Selvin Xavier [Mon, 15 Jun 2026 22:47:39 +0000 (15:47 -0700)]
RDMA/bnxt_re: Free CQ toggle page after firmware teardown
Free the toggle page only after firmware teardown completes so that
an NQ interrupt arriving during bnxt_qplib_destroy_cq() won't write
the toggle value to an already-freed page. Move free_page() after
bnxt_qplib_destroy_cq.
Selvin Xavier [Mon, 15 Jun 2026 22:47:38 +0000 (15:47 -0700)]
RDMA/bnxt_re: Free SRQ toggle page after firmware teardown
Free the toggle page only after firmware teardown completes so that
an NQ interrupt arriving during bnxt_qplib_destroy_srq() won't write
the toggle values to an already-freed page. Move free_page() after
bnxt_qplib_destroy_srq().
===================
This is supposed to improve s390 idle time accounting, and brings it
back to the state it was before arch_cpu_idle_time() was removed from
s390 [3].
In result all cpu time accounting is done by the s390 architecture backend
again, instead of having a mix of architecure specific and common code
accounting (common code: idle, s390 architecture: everything else).
===================
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
Francesco Lavra [Tue, 16 Jun 2026 11:44:29 +0000 (13:44 +0200)]
regcache: Do not overwrite error code when finalizing cache after error
During regcache initialization, if an error occurs in the
cache_ops->populate callback, and if cache operations include an exit
callback, the error code from populate() is overwritten with the return
value from exit(). This hides the error condition from the caller of
regcache_init(), and can cause NULL pointer dereferences when the regcache
is later accessed.
The YAML conversion added me as maintainer but I can't recall being
asked nor do I want to maintain it. Thierry has created the YAML file
and works for the company which contributed the driver.
dt-bindings: i2c: convert i2c-mux-reg to DT schema
Convert Documentation/devicetree/bindings/i2c/i2c-mux-reg.txt to
the YAML schema so the i2c-mux-reg binding is validated by
dt_binding_check. Faithful port of the existing properties; no
semantic change.
Haoxiang Li [Wed, 10 Jun 2026 03:05:13 +0000 (11:05 +0800)]
i2c: davinci: Unregister cpufreq notifier on probe failure
davinci_i2c_probe() registers a cpufreq transition notifier before adding
the I2C adapter. If i2c_add_numbered_adapter() fails, the probe error path
releases the device resources without unregistering the notifier.
Add a dedicated error path to unregister the cpufreq notifier after
i2c_add_numbered_adapter() fails.
In cci_probe() the controller's interrupt is requested using a devres
managed API, and in cci_probe() error path and cci_remove() it'd be
safe to rely on devres mechanism to free and shutdown the interrupt,
thus explicit disable_irq() calls can be removed as unnecessary ones.
Signed-off-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org> Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Andi Shyti <andi.shyti@kernel.org> Link: https://lore.kernel.org/r/20260515234121.1607425-5-vladimir.zapolskiy@linaro.org
i2c: qcom-cci: Move cci_init() under cci_reset() function
On probe or runtime errors cci_reset() is called and it should be coupled
with cci_init(), instead of doing this on caller's side, embed cci_init()
directly into the cci_reset() function.
This is a non-functional change, cci_reset() and cci_init() function
bodies are reordered.
Signed-off-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org> Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Andi Shyti <andi.shyti@kernel.org> Link: https://lore.kernel.org/r/20260515234121.1607425-4-vladimir.zapolskiy@linaro.org
Linus Torvalds [Tue, 16 Jun 2026 12:20:34 +0000 (17:50 +0530)]
Merge tag 'trace-tools-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull RTLA tool updates from Steven Rostedt:
- Fix discrepancy in --dump-tasks option
Due to a mistake, rtla-timerlat-hist used the CLI syntax
"--dump-task" instead of the documented "--dump-tasks". Change the
option to match both documentation and the other timerlat tool,
rtla-timerlat-top.
- Extend coverage of runtime tests
Cover both top and hist tools in all applicable test cases, add tests
for a few uncovered options, and extend checks for some existing
tests.
- Add unit tests for actions
rtla's actions feature is implemented in its source file and contains
non-trivial parsing logic. Cover it with unit tests.
- Stop record trace on interrupt
Fix a bug where an interval exists after receiving a signal in which
the main instance is stopped but the record instance is not, leading
to discrepancies in reported results and sometimes rtla hanging.
- Restore continue flag in actions_perform()
Fix a bug where rtla always continues tracing after hitting a
threshold even if the continue action was triggered just once, and
add tests verifying that the flag is reset properly.
- Migrate command line interface to libsubcmd
Replace rtla's argument parsing using getopt_long() with libsubcmd,
used by perf and objtool, to reuse existing code and auto-generate
better help messages. Extensive unit tests are included to detect
regressions.
- Add -A/--aligned option to timerlat tools
Add an option to align timerlat threads, based on the recently
introduced TIMERLAT_ALIGN option of the timerlat tracer, together
with unit tests and documentation.
- Document tests in README
Document how to run unit and runtime tests in rtla's README.txt,
including the dependencies needed to run them.
* tag 'trace-tools-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (26 commits)
rtla: Document tests in README
Documentation/rtla: Add -A/--aligned option
rtla/tests: Add unit tests for -A/--aligned option
rtla/timerlat: Add -A/--aligned CLI option
rtla/tests: Add unit tests for CLI option callbacks
rtla/tests: Add unit tests for _parse_args() functions
rtla: Parse cmdline using libsubcmd
tools subcmd: allow parsing distinct --opt and --no-opt
tools subcmd: support optarg as separate argument
rtla: Add libsubcmd dependency
rtla/tests: Add runtime tests for restoring continue flag
rtla/tests: Run runtime tests in temporary directory
rtla/tests: Add unit test for restoring continue flag
rtla/actions: Restore continue flag in actions_perform()
rtla: Stop the record trace on interrupt
rtla/tests: Add unit tests for actions module
rtla/tests: Add runtime tests for -C/--cgroup
rtla/tests: Add runtime test for -k and -u options
rtla/tests: Add runtime test for -H/--house-keeping
rtla/tests: Cover all hist options in runtime tests
...
Michael Wigham [Sat, 13 Jun 2026 22:52:16 +0000 (23:52 +0100)]
io_uring/rw: preserve partial result for iopoll
A partial read will store the completed byte count in io->bytes_done.
The regular completion path applies io_fixup_rw_res() so that, when the
following operation reaches EOF, the number of bytes already read is
returned.
The iopoll completion path does not apply this fixup to the return value
and can return zero instead.
Use the fixup result when updating the CQE, and the raw result for the
reissue check.
io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE
NOP file-acquisition support choses between a fixed (registered) file and
a normal fget()'d file based on its own IORING_NOP_FIXED_FILE flag in
sqe->nop_flags. However, a request's REQ_F_FIXED_FILE is set
independently from the generic IOSQE_FIXED_FILE sqe flag during request
init, before the issue handler runs.
If a NOP is submitted with IOSQE_FIXED_FILE set (so REQ_F_FIXED_FILE is
set) but without IORING_NOP_FIXED_FILE, io_nop() takes the normal path
and grabs a real reference via io_file_get_normal(). On completion,
io_put_file() only drops the reference when REQ_F_FIXED_FILE is clear,
so the fget()'d file is never released and leaks:
Decide between fixed and normal file acquisition from REQ_F_FIXED_FILE,
the same way io_assign_file() does for every other opcode, and fold
IORING_NOP_FIXED_FILE into REQ_F_FIXED_FILE at prep time.
Cc: stable@vger.kernel.org Fixes: a85f31052bce ("io_uring/nop: add support for testing registered files and buffers") Reported-by: syzbot+2cd473471e77bda12b0e@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?id=879092631b98f73a28ea405adacfa5bb34a14a25 Signed-off-by: Vasileios Almpanis <vasilisalmpanis@gmail.com> Link: https://patch.msgid.link/20260615144619.482749-1-vasilisalmpanis@gmail.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
Linus Torvalds [Tue, 16 Jun 2026 12:08:19 +0000 (17:38 +0530)]
Merge tag 'trace-latency-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull tracing latency updates from Steven Rostedt:
- Dump the stack to the buffer on timerlat uret threashold event
Record the stack trace in the buffer for THREAD_URET as well as
THREAD_CONTEXT when the threshold is hit. Otherwise, if the threshold
was not hit at task wakeup, but was at task return, it will not
produce a stack trace making it harder to debug.
- Have osnoise trace prints print to all buffers
The osnoise tracer is allowed to print to the main buffer. Add a
osnoise_print() helper function and use trace_array_vprintk() to
print osnoise output.
* tag 'trace-latency-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
tracing/osnoise: Array printk init and cleanup
tracing/osnoise: Dump stack on timerlat uret threshold event
Linus Torvalds [Tue, 16 Jun 2026 12:03:20 +0000 (17:33 +0530)]
Merge tag 'probes-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull probes updates from Masami Hiramatsu:
- BTF support for dereferencing pointers
Add syntax to the parsing of eprobes to typecast structure pointer
trace event fields, enabling BTF-based dereferencing instead of
relying on manual offsets.
- Improvements and robustness enhancements
- Use flexible array for entry fetch code.
Store probe entry fetch instructions in the probe_entry_arg
allocation via a flexible array member to simplify memory
allocation and lifetime management.
- Replace BUG_ON with lockdep_assert_held in uprobe_buffer functions
Replace BUG_ON() calls with lockdep_assert_held() in uprobe buffer
enable/disable paths to prevent kernel crashes and better verify
lock ownership.
- Ensure the uprobe buffer size is bigger than event size.
Add a BUILD_BUG_ON() assertion to guarantee that the per-CPU
uprobe working buffer size is always larger than the maximum probe
event size.
* tag 'probes-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
tracing/eprobes: Allow use of BTF names to dereference pointers
tracing: Replace BUG_ON with lockdep_assert_held in uprobe_buffer functions
tracing: Use flexible array for entry fetch code
tracing/probes: Ensure the uprobe buffer size is bigger than event size
Linus Torvalds [Tue, 16 Jun 2026 11:59:24 +0000 (17:29 +0530)]
Merge tag 'bootconfig-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull bootconfig updates from Masami Hiramatsu:
- bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c
Move the xbc_snprint_cmdline() function and its buffer from
main.c to the shared lib/bootconfig.c parser library so it
can be reused by userspace tools.
- render kernel.* subtree as cmdline string with -C
Add a new -C option to print the kernel.* subtree as a flat
command-line string at build time, allowing early parameter
injection without runtime parsing.
* tag 'bootconfig-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
tools/bootconfig: render kernel.* subtree as cmdline string with -C
bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c
Linus Torvalds [Tue, 16 Jun 2026 11:19:07 +0000 (16:49 +0530)]
Merge tag 'linux_kselftest-next-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest
Pull kselftest updates from Shuah Khan:
"Several fixes and improvements to resctrl tests and a change to
kselftest document to clarify the use of FORCE_TARGETS build variable"
* tag 'linux_kselftest-next-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:
kselftest: fix doc for ksft_test_result_report()
selftests/resctrl: Reduce L2 impact on CAT test
selftests/resctrl: Simplify perf usage in CAT test
selftests/resctrl: Remove requirement on cache miss rate
selftests/resctrl: Raise threshold at which MBM and PMU values are compared
selftests/resctrl: Increase size of buffer used in MBM and MBA tests
selftests/resctrl: Support multiple events associated with iMC
selftests/resctrl: Prepare for parsing multiple events per iMC
selftests/resctrl: Do not store iMC counter value in counter config structure
selftests/resctrl: Reduce interference from L2 occupancy during cache occupancy test
selftests/resctrl: Improve accuracy of cache occupancy test
docs: kselftest: Document the FORCE_TARGETS build variable
Linus Torvalds [Tue, 16 Jun 2026 11:03:57 +0000 (16:33 +0530)]
Merge tag 'linux_kselftest-kunit-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest
Pull kunit updates from Shuah Khan:
"Fixes to tool and kunit core and new features to both to support JUnit
XML (primitive) and backtrace suppression API:
- Core support for suppressing warning backtraces
- Parse and print the reason tests are skipped
- Add (primitive) support for outputting JUnit XML
- Don't write to stdout when it should be disabled
- Add backtrace suppression self-tests
- Suppress intentional warning backtraces in scaling unit tests
- Add documentation for warning backtrace suppression API
- Fix spelling mistakes in comments and messages
- gen_compile_commands: Ignore libgcc.a
- qemu_configs: Add or1k / openrisc configuration"
* tag 'linux_kselftest-kunit-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:
kunit:tool: Don't write to stdout when it should be disabled
kunit: tool: Add (primitive) support for outputting JUnit XML
kunit: tool: Parse and print the reason tests are skipped
kunit: Add documentation for warning backtrace suppression API
drm: Suppress intentional warning backtraces in scaling unit tests
kunit: Add backtrace suppression self-tests
bug/kunit: Core support for suppressing warning backtraces
kunit: Fix spelling mistakes in comments and messages
kunit: qemu_configs: Add or1k / openrisc configuration
gen_compile_commands: Ignore libgcc.a
Sayali Patil [Tue, 16 Jun 2026 06:14:35 +0000 (11:44 +0530)]
powerpc/fadump: define MIN_RMA in bytes rather than MB
The MIN_RMA size checks in fadump_setup_param_area() use
(MIN_RMA * 1024 * 1024), which is evaluated in int and can
overflow when MIN_RMA is increased to values such as SZ_2G,
triggering compiler warnings such as:
warning: integer overflow in expression of type 'int'
results in '0' [-Woverflow]
Define MIN_RMA directly in bytes using SZ_1M and update the
callers accordingly. This avoids repeated unit conversions and
prevents integer overflow.
Also convert MIN_RMA back to MB when populating the firmware
architecture vector, since firmware expects the value in MB.
powerpc: Restore KUAP registers on syscall restart exit
During a syscall restart, block KUAP so that pending interrupts can be
replayed. The original KUAP state is not restored before returning to
userspace, causing subsequent userspace accesses to fault and eventually
trigger bad_access_pkey(), crashing the kernel.
