summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-08-12leds: is31fl319x: Modernize registrationAndreas Kemnade
Use _ext version to have properties parsed to avoid needing to parse them in the driver itself. More modern properties are recognized and the LEDs can be referenced via phandle. Due to the maximum current mechanics, LEDs are not registered right in the first iteration over the nodes. Signed-off-by: Andreas Kemnade <andreas@kemnade.info> Link: https://patch.msgid.link/20260806-led-modern-v4-1-eed715baab2e@kemnade.info Signed-off-by: Lee Jones <lee@kernel.org>
2026-08-12KVM: s390: Fix pgste_get_trylock_multiple()Claudio Imbrenda
In case of failure, pgste_get_trylock_multiple() will attempt to unlock the locked PGSTEs based on whether the PCL is set. In some circumstances this can lead to unlocking PGSTEs that were locked by other threads. Fix by unlocking the amount of PGSTEs that were actually locked, ignoring the PCL bit in the array. Fixes: 94fd9b16cc67 ("KVM: s390: KVM page table management functions: lifecycle management") Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com> Reviewed-by: Christoph Schlameuss <schlameuss@linux.ibm.com> Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Message-ID: <20260812104436.109741-6-imbrenda@linux.ibm.com>
2026-08-12KVM: s390: Fix get_all_floating_irqs()Claudio Imbrenda
When attempting to report all pending floating interrupt to userspace, the GISA IPM bits are atomically tested and cleared, and the corresponding interrupt description is written in the output buffer. If the output buffer is too small, an error is returned to userspace, but the GISA IPM bits are now lost. Moreover, the contract of KVM_DEV_FLIC_GET_ALL_IRQS, which is the only path to get_all_floating_irqs(), states that: > All interrupts remain pending, i.e. are not deleted from the list of > currently pending interrupts. Fix by non-destructively testing for the GISA IPM bits. Fixes: 24160af6cb28 ("KVM: s390: add GISA interrupts to FLIC ioctl interface") Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Message-ID: <20260812104436.109741-4-imbrenda@linux.ibm.com>
2026-08-12KVM: s390: Use srcu in kvm_arch_vcpu_unlocked_ioctl()Claudio Imbrenda
kvm_arch_vcpu_unlocked_ioctl() is called without further locks held, but kvm_s390_inject_vcpu(), which is called from there, needs either the kvm->srcu or the slots lock. Fix by taking the kvm->srcu in kvm_arch_vcpu_unlocked_ioctl(). Fixes: ba5c1e9b6cee ("KVM: s390: interrupt subsystem, cpu timer, waitpsw") Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com> Reviewed-by: Christoph Schlameuss <schlameuss@linux.ibm.com> Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Message-ID: <20260812104436.109741-3-imbrenda@linux.ibm.com>
2026-08-12KVM: s390: Properly handle NULL pointer in dat_cond_set_storage_key()Claudio Imbrenda
Some callers pass NULL as oldkey. Calling page_cond_set_storage_key() will cause that NULL pointer to get dereferenced. Fix by checking for NULL and assigning the pointer to a dummy local variable to avoid crashes. Fixes: 8e03e8316eb2 ("KVM: s390: KVM page table management functions: storage keys") Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com> Reviewed-by: Christoph Schlameuss <schlameuss@linux.ibm.com> Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Message-ID: <20260812104436.109741-2-imbrenda@linux.ibm.com>
2026-08-12KVM: s390: Restore sigset on error pathChristian Borntraeger
kvm_sigset_activate() installs vcpu->sigset via sigprocmask() and stashes the caller's mask in current->real_blocked; only kvm_sigset_deactivate() restores it. For KVM_RUN on a STOPPED vcpu the error path will not restore the userspace mask. Re-arrange the error handling to also restore the signal mask. Fixes: 6352e4d2dd9a3 ("KVM: s390: implement KVM_(S|G)ET_MP_STATE for user space state control") Cc: stable@vger.kernel.org Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com> Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Message-ID: <20260811153738.206885-5-borntraeger@linux.ibm.com>
2026-08-12KVM: s390: pv: Fix rc/rrc offset for PVM_DUMPChristian Borntraeger
The rc/rrc value is copied to the cmd location of the cmd in the kvm_pv_cmd structure. Fix the offset. Fixes: 8aba09588d2a ("KVM: s390: Add CPU dump functionality") Cc: stable@vger.kernel.org Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com> Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Message-ID: <20260811153738.206885-4-borntraeger@linux.ibm.com>
2026-08-12KVM: s390: vsie: zero stale crypto bitsChristian Borntraeger
When shadowing crypto access bits from a format0 apcb (crycb 0 or 1), the bits 64..255 are unchanged from whatever is in the vsie page in the crycb and thus in the apcb. This gives a nested guest potential access to a device no longer available. Zero out the remaining bits. Fixes: 6b79de4b056e ("KVM: s390: vsie: allow guest FORMAT-1 CRYCB on host FORMAT-2") Cc: stable@vger.kernel.org Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com> Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Message-ID: <20260811153738.206885-3-borntraeger@linux.ibm.com>
2026-08-12KVM: s390: keyop: use mmu_lock to read gmap->asceChristian Borntraeger
Every other dat_* consumer in this file (kvm_s390_get_skeys, set_skeys, get_cmma_bits, set_cmma_bits, MEM_CLR_CMMA, kvm_s390_fixup_prefix, kvm_test_age_gfn, kvm_age_gfn) reads kvm->arch.gmap->asce *inside* the mmu_lock read-side. keyop is the only outlier. gmap->asce is mutated under write_lock(mmu_lock) by gmap_set_limit() and keyop might use a stale asce value for walking as KVM_S390_KEYOP and KVM_S390_VM_MEM_LIMIT_SIZE can run concurrently. This can result in memory corruption. Fixes: 0ee4ddc1647b ("KVM: s390: Storage key manipulation IOCTL") Cc: stable@vger.kernel.org Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com> Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Message-ID: <20260811153738.206885-2-borntraeger@linux.ibm.com>
