summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-07-24pinctrl: npcm8xx: move GPIO IRQ setup into request_resourcesTomer Maimon
npcmgpio_irq_startup() calls pinctrl_gpio_direction_input(), which may sleep while taking the pinctrl core mutex. That makes IRQ startup trip lockdep when CONFIG_PROVE_LOCKING is enabled. Move the direction change into irq_request_resources() and keep startup limited to the ack and unmask operations that are safe in atomic context. Signed-off-by: Tomer Maimon <tmaimon77@gmail.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-07-24pinctrl: npcm8xx: rename GPIO7 IOX2 signal to DOTomer Maimon
The pin description for GPIO7 spells the IOX2 output signal as D0. The datasheet names that signal IOX2_DO, matching the rest of the IOX naming scheme. Rename the pin description accordingly. Signed-off-by: Tomer Maimon <tmaimon77@gmail.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-07-24pinctrl: npcm8xx: clear pending GPIO events during initTomer Maimon
A bank may retain pending event status across resets of the GPIO block. If probe leaves the old state in place, the chained IRQ handler can see spurious events as soon as the irqchip is registered. Disable event generation and clear EVST before wiring each GPIO bank into gpiolib so the driver starts from a known state. Signed-off-by: Tomer Maimon <tmaimon77@gmail.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-07-24pinctrl: npcm8xx: support RG2 drive strength selectionTomer Maimon
RG2 pins 110-113 and 208-209 do not use the per-bank ODSC bit that the driver relies on for the rest of the drive-strength handling. Their strength is encoded in GCR_DSCNT[7:6] and supports four values: 8, 12, 16 and 24mA. Mark those pins as a dedicated drive-strength class and translate the pinconf get/set operations to the shared GCR_DSCNT field so the full hardware range becomes available. Signed-off-by: Tomer Maimon <tmaimon77@gmail.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-07-24pinctrl: npcm8xx: enable RMII outputs from RMII groupsTomer Maimon
NPCM8xx uses GCR_INTCR4 bits to release the R1, R2 and RMII3 transmit outputs from Hi-Z. Those bits need to follow the mandatory r1, r2 and rmii3 pin groups. The R1_OEn, R2_OEn and R3_OEn side groups are optional and should not be required just to enable RMII transmit outputs. Program the INTCR4 bits when the corresponding RMII groups are selected and clear them again when those pins switch back to GPIO or another shared function. Signed-off-by: Tomer Maimon <tmaimon77@gmail.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-07-24pinctrl: npcm8xx: drop RTS/CTS pins from bmcuart1Tomer Maimon
The bmcuart1 group currently claims BU1_RTS and BU1_CTS in addition to TXD and RXD. That prevents boards from using the modem-control pins independently through the dedicated nbu1crts function. Limit bmcuart1 to the TXD/RXD pair and let users opt into BU1_RTS and BU1_CTS explicitly through the nbu1crts group when those signals are needed. Signed-off-by: Tomer Maimon <tmaimon77@gmail.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-07-24Merge branch 'selftests-bpf-fix-several-issues-in-test_progs-c'Kumar Kartikeya Dwivedi
Feng Yang says: ==================== selftests/bpf: Fix several issues in test_progs.c From: Feng Yang <yangfeng@kylinos.cn> Fix several issues in test_progs.c v3: Add fix incorrect error checking for pthread_create patch Memory allocation null checks for the worker logic are relatively complex; remove them for now and submit them separately in a follow-up patch. v2: Fix several issues raised by sashiko-bot https://lore.kernel.org/all/20260722074748.674080-1-yangfeng59949@163.com/ v1: https://lore.kernel.org/all/20260721094404.593127-1-yangfeng59949@163.com/ ==================== Link: https://patch.msgid.link/20260723085100.482147-1-yangfeng59949@163.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-24selftests/bpf: Fix memory leak on subtest_states reallocationFeng Yang
Fix memory leak in subtest_states reallocation, and revert subtest_num if allocation fails. Fixes: 0925225956bb ("bpf/selftests: Add granular subtest output for prog_test") Signed-off-by: Feng Yang <yangfeng@kylinos.cn> Link: https://lore.kernel.org/bpf/20260723085100.482147-6-yangfeng59949@163.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-24selftests/bpf: Use calloc to allocate subtest_statesFeng Yang