The original KUAP register values are already saved in
arch_enter_from_user_mode(). Restore them on the syscall restart exit
path before returning to userspace.
Linus Torvalds [Tue, 16 Jun 2026 07:50:54 +0000 (13:20 +0530)]
Merge tag 'for-7.2/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm
Pull device mapper updates from Mikulas Patocka:
- small cleanups in dm-vdo, dm-raid, dm-cache, dm-zoned-metadata
- rework of dm-ima
- introduce dm-inlinecrypt
- fix wrong return value in dm-ioctl
- fix rcu stall when polling
* tag 'for-7.2/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
dm-zoned-metadata: Use strscpy() to copy device name
dm cache: make smq background work limit configurable
dm-inlinecrypt: add support for hardware-wrapped keys
dm: limit target bio polling to one shot
dm-ioctl: report an error if a device has no table
dm: add documentation for dm-inlinecrypt target
dm-inlinecrypt: add target for inline block device encryption
block: export blk-crypto symbols required by dm-inlinecrypt
dm-ima: use active table's size if available
dm-ima: Fail more gracefully in dm_ima_measure_on_*
dm-ima: Handle race between rename and table swap
dm-ima: Fix issues with dm_ima_measure_on_device_rename
dm-ima: remove new_map from dm_ima_measure_on_device_clear
dm-ima: Fix UAF errors and measuring incorrect context
dm-ima: don't copy the active table to the inactive table
dm-ima: Remove status_flags from dm_ima_measure_on_table_load()
dm-ima: remove broken last_target_measured logic
dm-ima: remove dm_ima_reset_data()
dm-raid: only requeue bios when dm is suspending
dm vdo: use get_random_u32() where appropriate
Pengpeng Hou [Mon, 15 Jun 2026 09:19:18 +0000 (17:19 +0800)]
gpio: mlxbf3: fail probe if gpiochip registration fails
mlxbf3_gpio_probe() logs a devm_gpiochip_add_data() failure but still
returns success. That leaves the platform device bound even though the
GPIO chip was not registered.
Return the registration error so probe failure matches the missing
gpiochip state.
Linus Torvalds [Tue, 16 Jun 2026 07:32:47 +0000 (13:02 +0530)]
Merge tag 'for-7.2/block-20260615' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull block updates from Jens Axboe:
- NVMe pull request via Keith:
- Per-controller admin and IO timeout sysfs attributes, and
letting the block layer set request timeouts (Maurizio,
Maximilian)
- Multipath passthrough iostats, and PCI P2PDMA enablement for
multipath devices (Keith, Kiran)
- A new diag sysfs attribute group exporting per-controller
counters (retries, multipath failover, error counters, requeue
and failure counts, reset and reconnect events) (Nilay)
- FDP configuration validation and bounds check fixes (liuxixin)
- Various nvmet fixes, including a pre-auth out-of-bounds read in
the Discovery Get Log Page handler, auth payload bounds
validation, and tcp error-path leak fixes (Bryam, Tianchu,
Geliang)
- nvme-tcp lockdep and workqueue fixes (Shin'ichiro, Kuniyuki,
Eric)
- Assorted other fixes and cleanups (John, Yao, Chao, Mateusz,
Achkinazi, Wentao)
- MD pull request via Yu Kuai:
- raid1/raid10 fixes for a deadlock in the read error recovery
path, error-path detection and bio accounting with cloned bios,
and an nr_pending leak in the REQ_ATOMIC bad-block error path
(Abd-Alrhman)
- PCI P2PDMA propagation from member devices to the RAID device
(Kiran)
- dm-raid bio requeue fix, and various smaller fixes and cleanups
(Benjamin, Chen, Li, Thorsten)
- Enable Clang lock context analysis for the block layer, with the
accompanying annotations across queue limits, the blk_holder_ops
callbacks, crypto, cgroup, iocost, kyber and mq-deadline (Bart)
- Block status code infrastructure work: a tagged status table, a
str_to_blk_op() helper, a bio_endio_status() helper, and on top of
that a new configurable block-layer error injection facility
(Christoph)
- DRBD netlink rework, replacing the genl_magic machinery with explicit
netlink serialization and moving the DRBD UAPI headers to
include/uapi/linux/ (Christoph Böhmwalder)
- bvec improvements: a bvec_folio() helper and making the bvec_iter
helpers proper inline functions (Willy, Christoph)
- ublk cleanups and a canceling-flag fix for the disk-not-allocated
case (Caleb, Ming)
- Partition handling fixes: bound the AIX pp_count scan, fix an of_node
refcount leak, and replace __get_free_page() with kmalloc() (Bryam,
Wentao, Mike)
- Convert numa_node to int in blk_mq_hw_ctx and ->init_request, and add
WQ_PERCPU to the block workqueue users (Mateusz, Marco)
- Block statistics and tracing: propagate in-flight to the whole disk
on partition IO, export passthrough stats, and a new
block_rq_tag_wait tracepoint (Tang, Keith, Aaron)
- A round of removals, unexports and cleanups across bio, direct-io and
the bvec helpers (Christoph)
- Various driver fixes (mtip32xx use-after-free, rbd snap_count
validation and strscpy conversion, nbd socket lockdep reclassify,
virtio-blk zone report clamp, floppy) and a batch of MAINTAINERS
email/list updates (Coly, Li, Yu, Christoph Böhmwalder)
- Other little fixes and cleanups all over
* tag 'for-7.2/block-20260615' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (117 commits)
MAINTAINERS: Update Coly Li's email address
block: check bio split for unaligned bvec
nbd: Reclassify sockets to avoid lockdep circular dependency
block: add configurable error injection
block: add a str_to_blk_op helper
block: add a "tag" for block status codes
block: add a macro to initialize the status table
floppy: Drop unused pnp driver data
block: propagate in_flight to whole disk on partition I/O
virtio-blk: clamp zone report to the report buffer capacity
block: optimize I/O merge hot path with unlikely() hints
drivers/block/rbd: Use strscpy() to copy strings into arrays
partitions: aix: bound the pp_count scan to the ppe array
block: Enable lock context analysis
block/mq-deadline: Make the lock context annotations compatible with Clang
block/Kyber: Make the lock context annotations compatible with Clang
block/blk-mq-debugfs: Improve lock context annotations
block/blk-iocost: Inline iocg_lock() and iocg_unlock()
block/blk-iocost: Split ioc_rqos_throttle()
block/crypto: Annotate the crypto functions
...
Linus Torvalds [Tue, 16 Jun 2026 07:23:59 +0000 (12:53 +0530)]
Merge tag 'for-7.2/io_uring-20260615' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull io_uring updates from Jens Axboe:
- Rework the task_work infrastructure.
Both the local (DEFER_TASKRUN) and the normal (tctx) task_work lists
were llist based, which is LIFO ordered, and hence each run had to do
an O(n) list reversal pass first to restore queue order.
Additionally, to cap the amount of task_work run, each method needed
a retry list as well.
Add a lockless MPCS FIFO queue (based on Dmitry Vyukov's intrusive
MPSC algorithm) and switch both task_work lists to it. It performs
better than llists and we can then also ditch the retry lists as well
as entries are popped one-at-the-time.
On top of those changes, run the tctx fallback task_work directly and
remove the now-unused per-ctx fallback machinery entirely.
- zcrx user notifications.
Add a mechanism for zcrx to communicate conditions back to userspace
via a dedicated CQE, with the initial users being notification on
running out of buffers and on a frag copy fallback, plus
shared-memory notification statistics.
Alongside that, a series of zcrx reliability and cleanup fixes: more
reliable scrubbing, poisoning pointers on unregistration, dropping an
extra ifq close, adding a ctx back-pointer, reordering fd allocation
in the export path, and killing a dead 'sock' member.
- Allow using io_uring registered buffers for plain SEND and RECV, not
just for the zero-copy send path.
This enables targets like ublk's NBD backend to push/pull IO data
directly to/from a registered buffer over a plain send/recv on a TCP
socket.
- Registered buffer improvements: account huge pages correctly, bump
the io_mapped_ubuf length field to size_t, and raise the previous 1GB
registered buffer size limit.
- Restrict the ctx access exposed to io_uring BPF struct_ops programs
by handing them an opaque type rather than the full io_ring_ctx, and
add a separate MAINTAINERS entry for the bpf-ops code.
- Allow opcode filtering on IORING_OP_CONNECT.
- Validate ring-provided buffer addresses with access_ok(), and align
the legacy buffer add limit with MAX_BIDS_PER_BGID.
- Various other cleanups and minor fixes, including avoiding msghdr
async data on connect/bind, dropping async_size for OP_LISTEN, making
the POLL_FIRST receive side checks consistent, re-checking
IO_WQ_BIT_EXIT for each linked work item, and using
trace_call__##name() at guarded tracepoint call sites.
* tag 'for-7.2/io_uring-20260615' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (31 commits)
io_uring/bpf-ops: add a separate maintainer entry
io_uring/net: make POLL_FIRST receive side checks consistent
io_uring: remove the per-ctx fallback task_work machinery
io_uring: run the tctx task_work fallback directly
io_uring: switch normal task_work to a mpscq
io_uring: switch local task_work to a mpscq
io_uring/mpscq: add lockless multi-producer, single-consumer FIFO queue
io_uring: grab RCU read lock marking task run
io_uring/zcrx: kill dead 'sock' member in struct io_zcrx_args
io_uring/kbuf: validate ring provided buffer addresses with access_ok()
io_uring/net: support registered buffer for plain send and recv
io_uring/nop: Drop a wrong comment in struct io_nop
io_uring/net: Remove async_size for OP_LISTEN
io_uring/net: Avoid msghdr on op_connect/op_bind async data
io_uring/bpf-ops: restrict ctx access to BPF
io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item
io_uring/kbuf: align legacy buffer add limit with MAX_BIDS_PER_BGID
io_uring/zcrx: add shared-memory notification statistics
io_uring/zcrx: notify user on frag copy fallback
io_uring/zcrx: notify user when out of buffers
...
The generic "ngpios" property is encoded as a normal uint32 cell. The
pisosr driver stores it in the gpio_chip field, but reading it with a
u16 helper does not match the DT property encoding.
Read "ngpios" as u32 and keep the existing assignment to the chip
field.
Linus Torvalds [Tue, 16 Jun 2026 06:57:23 +0000 (12:27 +0530)]
Merge tag 'hfs-v7.2-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/hfs
Pull hfs/hfsplus updates from Viacheslav Dubeyko:
"Several fixes in HFS/HFS+ of syzbot reported issues and HFS//HFS+
fixes of xfstests failures.
- fix a null-ptr-deref issue reported by syzbot (Edward Adam Davis)
If the attributes file is not loaded during system mount
hfsplus_create_attributes_file can dereference a NULL pointer.
Also, add a b-tree node size check in hfs_btree_open() with the
goal to prevent an uninit-value bug reported by syzbot for the case
of corrupted HFS+ image.
- fix __hfs_bnode_create() by using kzalloc_flex() instead of
kzalloc() (Rosen Penev)
- fix early return in hfs_bnode_read() (Tristan Madani)
hfs_bnode_read() can return early without writing to the output
buffer when is_bnode_offset_valid() fails or when
check_and_correct_requested_ length() corrects the length to zero.
Callers such as hfs_bnode_read_ u16() and hfs_bnode_read_u8() pass
stack-allocated buffers and use the result unconditionally, leading
to KMSAN uninit-value reports.
The rest fix (1) generic/637, generic/729 issue for the case of HFS+
file system, (2) generic/003, generic/637 for the case of HFS file
system"
* tag 'hfs-v7.2-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/hfs:
hfs: rework hfsplus_readdir() logic
hfs: disable the updating of file access times (atime)
hfs: fix incorrect inode ID assignment in hfs_new_inode()
hfsplus: rework hfsplus_readdir() logic
hfs/hfsplus: zero-initialize buffer in hfs_bnode_read
hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length
hfsplus: Add a sanity check for btree node size
hfsplus: fix issue of direct writes beyond end-of-file
hfs/hfxplus: use kzalloc_flex()
hfsplus: Remove the duplicate attr inode dirty marking action
Linus Torvalds [Tue, 16 Jun 2026 06:44:20 +0000 (12:14 +0530)]
Merge tag 'nilfs2-v7.2-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/nilfs2
Pull nilfs2 updates from Viacheslav Dubeyko:
"Fixes of syzbot reported issue and various small fixes in NILFS2
functionality.
- fix hung task in nilfs_transaction_begin() (Deepanshu Kartikey)
Reported by syzbot. The root cause is that user-supplied segment
numbers were not validated before nilfs_clean_segments() began
doing work; the range check on each segnum was performed deep
inside the call chain by nilfs_sufile_updatev(), which emits a
nilfs_warn() per invalid entry while still holding the segctor lock
and the sufile mi_sem.
Fix it by validating the contents of kbufs[4] in
nilfs_clean_segments() immediately after acquiring ns_segctor_sem
via nilfs_transaction_lock().
- fix a smatch warning in nilfs_mkdir() warn (Hongling Zeng)
This corrects a semantic issue related to the use of the
ERR_PTR macro that arose from a recent VFS change.
- fix a backing_dev_info reference leak (Shuangpeng Bai)
setup_bdev_super() initializes sb->s_bdev and takes a reference on
the block device backing_dev_info when assigning sb->s_bdi.
nilfs_fill_super() takes another reference to the same
backing_dev_info and stores it in sb->s_bdi again. The extra
reference is not paired with a matching bdi_put(), since
generic_shutdown_super() releases sb->s_bdi only once.
Drop the redundant bdi_get() in nilfs_fill_super(). The single
reference taken by setup_bdev_super() is enough and is released
during superblock shutdown"
* tag 'nilfs2-v7.2-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/nilfs2:
nilfs2: Fix return in nilfs_mkdir
nilfs2: fix backing_dev_info reference leak
nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers
Linus Torvalds [Tue, 16 Jun 2026 06:38:02 +0000 (12:08 +0530)]
Merge tag 'for-7.2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux
Pull btrfs updates from David Sterba:
"The most noticeable change is to enable large folios by default, it's
been in testing for a few releases. Related to that is huge folio
support (still under experimental config). Otherwise a few ioctl
updates, performance improvements and usual fixes and core changes.
