github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-28 01:55:51 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
1,446,278 Commits 1 Branch 940 Tags 24 GiB
8c83947c5d
Commit Graph

1446278 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Pierre Gondois
8c83947c5d cpufreq: Use policy->min/max init as QoS request 
Modify cpufreq_policy_init_qos() introduced previously to use
policy->min/max set in the driver .init() callback as the initial
values for the policy min/max frequency QoS requests, respectively,
so long as they are different from 0 (which means that they have
been updated by the driver). Update the documentation in accordance
with that code change.

This only affects the following drivers:

 - gx-suspmod (min)
 - cppc-cpufreq (min)
 - longrun (min/max)

Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
[ rjw: Changelog rewrite ]
Link: https://patch.msgid.link/20260528090913.2759118-5-pierre.gondois@arm.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
 2026-06-08 18:42:14 +02:00
Pierre Gondois
db80ad776c cpufreq: Remove driver default policy->min/max init 
Prior to commit 521223d8b3 ("cpufreq: Fix initialization of min and
max frequency QoS requests"), drivers were setting policy->min/max and
these values were used as initial policy QoS constraints.

After the above commit, these values are only used temporarily, as
cpufreq_set_policy() ultimately overrides them through:

cpufreq_policy_online()
\-cpufreq_init_policy()
  \-cpufreq_set_policy()
    \-/* Set policy->min/max */

A subsequent change will restore the previous behavior allowing
drivers to request special min/max QoS frequencies instead of
FREQ_QOS_MIN_DEFAULT_VALUE and FREQ_QOS_MAX_DEFAULT_VALUE, respectively,
if desired. For instance, the CPPC driver wants to advertise the lowest
non-linear frequency that should be used as the initial minimum
frequency QoS request.

However, for this purpose, all drivers setting policy->min/max to
policy->cpuinfo.min/max_freq, respectively, need to be updated so
their initial policy->min/max settings don't limit the frequency
scaling unnecessarily going forward (which would defeat the purpose
of commit 521223d8b3), so do that.

This does not actually alter the observed behavior of all of
the drivers in question because setting policy->min/max to
policy->cpuinfo.min/max_freq, respectively, is not necessary or
even useful any more after a previous change ("cpufreq: Set default
policy->min/max values for all drivers").

Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Acked-by: Jie Zhan <zhanjie9@hisilicon.com>
[ rjw: Changelog rewrite ]
Link: https://patch.msgid.link/20260528090913.2759118-4-pierre.gondois@arm.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
 2026-06-08 18:42:14 +02:00
Pierre Gondois
743a3cddb1 cpufreq: Set default policy->min/max values for all drivers 
Some drivers set policy->min/max in their .init() callback, but
cpufreq_set_policy() will ultimately override them through:

cpufreq_policy_online()
\-cpufreq_init_policy()
  \-cpufreq_set_policy()
    \-/* Set policy->min/max */

Thus the policy min/max values set by the drivers are only temporary.

There is an exception if CPUFREQ_NEED_INITIAL_FREQ_CHECK is set and
cpufreq_policy_online() calls __cpufreq_driver_target() which invokes
cpufreq_driver->target().

To prepare for a subsequent change that will remove all initialization
of policy->min/max in driver .init() callbacks if the min/max value is
equal to the corresponding cpuinfo.min/max_freq, set default
policy->min/max values in the core for all drivers.

Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Reviewed-by: Jie Zhan <zhanjie9@hisilicon.com>
[ rjw: Edits of the new comment and changelog ]
Link: https://patch.msgid.link/20260528090913.2759118-3-pierre.gondois@arm.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
 2026-06-08 18:42:14 +02:00
Pierre Gondois
70fa8a1860 cpufreq: Extract cpufreq_policy_init_qos() function 
Extract the QoS-related logic from cpufreq_policy_online()
to make that function shorter/simpler.

The logic is placed in cpufreq_policy_init_qos() and is
now executed right after the following calls:

 - cpufreq_driver->init()
 - cpufreq_table_validate_and_sort()

This facilitats subsequent changes that will, in
cpufreq_policy_init_qos():

 - Set a default policy->min/max value for all policies.
 - Use the policy->min/max values set by drivers as initial request
   values for policy frequency QoS requests.

No functional change.

Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Reviewed-by: Jie Zhan <zhanjie9@hisilicon.com>
[ rjw: Changelog edits ]
Link: https://patch.msgid.link/20260528090913.2759118-2-pierre.gondois@arm.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
 2026-06-08 18:42:14 +02:00
Pengjie Zhang
03120e1425 cpufreq: Documentation: fix conservative governor freq_step description 
The conservative governor documentation incorrectly states that setting
freq_step to 0 will use the default 5% frequency step. In reality, since
at least commit 8e677ce83b ("[CPUFREQ] conservative: fixup governor to
function more like ondemand logic"), freq_step=0 has always caused the
governor to skip frequency updates entirely.

Correct the documentation to reflect the actual behavior: freq_step=0
disables frequency changes by the governor entirely.

Fixes: 2a0e492798 ("cpufreq: User/admin documentation update and consolidation")
Signed-off-by: Pengjie Zhang <zhangpengjie2@huawei.com>
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
[ rjw: Subject adjustment ]
Link: https://patch.msgid.link/20260603055635.1549943-1-zhangpengjie2@huawei.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
 2026-06-08 15:32:19 +02:00
Rafael J. Wysocki
11efcfc295 CPUFreq arm updates for 7.2 
- Add cpufreq scaling support for Qualcomm Shikra SoC (Taniya Das, and
   Imran Shaik).
 
 - Minor fixes for cpufreq drivers (Krzysztof Kozlowski, Akashdeep Kaur,
   Hans Zhang, Guangshuo Li, and Xueqin Luo).
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEx73Crsp7f6M6scA70rkcPK6BEhwFAmomWYMACgkQ0rkcPK6B
 EhypdRAAnIHddDVfbl8mqMSVENcQrMBAgdSw4Foh6DcOfP2Nxu9+KSPR3xbFbNsy
 AxHc8M/merdjsHcuvA/03D/BgCzcpI80mb70k0u88LDneH7KbWbRMZ4nHFVzBui1
 CUV/LZ17q8RRlNCNKySAZAK+jGeLMh4KIGK15RCZn0hv+KsinFQkKyER7EgqZANA
 7TydPpwoQZakTh+YDJb27l2Cls/JXWZABuQbNtJIo1/SRBGnNQVpn+bEaYxhdeta
 G5OJrBw3i6fV0xfOEGQfwRy9qGr308qFvJEqoIJs0A/uBcY47TsYEYu/XHZfI5+C
 k8froLZIuClrHNEn+rAzS5n0PJTrp+bKaYMKCT31dDeOEB5KRMU0e/2Cj20dbjrz
 HB/2qufhhwR3C8W5N3l8POWvJJFUVABDO6N8vgOkp2qQYPdZmxKviTMcgKOYe0CA
 Z4DszH6DlwT9etP4lS4gv5rt8JmIdxFxSOrL6tYT2wVbpkA63H8wXIlKnob8wm5K
 CrQvUhSoxPqoHcKRd6RCSeOBDguVcpos9vgp8I6Mzdh4dVNvZRkKerJIJq+SBffw
 /SQhuBeireFMmDxoXb2nbKbQ05CNP4LM3AK35CLwu3Gz3Hm1o4m+IuoCmyZJkKAM
 pXcPQCZ2Es60sfkDXKLNSepQ3ux7d++TFIt0FcviyYTXICWnVVk=
 =hVKd
 -----END PGP SIGNATURE-----

Merge tag 'cpufreq-arm-updates-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm

Pull CPUFreq Arm updates for 7.2 from Viresh Kumar:

"- Add cpufreq scaling support for Qualcomm Shikra SoC (Taniya Das, and
   Imran Shaik).

 - Minor fixes for cpufreq drivers (Krzysztof Kozlowski, Akashdeep Kaur,
   Hans Zhang, Guangshuo Li, and Xueqin Luo)."

* tag 'cpufreq-arm-updates-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm:
  cpufreq: ti: Add EPROBE_DEFER for K3 SoCs
  cpufreq: qcom: Add cpufreq scaling support for Qualcomm Shikra SoC
  dt-bindings: cpufreq: Document Qualcomm Shikra SoC EPSS
  cpufreq: cppc: mask Desired_Excursion when autonomous selection is enabled
  cpufreq: qcom-cpufreq-hw: Fix possible double free
  cpufreq: apple-soc: Use FIELD_MODIFY()
  cpufreq/amd-pstate: Use FIELD_MODIFY()
  cpufreq: qcom: Unify user-visible "Qualcomm" name
 2026-06-08 14:55:31 +02:00
Akashdeep Kaur
b7a76f38ef cpufreq: ti: Add EPROBE_DEFER for K3 SoCs 
On K3 SoCs, ti-cpufreq relies on k3-socinfo to register the SoC
device before soc_device_match() can return valid revision
information. If ti-cpufreq probes before k3-socinfo,
soc_device_match() returns NULL, leading to incorrect CPU frequency
scaling behavior.

Add a needs_k3_socinfo flag to ti_cpufreq_soc_data (similar to
the existing multi_regulator pattern) to defer probe when k3-socinfo
hasn't registered the SoC device yet.

Signed-off-by: Akashdeep Kaur <a-kaur@ti.com>
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
 2026-06-08 11:16:42 +05:30
Taniya Das
4b5d3b8472 cpufreq: qcom: Add cpufreq scaling support for Qualcomm Shikra SoC 
The Qualcomm Shikra cpufreq hardware is functionally identical to EPSS,
but supports only up to 12 frequency lookup table (LUT) entries. When all
12 entries are populated, the existing repetitive LUT entry check may read
beyond valid entries and expose incorrect frequencies. Hence, introduce
shikra_epss_soc_data that reuses EPSS configuration with appropriate LUT
entries limit.

Signed-off-by: Taniya Das <taniya.das@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Imran Shaik <imran.shaik@oss.qualcomm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
 2026-06-08 10:58:07 +05:30
Imran Shaik
ef92354d0e dt-bindings: cpufreq: Document Qualcomm Shikra SoC EPSS 
The Qualcomm Shikra cpufreq hardware is functionally identical to EPSS,
but supports only up to 12 frequency lookup table (LUT) entries. Introduce
Shikra specific bindings to represent this constrained EPSS variant.

Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Imran Shaik <imran.shaik@oss.qualcomm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
 2026-06-08 10:58:07 +05:30
Rafael J. Wysocki
f02504316b Merge back earlier cpufreq material for 7.2 2026-05-29 14:39:36 +02:00
Zhongqiu Han
24fc587080 cpufreq: governor: Fix stale prev_cpu_nice spike when enabling ignore_nice_load 
When ignore_nice_load is toggled from 0 to 1 via sysfs, dbs_update() may
run concurrently and observe the new tunable value while prev_cpu_nice
still holds a stale baseline, producing a spurious massive idle_time that
results in an incorrect CPU load value.

The race can be illustrated with two concurrent paths:

Path A (sysfs write, holds attr_set->update_lock):

governor_store()
  mutex_lock(&attr_set->update_lock)
  ignore_nice_load_store()
    dbs_data->ignore_nice_load = 1              /* (A1) */
    gov_update_cpu_data(dbs_data)
      mutex_lock(&policy_dbs->update_mutex)     /* (A2) */
        j_cdbs->prev_cpu_nice = kcpustat_field(...)
      mutex_unlock(&policy_dbs->update_mutex)
  mutex_unlock(&attr_set->update_lock)

Path B (work queue, wins the race between A1 and A2):

dbs_work_handler()
  mutex_lock(&policy_dbs->update_mutex)         /* acquired before A2 */
  dbs_update()
    ignore_nice = dbs_data->ignore_nice_load    /* sees new value: 1 */
    cur_nice = kcpustat_field(...)
    idle_time += div_u64(cur_nice - j_cdbs->prev_cpu_nice, ..) /* stale */
    j_cdbs->prev_cpu_nice = cur_nice
  mutex_unlock(&policy_dbs->update_mutex)

Fix this by unconditionally sampling cur_nice and advancing prev_cpu_nice
in dbs_update() on every call, regardless of ignore_nice. With
prev_cpu_nice always reflecting the most recent sample, enabling
ignore_nice_load can never produce a stale-baseline spike: the delta will
always be the nice time accumulated in the last sampling interval, not
since boot. The additional kcpustat_field() call per CPU per sample is
negligible given that the sampling path already reads idle and load
accounting.

To keep prev_cpu_nice handling consistent with the always-tracking
semantics introduced above:

  - gov_update_cpu_data() unconditionally resets prev_cpu_nice alongside
    prev_cpu_idle, so both baselines share the same timestamp when
    io_is_busy changes.  This prevents an interval mismatch between
    idle_time and nice_delta on the next dbs_update() when
    ignore_nice_load is enabled.
  - cpufreq_dbs_governor_start() unconditionally initializes prev_cpu_nice
    so the baseline is always valid from the first dbs_update() call;
    remove the ignore_nice guard and the now-unused ignore_nice variable.

