summaryrefslogtreecommitdiff
path: root/include
AgeCommit message (Collapse)Author
2026-08-10xdrgen: Share void RPC procedure handlers across programsChuck Lever
The generated server-side decoder and encoder for a void procedure argument or result are named after the RPC program (for example, nfs_svc_decode_void). xdrgen derives that prefix from the program name alone, not the version, so two versions of one program built into the same module emit the identical symbol. NFSv2 and NFSv3 both declare program NFS_PROGRAM; once both are converted, fs/nfsd fails to link with multiple definitions of nfs_svc_decode_void and nfs_svc_encode_void. A void handler carries no program- or version-specific behavior: each merely forwards to xdrgen_decode_void() or xdrgen_encode_void(). Define one shared pair, xdrgen_svc_decode_void() and xdrgen_svc_encode_void(), in the xdrgen builtins, and stop the program generator from emitting a per-program void handler. lockd is the one in-tree consumer that already emits per-program void handlers, so regenerate the NLMv3 and NLMv4 XDR code to drop nlm_svc_{decode,encode}_void() and nlm4_svc_{decode,encode}_void() and point both procedure tables at the shared handlers. The shared handlers are identical to the generated ones they replace, so no wire behavior changes. Only the server (svc) handlers are affected. The client-side void stubs remain static and per-program, so they do not collide. Link: https://patch.msgid.link/20260712193122.116845-3-cel@kernel.org Signed-off-by: Chuck Lever <cel@kernel.org>
2026-08-10xdrgen: Emit a blank line ahead of enum declarationsChuck Lever
Clean up. The declaration templates for structs, pointers, and typedefs each begin with a blank line, which keeps successive declarations and the include block above them visually separated. The enum declaration template omits that blank line. trim_blocks collapses the template's lone comment line to nothing, so the omission stayed invisible as long as every generated header happened to lead with a non-enum declaration. Fixes: 4329010ad9c3 ("xdrgen: Address some checkpatch whitespace complaints") Link: https://patch.msgid.link/20260712193122.116845-2-cel@kernel.org Signed-off-by: Chuck Lever <cel@kernel.org>
2026-08-10sunrpc: derive the pool count instead of caching it in sv_nrpoolsJeff Layton
Now that the pool mode is always pernode, svc_serv.sv_nrpools is redundant with sv_is_pooled: an unpooled service always has a single pool, and a pooled service has svc_pool_map.npools pools (which is one on a single-node host). sv_nrpools cannot distinguish an unpooled service from a pooled service that happens to have one pool, so it is sv_nrpools, not sv_is_pooled, that carries no unique information. Replace the cached field with a svc_serv_nrpools() helper that derives the count from sv_is_pooled and the pool map, and convert all readers to it. svc_pool_map is file-local to svc.c, so export the helper for the svc_xprt.c and nfsd callers. Reading svc_pool_map.npools without svc_pool_map_mutex is safe: the mutex protects only svc_pool_map.count, and npools is already read locklessly in svc_pool_for_cpu(). A pooled service holds a map reference for its whole lifetime, so npools is stable while any reader could observe it. The hot path (svc_pool_for_cpu()) already dereferences svc_pool_map for to_pool, and npools shares that cacheline, so there is no new locking or coherence cost. __svc_create() keeps using its local npools argument for the sv_pools[] allocation, since sv_is_pooled is not set until svc_create_pooled() has returned from it. Doing this also removes a modulus operation from svc_pool_for_cpu(), which should make for more efficient RPC queueing. Assisted-by: Claude:claude-opus-4-8 Suggested-by: NeilBrown <neilb@ownmail.net> Signed-off-by: Jeff Layton <jlayton@kernel.org> Link: https://patch.msgid.link/20260706-sunrpc-pool-mode-v5-5-6c4ee7cd89aa@kernel.org Signed-off-by: Chuck Lever <cel@kernel.org>
2026-08-10lockd: Regenerate NLMv4 XDR codeChuck Lever
The checked-in NLMv4 xdrgen output predates the addition of enum value validation to generated decoders. As a result the decoders for fsh4_mode, fsh4_access, and nlm4_stats still accept any 32-bit value, while the current generator rejects values outside the enumeration. Resync the generated files with the in-tree xdrgen by regenerating from the unchanged nlm4.x specification. This is a plain regeneration with no specification change; it also refreshes the recorded specification modification time to show that all existing enum decoders have picked up the xdrgen tool fix. Reviewed-by: Jeff Layton <jlayton@kernel.org> Link: https://patch.msgid.link/20260630155638.874492-1-cel@kernel.org Signed-off-by: Chuck Lever <cel@kernel.org>
2026-08-10nfs_common: add new NOTIFY4_* flags proposed in RFC8881bisJeff Layton
RFC8881bis adds some new flags to GET_DIR_DELEGATION that later patches will consume. In particular, Linux nfsd can't easily provide info about directory cookies and ordering. The new flags allow it to omit that information. There is some risk here -- RFC8881bis is still a working group document, and has been for years. The changes to directory delegations have been stable for the last year or so however, so the hope is that those parts won't change (much). Signed-off-by: Jeff Layton <jlayton@kernel.org> Link: https://patch.msgid.link/20260616-dir-deleg-v7-3-6cbc7eac0ade@kernel.org Signed-off-by: Chuck Lever <cel@kernel.org>
2026-08-10nfsd: add protocol support for CB_NOTIFYJeff Layton
Add the necessary bits to nfs4_1.x and remove the duplicate definitions from nfs4.h and the uapi nfs4 header. Regenerate the xdr files. Note that regenerating these files caused conflicts with the definitions of NFS4_VERIFIER_SIZE and NFS4_FHSIZE in include/uapi/linux/nfs4.h. These constants are defined by the RFC, and are not part of the kernel API. They have been removed. Userspace consumers who require those constants should plan to get them from more authoritative sources. The nfsstat4 enum defined in the .x is fed to the xdrgen-generated wire encoder and decoder, which treat every enumerated value as legal on the wire. Do not carry the NFS4ERR_FIRST_FREE sentinel (which is not a protocol error code) into the .x; keeping it would make 10097 a value that could leak onto the wire. Instead base nfsd's internal error codes (NFSERR_EOF and friends) at an impossible nfsstat4 value, as lockd does for its nlm__int__* status codes. Signed-off-by: Jeff Layton <jlayton@kernel.org> Link: https://patch.msgid.link/20260616-dir-deleg-v7-2-6cbc7eac0ade@kernel.org Signed-off-by: Chuck Lever <cel@kernel.org>
2026-08-10lockd, nfsd: RCU-protect nlmsvc_ops dispatchJeff Layton
nlmsvc_ops is published by nfsd_lockd_init() and cleared by nfsd_lockd_shutdown() with plain stores, while lockd dereferences it unguarded from dispatch sites in fs/lockd/svcsubs.c. The pointer targets nfsd's .rodata and the fopen/fclose callbacks live in nfsd's .text, so a stale load after rmmod nfsd results in either a NULL deref or a module-text use-after-free. Declare nlmsvc_ops as __rcu, publish via rcu_assign_pointer(), clear via RCU_INIT_POINTER() + synchronize_rcu(). Add a struct module *owner field to nlmsvc_binding and pin the module across indirect calls with try_module_get/module_put. When the binding is torn down, fall back to fput() to avoid leaking struct file references. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Jeff Layton <jlayton@kernel.org> Link: https://patch.msgid.link/20260611-nfsd-testing-v2-16-5b90e276f2d9@kernel.org Signed-off-by: Chuck Lever <cel@kernel.org>
2026-08-10SUNRPC: Add svc_serv_maxthreads() to report the thread ceilingChuck Lever
A pooled RPC service sizes its threads dynamically, growing and shrinking each pool between its minimum and maximum bounds as load varies. The count of running threads therefore reflects recent demand, not the service's capacity. A consumer that sizes a data structure against the concurrency the service can sustain -- NFSD's NFSv4 session slot tables, for one -- needs that stable ceiling, and computing it means summing sp_nrthrmax across every pool. Add svc_serv_maxthreads() so the summation, and its dependence on the layout of struct svc_serv and struct svc_pool, stays within sunrpc. The read is lock-free: pool maxima change only when a service is reconfigured, a path callers already serialize against startup and shutdown, so a racing reader observes at worst a transient value. This is acceptable for the sizing heuristics that will consume it. nfsd_nrthreads() already sums sp_nrthrmax across pools by hand; convert it to svc_serv_maxthreads(), giving the new export an in-tree consumer and removing a copy of the dependence on svc_serv internals. Reviewed-by: NeilBrown <neil@brown.name> Reviewed-by: Jeff Layton <jlayton@kernel.org> Reviewed-by: Benjamin Coddington <bcodding@hammerspace.com> Link: https://patch.msgid.link/20260610-nfsd-slot-growth-clamp-v1-1-7b966700df0b@kernel.org Signed-off-by: Chuck Lever <cel@kernel.org>