User visible changes:
- enable large folios by default, added in 6.17 (under experimental
build), no feature limitations, a big change internally
- new ioctl to return raw checksums to userspace (a bit tricky given
compression and tail extents), can be used for mkfs and
deduplication optimizations
- provide stable UUID for e.g. overlayfs and temp_fsid, also
reflected in statvfs() field f_fsid, internal dev_t is hashed in to
allow cloning
- add 32bit compat version of GET_SUBVOL_INFO ioctl
- in experimental build, support huge folios (up to 2M)
Performance related improvements/changes:
- limit bio size to the estimated optimum derived from the queue,
this prevents build up of too much data for writeback, which could
cause latency spikes (reported improvement 15% on sequential
writes)
- don't force direct IO to be serialized, forgotten change during
mount API port, brings back +60% of throughput
- lockless calculation of number of shrinkable extent maps, improve
performance with many memcg allocated objects
Notable fixes:
- in zoned mode, fix a deadlock due to zone reclaim and relocation
when space needs to be flushed
- don't trim device which is internally not tracked as writeable
(e.g. when missing device is being rescanned)
- fix deadlock when cloning inline extent and mounted with
flushoncommit
- fix false IO failures after direct IO falls back to buffered write
in some cases
Core:
- remove COW fixup mechanism completely; detect and fix changes to
pages outside of filesystem tracking, guaranteed since 5.8, grace
period is over
- remove 2K block size support, experimental to test subpage code on
x86_64 but now it would block folio changes
- tree-checker improvements of:
- free-space cache and tree items
- root reference and backref items
- extent state exceptions in reloc tree
- add tracepoints related to sync, tree-log and transactions
- device stats item tracking unification, remove item if there are no
stats recorded, also don't leave stale stats on replaced device
- allow extent buffer pages to be allocated as movable, to help page
migration
- added checks for proper extent buffer release
- btrfs.ko code size reduction due to transaction abort call
simplifications
- several struct size reductions
- more auto free conversions
- more verbose assertions"
* tag 'for-7.2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: (130 commits)
btrfs: fix use-after-free after relocation failure with concurrent COW
btrfs: move WARN_ON on unexpected error in __add_tree_block()
btrfs: move locking into btrfs_get_reloc_bg_bytenr()
btrfs: lzo: reject compressed segment that overflows the compressed input
btrfs: retry faulting in the pages after a zero sized short direct write
btrfs: fix incorrect buffered IO fallback for append direct writes
btrfs: fix false IO failure after falling back to buffered write
btrfs: use verbose assertions in backref.c
btrfs: print a message when a missing device re-appears
btrfs: do not trim a device which is not writeable
btrfs: return real error after lookup failure in btrfs_ioctl_default_subvol()
btrfs: use mapping shared locking for reading super block
btrfs: use lockless read in nr_cached_objects shrinker callback
btrfs: switch local indicator variables to bools
btrfs: send: pass bool for pending_move and refs_processed parameters
btrfs: use shifts for sectorsize and nodesize
btrfs: fix deadlock cloning inline extent when using flushoncommit
btrfs: allocate eb-attached btree pages as movable
btrfs: add 32-bit compat ioctl for BTRFS_IOC_GET_SUBVOL_INFO
btrfs: derive f_fsid from on-disk fsid and dev_t
...
Linus Torvalds [Tue, 16 Jun 2026 06:34:00 +0000 (12:04 +0530)]
Merge tag 'dlm-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm
Pull dlm updates from David Teigland:
"There are four fixes/cleanups in this series; none are likely to be
issues in real usage:
- improve debugfs error exit path
- fix sequence number ordering in an artificial test case
- fix usercopy_abort for lvb data
- use hlist_for_each_entry_srcu for srcu lists"
* tag 'dlm-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm:
dlm: init per node debugfs before add to node hash
dlm: fix add msg handle in send_queue ordered
dlm: add usercopy whitelist to dlm_cb cache
dlm: use hlist_for_each_entry_srcu for SRCU protected lists
Linus Torvalds [Tue, 16 Jun 2026 06:28:52 +0000 (11:58 +0530)]
Merge tag 'fs_for_v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs
Pull udf, isofs, ext2, and quota updates from Jan Kara:
- Assorted udf & isofs fixes for maliciously formatted devices
- Cleanups to use kmalloc() instead of __get_free_page()
- Removal of deprecated DAX code from ext2
* tag 'fs_for_v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
udf: validate VAT inode size for old VAT format
udf: validate VAT header length against the VAT inode size
udf: validate sparing table length as an entry count, not a byte count
isofs: bound Rock Ridge symlink components to the SL record
ext2: fix ignored return value of generic_write_sync()
ext2: Remove deprecated DAX support
isofs: replace __get_free_page() with kmalloc()
quota: allocate dquot_hash with kmalloc()
udf: validate free block extents against the partition length
Linus Torvalds [Tue, 16 Jun 2026 06:20:40 +0000 (11:50 +0530)]
Merge tag 'xfs-merge-7.2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux
Pull xfs updates from Carlos Maiolino:
"The main highlight is the removal of experimental tag of the zone
allocator feature.
Besides that, this contains a collection of bug fixes and code
refactoring but no new features have been added"
* tag 'xfs-merge-7.2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (29 commits)
xfs: shut down the filesystem on a failed mount
xfs: skip inode inactivation on a shut down mount
xfs: move XFS_LSN_CMP to xfs_log_format.h
xfs: shut down zoned file systems on writeback errors
xfs: cleanup xfs_growfs_compute_deltas
xfs: pass back updated nb from xfs_growfs_compute_deltas
xfs: fix pointer arithmetic error on 32-bit systems
xfs: initialize iomap->flags earlier in xfs_bmbt_to_iomap
xfs: only log freed extents for the current RTG in zoned growfs
xfs: add newly added RTGs to the free pool in growfs
xfs: factor out a xfs_zone_mark_free helper
xfs: mark struct xfs_imap as __packed
xfs: store an agbno in struct xfs_imap
xfs: massage xfs_imap_to_bp into xfs_read_icluster
xfs: remove im_len field in struct xfs_imap
xfs: cleanup xfs_imap
xfs: remove the call to xfs_buf_reverify in xfs_trans_read_buf_map
xfs: remove the i_ino field in struct xfs_inode
xfs: remove xfs_setup_existing_inode
xfs: convert xchk_inode_xref_set_corrupt to xchk_ip_xref_set_corrupt
...
Bryam Vargas [Sun, 14 Jun 2026 21:19:43 +0000 (14:19 -0700)]
Input: mms114 - reject an oversized device packet size
mms114_interrupt() reads a packet of touch data from the device into a
fixed-size on-stack buffer
struct mms114_touch touch[MMS114_MAX_TOUCH];
which holds MMS114_MAX_TOUCH (10) events of MMS114_EVENT_SIZE (8) bytes,
i.e. 80 bytes. The length of the I2C read into it is taken verbatim from
the device:
packet_size is a single device register byte (0x0F) and the only check
is the lower bound packet_size <= 0; it is never bounded against the
size of touch[]. A malfunctioning, malicious or counterfeit controller
(or an attacker tampering with the I2C bus) can report a packet_size of
up to 255, so __mms114_read_reg() writes up to 175 bytes past the end of
touch[] on the IRQ-thread stack: a stack out-of-bounds write that can
overwrite the stack canary, saved registers and the return address.
A well-formed device never reports more than the buffer holds, so reject
an oversized packet and drop the report, consistent with the handler's
other error paths, rather than reading past the buffer.
Linus Torvalds [Tue, 16 Jun 2026 03:51:01 +0000 (09:21 +0530)]
Merge tag 'hardening-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux
Pull hardening updates from Kees Cook:
- lkdtm:
- Add case to provoke a crash in EFI runtime services (Ard Biesheuvel)
- add PPC_RADIX_TLBIEL test and missed isync (Sayali Patil)
- stddef: Document designated initializer semantics for
__TRAILING_OVERLAP() (Gustavo A. R. Silva)
- strarray: drop redundant allocation, add __counted_by_ptr (Thorsten
Blum)
* tag 'hardening-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
lkdtm/powerpc: add PPC_RADIX_TLBIEL test for radix MCE validation
lkdtm/powerpc: add isync after slbmte to enforce SLB update ordering
lkdtm: Add case to provoke a crash in EFI runtime services
lib/string_helpers: annotate struct strarray with __counted_by_ptr
lib/string_helpers: drop redundant allocation in kasprintf_strarray
MAINTAINERS: add kernel hardening keyword __counted_by_ptr
stddef: Document designated initializer semantics for __TRAILING_OVERLAP()
Linus Torvalds [Tue, 16 Jun 2026 03:48:53 +0000 (09:18 +0530)]
Merge tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux
Pull crypto library updates from Eric Biggers:
- Drop the last architecture-specific implementation of MD5
- Mark clmul32() as noinline_for_stack to improve codegen in some cases
* tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux:
lib/crypto: gf128hash: mark clmul32() as noinline_for_stack
lib/crypto: powerpc/md5: Drop powerpc optimized MD5 code
Linus Torvalds [Tue, 16 Jun 2026 03:46:37 +0000 (09:16 +0530)]
Merge tag 'crc-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux
Pull CRC updates from Eric Biggers:
"Accelerate CRC64-NVME for 32-bit ARM by refactoring the arm64 NEON
intrinsics implementation to be shared by 32-bit and 64-bit.
Also apply a similar cleanup to the 32-bit ARM NEON implementation of
xor_gen(), where it now reuses code from the 64-bit implementation"
* tag 'crc-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux:
crypto: aegis128 - Use neon-intrinsics.h on ARM too
lib/crc: arm: Enable arm64's NEON intrinsics implementation of crc64
lib/crc: Turn NEON intrinsics crc64 implementation into common code
xor/arm64: Use shared NEON intrinsics implementation from 32-bit ARM
xor/arm: Replace vectorized implementation with arm64's intrinsics
ARM: Add a neon-intrinsics.h header like on arm64
Linus Torvalds [Tue, 16 Jun 2026 03:31:23 +0000 (09:01 +0530)]
Merge tag 'v7.2-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
Pull crypto updates from Herbert Xu:
"API:
- Drop support for off-CPU cryptography in af_alg
- Document that af_alg is *always* slower
- Document the deprecation of af_alg
- Remove zero-copy support from skcipher and aead in af_alg
- Cap AEAD AD length to 0x80000000 in af_alg
- Free default RNG on module exit
Algorithms:
- Fix vli multiplication carry overflow in ecc
- Drop unused cipher_null crypto_alg
- Remove unused variants of drbg
- Use lib/crypto in drbg
- Use memcpy_from/to_sglist in authencesn
- Allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode
- Disallow RSA PKCS#1 SHA-1 sig algs in FIPS mode
- Filter out async aead implementations at alloc in krb5
- Fix non-parallel fallback by rstoring callback in pcrypt
- Validate poly1305 template argument in chacha20poly1305
Drivers:
- Add sysfs PCI reset support to qat
- Add KPT support for GEN6 devices to qat
- Remove unused character device and ioctls from qat
- Add support for hw access via SMCC to mtk
- Remove prng support from crypto4xx
- Remove prng support from hisi-trng
- Remove prng support from sun4i-ss
- Remove prng support from xilinx-trng
- Remove loongson-rng
- Remove exynos-rng
Others:
- Remove support for AIO on sockets"
* tag 'v7.2-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (196 commits)
crypto: tegra - fix refcount leak in tegra_se_host1x_submit()
crypto: rng - Free default RNG on module exit
crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode
hwrng: jh7110 - fix refcount leak in starfive_trng_read()
crypto: atmel-ecc - drop dead code in atmel_ecdh_max_size
crypto: cavium/cpt - fix DMA cleanup using wrong loop index
crypto: marvell/octeontx - fix DMA cleanup using wrong loop index
MAINTAINERS: make myself the maintainer of the Qualcomm QCE driver
crypto: amcc - convert irq_of_parse_and_map to platform_get_irq
crypto: sun4i-ss - Remove insecure and unused rng_alg
hwrng: xilinx - Move xilinx-rng into drivers/char/hw_random/
crypto: xilinx-trng - Replace crypto_drbg_ctr_df() with HMAC-SHA512
crypto: xilinx-trng - Fix return value of xtrng_hwrng_trng_read()
crypto: xilinx-trng - Remove crypto_rng interface
crypto: exynos-rng - Remove exynos-rng driver
hwrng: hisi-trng - Move hisi-trng into drivers/char/hw_random/
crypto: hisi-trng - Remove crypto_rng interface
crypto: loongson - Remove broken and unused loongson-rng
crypto: crypto4xx - Remove insecure and unused rng_alg
crypto: qat - validate RSA CRT component lengths
...
Linus Torvalds [Tue, 16 Jun 2026 03:14:43 +0000 (08:44 +0530)]
Merge tag 'slab-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab
Pull slab updates from Vlastimil Babka:
- Support for "allocation tokens" (currently available in Clang 22+)
for smarter partitioning of kmalloc caches based on the allocated
object type, which can be enabled instead of the "random"
per-caller-address-hash partitioning.
