summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-07-19dmaengine: dw-edma-pcie: Drop redundant pci_free_irq_vectors()Koichiro Den
dw_edma_pcie enables the PCI device with pcim_enable_device(), so IRQ vectors allocated by pci_alloc_irq_vectors() are released by pcim_msi_release() on device release. The driver should not call pci_free_irq_vectors() manually. Drop the redundant remove-time cleanup and rely on the managed PCI device lifetime instead, as documented by commit 03e4905402ae ("PCI/MSI: Clarify pci_free_irq_vectors() usage for managed devices"). Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Koichiro Den <den@valinux.co.jp> Link: https://patch.msgid.link/20260717180639.2643243-8-den@valinux.co.jp Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-07-19dmaengine: dw-edma: Clear stale requests on terminationKoichiro Den
terminate_all() can finish immediately when the channel is unconfigured, paused, idle, or already stopped in hardware. A pending PAUSE request can survive these paths and block issue_pending() even after termination. Clear the request whenever termination leaves the channel idle. A running channel keeps its STOP request until the interrupt handler consumes it. Fixes: e63d79d1ffcd ("dmaengine: Add Synopsys eDMA IP core driver") Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Koichiro Den <den@valinux.co.jp> Link: https://patch.msgid.link/20260717180639.2643243-7-den@valinux.co.jp Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-07-19dmaengine: dw-edma: Serialize channel state checksKoichiro Den
pause() and resume() read and update channel state without holding vc.lock, while the interrupt handlers update the same state under it. Take the same lock around those state checks so that request, status, and configured stay consistent. For example, pause() can observe EDMA_ST_BUSY right before the interrupt handler completes the final descriptor and moves the channel to EDMA_ST_IDLE, and then record EDMA_REQ_PAUSE on an already idle channel. No further interrupt will acknowledge the request, and since issue_pending() requires EDMA_REQ_NONE, the channel is wedged for good: terminate_all() leaves the stale request behind, so even reconfiguring the channel does not recover it. issue_pending() already runs under vc.lock, but it tests configured before taking it. Move that test under the lock as well, so configured, request, and status are evaluated as one channel-state snapshot. Fixes: e63d79d1ffcd ("dmaengine: Add Synopsys eDMA IP core driver") Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Koichiro Den <den@valinux.co.jp> Link: https://patch.msgid.link/20260717180639.2643243-6-den@valinux.co.jp Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-07-19dmaengine: dw-edma: Complete descriptors before pausingKoichiro Den
If PAUSE is requested while the final burst of a descriptor is in flight, the DONE interrupt takes the PAUSE path without checking whether the descriptor has been depleted. The depleted descriptor remains on the issued list and the channel enters EDMA_ST_PAUSE. On resume, dw_edma_start_transfer() can select that depleted descriptor again even though no burst remains, leaving the channel in an invalid busy state. Check for descriptor completion before acknowledging PAUSE. If there is no work to start on resume, leave the channel idle. Also ignore DONE interrupts while the channel is paused so a stale or repeated interrupt cannot change its state or start queued work. Fixes: e63d79d1ffcd ("dmaengine: Add Synopsys eDMA IP core driver") Cc: stable@vger.kernel.org Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Koichiro Den <den@valinux.co.jp> Link: https://patch.msgid.link/20260717180639.2643243-5-den@valinux.co.jp Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-07-19dmaengine: dw-edma: Serialize abort state updatesKoichiro Den
dw_edma_abort_interrupt() drops vc.lock before changing request and status. issue_pending() can acquire the lock in that small window, observe the old busy state, and skip starting queued descriptors. Then the abort handler overwrites the channel status as idle, leaving the new descriptors stranded for good. Keep descriptor completion and the state transition in the same critical section. Fixes: e63d79d1ffcd ("dmaengine: Add Synopsys eDMA IP core driver") Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Koichiro Den <den@valinux.co.jp> Link: https://patch.msgid.link/20260717180639.2643243-4-den@valinux.co.jp Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-07-19dmaengine: dw-edma: Terminate all descriptors without callbacksKoichiro Den