2026-08-10SUNRPC: close backchannel before destroying callback serviceChuck Lever
A backchannel receive can complete a request while the NFS callback service is being torn down. xprt_complete_bc_request() removes the request from bc_pa_list, drops bc_alloc_count, marks the request in use, and then asks xprt_enqueue_bc_request() to hand it to the callback service. If teardown has already cleared xprt->bc_serv, xprt_enqueue_bc_request() currently returns without enqueueing or freeing the committed request. The xprt_get() taken on entry is leaked as well. If the producer wins the race before bc_serv is cleared, it can also enqueue onto sv_cb_list after nfs_callback_down() has stopped the callback threads, leaving the request linked to a svc_serv that is about to be freed. Close the producer side before callback threads are stopped. Add xprt_svc_shutdown_bc() to clear xprt->bc_serv under bc_pa_lock, and call it on callback shutdown and callback-start failure before stopping the service threads. Requests that lose the NULL transition in xprt_enqueue_bc_request() are released through the normal backchannel free path after balancing bc_slot_count. Finally, drain any remaining sv_cb_list requests after the callback threads have stopped and before svc_destroy() frees the service. Fixes: 441244d4273a ("SUNRPC: cleanup common code in backchannel request") Fixes: 9e9fdd0ad0fb ("NFSv4.1: protect destroying and nullifying bc_serv structure") Cc: stable@vger.kernel.org Signed-off-by: Chris Mason <clm@meta.com> Reviewed-by: Jeff Layton <jlayton@kernel.org> Link: https://patch.msgid.link/20260528-tier2-v1-6-d026a1415e0b@oracle.com Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
2026-08-10netfilter: nft_ct: move custom expectation support to helperPablo Neira Ayuso
Originally, the ct expectation support called nf_ct_helper_ext_add() for confirmed conntracks, which is invalid, triggering a splat. This was fixed by commit 1710eb913bdc ("netfilter: nft_ct: skip expectations for confirmed conntrack") which restricted it to unconfirmed conntracks. However, early insertion of expectations into the expectations list when the conntrack is unconfirmed leads to stale entries pointing to the wrong hlist_head through .pprev due to ct extension reallocation. Commit 7c9664351980 ("netfilter: move nat hlist_head to nf_conn") moved the nat hlist_head to nf_conn for this reason: 1. ... 2. When reallocation of extension area occurs we need to fixup the bysource hash head via hlist_replace_rcu. I'd rather not increase the size of the struct nf_conn for this feature has very limited scope: only one expectation can be created at a time given expect_clash() will make nf_ct_expect_related() reports EBUSY. For this reason, relax nf_ct_expect_related() not to drop packets in case expectation creation fails, therefore, expectation creation becomes best effort. To address this issue, add an internal ct helper and attach it to the conntrack entry to streamline the custom ct expectation support with existing ct helpers. Expose a new nf_conntrack_helper_release() function to release the internal helper that is allocated and attached to the conntrack entry to create the custom expectations. The nft_ct module removal always waits for rcu grace period, then the NULL helper callback is observed after this. This patch also restricts the creation of expectations to different helpers other than this custom helper that is created for this type of expectations. Fixes: 857b46027d6f ("netfilter: nft_ct: add ct expectations support") Reported-by: Jaeyeong Lee <iostreampy@proton.me> Link: https://patch.msgid.link/20260715144755.00ea7dfcd9f@proton.me Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2026-08-10netfilter: flowtable: rename tun.l3_proto to tun.inner_protoPablo Neira Ayuso
This field refers to the inner protocol that is encapsulated by the tunnel header, just a comestic change. No functional changes are expected. Acked-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2026-08-10net: netfilter: add ether_type to net_device_path_ctx and use itPablo Neira Ayuso
Add an ether_type field to struct net_device_path_ctx to reject IPv4 over IPv6 and vice-versa, this is currently not support. Otherwise, incorrect dst_entry family can be reached from datapath. Acked-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2026-08-10net: pass net_device_path_ctx to dev_fill_forward_path()Lorenzo Bianconi
Refactor dev_fill_forward_path() to take a struct net_device_path_ctx pointer instead of a (dev, daddr) pair, so the caller can build and populate the context up front and keep it after the forward path walk. This allows additional fields (e.g. vlan and ether_type) to be carried in the context and shared with ndo_fill_forward_path implementations, instead of being reconstructed on the stack inside the core helper. Update the mtk_ppe_offload, airoha_ppe and nf_flow_table_path callers to allocate and fill the context before invoking dev_fill_forward_path(). The network topology resolution behaviour is unchanged. This is a preliminary patch to enable HW flowtable offload for IPv4 over IPv6 tunnels. Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@oss.qualcomm.com> Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2026-08-10netfilter: add DEBUG_NET_WARN_ON_ONCE to skb_set_nfct()Pablo Neira Ayuso
Trigger a warning if nf_ct_set() overlaps an existing ct object leading to refcount leak. Add this warning to skb_set_nfct() whose only user is nf_ct_set() instead. Update existing nf_ct_set() callers to use nf_reset_ct() first to clean up stale pointer to conntrack object which migh trigger false positive warnings. Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2026-08-10Merge tag 'thermal-v7.3-rc1' of ↵Rafael J. Wysocki
ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/thermal/linux Pull thermal driver updates for 7.3-rc1 from Daniel Lezcano: "- Move thermal_zone_device_enable() to the right place in order to prevent calling it if the thermal zone registration failed (Dan Carpenter) - Improve bitfield manipulations on Armada (Bryan B. Lima) - Remove unneeded 'fast_io' on Sun8i and Armada (Wolfram Sang) - Fix wrong boundary when clamping the low values in the set_trips() callback and fix wrong mask when setting the temperature interval on Airoha (Christian Marangi) - Make use of the regmap API in order to support the Airoha AN7583 (Christian Marangi) - Fix adc_tm5_get_temp() return check value on the QCom SPMI ADC sensor (Rakesh Kota) - Fix unbalanced clock enablement when the resume fails on the iMX driver (Can Peng) - Add Qualcomm Master BandGap thermal monitor support (Satya Priya Kakitapalli) - Add Maili Temperature bindings compatible (Haritha S K) - Add a devm action to clean hardware interrupts, sampling, and control registers on Spacemit K1 (Pei Xiao) - Fix trivial typo in an OF code comment (Marek Vasut) - Remove unecessary print on Qcom SPMI ADC driver when a call to devm_request_threaded_irq() fails as this one already prints a message (Jishnu Prakash) - Add support for QCom PMIC5 Gen3 ADC by using auxialiary driver and shared interrupt with the IIO driver (Jishnu Prakash) - Make resets optional on MT8196 and add the corresponding property in the DT bindings (AngeloGioacchino Del Regno) - Fix clock staying enabled with the resume operation fails on Qoriq (Can Peng) - Fix wrong closing brace position in thermal library header (Andreas Haufler) - Fix low and high trip point validation by moving the check after the clamp on the spacemit driver (surendra) - Remove redundant error messages on IRQ request failure (Pan Chuang) * tag 'thermal-v7.3-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/thermal/linux: (26 commits) thermal/drivers: Remove redundant error messages on IRQ request failure thermal/drivers/spacemit: Validate clamped trip thresholds tools/lib/thermal: Fix misplaced extern "C" closing brace thermal/drivers/qoriq: Disable clock on resume failure thermal/drivers/mediatek/lvts_thermal: Make reset optional for MT8196 dt-bindings: thermal: mediatek: Make resets optional for MT8196 thermal/drivers/qcom: add support for PMIC5 Gen3 ADC thermal monitoring iio: adc: qcom-spmi-adc5-gen3: Share SDAM0 IRQ with ADC_TM auxiliary driver iio: adc: qcom-spmi-adc5-gen3: Remove an unnecessary print thermal/of: Fix trivial enabled typo thermal/drivers/spacemit/k1: Add shutdown action and reorder registration order dt-bindings: thermal: qcom-tsens: Document the Maili Temperature Sensor thermal/drivers/qcom: Add support for Qualcomm MBG thermal monitoring dt-bindings: thermal: Add Qualcomm MBG thermal monitor support thermal/drivers/imx: Disable clock on runtime resume failure thermal/drivers/qcom-spmi-adc-tm5: Drop IIO_VAL_INT check in adc_tm5_get_temp thermal/drivers/airoha: Add support for AN7583 Thermal Sensor dt-bindings: arm: airoha: Add the chip-scu node for AN7583 SoC thermal/drivers/airoha: Generalize get_thermal_ADC and set_mux function thermal/drivers/airoha: Generalize probe function ...