It should be able to deterministically separate types containing a
pointer from those that do not (Marco Elver)
- Improvements and simplification of the kmem_cache_alloc_bulk() and
mempool_alloc_bulk() API. This includes adaptation of callers
(Christoph Hellwig)
- Performance improvements and cleanups related mostly to sheaves
refill (Hao Li, Shengming Hu, Vlastimil Babka)
- Several fixups for the slabinfo tool (Xuewen Wang)
* tag 'slab-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab:
mm/slab: do not limit zeroing to orig_size when only red zoning is enabled
mm/slub: preserve original size in _kmalloc_nolock_noprof retry path
mm: simplify the mempool_alloc_bulk API
mm/slab: improve kmem_cache_alloc_bulk
mm/slub: detach and reattach partial slabs in batch
mm/slub: introduce helpers for node partial slab state
mm/slub: use empty sheaf helpers for oversized sheaves
tools/mm/slabinfo: remove redundant slab->partial assignment
tools/mm/slabinfo: remove dead assignment in get_obj_and_str()
tools/mm/slabinfo: Fix trace disable logic inversion
MAINTAINERS: add slab-related scripts and tools to SLAB ALLOCATOR
mm/slub: fix typo in sheaves comment
mm, slab: simplify returning slab in __refill_objects_node()
mm, slab: add an optimistic __slab_try_return_freelist()
slab: fix kernel-docs for mm-api
slab: improve KMALLOC_PARTITION_RANDOM randomness
slab: support for compiler-assisted type-based slab cache partitioning
mm/slub: defer freelist construction until after bulk allocation from a new slab
Linus Torvalds [Tue, 16 Jun 2026 02:58:41 +0000 (08:28 +0530)]
Merge tag 'fbdev-for-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev
Pull fbdev updates from Helge Deller:
"Beside the removal of the Hercules monochrome ISA graphics driver and
the corresponding text console driver, there is just the typical
maintanance with smaller driver fixes and cleanups:
Removal of drivers:
- Hercules monochrome ISA graphics adapter driver (Ethan Nelson-Moore)
- Hercules mdacon console driver (Ethan Nelson-Moore)
Changes affecting many drivers at once:
- possible memory leak fixes in various drivers (Abdun Nihaal)
- many conversions to use strscpy() (David Laight)
- Use named initializers in drivers (Uwe Kleine-König)
Code fixes:
- fbcon: don't suspend/resume when vc is graphics mode (Lu Yao)
- modedb: fix a possible UAF in fb_find_mode() (Tuo Li)
- modedb: Fix entry for 1920x1080-60 mode (Steffen Persvold)
- arm: Export acorndata_8x8 font symbol for bootloader (Helge Deller)
- omap2: fix use-after-free in omapfb_mmap (Hongling Zeng)
Cleanups:
- pxa168fb: use devm_ioremap_resource() (Alberto Arostegui)
- provice helpers for fb_set_var() and fb_blank() and fbcon updates
(Thomas Zimmermann)
- fbcon: Use correct type for vc_resize() return value (Jiacheng Yu)
- chipsfb: add missing MODULE_DESCRIPTION() macro (Rahman Mahmutović)
- sunxvr2500: replace printk with device-aware logging functions
(Rahman Mahmutović)
- sm712: Fix operator precedence in big_swap macro (Li RongQing)
- imxfb: Use of_device_get_match_data() (Rosen Penev)
- atmel_lcdfb: Use of_device_get_match_data() (Rosen Penev)
Documentation fixes:
- grvga: Fix CLUT register address offset in comment (Eduardo Silva)
- omap/dss: Fix stale modedb.c path (Costa Shulyupin)
- correct CONFIG_FB_TILEBLITTING macro name in #endif comment (Ethan
Nelson-Moore)"
* tag 'fbdev-for-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: (43 commits)
fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode
fbdev: modedb: fix a possible UAF in fb_find_mode()
fbdev: s3fb: Use strscpy() to copy strings into arrays
fbdev: sm501fb: Fix buffer errors in OF binding code
fbcon: correct CONFIG_FB_TILEBLITTING macro name in #endif comment
fbdev/arm: Export acorndata_8x8 font symbol for bootloader
fbdev: mmpfb: Use strscpy() to copy device name
fbdev: sisfb: Replace strlen() strcpy() pair with strscpy()
fbdev: rivafb: Use strscpy() to copy device name
fbdev: cyber2000fb: Use strscpy() to copy device name
fbdev: atmel_lcdfb: Use strscpy() to copy device name
fbdev: Do not export fbcon from fbdev
fbdev: Wrap fbcon updates from vga-switcheroo in helper
fbdev: Wrap user-invoked calls to fb_blank() in helper
fbdev: Wrap user-invoked calls to fb_set_var() in helper
fbdev: omap2: fix use-after-free in omapfb_mmap
docs: omap/dss: Fix stale modedb.c path
fbdev: pxa168fb: use devm_ioremap_resource() for MMIO
fbdev: grvga: Fix CLUT register address offset in comment
fbdev: sunxvr2500: replace printk with device-aware logging functions
...
Linus Torvalds [Tue, 16 Jun 2026 02:46:55 +0000 (08:16 +0530)]
Merge tag 'mmc-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc
Pull MMC updates from Ulf Hansson:
"MMC core:
- Validate host's max_segs to fail gracefully
MMC host:
- davinci:
- Avoid potential NULL dereference in the IRQ handler
- Call mmc_add_host() in the correct order during probe
- dw_mmc-exynos:
- Increase DMA threshold for exynos7870
- renesas_sdhi:
- Add support for RZ/G2E, RZ/G2N and R-Car M3Le variants
- sdhci-msm:
- Add support for Hawi, Eliza and Shikra variants
- sdhci-of-k1:
- Add support for SD UHS-I modes
- Add support for tuning for eMMC HS200 and SD UHS-I"
* tag 'mmc-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: (24 commits)
mmc: dw_mmc: Add desc_num field for clarity
dt-bindings: mmc: sdhci-msm: Rename the binding to include 'qcom' prefix
mmc: sdhci-of-dwcmshc: use dev_err_probe() to simplify error paths
mmc: sdhci-of-dwcmshc: remove redundant IS_ERR() check
dt-bindings: mmc: sdhci-msm: qcom: Add Hawi compatible
mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC
mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC
dt-bindings: mmc: sdhci-msm: Add Eliza compatible
mmc: davinci: fix mmc_add_host order in probe
dt-bindings: mmc: sdhci-msm: Document the Shikra compatible
mmc: sdhci-of-k1: add comprehensive SDR tuning support
mmc: sdhci-of-k1: add regulator and pinctrl voltage switching support
mmc: sdhci-of-k1: enable essential clock infrastructure for SD operation
dt-bindings: mmc: spacemit,sdhci: add pinctrl support for voltage switching
mmc: via-sdmmc: Simplify initialisation of pci_device_id array
mmc: davinci: avoid NULL deref of host->data in IRQ handler
memstick: Constify the driver id_table
mmc: host: Move MODULE_DEVICE_TABLE next to the table itself
mmc: renesas_sdhi: add R-Car M3Le compatibility string
dt-bindings: mmc: renesas,sdhi: Document R-Car M3Le support
...
Linus Torvalds [Tue, 16 Jun 2026 02:40:21 +0000 (08:10 +0530)]
Merge tag 'hwmon-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging
Pull hwmon updates from Guenter Roeck:
"New drivers for the following chips:
- Analog Devices LTC4283 Swap Controller
- Analog Devices MAX20830
- Analog Devices MAX20860A
- ARCTIC Fan Controller
- Delta E50SN12051
- Luxshare LX1308
- Microchip EMC1812/13/14/15/33
- Monolithic MP2985
- Murata D1U74T PSU
New chip support added to existing drivers:
- asus-ec-sensors: Support for ROG MAXIMUS Z790 EXTREME, ROG STRIX
B850-E GAMING WIFI, and ROG STRIX B650E-E GAMING WIFI
- dell-smm: Add Dell Latitude 7530 to fan control whitelist
- nct6683: Support for ASRock Z890 Pro-A
- pmbus: Support for Flex BMR316, BMR321, BMR350 and BMR351
- pmbus/max34440: Support for ADPM12250
- pmbus/xdp720: Support for Infineon xdp730, and fix driver issues
reported by Sashiko
New functionality:
- Add support for update_interval_us chip attribute, and support it
in ina238 driver
- Add support for guard() and scoped_guard() for subsystem locks, and
use it in adt7411, ina2xx, and lm90 drivers
- emc2305: Support configurable fan PWM at shutdown
- lm63: Expose PWM frequency and LUT hysteresis as writable
- lm75: Support active-high alert polarity
- nct7802: Add time step attributes for tweaking responsiveness
- pmbus/adm1266: Add rtc debugfs entries for rtc, powerup_counter,
clear_blackbox, and firmware_revision
- raspberrypi: Fix delayed-work teardown race, add voltage input
support as well as voltage domain IDs
- mcp9982: Add support for reporting external diode faults
Miscellaneous bug fixes, changes and improvements:
- Use named initializers for platform_device_id arrays and
i2c_device_data, and remove unused driver data
- Various drivers: Move MODULE_DEVICE_TABLE next to the table itself
- ads7871: Convert to hwmon_device_register_with_info(), and use
DMA-safe buffer for SPI writes
- adt7411: document supported sysfs attributes
- adt7462: Add of_match_table to support devicetree
- adt7475: Add explicit header include
- coretemp; Fix outdated documentation, coding style issues, and
replace hardcoded core count with dynamic value
- cros_ec: Drop unused assignment of platform_device_id driver data
- emc2305: Fix fan channel index handling
- gpd-fan: Reject EC PWM value 0 as invalid, fix race condition
between device removal and sysfs access, upgrade log level from
warn to err for platform device creation failure, initialize EC
before registering hwmon device, drop global driver data and use
per-device allocation
- htu31: document debugfs serial_number
- ina238: Add support for samples and update_interval
- it87: Clamp negative values to zero in set_fan()
- lm75: Add explicit header include, Add explicit default cases in
lm75_is_visible(), and add section for sysfs interface to
documentation
- pmbus/lm25066: Fix PMBus coefficients for LM5064/5066/5066i
- tmp102: Use device_property_read_string API
- tmp401: Read "ti,n-factor" as signed
- Convert zyxel,nsa320-mcu to DT schema"
* tag 'hwmon-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (81 commits)
hwmon: tmp401: Read "ti,n-factor" as signed
hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i
hwmon: (gpd-fan) Reject EC PWM value 0 as invalid
hwmon: (dell-smm) Add Dell Latitude 7530 to fan control whitelist
hwmon: temperature: add support for EMC1812
dt-bindings: hwmon: temperature: add support for EMC1812
hwmon: (gpd-fan): fix race condition between device removal and sysfs access
hwmon: (gpd-fan): upgrade log level from warn to err for platform device creation failure
hwmon: (gpd-fan): Initialize EC before registering hwmon device
hwmon: (gpd-fan): drop global driver data and use per-device allocation
hwmon: (pmbus/max34440): add support adpm12250
hwmon: (ina238) Add update_interval_us attribute
hwmon: Add update_interval_us chip attribute
hwmon: (ina238) Add support for samples and update_interval
gpio: gpio-ltc4283: Add support for the LTC4283 Swap Controller
hwmon: ltc4283: Add support for the LTC4283 Swap Controller
dt-bindings: hwmon: Document the LTC4283 Swap Controller
hwmon: (pmbus/xdp720) Fix driver issues xdp720/730
hwmon: (pmbus/xdp720) Add support for efuse xdp730
dt-bindings: hwmon/pmbus: Add Infineon xdp730
...
Linus Torvalds [Tue, 16 Jun 2026 02:34:24 +0000 (08:04 +0530)]
Merge tag 'watchdog-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging
Pull watchdog updates and fixes from Guenter Roeck:
"Subsystem:
- Unregister PM notifier on watchdog unregister
- Various documentation fixes and improvements
Removed drivers:
- Remove AMD Elan SC520 processor watchdog driver
- Drop SMARC-sAM67 support
- Remove driver for integrated WDT of ZFx86 486-based SoC
New drivers:
- Driver for Andes ATCWDT200
- Driver for Gunyah Watchdog
Added support to existing drivers:
- Add "apple,t8103-wdt" and "apple,t8122-wdt" compatibles to Apple
watchdog driver
- Add rockchip,rk3528-wdt and rockchip,rv1103b-wdt to snps,dw-wdt.yaml
- Document IPQ9650, IPQ5210, Shikra, Nord, and Hawi in qcom-wdt.yaml
Also document sram property and add support to get the bootstatus
to qcom wdt driver
- lenovo_se10_wdt: Fix use-after-rfree and add support for SE10 Gen 2
platform
- ti,rti-wdt: Add ti,am62l-rti-wdt compatible
- renesas: Document RZ/G3L support and rework example for
renesas,r9a09g057-wdt
Other bug fixes and improvements:
- Use named initializers (sc1200, ziirave_wdt)
- Allow pic32-dmt and pic32-wdt to be built with COMPILE_TEST
- realtek-otto: enable clock before using I/O, and prevent PHASE2 underflows
- rti_wdt: Add reaction control
- renesas,rzn1-wdt: Drop interrupt support and other cleanup
- gpio_wdt: Add ACPI support
- imx7ulp_wdt: Keep WDOG running until A55 enters WFI on i.MX94
- sprd_wdt: Remove redundant sprd_wdt_disable() on register failure
- bcm2835_wdt: Switch to new sys-off handler API
- sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5
- hpwdt: Refine hpwdt message for UV platform
- Convert TS-4800 bindings to DT schema
- menz069_wdt: drop unneeded MODULE_ALIAS
- sp5100_tco: Use EFCH MMIO for newer Hygon FCH"
* tag 'watchdog-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (58 commits)
watchdog: sc1200: Drop unused assignment of pnp_device_id driver data
watchdog: unregister PM notifier on watchdog unregister
dt-bindings: watchdog: qcom-wdt: Document IPQ5210 watchdog
watchdog: dev: convert to kernel-doc comments
watchdog: core: clean up some comments
watchdog: uapi: add comments for what bit masks apply to
watchdog: linux/watchdog.h: repair kernel-doc comments
watchdog: add devm_watchdog_register_device() to watchdog-kernel-api
watchdog: ziirave_wdt: Use named initializers for struct i2c_device_id
watchdog: realtek-otto: enable clock before using I/O
watchdog: realtek-otto: prevent PHASE2 underflows
dt-bindings: watchdog: qcom-wdt: Document IPQ9650 watchdog
dt-bindings: watchdog: renesas,rzn1-wdt: interrupts are not required
dt-bindings: watchdog: apple,wdt: Add t8122 compatible
watchdog: apple: Add "apple,t8103-wdt" compatible
watchdog: rzn1: remove now obsolete interrupt support
dt-bindings: watchdog: Add watchdog compatible for RK3528
watchdog: convert the Kconfig dependency on OF_GPIO to OF
watchdog: Remove AMD Elan SC520 processor watchdog driver
watchdog: lenovo_se10_wdt: Fix use-after-free and resource leak risk
...