An early return triggered by read_prog_test_msg leaves uninitialized elements, which leads to memory corruption during free_test_states cleanup. Signed-off-by: Feng Yang <yangfeng@kylinos.cn> Link: https://lore.kernel.org/bpf/20260723085100.482147-5-yangfeng59949@163.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-24selftests/bpf: Fix missing allocation null checks in test_progs.cFeng Yang
Add null checks after memory allocations to prevent potential segmentation faults. Fixes: 79b453501310 ("tools/bpf: add a test for bpf_get_stack with tracepoint prog") Fixes: 0925225956bb ("bpf/selftests: Add granular subtest output for prog_test") Signed-off-by: Feng Yang <yangfeng@kylinos.cn> Link: https://lore.kernel.org/bpf/20260723085100.482147-4-yangfeng59949@163.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-24selftests/bpf: Fix incorrect error checking for pthread_createFeng Yang
pthread_create returns 0 on success and a positive error code on failure; it never returns a negative value. The current conditional branch can never be taken. Failures during thread creation are silently ignored, which will lead to invalid memory access when waiting on threads or dereferencing thread handles later. Fixes: 91b2c0afd00c ("selftests/bpf: Add parallelism to test_progs") Signed-off-by: Feng Yang <yangfeng@kylinos.cn> Link: https://lore.kernel.org/bpf/20260723085100.482147-3-yangfeng59949@163.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-24selftests/bpf: Fix extra free of subtest_state->nameFeng Yang
The name has already been freed in the free_subtest_state function and does not need to be freed again. The extra free is noop since the pointer was already set to NULL. Signed-off-by: Feng Yang <yangfeng@kylinos.cn> Link: https://lore.kernel.org/bpf/20260723085100.482147-2-yangfeng59949@163.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-24Merge tag 'drm-fixes-2026-07-25' of https://gitlab.freedesktop.org/drm/kernelLinus Torvalds
Pull drm fixes from Dave Airlie: "Weekly drm pull request, small and scattered seems to be the new normal, the ttm change is probably the largest, with xe being the most. Alex was out this week so amdgpu is smaller and only has some urgent fixes. MAINTAINERS: - update mailmap address ttm: - backup pages using correct order gpusvm: - fix mm leak on eviction - properly zero page array in mm scanning tests: - fix dma mask errors in tests panel: - fix dependency issues - ilitek-ili9881c - fix probing i915: - Remove DP_EDP_BACKLIGHT_AUX_ENABLE_CAP check for DPCD backlight xe: - Skip invalidation for purgeable state updates - Add drm_dev guards when detaching CCS read / write buffers - Alloc per domain unique i2c id - Fix SVM leak on resv obj alloc failure in xe_vm_create amdgpu: - Fix a backport mistake for dm_gpureset_toggle_interrupts() - Fix a failure on flip-done timeouts for mode1 reset appletbdrm: - fix issue in damage handling amdxdna: - fix command timeout race imagination: - fix gpu vm locking vc4: - prevent trusted bo from being mapped again - prevent timer rearm on shutdown v3d: - fix NULL deref in unbind - idle AXI before clock disable on suspend - use proper GMP access for newer hw vmwgfx: - validate shader array size ethosu: - fix length calculations - handle internal chaining buffers gma500: - return errors from HDMI i2c reads" * tag 'drm-fixes-2026-07-25' of https://gitlab.freedesktop.org/drm/kernel: (31 commits) drm/amd/display: Fix missing DCE check in dm_gpureset_toggle_interrupts() drm/amd/display: Fix flip-done timeouts on mode1 reset Revert "drm/pagemap: Guard HPAGE_PMD_ORDER use with CONFIG_ARCH_ENABLE_THP_MIGRATION" drm/vc4: Shut down BO cache timer before teardown drm/tests: shmem: Set DMA mask to 64-bit in drm_gem_shmem drm/xe/vm: Fix SVM leak on resv obj alloc failure in xe_vm_create() drm/xe/i2c: Allow per domain unique id drm/gma500: return errors from Oaktrail HDMI I2C reads drm/vc4: hvs/v3d: Fix null dereference in unbind drm/panel: fix unmet dependency bug for DRM_PANEL_HIMAX_HX83121A drm/panel: s6e3ha8: fix unmet dependency on DRM_DISPLAY_HELPER drm/panel: ilitek-ili9882t: fix unmet dependency for DRM_PANEL_ILITEK_ILI9882T drm/panel: ilitek-ili9881c: do not fail probe if iovcc is absent drm/v3d: Idle AXI transactions before disabling the clock on suspend drm/v3d: Reach the GMP through the hub registers on V3D 7.x mailmap: Update Maíra Canal's email address drm/pagemap: Guard HPAGE_PMD_ORDER use with CONFIG_ARCH_ENABLE_THP_MIGRATION drm/pagemap: Clear driver-provided PFNs from migration PFN array drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers accel: ethosu: Handle U85 internal chaining buffer ...