2026-08-12mfd: cs42l43: Fix regmap defaults orderingCharles Keepax
The regmap defaults should be ordered as binary search is done on the array. A few registers were added in the wrong places, move these to be in register address order. Fixes: a6fe20d67dc7 ("mfd: cs42l43: Add support for the B variant") Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Link: https://patch.msgid.link/20260805120109.4024451-1-ckeepax@opensource.cirrus.com Signed-off-by: Lee Jones <lee@kernel.org>
2026-08-12dt-bindings: mfd: syscon: Allow syscon compatible for Loongson-2K0300 chip idBinbin Zhou
The Loongson-2K0300 SoC exposes its chip ID registers through a syscon interface. Add the specific compatible `loongson,ls2k0300-chipid-syscon` to the allowed list of syscon bindings so that it can be referenced from the thermal node via a phandle. Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn> Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://patch.msgid.link/b76405a88b0cded91ba370139d7223fe2d6953df.1785829933.git.zhoubinbin@loongson.cn Signed-off-by: Lee Jones <lee@kernel.org>
2026-08-12pid: reject allocations through dead ancestor pid namespacesJérémy Jean
alloc_pid() checks PIDNS_ADDING only on the leaf pid namespace before making a new struct pid visible in every ancestor namespace. That is insufficient when an unborn descendant pid namespace outlives an ancestor whose init task has already exited. The descendant can still be initialized later through setns(), and the new pid is then published into the dead ancestor as well. Keep the existing ENOMEM behavior, but require PIDNS_ADDING to be set in every namespace that will receive the new pid before publishing any of them. This preserves the invariant that free_pid() never decrements pid_allocated in a namespace whose child_reaper is no longer live. Fixes: a3bdc23ba8ea ("pid_namespace: allow opening pid_for_children before init was created") Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr> Reviewed-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-08-12ASoC: es8316: Add regulator supportMark Brown
Hongyang Zhao <hongyang.zhao@thundersoft.com> says: Add regulator support for the four ES8316 power domains so board descriptions can model and control the codec supplies. The binding patch documents AVDD, CPVDD, DVDD and PVDD as optional supplies for ES8316, preserving compatibility with existing device-tree descriptions. The driver patch enables the supplies before initializing the regmap and keeps them enabled for the lifetime of the I2C device. The missing supply model was identified while reviewing the RubikPi 3 audio support: https://lore.kernel.org/linux-arm-msm/c293d9c7-bdb7-4303-80c8-404228c434d7@oss.qualcomm.com/ Link: https://patch.msgid.link/20260812-es8316-regulator-next-20260722-v2-0-e7078bc9bc9c@thundersoft.com
2026-08-12ASoC: codecs: es8316: Add regulator supportHongyang Zhao
ES8316 has separate AVDD, CPVDD, DVDD and PVDD supply inputs. Request and enable the supplies during I2C probe, before initializing the regmap. Keep them enabled for the lifetime of the I2C device so the regmap cannot access an unpowered device and its cache remains synchronized if the ASoC component is unbound and rebound. Signed-off-by: Hongyang Zhao <hongyang.zhao@thundersoft.com> Link: https://patch.msgid.link/20260812-es8316-regulator-next-20260722-v2-2-e7078bc9bc9c@thundersoft.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-12ASoC: dt-bindings: es8316: Add regulator suppliesHongyang Zhao
The ES8316 has separate AVDD, CPVDD, DVDD and PVDD supply inputs for its analog, charge pump, digital core and digital I/O domains. Describe all four inputs so boards can model the codec power topology. The binding also covers ES8311 and ES8323, whose supply inputs differ, so restrict these properties to the ES8316 compatible. Keep them optional for compatibility with existing descriptions. Signed-off-by: Hongyang Zhao <hongyang.zhao@thundersoft.com> Link: https://patch.msgid.link/20260812-es8316-regulator-next-20260722-v2-1-e7078bc9bc9c@thundersoft.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-12arm64/efi: Avoid voluntary preemption with efi_mm installedWill Deacon
Gus reports a bad kernel memory access when using software PAN (CONFIG_ARM64_SW_TTBR0_PAN=y) on a machine with support for EFI runtime services: Unable to handle kernel access to user memory outside uaccess routines at virtual address 00000000f322ff30 Mem abort info: ESR = 0x0000000096000004 FSC = 0x04: level 0 translation fault Internal error: Oops: 0000000096000004 [#1] SMP Workqueue: efi_rts_wq efi_call_rts pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : efi_call_rts+0xd8/0x288 Call trace: efi_call_rts+0xd8/0x288 (P) process_one_work+0x178/0x4f8 worker_thread+0x194/0x328 This is because the fpsimd context management code called from __efi_fpsimd_begin() can preempt voluntarily, returning later to the EFI code with an incorrect value for TTBR0_EL1 thanks to the deferred mm switching used by the software PAN implementation. Since EFI runtime services cannot preempt voluntarily and because the fpsimd switching code does not rely on the TTBR0_EL1 mappings, simply reorder the fpsimd switch so that it occurs before we change the page-table. Cc: Ard Biesheuvel <ardb@kernel.org> Reported-by: Gus Bourg <gus@bourg.net> Tested-by: Gus Bourg <gus@bourg.net> Fixes: a5baf582f4c0 ("arm64/efi: Call EFI runtime services without disabling preemption") Link: https://lore.kernel.org/all/20260806000144.3388823-1-gus@bourg.net/ Reviewed-by: Ard Biesheuvel <ardb@kernel.org> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-12rust: fmt: route {:p} through HashedPtr to prevent address leaksKe Sun