2026-08-10Merge branch 'acpi-video'Rafael J. Wysocki
Merge updates related to the ACPI video bus driver for 7.3-rc1: - Introduce helper function acpi_dev_is_video_device() and use it in the core ACPI device enumeration code, in the ACPI video bus driver, in the ACPI support code for I2C, in the PCI VGA driver, and in the x86 platform thinkpad_acpi driver (Andy Shevchenko) - Add a quirk to use the native backlight on Acer Nitro AN515-46 to the ACPI video bus driver (Marcos Paulo Medeiros) - Release PCI device reference after lookup in video_detect_portege_r100() in the ACPI video bus driver (Yuho Choi) * acpi-video: ACPI: video: Release PCI device reference after lookup ACPI: video: force native backlight on Acer Nitro AN515-46 platform/x86: thinkpad_acpi: Convert to use acpi_dev_is_video_device() helper PCI/VGA: Convert to use acpi_dev_is_video_device() helper i2c: acpi: Convert to use acpi_dev_is_video_device() helper ACPI: video: Convert to use acpi_dev_is_video_device() helper ACPI: scan: Convert to use acpi_dev_is_video_device() helper ACPI: utils: Introduce acpi_dev_is_video_device() helper
2026-08-10Merge branches 'acpi-scan', 'acpi-pci', 'acpi-tad' and 'acpi-apei'Rafael J. Wysocki
Merge an ACPI device enumeration core code update, ACPI support updates related to PCI, an ACPI Time and Alarm Device (TAD) driver update and ACPI APEI updates for 7.3-rc1: - Avoid registering platform devices with resource overlaps in the ACPI core device enumeration code (Rafael Wysocki) - Clear driver_data on all paths that free acpi_pci_root in acpi_pci_root_add() (Chen Pei) - Simplify acpi_get_pci_dev() with the help of a mutex guard, introduce acpi_dev_get_pci_dev() for code that has a struct ACPI device for which it wants to get the struct pci_dev pointer of the associated PCI device, and use it in the ACPI video bus driver (Rafael Wysocki) - Avoid printing confusing _OSC messages for non-PCIe host bridges without _OSC which is a valid configuration (Kazuma Kondo) - Add locking around evaluation of ACPI control methods in the ACPI TAD driver to avoid race conditions (Rafael Wysocki) - Handle repeated SEA error storms in APEI (Junhao He) - Fix ERST timeout unit conversion in APEI (Nirmoy Das) - Fix ARM section length accounting after header in the ACPI APEI GHES driver (TanZheng) - Mark ghes_in_nmi_spool_from_list() as maybe unused (Rui Qi) * acpi-scan: ACPI: scan: Avoid registering platform devices with resource overlaps * acpi-pci: ACPI: PCI: Avoid misleading _OSC messages for non-PCIe host bridges without _OSC ACPI: video: Use acpi_dev_get_pci_dev() instead of acpi_get_pci_dev() ACPI: video: Drop backlight parent device reference later ACPI: PCI: Introduce acpi_dev_get_pci_dev() ACPI: PCI: Use a mutex guard to simplify acpi_get_pci_dev() ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root * acpi-tad: ACPI: TAD: Add locking around AML evaluations * acpi-apei: ACPI: APEI: Handle repeated SEA error storms ACPI: APEI: Fix ERST timeout unit conversion ACPI: APEI: GHES: fix ARM section length accounting after header ACPI: APEI: GHES: Mark ghes_in_nmi_spool_from_list() as maybe unused
2026-08-10preempt: Introduce HAS_SEPARATE_PREEMPT_RESCHED_BITSBoqun Feng
With the changes that enable preempt count to track IRQ disabling nesting, we don't have enough bits in 32-bit preempt count implementation, as a result we move NMI nesting bits out of the 32-bit preempt count. However on the architectures that can support 64-bit preempt count implementation, we can keep the NMI nesting bits in the 32-bit preempt count and avoid maintaining NMI nesting bits outside of the same cache line. Therefore HAS_SEPARATE_PREEMPT_RESCHED_BITS is introduced to allow architectures to select this. Note that under this Kconfig, preempt count is maintained in a 64-bit word however preempt_count() still remains as an int because all the effective bits still fit in (previously we mask out NEED_RESCHED bit in preempt_count()). This should make no functional changes for existing preempt_count() users. Enable this for x86_64 along with the introduction of the Kconfig. [boqun: Undo the __preempt_count_{add,sub}() optimization in 32-bit preempt count since it may introduce {over,under}flow] Originally-by: Peter Zijlstra <peterz@infradead.org> Signed-off-by: Boqun Feng <boqun@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://patch.msgid.link/20260804161447.84806-11-boqun@kernel.org
2026-08-10sched: Remove the unused preempt_offset parameter of __cant_sleep()Boqun Feng
The preempt_offset is always 0 in all the callsites of __cant_sleep(), hence remove it. It also allows us to clear up the code a bit by no longer using a "preempt_count() > .." comparison. Signed-off-by: Boqun Feng <boqun@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://patch.msgid.link/20260804161447.84806-9-boqun@kernel.org
2026-08-10locking: Switch to _irq_{disable,enable}() variants in cleanup guardsBoqun Feng
The semantics of various IRQ disabling guards match what *_irq_{disable,enable}() provide, i.e. the interrupt disabling is properly nested, therefore it's OK to switch to use *_irq_{disable,enable}() primitives. [boqun: Adjust the user-side changes in do_sched_cfs_*_timer() provided by Peter and Lyude] Signed-off-by: Boqun Feng <boqun@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://patch.msgid.link/20260804161447.84806-8-boqun@kernel.org
2026-08-10irq,spin_lock: Add counted interrupt disabling/enablingBoqun Feng
Currently the nested interrupt disabling and enabling is represented by _irqsave() and _irqrestore() APIs, which are relatively unsafe, for example: <interrupts are enabled as beginning> spin_lock_irqsave(l1, flag1); spin_lock_irqsave(l2, flag2); spin_unlock_irqrestore(l1, flags1); <l2 is still held but interrupts are enabled> // accesses to interrupt-disable protected data will cause races This is even easier to trigger with guard facilities: unsigned long flag2; scoped_guard(spin_lock_irqsave, l1) { spin_lock_irqsave(l2, flag2); } // l2 locked but interrupts are enabled. spin_unlock_irqrestore(l2, flag2); (Hand-to-hand locking critical sections are not uncommon for a fine-grained lock design) And because of this unsafety, Rust cannot easily wrap the interrupt-disabling locks in a safe API, which complicates the design. To resolve this, introduce a new set of interrupt disabling APIs: * local_interrupt_disable(); * local_interrupt_enable(); They work like local_irq_save() and local_irq_restore() except that 1) the outermost local_interrupt_disable() call saves the interrupt state into a per-CPU variable, so that the outermost local_interrupt_enable() can restore the state, and 2) a per-CPU counter is added to record the nest level of these calls, so that interrupts are not accidentally enabled inside the outermost critical section. Also add the corresponding spin_lock primitives: spin_lock_irq_disable() and spin_unlock_irq_enable(), as a result, code as follows: spin_lock_irq_disable(l1); spin_lock_irq_disable(l2); spin_unlock_irq_enable(l1); // Interrupts are still disabled. spin_unlock_irq_enable(l2); doesn't have the issue that interrupts are accidentally enabled. This also makes the wrapper of interrupt-disabling locks on Rust easier to design. [boqun: Apply Peter's feedback and fix spell errors reported by Ingo] [boqun: Address the duplicate spin_acquire() spotted by sashiko] Co-developed-by: Lyude Paul <lyude@redhat.com> Signed-off-by: Lyude Paul <lyude@redhat.com> Signed-off-by: Boqun Feng <boqun@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://patch.msgid.link/20260804182657.87716-1-boqun@kernel.org