2026-07-24drm/xe/eustall: Add WA 14027054324 support for graphics IP 35.11Harish Chegondi
WA 14027054324 is implemented in the firmware and is applied before EU stall sampling and reverted after EU stall sampling. The driver needs to notify the firmware whenever EU stall sampling is being enabled/disabled so that the firmware takes the necessary action. The driver uses a scratch pad register to communicate with the firmware. Before enabling EU stall sampling, write 0x20 to the SWF scratch pad register to request the firmware to apply the workaround. The firmware applies the workaround and sets the scratch pad register to 0x60 as an ACK. Before disabling EU stall sampling, write 0x40 to the SWF scratch pad register to request the firmware to revert the workaround. The firmware reverts the workaround and sets the scratch pad register to 0 as an ACK. The firmware is expected to take about 1 ms to apply/revert the workaround. 10 ms timeout is used in the driver while waiting for an ack from the firmware to have adequate grace period. Bspec update for the SWF scratch pad register is still pending, but has been confirmed offline with the firmware team. Bspec: 53188 Signed-off-by: Harish Chegondi <harish.chegondi@intel.com> Reviewed-by: Matt Roper <matthew.d.roper@intel.com> Link: https://patch.msgid.link/16b6b972691943daddebad6e7b93b9d73add5249.1784745545.git.harish.chegondi@intel.com Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
2026-07-24Merge branch 's390-bpf-support-load-acquire-and-store-release-instructions'Kumar Kartikeya Dwivedi
Maxim Khmelevskii says: ==================== s390/bpf: Support load-acquire and store-release instructions Support load-acquire (BPF_LOAD_ACQ) and store-release (BPF_STORE_REL) instructions. Since s390 has strong memory model, implement them as regular BPF_LDX/BPF_STX instructions. ==================== Link: https://patch.msgid.link/20260723140648.583055-5-max@linux.ibm.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-24s390/bpf: Enable atomics tests for s390Maxim Khmelevskii
Add s390 to the if statement, that defines CAN_USE_LOAD_ACQ_STORE_REL. Reuse CAN_USE_LOAD_ACQ_STORE_REL in arena_atomics selftest, to remove code duplication. Signed-off-by: Maxim Khmelevskii <max@linux.ibm.com> Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com> Link: https://lore.kernel.org/bpf/20260723140648.583055-8-max@linux.ibm.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-24s390/bpf: Support load-acquire and store-release instructionsMaxim Khmelevskii
Support load-acquire (BPF_LOAD_ACQ) and store-release (BPF_STORE_REL) instructions. Since s390 has strong memory model, implement them as regular BPF_LDX/BPF_STX instructions. Tested with: ./test_progs -t verifier_load_acquire,verifier_store_release,atomics Signed-off-by: Maxim Khmelevskii <max@linux.ibm.com> Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com> Link: https://lore.kernel.org/bpf/20260723140648.583055-7-max@linux.ibm.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-24s390/bpf: Add emit_ldx and emit_stx functionsMaxim Khmelevskii
Add new functions for load and store to reuse them in the load-acquire and store-release logic. Signed-off-by: Maxim Khmelevskii <max@linux.ibm.com> Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com> Link: https://lore.kernel.org/bpf/20260723140648.583055-6-max@linux.ibm.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-24selftests/bpf: Add get_preempt_count() support for RISC-VTiezhu Yang
Currently, there is no RISC-V support for get_preempt_count() and its fallback path always returns 0. Add it so that bpf_in_interrupt(), bpf_in_nmi(), bpf_in_hardirq(), bpf_in_serving_softirq(), and bpf_in_task() work for RISC-V as well. Given that RISC-V has supported CONFIG_THREAD_INFO_IN_TASK since its initial commit fbe934d69eb7 ("RISC-V: Build Infrastructure") in 2017, directly retrieve preempt_count from the thread_info embedded within task_struct via bpf_get_current_task_btf(). This aligns the implementation with arm64, powerpc, and loongarch. Tested on a RISC-V virtual machine. Before: $ sudo ./test_progs -t exe_ctx ... #114 exe_ctx:FAIL Summary: 0/0 PASSED, 0 SKIPPED, 1 FAILED After: $ sudo ./test_progs -t exe_ctx #114 exe_ctx:OK Summary: 1/0 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn> Tested-by: Pu Lehui <pulehui@huawei.com> Reviewed-by: Pu Lehui <pulehui@huawei.com> Link: https://lore.kernel.org/bpf/20260722022906.8778-1-yangtiezhu@loongson.cn Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-24ARM: dts: ls1021a-iot: rename display@0 to display0Frank Li
Rename node name display@0 to display0 since no reg under it. Rename mode0 to timing0. Fix below CHECK_DTBS warnings: arch/arm/boot/dts/nxp/ls/ls1021a-iot.dtb: dcu@2ce0000 (fsl,ls1021a-dcu): 'display', 'display@0' do not match any of the regexes: '^pinctrl-[0-9]+$' from schema $id: http://devicetree.org/schemas/display/fsl,ls1021a-dcu.yaml arch/arm/boot/dts/nxp/ls/ls1021a-iot.dtb: display-timings: 'mode0' does not match any of the regexes: '^pinctrl-[0-9]+$', '^timing' from schema $id: http://devicetree.org/schemas/display/panel/display-timings.yaml Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-07-24dt-bindings: display: imx: Add deprecated property display and display0Frank Li