Define a custom `kernel::fmt::Pointer` trait and `HashedPtr` wrapper so that `{:p}` formatting uses the kernel's `%p` hashed format instead of printing raw pointer values, preventing kernel address space leaks. Signed-off-by: Ke Sun <sunke@kylinos.cn> Reviewed-by: Gary Guo <gary@garyguo.net> Link: https://patch.msgid.link/20260810-hashedptr-v15-2-eafd27d36476@kylinos.cn [ Fixed KUnit failure when the CRNG is not ready. Then, as suggested, replaced the `scnprintf` comment (with v16's), changed width to 100, replaced cast with `without_provenance`. - Miguel ] Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-08-12rust: fmt: fix {:p} printing stack addressesKe Sun
The `impl_fmt_adapter_forward!` macro forwards `Pointer` for `Adapter<T>` by destructuring `self` into a local `t`, causing `{:p}` to print the address of that temporary stack variable rather than the actual pointer. Remove `Pointer` from the macro and provide a manual impl for `Adapter<&T>` that passes `self.0` directly. Signed-off-by: Ke Sun <sunke@kylinos.cn> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Reviewed-by: Gary Guo <gary@garyguo.net> Tested-by: Link Mauve <linkmauve@linkmauve.fr> Cc: stable@vger.kernel.org Fixes: c5cf01ba8dfe ("rust: support formatting of foreign types") Link: https://patch.msgid.link/20260810-hashedptr-v15-1-eafd27d36476@kylinos.cn Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-08-12ovl: fix double end_creating() on the casefold-mismatch pathVivek Parikh
ovl_create_real() releases the new dentry twice when the casefold consistency check fails. The S_IFDIR branch calls end_creating() and sets err, then falls through to the common out: label which calls end_creating() on the same dentry again: case S_IFDIR: newdentry = ovl_do_mkdir(ofs, dir, newdentry, attr->mode); err = PTR_ERR_OR_ZERO(newdentry); if (!err && ofs->casefold != ovl_dentry_casefolded(newdentry)) { pr_warn_ratelimited(...); end_creating(newdentry); /* first */ err = -EINVAL; } break; ... if (err) goto out; ... out: if (err) { end_creating(newdentry); /* second, same dentry */ return ERR_PTR(err); } end_creating() is end_dirop(), which does inode_unlock() on the parent and dput() on the dentry, so the parent directory's i_rwsem is unlocked twice and the dentry is put twice. The second unlock releases a lock that is not held, which is what wedges every later creation under that parent, and the second dput() drops a reference that was never taken. The branch was added by commit dfc7da402ccc ("ovl: Check for casefold consistency when creating new dentries") as a bare dput(), which already released the reference twice; commit fe497f0759e0 ("VFS: change vfs_mkdir() to unlock on failure.") converted both sites to end_creating(), adding the double unlock. This is reachable by an unprivileged user. The casefold consistency of the layers is validated at mount time in ovl_parse_layer(), and again on every lookup in ovl_lookup_single(), but ofs->workdir is the internal "work" subdirectory created inside the user-supplied workdir, and that subdirectory is not re-checked. Marking it casefolded after the mount therefore makes every ovl_create_temp() inherit the wrong state - and that path reaches ovl_create_real() through ovl_start_creating_temp(), which uses start_creating() with a generated name and so never runs the lookup-time check. unshare -Urm mount -t tmpfs -o casefold=utf8-12.1.0 tmpfs mnt mkdir -p mnt/lower/d mnt/upper mnt/work mnt/merged mount -t overlay ovl -o lowerdir=mnt/lower,\ upperdir=mnt/upper,workdir=mnt/work mnt/merged chattr +F mnt/work/work mkdir mnt/merged/d/sub # directory copy-up overlayfs: wrong inherited casefold (work/#5) and the next copy-up blocks forever on the parent's i_rwsem: mkdir D start_creating+0x65/0xb0 ovl_start_creating_temp+0xb0/0xe0 [overlay] ovl_create_temp+0xa3/0x1d0 [overlay] ovl_copy_up_one+0x1f1c/0x21c0 [overlay] ovl_copy_up_flags+0xf5/0x140 [overlay] ovl_create_object+0xb7/0x220 [overlay] ovl_mkdir+0x23/0x40 [overlay] Drop the end_creating() from the branch and let out: own the cleanup, which is what every other error path in this function already does. Fixes: dfc7da402ccc ("ovl: Check for casefold consistency when creating new dentries") Cc: stable@vger.kernel.org Signed-off-by: Vivek Parikh <vivek.parikh@breachx.ai> Reviewed-by: Amir Goldstein <amir73il@gmail.com> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-08-12pipe: only enable the extra wake_up(rd_wait) for EPOLLET consumersOleg Nesterov
pipe_poll() unconditionally sets ->poll_usage on the first call, forcing anon_pipe_write() to wake up readers on every write even if the pipe was not empty. The reason is that some legacy epoll(EPOLLET) users depend on historical per-write wakeups, see commit 3a34b13a88ca ("pipe: make pipe writes always wake up readers"). Test-case: #include <unistd.h> #include <sys/epoll.h> #include <assert.h> int main(void) { int pfd[2], efd; struct epoll_event evt = { .events = EPOLLIN | EPOLLET }; pipe(pfd); efd = epoll_create1(0); epoll_ctl(efd, EPOLL_CTL_ADD, pfd[0], &evt); for (int i = 0; i < 2; ++i) { write(pfd[1], "", 1); assert(epoll_wait(efd, &evt, 1, 0) == 1); } return 0; } it fails if WRITE_ONCE(poll_usage, true) is removed from pipe_poll(). However, without EPOLLET in .events, it does not need the extra wakeup and succeeds even if write() is called only once before the main loop. Currently io_uring without (unsupported) IORING_POLL_ADD_LEVEL always sets EPOLLET, and in IORING_POLL_ADD_MULTI mode it depends on per-write wakeups the same way: #include <unistd.h> #include <sys/mman.h> #include <sys/epoll.h> #include <sys/syscall.h> #include <linux/io_uring.h> #include <assert.h> int main(void) { struct io_uring_params p = {}; int fd, pfd[2]; pipe(pfd); fd = syscall(SYS_io_uring_setup, 