summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-07-16ARM: replace linux/gpio.h inclusionsArnd Bergmann
linux/gpio.h should no longer be used, convert these instead to either linux/gpio/consumer.h or linux/gpio/legacy.h as needed. Reviewed-by: Linus Walleij <linusw@kernel.org> Acked-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Cc: soc@lists.linux.dev Link: https://lore.kernel.org/r/20260710211954.1373336-2-arnd@kernel.org Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-07-16dm-inlinecrypt: don't overwrite the error with -EINVALMikulas Patocka
get_key_size already returns -EINVAL on error, so we don't have to overwrite it again. No functional change. Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
2026-07-16dm: lookup_ioctl(): Use designated array initialersDavid Laight
Use designated initialisers for the _ioctls[] array and delete the unused field that contained the array index. Makes the code more robust against the order of the initialers. Any uninitialised entries would be processed corretly. Signed-off-by: David Laight <david.laight.linux@gmail.com> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
2026-07-16dm: list_devices(): Only process devices onceDavid Laight
Instead of doing a prescan to determine the length of buffer required, checking the supplied buffer is big enough, and then doing a second scan to fill the output buffer just do a single scan and detect when the buffer is too short. For additional safety only call strlen() once and use the returned length for everything (incuding the copy). Ensure than all the pad bytes between the entries are zero. Signed-off-by: David Laight <david.laight.linux@gmail.com> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
2026-07-16dm: __list_versions(): Only process targets onceDavid Laight
Instead of doing a prescan to determine the length of buffer required, checking the supplied buffer is big enough, and then doing a second scan to fill the output buffer just do a single scan and detect when the buffer is too short. This removes any problems that might occur if a 'target' is added between the scans. For additional safety only call strlen(tt->name) once and use the returned length for everything (incuding the copy). Ensure than all the pad bytes between the entries are zero. Set param->data_size to the actual size of the data. It was slightly large because ALIGN_MASK was added in instead of the size being rounded up. Signed-off-by: David Laight <david.laight.linux@gmail.com> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
2026-07-16pinctrl: qcom: milos-lpass-lpi: Add Eliza LPASS LPI TLMMRavi Hothi
Eliza SoC has the same LPASS LPI pin mux functions as Milos but the slew rate control is in the same GPIO config register rather than a separate register. Add a new variant data struct with updated slew offsets and LPI_FLAG_SLEW_RATE_SAME_REG flag, reusing the existing pin descriptors and function table from Milos. Signed-off-by: Ravi Hothi <ravi.hothi@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://patch.msgid.link/20260715132150.1322663-3-ravi.hothi@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-07-16dt-bindings: pinctrl: qcom,milos-lpass-lpi-pinctrl: Add Eliza pinctrlRavi Hothi
Document compatible for Qualcomm Eliza SoC LPASS LPI pin controller. Eliza has the same pin mux functions as Milos but uses a different slew rate register layout where the slew rate field is in the same GPIO config register rather than a separate dedicated register. As a result, Eliza only has a single reg entry instead of two. Signed-off-by: Ravi Hothi <ravi.hothi@oss.qualcomm.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://patch.msgid.link/20260715132150.1322663-2-ravi.hothi@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-07-16Merge tag 'renesas-fixes-for-v7.2-tag1' of ↵Arnd Bergmann
https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into arm/fixes Renesas fixes for v7.2 - Fix lock-ups on the Ironhide development board. * tag 'renesas-fixes-for-v7.2-tag1' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: arm64: dts: renesas: ironhide: Describe inline ECC carveouts Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-07-16gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lockMark Tomlinson
Locking is disabled in the regmap config as this driver uses its own lock. This means that all calls to regmap functions (read or write) must hold the i2c_lock. The function pca953x_irq_bus_sync_unlock() did not do this, and it was therefore possible that multiple threads could cause an incorrect register to be read/written. A previous patch partly fixed this, but only protected the write to the interrupt mask register, and not the read from the direction register. Fixes: bfc6444b57dc ("gpio: pca953x: fix pca953x_irq_bus_sync_unlock race") Cc: stable@vger.kernel.org Signed-off-by: Mark Tomlinson <mark.tomlinson@alliedtelesis.co.nz> Link: https://patch.msgid.link/20260709045116.2304246-1-mark.tomlinson@alliedtelesis.co.nz Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-07-16arm64: fixmap: Allow 256K early_ioremap() at any offsetYu Peng