Add deprecated property display and display0 to allow old platform lx1021a (>10 years) to put display timing under dcu node. Following patch rename display@0 to display0 and mode0 to timing0. Fix below CHECK_DTBS warnings: arch/arm/boot/dts/nxp/ls/ls1021a-iot.dtb: dcu@2ce0000 (fsl,ls1021a-dcu): 'display', 'display@0' do not match any of the regexes: '^pinctrl-[0-9]+$' from schema $id: http://devicetree.org/schemas/display/fsl,ls1021a-dcu.yaml Acked-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-07-24MAINTAINERS: ARM/FREESCALE: merge Layerscape entry into i.MX entryFrank Li
Both platforms are maintained by the same people, and the two entries contain largely identical information. Maintaining separate entries adds unnecessary duplication. Additionally, the standalone Layerscape entry does not include the imx@lists.linux.dev mailing list, causing Layerscape patches to miss NXP's Patchwork instance. Consolidating the entries ensures patches for both platforms are routed consistently and reduces future maintenance overhead. Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-07-24Merge branch 'bpf-fix-warning-in-bpf_tracing_link_release'Kumar Kartikeya Dwivedi
Leon Hwang says: ==================== bpf: Fix WARNING in bpf_tracing_link_release The trampoline could be corrupted by the blindly 'tr->flags = BPF_TRAMP_F_TAIL_CALL_CTX' in verifier. 1. A fexit attached to a tail_call_reachable prog. 'tr->flags' became 'BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_TAIL_CALL_CTX'. And, the trampoline would poke the target prog's nop insn using jmp insn instead of call insn. 2. Another fexit loaded with the same tail_call_reachable prog target. 'tr->flags' became 'BPF_TRAMP_F_TAIL_CALL_CTX'. 3. Close the first fexit link. Due to no BPF_TRAMP_F_CALL_ORIG in 'tr->flags', the trampoline will fail to restore the prog's nop insn using call insn. [ 3.410719] WARNING: kernel/bpf/syscall.c:3551 at bpf_tracing_link_release+0x53/0x60, CPU#1: test_progs/98 ... [ 3.428793] bpf_link_free+0x58/0x130 [ 3.429293] bpf_link_release+0x23/0x30 Fix the warning by updating 'tr->flags' with '|=' and lock. Changes: v1 -> v2: * Update the patch #1 message with 'tr->flags' change. (per Jiri) * Drop the 'link' and the last 'if' in patch #2. (per Jiri) * v1: https://lore.kernel.org/bpf/20260721133036.49265-1-leon.hwang@linux.dev/ ==================== Link: https://patch.msgid.link/20260722151909.69142-1-leon.hwang@linux.dev Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-24selftests/bpf: Verify no warning when close fexit linkLeon Hwang
Add a test to verify that there's no WARNING when detaching fexit link by following the repro steps of previous commit. Without the fix, the WARNING could be triggered by this test. Signed-off-by: Leon Hwang <leon.hwang@linux.dev> Reviewed-by: Pu Lehui <pulehui@huawei.com> Acked-by: Jiri Olsa <jolsa@kernel.org> Link: https://lore.kernel.org/bpf/20260722151909.69142-3-leon.hwang@linux.dev Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-24bpf: Fix WARNING in bpf_tracing_link_releaseLeon Hwang
The trampoline could be corrupted by the blindly 'tr->flags = BPF_TRAMP_F_TAIL_CALL_CTX' in verifier. 1. A fexit attached to a tail_call_reachable prog. 'tr->flags' became 'BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_TAIL_CALL_CTX'. And, the trampoline would poke the target prog's nop insn using jmp insn instead of call insn. 2. Another fexit loaded with the same tail_call_reachable prog target. 'tr->flags' became 'BPF_TRAMP_F_TAIL_CALL_CTX'. 3. Close the first fexit link. Due to no BPF_TRAMP_F_CALL_ORIG in 'tr->flags', the trampoline will fail to restore the prog's nop insn using call insn. [ 3.410719] WARNING: kernel/bpf/syscall.c:3551 at bpf_tracing_link_release+0x53/0x60, CPU#1: test_progs/98 ... [ 3.428793] bpf_link_free+0x58/0x130 [ 3.429293] bpf_link_release+0x23/0x30 Fix the warning by updating 'tr->flags' with '|=' and lock. Fixes: 2b5dcb31a19a ("bpf, x64: Fix tailcall infinite loop") Signed-off-by: Leon Hwang <leon.hwang@linux.dev> Reviewed-by: Pu Lehui <pulehui@huawei.com> Acked-by: Jiri Olsa <jolsa@kernel.org> Link: https://lore.kernel.org/bpf/20260722151909.69142-2-leon.hwang@linux.dev Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-24ARM: lpc32xx: remove a few manually populated OF devicesVladimir Zapolskiy
For a good while the common for all NXP LPC32xx platforms lpc32xx.dtsi file contains proper descriptions of DMA, SLC and MLC NAND controllers, this allows to remove populated device tree nodes from platform code. At the end of the last year it was announced that this change to happen, unlikely there are still users with such old dtbs to be affected by this change, but if there are such users, they should update board dtb file, if DMA or NAND controller decriptions are not found in them. Signed-off-by: Vladimir Zapolskiy <vz@kernel.org> Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