The DMA Engine client documentation says in the "Terminate APIs" section of Documentation/driver-api/dmaengine/client.rst: "No callback functions will be called for any incomplete transfers." dw-edma instead calls vchan_cookie_complete() when a deferred STOP reaches the interrupt handler. This schedules a callback for the active descriptor and leaves other issued or submitted descriptors queued. A late callback after dmaengine_terminate_sync() can dereference client state that has already been freed, while leftover descriptors may later restart into reused buffers or leak. Move all issued and submitted descriptors to the terminated list whenever termination completes. For a pending STOP, do this from both the DONE and ABORT paths. Complete their cookies in order without scheduling callbacks. A STOP can remain pending until the running transfer raises an interrupt. Make device_synchronize() wait for such a pending STOP to complete before releasing terminated descriptors. Reuse it from free_chan_resources(), then release the remaining virt-dma resources. Sleep instead of busy-polling while waiting, and warn if the existing timeout expires. Fixes: e63d79d1ffcd ("dmaengine: Add Synopsys eDMA IP core driver") Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Koichiro Den <den@valinux.co.jp> Link: https://patch.msgid.link/20260717180639.2643243-3-den@valinux.co.jp Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-07-19dmaengine: dw-edma: Fix HDMA channel status register accessKoichiro Den
GET_CH_32() takes the direction before the channel ID, but dw_hdma_v0_core_ch_status() passed them in the opposite order. This can make the status callback read another HDMA channel status register. Use the same argument order as the other HDMA register accesses. Fixes: e74c39573d35 ("dmaengine: dw-edma: Add support for native HDMA") Cc: stable@vger.kernel.org Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Koichiro Den <den@valinux.co.jp> Link: https://patch.msgid.link/20260717180639.2643243-2-den@valinux.co.jp Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-07-19Merge tag 'block-7.2-20260717' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fixes from Jens Axboe: - Fixes for the dio bounce buffer helpers: correct the alignment of bounced dio read bios to avoid a double unpin, handle huge zero folios in bio_free_folios(), and don't warn on the larger-order folio attempts in the greedy allocation path. - Try a slab allocation in bio_alloc_bioset() before falling back to the mempool, restoring the previous behavior for non-sleeping allocations from a cache-enabled bioset. - Serialize elevator changes for the same queue using the writer lock. - Fix a race in blk_time_get_ns() where a task preempted between setting PF_BLOCK_TS and the cached-timestamp reload could return 0. - blk-cgroup fix for leaks and the online flag on a radix_tree_insert() failure in blkg_create(). - Free the copied pages when blk_rq_map_kern() fails after blk_rq_append_bio() rejects the bio. - Remove manually added partitions on loop device detach, fixing dead partition devices left behind and a subsequent LOOP_CONFIGURE -EBUSY - Bound the AIX partition lvd scan to the sector that was actually read. - Show the block operation in error injection rules (Jackie) * tag 'block-7.2-20260717' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: block: fix aligning of bounced dio read bios block: handle huge zero folios in bio_free_folios block: try slab allocation in bio_alloc_bioset() before mempool block: show operation in error injection rules block: serialize elevator changes for the same queue using a writer lock block: free copied pages when blk_rq_map_kern() fails block: do not warn when doing greedy allocation in folio_alloc_greedy() partitions: aix: bound the lvd scan to one sector blk-cgroup: fix leaks and online flag on radix_tree_insert failure loop: remove manually added partitions on detach block: fix race in blk_time_get_ns() returning 0
2026-07-19bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insnLeon Hwang