2026-08-10Merge tag 'zynqmp-soc-for-7.3' of https://github.com/Xilinx/linux-xlnx into ↵Arnd Bergmann
soc/drivers arm64: Xilinx SOC changes for 7.3 firmware: - Feature check improvements - Clean up firmware and EL3 state on kexec soc: - Remove redundant dev_err() * tag 'zynqmp-soc-for-7.3' of https://github.com/Xilinx/linux-xlnx: firmware: xilinx: Clear firmware notifiers across kexec transitions firmware: xilinx: Release all peripheral devices from firmware firmware: xilinx: Add support to clear EL3 PM state firmware: xilinx: Propagate actual error from feature check firmware: xilinx: Use TF-A feature check for TF-A-specific APIs soc: xilinx: Remove redundant dev_err() Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-08-10crypto: af_alg - Replace 'bool privileged' with flagsEric Biggers
It isn't obvious what false/true mean at the definition sites, so let's replace it with flags instead. Also flip the polarity to make the default zero-initialized value be the secure (privileged-only) value. Signed-off-by: Eric Biggers <ebiggers@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-08-10crypto: ecdsa - Fix typo in function documentationPaul Louvel
Fix the misspelling of 'validate' in crypto_ecdh_shared_secret() and ecc_is_pubkey_valid_partial() documentation. Signed-off-by: Paul Louvel <paul.louvel@bootlin.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-08-10crypto: ccp - don't abuse kernel-doc comment formatRandy Dunlap
Use plain C "/*" notation for comments that are not in kernel-doc format to avoid kernel-doc warnings: Warning: include/uapi/linux/psp-sfs.h:18 expecting prototype for SFS(). Prototype was for PAYLOAD_NAME_SIZE() instead Warning: include/uapi/linux/psp-sfs.h:46 This comment starts with '/**', but isn't a kernel-doc comment. * Seamless Firmware Support (SFS) IOC Fixes: 648dbccc03a0 ("crypto: ccp - Add AMD Seamless Firmware Servicing (SFS) driver") Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Acked-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-08-10Merge tag 'soc_fsl-7.3-1' of ↵Arnd Bergmann
https://git.kernel.org/pub/scm/linux/kernel/git/chleroy/linux into soc/drivers FSL SOC Changes for 7.3 Freescale QUICC Engine: - Use generic I/O helpers in interrupt controller for IO Ports - Move CONFIG_QE_GPIO out of powerpc - Fix DT scan for GPIO nodes - Convert IO ports interrupt controller to generic IRQ chip - Add support of IRQs in GPIO controller - Implement get_direction() in GPIO controller - Check platform_driver_register() in interrupt controller for IO Ports Data Path I/O: - Replace maintainer - Remove redundant dev_err() - Fix kernel-doc typos Freescale Management Complex: - Use strscpy() to copy strings into arrays - Remove redundant dev_err() - Drop unused assignment of acpi_device_id::driver_data Other changes: - Add kernel and device tree binding support for RCW override, completing the SerDes PHY driver functionality - Fix kernel-doc warnings and typos in DPAA header * tag 'soc_fsl-7.3-1' of https://git.kernel.org/pub/scm/linux/kernel/git/chleroy/linux: (31 commits) bus: fsl-mc: drop unused assignment of acpi_device_id::driver_data soc: fsl: qe: check platform_driver_register() in qe_ic_of_init() phy: lynx-10g: use RCW override procedure for dynamic protocol change soc: fsl: guts: implement the RCW override procedure dt-bindings: fsl: layerscape-dcfg: define DCFG_DCSR region soc: fsl: guts: make fsl_soc_data available after fsl_guts_init() soc: fsl: guts: make it easier to determine on which SoC we are running soc: fsl: guts: add a central fsl_guts_read() function soc: fsl: guts: add a global structure to hold state soc: fsl: guts: use a macro to encode the DCFG CCSR space soc: fsl: guts: perform fsl_guts_init() error teardown in reverse order of setup soc: fsl: dpio: fix kernel-doc typos soc: fsl: fix kernel-doc warnings and typos bus: fsl-mc: Remove redundant dev_err() soc: fsl: qe: Add support of IRQs in QE GPIO soc: fsl: qe: Rename irq variable to parent_irq soc: fsl: qe: Convert to generic IRQ chip soc: fsl: qe: Handle spurious interrupts soc: fsl: qe: Iterate over all pending interrupts in cascade handler soc: fsl: qe: Use generic_handle_domain_irq() ... Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-08-10iommu/vt-d: Support the new DMA_REMAP_OPT_OUT flag bitKevin Tian
Some BIOS already provides config options to expose/hide VT-d units as a whole to/from system software. A new demand is to allow exposing VT-d units but requesting system software to disable DMA remapping while sustaining interrupt remapping. This can be communicated now by setting the new DMA_REMAP_OPT_OUT flag bit in the DMAR table, as introduced in VT-d spec v5.2 (section 8.1, DMA Remapping Reporting Structure). Introduce a new off policy (DMAR_FW_OFF) for DMA_REMAP_OPT_OUT. As the strongest off policy, it cannot be overridden by user opts or any force_on types. If tboot is enabled in the meantime, kernel will panic. It is user responsibility to configure BIOS properly. One cleanup is left for future - the DMAR flag is parsed multiple times, in detect_intel_iommu(), dmar_platform_optin() (which can be called at run-time), etc. Caching it is a cleaner way. Signed-off-by: Kevin Tian <kevin.tian@intel.com> Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com> Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
2026-08-10Merge tag 'qcom-drivers-for-7.3-2' of ↵Arnd Bergmann
https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/drivers More Qualcomm driver updates for v7.3 Add SMEM parsing for DDR configuration data and use its highest bank address bit to select the appropriate UBWC configuration. Enable generic PAS trusted-zone APIs for the Iris and Venus media drivers. Fix SCM probe retry state, reserved-memory cleanup, and an early IRQ-handler NULL dereference. Enable QSEECOM EFI variable access on the Asus Zenbook A16. Correct GENI firmware-size validation using the hardware CFG RAM depth and correct the PMIC GLINK Thunderbolt extradata layout. Document the Nord AOSS side channel and the IMEM minidump SRAM property. Clean up Qualcomm statistics macros and the WCNSS binding schema. * tag 'qcom-drivers-for-7.3-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: media: qcom: Switch to generic PAS TZ APIs dt-bindings: soc: qcom,aoss-qmp: Document Nord AOSS side channel dt-bindings: sram: qcom,imem: Add minidump-sram pattern property soc: qcom: qcom_stats: Replace CLIENT_VOTES_OFFSET macro with sizeof() soc: qcom: qcom_stats: Remove unused macro definitions soc: qcom: ubwc: Get HBB from SMEM soc: qcom: smem: Expose DDR data from SMEM soc: qcom: smem: Use 'unsigned int' instead of 'unsigned' firmware: qcom: scm: Fix tzmem state on probe retry firmware: qcom: scm: Fix reserved memory cleanup on probe failure firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is published firmware: qcom: scm: Allow QSEECOM on Asus Zenbook A16 (UX3607OA) soc: qcom: geni-se: Use HW PROG_RAM_DEPTH to validate firmware size soc: qcom: pmic_glink_altmode: Define the TBT extradata properly dt-bindings: soc: qcom,wcnss: Drop redundant $ref of firmware-name property Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-08-10rseq: Prevent hard lockup on granted time slice extensionNiels Pressel