2, &p); assert(fd >= 0); void *ring = mmap(0, p.cq_off.cqes + p.cq_entries * sizeof(struct io_uring_cqe), PROT_READ | PROT_WRITE, MAP_SHARED, fd, IORING_OFF_SQ_RING); assert(ring != MAP_FAILED); *(unsigned *)(ring + p.sq_off.tail) = 1; struct io_uring_sqe *sqes = mmap(0, p.sq_entries * sizeof(*sqes), PROT_READ | PROT_WRITE, MAP_SHARED, fd, IORING_OFF_SQES); assert(sqes != MAP_FAILED); sqes[0].opcode = IORING_OP_POLL_ADD; sqes[0].fd = pfd[0]; sqes[0].len = IORING_POLL_ADD_MULTI; sqes[0].poll32_events = EPOLLIN; syscall(SYS_io_uring_enter, fd, 1, 0, 0, 0, 0); unsigned *cq_head = ring + p.cq_off.head; unsigned *cq_tail = ring + p.cq_off.tail; for (int i = 0; i < 2; ++i) { write(pfd[1], "", 1); syscall(SYS_io_uring_enter, fd, 0, 0, IORING_ENTER_GETEVENTS, 0, 0); assert(*cq_tail == ++*cq_head); } return 0; } the 2nd assert() in the main loop fails without ->poll_usage == true. Rename ->poll_usage to ->pseudo_edgetrigger to make the purpose clearer, update the comments, and change pipe_poll() to set ->pseudo_edgetrigger only if wait->_key & EPOLLET is true. This check should catch both users, and this way poll/select and epoll without EPOLLET users will not pay for the extra wakeup. Signed-off-by: Oleg Nesterov <oleg@redhat.com> Link: https://patch.msgid.link/anCNoW-x0bcB2ggg@redhat.com Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-08-12pidfd: hold exec_update_lock around namespace ioctlChen Linxuan
The PIDFD_GET_*_NAMESPACE ioctls in pidfd_ioctl() perform a filesystem credentials ptrace access check before handing out a namespace file descriptor. The accompanying comment states that the code "mirrors nsfs behavior", but, unlike the corresponding procfs paths, it does so without holding the target task's exec_update_lock. proc_ns_get_link() and proc_ns_readlink() both take exec_update_lock for reading around the ptrace check and the namespace lookup, so that the credentials used for the access decision match those of the task when its namespace is read. Without it, a caller can pass the check against the target's old credentials and then read the namespace after the target has execve()'d a setuid binary and committed new credentials -- accessing namespace information it should have been denied. Hold exec_update_lock for reading around the ptrace check and the namespace lookup so that pidfd truly mirrors nsfs behavior, as the comment already claims. open_namespace() itself runs outside the lock: once a namespace reference is obtained it carries its own refcount and is opened with the caller's own credentials, so a concurrent execve() on the target can no longer affect the outcome. Fixes: 5b08bd408534 ("pidfs: allow retrieval of namespace file descriptors") Cc: stable@vger.kernel.org Signed-off-by: Chen Linxuan <me@black-desk.cn> Link: https://patch.msgid.link/20260731-pidfd-exec-update-lock-v1-1-b388f2f3a8b0@black-desk.cn Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-08-12fs: fix user path of nested backing filesBaokun Li
backing_file_open() derives the path to be stored in the new backing file from user_file->f_path. This is incorrect when user_file itself is a backing file, which is the case for nested stacking filesystems, e.g. overlayfs mounts where the lowerdir of one overlayfs is the merged directory of another. Since commit def3ae83da02 ("fs: store real path instead of fake path in backing file f_path") the f_path of a backing file holds the real path of the intermediate layer, not the path that the user opened. Commit 924577e4f6ca ("ovl: Fix nested backing file paths") fixed this for such configurations by passing file_user_path() from ovl_open_realfile(). However, commit 6af36aeb147a ("lsm: add backing_file LSM hooks") changed the first argument of backing_file_open() from the user path back to the user file and derived the path from user_file->f_path again, silently re-introducing the problem. As a result, files mapped through a nested overlayfs show the wrong path in /proc/<pid>/maps and in perf/ftrace mmap records. For example, with two nested overlayfs mounts: mkdir -p /ovl/{lower,upper,work,merged} /ovl/nested echo hello > /ovl/lower/foo mount -t overlay overlay \ -o lowerdir=/ovl/lower,upperdir=/ovl/upper,workdir=/ovl/work \ /ovl/merged # at least two lowerdirs are needed when upperdir is nonexistent mount -t overlay overlay \ -o lowerdir=/ovl/merged:/ovl/lower /ovl/nested mapping /ovl/nested/foo shows a disconnected path instead of the user path: # readlink /proc/self/fd/3 /ovl/nested/foo # grep foo /proc/self/maps 7f6e2c100000-7f6e2c101000 r--s 00000000 00:24 15813027 /foo The bogus path is derived from the f_path of the intermediate backing file, whose mount is a private clone that d_path() cannot resolve. Fix this by using file_user_path(), which returns the outermost user-visible path for backing files and falls back to &user_file->f_path for regular files. This restores the behavior of commit 924577e4f6ca ("ovl: Fix nested backing file paths") for overlayfs and also fixes the same problem for the other backing_file_open() callers, fuse passthrough and erofs ishare, when their user file is itself a backing file. backing_tmpfile_open() has the same pattern but is not affected: it is only called by ovl_create_tmpfile() for the upper layer, and another overlayfs is rejected as upperdir by the DCACHE_OP_REAL check in ovl_mount_dir_check(), so its user_file can never be a backing file. Fixes: 6af36aeb147a ("lsm: add backing_file LSM hooks") Cc: stable@vger.kernel.org Signed-off-by: Baokun Li <libaokun@linux.alibaba.com> Link: https://patch.msgid.link/20260804034204.3487077-1-libaokun@linux.alibaba.com Tested-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-08-12fs: remove stale inode_insert5() kernel-doc parameterYichong Chen