Linus Torvalds [Tue, 16 Jun 2026 02:26:47 +0000 (07:56 +0530)]
Merge tag 'spi-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi
Pull spi updates from Mark Brown:
"This has been quite a busy release, mainly due to the subsystem wide
work Johan Hovold has done to modernise resource allocation for the
subsystem on probe, the subsystem did some very clever allocation
management pre devm which didn't quite mesh comfortably with managed
allocations and made it far too easy to introduce error handling and
removal bugs.
- Cleanup and simplification of controller struct allocation, moving
everything over to devm and making the devm APIs more robust, from
Johan Hovold
- Support for spi-mem devices that don't assert chip select and
support for a secondary read command for memory mapped flashes,
some commits for this are shared with mtd.
- Support for SpacemiT K1"
* tag 'spi-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (118 commits)
spi: Fix mismatched DT property access types
spi: xilinx: use FIFO occupancy register to determine buffer size
spi: spi-mem: Fix spi_controller_mem_ops kdoc
spi: xilinx: let transfers timeout in case of no IRQ
spi: dt-bindings: nuvoton,npcm750-fiu: Convert to DT schema
spi: meson-spifc: fix runtime PM leak on remove
spi: Use named initializers for platform_device_id arrays
spi: rzv2h-rspi: Add suspend/resume support
spi: dw-pci: remove redundant pci_free_irq_vectors() calls
spi: ep93xx: fix double-free of zeropage on DMA setup failure
spi: cadence-xspi: Revert COMPILE_TEST support
spi: cadence-xspi: Support 32bit and 64bit slave dma interface
spi: tegra210-quad: Allocate DMA memory for DMA engine
spi: imx: replace dmaengine_terminate_all() with dmaengine_terminate_sync()
spi: fsl-lpspi: terminate the RX channel on TX prepare failure path
spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync()
spi: atmel: fix DMA channel and bounce buffer leaks
spi: omap2-mcspi: Use of_device_get_match_data()
spi: Use named initializers for arrays of i2c_device_data
spi: aspeed: Replace VLA parameter with flat pointer in calibration helper
...
Linus Torvalds [Tue, 16 Jun 2026 02:20:31 +0000 (07:50 +0530)]
Merge tag 'regulator-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator
Pull regulator updates from Mark Brown:
"The development of the regulator subsystem continues to be quite
quiet, we've got several new devices, removal of one old device and
some kernel wide cleanup of platform devices but nothing in the core.
- Cleanups of platform_device_id usage
- Filling out and fixing of the description of the MediaTek MT6359
- Removal of the PCAP regulator driver, the MFD has been removed
- New device support for Qualcomm Nord RPMH, PM8109, PM8150 and
PMAU0102, and SG Micro SGM3804"
* tag 'regulator-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (23 commits)
regulator: dt-bindings: mt6311: Convert to DT schema
regulator: qcom_smd-regulator: Add PM8019
regulator: dt-bindings: qcom,smd-rpm-regulator: Add PM8019
regulator: mt6359: Fix vbbck default internal supply name
regulator: bq257xx: drop confusing configuration of_node
regulator: Unify usage of space and comma in platform_device_id arrays
regulator: Use named initializers for platform_device_id arrays
regulator: Drop unused assignment of platform_device_id driver data
regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()
regulator: remove used pcap regulator driver
regulator: add SGM3804 Dual Output driver
regulator: dt-bindings: document the SGM3804 Dual Output regulator
regulator: mt6359: Add proper ldo_vcn33_[12] regulators
regulator: mt6359: Add regulator supply names
regulator: mt6359: const-ify regulator descriptions
regulator: dt-bindings: mt6359: Deprecate bogus vcn33_[12]_* split regulators
regulator: dt-bindings: mt6359: Drop regulator-name pattern restrictions
regulator: palmas: Move MODULE_DEVICE_TABLE next to the table itself
regulator: qcom_smd: Add PM8150 regulators
regulator: dt-bindings: qcom,smd-rpm-regulator: Document PM8150 IC
...
Linus Torvalds [Tue, 16 Jun 2026 02:13:29 +0000 (07:43 +0530)]
Merge tag 'i2c-7.2-part1' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux
Pull i2c updates from Andi Shyti:
"This pull request is mostly made of cleanups and small infrastructure
improvements across the I2C core, drivers and bindings. It also adds
support for three drivers and a few new compatibles.
Two major cleanup across drivers and core code:
- use named initializers in device ID tables
- replace dev_err() with dev_err_probe()
Drivers:
- at24: use named initializers for arrays of i2c_device_data
- at91: add MCHP_LAN966X_PCI dependency
- cadence: add shutdown callback
- k1: enable by default on SpacemiT
- mxs: improve documentation
- qcom-geni: use pm_runtime_force_suspend/resume for system sleep
- tegra:
- disable fair arbitration on non-MCTP buses
- allocate DMA buffers from the correct DMA device
- designware:
- handle active target shutdown cleanly
- add shutdown callbacks for platform and PCI drivers
- adopt the new PM_RUNTIME_ACQUIRE() helpers
DT bindings:
- convert davinci bindings to DT schema
Core and muxes:
- acpi: report missing I2C resources as -ENOENT
- gpiolib: add gpiod_is_single_ended() helper for I2C GPIO users
- i2c-mux-reg: add generic firmware node support
- a set of 10 patches from Johan Hovold fixing adapter registration
races, cleanup paths and resource management issues
New support:
- DesignWare LECA0003 (ACPI ID)
- Loongson LS2K0300 I2C controller (new driver)
- Qualcomm CCI Glymur and Shikra compatibles"
* tag 'i2c-7.2-part1' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux: (46 commits)
i2c: mxs: add missing kernel-doc for struct mxs_i2c_dev members
i2c: qcom-geni: Use pm_runtime_force_{suspend,resume} helpers
dt-bindings: i2c: qcom-cci: Document Glymur compatible
dt-bindings: i2c: qcom-cci: Document Shikra compatible
i2c: mux: reg: use device property accessors
i2c: acpi: Return -ENOENT when no resources found in i2c_acpi_client_count()
i2c: at91: Add MCHP_LAN966X_PCI dependency
i2c: eg20t: Consistently define pci_device_ids using named initializers
i2c: designware-pcidrv: Consistently define pci_device_ids using named initializers
i2c: bcm-kona: fix spelling mistake in timeout-check comment
i2c: cadence: Add shutdown handler
i2c: tegra: Disable fair arbitration for non-MCTP buses
i2c: tegra: use dmaengine_get_dma_device() for DMA buffer allocation
i2c: busses: make K1 driver default for SpacemiT platforms
i2c: Use named initializers for arrays of i2c_device_data
i2c: core: clean up adapter registration error label
i2c: core: clean up bus id allocation
i2c: core: fix adapter deregistration race
i2c: core: fix adapter registration race
i2c: core: disable runtime PM on adapter registration failure
...
Linus Torvalds [Tue, 16 Jun 2026 02:08:04 +0000 (07:38 +0530)]
Merge tag 'pwrseq-updates-for-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux
Pull power sequencing updates from Bartosz Golaszewski:
"A set of extensions to the M.2 pwrseq driver allowing it to work with
more cards than just the one from Qualcomm we supported initially.
There's also a tweak to debugfs output and a new function that will be
used by a bluetooth driver in the next cycle.
Power Sequencing core:
- Add a helper allowing consumers to access the struct device object
associated with a pwrseq provider
- Print the power sequencing device's parent in debugfs to add more
debugging information
Driver updates:
- Extend/rework the M.2 power sequencing driver in order to allow it
to support more M.2 cards, not just WCN7850"
* tag 'pwrseq-updates-for-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
power: sequencing: pcie-m2: Add PCI ID 0x1103 for WCN6855 Bluetooth
power: sequencing: Add an API to return the pwrseq device's 'dev' pointer
power: sequencing: pcie-m2: Create BT node based on the pci_device_id[] table
power: sequencing: pcie-m2: Create serdev for PCI devices present before probe
power: sequencing: pcie-m2: Improve PCI device ID check
power: sequencing: pcie-m2: Allow creating serdev for multiple PCI devices
power: sequencing: pcie-m2: Fix inconsistent function prefixes
power: sequencing: print power sequencing device parent in debugfs
Linus Torvalds [Tue, 16 Jun 2026 02:00:52 +0000 (07:30 +0530)]
Merge tag 'gpio-updates-for-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux
Pull gpio updates from Bartosz Golaszewski:
"There's one new driver, one legacy driver removed, a kunit test-suite
for the GPIO core, support for new models in existing drivers and a
slew of various changes in many places though I can't think of
anything controversial that would stand out - it's been a relatively
calm cycle.
GPIO core:
- Add an initial set of kunit test cases for the GPIO subsystem
- Use the devres owner as the GPIO chip's parent in absence of any
other parent
- Fix const-correctness of GPIO chip SRCU guards
- Provide new GPIO consumer interfaces: gpiod_is_single_ended() and
fwnode_gpiod_get()
- Quarantine all legacy GPIO APIs in linux/gpio/legacy.h
- Use __ro_after_init where applicable
New drivers:
- Add driver for the GPIO controller on Waveshare DSI TOUCH panels
Removed drivers:
- Remove the obsolete ts5500 GPIO driver
Driver updates:
- Modernize gpio-timberdale: remove platform data support and use
generic device property accessors
- Extend test build coverage by enabling COMPILE_TEST for more GPIO
drivers
- Add some missing dependencies in Kconfig
- Add support for sparse fixed direction to gpio-regmap
- Remove dead code from gpio-nomadik
- use BIT() in gpio-mxc
- use bitmap_complement() in gpio-xilinx and gpio-pca953x
- Use more appropriate printing functions where applicable
- Use named initializers for platform_device_id and i2c_device_id
arrays
- Convert gpio-altera to using the generic GPIO chip helper library
- Add support for new models to gpio-dwapb, gpio-zynq, gpio-usbio and
gpio-tegra186
- Unify the naming convention for Qualcomm in GPIO drivers
- Fix interrupt bank mapping to GPIO chips in gpio-mt7621
- Add support for the lines-initial-states property to gpio-74x164
- Switch to using dynamic GPIO base in gpio-ixp4xx
- Move the handling of an OF quirk from ASoC to gpiolib-of.c where
other such quirks live
- Use handle_bad_irq() in gpio-ep93xx
- Some other minor tweaks and refactorings
Devicetree bindings:
- Document the Waveshare GPIO controller for DSI TOUCH panels
- Document new models: Tegra238 in gpio-tegra186 and EIO GPIO in
gpio-zynq
- Add new properties for gpio-dwapb and fairchild,74hc595
- Fix whitespace issues
- Sort compatibles alphabetically in gpio-zynq
Documentation:
- Fix kerneldoc warnings in gpio-realtek-otto
Misc:
- Attach software nodes representing GPIO chips to the actual struct
device objects associated with them in some legacy platforms
enabling real firmware node lookup instead of string matching
- Drop unneeded dependencies on OF_GPIO from bus and staging drivers"
* tag 'gpio-updates-for-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (62 commits)
gpio: nomadik: remove dead DB8540 code from <gpio/gpio-nomadik.h>
gpio: mt7621: fix interrupt banks mapping on gpio chips
bus: ts-nbus: drop unneeded dependency on OF_GPIO
staging: media: max96712: drop unneeded dependency on OF_GPIO
gpiolib: Replace strcpy() with memcpy()
gpio: remove obsolete UAF FIXMEs from lookup paths
gpio: core: fix const-correctness of gpio_chip_guard
gpio: mxc: use BIT() macro
gpio: realtek-otto: fix kernel-doc warnings
gpio: max77620: Unify usage of space and comma in platform_device_id array
gpio: Use named initializers for platform_device_id arrays
gpio: cros-ec: Drop unused assignment of platform_device_id driver data
ARM: omap1: enable real software node lookup of GPIOs on Nokia 770
ARM: omap1: use platform_device_register_full() for GPIO devices on OMAP 16xx
ARM: omap1: drop unused variable from omap16xx_gpio_init()
gpio: gpiolib: use seq_puts() for plain strings
gpio: ts5500: remove obsolete driver
gpio: add kunit test cases for the GPIO subsystem
kunit: provide kunit_platform_device_unregister()
kunit: provide kunit_platform_device_register_full()
...
Small follow-up to the HW net selftests, in particular to add a
selftest showing that also large rx_buf_len for io_uring ZC is
supported with netkit queue leasing.
====================
Daniel Borkmann [Sun, 14 Jun 2026 10:26:07 +0000 (12:26 +0200)]
selftests/net: Add hugepage kernel config dependency for zcrx
test_iou_zcrx_large_buf in drivers/net/hw/nk_qlease.py runs iou-zcrx
with rx_buf_len > page size, backed by a hugepage-mapped area. Thus
add to the Kconfig.
Daniel Borkmann [Sun, 14 Jun 2026 10:26:06 +0000 (12:26 +0200)]
selftests/net: Add netkit io_uring ZC test for large rx_buf_len
Add test_iou_zcrx_large_buf, which runs iou-zcrx with rx_buf_len >
page size (-x 2) through a netkit-leased RX queue. The netkit ifindex
is opaque to io_uring, but rx_page_size is honoured by the leased
physical qops via netif_mp_open_rxq()'s lease redirect.
Originally, I also added a BIG TCP variant on top, but dropped it
here as fbnic (and the QEMU fbnic model) has no BIG TCP support
to exercise it as this point.
Tested against the QEMU fbnic emulation. The new test exercises
the > page rx_buf_len path only when the leased NIC advertises
QCFG_RX_PAGE_SIZE; otherwise it skips.