__exit_to_user_mode_loop() invokes rseq_grant_timeslice_extension() with interrupts enabled. If the extension is granted it invokes hrtimer_rearm_deferred_tif() to ensure that a pending deferred hrtimer rearm is handled before exiting to user space. Though this invokes __hrtimer_rearm_deferred() which expects to be invoked with interrupts disabled as it takes hrtimer_cpu_base::lock with raw_spin_lock(). That's a livelock waiting to happen and caught by lockdep: WARNING: ./include/linux/hrtimer_rearm.h:17 at irqentry_exit, CPU#1: slice_test WARNING: inconsistent lock state inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage. Prevent this by disabling interrupts around the invocation of hrtimer_rearm_deferred_tif() in rseq_grant_timeslice_extension(). [ tglx: Massaged change log ] Fixes: 15dd3a948855 ("hrtimer: Push reprogramming timers into the interrupt return path") Signed-off-by: Niels Pressel <npressel@ethz.ch> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260802124423.51616-1-npressel@ethz.ch
2026-08-10firmware: xilinx: Clear firmware notifiers across kexec transitionsJay Buddhabhatti
During a kexec restart, only the kernel is reloaded but notifier callbacks in firmware persist, causing state mismatches between kernel and firmware. To address this, introduce PM_ALL_NOTIFIERS node ID to unregister all notifier callbacks during kexec. On a graceful kexec restart, this occurs in zynqmp_firmware_shutdown(). On a crash kernel restart, it happens in zynqmp_firmware_probe() in the reloaded kernel. Unregistering all notifiers depends on firmware support for the PM_ALL_NOTIFIERS node ID. On firmware that does not implement it (the feature check reports a version below PM_API_VERSION_3) the step is skipped and a warning such as "Firmware doesn't support unregister all notifiers at once" is logged, e.g. on Versal NET firmware that predates this API. Signed-off-by: Jay Buddhabhatti <jay.buddhabhatti@amd.com> Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com> Reviewed-by: Prasanna Kumar T S M <ptsm@linux.microsoft.com> Link: https://patch.msgid.link/20260729122522.3732875-4-jay.buddhabhatti@amd.com Signed-off-by: Michal Simek <michal.simek@amd.com>
2026-08-10firmware: xilinx: Release all peripheral devices from firmwareJay Buddhabhatti
During a kexec restart, only the kernel is reloaded while devices allocated in firmware persist, causing state mismatches between the kernel and firmware. Introduce PM_DEV_ALL_PERIPH node ID (0x18224FFFU) to release all peripheral devices during kexec. On graceful restarts, this happens in zynqmp_firmware_shutdown(). On crash kernel restarts, it happens in zynqmp_firmware_probe() of the reloaded kernel. Releasing all peripherals depends on firmware support for the PM_DEV_ALL_PERIPH node ID. On firmware that does not implement it (the feature check reports a version below PM_API_VERSION_3) the release is skipped and a warning such as "Bulk device release is not supported by firmware" is logged, e.g. on Versal NET firmware that predates this API. Signed-off-by: Jay Buddhabhatti <jay.buddhabhatti@amd.com> Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com> Reviewed-by: Prasanna Kumar T S M <ptsm@linux.microsoft.com> Link: https://patch.msgid.link/20260729122522.3732875-3-jay.buddhabhatti@amd.com Signed-off-by: Michal Simek <michal.simek@amd.com>
2026-08-10firmware: xilinx: Add support to clear EL3 PM stateJay Buddhabhatti
Currently, during a kexec restart, only the kernel is reloaded, while EL3-specific data remain unchanged. This leads to a mismatch between the kernel state and secure firmware state like SGI number and shutdown scope variable. For example, the kernel registers an SGI number with EL3 firmware so that secure firmware can notify the kernel of events via that SGI. EL3 stores this SGI number in its internal state. After a kexec, the newly loaded kernel re-registers and may request a different SGI number, but the stale value programmed in EL3 remains, so event notifications are delivered on the old SGI and are missed by the new kernel. The shutdown scope variable has a similar stale state problem. To resolve this, the TF_A_CLEAR_PM_STATE PM API is introduced to clear EL3 PM subsystem state during kexec. On a graceful reboot, this API is triggered by zynqmp_firmware_shutdown(), while in a crash kernel scenario, it is invoked by zynqmp_firmware_probe() in the reloaded kernel. Signed-off-by: Jay Buddhabhatti <jay.buddhabhatti@amd.com> Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com> Reviewed-by: Prasanna Kumar T S M <ptsm@linux.microsoft.com> Link: https://patch.msgid.link/20260729122522.3732875-2-jay.buddhabhatti@amd.com Signed-off-by: Michal Simek <michal.simek@amd.com>
2026-08-10fonts: fixup font.h kernel-doc warningsRandy Dunlap
Use the typedef keyword when describing a typedef. Add the missing function return value for font_glyph_size(). Warning: include/linux/font.h:84 cannot understand function prototype: 'typedef const unsigned char font_data_t;' Warning: include/linux/font.h:53 No description found for return value of 'font_glyph_size' Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Cc: stable@vger.kernel.org # v7.1+ Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-10Merge tag 'drm-rust-next-2026-08-08' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/rust/kernel into drm-next DRM Rust changes for v7.3-rc1 - I/O (shared from driver-core tree via signed tag rust-io-7.3-rc1): - Rework of I/O types: make I/O regions typed (with a dynamically-sized Region type for the existing untyped case), create view types representing subregions of a mapped I/O region, and add io_project!() for safely creating subviews. - Split Io into a base trait (IoBase) and an extension trait (Io) with a blanket implementation, preventing implementers from overriding provided methods that unsafe code relies on. - Add a SysMem backend for shared system memory with volatile access, and make Coherent implement Io via an I/O view type. Add copying methods (memcpy_{from,to}io). - Replace dma_read!/dma_write! with io_read!/io_write!; drop the old macros. - DRM: - RegistrationGuard and RegistrationData: - Rework DeviceContext typestates: rename Uninit to Normal, add an Ioctl context, restrict AlwaysRefCounted to Normal for both Device and GEM Object, and establish a Deref chain from Registered to Normal. - Introduce RegistrationGuard, a guard representing a drm_dev_enter/exit SRCU critical section that proves the DRM device is registered, which implies the parent bus device is still bound. - Add RegistrationData as a GAT on drm::Driver. The data does not outlive driver unbind, so it can capture lifetime-annotated device resources and references. Accessible through the guard via a closure with HRTB lifetime. - Wrap ioctl dispatch in RegistrationGuard (returning ENODEV if unplugged) and pass registration data to handlers. - Add Driver::ParentDevice associated type. - Fix unbounded lifetimes in ioctl handler arguments. - Fix a race in drm_dev_register() where a partial failure allowed in-flight ioctls to proceed while the error path tore down resources. - GEM shmem: add DmaResvGuard helper, vmap functions, and sg_table() accessor. - GPUVM: require Send + Sync for the driver's associated data, implement Send and Sync for GpuVaAlloc and GpuVmBo, add SmContext lifetime bound, update DriverGpuVm for DeviceContext. - Nova: - nova-core / nova-drm cross-crate dependency: - Build nova-core and nova-drm from drivers/gpu/Makefile for build ordering, export nova-core Rust symbols for nova-drm. Workaround until the build system supports Rust cross-crate dependencies natively. - GSP boot process consolidation: - Introduce GspBootContext to bundle common boot parameters, replacing per-argument threading. Separate context and GPU lifetimes to support mutable borrows of GPU subdevices. - Turn FWSEC execution into a HAL method, make FWSEC bootloader