NR_FIX_BTMAPS is the per-slot page limit for early_ioremap(). Since __early_ioremap() maps the page-aligned physical range, a 256K request can require one extra page when the physical address is not page-aligned. Reserve one extra page per slot so the 256K mapping budget is usable regardless of the initial page offset. Link: https://lore.kernel.org/r/08fd96fa-ee3a-4904-bd11-bb08bd90436f@kylinos.cn Signed-off-by: Yu Peng <pengyu@kylinos.cn> Signed-off-by: Will Deacon <will@kernel.org>
2026-07-16Merge back cpufreq material for 7.3Rafael J. Wysocki
2026-07-16arm_mpam: guard MBWU state before adding it to garbageGuangshuo Li
__destroy_component_cfg() adds each RIS mbwu_state object to the MPAM garbage list when destroying component configuration. However, mbwu_state is allocated per RIS and only for RISes with MBWU monitors. A component can therefore have comp->cfg allocated while some RISes still have ris->mbwu_state set to NULL. Passing a NULL mbwu_state to add_to_garbage() dereferences the NULL pointer inside the macro. Skip RISes that do not have an mbwu_state object before adding them to the garbage list. Fixes: 41e8a14950e1 ("arm_mpam: Track bandwidth counter state for power management") Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com> Reviewed-by: Ben Horgan <ben.horgan@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-07-16arm_mpam: Fix MPAMCFG_MBW_PBM register settingFenghua Yu
MPAMCFG_MBW_PBM is written from cfg if cfg has the MBW partition feature. It is reset when cfg does not have the MBW partition feature. But the register handling is reversed. This may cause an incorrect register setting. For example, during an MPAM reset, reset_cfg is empty (no MBW partition feature set), and cfg->mbw_pbm is 0. Instead of resetting MPAMCFG_MBW_PBM to all 1's, the current logic will set it to cfg->mbw_pbm, which is 0. Fix the issue by swapping the if/else branches. Fixes: a1cb6577f575 ("arm_mpam: Reset when feature configuration bit unset") Reported-by: Matt Ochs <mochs@nvidia.com> Signed-off-by: Fenghua Yu <fenghuay@nvidia.com> Reviewed-by: Gavin Shan <gshan@redhat.com> Reviewed-by: Ben Horgan <ben.horgan@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-07-16drm/xe/guc: Hold device ref until queue teardown completesArvind Yadav
GuC exec queue destruction can run asynchronously. If the final device put happens from a destroy worker, drmm cleanup can end up draining the same workqueue and deadlock. Hold a drm_device reference for the queue lifetime and drop it after queue teardown completes. This keeps drmm cleanup from running while async destroy work is still pending. Move GuC destroy work to a module-lifetime Xe workqueue and flush it on PCI remove so hot-unbind/rebind still waits for pending destroy work. With queue-held device refs, guc_submit_sw_fini() cannot run with live GuC IDs. Replace the fini wait with an assertion and remove the unused fini_wq. v2: - Rebase v3: - Switch to queue-lifetime drm_dev_get()/drm_dev_put() model. (Matt) - Queue async teardown on system_dfl_wq instead of xe->destroy_wq. (Matt) - Drop separate deferred drm_dev_put worker. - Remove stale drain_workqueue(xe->destroy_wq) from guc_submit_sw_fini(). v4: - Replace the guc_submit_sw_fini() wait with an assertion and remove the now-unused fini_wq. (sashiko) v5: - Move destroy work to a module-lifetime Xe workqueue instead of system_dfl_wq. (Matt) - Flush the module-lifetime destroy workqueue during PCI remove to preserve the old device-remove wait semantics. v6: - Keep SVM pagemap destroy work on the per-device destroy_wq to avoid letting it outlive the xe_device/drm_device. (Sashiko) - Use WQ_MEM_RECLAIM for xe->destroy_wq because SVM pagemap destroy work can be queued from the reclaim path. v7: - Drop the per-device xe->destroy_wq and use the module-level destroy WQ for SVM pagemap destroy as well. (Matt) - Rename xe_exec_queue_destroy_wq_*() helpers to xe_destroy_wq_*() helpers because the WQ is no longer exec-queue specific. (Matt) v8: - Rebase. v9: - Keep SVM pagemap destroy work on the per-device WQ_MEM_RECLAIM destroy_wq because it can be queued from reclaim and embeds the dev_pagemap used by devres teardown. (Sashiko) - Keep the module-level destroy WQ GuC-only and drop WQ_MEM_RECLAIM from it. - Update the module-WQ kdoc to document the GuC/SVM split. v10: - Keep xe->destroy_wq per-cpu while adding WQ_MEM_RECLAIM to fix the workqueue allocation warning. v11: - Drop the SVM pagemap destroy comment as it was revision-specific. (Thomas) v12: - Rebase. Fixes: 2d2be279f1ca ("drm/xe: fix UAF around queue destruction") Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> Cc: Rodrigo Vivi <rodrigo.vivi@intel.com> Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com> Cc: Tejas Upadhyay <tejas.upadhyay@intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Signed-off-by: Arvind Yadav <arvind.yadav@intel.com> Link: https://patch.msgid.link/20260716062624.211396-1-arvind.yadav@intel.com Signed-off-by: Tejas Upadhyay <tejas.upadhyay@intel.com>