The BPF_MOV64_PERCPU_REG insn requires JIT to emit native code to for 'dst_reg = src_reg + <percpu_base_off>'. However, the interpreter ignores the 'off' at its ALU64_MOV_X label. The 'off' indicates the insn is BPF_MOV64_PERCPU_REG insn. Then, when the interpreter loads memory from the register, it will hit a page fault. [ 2.545572] BUG: unable to handle page fault for address: ffffffffacaaf034 [ 2.546485] #PF: supervisor read access in kernel mode [ 2.547167] #PF: error_code(0x0000) - not-present page [ 2.547850] PGD 134e63067 P4D 134e63067 PUD 134e64063 PMD 10021c063 PTE 800ffffeca550062 [ 2.548912] Oops: Oops: 0000 [#1] SMP PTI Set jit_required as true in order to disallow interpreter fallback in core.c::__bpf_prog_select_runtime(), if any BPF_ADDR_PERCPU insn is patched to the prog. BTW, rename the helper bpf_map_supports_cpu_flags() to bpf_map_is_percpu_map(). Fixes: 7bdbf7446305 ("bpf: add special internal-only MOV instruction to resolve per-CPU addrs") Signed-off-by: Leon Hwang <leon.hwang@linux.dev> Link: https://lore.kernel.org/bpf/20260715141122.15783-4-leon.hwang@linux.dev Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-19bpf: Disallow interpreter fallback for gotox insnLeon Hwang
The interpreter does not recognize the BPF_JMP|BPF_JA|BPF_X insn, which is used for insn_array map. Thereafter, it would hit the BUG_ON() in ___bpf_prog_run() at run time. [ 2.563726] BPF interpreter: unknown opcode 0d (imm: 0x0) [ 2.564557] ------------[ cut here ]------------ [ 2.565206] kernel BUG at kernel/bpf/core.c:2349! [ 2.565882] Oops: invalid opcode: 0000 [#1] SMP PTI Set jit_required as true when insn_array map is used in the prog in order to disallow interpreter fallback for gotox insn in core.c::__bpf_prog_select_runtime(). Fixes: 493d9e0d6083 ("bpf, x86: add support for indirect jumps") Signed-off-by: Leon Hwang <leon.hwang@linux.dev> Link: https://lore.kernel.org/bpf/20260715141122.15783-3-leon.hwang@linux.dev Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-19bpf: Disallow interpreter fallback for arena-related insnsLeon Hwang
Since the interpreter does not support the arena-related insns, interpreter fallback should not be allowed for these insns in core.c::__bpf_prog_select_runtime(). Currently, when the interpreter executes the arena ST/LDX/STX insns, it would hit the BUG_ON() in ___bpf_prog_run() at run time. [ 2.579196] BPF interpreter: unknown opcode a2 (imm: 0x0) [ 2.579998] ------------[ cut here ]------------ [ 2.580652] kernel BUG at kernel/bpf/core.c:2349! [ 2.581314] Oops: invalid opcode: 0000 [#1] SMP PTI Set jit_required as true when arena map is used in the prog to disallow interpreter fallback for arena-related insns. Fixes: 6082b6c328b5 ("bpf: Recognize addr_space_cast instruction in the verifier.") Signed-off-by: Leon Hwang <leon.hwang@linux.dev> Link: https://lore.kernel.org/bpf/20260715141122.15783-2-leon.hwang@linux.dev Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-19Merge tag 'io_uring-7.2-20260717' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fixes from Jens Axboe: - Fix a use-after-free in the bpf-ops struct_ops path, where the same io_uring_bpf_ops map could be registered more than once. - Fix the deferred iovec free for the provided-buffer grow path, which could leave the caller with a dangling iovec and result in repeated frees. Follow-up to the earlier fix in this series. - Zero-check the unused addr3/pad2 SQE fields for unlinkat * tag 'io_uring-7.2-20260717' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/bpf-ops: reject re-registration of an already-bound ops io_uring/fs: check unused sqe fields for unlinkat io_uring/kbuf: free the replaced iovec after a successful grow
2026-07-19Merge branch 'bpf-reject-arena-frees-below-the-arena-base'Kumar Kartikeya Dwivedi
Yiyang Chen says: ==================== bpf: Reject arena frees below the arena base bpf_arena_free_pages() can be called with a scalar arena address. The runtime reconstructs a full user address from the arena base and the low 32 bits before returning the range to the arena free tree. A scalar one page below the arena base can otherwise produce an out-of-domain free-tree offset and make a later allocation return an address below the arena mapping. Patch 1 rejects frees whose reconstructed full user address is below user_vm_start. Patch 2 adds verifier_arena coverage for the scalar-below-base case. Changes in v2: - Add Reviewed-by tags from Emil Tsalapatis. - Remove the empty inline asm from the selftest. v1: https://lore.kernel.org/bpf/cover.1782813442.git.chenyy23@mails.tsinghua.edu.cn/ ==================== Link: https://patch.msgid.link/20260717-c10-031-public-bpf-next-v2-b4-v2-0-54b555443a7c@mails.tsinghua.edu.cn Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-19selftests/bpf: Cover scalar arena frees below the baseYiyang Chen