usage a property of the TU102 HAL (GA102+ gets its own instance with it disabled). Move firmware file selection to the GSP HAL. - Store the Fsp instance in Gpu (lifetime tied to the GPU, not just a single boot invocation). Move GSP state and unload bundle into a pinned subobject for reliable teardown on partial init failure. - Boot GSP with vGPU enabled: - Add PRC (Product Reconfiguration Control) protocol to query device configuration from the FSP. Read vGPU mode, detect and store vGPU state. - Set RMSetSriovMode registry entry and reserve the larger WPR2 heap required when vGPU is enabled. - Build SetRegistry entries dynamically. - TLV firmware image format: - Add a TLV (type-length-value) parser for the new firmware image format. TLV files use unversioned filenames with a .tlv suffix, start with "NVFW" magic, and contain tagged blocks with 4-byte aligned payloads. - Transition all firmware loading (booter, gsp, gen_bootloader, fsp) to TLV images. - Note: this requires a development firmware not in linux-firmware [1]; this is temporary and serves the transition to r615. - Hopper/Blackwell fixes and cleanups: - Correct FRTS vidmem offset calculation, split FbLayout into FSP and non-FSP versions, fix Blackwell flush address composition, use absolute FBHUB0 flush registers on Blackwell, use correct sysmem flush registers on Hopper. - Harden FSP messaging: limit receive allocation size, catch bogus queue pointers, ensure DMA allocation lifetimes for FMC boot and LibOS, wait for RISC-V HALTED on unload. - I/O projection adoption: - Use io_project!() for PTE array, message queues, and Falcon DMA transfer bounds checking. - Misc: - Keep unloading if FWSEC-SB fails during Turing/Ampere GSP reset. - Don't declare booter firmware for FSP chipsets. - Fix packed registry table size. - Extract and display usable FB regions from GSP. - Store bar and dev directly in Falcon, simplifying the API. - Parse VBIOS structs via zerocopy. - Convert to kernel bitfield macro, remove local one. - Move register definitions into sub-modules. - Add FSP and PRC protocol documentation. - Tyr: - Firmware loading and MCU boot: - Add a generic slot manager for dynamically allocating limited hardware slots to software seats, with lazy eviction under contention. - Add MMU support wrapping the slot manager for address-space slot allocation, with MAIR-to-MEMATTR translation. - Add GPU virtual memory (VM) support using drm_gpuvm with ARM64 LPAE Stage 1 page tables and 4KB/2MB page sizes. - Add a kernel buffer object type for internal driver allocations. - Add a parser for the Mali CSF firmware binary format. - Add MCU booting: load, parse, and map firmware sections into VM, then boot the MCU at probe(). - Cross-subsystem: - Add faux::Device type with AsBusDevice support. Allow retrieving a bound Device from a Registration. - Add device lifetime to IoPageTable. - Add Vec::zeroed method. - Add firmware::request_into_buf() to load firmware into a caller-provided buffer. - Rename dma_handle to dma_address in the DMA abstraction. - Change pci_sriov_get_totalvfs() return type to unsigned int; add Rust helper. [1] https://github.com/ttabi/linux-firmware-nova Signed-off-by: Dave Airlie <airlied@redhat.com> From: "Danilo Krummrich" <dakr@kernel.org> Link: https://patch.msgid.link/DKJQQUOS0PVO.3JPR3MYK4PDVZ@kernel.org
2026-08-10Merge tag 'v7.2-rc7' into driver-core-nextDanilo Krummrich
We need the driver-core fixes in here as well to build on top of. Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-08-09Input: elan_i2c - use device-id/acpi.h for ACPI IDsLonglong Xia
elan-i2c-ids.h only needs struct acpi_device_id from the ACPI device ID definitions. The MODULE_DEVICE_TABLE() user already includes <linux/module.h>. Include <linux/device-id/acpi.h> instead of the broader <linux/mod_devicetable.h> header. Assisted-by: Codex:GPT-5 Signed-off-by: Longlong Xia <xialonglong@kylinos.cn> Link: https://patch.msgid.link/20260809142928.4031270-1-xialonglong2025@163.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-08-09KVM: PPC: Introduce KVM_CAP_PPC_COMPAT_CAPS and wire up ioctlAmit Machhiwal
Introduce a new capability and ioctl to expose CPU compatibility modes supported by the host processor for nested guests. On IBM POWER systems, newer processor generations (N) can operate in compatibility modes corresponding to earlier generations, like (N-1) and (N-2). This is particularly relevant for nested virtualization, where nested KVM guests may need to run with a specific processor compatibility level. Introduce KVM_CAP_PPC_COMPAT_CAPS capability and the corresponding KVM_PPC_GET_COMPAT_CAPS vm ioctl. The ioctl returns a bitmap describing the compatibility modes supported by the host in respective bit numbers, allowing userspace (e.g., QEMU) to select an appropriate compatibility level when configuring nested KVM guests. The ioctl handling is added in kvm_arch_vm_ioctl() and retrieves host CPU compatibility capabilities via a PowerPC-specific backend implementation when available. The struct kvm_ppc_compat_caps places the 'size' field first so it can be read alone via get_user() before copy_struct_from_user() is called, avoiding pointer arithmetic to locate the size field. The ioctl is defined using _IO so the ioctl number remains stable even if the struct grows in future versions. It uses copy_struct_from_user() and copy_struct_to_user() to provide forward- and backward-compatible extensibility: older userspace passing a smaller struct to a newer kernel gets zero-padded trailing fields. Newer userspace passing a larger struct to an older kernel (usize > ksize) succeeds if trailing bytes are zero (the kernel reports back min(usize, ksize) as the filled size); if trailing bytes are non-zero, the kernel writes back ksize into host_caps.size and returns -E2BIG so userspace can retry with the correct size. KVM_PPC_COMPAT_CAPS_SIZE_VER0 is defined as a frozen integer constant (24) marking the size of the initial struct version, used as the minimum floor for size field validation, similar to other versioned struct interfaces in the kernel. The 'flags' field is reserved for future use. The kernel rejects any call where flags is non-zero with -EINVAL, preventing garbage values from being baked into ABI permanently. The ioctl returns appropriate error codes: E2BIG if usize exceeds PAGE_SIZE, or if new userspace provides a larger struct with non-zero trailing bytes (with ksize written back into host_caps.size for the retry); EINVAL for an invalid size or non-zero reserved fields; EFAULT for failed copy operations; and ENOTTY if the backend doesn't implement get_compat_caps. Suggested-by: Vaibhav Jain <vaibhav@linux.ibm.com> Tested-by: Gautam Menghani <gautam@linux.ibm.com> Reviewed-by: Gautam Menghani <gautam@linux.ibm.com> Tested-by: Anushree Mathur <anushree.mathur@linux.ibm.com> Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com> Signed-off-by: Amit Machhiwal <amachhiw@linux.ibm.com> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260808161148.66673-2-amachhiw@linux.ibm.com
2026-08-09Merge tag 'tegra-for-7.3-arm64-dt' of ↵Alexandre Belloni