inode_insert5() no longer has an isnew argument, but its kernel-doc still documents one. This triggers a W=1 kernel-doc warning. Remove the stale parameter description. Signed-off-by: Yichong Chen <chenyichong@uniontech.com> Link: https://patch.msgid.link/20260805024149.935769-1-chenyichong@uniontech.com Reviewed-by: Jan Kara <jack@suse.cz> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-08-12fs: fix switch/case indentation in sysfs() syscallManush Prajwal
The case labels in the sysfs(2) syscall implementation are indented one level deeper than the switch statement itself, which does not match the kernel coding style (switch and case should be at the same indentation level). Fix the indentation; no functional change. Signed-off-by: Manush Prajwal <manushprajwal555@gmail.com> Link: https://patch.msgid.link/20260808182816.2399-1-manushprajwal555@gmail.com Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-08-12fs: document semantics of kstat::{uid,gid} fieldsJann Horn
The uid stored in struct kstat is logically a vfsuid; file systems initialize it by converting a kuid (filesystem perspective) to a vfsuid (mount perspective), then use vfsuid_into_kuid(), which essentially just typecasts from vfsuid to kuid. For now, just add a comment to note this mismatch between C type and semantic type. Below are some notes for anyone who wants to refactor this in the future. There are probably two options to refactor this away: 1. Change the type of kstat::uid to vfsuid_t, and perform the conversion from vfsuid to userspace-uid in the VFS layer. This wouldn't change machine code, just be more semantically correct. 2. Change the semantics of kstat::uid to really be a kuid_t, and let the VFS layer take care of doing the translation from kuid to vfsuid that is currently done in filesystem code (or in generic_fillattr, on behalf of the filesystem code). Option 2 is probably neater since it moves more logic into the generic VFS layer, and this is something that is expected to work the same way in all file systems? The following coccinelle script: ``` virtual context @@ struct kstat *stat; @@ * stat->uid @@ struct kstat *stat; @@ * stat->gid @@ struct kstat stat; @@ * stat.uid @@ struct kstat stat; @@ * stat.gid ``` detects 43 field accesses to these uid/gid fields. Signed-off-by: Jann Horn <jannh@google.com> Link: https://patch.msgid.link/20260803-vfs-comment-stat-uid-v1-1-162d062b737c@google.com Reviewed-by: Jan Kara <jack@suse.cz> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-08-12pmdomain: Merge branch fixes into nextUlf Hansson
Merge the pmdomain fixes for v7.2-rc[n] into the next branch, to allow them to get tested together with the pmdomain changes that are targeted for the next release. Signed-off-by: Ulf Hansson <ulfh@kernel.org>
2026-08-12pmdomain: mediatek: mfg: initialize prev_o in mtk_mfg_attach_dev()Karl Mehltretter
mtk_mfg_attach_dev() reads prev_o on the first iteration of its loop, in "if (prev_o && prev_o->freq == o->freq)", before prev_o is assigned at the end of the loop body. On that first iteration, evaluating prev_o reads an indeterminate value. If it is non-NULL, the condition dereferences a stale or invalid pointer, potentially faulting or incorrectly skipping the first OPP. Initialize prev_o to NULL. This matches the intent as well: there is no previous OPP to compare against on the first iteration. Found with Clang's -Wconditional-uninitialized. Fixes: f08e7a4e8d6ac ("pmdomain: mediatek: Add support for MFlexGraphics") Assisted-by: Claude:claude-fable-5 Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Reviewed-by: Nicolas Frattaroli <nicolas.frattaroli@collabora.com> Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson <ulfh@kernel.org>
2026-08-12pmdomain: renesas: Add R-Car X5H MDLC driverGeert Uytterhoeven
Add a minimal Module Controller driver for the R-Car X5H (R8A78000) SoC. For now this just supports the always-on power domains, and dummy module clocks and resets for the serial console (which is enabled by the boot loader). Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Ulf Hansson <ulfh@kernel.org>
2026-08-12dt-bindings: mfd: syscon: Add ESWIN EIC7700 compatiblePinkesh Vaghela
Document ESWIN EIC7700 SoC compatible for syscon registers. Signed-off-by: Pinkesh Vaghela <pinkesh.vaghela@einfochips.com> Acked-by: Conor Dooley <conor.dooley@microchip.com> Link: https://patch.msgid.link/20260804104431.1391839-5-pinkesh.vaghela@einfochips.com Signed-off-by: Lee Jones <lee@kernel.org>
2026-08-12mfd: qnap-mcu: keep the reply buffer alive past a command timeoutAli Ahmet Memis
qnap_mcu_exec() publishes an on-stack buffer to the receive path: unsigned char rx[QNAP_MCU_RX_BUFFER_SIZE]; ... reply->data = rx; reply->length = length; and qnap_mcu_receive_buf() writes into it from the serdev receive path, which runs out of flush_to_ldisc() and is not serialized against qnap_mcu_exec() at all. bus_lock cannot cover it, because qnap_mcu_exec() holds that mutex across wait_for_completion_timeout(). On a timeout qnap_mcu_exec() returns with reply->data still pointing at its own frame. A reply that arrives late, or an unsolicited message from the MCU, is then written into a stack frame that has been left, corrupting whatever runs next on that stack. The same applies when qnap_mcu_write() fails, since that path returns without touching the reply state either. Move the receive buffer into struct qnap_mcu. It is 37 bytes and the structure is devm_kzalloc()ed, so it lives as long as the driver, and a late write lands in memory that is still valid and is reinitialized by the next command. bus_lock keeps commands from sharing it. This deliberately does not clear reply->data or reply->length on the timeout path. Doing so races with qnap_mcu_receive_buf(), which reads both after its if (!reply->length) return size; check: clearing reply->data gives a NULL dereference, and clearing reply->length alone removes the reply->received == reply->length exit condition, so the copy loop runs until the uart chunk is consumed and overruns the buffer. Leaving both set keeps the write bounded by reply->length, which qnap_mcu_exec() has already checked against sizeof(mcu->rx). Fixes: 998f70d1806b ("mfd: Add base driver for qnap-mcu devices") Cc: stable@vger.kernel.org Signed-off-by: Ali Ahmet Memis <ali@iusegentoo.com> Link: https://lore.kernel.org/all/20260802132012.537B81F000E9@smtp.kernel.org/ Link: https://patch.msgid.link/20260802135307.31380-1-ali@iusegentoo.com Signed-off-by: Lee Jones <lee@kernel.org>