Add a verifier_arena case that fills a two-page arena, calls bpf_arena_free_pages() with a scalar address one page below the arena base, and then verifies that another allocation is still rejected. Before the runtime guard, the invalid free can repopulate the free tree with an out-of-domain offset and the final allocation succeeds. Signed-off-by: Yiyang Chen <chenyy23@mails.tsinghua.edu.cn> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Link: https://lore.kernel.org/bpf/20260717-c10-031-public-bpf-next-v2-b4-v2-2-54b555443a7c@mails.tsinghua.edu.cn Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-19bpf: Reject arena frees below the arena baseYiyang Chen
bpf_arena_free_pages() accepts scalar arena addresses. The runtime masks the address to the low 32 bits and reconstructs a full user address from the arena base before returning the range to the arena free tree. When the scalar value is below the low 32 bits of the arena base, full_uaddr falls below user_vm_start. The existing upper-end clipping then turns this into an out-of-range free-tree offset. A later allocation can reuse that offset and return an address below the arena mapping. Reject such frees before computing the clipped range. Fixes: 317460317a02a ("bpf: Introduce bpf_arena.") Signed-off-by: Yiyang Chen <chenyy23@mails.tsinghua.edu.cn> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Link: https://lore.kernel.org/bpf/20260717-c10-031-public-bpf-next-v2-b4-v2-1-54b555443a7c@mails.tsinghua.edu.cn Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-19selftests/bpf: Remove redundant config option from selftests fragmentsAlexis Lothoré (eBPF Foundation)
CONFIG_IPV6_SEG6_LWTUNNEL is currently enabled in each arch-specific config fragment for the BPF selftests. Commit 33a971d549d8 ("selftests/bpf: Add LWT encap tests for skb metadata") has enabled this config in the generic config as well, resulting in a small warning when configuring a kernel for selftests: $ cat tools/testing/selftests/bpf/{config,config.vm,config.x86_64}>.config $ make olddefconfig HOSTCC scripts/kconfig/conf.o HOSTCC scripts/kconfig/confdata.o HOSTLD scripts/kconfig/conf config:269:warning: override: reassigning to symbol IPV6_SEG6_LWTUNNEL # # configuration written to .config # Now that IPV6_SEG6_LWTUNNEL is set in the general config fragment, drop it from the arch-specific fragments. Signed-off-by: Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com> Link: https://lore.kernel.org/bpf/20260709-testing-fragments-v1-1-65244b0650ff@bootlin.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-19Merge tag 'spi-fix-v7.2-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A couple of fairly routine driver fixes, nothing too remarkable" * tag 'spi-fix-v7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: cadence-quadspi: Fix indirect write timeout when DMA read mode is enabled spi: dw-dma: Wait for controller idle before completing Tx
2026-07-19ublk: wait on ublk_dev_ready() instead of ub->completionMing Lei
ub->completion is only re-armed by a successful START_USER_RECOVERY. If the ublk server sends END_USER_RECOVERY without one - e.g. its START failed with -EBUSY and the error was ignored - the wait is satisfied by the stale completion of the previous recovery cycle, and the device is marked LIVE and the requeue list kicked while the FETCH stream is still running and ubq->canceling is still set. The kick redispatches a previously requeued request, __ublk_queue_rq_common() sees ->canceling and parks it again via __ublk_abort_rq(), and after the last FETCH clears ->canceling nothing ever kicks the requeue list again: the request is stranded there while holding its tag. If it is the flush machinery's flush_rq, every subsequent fsync piles up in uninterruptible sleep and teardown hangs on tag draining. This matches a report of a lost PREFLUSH with ext4 on top of ublk after daemon crash recovery. ub->completion is an edge-triggered latch used as a proxy for the level condition "every queue has fetched all I/O commands", which can regress (F_BATCH's UNPREP, daemon death) and whose re-arm can be skipped. Drop it and wait on the real condition instead: the new helper ublk_wait_dev_ready_and_lock() waits on ublk_dev_ready() via wait_var_event_interruptible(), woken from ublk_mark_io_ready(), then re-checks it under ub->mutex, waiting again on regression, and returns with the mutex held and readiness guaranteed. Readiness becomes true in the same ub->mutex critical section that clears the last queue's ->canceling, so END_USER_RECOVERY marks the device LIVE and kicks the requeue list strictly after ->canceling clears. The wait stays interruptible, so a server whose daemon died can still be signalled out. For ublk_ctrl_start_dev() this replaces the fail-fast -EINVAL on an F_BATCH ready->UNPREP regression with waiting until the device is ready again. Reported-by: George Salisbury <gsalisbury@apnic.net> Fixes: 728cbac5fe21 ("ublk: move device reset into ublk_ch_release()") Cc: stable@vger.kernel.org Signed-off-by: Ming Lei <tom.leiming@gmail.com> Link: https://patch.msgid.link/20260719134540.120269-1-tom.leiming@gmail.