ using devm_request_irq(), this means the IRQ is going to be automatically unregistered by devres after mv_rtc_remove() returns. However, mv_rtc_remove() explicitly disables the hardware clock before devres teardown happens so the interrupt handler may run while the clock is disabled leading to a possible bus hang when accessing registers. Link: https://patch.msgid.link/20260625130202.1621692-1-alexandre.belloni@bootlin.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-08-19rtc: ab-eoz9: add missing MODULE_DEVICE_TABLE()Pengpeng Hou
The driver has a match table for the i2c bus wired into its driver structure, but the table is not exported with MODULE_DEVICE_TABLE(). Add the missing MODULE_DEVICE_TABLE() entry so module alias information is generated for automatic module loading. This is a source-level fix. It does not claim dynamic hardware reproduction; the evidence is the driver-owned match table, its use by the driver registration structure, and the missing module alias publication. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Link: https://patch.msgid.link/20260704152528.53258-1-pengpeng@iscas.ac.cn Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-08-19rtc: brcmstb-waketimer: add missing MODULE_DEVICE_TABLE()Pengpeng Hou
The driver has an OF match table wired to .of_match_table, but does not export the table with MODULE_DEVICE_TABLE(). Add the missing MODULE_DEVICE_TABLE(of, ...) entry so module alias information is generated for OF based module autoloading. This is a source-level fix. It does not claim dynamic hardware reproduction; the evidence is the driver-owned match table, its use by the platform driver, and the missing module alias publication. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Link: https://patch.msgid.link/20260704121734.54941-1-pengpeng@iscas.ac.cn Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-08-19Merge tag 'gpio-updates-for-v7.3-rc1-v2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio updates from Bartosz Golaszewski: "GPIO core: - extend the gpio-regmap abstraction layer with more features allowing users to override configuration setting, translate register values and masks and enable/disable interrupts - extend GPIO kunit tests with suites verifying probe ordering by software node devlink support and software node hogs - shrink GPIO kunit initialization code - coding style updates (remove commas from sentinels where applicable) - with all users now converted treewide to using real firmware node links for software node GPIO lookup: remove the deprecated label-matching mechanism from from GPIO core - drop redundant return value check of nonseekable_open() in gpiolib-cdev - use IRQ trigger helpers where applicable Driver updates: - refactor error paths and logging in gpio-nomadik - use more modern interfaces for getting resources in gpio-rockchip, gpio-bt8xx and gpio-pca9570 - add missing MODULE_DEVICE_TABLE() to gpio-sifive and gpio-vf610 - drop unused FILONOFF macro from gpio-rcar - extend build coverage of ioport GPIO drivers with COMPILE_TEST=y - only enable the gpio-rtd driver by default with ARCH_REALTEK=y to avoid bloating the build - refactor coding style in several drivers - use correct endianess translation in gpio-pcf85x - add wake-up interrupt support to gpio-mvebu - apply initial value in direction output setter in gpio-by-pinctrl Misc: - replace linux/gpio.h inclusions treewide with linux/gpio/legacy.h which now exports all the deprecated APIs - select GPIOLIB_LEGACY in Kconfig where required treewide - use software nodes for gpio-keys in MFD drivers Devicetree bindings: - describe the realtek rtd1625 GPIO controller - document new models for gpio-pca95xx and gpio-cadence - document new property in gpio-rockchip" * tag 'gpio-updates-for-v7.3-rc1-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (61 commits) gpio: gpio-by-pinctrl: Apply initial value in direction output wrapper dt-bindings: gpio: rockchip,gpio-bank: Add rockchip,grf property gpio: Use IRQ trigger mask helpers gpio: allow COMPILE_TEST for IOPORT drivers gpio: realtek: Add driver for Realtek DHC RTD1625 SoC gpio: regmap: Add IRQ enable/disable helpers gpio: regmap: Add set_config callback gpio: regmap: Add value_xlate callback gpio: regmap: Add gpio_regmap_operation to extend reg_mask_xlate callback gpio: regmap: Order kernel-doc descriptions with the actual appearance gpio: regmap: Apply default resource callbacks for regmap IRQ chip gpio: regmap: Provide default IRQ resource request and release callbacks Revert "gpio: realtek: Add driver for Realtek DHC RTD1625 SoC" gpib: gpio: replace linux/gpio.h inclusion Input: matrix_keyboard - replace linux/gpio.h inclusion phy: replace linux/gpio.h inclusions pcmcia: replace linux/gpio.h inclusions ASoC: replace linux/gpio.h inclusions mfd: replace linux/gpio.h inclusions sh: replace linux/gpio.h inclusions ...