2026-08-12rust: module: update MAINTAINERS to cover module.rsAlvin Sun
Module types now live in `rust/kernel/module.rs` alongside `rust/kernel/module_param.rs`. Update the MODULE SUPPORT file pattern from `rust/kernel/module_param.rs` to `rust/kernel/module*.rs` so both files are covered. Assisted-by: opencode:glm-5.2 Link: https://lore.kernel.org/rust-for-linux/8ea21b29-9baf-4926-a16f-7d21c5a1a1b8@suse.com Reviewed-by: Alice Ryhl <aliceryhl@google.com> Acked-by: Petr Pavlu <petr.pavlu@suse.com> Signed-off-by: Alvin Sun <alvin.sun@linux.dev> Link: https://patch.msgid.link/20260811-fix-fops-owner-v10-10-7e71776f9dbe@linux.dev [ Removed Acked-by and Cc. - Miguel ] Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-08-12rust: macros: remove `THIS_MODULE` static from `module!`Alvin Sun
All users have been migrated to `ModuleMetadata::THIS_MODULE` const or `this_module::<LocalModule>()` helper. The `static THIS_MODULE` generated by the `module!` macro is no longer referenced anywhere, so remove it to avoid having two sources of the same `ThisModule` pointer. Assisted-by: opencode:glm-5.2 Reviewed-by: Andreas Hindborg <a.hindborg@kernel.org> Reviewed-by: Gary Guo <gary@garyguo.net> Acked-by: Danilo Krummrich <dakr@kernel.org> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Acked-by: Petr Pavlu <petr.pavlu@suse.com> Signed-off-by: Alvin Sun <alvin.sun@linux.dev> Link: https://patch.msgid.link/20260811-fix-fops-owner-v10-9-7e71776f9dbe@linux.dev Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-08-12rust_binder: use `LocalModule` for `THIS_MODULE`Alvin Sun
Replace the `THIS_MODULE` static reference in the binder fops with `this_module::<LocalModule>()`, consistent with the move of `THIS_MODULE` into the `ModuleMetadata` trait. Assisted-by: opencode:glm-5.2 Reviewed-by: Gary Guo <gary@garyguo.net> Acked-by: Danilo Krummrich <dakr@kernel.org> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Alvin Sun <alvin.sun@linux.dev> Link: https://patch.msgid.link/20260811-fix-fops-owner-v10-8-7e71776f9dbe@linux.dev Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-08-12rust: configfs: use `LocalModule` for `THIS_MODULE`Alvin Sun
Replace the `THIS_MODULE` static reference in the `configfs_attrs!` macro with `this_module::<LocalModule>()`, and update rnull to import `LocalModule` instead of `THIS_MODULE`, consistent with the move of `THIS_MODULE` into the `ModuleMetadata` trait. Assisted-by: opencode:glm-5.2 Reviewed-by: Andreas Hindborg <a.hindborg@kernel.org> Acked-by: Danilo Krummrich <dakr@kernel.org> Reviewed-by: Gary Guo <gary@garyguo.net> Acked-by: Andreas Hindborg <a.hindborg@kernel.org> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Alvin Sun <alvin.sun@linux.dev> Link: https://patch.msgid.link/20260811-fix-fops-owner-v10-7-7e71776f9dbe@linux.dev [ Rebased to avoid the imports cleanup patch. - Miguel ] Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-08-12rust: miscdevice: set fops.owner from driver module pointerAlvin Sun
Set the miscdevice fops owner field from the driver module pointer via the `this_module::<T::OwnerModule>()` helper, instead of defaulting to null. Assisted-by: opencode:glm-5.2 Reviewed-by: Andreas Hindborg <a.hindborg@kernel.org> Reviewed-by: Gary Guo <gary@garyguo.net> Acked-by: Danilo Krummrich <dakr@kernel.org> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Alvin Sun <alvin.sun@linux.dev> Link: https://patch.msgid.link/20260811-fix-fops-owner-v10-6-7e71776f9dbe@linux.dev Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-08-12rust: drm: set fops.owner from driver module pointerAlvin Sun
Change `create_fops()` to accept an owner module pointer instead of hardcoding `null_mut()`, ensuring the kernel correctly tracks the module owning the DRM device's file operations. Assisted-by: opencode:glm-5.2 Reviewed-by: Andreas Hindborg <a.hindborg@kernel.org> Reviewed-by: Gary Guo <gary@garyguo.net> Acked-by: Danilo Krummrich <dakr@kernel.org> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Alvin Sun <alvin.sun@linux.dev> Link: https://patch.msgid.link/20260811-fix-fops-owner-v10-5-7e71776f9dbe@linux.dev Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-08-12rust: macros: auto-insert OwnerModule in #[vtable]Alvin Sun
Auto-add `type OwnerModule: ::kernel::ModuleMetadata;` as a required associated type on the trait side if not already defined, and auto-insert `type OwnerModule = crate::LocalModule;` on the impl side if not explicitly provided, eliminating the need to manually declare and implement `OwnerModule` in every vtable trait and impl. Assisted-by: opencode:glm-5.2 Reviewed-by: Andreas Hindborg <a.hindborg@kernel.org> Suggested-by: Gary Guo <gary@garyguo.net> Link: https://lore.kernel.org/all/DIMMWHUOLPSH.13JFRHDKDQJGO@garyguo.net Reviewed-by: Gary Guo <gary@garyguo.net> Acked-by: Danilo Krummrich <dakr@kernel.org> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Alvin Sun <alvin.sun@linux.dev> Link: https://patch.msgid.link/20260811-fix-fops-owner-v10-4-7e71776f9dbe@linux.dev [ Fixed `rusttest` by adding a dummy `LocalModule`. Removed interim `#[allow(dead_code)]`. - Miguel ] Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-08-12rust: doctest: add LocalModule fallback for #[vtable] ThisModuleAlvin Sun