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-07-19Merge tag 'regulator-fix-v7.2-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fix from Mark Brown: "One straightforward driver fix for some incorrectly described bitfields in the ltc3676 driver" * tag 'regulator-fix-v7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: ltc3676: Fix incorrect IRQSTAT bit offsets
2026-07-19Merge branch 'bpf-add-memory-usage-for-arena-and-selftest'Kumar Kartikeya Dwivedi
Jiayuan Chen says: ==================== bpf: Add memory usage for arena and selftest arena is the only map type whose map_mem_usage() still returns 0, so bpftool and fdinfo always show 0 memlock for it no matter how many pages it holds. This series adds the accounting, runs the arena selftests serially so they don't OOM a small CI VM, and adds a test for it. v1 -> v2: - split the scratch_page -> arena refactor into a prep patch (no functional change) - use WRITE_ONCE() for nr_pages to pair with the lockless reader - reword the "run serially" commit message - selftest: alloc prog returns 0 so the failure check is reached v1: https://lore.kernel.org/bpf/20260716142746.8794-1-jiayuan.chen@linux.dev/ ==================== Link: https://patch.msgid.link/20260717114117.350851-1-jiayuan.chen@linux.dev Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-19selftests/bpf: Add tests for memory usage for arenaJiayuan Chen
Allocate and free arena pages, both from BPF and via user-space fault-in, and check that the map's memlock in fdinfo tracks the number of pages that are actually populated. Like the other arena tests it runs serially. test: ./test_progs -a arena_mem_usage #5 arena_mem_usage:OK Summary: 1/0 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Link: https://lore.kernel.org/bpf/20260717114117.350851-5-jiayuan.chen@linux.dev Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-19selftests/bpf: Run arena tests seriallyJiayuan Chen
Every arena reserves a 4GB kernel vmalloc region at creation, and on a KASAN build that eagerly populates ~512MB of shadow memory per arena. When several arena tests run in parallel their shadow adds up, exhausts the memory of a small CI VM and trips the OOM killer during map creation. Make the dedicated arena tests (arena_* and libarena*) serial so they no longer pile up in the parallel phase. That alone brings the peak number of live arenas back within the CI memory budget. A few other tests such as verifier_arena*, stream and compute_live_registers create an arena too, but they run inside shared RUN_TESTS()/RUN() suites, so turning them serial would drag many unrelated subtests along with them. Leave those as-is. Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Link: https://lore.kernel.org/bpf/20260717114117.350851-4-jiayuan.chen@linux.dev Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-19bpf: Add memory usage for arenaJiayuan Chen
arena is the only map type whose map_mem_usage() still returns 0, so "bpftool map show" and fdinfo always showed 0 memlock for an arena no matter how many pages it had. Count the pages that are actually mapped into the arena: bump a counter in apply_range_set_cb() when a page goes in and drop it in apply_range_clear_cb() when a page goes out, both under the arena spinlock. map_mem_usage() then just returns nr_pages << PAGE_SHIFT. Only real data pages are counted, not the scratch page. Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Link: https://lore.kernel.org/bpf/20260717114117.350851-3-jiayuan.chen@linux.dev Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-19bpf: Pass arena instead of scratch_page to the pte callbacksJiayuan Chen
Replace the scratch_page field in the pte-callback data with the arena pointer; later patches use other arena fields from these callbacks. No functional change. Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Link: https://lore.kernel.org/bpf/20260717114117.350851-2-jiayuan.chen@linux.dev Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-19Merge tag 'x86-urgent-2026-07-19' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: - Reject too long acpi_rsdp= boot parameter values (Thorsten Blum) - Validate console=uart8250 baud rate to fix early boot hang (Thorsten Blum) - Remove dead Makefile rule (Ethan Nelson-Moore) * tag 'x86-urgent-2026-07-19' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/boot: Validate console=uart8250 baud rate to fix early boot hang x86/boot: Reject too long acpi_rsdp= values x86/cpu: Remove Makefile rule for removed UMC CPU support