Fixes: ee88415caf ("[CPUFREQ] Cleanup locking in conservative governor")
Fixes: 5a75c82828 ("[CPUFREQ] Cleanup locking in ondemand governor")
Fixes: 326c86deae ("[CPUFREQ] Remove unneeded locks")
Signed-off-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Link: https://patch.msgid.link/20260419132655.3800673-3-zhongqiu.han@oss.qualcomm.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
 2026-05-26 19:06:14 +02:00
Zhongqiu Han
91f5d69847 cpufreq: governor: Fix data races on per-CPU idle/nice baselines 
gov_update_cpu_data() resets per-CPU prev_cpu_idle for every CPU in the
governed domain, and conditionally resets prev_cpu_nice when
ignore_nice_load is set. It is called from sysfs store callbacks
(e.g. ignore_nice_load_store) which run under attr_set->update_lock,
held by the surrounding governor_store().

Concurrently, dbs_work_handler() calls gov->gov_dbs_update() (which calls
dbs_update()) under policy_dbs->update_mutex. dbs_update() both reads and
writes the same prev_cpu_idle / prev_cpu_nice fields. The potential race
path is:

Path A (sysfs write, holds attr_set->update_lock only):

  governor_store()
    mutex_lock(&attr_set->update_lock)
    ignore_nice_load_store()
      dbs_data->ignore_nice_load = input
      gov_update_cpu_data(dbs_data)
        list_for_each_entry(policy_dbs, ...)
          for_each_cpu(j, ...)
            j_cdbs->prev_cpu_idle = get_cpu_idle_time(...)  /* write */
            j_cdbs->prev_cpu_nice = kcpustat_field(...)     /* write */
    mutex_unlock(&attr_set->update_lock)

Path B (work queue, holds policy_dbs->update_mutex only):

  dbs_work_handler()
    mutex_lock(&policy_dbs->update_mutex)
    gov->gov_dbs_update(policy)
      dbs_update()
        for_each_cpu(j, policy->cpus)
          idle_time = cur - j_cdbs->prev_cpu_idle           /* read  */
          j_cdbs->prev_cpu_idle = cur_idle_time             /* write */
          idle_time += cur_nice - j_cdbs->prev_cpu_nice     /* read  */
          j_cdbs->prev_cpu_nice = cur_nice                  /* write */
    mutex_unlock(&policy_dbs->update_mutex)

Because attr_set->update_lock and policy_dbs->update_mutex are two
completely independent locks, the two paths are not mutually exclusive.
This results in a data race on cpu_dbs_info.prev_cpu_idle and
cpu_dbs_info.prev_cpu_nice.

Fix this by also acquiring policy_dbs->update_mutex in
gov_update_cpu_data() for each policy, so that path A participates in
the mutual exclusion already established by dbs_work_handler(). Also
update the function comment to accurately reflect the two-level locking
contract.

Additionally, cpufreq_dbs_governor_start() initializes prev_cpu_idle
using io_busy read from dbs_data->io_is_busy without holding
policy_dbs->update_mutex.  A concurrent io_is_busy_store() can update
io_is_busy and call gov_update_cpu_data(), which writes prev_cpu_idle
with the new value under the mutex.  cpufreq_dbs_governor_start() then
overwrites prev_cpu_idle with the stale io_busy value, leaving the
baseline inconsistent with the tunable.  Fix this by reading io_busy
inside the mutex.

The root of this race dates back to the original ondemand/conservative
governors. Before commit ee88415caf ("[CPUFREQ] Cleanup locking in
conservative governor") and commit 5a75c82828 ("[CPUFREQ] Cleanup
locking in ondemand governor"), all accesses to prev_cpu_idle and
prev_cpu_nice in cpufreq_governor_dbs() (path X), store_ignore_nice_load()
/io_is_busy_store() (path Y), and do_dbs_timer() (path Z) were serialised
by the same dbs_mutex, so no race existed. Those two commits switched
do_dbs_timer() from dbs_mutex to a per-policy/per-cpu timer_mutex to
reduce lock contention, but left path Y (store) still holding dbs_mutex.
As a result, path Y (store) and path Z (do_dbs_timer) no longer shared a
common lock, introducing a potential race on prev_cpu_idle/prev_cpu_nice
between path Y (store) and dbs_check_cpu().

Commit 326c86deae ("[CPUFREQ] Remove unneeded locks") then removed
dbs_mutex from store_ignore_nice_load()/io_is_busy_store() entirely,
introducing an additional potential race between path Y (now lockless)
and cpufreq_governor_dbs() (path X, still holding dbs_mutex), while the
race between path Y and path Z remained.

Fixes: ee88415caf ("[CPUFREQ] Cleanup locking in conservative governor")
Fixes: 5a75c82828 ("[CPUFREQ] Cleanup locking in ondemand governor")
Fixes: 326c86deae ("[CPUFREQ] Remove unneeded locks")
Signed-off-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Link: https://patch.msgid.link/20260419132655.3800673-2-zhongqiu.han@oss.qualcomm.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
 2026-05-26 19:06:14 +02:00
K Prateek Nayak
df488cac61 cpufreq/amd-pstate-ut: Disable dynamic_epp after the mode switch 
Dan reported a possible NULL pointer dereference in amd-pstate-ut.c from
static analysis and sure enough, running amd-pstate-ut in active mode
with amd_dynamic_epp=enable results in a crash as a reult of the policy
reference being set to NULL early, before disabling dynamic EPP.

Kalpana also reported seeing amd-pstate-ut error out with -EBUSY for
"amd_pstate_ut_epp" test when starting from the passive mode and
amd_dynamic_epp=enable in the command line. The reason for the failure
is that the command line enables dynamic_epp by default after the mode
switch and the modifications to EPP values are blocked when running in
dynamic EPP mode.

Solution to both problems is to toggle off dynamic_epp *after* the mode
switch when the driver grabs the policy reference again since the unit
test is in full control of the policy after that point.

The final restoration step will reset the dynamic_epp state via mode
switch based on the initial conditions of the system.

Reported-by: Kalpana Shetty <kalpana.shetty@amd.com>
Reported-by: Dan Carpenter <error27@gmail.com>
Closes: https://lore.kernel.org/linux-pm/ahEq0CvdBX0T7_cO@stanley.mountain/
Fixes: f9f16835d4 ("cpufreq/amd-pstate-ut: Drop policy reference before driver switch")
Signed-off-by: K Prateek Nayak <kprateek.nayak@amd.com>
Link: https://patch.msgid.link/20260523055503.7651-1-kprateek.nayak@amd.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
 2026-05-26 12:39:28 +02:00
Linus Torvalds
e7ae89a0c9 Linux 7.1-rc5 2026-05-24 13:48:06 -07:00
Linus Torvalds
6a97c4d526 Arm: 
- Fix ITS EventID sanitisation when restoring an interrupt translation
   table.
 
 - Fix PPI memory leak when failing to initialise a vcpu.
 
 - Correctly return an error when the validation of a hypervisor trace
   descriptor fails, and limit this validation to protected mode only.
 
 RISC-V:
 
 - Fix invalid HVA warning in steal-time recording
 
 - Return SBI_ERR_FAILURE to guest upon OOM in pmu_event_info()
   and pmu_snapshot_set_shmem()
 
 - Fix NULL pointer dereference in SBI v0.1 SEND_IPI handler
 
 - Fix sign extension of value for MMIO loads
 
 s390:
 
 - Fix bugs in vSIE (nested virtualization) and UCONTROL, caused by the page
   table rewrite.
 
 x86:
 
 - Apply erratum #1235 workaround (disable AVIC IPI virtualization) on Hygon
   Family 18h, just like on AMD Family 17h.
 
 - When KVM_CAP_X86_APIC_BUS_CYCLES_NS is queried on a specific VM, return
   the VM's configured APIC bus frequency instead of the default.  This
   is less confusing (read: not wrong) and makes it easier to fill in CPUID
   information that communicates the APIC bus frequency to the guest.
 
 Selftests:
 
 - Do not include glibc-internal <bits/endian.h>; it worked by chance and
   broke building KVM selftests with musl.
 -----BEGIN PGP SIGNATURE-----
 
 iQFIBAABCgAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmoSp6cUHHBib256aW5p
 QHJlZGhhdC5jb20ACgkQv/vSX3jHroPgswgAiO5Gi7d6dIspG7e41g5fF2Wq5Rnq
 1nB7ZV+CqT0k1fvFe4hBrc2c+DLzFn+h3/fj+4scVF4oAN9YRauIq/2xlGWR23bR
 gsFncJ2w6TAKLN3MvCh1SpO+GI7kcnTs7HtJ6weDkddbGEtUIgkUZkwEYnEN4t6T
 pgO7USGFbBBXY575UO/xMeLkfyABzJlLjQbKrvG6RKtEsKAxzTxcPtjQegtHYH4Q
 6DLGif4YUB0ZWMQETccl/bKqU6L+OQgDUOSUoHWt+2ox0DLDwiy7VVf3infecXsJ
 r3PGKn709nlrd+hBn2S9gCbT/BCxp828k2DxSasZ7PQ8634O+qrpLLkODw==
 =VWgs
 -----END PGP SIGNATURE-----

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

Pull kvm fixes from Paolo Bonzini:
 "arm64:

   - Fix ITS EventID sanitisation when restoring an interrupt
     translation table.

   - Fix PPI memory leak when failing to initialise a vcpu.

   - Correctly return an error when the validation of a hypervisor trace
     descriptor fails, and limit this validation to protected mode only.

  RISC-V:

   - Fix invalid HVA warning in steal-time recording

   - Return SBI_ERR_FAILURE to guest upon OOM in pmu_event_info() and
     pmu_snapshot_set_shmem()

   - Fix NULL pointer dereference in SBI v0.1 SEND_IPI handler

   - Fix sign extension of value for MMIO loads

  s390:

   - Fix bugs in vSIE (nested virtualization) and UCONTROL, caused by
     the page table rewrite.

  x86:

   - Apply erratum #1235 workaround (disable AVIC IPI virtualization) on
     Hygon Family 18h, just like on AMD Family 17h.

   - When KVM_CAP_X86_APIC_BUS_CYCLES_NS is queried on a specific VM,
     return the VM's configured APIC bus frequency instead of the
     default. This is less confusing (read: not wrong) and makes it
     easier to fill in CPUID information that communicates the APIC bus
     frequency to the guest.

  Selftests:

   - Do not include glibc-internal <bits/endian.h>; it worked by chance
     and broke building KVM selftests with musl"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
  KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h (erratum #1235)
  KVM: selftests: Verify that KVM returns the configured APIC cycle length
  KVM: x86: Return the VM's configured APIC bus frequency when queried
  KVM: selftests: elf: Include <endian.h> instead of <bits/endian.h>
  KVM: s390: Properly reset zero bit in PGSTE
  KVM: s390: vsie: Fix redundant rmap entries
  KVM: s390: vsie: Fix unshadowing logic
  KVM: s390: Fix leaking kvm_s390_mmu_cache in case of errors
  KVM: s390: vsie: Fix memory leak when unshadowing
  KVM: arm64: Fix nVHE/pKVM hyp tracing error on invalid desc
  KVM: arm64: vgic: Free private_irqs when init fails after allocation
  KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits
  RISC-V: KVM: Fix sign extension for MMIO loads
  RISC-V: KVM: Fix NULL pointer dereference in SBI v0.1 SEND_IPI handler
  riscv: kvm: return SBI_ERR_FAILURE for pmu_event_info() when OOM
  riscv: kvm: return SBI_ERR_FAILURE for pmu_snapshot_set_shmem() when OOM
  RISC-V: KVM: Fix invalid HVA warning in steal-time recording
 2026-05-24 12:50:36 -07:00
Linus Torvalds
3526d74623 Miscellaneous x86 fixes: 
- On SEV guests, handle set_memory_{encrypted,decrypted}()
    failures more conservatively by assuming that all affected
    pages are unencrypted (Carlos López)
 
  - Disable broadcast TLB flush when PCID is disabled
    (Tom Lendacky)
 
  - Fix VMX vs. hrtimer_rearm_deferred() regression
    (Peter Zijlstra)
 
  - Move IRQ/NMI dispatch code from KVM into x86 core, to
    prepare for a KVM x2apic fix (Peter Zijlstra)
 
  - Fix incorrect munmap() size on map_vdso() failure
    (Guilherme Giacomo Simoes)
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmoSodIRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1gvMg//V6nHSV45mHL8nTXxUt0fmxr7KpF93phL
 Dp86WEztvpQUSmOJ3Gbt5ijhiP14+Adwk9oflTE+HwUna7Y1xZsu5XD4mwnxKg1q
 D7FssgBbdcds5wKKQ6A37mwhqjn7+KFEUuxb5AZeKvZ+dS4NynSpe4HhGsLtUdvs
 gzKAv9SlL/tZFSFOKhjRtAsb9nXXwzNzmdsmtisauxkgrDAzLxf9xPIb9VDsXqxL
 7fimKx8r8ABXJTcE6wof95BgKJjqm9RQ2obEpaWuBtxVMTvvbOBi8zhwScuruUcY
 v4WsoJLT5Qqo010uO0+sQR5zM7opWmWoLBQ6gJukA9cyGtuYLVnxfK4SJCYsZii0
 7GKNcAs/Ex99GIQi5tADCCkZGWeFj0t0htzqz8HrmarayyhW8dGNZNQlSJz02nP4
 bvVB0QO5PPZHcIy4tPITtWBJWEfjAj3XcsCcEXfNuVrWSwhGniaTg3xmbvTpyO0r
 DGe3HZUGnpjdXJbMIK4N/IbjQrBbuaYI7oaHS8BEh4Ol/z5cRX3xQH79qxl0LFht
 BSC6uCSpNHu5c1A7GliVYe3YVpwjTMCSoSXMrz2AgqSzNKGbV/nl54w+C8TcDpuH
 pCkkIf2cyAdi1gTtP4lB/YJCvgk4dKQ5V3qzfU00bvIzDBAAH86s8YaRw05/YJpT
 Wi+KB5E5Jj4=
 =mDyr
 -----END PGP SIGNATURE-----