git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/dt arm64: tegra: Device tree changes for v7.3-rc1 This contains a new device tree for the Lenove ThinkEdge SE70 Edge Client device as well as a number of fixes and cleanups for Tegra234 and Tegra194. Tegra264 sees a number of additions to enable more features. * tag 'tegra-for-7.3-arm64-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: (1469 commits) arm64: tegra: Correct Tegra234 p3740 interrupt flags arm64: tegra: Correct Tegra234 p3737 interrupt flags arm64: tegra: Correct Tegra194 p2972 interrupt flags arm64: tegra: Drop CPU masks from GICv3 PPI interrupts arm64: tegra: Add Lenovo ThinkEdge SE70 device tree arm64: tegra: Add pinctrl nodes for Tegra264 arm64: tegra: Fix CMDQV interrupt type on Tegra264 arm64: tegra: Properly sort devices on Tegra264 arm64: tegra: Add GTE nodes for Tegra264 arm64: tegra: Add Host1x and VIC on Tegra264 arm64: tegra: Populate CPU and L2 cache nodes on Tegra264 arm64: tegra: Enable GPCDMA in Tegra264 and add iommu-map Linux 7.2-rc5 super: fix emergency thaw deadlock on frozen block devices tracing: perf: Fix stale head for perf syscall tracing ftrace: Add global mutex to serialize trace_parser access tracing: Delay module ref count for "enable_event" trigger tracing: Fix use-after-free freeing trigger private data bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() tracing: Fix context switch counter truncation ... Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-08-08Merge tag 'usb-7.2-rc7' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB / Thunderbolt fixes from Greg KH: "Here are some small USB and Thunderbolt driver fixes for 7.2-rc7 that resolve some reported issues. Included in here are: - new quirk for some broken USB devices - thunderbolt device fixes for reported issues - usb gadget driver fix - usb atm driver fix - xhci driver fixes. - other minor USB driver fixes All of these have been in linux-next this week with no reported issues" * tag 'usb-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: usb: xhci: use BIT_ULL for CRCR bits to fix incorrect 64bit mask usb: quirks: Add ShanWan gamepad to quirk list usb: hub: Split announce_device() to log device identity before enumeration usb: core: Add quirk for 255-bytes initial config read usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg usb: gadget: f_ncm: Use unsigned int for ndp_index usb: cdnsp: fix incorrect endian conversions for APB timeout register thunderbolt: Initialize ->domain_released completion before it is being used thunderbolt: icm: Preserve USB4 proxy data-valid bit thunderbolt: Bound the DROM dual link port number before indexing sw->ports thunderbolt: Fix bandwidth group reservation indexing thunderbolt: stream: Unmap buffers with mapped size
2026-08-08Merge tag 'char-misc-7.2-rc7' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char / misc and documentation fixes from Greg KH: "Here are some small char/misc and nvmem and documentation fixes for 7.2-rc7 to resolve some reported issues. Included in here are: - updates to the documentation for the kernel threat model and security bugs to get the LLMs to actually follow what we have been asking them to do (i.e. not claim security issues for things we do not consider security issues.) - nvmem driver fixes which required a tiny "layout" driver to be added. - fastrpc driver fixes - mei driver fix - counter driver fix - binder driver fix All of these have been in linux-next this week with no reported problems" * tag 'char-misc-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: docs: security-bugs: clarify some mandatory steps for AI reports docs: coding-assistant: explain important steps when looking for bugs docs: security-bugs: clarify what counts as a valid version docs: threat-model: move fake devices out of "non production use" docs: threat-model: clarify "security bug" vs "vulnerability" counter: microchip-tcb-capture: Fix DT channel validation mei: pull kvfree out of spinlock rust_binder: do not query current thread for all ioctls nvmem: layouts: Add fixed-layout driver nvmem: apple-spmi-nvmem: wrap regmap calls to satisfy CFI misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free misc: fastrpc: fix channel ctx ref leak when session alloc fails misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke misc: fastrpc: Remove buffer from list prior to unmap operation misc: fastrpc: Fix initial memory allocation for Audio PD memory pool
2026-08-08preempt: Introduce __preempt_count_{sub,add}_return()Boqun Feng
In order to use preempt_count() to track the interrupt disable nesting level, __preempt_count_{add,sub}_return() are introduced, as their names suggest, these primitives return the new value of the preempt_count() after changing it. The following example shows the usage of it in local_interrupt_disable(): // increase the HARDIRQ_DISABLE bit new_count = __preempt_count_add_return(HARDIRQ_DISABLE_OFFSET); // if it's the first-time increment, then disable the interrupt // at hardware level. if ((new_count & HARDIRQ_DISABLE_MASK) == HARDIRQ_DISABLE_OFFSET) { local_irq_save(flags); raw_cpu_write(local_interrupt_disable_state, flags); } Having these primitives will avoid a read of preempt_count() after changing preempt_count() on certain architectures. Signed-off-by: Boqun Feng <boqun@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Acked-by: Heiko Carstens <hca@linux.ibm.com> # s390 Link: https://patch.msgid.link/20260804161447.84806-4-boqun@kernel.org
2026-08-08preempt: Introduce HARDIRQ_DISABLE_BITSBoqun Feng
In order to support preempt_disable()-like interrupt disabling, that is, using part of preempt_count() to track interrupt disabling nesting level, change the preempt_count() layout to contain 8-bit HARDIRQ_DISABLE count. Signed-off-by: Boqun Feng <boqun@kernel.org> Signed-off-by: Lyude Paul <lyude@redhat.com> Signed-off-by: Boqun Feng <boqun@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://patch.msgid.link/20260121223933.1568682-2-lyude@redhat.com Link: https://patch.msgid.link/20260804161447.84806-3-boqun@kernel.org
2026-08-08preempt: Track NMI nesting to separate per-CPU counterJoel Fernandes
Move NMI nesting tracking from the preempt_count bits to a separate per-CPU counter (nmi_nesting). This is to free up the NMI bits in the preempt_count, allowing those bits to be repurposed for other uses. Reduce NMI_BITS from 4 to 1, using it only to detect if we're in an NMI. The per-CPU counter currently caps nesting at 15. [boqun: Address Steven Rostedt's comment on the BUG_ON() condition] [boqun: Use preempt_count_set() in __nmi_exit() to avoid underflow] Suggested-by: Boqun Feng <boqun@kernel.org> Signed-off-by: Joel Fernandes <joelagnelf@nvidia.com> Signed-off-by: Lyude Paul <lyude@redhat.com> Signed-off-by: Boqun Feng <boqun@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://patch.msgid.link/20260121223933.1568682-3-lyude@redhat.com Link: https://patch.msgid.link/20260804161447.84806-2-boqun@kernel.org
2026-08-08KVM: arm64: Make timer_get_offset() work in all contextsMarc Zyngier
We currently have two implementations of get_timer offset(), one in arm_arch_timer.h, and another one in switch.h. These two only differ by a pair of kern_hyp_va(), which seems a pretty weak reason to open-code it. Turn this function into a macro to avoid the include dependency hell on kern_hyp_va(), and make it work correctly in all contexts. Signed-off-by: Marc Zyngier <maz@kernel.org> Signed-off-by: Mostafa Saleh <smostafa@google.com> Link: https://patch.msgid.link/20260808085824.732659-2-smostafa@google.com Signed-off-by: Oliver Upton <oupton@kernel.org>
2026-08-08Merge tag 'qcom-arm64-for-7.3' of ↵Alexandre Belloni