2026-07-19rust: drm: fix non-const `read8` in unit testGary Guo
With CONFIG_CC_OPTIMIZE_FOR_SIZE, the address validity check in non-const `read8` invocaction is not optimized away, leading to build failure. Fixes: d055768429b3 ("rust: drm: gem: shmem: Add vmap functions") Signed-off-by: Gary Guo <gary@garyguo.net> Link: https://patch.msgid.link/20260716142545.3622278-2-gary@kernel.org Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-07-19hwmon: (asus-ec-sensors) add missed handle for ENOMEMEugene Shalygin
Add missing return value check in the setup function. Fixes: d0ddfd241e57 ("hwmon: (asus-ec-sensors) add driver for ASUS EC") Signed-off-by: Eugene Shalygin <eugene.shalygin@gmail.com> Link: https://lore.kernel.org/r/20260712130602.1256700-2-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-07-19hwmon: (asus-ec-sensors) fix EC read intervalsEugene Shalygin
Take INITIAL_JIFFIES into account when setting up next update time. Fixes: d0ddfd241e57 ("hwmon: (asus-ec-sensors) add driver for ASUS EC") Signed-off-by: Eugene Shalygin <eugene.shalygin@gmail.com> Link: https://lore.kernel.org/r/20260712110650.1240071-2-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-07-19hwmon: (asus-ec-sensors) fix looping over banks while reading from ECEugene Shalygin
Do not assume there are only bank 0 and bank 1 available, just use '!=' for bank comparison. Fixes: d0ddfd241e57 ("hwmon: (asus-ec-sensors) add driver for ASUS EC") Signed-off-by: Eugene Shalygin <eugene.shalygin@gmail.com> Link: https://lore.kernel.org/r/20260711074217.554656-1-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-07-19hwmon: (pmbus/max34440) block unsupported VIN and IIN limit registersAlexis Czezar Torreno
MAX34451 and ADPM chips do not support standard PMBus VIN/IIN limit registers, manufacturer specific min/max registers, or undercurrent or undertemperature fault limits. STATUS_BYTE and STATUS_OTHER are also not available. Accessing these non-existent registers during driver initialization triggers a CML error and asserts ALERT. Handled by blocking these functions during read/write. Fixes: 7a001dbab4ad ("hwmon: (pmbus/max34440) Add support for MAX34451.") Fixes: 629cf8f6c23a ("hwmon: (pmbus/max34440) Add support for ADPM12160") Fixes: 2e0b52f1ae88 ("hwmon: (pmbus/max34440): add support adpm12200") Fixes: 479bfeba2eb6 ("hwmon: (pmbus/max34440): add support adpm12250") Signed-off-by: Alexis Czezar Torreno <alexisczezar.torreno@analog.com> Link: https://lore.kernel.org/r/20260716-max34451_fixes-v1-1-a941b27eaecb@analog.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-07-19arm64: dts: apple: t60xx: jxxx: Add device-specific SMC hwmon sensorsJames Calligeros
Add the device-specific hwmon sensors for select T60xx-based devices Signed-off-by: James Calligeros <jcalligeros99@gmail.com> Link: https://patch.msgid.link/20260714-smc-subdev-dt-v2-12-13fa78873121@gmail.com Signed-off-by: Sven Peter <sven@kernel.org>
2026-07-19arm64: dts: apple: t8112: jxxx: Add device-specific SMC hwmon sensorsJames Calligeros
Add the device-specific hwmon sensors for select T8112-based devices Signed-off-by: James Calligeros <jcalligeros99@gmail.com> Link: https://patch.msgid.link/20260714-smc-subdev-dt-v2-11-13fa78873121@gmail.com Signed-off-by: Sven Peter <sven@kernel.org>
2026-07-19arm64: dts: apple: t8103: jxxx: Add device-specific SMC hwmon sensorsJames Calligeros
Add the device-specific hwmon sensors for select T8103-based devices Signed-off-by: James Calligeros <jcalligeros99@gmail.com> Link: https://patch.msgid.link/20260714-smc-subdev-dt-v2-10-13fa78873121@gmail.com Signed-off-by: Sven Peter <sven@kernel.org>
2026-07-19arm64: dts: apple: t602x: Add common SMC hwmon sensorsJames Calligeros
Add the SMC hwmon sensors common to all SoCs Signed-off-by: James Calligeros <jcalligeros99@gmail.com> Link: https://patch.msgid.link/20260714-smc-subdev-dt-v2-9-13fa78873121@gmail.com Signed-off-by: Sven Peter <sven@kernel.org>
2026-07-19arm64: dts: apple: t600x: Add common SMC hwmon sensorsJames Calligeros