2026-07-16arm_mpam: Fix software reset values of MPAMCFG_PRIBen Horgan
Priority partitioning is not supported other than to set the per-PARTID defaults in MPAMCFG_PRI, INTPRI and DSPRI, to the highest priority. When 0 is the lowest priority, all ones is the highest priority. However, these values are calculated with an extra higher bit set. Luckily, there is still no chance of setting functional bits incorrectly. When the priority widths are maximal, this is ensured as the fields have width 16 and a u16 holds the value for each field. When the widths are smaller, the higher order bits beyond the advertised widths, MPAMF_PRI_IDR.DSPRI_WD and MPAMF_PRI_IDR.INTPRI_WD, in the priority fields INTPRI and DSPRI are not used to calculate the priority. It is not specified whether these higher order bits are RAZ/WI or Res0 and so it is desirable not to set them to avoid the chance of misleading reads. Correct the priority reset values. Fixes: 880df85d8673 ("arm_mpam: Probe and reset the rest of the features") Signed-off-by: Ben Horgan <ben.horgan@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-07-16arm64: syscall: Ensure saved x0 is kept in-sync with tracer updatesWill Deacon
When seccomp support was originally added to arm64 in a1ae65b21941 ("arm64: add seccomp support"), seccomp was erroneously called _before_ the ptrace syscall-enter-stop and therefore the tracer could trivially manipulate the syscall register state after the seccomp check had passed. This was subsequently fixed in a5cd110cb836 ("arm64/ptrace: run seccomp after ptrace") by moving the seccomp check after the tracer has run. Unfortunately, a decade later, that fix has been reported to be incomplete. On arm64, both the first argument to a syscall and its eventual return value are allocated to register x0. In order to facilitate syscall restarting and querying of syscall arguments on the syscall exit path, the original value of x0 is stashed in 'struct pt_regs::orig_x0' early during the syscall entry path and is returned for the first argument by syscall_get_arguments(). Unlike 32-bit Arm, this stashed value is not directly exposed via ptrace() and so changes to register x0 made by the tracer on a syscall-enter-stop are not reflected in 'orig_x0'. This means that seccomp, syscall tracepoints and audit can observe a stale value for the register compared to the argument that will be observed by the actual syscall. Re-sync 'orig_x0' from x0 on the syscall entry path following a potential ptrace stop (i.e. PTRACE_EVENTMSG_SYSCALL_ENTRY or SECCOMP_RET_TRACE). This behaviour is limited to native tasks (because compat tasks expose 'orig_r0' to ptrace) where the syscall is not being skipped (because x0 is updated to hold the return value of -ENOSYS in that case). Cc: Kees Cook <kees@kernel.org> Cc: Jinjie Ruan <ruanjinjie@huawei.com> Cc: Mark Rutland <mark.rutland@arm.com> Cc: stable@vger.kernel.org Reported-by: Yiqi Sun <sunyiqixm@gmail.com> Link: https://lore.kernel.org/all/20260529065444.1336608-1-sunyiqixm@gmail.com/ Suggested-by: Catalin Marinas <catalin.marinas@arm.com> Fixes: a5cd110cb836 ("arm64/ptrace: run seccomp after ptrace") Reviewed-by: Jinjie Ruan <ruanjinjie@huawei.com> Tested-by: Jinjie Ruan <ruanjinjie@huawei.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-07-16mmc: bcm2835: DMA mapping improvementsJohn Garry
As pointed out by sashiko bot in [0], recent proposed changes to dma_max_mapping_size() may affect the driver. While the issue reported may be a false positive, Robin pointed out some other DMA-related issues in the driver which are addressed here: - the DMA max mapping size is irrelevant for the programmed IO mode of operation - we should not call dma_max_mapping_size() on the MMC host platform device, but rather the DMA engine device In addition, it's better to use the device returned from dmaengine_get_dma_device() for dma_umap_sg() and dma_unmap_sg(), and not reference the DMA channel device directly. [0] https://lore.kernel.org/linux-scsi/d82926fe-4557-401d-ae58-4302fef5657c@oracle.com/#t Signed-off-by: John Garry <john.g.garry@oracle.com> Signed-off-by: Ulf Hansson <ulfh@kernel.org>
2026-07-16dt-bindings: leds: bcm6358: Convert to DT schemaNinad Naik