2026-07-24ARM: lpc32xx: only run SoC init on LPC32xx hardwareKarl Mehltretter
lpc32xx_check_uid() and lpc32xx_pm_init() are arch_initcalls that poke LPC32xx-only registers. Since the multiplatform conversion they also run on other ARCH_MULTI_V5 boards where access faults e.g. on versatile: Unable to handle kernel paging request at virtual address f4004130 PC is at lpc32xx_check_uid+0x2c/0x9c Drop the arch_initcall() registrations and call both functions directly from lpc3250_machine_init(), the machine's .init_machine hook. The calls are placed in link order (common.c, pm.c, phy3250.c) to keep their previous relative ordering. Fixes: 75bf1bd7d2f9 ("ARM: lpc32xx: allow multiplatform build") Suggested-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Reviewed-by: Vladimir Zapolskiy <vz@kernel.org> Reviewed-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
2026-07-24firmware: imx: scu: manage mailbox channels and global handlePengpeng Hou
imx_scu_probe() requests mailbox channels with the non-managed mbox_request_channel_byname() helper and then publishes sc_ipc through the global imx_sc_ipc_handle. Later probe failures, including child population failure, can leave the channels and global handle live after the probe has failed. Register devres actions to free each mailbox channel and clear the global handle. Also depopulate partially created child devices when devm_of_platform_populate() reports an error. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-07-24bpf: Fix CFI mismatch in task work callbackMykyta Yatsenko
BPF subprograms use the bpf_callback_t ABI, but task work invokes the callback through a three-argument function pointer. This trips kCFI. Store and invoke the callback as bpf_callback_t. Fixes: 38aa7003e369 ("bpf: task work scheduling kfuncs") Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com> Link: https://lore.kernel.org/bpf/20260724-task_work_cfi-v1-1-2616691781ed@meta.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-24Merge tag 'ceph-for-7.2-rc5' of https://github.com/ceph/ceph-clientLinus Torvalds
Pull ceph fixes from Ilya Dryomov: "A bunch of assorted fixes with the majority being hardening against malformed input and invalid data scenarios that don't happen in real deployments but can be utilized to trigger use-after-free and similar issues, some error path leak fixups and two patches from Max to avoid a potential hang in __ceph_get_caps() and unintended nesting of current->journal_info while handling replies from the MDS. All marked for stable" * tag 'ceph-for-7.2-rc5' of https://github.com/ceph/ceph-client: ceph: avoid fs reclaim while using current->journal_info ceph: add owner/capability checks for CEPH_IOC_SET_LAYOUT* ceph: fix hanging __ceph_get_caps() with stale mds_wanted rbd: Reset positive result codes to zero in object map update path libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE libceph: refresh auth->authorizer_buf{,_len} after authorizer update ceph: fix refcount leak in ceph_readdir() libceph: guard missing CRUSH type name lookup libceph: remove debugfs files before client teardown libceph: bound get_version reply decode to front len ceph: fix writeback_count leak in write_folio_nounlock() libceph: fix two unsafe bare decodes in decode_lockers() ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() libceph: Reject monmaps advertising zero monitors libceph: reject zero bucket types in crush_decode libceph: Fix multiplication overflow in decode_new_up_state_weight()
2026-07-24Merge branch 'bpf-riscv-add-timed-may_goto-support'Kumar Kartikeya Dwivedi
Feng Jiang says: ==================== bpf, riscv: add timed may_goto support This series adds RISC-V JIT support for the timed may_goto loop bound. Patch 1 implements arch_bpf_timed_may_goto() and enables bpf_jit_supports_timed_may_goto() so the verifier uses the timed expansion path. Patch 2 adds a test that checks R0-R5 are preserved across arch_bpf_timed_may_goto() calls. Patch 3 enables the verifier_may_goto_1, stream_cond_break, and may_goto_interaction fastcall tests on riscv64. Tested on riscv64 QEMU (rva23s64): may_goto programs load and JIT correctly, and the 250ms timeout path works as expected. Signed-off-by: Feng Jiang <jiangfeng@kylinos.cn> Tested-by: Pu Lehui <pulehui@huawei.com> Reviewed-by: Björn Töpel <bjorn@kernel.org> Acked-by: Björn Töpel <bjorn@kernel.org> --- Changes in v5: - Use REG_S/REG_L/SZREG in arch_bpf_timed_may_goto assembly. (Pu Lehui) - Add __arch_s390x to the timed_may_goto_preserves_regs test. (Pu Lehui) - Switch the preserves-regs test to SEC("syscall") to fix bpf_prog_test_run() EINVAL. - Link to v4: https://lore.kernel.org/r/20260722-riscv-bpf-timed-may-goto-v4-0-e117e6337bc7@kylinos.cn