Merge tag 'x86-urgent-2026-05-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull x86 fixes from Ingo Molnar:

 - On SEV guests, handle set_memory_{encrypted,decrypted}() failures
   more conservatively by assuming that all affected pages are
   unencrypted (Carlos López)

 - Disable broadcast TLB flush when PCID is disabled (Tom Lendacky)

 - Fix VMX vs. hrtimer_rearm_deferred() regression (Peter Zijlstra)

 - Move IRQ/NMI dispatch code from KVM into x86 core, to prepare for a
   KVM x2apic fix (Peter Zijlstra)

 - Fix incorrect munmap() size on map_vdso() failure (Guilherme Giacomo
   Simoes)

* tag 'x86-urgent-2026-05-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  virt: sev-guest: Explicitly leak pages in unknown state
  x86/mm: Disable broadcast TLB flush when PCID is disabled
  x86/kvm/vmx: Fix VMX vs hrtimer_rearm_deferred()
  x86/kvm/vmx: Move IRQ/NMI dispatch from KVM into x86 core
  x86/vdso: Fix incorrect size in munmap() on map_vdso() failure
 2026-05-24 11:00:45 -07:00
Linus Torvalds
a674bf74b3 Miscellaneous irqchip driver fixes: 
- Fix the hardware probing error path of the renesas-rzt2h
    irqchip driver
 
  - Fix the exynos-combiner irqchip driver on -rt kernels
    by turning the IRQ controller spinlock into a raw spinlock
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmoSn/wRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1jthA//Z2eisCdaZjORqfBl2Kedz7l5fvVVCcaK
 5Eza3UN0V/+QDTf5kIEeIDym/pjwtubht5FdmZKMAXrckoLCDcJJuKM7bl03VQqU
 dvNMBlH2EOLmWLE4hFMOx6NS3wtUhSemkaqK9dhu08uTolCVJwFgrC64zc7QXjk4
 o9xSW+I6VYDF6aaITDLe9mD5dRTAnQXbi2toqpruXA1B2ZIaN+tDaMjvkVINrU5D
 1sVLB01zJnKYUZ0PY9w6ZQOP8e64ufJdFENJYA8Cg1dPy5XcLP7Hc/3D1cOsQdzX
 z8GRs3LXuBNzrJpev9ZKlnbEU4FJr/L3jU6d+hSRjGS0PHYJy/Gc4EP3LBIjT9QD
 IWJeRebpse39c1xSVX9IP2MuV4kJsz0Baq03WEsiYbfbQL/lHgiRKMF8XsPvjzqV
 a1+6J+s8L6FNO2pXkemYkk8+JRlEQIbDv5BA/5asiKpiIExLQT+1c9GHKnDnDDp7
 R1YI4KFEbG+tzHjWEhke8+Vzc7CAcN+5awwUG7dnB76RTR95tc+wHDW+vId/vJwb
 WnYBqDpICwsFFkkMFYloCft4d0UeyT47iWsIHLu/ksBe6ThJKxkoYi/8f5sBcZno
 p0lu4OmRow5bxbFaPqOMmU9+b5tzkGYbDgDNfncnz/Ur1I7KbCLxrFnzkk+D25Xm
 Fc+9f9by91s=
 =Xl3Y
 -----END PGP SIGNATURE-----

Merge tag 'irq-urgent-2026-05-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull irqchip driver fixes from Ingo Molnar:

 - Fix the hardware probing error path of the renesas-rzt2h
   irqchip driver

 - Fix the exynos-combiner irqchip driver on -rt kernels
   by turning the IRQ controller spinlock into a raw spinlock

* tag 'irq-urgent-2026-05-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  irqchip/renesas-rzt2h: Use pm_runtime_put_sync() in probe error path
  irqchip/exynos-combiner: Switch to raw_spinlock
 2026-05-24 10:55:21 -07:00
Linus Torvalds
ee651da6d3 Debugobjects fix: 
- Fix debugobjects regression on -rt kernels: don't fill the
   pool (which uses a coarse lock) if ->pi_blocked_on, because
   that messes up the priority inheritance of callers.
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmoSno8RHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1i1vg//Tlqck/pDdSAs4QDTqs+Pn7cO7nv/QD4q
 TDlvAVITCzSBm26tGPznT7kFfo+khApTNu2+SbM1/2n+uGJFuQ759YBRfk2WvnYe
 Nundyyl6prAoGq/7pCklJG5IMeZinKlVseuj0XKMamNwr4Y09MJnwPZMXs7HJTYn
 f+Ij6mVyCis+RvyNe7KuA0D3VtzleWtFFyD1p8Bznca4lsF0LoBe+4g2xs601H3+
 HLFp1ADadJbe8zd5Rfph9C5A9g188gpw3EYfsI9oh1qZcvHlKDq26xTMM5cYm4tO
 5Bu4pNRvikSD5EeNjlBZjvgQmUtLDvVtUeXDBmNt4mh5XrAa5z85uVy62CBsxPVX
 Cxmv6rflz/japDCaZsQZhmo/pDKL/E5sQp4o4IewA/7wkPFhE8UN524JzldfOBgx
 4aKv6o+prXrBhn47ybzLpdbkDNZcIkfkzeeSfPsuhRw1flnrqqYFnHBObcOo0u3b
 RNsDO0kKS2l/GrK7YAKY6NRRGVzzym6jpE6/fzGPt3Stih57V3r1IhhdNthzfjSW
 vW+Ed8aYaoJWpvG27IovfJLz3DDxYFuiySVTPaZfmsAU7ApSd44CPOOPAizDWoCq
 ehzAYV2AY8UOQF6d9w2oFs9jgUG8Wrl+JcNomdMzk1gHeKDEyfiYDKU/6EcmVrwE
 09ZwR8lLH8s=
 =NVUg
 -----END PGP SIGNATURE-----

Merge tag 'core-urgent-2026-05-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull debugobjects fix from Ingo Molnar::

 - Fix debugobjects regression on -rt kernels: don't fill the pool
   (which uses a coarse lock) if ->pi_blocked_on, because that messes up
   the priority inheritance of callers

* tag 'core-urgent-2026-05-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  debugobjects: Do not fill_pool() if pi_blocked_on
 2026-05-24 10:48:55 -07:00
Linus Torvalds
2be86a8c57 hwmon fixes for v7.1-rc5 
- adm1266: Various fixes from Abdurrahman Hussain
   The fixed issues were reported by Sashiko as part of a code review of a
   functional change in the driver.
 
 - lenovo-ec-sensors: Convert to devm_request_region() to fix release_region
   cleanup, and fix EC "MCHP" signature validation logic, from Kean Ren
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEiHPvMQj9QTOCiqgVyx8mb86fmYEFAmoRvVkACgkQyx8mb86f
 mYFFFBAAqlMPXnhk5ZAVbR7LojzTRtrKhSLUK2hX1A3Kaw6+MZMtnM/ccF2rzhQZ
 d7X2AecZAbIDt/33HrA9WkgcyvdK+RrFE3Ea2bBiBdWnrYlt0v5C2qnWWXdmtp6V
 ea3eu7UiejUAqwpREwQMdFOFCPLUm/lsruIObXT13X9a7HCMtGAsG0gUUO4dy7Tv
 HoYe8FM9sR6tDUf2p+cMnOOQ2ZvzEbq26umJ8gpw0nA9xXx9QCwZ+OgIzpvo+l23
 r/QTMCGlVsqbqltpaP8eyyETIQubPdSdlbdrMCQQFWtpb06lbhoQv4P0L7OBuaWo
 ta9PAdfDqhxMYvU1aNfHUZuDsM/gi+o0ARrAOSY67K+ZjRyMhRGDGq6I10/lk7n2
 xvqlpcYsMRnFtKmBdp14uUMTx/kL0iqd5xpvfWUe59pQOxZqNteJM8OlZU0whfMy
 O7GZcL13Tz7b805El9Zn59Ix80z36f5jPfLai2Fu9P32fEyun+cIWsU4ZM7CDD68
 v1jGExcKbjfHVpR7z0pAQ3X/ufVVnDh4M73OPIwlCOt6DAToYA6wDx+LwYXA+sLP
 FI+qfVwvpAlA0SD/jhvURhXz5bf8Fc1WO5GsXCiD5VmtL3ND+N+ciQeZGu2DxVNY
 I7gDe/KL1i+jLbieLGWB7GRSTdofjUvhD+/jBbJnvyGuXxwnYgw=
 =vk5N
 -----END PGP SIGNATURE-----

Merge tag 'hwmon-for-v7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging

Pull hwmon fixes from Guenter Roeck:

 - adm1266: Various fixes from Abdurrahman Hussain

   The fixed issues were reported by Sashiko as part of a code review of
   a functional change in the driver.

 - lenovo-ec-sensors: Convert to devm_request_region() to fix
   release_region cleanup, and fix EC "MCHP" signature validation logic,
   from Kean Ren

* tag 'hwmon-for-v7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
  hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read with pmbus_lock
  hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock
  hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock
  hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe()
  hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe()
  hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors
  hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple
  hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR
  hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer
  hwmon: (pmbus/adm1266) include adapter number in GPIO line label
  hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer
  hwmon: (pmbus/adm1266) reject implausible blackbox record_count
  hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX
  hwmon: (pmbus/adm1266) seed timestamp from the real-time clock
  hwmon: (lenovo-ec-sensors): Fix EC "MCHP" signature validation logic
  hwmon: (lenovo-ec-sensors): Convert to devm_request_region()
 2026-05-24 10:37:55 -07:00
Nathan Chancellor
53676e4d44 drm/msm: Restore second parameter name in purge() and evict() 
After commit 3392291fc5 ("drm/msm: Fix shrinker deadlock"), all
supported versions of clang warn (or error with CONFIG_WERROR=y):

  drivers/gpu/drm/msm/msm_gem_shrinker.c:105:58: error: omitting the parameter name in a function definition is a C23 extension [-Werror,-Wc23-extensions]
    105 | purge(struct drm_gem_object *obj, struct ww_acquire_ctx *)
        |                                                          ^
  drivers/gpu/drm/msm/msm_gem_shrinker.c:117:58: error: omitting the parameter name in a function definition is a C23 extension [-Werror,-Wc23-extensions]
    117 | evict(struct drm_gem_object *obj, struct ww_acquire_ctx *)
        |                                                          ^
  2 errors generated.

With older but supported versions of GCC, this is an unconditional hard error:

  drivers/gpu/drm/msm/msm_gem_shrinker.c: In function 'purge':
  drivers/gpu/drm/msm/msm_gem_shrinker.c:105:35: error: parameter name omitted
   purge(struct drm_gem_object *obj, struct ww_acquire_ctx *)
                                     ^~~~~~~~~~~~~~~~~~~~~~~
  drivers/gpu/drm/msm/msm_gem_shrinker.c: In function 'evict':
  drivers/gpu/drm/msm/msm_gem_shrinker.c:117:35: error: parameter name omitted
   evict(struct drm_gem_object *obj, struct ww_acquire_ctx *)
                                     ^~~~~~~~~~~~~~~~~~~~~~~

Restore the parameter name to clear up the warnings, renaming it
"unused" to make it clear it is only needed to satisfy the prototype of
drm_gem_lru_scan().