Convert the brcm,bcm6358 to DT schema. Signed-off-by: Ninad Naik <ninadnaik07@gmail.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://patch.msgid.link/20260707184437.500278-1-ninadnaik07@gmail.com Signed-off-by: Lee Jones <lee@kernel.org>
2026-07-16spi: realtek-rtl: change to __raw reads and writesRustam Adilov
To make the spi driver operable with SWAP_IO_SPACE config enabled, replace all instances of readl/writel with their __raw variants. Otherwise readl/writel will do a byte swap which this driver does not intend to do. Tested-by: Carlo Szelinsky <github@szelinsky.de> Signed-off-by: Rustam Adilov <adilov@disroot.org> Link: https://patch.msgid.link/20260711083411.45836-1-adilov@disroot.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-16regulator: mcp16502: Convert to dev_err_probe() in mcp16502_probe()Ninad Naik
The mcp16502_probe() currently uses dev_err() for logging errors. However, functions like devm_regmap_init_i2c, devm_gpiod_get_optional and devm_regulator_register can return -EPROBE_DEFER. Using dev_err() in these situations can cause unnecessary error spam in dmesg. As a result, convert to dev_err_probe(). It also simplifies the print and return operations into single statement. The 'ret' variable is no longer required and has been removed. Originally detected by Coccinelle with this warning "Consider using %pe to print PTR_ERR()" Compile-tested only. Signed-off-by: Ninad Naik <ninadnaik07@gmail.com> Link: https://patch.msgid.link/20260714192228.1639768-1-ninadnaik07@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-16mfd: rohm-bd718x7: Use software nodes for gpio-keysDmitry Torokhov
Refactor the rohm-bd7182x7 MFD driver to use software nodes for instantiating the gpio-keys child device, replacing the old platform_data mechanism. The power key's properties are now defined using software nodes and property entries. The IRQ is passed as a resource attached to the platform device. This will allow dropping support for using platform data for configuring gpio-keys in the future. Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Link: https://patch.msgid.link/20260611-rohm-software-nodes-v5-2-0244664a3b65@gmail.com Signed-off-by: Lee Jones <lee@kernel.org>
2026-07-16mfd: rohm-bd71828: Use software nodes for gpio-keysDmitry Torokhov
Refactor the rohm-bd71828 MFD driver to use software nodes for instantiating the gpio-keys child device, replacing the old platform_data mechanism. The power key's properties are now defined using software nodes and property entries. The IRQ is passed as a resource attached to the platform device. This will allow dropping support for using platform data for configuring gpio-keys in the future. Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Link: https://patch.msgid.link/20260611-rohm-software-nodes-v5-1-0244664a3b65@gmail.com Signed-off-by: Lee Jones <lee@kernel.org>
2026-07-16ASoC: codecs: lpass-{wsa,va}-macro: check clk_set_rate() return valueMark Brown
Ajay Kumar Nandam <ajay.nandam@oss.qualcomm.com> says: clk_set_rate() returns 0 on success or a negative errno on failure but the WSA and VA macro probe functions are ignoring it. This series adds return value checking and bails out of probe on failure. This mirrors the same fix already posted for the TX and RX macros [1]. [1] https://lore.kernel.org/all/20260707-xo-sd-codec-tx-rx-v2-3-f61b4622f97f@oss.qualcomm.com/ Link: https://patch.msgid.link/20260715-xo-sd-codec-wsa-va-clk-set-rate-v2-0-16ca64c2b929@oss.qualcomm.com
2026-07-16ASoC: codecs: lpass-va-macro: check clk_set_rate() return valueAjay Kumar Nandam
clk_set_rate() returns 0 on success or a negative errno on failure but the VA macro probe function is ignoring it. Check the return value and bail out of probe on failure. Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Ajay Kumar Nandam <ajay.nandam@oss.qualcomm.com> Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com> Link: https://patch.msgid.link/20260715-xo-sd-codec-wsa-va-clk-set-rate-v2-2-16ca64c2b929@oss.qualcomm.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-16ASoC: codecs: lpass-wsa-macro: check clk_set_rate() return valueAjay Kumar Nandam
clk_set_rate() returns 0 on success or a negative errno on failure but the WSA macro probe function is ignoring it. Check the return value and bail out of probe on failure. Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Ajay Kumar Nandam <ajay.nandam@oss.qualcomm.com> Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com> Link: https://patch.msgid.link/20260715-xo-sd-codec-wsa-va-clk-set-rate-v2-1-16ca64c2b929@oss.qualcomm.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-16block: fix aligning of bounced dio read biosChristoph Hellwig