Add a `LocalModule` struct with a null-pointer `ModuleMetadata` impl in the doctest harness, so that `crate::LocalModule` (auto-inserted by `#[vtable]`) resolves correctly when there is no `module!` macro. Assisted-by: opencode:glm-5.2 Reviewed-by: Andreas Hindborg <a.hindborg@kernel.org> Reviewed-by: Gary Guo <gary@garyguo.net> Acked-by: Danilo Krummrich <dakr@kernel.org> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Alvin Sun <alvin.sun@linux.dev> Link: https://patch.msgid.link/20260811-fix-fops-owner-v10-3-7e71776f9dbe@linux.dev [ Fixed `clippy::undocumented_unsafe_blocks` lint by wrapping with a block. Added interim `#[allow(dead_code)]`. - Miguel ] Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-08-12rust: module: add `THIS_MODULE` const to `ModuleMetadata` traitAlvin Sun
Since `const_refs_to_static` has been stable as of the MSRV bump, a `ThisModule` pointer can now be used in const contexts. Add a `THIS_MODULE` const to the `ModuleMetadata` trait so that modules can provide their `ThisModule` pointer in const contexts such as static `file_operations`. Add a `this_module()` helper to retrieve the `THIS_MODULE` pointer of a given module type, and update `__init` to use it instead of the `THIS_MODULE` static generated by the `module!` macro. The `static THIS_MODULE` generated by the `module!` macro is retained for backwards compatibility with existing users and removed in a later patch once all references have been migrated. Assisted-by: opencode:glm-5.2 Reviewed-by: Andreas Hindborg <a.hindborg@kernel.org> Reviewed-by: Gary Guo <gary@garyguo.net> Acked-by: Danilo Krummrich <dakr@kernel.org> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Acked-by: Petr Pavlu <petr.pavlu@suse.com> Signed-off-by: Alvin Sun <alvin.sun@linux.dev> Link: https://patch.msgid.link/20260811-fix-fops-owner-v10-2-7e71776f9dbe@linux.dev Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-08-12rust: module: move module types into `module.rs`Alvin Sun
Move `Module`, `InPlaceModule`, `ModuleMetadata` and `ThisModule` from `lib.rs` into a new `rust/kernel/module.rs`. Re-export them from `lib.rs` to avoid tree-wide changes. Switch six bus driver registrations from `module.0` to the public `ThisModule::as_ptr()` accessor, since the field is no longer visible outside the new `module` submodule. No functional change. Assisted-by: opencode:glm-5.2 Suggested-by: Gary Guo <gary@garyguo.net> Link: https://lore.kernel.org/all/DJFIQPLOVO4T.1K8T0VZM30LDA@garyguo.net/ Reviewed-by: Gary Guo <gary@garyguo.net> Acked-by: Danilo Krummrich <dakr@kernel.org> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Acked-by: Petr Pavlu <petr.pavlu@suse.com> Signed-off-by: Alvin Sun <alvin.sun@linux.dev> Link: https://patch.msgid.link/20260811-fix-fops-owner-v10-1-7e71776f9dbe@linux.dev Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-08-12Merge patch series "fixes for iomap_bio_read_folio_range_sync"Christian Brauner
Christoph Hellwig <hch@lst.de> says: Two fixes for iomap_bio_read_folio_range_sync, a potential kernel crash when tweaking the device integrity behvavior using sysfs, and a missing bio_uninit that the Sashiko review of the first fix found. * patches from https://patch.msgid.link/20260804124404.737145-1-hch@lst.de: iomap: iomap_bio_read_folio_range_sync is missing a call to bio_uninit iomap: don't free integrity payload that doesn't exist Link: https://patch.msgid.link/20260804124404.737145-1-hch@lst.de Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-08-12iomap: iomap_bio_read_folio_range_sync is missing a call to bio_uninitChristoph Hellwig
Which could leak blkg references. Fixes: c03cea42149d ("iomap: add initial support for writes without buffer heads") Signed-off-by: Christoph Hellwig <hch@lst.de> Link: https://patch.msgid.link/20260804124404.737145-3-hch@lst.de Reviewed-by: "Darrick J. Wong" <djwong@kernel.org> Reviewed-by: Anuj Gupta <anuj20.g@samsung.com> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-08-12iomap: don't free integrity payload that doesn't existChristoph Hellwig
fs_bio_integrity_alloc might not allocate a bio integrity payload if PI verification is disabled on the block device. Check for that case before calling fs_bio_integrity_free in iomap_bio_read_folio_range_sync to avoid a NULL pointer dereferences. Make the branch cover the PI verification as well - while fs_bio_integrity_verify works without an integrity payload, it requires one to actually do useful work. Fixes: 0b10a370529c ("iomap: support T10 protection information") Cc: stable@vger.kernel.org # v7.1 Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Anuj Gupta <anuj20.g@samsung.com> Reviewed-by: Kanchan Joshi <joshi.k@samsung.com> Reviewed-by: "Darrick J. Wong" <djwong@kernel.org> Link: https://patch.msgid.link/20260804124404.737145-2-hch@lst.de Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-08-12super: fix dying superblock warning messagesKarl Mehltretter
WARN_ON_ONCE() takes a condition, not a message. The string literals are always true, so the warnings still trigger but the messages are never printed. Use WARN_ONCE(1, ...) instead to print the messages and keep the once-only behavior. Found with a Coccinelle script. Clang's -Wstring-conversion also flags such calls but is not enabled in kernel builds. Fixes: f0cd988016f6 ("fs: massage locking helpers") Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Link: https://patch.msgid.link/20260808123802.73687-1-kmehltretter@gmail.com Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-08-12docs: fix grammatical error in iomap docsBenjamin Wu