For fbnic, I used Bjorn's patches locally [0]:
# ./nk_qlease.py
TAP version 13
1..5
ok 1 nk_qlease.test_iou_zcrx
ok 2 nk_qlease.test_iou_zcrx_large_buf
ok 3 nk_qlease.test_attrs
ok 4 nk_qlease.test_attach_xdp_with_mp
ok 5 nk_qlease.test_destroy
# Totals: pass:5 fail:0 xfail:0 xpass:0 skip:0 error:0
Without those patches (aka not advertising QCFG_RX_PAGE_SIZE):
# ./nk_qlease.py
TAP version 13
1..5
ok 1 nk_qlease.test_iou_zcrx
ok 2 nk_qlease.test_iou_zcrx_large_buf # SKIP Large chunks are not supported -95
ok 3 nk_qlease.test_attrs
ok 4 nk_qlease.test_attach_xdp_with_mp
ok 5 nk_qlease.test_destroy
# Totals: pass:4 fail:0 xfail:0 xpass:0 skip:1 error:0
Daniel Borkmann [Sun, 14 Jun 2026 10:26:05 +0000 (12:26 +0200)]
selftests/net: Use public NetDrvContEnv API in nk_qlease fixtures
Expose the netkit host ifname as a public attribute nk_host_ifname
(symmetric with the already-public nk_guest_ifname), rename _attach_bpf
to a public attach_bpf, and add a public detach_bpf helper that
encapsulates the tc-filter teardown bookkeeping. Switch the fixtures
to this public API. No functional change and keeps pylint happy.
Daniel Borkmann [Sun, 14 Jun 2026 10:26:04 +0000 (12:26 +0200)]
selftests/net: Move netkit lease hw setup into per-test fixtures
The HW counterpart of nk_qlease.py was carrying its lease setup in main()
and stashing src_queue / nk_queue / nk_*_ifname on cfg, which had drawbacks
called out during the review at [0].
This is the deferred half of the cleanup that landed in commit e254ffb9502c
("selftests/net: Split netdevsim tests from HW tests in nk_qlease") which
was the SW counterpart of nk_qlease.py.
While at it, convert the open-coded "ip netns exec" prefixes in the test
bodies over to the ns= argument of cmd() / bkg().
Linus Torvalds [Tue, 16 Jun 2026 01:56:47 +0000 (07:26 +0530)]
Merge tag 'pwm/for-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux
Pull pwm updates from Uwe Kleine-König:
"The usual mixture of minor fixes, a few cleanups, a new driver and dt
updates for the pwm subsystem.
Thanks to Chen Ni, Devi Priya, Manish Baing, Maurice Hieronymus,
Ronaldo Nunez, Rosen Penev, Shiji Yang and Yixun Lan for the actual
changes and Bjorn Andersson, Conor Dooley, Frank Li, Michal Wilczynski
and Rob Herring for reviews and acks"
* tag 'pwm/for-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux:
pwm: th1520: Remove requirement for mul_u64_u64_div_u64_roundup
dt-bindings: pwm: stmpe: Drop legacy binding
pwm: pca9685: Use named initializers for struct i2c_device_id
pwm: pxa: Add optional bus clock
dt-bindings: pwm: marvell,pxa-pwm: Add SpacemiT K3 PWM support
pwm: ipq: Add missing module description
pwm: stm32: Make use of mul_u64_u64_div_u64_roundup()
pwm: Consistently define pci_device_ids using named initializers
pwm: Driver for qualcomm ipq6018 pwm block
pwm: imx27: Fix variable truncation in .apply()
pwm: mediatek: correct mt7628 clock source setting
pwm: mediatek: set mt7628 pwm45_fixup flag to false
pwm: atmel-tcb: Remove unneeded semicolon
Linus Torvalds [Tue, 16 Jun 2026 01:49:53 +0000 (07:19 +0530)]
Merge tag 'chrome-platform-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux
Pull chrome-platform updates from Tzung-Bi Shih:
"Improvements:
- Use named initializers for struct i2c_device_id
Fixes:
- Fix a probe race between cros_ec_sensorhub and cros_ec_sysfs
- Check for the presence of ACPI_COMPANION() for drivers converted
from acpi_driver to platform_driver to avoid issues where
device_match_driver_override() might forcibly match the driver to
the device
- Fix a possible UAF in cros_ec_chardev
- Prevent build for big-endian systems as CHROME_PLATFORMS drivers
are only running and testing under little-endian systems
Cleanups:
- Drop some redundant bits in cros_kbd_led_backlight and Kconfig"
* tag 'chrome-platform-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux:
platform/chrome: Prevent build for big-endian systems
platform/chrome: Remove superfluous dependencies from CROS_EC
platform/chrome: cros_ec_chardev: Introduce rwsem for protecting ec_dev
platform/chrome: cros_ec_chardev: Add event relayer
platform/chrome: cros_ec_chardev: Move data to chardev_pdata
platform/chrome: cros_ec_chardev: Introduce chardev_data
platform/chrome: Use named initializers for struct i2c_device_id
platform/chrome: wilco_ec: event: Check ACPI_COMPANION()
platform/chrome: chromeos_tbmc: Check ACPI_COMPANION()
platform/chrome: chromeos_privacy_screen: Check ACPI_COMPANION()
platform/chrome: cros_kbd_led_backlight: Drop CONFIG_MFD_CROS_EC_DEV ifdeffery
platform/chrome: cros_kbd_led_backlight: Pass keyboard_led as parameter
platform/chrome: cros_kbd_led_backlight: Drop max_brightness from driver data
platform/chrome: Resolve kb_wake_angle visibility race
perf trace: Guard __probe_ip suppression with evsel__is_probe()
trace__fprintf_tp_fields() compares every field name against
"__probe_ip" for all tracepoint events, but this field is only
implicitly added by the Ftrace subsystem to bare dynamic probes.
Add an evsel__is_probe() check before the strcmp so the string
comparison is skipped entirely for non-probe events.
perf evsel: Add lazy-initialized probe type detection helpers
Several places in perf need to check whether an evsel is a kprobe or
uprobe, which requires looking up the PMU by name via evsel__find_pmu().
This lookup walks the PMU list each time, which is wasteful when the
same evsel is checked repeatedly.
Add evsel__is_kprobe(), evsel__is_uprobe(), and evsel__is_probe() that
resolve the probe type on first call via evsel__pmu_name() and cache
the result in a 3-bit field (probe_type) in struct evsel. The field
fits in existing padding after the bool fields, so struct size does not
grow.
The enum uses PROBE__UNKNOWN (0) as the uninitialized sentinel —
explicitly set in evsel__init() — so the lookup happens on first use.
PROBE__NOPE (1) caches "not a probe" to avoid repeated negative lookups.
PMU-based probes (kprobe/uprobe PMU) are detected by PMU name.
Ftrace-based dynamic probes (created via tracefs, reported as PMU
"tracepoint") are detected by the __probe_ip field that the kernel
adds to all dynamic probe formats. This covers kprobes, uprobes, and
fprobes regardless of their group/system name.
perf evsel: Add no-libtraceevent stubs for evsel__field() and evsel__common_field()
When building without libtraceevent (NO_LIBTRACEEVENT=1), evsel__field()
and evsel__common_field() are declared but never defined, causing link
errors in any code path that references them.
Add inline stubs that return NULL when HAVE_LIBTRACEEVENT is not defined,
matching the pattern used by other evsel accessor functions.
perf cs-etm: Reject CPU IDs that would overflow signed comparison
metadata[j][CS_ETM_CPU] is a u64 from perf.data, but the comparison
with max_cpu casts it to (int). A crafted value like 0xFFFFFFFF becomes
-1 after the cast, which compares less than max_cpu (0), so the queue
array is never sized to accommodate it. When the value is later passed
to cs_etm__get_queue(), it indexes queue_array with the original large
value, causing an out-of-bounds access.
Validate that CS_ETM_CPU fits in an int before using it in the signed
comparison.
Fixes: 57880a7966be510c ("perf: cs-etm: Allocate queues for all CPUs") Reported-by: sashiko-bot <sashiko-bot@kernel.org> Cc: James Clark <james.clark@arm.com> Cc: Adrian Hunter <adrian.hunter@intel.com> Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
perf c2c: Free format list entries when releasing c2c hist entries
c2c_hists__init() calls hpp_list__parse() which allocates and registers
format entries on hists->list. When c2c_he_free() destroys a c2c hist
entry, it deletes the histogram entries and frees the hists container but
never unregisters the format list entries, leaking them.
Call perf_hpp__reset_output_field() before freeing the hists to properly
unregister and free all format entries.
perf bpf: Bounds-check array offsets in bpil_offs_to_addr()
bpil_offs_to_addr() converts offsets stored in perf.data's
bpf_prog_info_linear structure into heap pointers by adding the offset
to the data allocation base. The offsets come from untrusted file input
and are not validated against data_len.
If an offset exceeds data_len, the computed address points outside the
allocated data buffer. Callers like synthesize_bpf_prog_name() then
dereference prog_tags[sub_id] or func_info pointers, reading arbitrary
heap memory.
Add a bounds check: when an offset exceeds data_len, zero the field
and skip the conversion. This prevents out-of-bounds pointer
construction from crafted perf.data files.
Reported-by: sashiko-bot <sashiko-bot@kernel.org> Fixes: 6ac22d036f86c4e2 ("perf bpf: Pull in bpf_program__get_prog_info_linear()") Cc: Dave Marchevsky <davemarchevsky@fb.com> Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
perf bpf: Reject oversized BPF metadata events that truncate header.size
bpf_metadata_alloc() computes event_size from the number of BPF metadata
variables and stores it in header.size, which is __u16. With 204 or
more .rodata variables prefixed "bpf_metadata_", event_size exceeds
65535 and silently truncates.
The truncated header.size causes synthesize_perf_record_bpf_metadata()
to allocate a buffer sized by the truncated value, then memcpy the full
event data into it — a heap buffer overflow.
Add a check that event_size fits in __u16 before proceeding. BPF
programs with that many metadata variables are exotic enough that
silently dropping the metadata is acceptable.
Reported-by: sashiko-bot <sashiko-bot@kernel.org> Fixes: ab38e84ba9a80581 ("perf record: collect BPF metadata from existing BPF programs") Reviewed-by: Ian Rogers <irogers@google.com> Cc: Blake Jones <blakejones@google.com> Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
perf bpf: Validate func_info_rec_size and sub_id in synthesize_bpf_prog_name()
synthesize_bpf_prog_name() computes a pointer into the func_info array
using sub_id * info->func_info_rec_size without validating either value.
Both come from perf.data and are untrusted:
- A func_info_rec_size smaller than sizeof(struct bpf_func_info) means
the finfo pointer would reference a truncated entry, reading past it
into adjacent data.
- A sub_id >= nr_func_info computes an offset past the func_info buffer,
causing an out-of-bounds read.
Add bounds checks for both values before computing the pointer offset.
When validation fails, fall through to the non-BTF name path instead
of reading garbage.
Reported-by: sashiko-bot <sashiko-bot@kernel.org> Fixes: 7b612e291a5affb1 ("perf tools: Synthesize PERF_RECORD_* for loaded BPF programs") Cc: Song Liu <songliubraving@fb.com> Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
perf sched: Replace (void*)1 sentinel with proper runtime allocation
map__findnew_thread() marks color-pid threads by storing (void*)1 as
the thread private data via thread__set_priv(). This sentinel value
causes two problems:
1. thread__get_runtime() returns (void*)1 as a struct thread_runtime
pointer. Any field access (e.g. tr->shortname) dereferences address
1, which is an unmapped page — immediate segfault.
2. cmd_sched() registers free() as the thread priv destructor, so thread
cleanup calls free((void*)1) — undefined behavior that corrupts the
heap on many allocators.
Fix by adding a 'color' flag to struct thread_runtime and allocating a
real runtime struct for color-pid threads. thread__has_color() now
checks the flag instead of relying on priv being non-NULL.
Reported-by: sashiko-bot <sashiko-bot@kernel.org> Fixes: 58a606149c60d5da ("perf sched: Avoid union type punning undefined behavior") Reviewed-by: Ian Rogers <irogers@google.com> Cc: Ian Rogers <irogers@google.com> Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
perf hwmon: Fix fd check to accept fd 0 in hwmon_pmu__describe_items()
hwmon_pmu__describe_items() checks 'if (fd > 0)' after openat(), which
incorrectly rejects fd 0. While fd 0 is normally stdin, if stdin has
been closed (common in daemon/service contexts), the kernel reuses fd 0
for the next open. With fd > 0, the sysfs file is not read and the fd
is leaked.
Change to 'if (fd >= 0)' to match the standard openat() error check.
Reported-by: sashiko-bot <sashiko-bot@kernel.org> Fixes: 53cc0b351ec99278 ("perf hwmon_pmu: Add a tool PMU exposing events from hwmon in sysfs") Reviewed-by: Ian Rogers <irogers@google.com> Cc: Ian Rogers <irogers@google.com> Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
perf tools: Use snprintf() for root_dir path construction
get_kernel_version() in machine.c and dso__load_guest_kernel_sym() in
symbol.c use sprintf() to construct paths by prepending root_dir to
"/proc/version" and "/proc/kallsyms" respectively. Both write into
PATH_MAX stack buffers, but root_dir comes from --guestmount or KVM
configuration and is not length-checked. A root_dir at or near
PATH_MAX causes a stack buffer overflow.
Switch to snprintf() with sizeof(path) to prevent overflow.
Reported-by: sashiko-bot <sashiko-bot@kernel.org> Fixes: a1645ce12adb6c9c ("perf: 'perf kvm' tool for monitoring guest performance from host") Cc: Zhang Yanmin <yanmin_zhang@linux.intel.com> Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
perf dso: Set error code when open() fails on uncompressed fallback path
filename__decompress() has an early return for files that are not
actually compressed, where it calls open() directly. When open()
fails, the function returns -1 but never sets *err. The caller chain
(decompress_kmodule → dso__decompress_kmodule_path → dso__get_filename)
then reads *dso__load_errno(dso) to set errno, but that field was never
populated, so errno gets a stale or zero value.
With errno=0, __open_dso() computes fd = -errno = 0, which is non-
negative, so callers treat fd 0 (stdin) as a valid DSO file descriptor.
Set *err = errno when open() fails on the uncompressed path, matching
the error handling on the compressed path at line 354.
Reported-by: sashiko-bot <sashiko-bot@kernel.org> Fixes: 8b42b7e5e8b5692b ("perf tools: Add is_compressed callback to compressions array") Cc: Jiri Olsa <jolsa@kernel.org> Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
perf dso: Fix heap overflow in dso__get_filename() on decompressed path
dso__get_filename() allocates name with malloc(PATH_MAX), but the
dso__filename_with_chroot() path replaces name with an asprintf'd
exact-size string (e.g. 8 bytes for "/a/b.ko"). When the DSO needs
decompression, dso__decompress_kmodule_path() writes the temp path
("/tmp/perf-kmod-XXXXXX", 22 bytes) into newpath, and strcpy(name,
newpath) overflows the smaller allocation.