bio_iov_iter_align_down expects the "normal" biovec layout from vector 0, while bio_iov_iter_bounce_read abuses vector 0 for a bounce buffer allocation. Pass an explicit bvec to bio_iov_iter_align_down to deal with this case to avoid a double unpin. Additionally we need to free the folio if no bio_vec could be added, and adjust the size of the first bio_vec that contains the bounce buffer when the I/O size is aligned down. Fixes: e7b8b3c5b2a6 ("block: align down bounces bios") Reported-by: 0wnerD1ed <l7z@0b1t.tech> Signed-off-by: Christoph Hellwig <hch@lst.de> Tested-by: 0wnerD1ed <l7z@0b1t.tech> Reviewed-by: Keith Busch <kbusch@kernel.org> Link: https://patch.msgid.link/20260716091306.316625-3-hch@lst.de Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-07-16block: handle huge zero folios in bio_free_foliosChristoph Hellwig
When CONFIG_PERSISTENT_HUGE_ZERO_FOLIO is enabled, iomap_dio_zero() can add a huge zero folio to a zeroing bio, which needs special treatment in bio_free_folios by also checking is_huge_zero_folio() in addition to is_zero_folio(). Fixes: 8dd5e7c75d7b ("block: add helpers to bounce buffer an iov_iter into bios") Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Hannes Reinecke <hare@kernel.org> Link: https://patch.msgid.link/20260716091306.316625-2-hch@lst.de Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-07-16block: try slab allocation in bio_alloc_bioset() before mempoolJoseph Qi
When the per-CPU bio cache is enabled but empty, bio_alloc_percpu_cache() returns NULL and bio_alloc_bioset() falls straight through to the mempool fallback: if (unlikely(!bio)) { if (!(saved_gfp & __GFP_DIRECT_RECLAIM)) return NULL; ... } For non-sleeping allocations (no __GFP_DIRECT_RECLAIM) this returns NULL without ever attempting a slab allocation, even when there is plenty of free memory. Commit b520c4eef83d ("block: split bio_alloc_bioset more clearly into a fast and slowpath") introduced this. Before it, a percpu cache miss fell through to mempool_alloc(), which attempted the underlying slab allocation first and only failed when that slab allocation failed. The restructuring dropped the slab attempt that non-sleeping callers of a cache-enabled bioset (such as the default fs_bio_set used by bio_alloc()) relied on. Try a slab allocation with optimistic GFP_ flags before falling back to the mempool whenever the bio is still NULL, so both the cache-empty and non-cache paths share the same slab attempt. This restores the previous behavior for non-sleeping allocations. Fixes: b520c4eef83d ("block: split bio_alloc_bioset more clearly into a fast and slowpath") Suggested-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Link: https://patch.msgid.link/20260709020145.4011533-1-joseph.qi@linux.alibaba.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-07-16block: show operation in error injection rulesJackie Liu
Rules listed through the error_injection debugfs file omit the block operation they match. As a result, rules that differ only in operation are indistinguishable even though op is mandatory when adding a rule. Signed-off-by: Jackie Liu <liuyun01@kylinos.cn> Reviewed-by: Christoph Hellwig <hch@lst.de> Link: https://patch.msgid.link/20260715073341.95129-1-liu.yun@linux.dev Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-07-16block: serialize elevator changes for the same queue using a writer lockShin'ichiro Kawasaki
When elevator_change() is called concurrently for the same queue, the elevator_change_done() function runs concurrently as well. This function adds or deletes kobjects for the debugfs entry of the queue. Then the concurrent calls cause memory corruption of the kobjects and result in a process hang. The core part of the elevator switch is protected by queue freeze and q->elevator_lock. However, since the commit 559dc11143eb ("block: move elv_register[unregister]_queue out of elevator_lock"), the elevator_change_done() is not serialized. Hence the memory corruption and the hang. The failures are observed when udev-worker writes to a sysfs queue/scheduler attribute file while the blktests test case block/005 writes to the same attribute file. The failure also can be recreated by running two processes that write to the same queue/scheduler file concurrently. The failure is observed since another commit 370ac285f23a ("block: avoid cpu_hotplug_lock depedency on freeze_lock"). This commit changed the behavior of queue freeze and it unveiled the failure. Fix the failure by changing elv_iosched_store() to acquire update_nr_hwq_lock as the writer lock instead of the reader lock. This serializes the whole elevator switch steps, including the elevator_change_done() call. Fixes: 559dc11143eb ("block: move elv_register[unregister]_queue out of elevator_lock") Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com> Reviewed-by: Nilay Shroff <nilay@linux.ibm.com> Reviewed-by: Ming Lei <tom.leiming@gmail.com> Link: https://patch.msgid.link/20260716092237.1305030-1-shinichiro.kawasaki@wdc.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-07-16block: free copied pages when blk_rq_map_kern() failsJackie Liu