Cc: stable@vger.kernel.org
Fixes: 3392291fc5 ("drm/msm: Fix shrinker deadlock")
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
 2026-05-24 10:31:24 -07:00
Linus Torvalds
f0e77c598e bpf-fixes 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEE+soXsSLHKoYyzcli6rmadz2vbToFAmoRvpcACgkQ6rmadz2v
 bTow3w/+L3PVujliBpziQFTnHJ2SoTiwUoyjJpsQOc2o1yDEWJXvTcnQ5EURah4t
 aDMjPBBWgDea7HHWvC/vbRf2D8AjCf3gZBBpzW6uTQ2F1whD3DRCZ4O6XPvfdJEQ
 R0JkqZyjBjH9fkKBy30PcF+XM9iJ5pY/mkx6nCrcYvsvbj5cIkZnmP03vBGh1jeI
 yanlYb6N2XHwQp98PKoiN4/BP4ZOQx2HhBX0TmhTcRXVAyyX5SQy4ukrp1y2CSji
 YjpM2qHdEMtMeFFwcy1K2hJwNbjhrvfgHaKbwSuM3eLjug2AMBX0zp/4Zvw7mb2o
 B6zMRo0UgOt+kJzunmqnfNe01YZ+Z+So+FkinLSTba91gwCgxa3Qm3gNsZBtxv5V
 ayrrrFoB1PCxsRJqC0Jio7WXY1JRUkusHOdzR/8pygmwcp+vy6XEzJwhGD+DeMcu
 T4VJj2bp1bCK4iZwqjyxNAoniYSIjwxzwVDw8s0Zz1Bk+92YJEnZatahFTYFzJRK
 G9hnJaht0dK960LnudBUwKXz37dvM3LxAAt0ckAepfHAOwwrdB5XhgLQjfPZejot
 J6FWsxVoS1L+lXV7104QPy2Y9zmJ7ElOzQHWRcoBWs7Srar1a+PUFD0nkuSKmPcu
 7P3ukMr6NyekE0zGlOWSZNetlZpdzvUrpuRY2WOIl+sezwCp2xg=
 =04VP
 -----END PGP SIGNATURE-----

Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Pull bpf fixes from Alexei Starovoitov:

 - Fix bpf_throw() and global subprog combination (Kumar Kartikeya
   Dwivedi)

 - Fix out of bounds access in BPF interpreter (Yazhou Tang)

 - Fix potential out of bounds access in inner per-cpu array map
   (Guannan Wang)

 - Reject NULL data/sig in bpf_verify_pkcs7_signature (KP Singh)

* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:
  libbpf: fix off-by-one in emit_signature_match jump offset
  bpf: Reject NULL data/sig in bpf_verify_pkcs7_signature
  selftests/bpf: Cover global subprog exception leaks
  bpf: Check global subprog exception paths
  bpf: make bpf_session_is_return() reference optional
  bpf: Use array_map_meta_equal for percpu array inner map replacement
  selftests/bpf: Add test for large offset bpf-to-bpf call
  bpf: Fix s16 truncation for large bpf-to-bpf call offsets
  bpf: Fix out-of-bounds read in bpf_patch_call_args()
 2026-05-24 09:53:17 -07:00
Linus Torvalds
4cbfe4502e three ksmbd server fixes 
-----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmoQ3EcACgkQiiy9cAdy
 T1HgVAwAktfOphQUPBUd1RwtGYUZWcMS6uHwBjCvs7As1Rm43dGoNpjCkDkm14eJ
 w9JuXh8gkHPviIgildCzHn/kt0HvNuFt4PwI8neOLQgSzeQmDKUM9uTnQAgHoj+u
 Szkf13t0vGHN52fKa0mtFkDCvzYvyuIt6j4hlFNt0NXIdaQq3MS7pTGOnip62edx
 ZBZWFEoOzEgwi0ZaKxt20Ocgl/P2lrdyEDnRM9U7AfRbae6Po+ephtZL1nN3OvVR
 ZpdC/nE9ce4KFvr0f4vm3eBqr4BX8g4gYj+OOlBn9Zq93gre28Eo9IKZpCOhq/b6
 jPxPhoIVYSwKL7mhmvdy1tM9MYudNOvnkFtQh7JSsyTfjl89rcMiVkb11ZvBi4GS
 d3lY+CF6U6BUbu65T+HqtwlmplntDZfmVrAc6DvScUkOo7yol+QE9K5llOaVV+ju
 ZZOH9RY3EQqwkWQoXT70dSwxihzSLhliKEQXm7vQbQe1lvlNaSIqDjIdPdQVqhZ2
 VfdlNxnW
 =Pxit
 -----END PGP SIGNATURE-----

Merge tag 'v7.1-rc5-ksmbd-server-fixes' of git://git.samba.org/ksmbd

Pull smb server fixes from Steve French:

 - fix for creating tmpfiles

 - fix durable reconnect error path

 - validate SID in security descriptor when inheriting DACL

* tag 'v7.1-rc5-ksmbd-server-fixes' of git://git.samba.org/ksmbd:
  smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close
  ksmbd: validate SID in parent security descriptor during ACL inheritance
  ksmbd: fix durable reconnect error path file lifetime
 2026-05-23 16:59:02 -07:00
Linus Torvalds
400544639d for-7.1-rc4-tag 
-----BEGIN PGP SIGNATURE-----
 
 iQJPBAABCgA5FiEE8rQSAMVO+zA4DBdWxWXV+ddtWDsFAmoRu2cbFIAAAAAABAAO
 bWFudTIsMi41KzEuMTIsMiwyAAoJEMVl1fnXbVg7jk0P/iokJwhO+YP7rdnDPAl6
 wXYq/e4HxSl65//wwkR2Q7zc/GWOSdGZoP7fHCtXY52RERDKq2xrkQ+fBtnEMvS3
 N6bwM0kVBoGPkXRHrf55SdfH7ITldeVAYIRIajO5bVT/j/F8l9s7ivXmI0Ep1xgZ
 Eiv5MuOiW/kPLzYW1pHP+UniaUhIgQGTRcHs7NotAn55q2odnLdddRWx8NGT1kAe
 Owydf6c0/B/+7NLhTLQl/w4WmeFL3OR0b0HuHiVYBNuQBkgCxwcUsERfPjnWpAbr
 Pll32JKmJxH1Rthr8qA++Xv72D31VNAYVwxyieq/kPSFg6rwjcKw2lLdFKv99fCT
 3OcDg0N9X20RK4ZcyMSwiCkS92DFStmVy4FtVIdNXbgpRcbw/jHNB6CnFq+RHOVU
 wBNYdLte7zSmroDSQ/U2l/xY0n1KCf/KcYBxnkIkri6fdl/f2o8/monPfbsUvYiK
 0qI3ODSomBpQRU0vYddJ28KfEx0iHqSQzmDyRFDlDuNb7M24d5W82jWLf60Nlk4h
 ngehWVaVvLm8y4YiRteD10TGD7ClBE6ilu0t0dS2ys7o7stIAuXbjIP435tYz2T4
 B0ddujn7S0mwNCoT+5yRfmxPQFJpyt93jU65VTJ95Mc7Pg43/D6b5ju7tvZlVdNw
 NT4nY8sOiLy1KR72SvguXPSr
 =hKb2
 -----END PGP SIGNATURE-----

Merge tag 'for-7.1-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux

Pull btrfs fixes from David Sterba:
 "A batch of fixes to simple quotas:

   - add conditional rescheduling point not dependent on the lock during
     inode iterations to avoid delays with PREEMPT_NONE enabled

   - fix subvolume deletion so it does not break the squota invariants

   - properly handle enabling squota, tracking extents in the initial
     transaction

   - catch and warn about underflows, clamp to zero to avoid further
     problems

  And one fix to inode size handling:

   - fix handling of preallocated extents beyond i_size when not using
     the no-holes feature"

* tag 'for-7.1-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
  btrfs: swallow btrfs_record_squota_delta() ENOENT
  btrfs: clamp to avoid squota underflow
  btrfs: fix squota accounting during enable generation
  btrfs: check for subvolume before deleting squota qgroup
  btrfs: always drop root->inodes lock before cond_resched()
  btrfs: mark file extent range dirty after converting prealloc extents
 2026-05-23 16:54:48 -07:00
Linus Torvalds
f83ef5bca2 xfs: fixes for v7.1-rc5 
Signed-off-by: Carlos Maiolino <cem@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iJUEABMJAB0WIQSmtYVZ/MfVMGUq1GNcsMJ8RxYuYwUCahG3QAAKCRBcsMJ8RxYu
 Y92cAYC0vDsgBcwRgeLBhrEHmzvkNBwKJAqAvXzYoxP/ux+N7hvS3k7kieXXTmmw
 v/fX7AMBf2C9hjNn6la4uRxR0kkQWneqQWAvkxiy/584xnCheCFR3D+olAgh0ySp
 BWRCCbEzwg==
 =lIaC
 -----END PGP SIGNATURE-----

Merge tag 'xfs-fixes-7.1-rc5' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux

Pull xfs fix from Carlos Maiolino:
 "A single fix for a race in xfs buffer cache which may lead to
  filesystem shutdown due to inconsistent metadata if the buffer
  lookup happens to find an old dead buffer still in the cache"

* tag 'xfs-fixes-7.1-rc5' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
  xfs: fix a buffer lookup against removal race
 2026-05-23 16:51:22 -07:00
Linus Torvalds
eed108edc1 NIOS2: updates for v7.2 
- Implement _THIS_IP_ for inline asm
 - Add Simon Schuster as a maintainer and mark the NIOS2 as Supported
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEoHhMeiyk5VmwVMwNGZQEC4GjKPQFAmoRzqMACgkQGZQEC4Gj
 KPT/zg//Y83pZF/w5pjBHDVtk9qn0wnoWCECYfigAjSywIRm4swBQcfA2XG8+mJ7
 I6t5LyVhgSRKlm9Flk/YIwRbRQFjsSnMgQKE9I+tZhVMbzni4ilqgD30iEDAyHwt
 34ezQUVpGrOytzsyM2SqK4ftGUgwSYMKuhyo5oqKKR5flBaP8b8DLpqLQmLlir/6
 5PHQf6Z8o0G080s3GTOTRCFAfhFRvaq+lDc3koFZT8xO1dePLABEYRFoAKuzgOOl
 I1amihW+dBZgXx4GwACLBn911IF77lwnTzc+I7Y/kokUuNCCGKloWtr1EDeM+w4k
 CvtUaohhBRXCN8rSpdaaKxyBR9P1MZnfCxflOBXvNpfHPUvbDFD/aR5tQNW0Es+V
 q9mxyeK0rwjo8lMOOZel98Bdq1KPygPW5RCBT9atoqpktYlmiBDYPIY3v2kANkZn
 s3qJ0iVpAB2shHS3mTLP9BkW+alvJozaZAhKnGt2i87HiaVD5XL3aw1VVCR/JWuC
 lcuR6GzjIoBneWK4CdgAnTqIziVwp50yM32DG2zrGSu8f32HsfrKSJO8auowXQJl
 6g0YB4PBXTZgISIcamywEMX5Y7Gv3O77Se45qyvbl/zI2Ck94IDXbFoGZbh0dkXc
 DnunewQU+ggTHrg5WexNmocrZnOw+vmHfevB9zhi+2DNuFqDyHQ=
 =LDk6
 -----END PGP SIGNATURE-----

Merge tag 'nios2_updates_for_v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux

Pull nios2 fixes from Dinh Nguyen:

 - Implement _THIS_IP_ for inline asm

 - Add Simon Schuster as a maintainer and mark the NIOS2 as Supported

* tag 'nios2_updates_for_v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux:
  nios2: Implement _THIS_IP_ using inline asm
  MAINTAINERS: arch/nios2: Add Simon Schuster as co-maintainer
 2026-05-23 09:21:08 -07:00
Linus Torvalds
95e6d3ba05 LoongArch fixes for v7.1-rc5 
-----BEGIN PGP SIGNATURE-----
 
 iQJKBAABCAA0FiEEzOlt8mkP+tbeiYy5AoYrw/LiJnoFAmoQFmAWHGNoZW5odWFj
 YWlAa2VybmVsLm9yZwAKCRAChivD8uImevFED/9pCspo7HFPyYlEBeEoPfKvkLRr
 XyJzaVpCyqfbnfnsLyUGnu+rtQfX1hLxRqeMUjPGx0AE8M59KD9KkQ0H2ZdTVz80
 3ytI0oVBVCzmm1QdbtxRHPGd1kvJcUH/Z2hQFQhSPDoq8wiLbjj36kpGy3YQEdjb
 o7880THpa47OemgHwAKqCUOyXnsfjPj5nISimuIZg3XfFn9svsvuk3nsktYWdcJ3
 UiH9BDSVbIqHj7xzSCrvgil8fcaBHYbXNBjWezubmc0V21PKWf063XNqO9xKzkGQ
 uzcb0l0B9qImm0brxczIlDfoLc3wzOj67jrvUF5xhU4DZiNBci039RNfW8+7l1pQ
 GhrWBxf+sWuhW/vqiv65bHys4Af5P1FX2848i4ZxW+m2gfuxw5T43Mf6R1v05Acy
 0NZ3Y0zZt+rw8VpTF0I7egjshLFix5fq4mdfECKBB24fCsr8svNFuNYT8JPtqw3S
 Hk6wN5RVHy5cbc4wnq3zUQna7iWO+bE+rngnyv29BS/1nIfAhbOUqIrNrB0lvs5S
 UK6IQVmW84Zx18KvWie4tzyAXWJglCOM1V8f1QejOrNGPPZI9+RDtYw8TONFrFdz
 SFfL6fulS6X5tSCo9e8V7NzeWLIvIGEjxVP2bVeVBrY4fVvmjromm/msVqrYhj3Z
 8UYQqCuduiGQErmH3g==
 =cYtz
 -----END PGP SIGNATURE-----

Merge tag 'loongarch-fixes-7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson

Pull LoongArch fixes from Huacai Chen:
 "Rework KASLR to avoid initrd overlap, remove some unused code to avoid
  a build warning, fix some bugs in kprobes and KVM"

* tag 'loongarch-fixes-7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson:
  LoongArch: KVM: Move some variable declarations to paravirt.h
  LoongArch: kprobes: Fix handling of fatal unrecoverable recursions
  LoongArch: kprobes: Use larch_insn_text_copy() to patch instructions
  LoongArch: Remove unused code to avoid build warning
  LoongArch: Avoid initrd overlap during kernel relocation
  LoongArch: Skip relocation-time KASLR if already applied
  efi/loongarch: Randomize kernel preferred address for KASLR
 2026-05-23 09:13:00 -07:00
KP Singh
7dd62566e0 libbpf: fix off-by-one in emit_signature_match jump offset 
The offset for the cleanup-label jump is computed before the MOV R7
instruction is emitted, but the JMP lands after it. Account for the
extra insn in the offset calculation (-2 instead of -1). Drop the
redundant self-loop in the else branch; gen->error = -ERANGE already
marks the generation as failed.