Changes in v4: - Add 'bpf-next' prefix to match the BPF kernel tree workflow. - Add a test checking that R0-R5 are preserved across arch_bpf_timed_may_goto() calls. Use bpf_get_prandom_u32() to prevent the verifier from removing the checks via DCE. - Rename may_goto_interaction_arm64() to may_goto_interaction(). - Wrap the arch_bpf_timed_may_goto address check to a single line. - Link to v3: https://lore.kernel.org/r/20260715-riscv-bpf-timed-may-goto-v3-0-cf2a9c3d843f@kylinos.cn Changes in v3: - Set up the frame pointer in arch_bpf_timed_may_goto() so the function does not break stack unwinding under CONFIG_FRAME_POINTER. Changes in v2: - Fix BPF_REG_0 being clobbered after arch_bpf_timed_may_goto() calls. - Enable the may_goto_interaction fastcall test on riscv64. --- ==================== Link: https://patch.msgid.link/20260723-riscv-bpf-timed-may-goto-v5-0-86acb54e5642@kylinos.cn Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-24selftests/bpf: Enable timed may_goto tests for riscv64Feng Jiang
Enable verifier_may_goto_1 (raw instruction tests), stream_cond_break (250ms timeout path), and the may_goto_interaction fastcall test on riscv64 now that the JIT supports timed may_goto. Signed-off-by: Feng Jiang <jiangfeng@kylinos.cn> Reviewed-by: Pu Lehui <pulehui@huawei.com> Reviewed-by: Björn Töpel <bjorn@kernel.org> Acked-by: Björn Töpel <bjorn@kernel.org> Link: https://lore.kernel.org/bpf/20260723-riscv-bpf-timed-may-goto-v5-3-86acb54e5642@kylinos.cn Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-24selftests/bpf: Test timed may_goto preserves R0-R5Feng Jiang
Add a test that checks R0-R5 are preserved across arch_bpf_timed_may_goto() calls. Use bpf_get_prandom_u32() to avoid the verifier removing the checks via DCE. Suggested-by: Björn Töpel <bjorn@kernel.org> Signed-off-by: Feng Jiang <jiangfeng@kylinos.cn> Reviewed-by: Pu Lehui <pulehui@huawei.com> Reviewed-by: Björn Töpel <bjorn@kernel.org> Acked-by: Björn Töpel <bjorn@kernel.org> Link: https://lore.kernel.org/bpf/20260723-riscv-bpf-timed-may-goto-v5-2-86acb54e5642@kylinos.cn Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-24bpf, riscv: Add support for timed may_gotoFeng Jiang
Implement arch_bpf_timed_may_goto() for the RV64 JIT. The argument and return value are carried in BPF_REG_AX, and BPF R0-R5 are preserved across the call to the generic bpf_check_timed_may_goto(). Enable bpf_jit_supports_timed_may_goto() so the verifier uses the timed expansion path. Signed-off-by: Feng Jiang <jiangfeng@kylinos.cn> Reviewed-by: Pu Lehui <pulehui@huawei.com> Reviewed-by: Björn Töpel <bjorn@kernel.org> Acked-by: Björn Töpel <bjorn@kernel.org> Link: https://lore.kernel.org/bpf/20260723-riscv-bpf-timed-may-goto-v5-1-86acb54e5642@kylinos.cn Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-24Merge branch 'for-7.3/cxl-fixes' into cxl-for-nextDave Jiang
Various CXL fixes cxl/features: Clamp Get Feature output size to the remaining buffer cxl/features: Reject Set Features output buffer smaller than the header cxl/features: Reject Get Feature count larger than the output buffer cxl/port: Restart port enumeration when a sibling adds the dport first cxl/features: Serialize multi-part Get/Set Feature transfers cxl/pci: Honor -EPROBE_DEFER from component register setup cxl/mbox: Break poison list loop on an empty payload cxl/memdev: Fix firmware upload exact-fit handling cxl/features: bound fwctl command payload to the input buffer cxl/mce: Make the MCE notifier per-region cxl/pci: Remove incorrect mbox.valid check in cxl_pci_type3_init_mailbox() cxl: docs/linux/dax-driver - fix typos cxl: fix mailbox return code description typo cxl/mbox: Clamp mailbox output allocation to the payload size
2026-07-24KVM: SVM: Always intercept ICEBP to workaround AMD ICEBP+TASK_SWITCH flawsDavid Woodhouse
Unconditionally intercept and emulate ICEBP, i.e. INT1 #DBs, on SVM to workaround a bug/misfeature in current AMD CPUs. AMD CPUs don't provide information to allow software to distinguish instruction-induced #DBs (i.e. ICEBP) from exception-induced #DBs (all others), and also don't report an instruction length for an ICEBP-induced TASK_SWITCH. On an intercepted TASK_SWITCH (which always has fault semantics), KVM (any hypervisor, really) looks at the vectoring event type to decide whether it was logically caused by a trap, and therefore whether to advance guest RIP before entering the new task. If the guest IDT is configured to deliver #DBs via a task gate, then the guest will see broken behavior for ICEBP #DB because KVM doesn't have enough information to detect and skip the ICEBP. The typical workaround is to intercept ICEBP unconditionally and handle the FAULT=>TRAP conversion in the hypervisor, at which point the #DB-induced TASK_SWITCH occurs with RIP on the correct instruction boundary regardless of whether it was instruction-induced or exception-induced. As a bonus, intercepting ICEBP more or less aligns SVM with VMX (KVM always intercepts #DBs on VMX, and ICEBP #DB VM-Exits on Intel have fault-like behavior). Signed-off-by: David Woodhouse <dwmw@amazon.co.uk> Link: https://patch.msgid.link/e03f092dfbb7d391a6bf2797ba01e122ba080bcd.camel@infradead.org [sean: drop selftest, reword changelog to provide more details] Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-25Merge tag 'drm-misc-next-2026-07-24' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/misc/kernel into drm-next drm-misc-next for v7.3: UAPI Changes: cgroup: - dmem: accept one region per limit drm: - send per-connector hotplug events Core Changes: buddy: - tests: test buffer clearence on resume panel: - implement ref counting for struct drm_panel throughout the DRM tree Driver Changes: etnaviv: - force flush on power register ops gma: - replace simple-kms helpers with regular atomic helpers - clean up host1x: - support Tegra264 plus DT bindings - fix minor issues throughout driver hypervdrm: - clean up PCI-device binding imagination: - mark BXM-4-64 MC1 (36.52.104.182) as supported - clean up ivpu: - clean up nouveau: - remove redundant call to pm_runtime_mark_last_busy() panel: - support Novatek NT36536 plus DT bindings - sofef00: fix backlight updates - osd101t2587: use mipi_dsi_*_multi interface - panel-edp: adjust timing for AUO displays - panel-lvds: support Opto Logic SCX1001511GGC49 - panel-simple: support Kyocera tcg070wvlq panfrost: - clean up solomon: - clean up variables tve200: - add OF module alias for autoloading v3d: - fix job BO handling vc4: - ref i2c-adapter module Signed-off-by: Dave Airlie <airlied@redhat.com> From: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patch.msgid.link/20260724082204.GA18774@linux.fritz.box
2026-07-24Merge tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linuxLinus Torvalds
Pull fscrypt fixes from Eric Biggers: "A couple fixes for AI-detected bugs" * tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux: fscrypt: Avoid dynamic allocation in fscrypt_get_devices() fscrypt: Add missing superblock check in find_or_insert_direct_key()
2026-07-25Merge tag 'amd-drm-fixes-v7.2-2026-07-24' of ↵Dave Airlie
git://git.kernel.org/pub/scm/linux/kernel/git/superm1/linux into drm-fixes amd-drm-fixes-v7.2-2026-07-04: - Fix a backport mistake for dm_gpureset_toggle_interrupts() - Fix a failure on flip-done timeouts for mode1 reset Signed-off-by: Dave Airlie <airlied@redhat.com> From: Mario Limonciello <superm1@kernel.org> Link: https://patch.msgid.link/5d5964a3-fb85-4a3c-9252-a43c93fe935d@kernel.org
2026-07-24arm64: dts: rockchip: Fix rk3566-bigtreetech-cb2 touchscreen propertyFabio Estevam
The TSC2007 driver uses the ti,max-rt property to specify the maximum touch resistance, but the rk3566-bigtreetech-cb2 device tree uses the undocumented ti,rt-thr property instead. As a result, the configured value is ignored and the driver falls back to its default maximum resistance value of 4095. Replace ti,rt-thr with ti,max-rt to preserve the intended resistance threshold of 3000. Fixes: bfbc663d2733 ("arm64: dts: rockchip: Add BigTreeTech CB2 and Pi2") Signed-off-by: Fabio Estevam <festevam@gmail.com> Link: https://patch.msgid.link/20260721135450.45286-1-festevam@gmail.com Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-24arm64: dts: rockchip: fix label of sys_led for nanopi-r4sVic B
This commit corrects the system LED configuration for the NanoPi R4S by replacing the deprecated label property with color and function. This changes the resulting label of mislabeled sys_led from red:power to green:status, while the labels of the other two leds stay intact (green:lan for lan_led and green:wan for wan_led). Signed-off-by: Vic B <linux@vicb.net> Link: https://patch.msgid.link/al0cKhqvPbBO_5q8@vicb.net Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-24arm64: dts: rockchip: Fix the rk3566-radxa-cm3 Wifi compatibleFabio Estevam
According to brcm,bcm4329-fmac.yaml, "brcm,bcm43455-fmac" needs the "brcm,bcm4329-fmac" fallback. Change it accordingly to fix the following dt-schema warning: ['brcm,bcm43455-fmac'] is too short Signed-off-by: Fabio Estevam <festevam@gmail.com> Link: https://patch.msgid.link/20260721133421.44258-1-festevam@gmail.com Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-24arm64: dts: rockchip: Fix Gru WLAN sideband interruptFabio Estevam
The Marvell WLAN host wake interrupt is wired to GPIO0 8 and is not one of the PCI INTx interrupts. The PCI device schema therefore interprets the two-cell GPIO interrupt specifier as an invalid PCI interrupt and reports dtbs_check warnings: pcie@0,0: wifi@0,0:interrupts:0:0: 8 is not one of [1, 2, 3, 4] pcie@0,0: wifi@0,0:interrupts:0: [8, 8] is too long Describe the sideband interrupt with interrupts-extended, which explicitly carries the interrupt controller and removes the ambiguity. Fixes: 48f4d9796d99 ("arm64: dts: rockchip: add Gru/Kevin DTS") Signed-off-by: Fabio Estevam <festevam@gmail.com> Link: https://patch.msgid.link/20260721133445.44283-1-festevam@gmail.com Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-24arm64: dts: rockchip: Add Vicharak Vaaman2 boardHrushiraj Gandhi