bio_copy_kern() allocates pages that are normally freed by the bio completion callback. If blk_rq_append_bio() rejects the bio, however, blk_rq_map_kern() only drops the bio reference. Since bio_put() does not free pages referenced by the bio vectors, those pages leak. This can happen when the bio exceeds the queue segment constraints or when a later mapping cannot be merged into a request built by earlier calls. Track whether the buffer was copied and free those pages before dropping the rejected bio. Fixes: 3a5a39276d2a ("block: allow blk_rq_map_kern to append to requests") Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Jackie Liu <liuyun01@kylinos.cn> Reviewed-by: Christoph Hellwig <hch@lst.de> Link: https://patch.msgid.link/20260715073518.96042-1-liu.yun@linux.dev Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-07-16ASoC: fs210x: Make cache write through again during resumeMark Brown
The fs210x driver currently puts the regmap cache into cache only mode during suspend but at no point does it make it writable again, meaning that device can't work after suspend other than basic powerup which bypasses the cache. Mark the cache as writable again when we resync the registers, it's not clear to me that the cache only mode is needed at all but this is a fairly minimal change. Since this is setting a flag it's safe to do even if the cache was not previously in cache only mode. Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com> Link: https://patch.msgid.link/20260715-asoc-fs210x-fix-resume-v1-1-dd81d9c62c05@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-16dt-bindings: backlight: 88pm860x: Add missing bracketManuel Ebner
Add missing '};' to code. Signed-off-by: Manuel Ebner <manuelebner@mailbox.org> Link: https://patch.msgid.link/20260710112529.435341-2-manuelebner@mailbox.org Signed-off-by: Lee Jones <lee@kernel.org>
2026-07-16dt-bindings: leds: Document "gpio" triggerSamuel Holland
The "gpio" trigger is used to control LEDs by the level of a GPIO input referenced by the trigger-sources property. This is already documented in the trigger-sources property description and is used in at least one devicetree (am335x-regor.dtsi). Document it so validation of those and future DTs will pass. Signed-off-by: Samuel Holland <samuel@sholland.org> Acked-by: Conor Dooley <conor.dooley@microchip.com> Link: https://patch.msgid.link/20260711192842.845048-2-samuel@sholland.org Signed-off-by: Lee Jones <lee@kernel.org>
2026-07-16arm64: dts: am62p5-var-som-symphony: add TPM supportStefano Radaelli
Add the ST33KTPM2XI2C TPM device on the Symphony carrier board. The TPM reset signal is driven through a PCAL6408 GPIO expander, so add the corresponding GPIO expander node. Configure the RGB_SEL board signal through a GPIO hog to keep the board in the expected configuration. Signed-off-by: Stefano Radaelli <stefano.r@variscite.com> Link: https://patch.msgid.link/d3ac1ce507b48f8debc8857814be00600b5a14f9.1782680023.git.stefano.r@variscite.com Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
2026-07-16arm64: dts: am62p5-var-som-symphony: add touchscreen supportStefano Radaelli
Add support for the capacitive touchscreen on the Symphony carrier board. Describe the FT5x06 touchscreen controller, configure its interrupt, and mark it as a wakeup source. Signed-off-by: Stefano Radaelli <stefano.r@variscite.com> Link: https://patch.msgid.link/eaf0479114137e4472b4adb3df82a5bcf78405a2.1782680023.git.stefano.r@variscite.com Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
2026-07-16arm64: dts: ti: var-som-am62p: update audio codec configurationStefano Radaelli
Update the WM8904 audio codec configuration on the VAR-SOM-AM62P. Set the audio reference clock rate to 12 MHz and add the codec DRC, GPIO and DMIC configuration required by the board. Signed-off-by: Stefano Radaelli <stefano.r@variscite.com> Link: https://patch.msgid.link/76e49b33e7810b7cf6452cf827d88b5d0f04ba3b.1782680023.git.stefano.r@variscite.com Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
2026-07-16arm64: dts: ti: var-som-am62p: fix Ethernet PHY configurationStefano Radaelli
Fix the Ethernet device tree description on the VAR-SOM-AM62P. Enable the CPSW Ethernet controller and correct the Ethernet PHY description by modelling the PHY power supply and adding the required board-specific PHY properties. Signed-off-by: Stefano Radaelli <stefano.r@variscite.com> Link: https://patch.msgid.link/4d1ba0d1b9bd4957224213cf17dca93392788e03.1782680023.git.stefano.r@variscite.com Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