Fixes: fb2b0e2901 ("libbpf: Update light skeleton for signing")
Signed-off-by: KP Singh <kpsingh@kernel.org>
Link: https://lore.kernel.org/r/20260522215337.662271-2-kpsingh@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
 2026-05-23 07:49:22 -07:00
Linus Torvalds
c8561c73b4 Driver core fixes for 7.1-rc5 
- Remove the software node on platform device release(); without this,
   the software node remains registered after the device is gone and a
   subsequent platform_device_register_full() reusing the same node fails
   with -EBUSY
 
 - In sysfs_update_group(), do not remove a pre-existing directory when
   create_files() fails; the previous code would silently destroy a sysfs
   group that the caller did not create
 
 - Set fwnode->secondary to NULL in fwnode_init() to avoid dereferencing
   uninitialized memory (e.g. in dev_to_swnode()) when the firmware node
   is allocated on the stack or via a non-zeroing allocator
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQS2q/xV6QjXAdC7k+1FlHeO1qrKLgUCahGkDAAKCRBFlHeO1qrK
 Ls4tAP0Ti0VhRJOHz2h3boyp0tXH1bIt082073oJGasHAjnoeQEAg0zbdA2Qkj9o
 DDv5iX6KYGkeFUzv8MjuWUexc5HlYQ0=
 =Lc0O
 -----END PGP SIGNATURE-----

Merge tag 'driver-core-7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core

Pull driver core fixes from Danilo Krummrich:

 - Remove the software node on platform device release(); without this,
   the software node remains registered after the device is gone and a
   subsequent platform_device_register_full() reusing the same node
   fails with -EBUSY

 - In sysfs_update_group(), do not remove a pre-existing directory when
   create_files() fails; the previous code would silently destroy a
   sysfs group that the caller did not create

 - Set fwnode->secondary to NULL in fwnode_init() to avoid dereferencing
   uninitialized memory (e.g. in dev_to_swnode()) when the firmware node
   is allocated on the stack or via a non-zeroing allocator

* tag 'driver-core-7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core:
  device property: set fwnode->secondary to NULL in fwnode_init()
  sysfs: don't remove existing directory on update failure
  driver core: platform: remove software node on release()
 2026-05-23 07:49:05 -07:00
Linus Torvalds
3f264650ca i2c-for-7.1-rc5 
- core:
   - smbus: fix a potential uninitialization bug
 - tegra:
   - drop runtime PM reference when exiting on mutex_lock failure
   - preserve transfer errors when releasing the mutex
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEOZGx6rniZ1Gk92RdFA3kzBSgKbYFAmoRYoEACgkQFA3kzBSg
 Kbb1gA/+JYtgCLp8zwuQTdvSa9ajYf212JAtu2c51UYjZppwivvT6bFMNbHFh9Wh
 jR+st4yJ8ULL0PLurc7dl8q1D6gxoJ8fvtx6v9hyihLN9wHQ9NFV8r/QP11dVO8o
 vE4Ebb0OFHzH/B5P8r8ZdAY7Iq2fZ7IZPgDgeV+a9O02BShmn/y9/eJSw/V3tlbV
 pKjojcoZBRgKrmu6UVCCtXJRj07ZPSOWnl4Auc7SGrek7jwdLtL6Gg/lcdyWGLY1
 M4ZDAl8lnOYhnuknCD7JiK+cY2kM9I7VRROIcAbekqXFsx48M4Rz8xulhzaUJWpW
 /1QLyfeTSqyylEauRciXe8SaJ0ZvwogGRQEUaop/EPMAaQeARmxy8/Ez4mXt1rhI
 qkZTVF5D0KDlVYri0CMYjEFth7P2zMx8d7pMEb3JVIOhda+RBqVjMdTSSffkhzri
 MW8lXDzD/Ae431OVoW0IPF6hvZn2++/hO1eyJxNpQ0O8KLWK1hEp+8eIqB0VtEVy
 /AyBAgBEFBxC3kKyqDQlNVnQR/n0YUmE10/rN2Oa5IjnrBfhxG7BSSOatws+DdFe
 tNM8cUQf7Fk62I02LrxMSMnT1yjubMAVZoI68Sj5dX3vEAx+pyVTRRIv3mL9yPAb
 /XGgzYa2y7I/8IybHCb0BOzLAa3FW5MNWvz66CJB1ngfCFICscE=
 =zXRp
 -----END PGP SIGNATURE-----

Merge tag 'i2c-for-7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux

Pull i2c fixes from Wolfram Sang:
 "Core:
   - smbus: fix a potential uninitialization bug

  Tegra:
   - drop runtime PM reference when exiting on mutex_lock failure
   - preserve transfer errors when releasing the mutex"

* tag 'i2c-for-7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
  i2c: smbus: fix a potential uninitialization bug
  i2c: tegra: make tegra_i2c_mutex_unlock() return void
  i2c: tegra: fix pm_runtime leak on mutex_lock failure
 2026-05-23 07:32:39 -07:00
Linus Torvalds
ab868c1097 RDMA v7.1 first rc window 
- syzbot triggred crash in rxe due to concurrent plug/unplug
 
 - Possible non-zero'd memory exposed to userspace in bnxt_re
 
 - Malicous 'magic packet' with SIW causes a buffer overflow
 
 - Tighten the new uAPI validation code to not crash in debugging prints
   and have the right module dependencies in drivers
 
 - mana was missing the max_msg_sz report to userspace
 
 - UAF in rtrs on an error path
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRRRCHOFoQz/8F5bUaFwuHvBreFYQUCahDmpgAKCRCFwuHvBreF
 YRRTAP0YXV95Y5gcli55IhetKjJUzQbaREz2NueqIpf1IorMbAD+Lns4DgZCU0KW
 bC81x7cGHBSyCju9zogIdBFJhsbxeQ4=
 =MxJz
 -----END PGP SIGNATURE-----

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma

Pull rdma fixes from Jason Gunthorpe:

 - syzbot triggred crash in rxe due to concurrent plug/unplug

 - Possible non-zero'd memory exposed to userspace in bnxt_re

 - Malicous 'magic packet' with SIW causes a buffer overflow

 - Tighten the new uAPI validation code to not crash in debugging prints
   and have the right module dependencies in drivers

 - mana was missing the max_msg_sz report to userspace

 - UAF in rtrs on an error path

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
  RDMA/rtrs: Fix use-after-free in path file creation cleanup
  RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port
  RDMA/core: Do not read wild stack memory in uverbs_get_handler_fn()
  RDMA/core: Move the _ib_copy_validate_udata* functions to ib_core_uverbs
  RDMA/siw: Reject MPA FPDU length underflow before signed receive math
  RDMA/bnxt_re: zero shared page before exposing to userspace
  selftests/rdma: explicitly skip tests when required modules are missing
  RDMA/nldev: Add mutual exclusion in nldev_dellink()
 2026-05-23 07:17:27 -07:00
Carlos Maiolino
8339dd0e50 xfs: fixes for v7.1-rc5 
Signed-off-by: Carlos Maiolino <cem@kernel.org>
  Lines starting with '#' will be ignored.
 -----BEGIN PGP SIGNATURE-----
 
 iJUEABMJAB0WIQSmtYVZ/MfVMGUq1GNcsMJ8RxYuYwUCahG0TgAKCRBcsMJ8RxYu
 Y18FAX0cD9LJOQetOPnFHYl6AdO4f0OmaBnjbyF19iRQjrLo9GthdiQf7WXD6QaG
 b00H18ABgMYDhTO70T1zH2KkpaaVBOKHT9oFQ+Bzki6R1J+rCU2ZXOiQARmFLvd3
 xE25p55FiQ==
 =UWBN
 -----END PGP SIGNATURE-----

Merge tag 'xfs-fixes-7.1-rc5' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux into test_merge

xfs: fixes for v7.1-rc5

Signed-off-by: Carlos Maiolino <cem@kernel.org>
 Lines starting with '#' will be ignored.
 2026-05-23 16:15:18 +02:00
Linus Torvalds
f53a244224 fwctl 7.1 first rc pull request 
- Buffer overflow due to missing input validation in pds
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRRRCHOFoQz/8F5bUaFwuHvBreFYQUCahDk/QAKCRCFwuHvBreF
 YRxuAQCliGLeyivZ1BVcJ0rB7obSheMWS6drbJbw2H5LmRkAcwD/XHJeTHsu2Cqs
 Pf8mZR5b+MZGm3SpAxYR+FJLxV4rmAc=
 =CxSO
 -----END PGP SIGNATURE-----

Merge tag 'for-linus-fwctl' of git://git.kernel.org/pub/scm/linux/kernel/git/fwctl/fwctl

Pull fwctl fix from Jason Gunthorpe:

 - Buffer overflow due to missing input validation in pds

* tag 'for-linus-fwctl' of git://git.kernel.org/pub/scm/linux/kernel/git/fwctl/fwctl:
  fwctl: pds: Validate RPC input size before parsing
 2026-05-23 07:13:06 -07:00
Tina Zhang
9a12fa5213 KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h (erratum #1235) 
Hygon Family 18h CPUs are derived from AMD Family 17h (Zen1) silicon and
share the same erratum #1235: hardware may read a stale IsRunning=1 bit
during ICR write emulation and silently fail to generate an
AVIC_IPI_FAILURE_TARGET_NOT_RUNNING VM-Exit on the sending vCPU.

The absence of the VM-Exit causes KVM to miss the required wakeup of
blocking target vCPUs, leading to hung vCPUs and unbounded delays in
guest execution.

Extend the existing AMD Family 17h erratum #1235 workaround to also cover
Hygon Family 18h.  With IPI virtualization disabled, KVM never sets
IsRunning=1 in the Physical ID table, so every non-self IPI generates a
VM-Exit and is correctly emulated.

Fixes: 8de4a1c816 ("KVM: SVM: Disable (x2)AVIC IPI virtualization if CPU has erratum #1235")
Cc: <stable@vger.kernel.org>
Signed-off-by: Tina Zhang <zhang_wei@open-hieco.net>
Message-ID: <20260522040014.3380201-1-zhang_wei@open-hieco.net>
 2026-05-23 10:09:04 +02:00
Sean Christopherson
d9c41dc531 KVM: selftests: Verify that KVM returns the configured APIC cycle length 
Add checks in the APIC bus clock test to verify that querying
KVM_CAP_X86_APIC_BUS_CYCLES_NS on the VM after changing the frequency
returns the VM's actual APIC cycle length, not KVM's default.  For
giggles, verify that KVM still returns its default frequency for the
system-scoped check.

Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-ID: <20260522173526.3539407-3-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 2026-05-23 10:07:40 +02:00
Sean Christopherson
86e2de10eb KVM: x86: Return the VM's configured APIC bus frequency when queried 
When KVM_CAP_X86_APIC_BUS_CYCLES_NS is queried on a specific VM, return the
VM's configured APIC bus frequency, not KVM's default.  Aside from the fact
that returning the default frequency is blatantly wrong if userspace has
changed the frequency, returning the configured frequency means userspace
can blindly trust the result, e.g. when filling PV CPUID information that
communicates the APIC bus frequency to the guest.

Fixes: 6fef518594 ("KVM: x86: Add a capability to configure bus frequency for APIC timer")
Reported-by: David Woodhouse <dwmw2@infradead.org>
Closes: https://lore.kernel.org/all/ab84153e33fbe7c25667f595c56b310d4d5a93ef.camel@infradead.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-ID: <20260522173526.3539407-2-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 2026-05-23 10:07:29 +02:00
Hisam Mehboob
2d42c7cf1a KVM: selftests: elf: Include <endian.h> instead of <bits/endian.h> 
<bits/endian.h> is a glibc-internal header that explicitly states it
should never be included directly:

  #error "Never use <bits/endian.h> directly; include <endian.h> instead."