Add the SMC hwmon sensors common to all SoCs Signed-off-by: James Calligeros <jcalligeros99@gmail.com> Link: https://patch.msgid.link/20260714-smc-subdev-dt-v2-8-13fa78873121@gmail.com Signed-off-by: Sven Peter <sven@kernel.org>
2026-07-19arm64: dts: apple: t8112: Add common SMC hwmon sensorsJames Calligeros
Add the SMC hwmon sensors common to all SoCs Signed-off-by: James Calligeros <jcalligeros99@gmail.com> Link: https://patch.msgid.link/20260714-smc-subdev-dt-v2-7-13fa78873121@gmail.com Signed-off-by: Sven Peter <sven@kernel.org>
2026-07-19arm64: dts: apple: t8103: Add common SMC hwmon sensorsJames Calligeros
Add the SMC hwmon sensors common to all SoCs Signed-off-by: James Calligeros <jcalligeros99@gmail.com> Link: https://patch.msgid.link/20260714-smc-subdev-dt-v2-6-13fa78873121@gmail.com Signed-off-by: Sven Peter <sven@kernel.org>
2026-07-19arm64: dts: apple: Add common SMC hwmon infrastructureJames Calligeros
Apple's System Management Controller exposes the readings from numerous sensors scattered around the SoC and elsewhere in the machine. Some of these sensors are reliably common on all devices, whereas others are exposed at SMC keys specific to either the SoC or even the particular device. To account for this and expose the right sensors for the right device without tedious Devicetree duplication, we can include fragments of increasing specificity in the per-device .dts files such that the individual keys (of which there are potentially hundreds) do not need to be copied in for every device. Add the initial set of SMC hwmon sensors that are common to multiple devices so that they can be included in the per-device Devicetrees. Co-developed-by: Janne Grunau <j@jannau.net> Signed-off-by: Janne Grunau <j@jannau.net> Signed-off-by: James Calligeros <jcalligeros99@gmail.com> Link: https://patch.msgid.link/20260714-smc-subdev-dt-v2-5-13fa78873121@gmail.com Signed-off-by: Sven Peter <sven@kernel.org>
2026-07-19arm64: dts: apple: t602x: Add SMC hwmon nodeJames Calligeros
Add the SMC hwmon subdevice Signed-off-by: James Calligeros <jcalligeros99@gmail.com> Link: https://patch.msgid.link/20260714-smc-subdev-dt-v2-4-13fa78873121@gmail.com Signed-off-by: Sven Peter <sven@kernel.org>
2026-07-19arm64: dts: apple: t600x: Add SMC hwmon nodeJames Calligeros
Add the SMC hwmon subdevice Signed-off-by: James Calligeros <jcalligeros99@gmail.com> Link: https://patch.msgid.link/20260714-smc-subdev-dt-v2-3-13fa78873121@gmail.com Signed-off-by: Sven Peter <sven@kernel.org>
2026-07-19arm64: dts: apple: t8103: Add SMC hwmon nodeJames Calligeros
Add the SMC hwmon subdevice Signed-off-by: James Calligeros <jcalligeros99@gmail.com> Link: https://patch.msgid.link/20260714-smc-subdev-dt-v2-2-13fa78873121@gmail.com Signed-off-by: Sven Peter <sven@kernel.org>
2026-07-19arm64: dts: apple: t8112: Add SMC hwmon nodeJames Calligeros
Add the SMC hwmon subdevice Signed-off-by: James Calligeros <jcalligeros99@gmail.com> Link: https://patch.msgid.link/20260714-smc-subdev-dt-v2-1-13fa78873121@gmail.com Signed-off-by: Sven Peter <sven@kernel.org>
2026-07-19gfs2: Remove the glock lru list and shrinkerAndreas Gruenbacher
We are no longer keeping unreferences glocks around, so remove the now-obsolete glock lru list and shrinker. Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
2026-07-19gfs2: Skip dlm unlocks earlierAndreas Gruenbacher
When we were still caching unreferenced glocks, evicting all the cached inodes in gfs2_kill_sb() did put the unreferenced glocks onto the glock lru list, and they would be freed in gfs2_gl_hash_clear(). We could set the SDF_SKIP_DLM_UNLOCK flag in gfs2_gl_hash_clear() to indicate to gdlm_put_lock() to skip unlocking glocks explicitly when possible. Now, glocks are demoted and dropped immediately though, so to allow gdlm_put_lock() to skip unnecessary unlocking, we need to set some "unmount" flag before calling gfs2_evict_inodes(). We can use the existing SDF_KILL flag for that if we set it before calling gfs2_evict_inodes() in gfs2_kill_sb(). Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
2026-07-19gfs2: Don't cache unreferenced glocksAndreas Gruenbacher