2026-07-16arm64: dts: ti: var-som-am62: Add support for Variscite Symphony BoardStefano Radaelli
Add device tree support for the Variscite Symphony carrier board with the VAR-SOM-AM62 system on module. The Symphony board includes - uSD Card support - USB ports and OTG - Additional Gigabit Ethernet interface - Uart interfaces - OV5640 Camera support - GPIO Expander and TPM - CAN, I2C and general purpose interfaces - Capacitive touch controller Link: https://www.variscite.it/product/single-board-computers/symphony-board/ Signed-off-by: Stefano Radaelli <stefano.r@variscite.com> Link: https://patch.msgid.link/42decef4f84db8fc0474675a23e157b68b3b1a1b.1783864932.git.stefano.r@variscite.com Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
2026-07-16arm64: dts: ti: Add support for Variscite VAR-SOM-AM62Stefano Radaelli
Add device tree support for the Variscite VAR-SOM-AM62 system on module. This SOM is designed to be used with various carrier boards. The module includes: - AM62x Sitara MPU processor - Up to 4GB of DDR4-3733 memory - Up to 128GB eMMC storage memory - Integrated 10/100/1000 Mbps Ethernet Transceiver Analog Devices - Audio codec wm8904 - Resistive touch panel interface controller - I2C, UART and SPI interfaces - Bluetooth 5.2 + WiFi single or dual band Only SOM-specific peripherals are enabled by default. Carrier board specific interfaces are left disabled to be enabled in the respective carrier board device trees. Link: https://variscite.com/system-on-module-som/ti-sitara-am62x/var-som-am62/ Signed-off-by: Stefano Radaelli <stefano.r@variscite.com> Link: https://patch.msgid.link/0a7bdfda80309eaa207b5b369d72f4bcb16e0604.1783864932.git.stefano.r@variscite.com Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
2026-07-16dt-bindings: arm: ti: Add bindings for Variscite VAR-SOM-AM62Stefano Radaelli
Add devicetree bindings for Variscite VAR-SOM-AM62 System on Module and its carrier boards. Acked-by: Conor Dooley <conor.dooley@microchip.com> Signed-off-by: Stefano Radaelli <stefano.r@variscite.com> Link: https://patch.msgid.link/20d42ed8808c477c79b4d45fea6fd474ee42b06d.1783864932.git.stefano.r@variscite.com Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
2026-07-16arm64: dts: ti: k3-am69-aquila: Add Toradex OV5640 CSI camerasVitor Soares
Add device tree overlays for the Toradex OV5640 CSI cameras on Aquila CSI_1 and CSI_2. Two variants are supported for each interface: the current CSI Camera Set 5MP OV5640 with a 27 MHz oscillator and the legacy CSI Module 5MP OV5640 with a 24 MHz oscillator. On the Aquila AM69 Development Board, CSI_1 is exposed on connector J70 and CSI_2 is exposed on connector J71. Link: https://developer.toradex.com/hardware/accessories/cameras/csi-camera-module-5mp-ov5640-arducam Link: https://developer.toradex.com/hardware/legacy-products/other/csi-camera-module-5mp-ov5640/ Signed-off-by: Vitor Soares <vitor.soares@toradex.com> Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com> Link: https://patch.msgid.link/20260602115123.1324474-16-ivitro@gmail.com Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
2026-07-16arm64: dts: ti: k3-am69-aquila: Add Toradex Capacitive Touch Display 7" DSIVitor Soares
Add a device tree overlay for the Toradex Capacitive Touch Display 7" DSI on the Aquila DSI_1 interface. Used on the Clover Board (J12), where DSI_1 is exposed via a FFC/FPC connector. The display includes an internal Texas Instruments SN65DSI83 DSI-to-LVDS bridge driving a Riverdi RVT70HSLNWCA0 7" WSVGA IPS TFT LCD panel. Touch input is provided by an Ilitek ILI2132 capacitive touch controller. Link: https://developer.toradex.com/hardware/accessories/displays/capacitive-touch-display-7inch-dsi Signed-off-by: Vitor Soares <vitor.soares@toradex.com> Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com> Link: https://patch.msgid.link/20260602115123.1324474-15-ivitro@gmail.com Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
2026-07-16arm64: dts: ti: k3-am69-aquila: Add Toradex Capacitive Touch Display 10.1" DSIVitor Soares
Add a device tree overlay for the Toradex Capacitive Touch Display 10.1" DSI on the Aquila DSI_1 interface. Used on the Clover Board (J12), where DSI_1 is exposed via a FFC/FPC connector. The display includes an internal Texas Instruments SN65DSI83 DSI-to-LVDS bridge driving a Riverdi RVT101HVLNWC00 10.1" WXGA IPS TFT LCD panel. Touch input is provided by an Ilitek ILI2132 capacitive touch controller. The overlay is also combined with the Aquila AM69 Clover carrier board device tree to provide a ready-to-use DTB. Link: https://developer.toradex.com/hardware/accessories/displays/capacitive-touch-display-101inch-dsi Signed-off-by: Vitor Soares <vitor.soares@toradex.com> Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com> Link: https://patch.msgid.link/20260602115123.1324474-14-ivitro@gmail.com Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