Replace it with the correct public header <endian.h> which works on
all C libraries including musl. Building KVM selftests with musl-gcc
fails with:

  lib/elf.c:10:10: fatal error: bits/endian.h: No such file or directory

Fixes: 6089ae0bd5 ("kvm: selftests: add sync_regs_test")
Signed-off-by: Hisam Mehboob <hisamshar@gmail.com>
Message-ID: <20260409164020.1575176-4-hisamshar@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 2026-05-23 10:05:26 +02:00
Paolo Bonzini
06c4f99526 KVM/riscv fixes for 7.1, take #1 
- Fix invalid HVA warning in steal-time recording
 - Return SBI_ERR_FAILURE to guest upon OOM in pmu_event_info()
   and pmu_snapshot_set_shmem()
 - Fix NULL pointer dereference in SBI v0.1 SEND_IPI handler
 - Fix sign extension of value for MMIO loads
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEZdn75s5e6LHDQ+f/rUjsVaLHLAcFAmoQUxsACgkQrUjsVaLH
 LAdm4g//fKQQeVn+y6X7ASw7Msa3hO360VyRcuNj5peP8RJKPPRg60LW+kPwY4GS
 7d6SZGzxXZX5PVF6QODAkt2PYYdyjVcakE4T1qF7LPEviMbHJPg1xp0exIlyW97x
 /6FjH8rjtO+ziJ6JWySzQY18eh4ZVG5PaUKItvqDxc51BAnOzS8Z5XXSzfzSIFpW
 M0eYOb2U6ZIpR1OMm0L2sO36FYm8/TZXiz7eve3uujDgPv0qtbnSrjfdwdxqFbi+
 qssb2VwMDgLcCV9LvUr1bTPabdVy9dov3A9tr4vaMg6+r+mH+24kIHOdiimM3c7n
 WIgr/bbAWqqtTr4R6LCF9+dmeo67uoavIvq9W+tak8E/2/bhD7VRleaR2unWlI3u
 +ZDnH/KbaaqikbaXgUJXj125c8nQ1qli1mIBCbE6glOUrqG7kepCRzeL82fOYm2n
 u5zgDTHk2AUBm1hs/4HDjFxK4Mfsf683XWa6Hc2aueNr5bqGyEI2DesB/02zGmiz
 6YoAKVkbnnDhVCIBXZBEDMqm2ZK4KJtjYPVf6MHEwU7edr806WkGpj4/qIFG6Mhj
 LVNlB3PSENqLJGv8ZJbzWvvubXPvOylga6EWpZLwoqk+shOHHCHCGXYDaGMQ29Hu
 LBv61qQkeU1dtlpyEO4IhBf78ahzyu/MMPfk6ldLkQzV/PXfZ08=
 =S4B4
 -----END PGP SIGNATURE-----

Merge tag 'kvm-riscv-fixes-7.1-1' of https://github.com/kvm-riscv/linux into HEAD

KVM/riscv fixes for 7.1, take #1

- Fix invalid HVA warning in steal-time recording
- Return SBI_ERR_FAILURE to guest upon OOM in pmu_event_info()
  and pmu_snapshot_set_shmem()
- Fix NULL pointer dereference in SBI v0.1 SEND_IPI handler
- Fix sign extension of value for MMIO loads
 2026-05-23 10:04:35 +02:00
Paolo Bonzini
37f32d5ab8 KVM: s390: some vSIE and UCONTROL fixes 
Fix some memory issues and some hangs in vSIE.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEoWuZBM6M3lCBSfTnuARItAMU6BMFAmoQPUMACgkQuARItAMU
 6BMpJRAAyGmcEwrT3uRaScd3eX6A23Wyb4gb0TzlYPXM4oQaQWhl0gl0fYmIPxFI
 plSONGrgQA8TtmElixt1ijVo0edp0PnPgdfol7fkzpImzmOgJAI130p1IQAh34rm
 pFjvhOmaGJSl66VnXe6lDzJCTErcrEEZ0X3BNsm3PO/DNYCvKwgzDz8nsjsZ2RPE
 BvLIUqOTgknq0VwkO0WBqTfuKL0N/FHt6xeqR2cOdtgBzHjsuXH3/5BL7rW+TLou
 hG/97py7x3ivTDrK/ktP6PHtO3H/goPhHta8xTH2ow9MjvUT+SrVyc/pfi9AEiA7
 zpA36g8ArqokzcaAFFlA/iINndjokgakhW0T0jgwFvb0Qntf6TAJ6UlL8bw+YOnq
 qbHumWX5SijFktULpOBKY0WmDXPgxUE6UorxNP4rvsw8LaIfyguIJHZzas0h2khw
 uOsySoMHRZjUA7P603fmqSZTfjb/e3bnqNvo0cJtdnSwzmjfuyYEJz1lhGaYkHsF
 t/QoRDGCeIu5N988xc4HSE/Rwzij7QT68whbRPotDJQYYRMIi22RRfG+krNYhSja
 vbVhVFOJJwiCF3/zzhhlDMS7smfs9RYXbG0QbPF5w7/hdcIpPLRxwg5/5k0t6T/M
 W7igzgYaUEjyMcNNQWAWUULj46icpzBFzst+W3c1V9lmZ/nr6H8=
 =Pewa
 -----END PGP SIGNATURE-----

Merge tag 'kvm-s390-master-7.1-2' of https://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD

KVM: s390: some vSIE and UCONTROL fixes

Fix some memory issues and some hangs in vSIE.
 2026-05-23 10:03:58 +02:00
Paolo Bonzini
e23844b2dd KVM/arm64 fixes for 7.1, take #3 
- Fix ITS EventID sanitisation when restoring an interrupt translation
   table.
 
 - Fix PPI memory leak when failing to initialise a vcpu.
 
 - Correctly return an error when the validation of a hypervisor trace
   descriptor fails, and limit this validation to protected mode only.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEn9UcU+C1Yxj9lZw9I9DQutE9ekMFAmoNX+sACgkQI9DQutE9
 ekMvcg//aWuZZ8eCJ/52EX8/R8dkHXmVgqff1rVFDJPG4TiqCT7NUkFqnAv9Wvf1
 DdQnUukMclLcbtNDVqv0AWNYDaXZFG5AQOEOyKjy3Ulk3ItykUzmnTvaIFBZkmMS
 YCPsfYRHIIVg84GHKf4a2o0IneOjO6zJQyR0P1NbUIHC+wWtWgLb7ttRtlWO22PC
 vNiJVyOak7Y332TghKWdrrXMRvcoh6gqkzERSTorq848H9O3q3SfO9gqX0dg+vFH
 gqK6J0TEVFsRo3y0q507CDkpFOBDwvAtuiAUAr8/kb8Jjj6XWP1Farh3Bh1/6lwu
 tMjWO9jTQnp5NHZbcjSMqD8OVDIwvnuw8SxnMHz+67qusRLOMBpNQPtVcltr65xG
 vte6X5GbEmrzt6Du0j+dudb+RNIZ05fNU3jDVHJ/h7XVuq9iEV7frdJFjDMUDq5U
 Vtp70SkhhbjcqiaYKJwCvgi1GlfPGj2NUkVwAptV7mDc5PFRnjOWaKkgg59wWi+z
 1fBQfR2Pr5yOsqS0Dl+3rOotnvg/R5XqdNjPoV14fHeymEH7Pwx69NW29Y42IHw9
 eh8kicQTaCBH1ih8L+aSLksIqov4kpoHecnP4Qk5jkKjXTL04TeV84yt72ZOYOuc
 hkeSBjZXlVxoELYM4zf0HkQdD9e/YFVoWShqqxq1PRkWaWlHEfU=
 =ZZ/v
 -----END PGP SIGNATURE-----

Merge tag 'kvmarm-fixes-7.1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD

KVM/arm64 fixes for 7.1, take #3

- Fix ITS EventID sanitisation when restoring an interrupt translation
  table.

- Fix PPI memory leak when failing to initialise a vcpu.

- Correctly return an error when the validation of a hypervisor trace
  descriptor fails, and limit this validation to protected mode only.
 2026-05-23 10:03:10 +02:00
Linus Torvalds
79bd2dded1 sched_ext: Fixes for v7.1-rc4 
- Spurious WARN in ops_dequeue() racing with concurrent dispatch.
 
 - Self-deadlock between scheduler disable and a concurrent sub-sched
   enable.
 -----BEGIN PGP SIGNATURE-----
 
 iIQEABYKACwWIQTfIjM1kS57o3GsC/uxYfJx3gVYGQUCahCHGQ4cdGpAa2VybmVs
 Lm9yZwAKCRCxYfJx3gVYGdKOAP9C6xYbZSXuPJSugQg7Ogq7GTcMf0EtK7CGVb9x
 0pVJigEA1E17Vqf1WTWTp2DOsoPV1adS51wcoTGvklJc0eFRrw0=
 =i40E
 -----END PGP SIGNATURE-----

Merge tag 'sched_ext-for-7.1-rc4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext

Pull sched_ext fixes from Tejun Heo:

 - Spurious WARN in ops_dequeue() racing with concurrent dispatch

 - Self-deadlock between scheduler disable and a concurrent sub-sched
   enable

* tag 'sched_ext-for-7.1-rc4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext:
  sched_ext: Fix spurious WARN on stale ops_state in ops_dequeue()
  sched_ext: Fix deadlock between scx_root_disable() and concurrent forks
 2026-05-22 16:43:33 -07:00
Linus Torvalds
de37e502a3 cgroup: Fixes for v7.1-rc4 
Two rstat fixes:
 
 - Out-of-bounds access in the css_rstat_updated() BPF kfunc when called
   with an unchecked user-supplied cpu.
 
 - Over-strict NMI guard after the recent switch to try_cmpxchg left
   sparc and ppc64 unable to queue rstat updates from NMI.
 -----BEGIN PGP SIGNATURE-----
 
 iIQEABYKACwWIQTfIjM1kS57o3GsC/uxYfJx3gVYGQUCahCHDA4cdGpAa2VybmVs
 Lm9yZwAKCRCxYfJx3gVYGTk2AP9Me+BV0h17oEuaqAii7uzMom6zCYUO6KY6ADAe
 zr+zcgEA0B72FxH+GyPwe7lhropwg9WR6jagsCFN/tlMPHwQrwc=
 =Sos7
 -----END PGP SIGNATURE-----

Merge tag 'cgroup-for-7.1-rc4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup

Pull cgroup fixes from Tejun Heo:
 "Two rstat fixes:

   - Out-of-bounds access in the css_rstat_updated() BPF kfunc when
     called with an unchecked user-supplied cpu

   - Over-strict NMI guard after the recent switch to try_cmpxchg left
     sparc and ppc64 unable to queue rstat updates from NMI"

* tag 'cgroup-for-7.1-rc4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:
  cgroup: rstat: relax NMI guard after switch to try_cmpxchg
  cgroup/rstat: validate cpu before css_rstat_cpu() access
 2026-05-22 16:28:47 -07:00
Linus Torvalds
4a5860ea60 drm fixes for 7.1-rc5 
gem:
 - clean up LRU locking
 
 msm:
 - Core:
  - Fixed bindings for SM8650, SM8750 and Eliza
  - Don't use UTS_RELEASE directly
  - Fix typo in clock-names property
 - DPU:
   - Fixed CWB description on Kaanapali
   - Fixed scanline strides for YUV UBWC formats
   - Stopped DSI register dumping to access past the end of region
 - DSI:
   - Fix dumping unaligned regions
 - GPU:
   - Fix GMEM_BASE for a6xx gen3
   - Fix userspace reachable crash on a2xx-a4xx
   - Fix sysprof_active for counter collection with IFPC enabled GPUs
   - Fix shrinker lockdep
 
 amdgpu:
 - Userq fixes
 - VPE fix
 - SMU 15 fix
 - Misc fixes
 - VCE fixes
 - DC bios parsing fixes
 - DC aux fix
 - Mode1 reset fix
 - RAS fixes
 
 amdkfd:
 - Misc fixes
 
 radeon:
 - CS parser fix
 
 xe:
 - SRIOV related fixes
 - Fix leak and double-free
 - Multi-cast register fixes
 - Multi-queue fix
 
 i915:
 - Fix joiner color pipeline selection [display]
 - Fix readback for target_rr in Adaptive Sync SDP [dp]
 - Apply Intel DPCD workaround when SDP on prior line used [psr]
 
 amdxdna:
 - remove mmap and export for ubuf
 
 bridge:
 - chipone-icn6211: managed bridge cleanup
 - lt66121: acquire reset GPIO
 - megachips: fix clean up on failed IRQ requests
 
 v3d:
 - fix UAF in error code paths
 - release GEM-object ref on free'd jobs
 
 virtio:
 - use uninterruptible resv locking in plane updates
 
 mediatek:
 - fix sparse warnings
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmoQ1MQACgkQDHTzWXnE
 hr6iOQ/9FmcbV1C3rSE3UxrWrxpUnP++f4kxUu8Ol6KX3SJLgeCqlUsoX7XC1hyH
 tPsbRyfNhHOUL3j2QGEkXko/Ip4BodykzIqU9rnA+mdFMwD7DvKOC6irUz8SrDg3
 re7b8OZVkI5EfK6GK0wpjuzWOVnfVXHn4mtPhTrnS4EqoznM4g12bReW0qx0j0m3
 m877elDJZf8YHbU69qa7ulXJYUCSVz6wbLBpKE1lLv+GrJ0ijLAX1F5xNEIcezeA
 bGwj/tY+mfYc8SdvTC3y2fB4mssFErmtQ/TOx0PYpU38mdFhNdJkUm1QOHjI6ty1
 7CiyZqJmVAPBxvj/omRROeR7DFkytnweYOaFhGXPIdXYGvm5Kf5QunqmhU880Do7
 FXAZUaKJdLY5VrJ1tuqSqH8uw/ZX7TZo6sPgamsXxDf8cxHkPNbHfEoA1vRMO7Iy
 tqgfFl1sYXFvVBB0AZd0CKBefElZXw2Nwzs7Um4dPL/nMvk5wC2n/mQYaM9a9BCi
 jLwVQT5FXUU2YY47AwUz+1Sxg4EwBAdflncKGS7xyHvmhJrVrOdUrZ1wIg2+19ug
 gjV4DO2J6iYMI9ZaSe1I/KSxtHJYGM0U59bcNH7ycUuSQwn6M9918KQKNNPXu50h
 vt0rvbUM09Bvq3GWtk6f+Fx20s9Aj+2F/h/nLjnam2DULUoCwB4=
 =E/kQ
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-2026-05-23' of https://gitlab.freedesktop.org/drm/kernel