Currently, gfs2 caches unreferenced glocks until memory pressure sets in or the filesystem is unmounted. This was supposedly done to avoid excessive log flushing: when a glock still has outstanding revokes, freeing it requires an extra log flush, and we want to avoid too many of those extra log flushes. Since commit 9287c6452d2b1 ("gfs2: Fix occasional glock use-after-free"), outstanding revokes are accounted for in the glock reference count and glocks with outstanding revokes will never be freed anymore, so this is no longer an issue. This also means that we won't need a glock LRU list anymore, but we leave removing that list to a later patch for better readability. It might seem that glocks that are not referenced anymore can be dropped immediately without unlocking them first, but that isn't true for inode glocks that have an address space attached (the "gfs2_glock(aspace)" slab cache): that address space is only truncated when the associated glock is unlocked. So unlock those glocks when they become unreferenced. Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
2026-07-19gfs2: Enable automatic glock hash table shrinkingAndreas Gruenbacher
All of the examiner functions passed to glock_hash_walk() can deal with glock hash table resizes and the resulting repeat visiting of glocks, so we can allow automatic glock hash table shrinking. Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
2026-07-19alpha: enable lockdep hardirq state trackingMagnus Lindholm
Alpha masks interrupts through the PAL IPL state, so lockdep cannot infer hardirq state transitions from generic code alone. Add explicit hardirq on/off annotations to the low-level entry and return paths so lockdep's IRQ state follows the hardware IPL state. Annotate the PAL IPL transitions and the shared return-to-user/kernel paths where interrupts become enabled or disabled. With the preceding irqflags, raw-lock, sysfs, and ftrace return-address preparations in place, select LOCKDEP_SUPPORT and TRACE_IRQFLAGS_SUPPORT for Alpha. This keeps CONFIG_PROVE_LOCKING usable on Alpha instead of disabling debug_locks due to IRQ-state mismatches. Reviewed-by: Matt Turner <mattst88@gmail.com> Tested-by: Matt Turner <mattst88@gmail.com> Signed-off-by: Magnus Lindholm <linmag7@gmail.com> Link: https://lore.kernel.org/r/20260706170019.2941459-7-linmag7@gmail.com Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
2026-07-19alpha: use raw spinlocks for low-level platform locksMagnus Lindholm
Some Alpha platform locks are used as low-level hardware serialization locks in interrupt-controller and chipset access paths. These paths can run while IRQ state is being changed or while lockdep is tracking that state, so regular spinlock instrumentation is not appropriate once lockdep is enabled. Convert the affected Tsunami and Rawhide platform locks to raw_spinlock_t. This keeps the locks as simple hardware serialization locks and avoids lockdep recursion or IRQ-state mismatches when CONFIG_PROVE_LOCKING is enabled. This is a preparatory change for enabling lockdep hardirq state tracking on Alpha. Reviewed-by: Matt Turner <mattst88@gmail.com> Tested-by: Matt Turner <mattst88@gmail.com> Signed-off-by: Magnus Lindholm <linmag7@gmail.com> Link: https://lore.kernel.org/r/20260706170019.2941459-6-linmag7@gmail.com Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
2026-07-19alpha: provide ftrace return address support for lockdepMagnus Lindholm
Lockdep uses ftrace_return_address() to report useful call sites for lock acquisition and IRQ-state tracking diagnostics. Provide the Alpha architecture hook using the compiler return-address builtin when frame pointers are available. Return zero when frame pointers are disabled, matching the existing fallback behavior of architectures that cannot provide a reliable return address. This is a preparatory change for enabling lockdep support on Alpha. Reviewed-by: Matt Turner <mattst88@gmail.com> Tested-by: Matt Turner <mattst88@gmail.com> Signed-off-by: Magnus Lindholm <linmag7@gmail.com> Link: https://lore.kernel.org/r/20260706170019.2941459-5-linmag7@gmail.com Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
2026-07-19alpha: make irqflags helpers operate on IPL stateMagnus Lindholm
Alpha interrupt masking is controlled by the PAL IPL value, not by the full processor status word. Make arch_local_save_flags() return the current IPL directly, and make arch_local_irq_restore() and arch_irqs_disabled_flags() treat their argument as IPL state. Mask the low IPL bits in the restore and test helpers so callers which still pass a saved PS value continue to behave as expected. This prepares the irqflags helpers for lockdep IRQ-state tracking, where the saved flags value is used to determine whether hard IRQs are enabled or disabled. Reviewed-by: Matt Turner <mattst88@gmail.com> Tested-by: Matt Turner <mattst88@gmail.com> Signed-off-by: Magnus Lindholm <linmag7@gmail.com> Link: https://lore.kernel.org/r/20260706170019.2941459-4-linmag7@gmail.com Signed-off-by: Magnus Lindholm <linmag7@gmail.com>