2026-08-19Merge tag 'pwrseq-updates-for-v7.3-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull power sequencing updates from Bartosz Golaszewski: "This a very tiny pull for v7.3 from the power sequencing tree. It only contains a handful of updates to the pwrseq-pcie-m2 driver: - add support for new devices to pwrseq-pcie-m2 - make device matching more fine-grained for cases where the same combo chips are wired differently on the M.2 card (and - for instance - don't require serial device creation because they expose BT over USB) in pwrseq-pcie-m2" * tag 'pwrseq-updates-for-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: power: sequencing: pcie-m2: Match WCN6855 and WCN7851 UART BT variants by subdevice ID power: sequencing: pcie-m2: Add QCA2066 (QCNFA765) BT serdev ID power: sequencing: pcie-m2: Add PCI ID for NXP 88W9098 and AW693 Bluetooth
2026-08-19Merge tag 'pwm/for-7.3-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux Pull pwm updates from Uwe Kleine-König: "A bunch of cleanups - in C and Rust - and a devicetree and driver extension for a new SoC variant. Thanks to Biju Das, Francis Laniel, Guru Das Srinagesh, Markus Elfring, Mikko Perttunen, Thierry Reding, and Yi-Wei Wang for their changes and further Alexandre Courbot, Benno Lossin, Chen Wang, Geert Uytterhoeven, Jon Hunter, Laurent Pinchart, Michal Wilczynski, Mikko Perttunen, and Rob Herring for valuable review feedback" * tag 'pwm/for-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux: pwm: th1520: use vertical import style rust: pwm: replace `core::mem::zeroed` with `pin_init::zeroed` pwm: rzg2l-gpt: Drop unused rzg2l_gpt_chip parameter from rzg2l_gpt_calculate_prescale() pwm: Use seq_putc() calls in pwm_dbg_show() pwm: tegra: Add support for Tegra264 pwm: tegra: Parametrize duty and scale field widths pwm: tegra: Modify read/write accessors for multi-register channel pwm: tegra: Avoid hard-coded max clock frequency pwm: tegra: Prefix driver-local macros and functions dt-bindings: pwm: Document Tegra264 controller pwm: lpss-pci: Unify coding style of pci_device_id array pwm: Unify coding style of of_device_id arrays pwm: Unify coding style of acpi_device_id arrays pwm: Use named initializers for arrays of acpi_device_id pwm: pca9685: Drop unused assignment of acpi_device_id driver data pwm: pxa: Depend on OF and simplify accordingly pwm: Use named initializers for platform_device_id arrays pwm: mc33xs2410: Initialize spi_device_id arrays using member names
2026-08-19Merge tag 'input-for-v7.3-rc0' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: - A new driver and device tree binding for Imagis ISA1200 haptic motor controller - Improvements to input core opening, closing and inhibiting devices, ensuring devices are fully ready before delivering events, deferring handler start() until the device is opened, resyncing state on uninhibit, and rejecting inhibit requests during unregistration - Updates to cap11xx capacitive touch driver to support Microchip CAP1114, optional hardware reset GPIO handling, and per-chip LED constraints - Fixes for MELFAS MMS114 touchscreen driver hardening incoming data parsing, endianness fixes for I2C packet layout, Y-resolution configuration, and refactoring to use chip variant descriptors - Updates for psmouse driver resolving a potential UAF during protocol disconnect, cleaning up PNP ID matching, and making use of guard() - Fix for FocalTech PS/2 protocol to prevent coordinate underflow and cursor jumps at boundaries - A change to Synaptics driver to enable InterTouch (SMBus) mode on Dell Inspiron 3521 - Refactoring of PA-RISC keyboard support in gscps2 to supply keymaps via software node device properties, removing architecture-specific tables from the generic atkbd driver - Updates to Samsung keypad driver to keep interrupts disabled while device is closed, along with wakeup logic cleanups and use of pm_runtime_active guards - Updates to NXP i.MX SNVS power key driver to report press events during resume to avoid lost events, and error handling cleanups - Updated TCA8418 keypad driver enabling overflow mode per hardware errata - Conversion of ROHM BD718x7 and BD71828 PMIC drivers to instantiate gpio-keys child devices using software nodes instead of platform data (coming from MFD immutable branch) - Updates to Synaptics RMI4 driver to use touchscreen dimensions from platform data when specified - Firmware update speed optimization for IC Type 0x19 in ELAN I2C driver - A fix to Azoteq IQS5xx driver to validate firmware record spans against programmable map size - Update to Samsung SUR40 contact count based on PixelSense specification - A number of updates to device tree bindings, including TI TPS65217 power button schema conversion and new compatibles for FocalTech FT3D81 and Synaptics S3706B - Other assorted driver cleanups, style fixes, and conversions to modern string and cleanup helpers * tag 'input-for-v7.3-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (61 commits) Input: rmi4 - use platform data instead of query, when available Input: elan_i2c - sort include statements Input: elan_i2c - optimize update speed for IC Type 0x19. Input: elan_i2c - use device-id/acpi.h for ACPI IDs Input: reject inhibit and uninhibit requests on unregistering devices Input: defer handler's start() until device is opened Input: call handler->start() when uninhibiting device Input: clear inhibited flag before re-opening device on uninhibit Input: ensure device is ready before delivering events Input: gscps2 - supply PA-RISC keyboard keymap via device property Input: synaptics_i2c - return 0 explicitly on success Input: rmi_smbus - remove conditional return with no effect Input: pmic8xxx-keypad - remove conditional return with no effect Input: focaltech - use signed coordinates to prevent underflow Input: psmouse - use guard() for resource management Input: psmouse - modernize PNP ID parsing Input: psmouse - clean up locking around disable_work_sync() Input: psmouse - fix use-after-free during protocol disconnect Input: samsung-keypad - use pm_runtime_active guard Input: samsung-keypad - keep interrupt disabled while closed ...