https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/dt Qualcomm Arm64 DeviceTree updates for v7.3 Introduce DeviceTree support for the Shikra SoC, its GCC and RPM clock controllers, CQM, CQS, and IQS SoM platforms, and their evaluation boards. Document the Hawi and Maili SoCs. Add the Eliza CQS SoM and EVK platforms, the QCS8550 RB5 Gen 2, Vicharak Axon Mini, HONOR MagicBook Art 14, Microsoft Surface Pro 12, Xiaomi 12 Lite, Motorola Edge 30, Sony Xperia M2, and Motorola Moto G2 device trees. Extend Eliza support with USB, SD card, touchscreen, PMIC, interconnect, thermal, CPU and LLCC bandwidth-monitor, QUPv3, and ADSP GPR descriptions. Expand Glymur support with GPU, camera and EVA clock controllers, LPASS audio, CoreSight, PCIe, USB, IMEM and PIL memory regions, power domains, thermal cooling, and CRD peripherals. Add SoCCP, PMIC regulator, TRNG, and CPU-capacity descriptions. Add display, IPA, camera, USB, audio, crypto, TRNG, CoreSight, and thermal support to the Kaanapali, Milos, Hamoa, and related platforms. Add embedded controller support for Hamoa and Glymur boards. Improve networking-platform descriptions with IPQ PCIe port, PHY, clock, PWM, regulator, and interrupt updates. Update CTCU, display, Iris, audio, camera, PCIe, USB-C, power-domain, memory-region, and thermal descriptions across established Qualcomm platforms. Correct bindings and DeviceTree validation for Qualcomm compatible strings, legacy fallback compatibles, node naming and formatting, address ranges, clock specifiers, reserved memory, regulators, GPIOs, and peripheral wiring. * tag 'qcom-arm64-for-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (244 commits) arm64: dts: qcom: eliza: Describe the ADSP GPR node arm64: dts: qcom: eliza-evk: Add support for USB and SD card dt-bindings: arm: qcom-soc: Allow WSA88xx speaker compatible dt-bindings: arm: qcom-soc: Validate nodes with fallbacks dt-bindings: arm: qcom-soc: Document more of existing legacy style compatibles dt-bindings: arm: qcom-soc: Include Eliza, Kaanapali and others in SoC names arm64: dts: qcom: eliza: Enable cpufreq cooling devices arm64: dts: qcom: glymur: add SoCCP DT node arm64: dts: qcom: glymur: fix SoCCP memory mappings arm64: dts: qcom: mahua: Add QREF regulator supplies to TCSR arm64: dts: qcom: glymur: Add QREF regulator supplies to TCSR arm64: dts: qcom: glymur: Add CX power domain to GCC arm64: dts: qcom: glymur: Drop fake PCIe phy 3B arm64: dts: qcom: glymur: add TRNG node arm64: dts: qcom: glymur: enable ETR and CTCU devices arm64: dts: qcom: glymur: Add PCIe port compatibles and ports arm64: dts: qcom: smb2370: Disable SMB2370_2 by default arm64: dts: qcom: eliza-mtp: Enable touchscreen arm64: dts: qcom: purwa-iot-som: enable video arm64: dts: qcom: purwa: Override Iris clocks and operating points ... Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-08-08Merge tag 'driver-core-7.2-rc7' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core Pull driver core fixes from Danilo Krummrich: - Fix Rust build failure on s390 by gating ioremap() / iounmap() helpers and the io::mem module on CONFIG_HAS_IOMEM; gate affected doctests as well. - Add missing kernel-doc for show_const / store_const union members in struct device_attribute. * tag 'driver-core-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: rust: io: gate ioremap doctests on CONFIG_HAS_IOMEM rust: io: gate ioremap/iounmap on CONFIG_HAS_IOMEM driver core: add missing kernel-doc for union members
2026-08-08Merge tag 'input-for-v7.2-rc6' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: - Fixes for information leaks and OOB accesses across several drivers, including evdev, focaltech, edt-ft5x06, iforce, and cs40l50-vibra - Improvements to the synaptics-rmi4 driver to properly handle F54 worker errors and prevent buffer overflows - Input validation fixes in the hynitron_cstxxx touchscreen driver to prevent issues with invalid finger IDs and touch counts - Fixes for use-after-free and initialization bugs in the byd mouse and psxpad-spi drivers - New quirks for the atkbd driver to make keyboard work on HONOR and Xiaomi laptops - Support for the ZENAIM LEVERLESS controller in the xpad driver. * tag 'input-for-v7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: evdev - sanitize event type index when fetching event masks Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue Input: synaptics-rmi4 - block s_input when F54 queue is busy Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer Input: synaptics-rmi4 - zero report size on F54 work error Input: synaptics-rmi4 - fix F55 transmitter electrode count typo Input: hynitron_cstxxx - validate touch count and finger IDs Input: evdev - fix information leak in evdev_pass_values() fixp-arith: convert comments to kernel-doc format Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet Input: atkbd - skip deactivate for HONOR ZQC-P Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard Input: iforce - validate input packet lengths Input: psxpad-spi - set driver data before use Input: cs40l50-vibra - validate custom data from user space Input: xpad - add support for ZENAIM LEVERLESS Input: edt-ft5x06 - ignore contacts with an out-of-range slot id Input: byd - synchronize timer deletion before freeing private data
2026-08-08i3c: master: dw-i3c-master: fix OD timing for first broadcastTze Yee Ng
Implement ->set_speed() so the I3C core can switch open-drain timing for the first broadcast address per spec: I3C_OPEN_DRAIN_SLOW_SPEED programs tHIGH_INIT (200 ns) before RSTDAA, and I3C_OPEN_DRAIN_NORMAL_SPEED restores normal OD timing afterward. Cache the normal OD register value during bus init and use a separate od_hcnt for the slow path so SDR extended timing remains derived from the normal PP hcnt. For AMD_I3C_OD_PP_TIMING, cache AMD_I3C_OD_TIMING as the normal OD baseline and stop rewriting OD timing in send_ccc_cmd()/runtime resume so I3C_OPEN_DRAIN_SLOW_SPEED is preserved through RSTDAA. Use PM_RUNTIME_ACQUIRE_AUTOSUSPEND() in set_speed(). Compute od_hcnt with DIV_ROUND_UP_ULL() for 32-bit safety and clamp it to U8_MAX to match the 8-bit I3C_OD_HCNT field. Fixes I2C devices with spike filters not being detected on mixed buses. Signed-off-by: Tze Yee Ng <tze.yee.ng@altera.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/d789219ca0418898a1ef2bf9295b4f96ca7b4209.1785484707.git.tze.yee.ng@altera.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-08-08i3c: master: Add helper to query bus wakeup requirementsAdrian Hunter
Add i3c_master_has_wakeup_enabled_devs(), which iterates over the devices on an I3C bus and reports whether any of them are enabled for system wakeup and have IBI enabled. Controller drivers can use this helper to determine whether wakeup support must remain available while the system is suspended. Acked-by : Mukesh Savaliya <mukesh.savaliya@oss.qualcomm.com> Signed-off-by: Adrian Hunter <adrian.hunter@intel.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260807145638.168865-11-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-08-08i3c: master: Support IBI-based wakeup capabilityAdrian Hunter
An I3C controller acts as a bus controller for one or more I3C devices. If the controller can wake the system in response to an In-Band Interrupt (IBI), then any device on that bus that is capable of generating IBIs can potentially be used as a wakeup source. Add an ibi_wakeup flag to struct i3c_master_controller so controller drivers can advertise support for IBI-based wakeup. If set, mark IBI-capable I3C devices as wakeup capable when they are registered, allowing wakeup management through the standard device wakeup framework. Signed-off-by: Adrian Hunter <adrian.hunter@intel.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Acked-by: Mukesh Savaliya <mukesh.savaliya@oss.qualcomm.com> Link: https://patch.msgid.link/20260807145638.168865-9-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>