Replace the strcpy with strdup(newpath) + free(name) so the buffer
is always correctly sized for its content.
Reported-by: sashiko-bot <sashiko-bot@kernel.org> Fixes: 1d6b3c9ba756a513 ("perf tools: Decompress kernel module when reading DSO data") Reviewed-by: Ian Rogers <irogers@google.com> Cc: Namhyung Kim <namhyung@kernel.org> Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
perf symbols: Break infinite loop on zero-filled notes in sysfs__read_build_id()
sysfs__read_build_id() iterates ELF note headers from sysfs files in a
while(1) loop. If the file contains a zero-filled note header (both
n_namesz and n_descsz are 0), the code computes n = namesz + descsz = 0
and calls read(fd, bf, 0). read() with count 0 returns 0, which
matches the expected (ssize_t)n value, so the error check passes and
the loop repeats — reading the same zero bytes and spinning forever.
This can happen with corrupted or zero-padded sysfs pseudo-files.
Add a check for n == 0 before the read, since no valid ELF note has
both name and description of zero length.
Reported-by: sashiko-bot <sashiko-bot@kernel.org> Fixes: f1617b40596cb341 ("perf symbols: Record the build_ids of kernel modules too") Reviewed-by: Ian Rogers <irogers@google.com> Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
perf symbols: Validate p_filesz before use in filename__read_build_id()
filename__read_build_id() stores ELF p_filesz in a ssize_t variable.
A crafted 32-bit ELF with p_filesz = 0xFFFFFFFF produces ssize_t value
-1. The comparison `p_filesz > buf_size` evaluates false because signed
-1 is less than any non-negative buf_size, so the realloc is skipped and
buf remains NULL.
The subsequent read(fd, NULL, -1) returns -1, which equals p_filesz,
passing the error check. read_build_id() then dereferences the NULL
buffer.
Add an explicit check for p_filesz <= 0 before using the value,
catching both zero-length and sign-wrapped negative sizes from crafted
ELF files.
Reported-by: sashiko-bot <sashiko-bot@kernel.org> Fixes: ba0b7081f7a521d7 ("perf symbol-minimal: Fix ehdr reading in filename__read_build_id") Reviewed-by: Ian Rogers <irogers@google.com> Cc: Ian Rogers <irogers@google.com> Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
This clobbers p_filesz with the already-swapped p_offset value. The
64-bit path on line 182 is correct and swaps p_filesz from p_filesz.
The consequence is that the PT_NOTE segment read uses the wrong size,
which can cause either a short read (missing the build-id) or an
oversized read (reading past the segment into adjacent data).
Fix by swapping the correct field.
Reported-by: sashiko-bot <sashiko-bot@kernel.org> Fixes: fef8f648bb47726d ("perf symbol: Fix use-after-free in filename__read_build_id") Reviewed-by: Ian Rogers <irogers@google.com> Cc: Ian Rogers <irogers@google.com> Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
====================
ionic: Expose more port stats to ethtool [part]
The primary aim of this patchset is to support the reporting of new port
statistics (and one old one) that firmware sends to the driver. A scheme
for these extra stats is introduced in order to prevent devices that
don't support these new statistics from unconditionally setting them or
reporting them in ethtool.
====================
Eric Joyner [Sun, 14 Jun 2026 20:53:02 +0000 (13:53 -0700)]
ionic: Get "link_down_count" ext link stat from firmware
The number of times that link has gone down at the port level is tracked
by the firmware and sent to the driver via regular DMA writes to an
instance of struct ionic_port_status in the driver's memory.
This statistic was never reported in favor of a driver-derived stat, but
doing it in the driver was never necessary since firmware had been
reporting it the whole time. Since it would be more accurate and true to
the description of the statistic to get this count at the PHY level,
replace the driver-calculated statistic with one derived from the
firmware one and remove the driver-calculated one entirely.
The stat reported by the ethtool .get_link_ext_stats() handler is
normalized to 0 on driver load and any device resets that require the
driver to rebuild state while also handling overflows.
Eric Joyner [Sun, 14 Jun 2026 20:53:01 +0000 (13:53 -0700)]
ionic: Report "rx_bits_phy" stat to ethtool
This stat contains the number of total bits that the PHY has received;
it's useful for BER calculations. Add it to the ethtool stats output.
However, since this is one of the new "extra port stats", it's reported
in a different manner than the existing port stats and only
conditionally added to the ethtool stats output list: both the
DEV_CAP_EXTRA_STATS capability must be supported by the firmware, and
the firmware must set the value of the statistic to something other than
IONIC_STAT_INVALID.
To help support this scheme, the extra port stats region is initialized to
0xff's/IONIC_STAT_INVALID by the driver, to ensure the statistics that
the driver knows about but the firmware does not are still invalid
to the driver.
Eric Joyner [Sun, 14 Jun 2026 20:53:00 +0000 (13:53 -0700)]
ionic: Update ionic_if.h with new extra port stats
Add a new structure to report additional statistics from the firmware to
struct ionic_port_info. This new struct currently only contains FEC
related statistics, but any new port-level statistics collected by the
firmware would go into it.
The new structure is located in the same area as the unused
ionic_port_pb_stats structure, so this patch also removes that and its
supporting enumerations since they was never used in this driver.
Finally, to indicate firmware support for the new structure, introduce a
new device capability that the driver can use to see if the attached
device supports reporting these extra stats.
Brett Creeley [Sun, 14 Jun 2026 20:52:59 +0000 (13:52 -0700)]
ionic: Fix check in ionic_get_link_ext_stats
The current check will fail if SR-IOV is not initialized for the
physical function; this is because is_physfn is 0 if sriov_init() isn't
run or fails. Change the check that prevents getting the link down count
to use is_virtfn instead so that VFs don't get this functionality, which
was the original intent.
Fixes: 132b4ebfa090 ("ionic: add support for ethtool extended stat link_down_count") Signed-off-by: Brett Creeley <brett.creeley@amd.com> Signed-off-by: Eric Joyner <eric.joyner@amd.com> Link: https://patch.msgid.link/20260614205303.48088-2-eric.joyner@amd.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Linus Torvalds [Tue, 16 Jun 2026 00:56:12 +0000 (06:26 +0530)]
Merge tag 'x86_tdx_for_7.2-rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip
Pull x86 TDX updates from Dave Hansen:
"There are a few cleanups, and some changes that should allow TDX and
kexec to coexist nicely.
The biggest change, however, is support for updating the TDX module
after boot, just like CPU microcode. TDX users really want this
because it lets them do security updates without tearing things down
and rebooting.
- Add TDX module update support
- Make kexec and TDX finally place nice together
- Put TDX error codes into a single header"
* tag 'x86_tdx_for_7.2-rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip: (30 commits)
x86/virt/tdx: Document TDX module update
x86/virt/tdx: Enable TDX module runtime updates
x86/virt/tdx: Refresh TDX module version after update
coco/tdx-host: Lock out module updates when reading version
x86/virt/seamldr: Add module update locking
x86/virt/tdx: Restore TDX module state
x86/virt/seamldr: Initialize the newly-installed TDX module
x86/virt/seamldr: Install a new TDX module
x86/virt/tdx: Reset software states during TDX module shutdown
x86/virt/seamldr: Shut down the current TDX module
x86/virt/seamldr: Abort updates after a failed step
x86/virt/seamldr: Introduce skeleton for TDX module updates
x86/virt/seamldr: Allocate and populate a module update request
coco/tdx-host: Implement firmware upload sysfs ABI for TDX module updates
coco/tdx-host: Don't expose P-SEAMLDR information on CPUs with erratum
coco/tdx-host: Expose P-SEAMLDR information via sysfs
x86/virt/seamldr: Add a helper to retrieve P-SEAMLDR information
x86/virt/seamldr: Introduce a wrapper for P-SEAMLDR SEAMCALLs
coco/tdx-host: Expose TDX module version
coco/tdx-host: Introduce a "tdx_host" device
...
Linus Torvalds [Tue, 16 Jun 2026 00:47:23 +0000 (06:17 +0530)]
Merge tag 'x86_mm_for_7.2-rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip
Pull x86 mm updates from Dave Hansen:
"There's a small comment fixup, followed by an actual bug fix. The bug
fix is slightly new territory for us. It fixes a real regression, but
it is from ~6.18 not a _new_ regression. It was mostly only biting
folks doing hotplug memory testing. So, it was queued in here and held
for the merge window instead of going via x86/urgent.
- Fix freeing of PMD-sized vmemmap pages
- Update comment about pgd_list"
* tag 'x86_mm_for_7.2-rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip:
x86/mm: Fix freeing of PMD-sized vmemmap pages
x86: Update comment about pgd_list
Linus Torvalds [Tue, 16 Jun 2026 00:40:22 +0000 (06:10 +0530)]
Merge tag 'x86_misc_for_7.2-rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip
Pull misc x86 updates from Dave Hansen:
"These are the usual random pile, with the one exception of moving Rick
over to be a TDX maintainer. Rick has been doing a great job with TDX
contributions, especially on the host side of things. It's time to
promote him to "M".
- Move Rick Edgecombe to TDX maintainer
- Remove unused header
- Ensure printf() validation in all configs"
* tag 'x86_misc_for_7.2-rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip:
MAINTAINERS: Move Rick Edgecombe to TDX maintainer
x86: Remove unnecessary architecture-specific <asm/device.h>
x86/bug: Put HAVE_ARCH_BUG_FORMAT_ARGS WARN definitions inside __ASSEMBLER__
x86/bug: Add printf() validation to HAVE_ARCH_BUG_FORMAT_ARGS WARNs
Linus Torvalds [Tue, 16 Jun 2026 00:27:30 +0000 (05:57 +0530)]
Merge tag 'x86_sev_for_v7.2_rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip
Pull x86 SEV updates from Borislav Petkov:
- Remove redundant GHCB initialization guards in the SEV page state and
SVSM call paths now that the GHCB helpers handle early-boot fallback
internally
- Skip SNP initialization in the CCP driver immediately when the
preparation step fails rather than proceeding to an operation that
will certainly fail
- Abort SNP preparation and return an error when not all CPUs are
online, since the firmware enforces that every CPU enables SNP and
will fail init if not
- Simplify the VMM communication exception entry path by replacing
separate kernel and user mode macros with a single handler that
dispatches based on the current privilege level
* tag 'x86_sev_for_v7.2_rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip:
x86/sev: Remove redundant ghcbs_initialized checks around __sev_{get,put}_ghcb()
crypto/ccp: Skip SNP_INIT if preparation fails
x86/sev: Do not initialize SNP if missing CPUs
x86/entry: Zap the #VC entry user and kernel macros
Add support for the two SerDes PCS interfaces of the MxL862xx switch
ICs, which can both either be used to connect PHYs or SFP cages, or as
CPU port(s). 1000Base-X, 2500Base-X, 10GBase-R, 10GBase-KR, SGMII,
QSGMII and USXGMII (single 10G or quad 2.5G) are supported.
The firmware only added the API to directly control the PCS as of
version 1.0.84, so the PCS features are gated behind a version check.
As the driver is growing do some refactoring to break out the phylink
parts into mxl862xx-phylink.h.
====================
Daniel Golle [Sat, 13 Jun 2026 03:07:29 +0000 (04:07 +0100)]
net: dsa: mxl862xx: add support for SerDes ports
The MxL862xx has two XPCS/SerDes interfaces (XPCS0 for ports 9-12,
XPCS1 for ports 13-16). Each can operate in various single-lane modes
(SGMII, 1000Base-X, 2500Base-X, 10GBase-R, 10GBase-KR, USXGMII) or as
QSGMII or 10G_QXGMII providing four sub-ports per interface.
Implement phylink PCS operations using the firmware's XPCS API:
- pcs_enable/pcs_disable: refcount the sub-ports sharing an XPCS
and power it down once the last sub-port is released.
- pcs_config: configure negotiation mode and CL37/SGMII advertising.
- pcs_get_state: read link state and the link-partner ability word
from firmware and decode using phylink's standard CL37, SGMII, and
USXGMII decoders.
- pcs_an_restart: restart CL37 or CL73 auto-negotiation.
- pcs_link_up: force speed/duplex for SGMII.
- pcs_inband_caps: report per-mode in-band status capabilities.
Register a PCS instance for each SerDes interface and
QSGMII/10G_QXGMII sub-ports during setup. Advertise the supported
interface modes in phylink_get_caps based on port number.
Firmware older than 1.0.84 lacks the XPCS API and instead configures
the SerDes itself, using defaults stored in flash. mac_select_pcs()
returns NULL in that case while the single-lane interface modes stay
advertised, so a CPU port keeps working in the firmware-configured
mode.
Lacking support for expressing PHY-side role modes in Linux only the
MAC-side of SGMII, QSGMII, USXGMII and 10G_QXGMII are implemented for
now.
Daniel Golle [Sat, 13 Jun 2026 03:07:23 +0000 (04:07 +0100)]
net: dsa: mxl862xx: move API macros to mxl862xx-host.h
Move the MXL862XX_API_WRITE, MXL862XX_API_READ and
MXL862XX_API_READ_QUIET convenience macros from mxl862xx.c to
mxl862xx-host.h next to the mxl862xx_api_wrap() prototype they wrap.
This makes them available to other compilation units that include
mxl862xx-host.h, which is needed once the SerDes PCS code in
mxl862xx-phylink.c also calls firmware commands.
Daniel Golle [Sat, 13 Jun 2026 03:07:16 +0000 (04:07 +0100)]
net: dsa: mxl862xx: move phylink stubs to mxl862xx-phylink.c
Move the phylink MAC operations and get_caps callback from mxl862xx.c
into a dedicated mxl862xx-phylink.c file. This prepares for the SerDes
PCS implementation which adds substantial phylink/PCS code -- keeping
it in a separate file avoids function-position churn in the main
driver file.