2026-08-19rtc: s32g: add missing MODULE_DEVICE_TABLE()Pengpeng Hou
The driver has an OF match table wired to .of_match_table, but does not export the table with MODULE_DEVICE_TABLE(). Add the missing MODULE_DEVICE_TABLE(of, ...) entry so module alias information is generated for OF based module autoloading. This is a source-level fix. It does not claim dynamic hardware reproduction; the evidence is the driver-owned match table, its use by the platform driver, and the missing module alias publication. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Reviewed-by: Matthias Brugger <mbrugger@suse.com> Reviewed-by: Ciprian Marian Costea <ciprianmarian.costea@oss.nxp.com> Link: https://patch.msgid.link/20260704122003.70108-1-pengpeng@iscas.ac.cn Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-08-19Merge tag 'chrome-platform-firmware-v7.3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux Pull chrome platform firmware updates from Tzung-Bi Shih: "Fixes: - Don't map no-map memory regions for CBMEM entries - Check bound of coreboot table entries Cleanups: - Fix typo in docs" * tag 'chrome-platform-firmware-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux: firmware: coreboot: Validate table bounds firmware: coreboot: Skip no-map CBMEM entries docs: ABI: testing: Fix typo
2026-08-19rtc: zynqmp: Return optional clock lookup errorsPengpeng Hou
devm_clk_get_optional() returns NULL when the optional clock is absent, but returns an ERR_PTR when the clock provider lookup fails. Probe currently keeps the ERR_PTR and then passes it to clk_get_rate(). Return the lookup error instead. A truly absent optional clock still reaches the existing calibration fallback through clk_get_rate(NULL). Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Fixes: 07dcc6f9c762 ("rtc: zynqmp: Add calibration set and get support") Reviewed-by: Michal Simek <michal.simek@amd.com> Link: https://patch.msgid.link/20260624055524.38522-1-pengpeng@iscas.ac.cn Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-08-19rtc: ds1343: replace symbolic permissions with octalJack Lee
Symbolic permissions S_IRUGO and S_IWUSR are deprecated in favor of octal permissions. Replace S_IRUGO|S_IWUSR with 0644 and S_IRUGO with 0444. Signed-off-by: Jack Lee <skunkolee@gmail.com> Link: https://patch.msgid.link/20260612223534.77412-1-skunkolee@gmail.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-08-19smb/client: fix nlink of an overwritten open fileChenXiaoSong
Reproducer: 1. server: systemctl start ksmbd 2. client: mount with `posix` option mount -t cifs -o posix //${server_ip}/export /mnt 3. client: touch /mnt/file1 /mnt/file2 4. client: C program: int fd = open("/mnt/file2", O_RDONLY); 5. client: C program: rename("/mnt/file1", "/mnt/file2"); 6. client: C program: struct stat stbuf; fstat(fd, &stbuf); stbuf.st_nlink is 1, should be 0 This patch fixes xfstests generic/035 when mounted with `posix` option. Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn> Signed-off-by: Steve French <stfrench@microsoft.com> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Paulo Alcantara <pc@manguebit.org>
2026-08-19cifs: remove dead size-update blocks in cifs_setattr_unix/nounixFrank Sorenson
Commit 110fee6b9bb5 ("smb: client: fix missing timestamp updates with O_TRUNC") introduced cifs_file_set_size(), which calls netfs_resize_file() and cifs_setsize() on success. cifs_setsize() calls i_size_write(), updating i_size to the new value. The subsequent blocks in both cifs_setattr_unix() and cifs_setattr_nounix(): if ((attrs->ia_valid & ATTR_SIZE) && attrs->ia_size != i_size_read(inode)) { truncate_setsize(inode, attrs->ia_size); netfs_resize_file(&cifsInode->netfs, attrs->ia_size, true); fscache_resize_cookie(cifs_inode_cookie(inode), attrs->ia_size); } are therefore unreachable on the success path: attrs->ia_size == i_size_read(inode) always holds after cifs_file_set_size() succeeds. On the failure path, execution jumps to out/cifs_setattr_exit before reaching these blocks. truncate_setsize() and netfs_resize_file() are redundant with what cifs_file_set_size() already did; fscache_resize_cookie() was moved there by commit fa724e235cfd ("cifs: add fscache_resize_cookie() to cifs_setsize()"). Remove both dead blocks. Fixes: 110fee6b9bb5 ("smb: client: fix missing timestamp updates with O_TRUNC") Signed-off-by: Frank Sorenson <sorenson@redhat.com> Reviewed-by: Huiwen He <hehuiwen@kylinos.cn> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Paulo Alcantara <pc@manguebit.org>