Add device tree for the Vicharak Vaaman2, a single-board computer based on the Rockchip RK3588 SoC. The board features: - RK3588 SoC with 4x Cortex-A76 (big) + 4x Cortex-A55 (little) - eMMC storage via SDHCI (HS400) - microSD card via SDMMC - RK806 PMIC on SPI2 providing all required power domains - Two RK8602/RK8603 CPU regulators on I2C0 (big clusters) - RK8602 NPU regulator on I2C1 - HYM8563 RTC on I2C0 - Status LED on GPIO2_C5 (active-low, heartbeat trigger) - UART2 as serial console at 1500000 baud - SARADC with 1.8V reference Signed-off-by: Hrushiraj Gandhi <hrushirajg23@gmail.com> Link: https://patch.msgid.link/20260714054653.266842-3-hrushirajg23@gmail.com Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-24dt-bindings: arm: rockchip: Add Vicharak Vaaman2Hrushiraj Gandhi
Add device tree binding documentation for the Vicharak Vaaman2, a single-board computer based on the Rockchip RK3588 SoC. Signed-off-by: Hrushiraj Gandhi <hrushirajg23@gmail.com> Acked-by: Conor Dooley <conor.dooley@microchip.com> Link: https://patch.msgid.link/20260714054653.266842-2-hrushirajg23@gmail.com Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-24arm64: dts: rockchip: add Vicharak Axon boardHrushiraj Gandhi
Add initial support for the Vicharak Axon single-board computer based on the Rockchip RK3588 SoC. The board supports: - eMMC storage - microSD card - Gigabit Ethernet - HDMI output (dual HDMI) - HDMI input - USB 2.0 host ports - PCIe 2.0 slots - PCIe 3.0 x4 slot - SATA - RTC - Status LEDs The board uses an RK806 PMIC and provides the regulators required by the RK3588 SoC. Signed-off-by: Hrushiraj Gandhi <hrushirajg23@gmail.com> Link: https://patch.msgid.link/20260714053419.265523-3-hrushirajg23@gmail.com [some sorting, dropped deprecated regulator-suspend-microvolt properties] Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-24dt-bindings: arm: rockchip: add Vicharak Axon boardHrushiraj Gandhi
Add the device tree binding for the Vicharak Axon single-board computer based on the Rockchip RK3588 SoC. Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Hrushiraj Gandhi <hrushirajg23@gmail.com> Link: https://patch.msgid.link/20260608060940.52549-2-hrushirajg23@gmail.com Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-24arm64: dts: rockchip: Add LCKFB Taishan Pi 3MLiu Changjie
Add the device tree for LCKFB Taishan Pi 3M, a board based on the Rockchip RK3576 SoC. The board schematics are available at: https://oshwhub.com/li-chuang-kai-fa-ban/project_gzzvrwqn Describe the RK806 supplies, eMMC, recovery key, RTC, SD card, Gigabit Ethernet, USB Type-A hosts, source-only USB Type-C host, mSATA, HDMI video and audio, AP6256 Wi-Fi and Bluetooth, status LED, thermal sensors, and debug UART. The MAE0621A PHY CLKOUT supplies the GMAC reference-clock input, so request its validated 125 MHz setting. The following interfaces were tested on the hardware: eMMC, RTC register access, recovery key, SD card, 1GbE, USB 2.0 Type-A storage, USB 3.0 Type-A 5 Gbit/s enumeration and 64 MiB storage I/O, USB-C source/host enumeration in both orientations, mSATA, HDMI video and audio, AP6256 2.4/5 GHz Wi-Fi scan, WPA2 association, ping and bidirectional throughput, Bluetooth firmware load and HCI bring-up, and UART0. Bluetooth active discovery was additionally exercised during bring-up. Signed-off-by: Liu Changjie <liucj1228@outlook.com> Link: https://patch.msgid.link/MN0PR19MB6091D3101FD2D8F940F0CE4DACF92@MN0PR19MB6091.namprd19.prod.outlook.com Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-24dt-bindings: arm: rockchip: Add LCKFB Taishan Pi 3MLiu Changjie
Add the compatible string for LCKFB Taishan Pi 3M, a board based on the Rockchip RK3576 SoC. Acked-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Liu Changjie <liucj1228@outlook.com> Link: https://patch.msgid.link/MN0PR19MB6091201B6DAEE197762F6468ACF92@MN0PR19MB6091.namprd19.prod.outlook.com Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-24arm64: dts: rockchip: Add Orange Pi 5 Pro board supportDennis Gilmore
Add device tree for the Xunlong Orange Pi 5 Pro (RK3588S). - eMMC module, you can optionally solder a SPI NOR in place and turn off the eMMC - PCIe-attached NIC (pcie2x1l2) - PCIe NVMe slot (pcie2x1l1) - AP6256 WiFi (BCM43456) via SDIO with mmc-pwrseq - BCM4345C5 Bluetooth - es8388 audio - USB 2.0 and USB 3.0 - HDMI output is enabled - the second HDMI port connected to the DP bridge is left out for a followup set Vendors schematics are available at: https://drive.google.com/file/d/1qs1DratHuh7C6J6MEtQIwUsiSrg8qgTi/view Signed-off-by: Dennis Gilmore <dennis@ausil.us> Reviewed-by: Alexey Charkov <alchark@gmail.com> Link: https://patch.msgid.link/20260511025352.106126-5-dennis@ausil.us Signed-off-by: Heiko Stuebner <heiko@sntech.de>
generated by cgit v1.2.3 (git 2.39.1) at 2026-08-11 13:51:55 +0000