Daniel Golle [Sat, 13 Jun 2026 03:07:11 +0000 (04:07 +0100)]
net: dsa: mxl862xx: store firmware version for feature gating
Query the firmware version at init (already done in wait_ready),
cache it in priv->fw_version, and provide MXL862XX_FW_VER_MIN()
for version-gated code paths throughout the driver.
MXL862XX_FW_VER() packs major/minor/revision into a u32 with
bitwise shifts so that versions compare with natural ordering,
independent of host endianness.
Linus Torvalds [Tue, 16 Jun 2026 00:15:36 +0000 (05:45 +0530)]
Merge tag 'x86_microcode_for_v7.2_rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip
Pull x86 microcode loader updates from Borislav Petkov:
- Move the zero-revision fixup for AMD microcode to the patch level
retrieval function and restrict it to Zen family processors, ensuring
patch level arithmetic always operates on a valid revision
- Fix an incorrect comment about which CPUID bit is checked when
determining whether the microcode loader should be disabled
- Add the latest Intel microcode revision data for a broad range of
processor models and steppings and add the script which generates the
header of minimum expected Intel microcode revisions
* tag 'x86_microcode_for_v7.2_rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip:
x86/microcode/AMD: Move the no-revision fixup to get_patch_level()
x86/microcode: Fix comment in microcode_loader_disabled()
scripts/x86/intel: Add a script to update the old microcode list
x86/microcode/intel: Refresh old_microcode defines with Nov 2025 release
Linus Torvalds [Tue, 16 Jun 2026 00:11:22 +0000 (05:41 +0530)]
Merge tag 'x86_cleanups_for_v7.2_rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip
Pull x86 cleanups from Borislav Petkov:
- The usual pile of cleanups and fixlets the cat dragged in
* tag 'x86_cleanups_for_v7.2_rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip:
x86/cpu: Remove obsolete aperfmperf_get_khz() declaration
x86/pmem: Check for platform_device_alloc() retval
x86/platform/uv: Use str_enabled_disabled() in uv_nmi_setup_hubless_intr()
x86/cpu: Keep the PROCESSOR_SELECT menu together
x86/tlb: Convert copy_from_user() + kstrtouint() to kstrtouint_from_user()
x86/purgatory: Fix #endif comment
x86/boot: Get rid of kstrtoull()
x86/boot/compressed: Use boot_kstrtoul() for hugepages= parsing
Linus Torvalds [Tue, 16 Jun 2026 00:05:40 +0000 (05:35 +0530)]
Merge tag 'x86_cache_for_v7.2_rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip
Pull x86 resource control updates from Borislav Petkov:
"Preparatory work for MPAM counter assignment:
- Simplify the error handling path when creating monitor group event
configuration directories
- Make the MBM event filter configurable only on architectures that
support it and expose this with the respective file modes in the
event config
- Disallow the MBA software controller on systems where MBM counters
are assignable, as it requires continuous bandwidth measurement
that assignable counters do not guarantee
- Replace a compile-time Kconfig option for fixed counter assignment
with a per-architecture runtime property, and expose whether the
counter assignment mode is changeable to userspace
- Continue counter allocation across all domains instead of aborting
at the first failure
- Document that automatic MBM counter assignment is best effort and
may not assign counters to all domains
- Document the behavior of task ID 0 and idle tasks in the resctrl
tasks file"
* tag 'x86_cache_for_v7.2_rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip:
fs/resctrl: Document tasks file behaviour for task id 0 and idle tasks
fs/resctrl: Document that automatic counter assignment is best effort
fs/resctrl: Continue counter allocation after failure
fs/resctrl: Add monitor property 'mbm_cntr_assign_fixed'
fs/resctrl: Disallow the software controller when MBM counters are assignable
x86,fs/resctrl: Create 'event_filter' files read only if they're not configurable
fs/resctrl: Tidy up the error path in resctrl_mkdir_event_configs()
Linus Torvalds [Tue, 16 Jun 2026 00:01:01 +0000 (05:31 +0530)]
Merge tag 'edac_updates_for_v7.2_rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/ras/ras
Pull EDAC updates from Borislav Petkov:
- Fix a malformed Kconfig default for the AMD Address Translation
Library
- Make sure i10nm loads successfully when the ADXL address decoder is
absent because former has decoding capabilities too
- Ensure error reporting is cleanly disabled on driver teardown and on
failed initialization for several legacy Intel EDAC drivers
- Fix a grammar issue in a diagnostic warning in the Sandy Bridge
driver
- Fix a missing resource release callback and incorrect memory topology
parsing in the igen6 driver, and add support for Intel Panther Lake-H
and Nova Lake-H SoCs
- Fix an out-of-bounds shift causing undefined behaviour in the Skylake
driver
- Consolidate memory controller register access helpers into shared
common code across the Intel Skylake, Ice Lake, and Meteor Lake
drivers
- Introduce sub-channel awareness and Rank Retry Logic improvements to
the Intel Skylake and i10nm drivers in preparation for Diamond Rapids
server support
- Add Rank Retry Logic support for Intel Diamond Rapids server to
imh_edac
- Make In-Band ECC detection registers configurable per SoC in the
igen6 driver
- Standardize PCI device ID table definitions across all EDAC drivers
to use named field initializers and standard PCI helper macros
* tag 'edac_updates_for_v7.2_rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/ras/ras: (22 commits)
EDAC: Consistently define pci_device_ids using named initializers
EDAC/igen6: Add Intel Nova Lake-H SoC support
EDAC/igen6: Make registers for detecting IBECC configurable
EDAC/imh: Add RRL support for Intel Diamond Rapids server
EDAC/{skx_common,i10nm}: Prepare RRL for sub-channel granularity
EDAC/skx_common: Add SubChannel support to ADXL decode
EDAC/{skx_common,i10nm}: Move RRL handling to common code
EDAC/{skx_common,i10nm}: Introduce rrl_ctrl_mode
EDAC/{skx_common,i10nm}: Rename rrl_mode to rrl_source_type
EDAC/{skx_common,skx,i10nm}: Split skx_set_decode()
EDAC/{skx_common,i10nm,imh}: Move MC register access helpers to skx_common
EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info
EDAC/igen6: Add one Intel Panther Lake-H SoC support
EDAC/igen6: Fix memory topology parsing for Panther Lake-H SoCs
EDAC/igen6: Fix call trace due to missing release()
EDAC/sb_edac: fix grammar in sb_decode_ddr3 warning
EDAC/i5400: disable error reporting at teardown and refactor helper
EDAC/i5100: disable error reporting at teardown and create helper
EDAC/i5000: disable error reporting at teardown and refactor helper
EDAC/i7300: disable error reporting if init fails and refactor helper
...
Linus Torvalds [Mon, 15 Jun 2026 23:48:04 +0000 (05:18 +0530)]
Merge tag 'arm64-upstream' of gitolite.kernel.org:pub/scm/linux/kernel/git/arm64/linux
Pull arm64 updates from Will Deacon:
"It feels like the new world of AI tooling has slowed us down a little
on the feature side when compared to the fixes side. The extra rounds
of Sashiko review have also pushed a few things out until next time.
Still, there's some good foundational stuff here for the fpsimd code
and hardening work towards removing the predictable linear alias of
the kernel image.
CPU errata handling:
- Extend CnP disabling workaround to HiSilicon HIP09 hardware.
- Work around eternally broken broadcast TLB invalidation on more
CPUs.
- Documentation and code cleanups.
CPU features:
- Add new hwcaps for the 2025 dpISA extensions.
Floating point / SVE / SME:
- Significant cleanup to the low-level state management code in the
core architecture code and KVM.
- Use correct register widths during SVE/SME save/restore assembly.
- Expose SVE/SME save/restore memory accesses to sanitisers.
Memory management:
- Preparatory work for unmapping the kernel data and bss sections
from the linear map.
Miscellaneous:
- Inline DAIF manipulation helpers so they can be used safely from
non-instrumentable code.
- Fix handling of the 'nosmp' cmdline option to avoid marking
secondary cores as "possible".
MPAM:
- Add support for v0.1 of the MPAM architecture.
Perf:
- Update HiSilicon PMU MAINTAINERS entry.
- Fix event encodings for the DVM node in the CMN driver.
Selftests:
- Extend sigframe tests to cover POE context.
- Add coverage for the newly added 2025 dpISA hwcaps.
System registers:
- Add new registers and ESR encodings for the HDBSS feature.
Plus minor fixes and cleanups across the board"
* tag 'arm64-upstream' of gitolite.kernel.org:pub/scm/linux/kernel/git/arm64/linux: (73 commits)
arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU
arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU
arm64: errata: Mitigate TLBI errata on various Arm CPUs
arm64: cputype: Add C1-Premium definitions
arm64: cputype: Add C1-Ultra definitions
Revert "arm64: mm: Unmap kernel data/bss entirely from the linear map"
Revert "arm64: mm: Defer remap of linear alias of data/bss"
arm64: arch_timer: reuse arch_timer_read_cnt{p,v}ct_el0() helpers
arm64/mm: Rename ptdesc_t
arm64: mm: Defer remap of linear alias of data/bss
KVM: arm64: Omit tag sync on stage-2 mappings of the zero page
arm64: Avoid double evaluation of __ptep_get()
kasan: Move generic KASAN page tables out of BSS too
arm64: Rename page table BSS section to .bss..pgtbl
arm64: patching: replace min_t with min in __text_poke
perf/arm-cmn: Fix DVM node events
arm64: fpsimd: Remove <asm/fpsimdmacros.h>
arm64: fpsimd: Move SME save/restore inline
arm64: fpsimd: Move sve_flush_live() inline
arm64: fpsimd: Move SVE save/restore inline
...
Linus Torvalds [Mon, 15 Jun 2026 23:38:13 +0000 (05:08 +0530)]
Merge tag 's390-7.2-1' of gitolite.kernel.org:pub/scm/linux/kernel/git/s390/linux
Pull s390 updates from Alexander Gordeev:
- Use CIO device online variable instead of the internal FSM state to
determine device availability during purge operations
- Remove extra check of task_stack_page() because try_get_task_stack()
already takes care of that when reading /proc/<pid>/wchan
- Allow user-space to use the new SCLP action qualifier 4 for to
provide NVMe SMART log data to the platform.
- Send AP CHANGE uevents on successful bind and successful association
to notify user-space about SE operations on AP queue devices
- Add an s390dbf kernel parameter to configure debug log levels and
area sizes during early boot
- On arm64 the empty zero page is going to be mapped read-only. Do the
same for s390 with an explicit set_memory_ro() call
- Improve s390-specific bcr_serialize() and cpu_relax() implementations
- Remove all unused variables to avoid allmodconfig W=1 build fails
with latest clang-23
- Cleanup default Kconfig values for s390 selftests
- Add a s390-tod trace clock to allow comparing trace timestamps
between different systems or virtual machines on s390
- Remove the s390 implementation of strlcat() in favor of the generic
variant
- Make consistent the calling order between
page_table_check_pte_clear() and secure page conversion across all
code paths
- Rearrange some fields within AP and zcrypt structs to reduce memory
consumption and unused holes
- Shorten GR_NUM and VX_NUM macros and move them to a separate header
- Replace __get_free_page() with kmalloc() in few sources
- Introduce an infrastructure for more efficient this_cpu operations.
Eliminate conditional branches when PREEMPT_NONE is removed
- Enable Rust support
- Use z10 as minimum architecture level, similar to the boot code, to
enforce a defined architecture level set
- Improve and convert various mem*() helper functions to C. For that
add .noinstr.text section to avoid orphaned warnings from the linker
- Fix the function pointer type in __ret_from_fork() to correct the
indirect call to match kernel thread return type of int
- Revert support for DCACHE_WORD_ACCESS to avoid an endless exception
loop on read from donated Ultravisor pages at unaligned addresses
* tag 's390-7.2-1' of gitolite.kernel.org:pub/scm/linux/kernel/git/s390/linux: (52 commits)
s390: Revert support for DCACHE_WORD_ACCESS
s390/process: Fix kernel thread function pointer type
s390/tishift: Convert __ashlti3(), __ashrti3(), __lshrti3() to C
s390/memmove: Optimize backward copy case
s390/string: Convert memset(16|32|64)() to C
s390/string: Convert memcpy() to C
s390/string: Convert memset() to C
s390/string: Convert memmove() to C
s390/string: Add -ffreestanding compile option to string.o
s390: Add .noinstr.text to boot and purgatory linker scripts
s390/purgatory: Enforce z10 minimum architecture level
s390: Enable Rust support
s390/cmpxchg: Fix KASAN stack-out-of-bounds in atomic helpers
rust: helpers: Add memchr wrapper for string operations
rust/bindgen_parameters: Mark s390 types as opaque to prevent repr conflicts
s390/jump_label: Implement ARCH_STATIC_BRANCH_JUMP_ASM and ARCH_STATIC_BRANCH_ASM macros
s390/bug: Provide ARCH_WARN_ASM for Rust WARN/BUG support
s390/ap: Fix locking issue in SE bind and associate sysfs functions
s390/percpu: Provide arch_this_cpu_write() implementation
s390/percpu: Provide arch_this_cpu_read() implementation
...
====================
MAC-PHY interrupt changed to level triggered interrupt
According to OPEN Alliance 10BASE-T1x MAC-PHY Serial Interface
specification, MAC-PHY interrupt is "active low, level triggered".
The specification mentions about the conditions in which the IRQ
is asserted and deasserted.
Bug is inadvertently introduced by treating the IRQ in the OA TC6
framework driver and in dt-binding YAML file as edge triggered.
With the changes to use level triggered interrupt, use of threaded
irq is more efficient than the current method that has interrupt hander
working with work queue.
This change of interrupt handler mechanism exposed couple of race
conditions due to the fact that interrupts were not masked on protocol
error. And pointers were not initialized with null after skbs are freed.
Changes are done in two files
- OA TC6 framework Ethernet driver
- YAML file for the vendor that already uses OA TC6 framework.
Maintainer for this driver is already informed and aware of these
changes. Testing for these changes was done in onsemi's setup and
found to be working.
====================
projects / thirdparty / linux.git / log