2026-08-19cifs: remove redundant size-update block in cifs_remap_file_range()Frank Sorenson
cifs_remap_file_range() acquires i_rwsem on both inodes via lock_two_nondirectories() before calling smb2_duplicate_extents(). cifs_setsize() (called inside smb2_duplicate_extents() when the clone extends the file) therefore already runs under the lock, meaning the fscache_resize_cookie() added to cifs_setsize() by commit fa724e235cfd ("cifs: add fscache_resize_cookie() to cifs_setsize()") is correctly serialised for this path without further changes. That same commit made the caller-side block: if (rc == 0 && new_size > i_size) { truncate_setsize(target_inode, new_size); fscache_resize_cookie(cifs_inode_cookie(target_inode), new_size); } redundant: smb2_duplicate_extents() already performs the full size update via cifs_setsize() when the operation extends the file. Remove the now-dead block. Signed-off-by: Frank Sorenson <sorenson@redhat.com> Reviewed-by: Huiwen He <hehuiwen@kylinos.cn> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Paulo Alcantara <pc@manguebit.org>
2026-08-19cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under ↵Frank Sorenson
i_rwsem cifs_setsize() calls fscache_resize_cookie() without holding i_rwsem. When the fscache cookie is active (FSCACHE_COOKIE_IS_CACHING is set), fscache_resize_cookie() performs a real resize that requires i_rwsem held exclusively. If another file descriptor has the same inode open, fscache_use_cookie() was already called from that cifs_open(), making the cookie active. In that case, calling cifs_setsize() from cifs_do_truncate() (invoked from cifs_open() without i_rwsem) races against concurrent fscache I/O. Strip fscache_resize_cookie() from cifs_setsize(), making it a pure size/page-cache helper. Add cifs_resize_file_locked() for callers that already hold i_rwsem: it calls netfs_resize_file() and cifs_setsize(), then temporarily activates the cookie with fscache_use_cookie() to perform the resize under the lock, then deactivates it with cifs_fscache_unuse_inode_cookie(). Using fscache_use_cookie() before the resize ensures correctness whether or not another fd already holds the cookie active. Switch cifs_file_set_size(), smb2_duplicate_extents(), and both size- extension branches of smb3_simple_falloc() to the new wrapper; those paths already hold i_rwsem via VFS setattr, lock_two_nondirectories(), or cifs_fallocate() respectively. cifs_do_truncate() continues to call cifs_setsize() followed by cifs_invalidate_cache(), since it runs without i_rwsem. Fixes: fa724e235cfd ("cifs: add fscache_resize_cookie() to cifs_setsize()") Cc: stable@vger.kernel.org Cc: David Howells <dhowells@redhat.com> Cc: Paulo Alcantara <pc@manguebit.com> Signed-off-by: Frank Sorenson <sorenson@redhat.com> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Paulo Alcantara <pc@manguebit.org>
2026-08-19cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNCFrank Sorenson
cifs_do_truncate() is invoked from cifs_open() without i_rwsem, so it cannot use cifs_resize_file_locked() to perform a proper fscache cookie resize. Instead, add cifs_invalidate_cache() after cifs_setsize(). cifs_invalidate_cache() calls fscache_invalidate(), which works without holding i_rwsem: it unconditionally increments inval_counter and sets FSCACHE_COOKIE_NO_DATA_TO_READ, ensuring that stale cached data is not served once the cookie is later activated by fscache_use_cookie(). Truncation to zero leaves no valid cached data, making invalidation the correct semantic here. Fixes: fa724e235cfd ("cifs: add fscache_resize_cookie() to cifs_setsize()") Cc: stable@vger.kernel.org Cc: David Howells <dhowells@redhat.com> Cc: Paulo Alcantara <pc@manguebit.com> Signed-off-by: Frank Sorenson <sorenson@redhat.com> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Paulo Alcantara <pc@manguebit.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-09-08 18:50:10 +0000