2026-07-16arm64: dts: ti: k3-am69-aquila: Add Toradex Capacitive Touch Display 7" DSI ↵Vitor Soares
with adapter Add a device tree overlay for the Toradex Capacitive Touch Display 7" DSI used with the Toradex DSI Display Adapter on the Aquila Development Board. On this board, DSI_1 is exposed on connector J44 through a Samtec LSS-130 connector, and the adapter converts it to an FFC/FPC connector. The display includes an internal Texas Instruments SN65DSI83 DSI-to-LVDS bridge driving a Riverdi RVT70HSLNWCA0 7" WSVGA IPS TFT LCD panel. Touch input is provided by an Ilitek ILI2132 capacitive touch controller. Link: https://developer.toradex.com/hardware/accessories/displays/capacitive-touch-display-7inch-dsi Link: https://developer.toradex.com/hardware/accessories/add-ons/dsi-display-adapter Signed-off-by: Vitor Soares <vitor.soares@toradex.com> Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com> Link: https://patch.msgid.link/20260602115123.1324474-13-ivitro@gmail.com Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
2026-07-16arm64: dts: ti: k3-am69-aquila: Add Toradex Capacitive Touch Display 10.1" ↵Vitor Soares
DSI with adapter Add a device tree overlay for the Toradex Capacitive Touch Display 10.1" DSI used with the Toradex DSI Display Adapter on the Aquila Development Board. On this board, DSI_1 is exposed on connector J44 through a Samtec LSS-130 connector, and the adapter converts it to an FFC/FPC connector. The display includes an internal Texas Instruments SN65DSI83 DSI-to-LVDS bridge driving a Riverdi RVT101HVLNWC00 10.1" WXGA IPS TFT LCD panel. Touch input is provided by an Ilitek ILI2132 capacitive touch controller. Link: https://developer.toradex.com/hardware/accessories/displays/capacitive-touch-display-101inch-dsi Link: https://developer.toradex.com/hardware/accessories/add-ons/dsi-display-adapter Signed-off-by: Vitor Soares <vitor.soares@toradex.com> Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com> Link: https://patch.msgid.link/20260602115123.1324474-12-ivitro@gmail.com Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
2026-07-16arm64: dts: ti: k3-am69-aquila: Add DSI to LVDS adapter with 10.1" displayVitor Soares
Add a device tree overlay for the Toradex DSI to LVDS Adapter with the Toradex Capacitive Touch Display 10.1" LVDS. Used on Development Board (J44), where DSI_1 is exposed via a Samtec LSS-130 connector. The adapter is based on the Texas Instruments SN65DSI84 DSI-to-LVDS bridge and drives a LogicTechno LT170410-2WHC 10.1" WXGA LVDS panel. Touch input is provided by an Atmel MaxTouch capacitive touch controller. Link: https://developer.toradex.com/hardware/accessories/add-ons/dsi-lvds-adapter Link: https://developer.toradex.com/hardware/accessories/displays/capacitive-touch-display-101inch-lvds Signed-off-by: Vitor Soares <vitor.soares@toradex.com> Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com> Link: https://patch.msgid.link/20260602115123.1324474-11-ivitro@gmail.com Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
2026-07-16arm64: dts: ti: k3-am69-aquila: Add Toradex DSI to HDMI AdapterVitor Soares
Add a device tree overlay for the Toradex DSI to HDMI Adapter on the Aquila AM69 DSI_1 interface. Used on Aquila Development Board (J44), where DSI_1 is exposed via a Samtec LSS-130 connector. The adapter is based on the Lontium LT8912B DSI-to-HDMI bridge. Link: https://developer.toradex.com/hardware/accessories/add-ons/dsi-hdmi-adapter Signed-off-by: Vitor Soares <vitor.soares@toradex.com> Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com> Link: https://patch.msgid.link/20260602115123.1324474-10-ivitro@gmail.com Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
2026-07-16arm64: dts: ti: k3-am642-tqma64xxl-mbax4xxl: add icssg1 ti,pa-statsAlexander Feilke
Add missing ti,pa-stats syscon phandle. In addition to providing additional ethtool stats, this avoids a "icssg-prueth icssg1-eth: couldn't get ti,pa-stats syscon regmap" error message. Signed-off-by: Alexander Feilke <Alexander.Feilke@ew.tq-group.com> [Nora Schiffer: edited commit description] Signed-off-by: Nora Schiffer <nora.schiffer@ew.tq-group.com> Link: https://patch.msgid.link/a03189aa138f74955a03b9fe6018a17bf7e2ce8c.1783348781.git.nora.schiffer@ew.tq-group.com Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
2026-07-16arm64: dts: ti: k3-am642-tqma64xxl: add ospi0 vcc-supplyAlexander Feilke
Add missing vcc-supply to ospi0 flash. Signed-off-by: Alexander Feilke <Alexander.Feilke@ew.tq-group.com> Signed-off-by: Nora Schiffer <nora.schiffer@ew.tq-group.com> Link: https://patch.msgid.link/aaec2ddf7cecb58ca0af37d4f03afec571804757.1783348781.git.nora.schiffer@ew.tq-group.com Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>