Change "This origins" -> "The origins" Signed-off-by: Benjamin Wu <benjamin.wu37@gmail.com> Link: https://patch.msgid.link/20260810063704.355933-1-benjamin.wu37@gmail.com Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-08-11Merge tag 'sunxi-clk-for-7.3' of ↵Stephen Boyd
https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into clk-allwinner Pull Allwinner clk driver updates from Chen-Yu Tsai: Some cleanups to the Allwinner clock driver library and support for the Allwinner A733 RTC clocks added. * tag 'sunxi-clk-for-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: clk: sunxi-ng: sun6i-rtc: add a733 support clk: sunxi-ng: sun6i-rtc: split main oscillator div and gate clk: sunxi-ng: div: add read-only operation support clk: sunxi-ng: mux: fix determine helper rate propagation clk: sunxi-ng: mux: remove unneeded export clk: sunxi-ng: sun6i-rtc: Add feature bit for IOSC calibration clk: sunxi-ng: sun6i-rtc: clean up DT usage clk: sunxi-ng: fix ccu probe clock unregister on error dt-bindings: rtc: sun6i: add sun60i-a733 support dt-bindings: rtc: sun6i: no clock-output-names on h616/r329
2026-08-11Merge tag 'qcom-clk-for-7.3' of ↵Stephen Boyd
https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into clk-qcom Pull Qualcomm clk driver updates from Bjorn Andersson: Add global, TCSR, RPMh, and video clock controller support for Maili. Add global, RPM, GPU, display, and audio core clock controller support for Shikra. Add display and graphics clock controllers for Nord. Add Glymur camera and EVA clock controllers, the IPQ9650 REFGEN clocks, and Hawi video clock controller support. Extend the IPQ5210 APSS PLL and RPM clock support for Agatti. Enable runtime PM and regulator-backed reference clock handling where needed. Update QCM2290 clock and power-domain handling, critical clock definitions, and arm architecture Kconfig defaults. Correct MDM9607, MSM8916, MSM8939, SM6115, QCS8300, Kaanapali, and Glymur clock and power-domain handling. Improve GDSC error propagation and teardown. Update bindings for the added controllers and required power and OPP properties. * tag 'qcom-clk-for-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (94 commits) clk: qcom: Add support for Qualcomm GPU Clock Controller on Shikra clk: qcom: Return expected ENOMEM error on dynamic allocation failure clk: qcom: apss-ipq-pll: Add IPQ5210 support dt-bindings: clock: qcom,a53pll: Add IPQ5210 compatible clk: qcom: Add support for videocc driver on Qualcomm Maili SoC dt-bindings: clock: qcom: Add Qualcomm Maili video clock controller dt-bindings: clock: qcom: Add Qualcomm Shikra GPU clock controller dt-bindings: clock: qcom: Add Qualcomm Shikra Display clock controller clk: qcom: gpucc-qcm2290: Park RCG's clk source at XO during disable clk: qcom: gpucc-qcm2290: Keep the critical clocks always-on from probe clk: qcom: gpucc-qcm2290: Move to the latest common qcom_cc_probe() model clk: qcom: gpucc-qcm2290: Drop pm_clk handling clk: qcom: qcm2290: Update DISPCC and GPUCC GDSC *wait_val values clk: qcom: qcm2290: Add RETAIN_FF_ENABLE flag for DISPCC and GPUCC GDSCs clk: qcom: qcm2290: Set POLL_CFG_GDSCR flag for DISPCC and GPUCC GDSCs clk: qcom: dispcc-qcm2290: Enable runtime PM support clk: qcom: dispcc-qcm2290: Move to the latest common qcom_cc_probe() model clk: qcom: gcc-qcm2290: Keep the critical clocks always-on from probe dt-bindings: clock: qcom,qcm2290-dispcc: Add missing power-domains property clk: qcom: Add Audio Core clock controller support on Qualcomm Shikra SoC ...
2026-08-11Merge tag 'samsung-clk-7.3' of ↵Stephen Boyd
https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into clk-samsung Pull Samsung SoC clk driver updates from Krzysztof Kozlowski: - Exynos990: Add few missing clocks and correct the gate clock parents in the PERIS clock controller. - Cleanup - Use kzalloc_flex for __counted_by checks in Samsung clk driver. * tag 'samsung-clk-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: clk: samsung: pll: use kzalloc_flex clk: samsung: cpu: use kzalloc_flex clk: samsung: use kzalloc_flex clk: samsung: exynos990: Fix PERIS gate clock parents clk: samsung: exynos990: Add PERIS TMU_SUB_PCLK gate dt-bindings: clock: exynos990: Add CLK_GOUT_PERIS_TMU_SUB_PCLK
2026-08-11Merge tag 'v7.3-rockchip-clk1' of ↵Stephen Boyd
https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into clk-rockchip Pull Rockchip clk driver updates from Heiko Stuebner: - Clock driver for Rockchip RV1106 - Fix for Rockchip rk3576 spi source mux - Better representing fractional PLL coefficients in Rockchip clk driver - Fix for the Rockchip dclk of the 3rd video-port to not affect other compoents when its rate gets changed * tag 'v7.3-rockchip-clk1' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: clk: rockchip: rk3576: fix source muxes for SPI0..SPI4 clk: rockchip: Add clock controller for the RV1106 dt-bindings: clock: rockchip: Add RV1106 CRU support clk: rockchip: Fractional PLL coefficient on RK3588/RK3576 is two's complement clk: rockchip: Fix the fractional part denominator on RK3588/RK3576 PLLs clk: rockchip: rk3588: Allow VP2 the same sourcing options as other VPs clk: rockchip: rk3588: Don't change PLL rates when setting dclk_vop2_src
2026-08-12clk: at91: Read "reg" with helperRob Herring (Arm)
The "reg" property is an address-sized DT cell property. The AT91 compat clock parser only uses a small bus id from it, but reading it with the u8 helper does not match the property encoding. Use of_property_read_reg() so the code goes through the helper for "reg" properties, then keep the existing range check before passing the bus id to the clock registration code. Assisted-by: Codex:gpt-5-5 Signed-off-by: Rob Herring (Arm) <robh@kernel.org> Reviewed-by: Brian Masney <bmasney@redhat.com> Link: https://patch.msgid.link/20260612215251.1888345-1-robh@kernel.org Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>