Pull drm fixes from Dave Airlie:
 "Regular fixes pull, amdgpu/xe being the usual, with bonus msm content
  to bulk things out, otherwise it has the usual scattered changes, with
  amdxdna dropping a badly thought out userspace api.

  gem:
   - clean up LRU locking

  msm:
   - Core:
     - Fixed bindings for SM8650, SM8750 and Eliza
     - Don't use UTS_RELEASE directly
     - Fix typo in clock-names property
   - DPU:
      - Fixed CWB description on Kaanapali
      - Fixed scanline strides for YUV UBWC formats
      - Stopped DSI register dumping to access past the end of region
   - DSI:
      - Fix dumping unaligned regions
   - GPU:
      - Fix GMEM_BASE for a6xx gen3
      - Fix userspace reachable crash on a2xx-a4xx
      - Fix sysprof_active for counter collection with IFPC enabled GPUs
      - Fix shrinker lockdep

  amdgpu:
   - Userq fixes
   - VPE fix
   - SMU 15 fix
   - Misc fixes
   - VCE fixes
   - DC bios parsing fixes
   - DC aux fix
   - Mode1 reset fix
   - RAS fixes

  amdkfd:
   - Misc fixes

  radeon:
   - CS parser fix

  xe:
   - SRIOV related fixes
   - Fix leak and double-free
   - Multi-cast register fixes
   - Multi-queue fix

  i915:
   - Fix joiner color pipeline selection [display]
   - Fix readback for target_rr in Adaptive Sync SDP [dp]
   - Apply Intel DPCD workaround when SDP on prior line used [psr]

  amdxdna:
   - remove mmap and export for ubuf

  bridge:
   - chipone-icn6211: managed bridge cleanup
   - lt66121: acquire reset GPIO
   - megachips: fix clean up on failed IRQ requests

  v3d:
   - fix UAF in error code paths
   - release GEM-object ref on free'd jobs

  virtio:
   - use uninterruptible resv locking in plane updates

  mediatek:
   - fix sparse warnings"

* tag 'drm-fixes-2026-05-23' of https://gitlab.freedesktop.org/drm/kernel: (78 commits)
  drm/xe/oa: Fix exec_queue leak on width check in stream open
  drm/virtio: use uninterruptible resv lock for plane updates
  drm/amdgpu: fix handling in amdgpu_userq_create
  drm/radeon/evergreen_cs: Add missing NULL prefix check in surface check
  drm/amdgpu: userq_va_mapped should remain true once done
  drm/amdgpu: avoid integer overflow in VA range check
  drm/amd/ras: Fix UMC error address allocation leak
  drm/amdgpu: unmap all user mappings of framebuffer and doorbell before mode1 reset
  drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async
  drm/amd/display: Validate GPIO pin LUT table size before iterating
  drm/amd/display: Fix integer overflow in bios_get_image()
  drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id
  drm/amdgpu: use atomic operation to achieve lockless serialization
  drm/amdkfd: Check bounds on allocate_doorbell
  drm/amdgpu/vce3: Fix VCE 3 firmware size and offsets
  drm/amdgpu/vce2: Fix VCE 2 firmware size and offsets
  drm/amdgpu/vce1: Stop using amdgpu_vce_resume
  drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets
  drm/amdgpu/vce1: Don't repeat GTT MGR node allocation
  drm/amdgpu/vce1: Check if VRAM address is lower than GART.
  ...
 2026-05-22 16:15:32 -07:00
Linus Torvalds
0e6582a516 SCSI fixes on 20260522 
Small fixes, two in drivers and the remaining a sign conversion probem in sd
 with no user visible consequences (non-zero is error).
 
 Signed-off-by: James E.J. Bottomley <James.Bottomley@HansenPartnership.com>
 -----BEGIN PGP SIGNATURE-----
 
 iLgEABMIAGAWIQTnYEDbdso9F2cI+arnQslM7pishQUCahCGHxsUgAAAAAAEAA5t
 YW51MiwyLjUrMS4xMiwyLDImHGphbWVzLmJvdHRvbWxleUBoYW5zZW5wYXJ0bmVy
 c2hpcC5jb20ACgkQ50LJTO6YrIX6/wD8DDul4OL9k/6NvnhX93V4yt5yEVUKwyLi
 71sI1y8Y9UIA/R+0OPRjl6z4KOZaMPZqLIQFLOAweVsHpXAQ20IrPcuU
 =7Y5a
 -----END PGP SIGNATURE-----

Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

Pull SCSI fixes from James Bottomley:
 "Small fixes, two in drivers and the remaining a sign conversion probem
  in sd with no user visible consequences (non-zero is error)"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: target: tcm_loop: Fix NULL ptr dereference
  scsi: isci: Fix use-after-free in device removal path
  scsi: sd: Fix return code handling in sd_spinup_disk()
 2026-05-22 16:08:06 -07:00
Linus Torvalds
59825bc9ce platform-drivers-x86 for v7.1-4 
Fixes and New HW Support
 
 - Add ACPI_HANDLE()/ACPI_COMPANION() NULL checks (many drivers) to
   handle match overrides gracefully
 
 - asus-armoury:
 
   - Fix mini-LED mode get/set
 
   - Add support for FA401EA, FX607VU, G614FR, and GU605CP
 
 - bitland-mifs-wmi: Add CONFIG_LEDS_CLASS dependency
 
 - hp-wmi: Add thermal support for Omen 16-c0xxx (board 8902)
 
 - intel/vsec: Fix enable_cnt imbalance due to PCIe error recovery
 
 - surface/aggregator_registry: Remove battery & AC nodes on Surface
 			       Laptop 7 to avoid duplicated devices
 
 - uniwill-laptop:
 
   - Handle uninitialized and invalid charging threshold values
 
   - Accept charging threshold of 0 through power supply sysfs ABI and
     clamp it to 1
 
   - Make 'force' parameter to work also when device descriptor is found
 
   - Do not enable charging limit despite the 'force' parameter to avoid
     permanent damage to battery
 
 The following is an automated shortlog grouped by driver:
 
 acer-wireless:
  -  Check ACPI_COMPANION() against NULL
 
 adv_swbutton:
  -  Check ACPI_HANDLE() against NULL
 
 asus-armoury:
  -  add support for FA401EA
  -  add support for FX607VU
  -  add support for G614FR
  -  add support for GU605CP
  -  fix mini-LED mode get/set on MODE2 devices
 
 asus-laptop:
  -  Check ACPI_COMPANION() against NULL
 
 bitland-mifs-wmi:
  -  add CONFIG_LEDS_CLASS dependency
 
 dell/dell-rbtn:
  -  Check ACPI_COMPANION() against NULL
 
 eeepc-laptop:
  -  Check ACPI_COMPANION() against NULL
 
 fujitsu:
  -  Check ACPI_COMPANION() against NULL
 
 fujitsu-tablet:
  -  Check ACPI_COMPANION() against NULL
 
 hp_accel:
  -  Check ACPI_COMPANION() against NULL
 
 hp-wmi:
  -  fix support for thermal profile Omen 16-с0xxx laptops
 
 intel-hid:
  -  Check ACPI_HANDLE() against NULL
 
 intel/rst:
  -  Check ACPI_COMPANION() against NULL
 
 intel_sar:
  -  Check ACPI_HANDLE() against NULL
 
 intel/smartconnect:
  -  Check ACPI_HANDLE() against NULL
 
 intel-vbtn:
  -  Check ACPI_HANDLE() against NULL
 
 intel/vsec:
  -  Fix enable_cnt imbalance on PCIe error recovery
 
 lg-laptop:
  -  Check ACPI_COMPANION() against NULL
 
 panasonic-laptop:
  -  Check ACPI_COMPANION() against NULL
 
 sony-laptop:
  -  Check ACPI_COMPANION() against NULL
 
 surface: aggregator_registry:
  -  omit battery & AC nodes on Surface Laptop 7
 
 surface: surfacepro3_button:
  -  Check ACPI_COMPANION()
 
 system76:
  -  Check ACPI_COMPANION() against NULL
 
 toshiba_acpi:
  -  Check ACPI_COMPANION() against NULL
 
 toshiba_bluetooth:
  -  Check ACPI_COMPANION() against NULL
 
 toshiba_haps:
  -  Check ACPI_COMPANION() against NULL
 
 uniwill-laptop:
  -  Accept charging threshold of 0
  -  Do not enable the charging limit even when forced
  -  Fix behavior of "force" module param
  -  Properly initialize charging threshold
 
 wireless-hotkey:
  -  Check ACPI_COMPANION() against NULL
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQSCSUwRdwTNL2MhaBlZrE9hU+XOMQUCahBSaQAKCRBZrE9hU+XO
 MXuOAQDhdhmEHMF6DLGsS1oYVgRmLe+JTH7sC+j4GX7EXzdKYQEAtBWYBsVl6FXF
 2ICXDIIg1nUX4L8Ilr5pqnC4qYYLQAM=
 =rdI2
 -----END PGP SIGNATURE-----

Merge tag 'platform-drivers-x86-v7.1-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86

Pull x86 platform driver fixes from

 - Add ACPI_HANDLE()/ACPI_COMPANION() NULL checks (many drivers) to
   handle match overrides gracefully

 - asus-armoury:
    - Fix mini-LED mode get/set
    - Add support for FA401EA, FX607VU, G614FR, and GU605CP

 - bitland-mifs-wmi:
    - Add CONFIG_LEDS_CLASS dependency

 - hp-wmi:
    - Add thermal support for Omen 16-c0xxx (board 8902)

 - intel/vsec:
    - Fix enable_cnt imbalance due to PCIe error recovery

 - surface/aggregator_registry:
    - Remove battery & AC nodes on Surface Laptop 7 to avoid duplicated
      devices

 - uniwill-laptop:
    - Handle uninitialized and invalid charging threshold values
    - Accept charging threshold of 0 through power supply sysfs ABI and
      clamp it to 1
    - Make 'force' parameter to work also when device descriptor is
      found
    - Do not enable charging limit despite the 'force' parameter to
      avoid permanent damage to battery

* tag 'platform-drivers-x86-v7.1-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (35 commits)
  platform/x86: bitland-mifs-wmi: add CONFIG_LEDS_CLASS dependency
  platform/x86: wireless-hotkey: Check ACPI_COMPANION() against NULL
  platform/x86: toshiba_haps: Check ACPI_COMPANION() against NULL
  platform/x86: toshiba_bluetooth: Check ACPI_COMPANION() against NULL
  platform/x86: toshiba_acpi: Check ACPI_COMPANION() against NULL
  platform/x86: system76: Check ACPI_COMPANION() against NULL
  platform/x86: sony-laptop: Check ACPI_COMPANION() against NULL
  platform/x86: panasonic-laptop: Check ACPI_COMPANION() against NULL
  platform/x86: lg-laptop: Check ACPI_COMPANION() against NULL
  platform/x86: intel/smartconnect: Check ACPI_HANDLE() against NULL
  platform/x86: intel/rst: Check ACPI_COMPANION() against NULL
  platform/x86: fujitsu-tablet: Check ACPI_COMPANION() against NULL
  platform/x86: fujitsu: Check ACPI_COMPANION() against NULL
  platform/x86: eeepc-laptop: Check ACPI_COMPANION() against NULL
  platform/x86: dell/dell-rbtn: Check ACPI_COMPANION() against NULL
  platform/x86: asus-laptop: Check ACPI_COMPANION() against NULL
  platform/x86: acer-wireless: Check ACPI_COMPANION() against NULL
  platform/x86: asus-armoury: add support for GU605CP
  platform/x86: asus-armoury: add support for FA401EA
  platform/x86: asus-armoury: add support for G614FR
  ...
 2026-05-22 15:45:26 -07:00
Dave Airlie
84335a9985 - SRIOV related fixes (Wajdeczko, Mohanram) 
- Fix leak and double-free (Lin)
 - Multi-cast register fixes (Gustavo)
 - Multi-queue fix (Niranjana)
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEbSBwaO7dZQkcLOKj+mJfZA7rE8oFAmoPazEACgkQ+mJfZA7r
 E8r5gwf/TypGltHME1VraMkYmNkykoR2B/cFkrLo5HjMrNVnAQm9ZXSIi4EJKeuP
 77w/gBu0H/FvB9nDrXM9arefHVWsNMeRM+eQAoXOKkhPBrmeqKaj05qDvFmkjv2e
 ZJFKzSU0k7+/AaIwpSKb4IktEZf8N8fonAszX8MGZ7yYkyP8TSKwqVYBYhto2m9r
 OLLWTO/tzhSz+l4Xmy3OkvVYBSj23QgZjv+jFzUmM1Xq4dEaxCuqqCQEyDQ0/Wbv
 E2rqdRS5GRHpnhhh/D4bDYejcYyVgcfXVGxXUP0CHUmBCB8Yu4H+fLdT4h6kqu2j
 jkryh/W8pHvNYVIFsLDsrPdHOoiTug==
 =RL0p
 -----END PGP SIGNATURE-----

Merge tag 'drm-xe-fixes-2026-05-21' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes

- SRIOV related fixes (Wajdeczko, Mohanram)
- Fix leak and double-free (Lin)
- Multi-cast register fixes (Gustavo)
- Multi-queue fix (Niranjana)

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Rodrigo Vivi <rodrigo.vivi@intel.com>
Link: https://patch.msgid.link/ag9rR5VwCdkA0lzI@intel.com
 2026-05-23 07:57:08 +10:00
Linus Torvalds
cca95436be phy fixes for 7.1 
Couple of driver fixes
  - Big pile of Qualcomm DP/eDP config fixes and kaanapali PHY PLL
    lock failure fix
  - Apple typec switch/mux leak fix
  - Marvell incoorect register fix for mvebu utmi phy
  - Tegra per-pad calibration fix
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE+vs47OPLdNbVcHzyfBQHDyUjg0cFAmoQjSAACgkQfBQHDyUj
 g0e5NA//dOb7/jrQf2jFlzlK3MprA4DWxpB8o3cFzWWxTix20+jSyBqyVtC/g0EM
 zf0hGPbh3dhmA6hN6wAaYLj+ly9k5TEibqMbziEaZNNYlvO/ugkeOGrFHBLwNkS1
 gpT4n4Zojdarr3OtqkEsFCuaaWtjRl6f5Qz0mT8Q1D1qgb1wHuiQDeHKG/o4yWyZ
 ROyawyCmKebV/T35XUxn+MtGrhVC8CUGhFebn2Cn4JEog915f9uuacFZtRV+SO3C
 wc8s2kEwnCkCiOQjE/f/8Jgx4NtP0FpHu09dJJ81IciOlhPOWIBGmVE1wWwFNdGs
 orJMYwIBcdixfWoFUaxcJaGp/VtDx5cyVqL8ZUyVCj9cN5Az/C917ELkpflPitqv
 jFsclq/fZoYWjvaGGILe+pW6qRG4XPFL3PzqClGKPi4bJpip4mvi6EEKUFpZzg4B
 SlpCal8N6UN1l6Vl8YSTW0WNyeafUpeANRddrVKoignVGbvVS/C7Hs2b4WRE3Ahh
 R8tt8w6Toe69g/syu1X46qAUe9M9/S5zIsKSgELp5zI4TzKtZJ70lLRCm49oNUgO
 AHDCxeIAE9jeokroiEitzO5tvfGhCXLy+1RIx2uLMphlzhSnP4r8RXN+r81/lBtq
 KDwqw2NcZ7V/TQmhOz9rr7Lmy1ltpti76b0isb3MOHVPytWpHpo=
 =SxJy
 -----END PGP SIGNATURE-----

Merge tag 'phy-fixes-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy

Pull phy fixes from Vinod Koul:

 - Big pile of Qualcomm DP/eDP config fixes and kaanapali PHY PLL
   lock failure fix

 - Apple typec switch/mux leak fix

 - Marvell incoorect register fix for mvebu utmi phy

 - Tegra per-pad calibration fix

* tag 'phy-fixes-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy:
  phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp swing config
  phy: apple: atc: Fix typec switch/mux leak on unbind
  phy: spacemit: Remove incorrect clk_disable() in spacemit_usb2phy_init()
  phy: eswin: Fix incorrect error check in probe()
  phy: qcom-qmp-ufs: Fix kaanapali PHY PLL lock failure after SM8650 G4 fix
  phy: exynos5-usbdrd: fix USB 2.0 HS PHY tuning values for Exynos7870
  phy: tegra: xusb: Fix per-pad high-speed termination calibration
  phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access
  phy: qcom: edp: Add PHY-specific LDO config for eDP low vdiff
  phy: qcom: edp: Fix AUX_CFG8 programming for DP mode
  phy: qcom: edp: Add SC7280/SC8180X swing/pre-emphasis tables
  phy: qcom: edp: Add eDP/DP mode switch support
  phy: qcom: edp: Unify generic DP/eDP swing and pre-emphasis tables
 2026-05-22 13:23:21 -07:00
Linus Torvalds
e216d85eaf spi: Fixes for v7.1 
Another batch of driver fixes from Johan fixing error handling paths,
 plus another from Felix.  We also have a new device ID added in the DT
 bindings for SpacemiT K3.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmoQOJYACgkQJNaLcl1U
 h9Cv9AgAg9YV8hoCA8qMNcIurXXnaaJ8+SU2zqOdN9fuHMuxFCnxY+J4xjp1V5b6
 waIJxCFX6qqPMEAzmJrqWkGyJtcE2B3sGioJ++mmNWVAJOwbc8/4QWbQyZHdyvuS
 Zk/NjdAV7BOC30CAO6DfVGi4rXCZEA3ul8I+qCQYl9KOnu8j5tQTVbhZijC9MHBG
 YG+e7stFnx44Psl/IiGvlbVvG6AUi3whlMkX7ep0aeGnz6/g1IVyGty0cMaWlW8K
 8DXOlzmDoCTKLdlqAHO5sN063nA/3utjkFzoTZ98THvsL2vaQnNWxZI1bxyfhG45
 xZAPcx4Q9DTm/REyZnja19E1x6+wsQ==
 =qdyL
 -----END PGP SIGNATURE-----

Merge tag 'spi-fix-v7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi

Pull spi fixes from Mark Brown:
 "Another batch of driver fixes from Johan fixing error handling paths,
  plus another from Felix. We also have a new device ID added in the DT
  bindings for SpacemiT K3"

* tag 'spi-fix-v7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
  spi: dt-bindings: fsl-qspi: support SpacemiT K3
  spi: ti-qspi: fix use-after-free after DMA setup failure
  spi: sprd: fix error pointer deref after DMA setup failure
  spi: qup: fix error pointer deref after DMA setup failure
  spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache()
  spi: ep93xx: fix error pointer deref after DMA setup failure
 2026-05-22 13:19:41 -07:00
Linus Torvalds
ddae1043d8 regulator: Fixes for v7.1 
A couple of fixes here, one very minor Kconfig fix and a fix for a nasty
 issue with error reporting in the tps65219 driver.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmoQOVsACgkQJNaLcl1U
 h9BsEgf+NbodkfOh8KPtRrAto3B89pXrwXpT6Q7d+J0w1cPJa6+VC8yMtDx4IJ2C
 FfDU3V0H9W5Dfgeq4942r7v4E9ZOXcI5MLSwg1GPo5c9ynvbK+mhVbrtd+83IeKE
 KtQmXmhnlAPhx6yuFnjb0FDKaAq+DJemXKQfA/Qf+meQIo8Eg4HMjrO+sKLvwDOB
 o48KdpxdLig/v5K3kfab7QfqB3pDMpA8ryCYCgrrNWyqi3dD0/uC0eyKZjTOOmtG
 Rj1iHFzxCyOBgEIo7LmUTPUQIqzOWK3SOE9hGPcwvEuq6BhF7heMzffJYpwbWokM
 wguAsloFxce18XG3n+bBiHWFRoW/4Q==
 =e7Zg
 -----END PGP SIGNATURE-----

Merge tag 'regulator-fix-v7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator

Pull regulator fixes from Mark Brown:
 "A couple of fixes here, one very minor Kconfig fix and a fix for a
  nasty issue with error reporting in the tps65219 driver"

* tag 'regulator-fix-v7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
  regulator: tps65219: fix irq_data.rdev not being assigned
  regulator: Kconfig: fix a typo in help
 2026-05-22 13:17:29 -07:00
Linus Torvalds
003759d49a Pin control fixes for the v7.1 kernel: 
- Implement the GPIO .get_direction() callback in the Mediatek
   driver to rid dmesg warnings.
 
 - Mark the Qualcomm IPQ4019 pins used as GPIO as using the
   GPIO pin function, so there is no conflict with orthogonal
   muxing.
 
 - Fix incorrect settings of the "PUPD" (pull-up-pull-down)
   register during suspend/resume in the Renesas RZG2L.
 
 - Fix the SMT register cache to be per-bank in the Renesas
   RZG2L.
 
 - Fix the QDSS track clock and control pin group names in the
   Qualcomm Eliza driver.
 
 - Fix a deadlock in the Amlogic driver, caused by playing
   around in sysfs.
 
 - Fix some GPIO wakeup interrupt handling in Qualcomm QCS615.
   and a similar fix for the Qualcomm SM8150.
 
 - Allow parsing DTs without explicit function nodes in the
   Freescale i.MX1 driver.
 
 - Enable the IRQ for the WACF2200 touchscreen using a DMI
   quirk.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEElDRnuGcz/wPCXQWMQRCzN7AZXXMFAmoQdtwACgkQQRCzN7AZ
 XXMAIQ/+KsiMLrdx7/5hapLHAPj2p4ZznO9Tvw0q2JQD4S93AqLosg5njUsyDlCn
 D8mfPx3td7lQX6GbypfnFkppJU7I/wr5UjYn8iouRDVKJSN1zdUXRRylOU9DYpnq
 a7DNR+ScVfxTtNeLFB9XhB5RzxVmkERjVNzan+T+BmHa1M4eUoIBkrwWGV4U9b4d
 2296ESnzKH2mtfbkeh9L1x70705kzWR15hhn2xwHsNwtg/8z7oGxCeZTnbEseuam
 QBzD2sfKVf7+uj4QItIuzyr//RfIVcOsWuxB/jZhgh3ob2plp5T362pV0QOA1706
 TvGYSGyMhz/BobIDKtg7g3q0i5XJpHalA8RRjhY8jWduUymYPti7SUDuhetN/MMK
 z7qiAqzUwvXY5KadVza2P6lu+PKliusdqFSoF5AooC7JwFXGJrCSxno+oR/AzByg
 SuwQt3wBFM/Ik1qtmdt0EL0J3euxCoivPrzTAWyBsY4YoTsGnUXEUn/vAIA7CfIQ
 SjD2XvNJ2okZfWQKfl6pNdpyM/Y9UTNA3wN7qoAfvo0f4Zxyy5eqYfim9FWpgwQ+
 Bchx+CcXc9iEuc9Ja3zzikkR2IVE5AcLlFtPmiKK3nkqhO6MiU+1kzsDk8jT2Bt1
 PYNkIWZjMRZq3Ya56JCOHlxTPAWBG5mXLP1YEz3MwUVVSe+wGwI=
 =bMLM
 -----END PGP SIGNATURE-----

Merge tag 'pinctrl-v7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl

Pull pin control fixes from Linus Walleij:

 - Implement the GPIO .get_direction() callback in the Mediatek driver
   to rid dmesg warnings

 - Mark the Qualcomm IPQ4019 pins used as GPIO as using the GPIO pin
   function, so there is no conflict with orthogonal muxing

 - Fix incorrect settings of the "PUPD" (pull-up-pull-down) register
   during suspend/resume in the Renesas RZG2L

 - Fix the SMT register cache to be per-bank in the Renesas RZG2L

 - Fix the QDSS track clock and control pin group names in the Qualcomm
   Eliza driver

 - Fix a deadlock in the Amlogic driver, caused by playing around in
   sysfs

 - Fix some GPIO wakeup interrupt handling in Qualcomm QCS615. and a
   similar fix for the Qualcomm SM8150

 - Allow parsing DTs without explicit function nodes in the Freescale
   i.MX1 driver

 - Enable the IRQ for the WACF2200 touchscreen using a DMI quirk

* tag 'pinctrl-v7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
  pinctrl-amd: enable IRQ for WACF2200 touchscreen on Lenovo Yoga 7 14AGP11
  pinctrl: imx1: Allow parsing DT without function nodes
  pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150
  pinctrl: qcom: Fix GPIO to PDC wake irq map for qcs615
  pinctrl: meson: amlogic-a4: fix deadlock issue
  pinctrl: qcom: eliza: Fix QDSS trace clock/control pingroup names
  pinctrl: renesas: rzg2l: Fix SMT register cache handling
  pinctrl: renesas: rzg2l: Fix incorrect PUPD register offset for high pins during suspend/resume
  pinctrl: qcom: ipq4019: mark gpio as a GPIO pin function
  pinctrl: mediatek: moore: implement gpio_chip::get_direction()
 2026-05-22 12:33:28 -07:00
Linus Torvalds
99e08debac gpio fixes for v7.1-rc5 
- propagate the error code from regulator_enable() in resume path in
   gpio-pca953x
 - take the device lock when calling device_is_bound() in virtual GPIO
   drivers
 - fix software node leak in remove path in gpio-aggregator
 - fix a potential use-after-free in gpio-aggregator
 - harden the GPIO character device uAPI: check that line config
   attributes are correctly zeroed
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEkeUTLeW1Rh17omX8BZ0uy/82hMMFAmoQIysACgkQBZ0uy/82
 hMO9PRAAkaQ58li/hZYklF0O9jDsnhmK/XdPbCQvGnfRyW+838+iIyreP7NrfCN1
 XmicF7Tvt5Spq0qadSvfddMzlWcR7W15XKKVs4QgulPTZubyIyTty5SjNZZcRBxc
 pqq5Png7agZ0b7L3rFqp2sEU3044oI9+2nkWHhmxRVgoXKQVdD0AqddAJ/xiZg/b
 K1M4mjo4k12nUwo9acPMmAvOftwCiGX56p9qdXl4iobBo9Cn8qfnZgC4Oq8uOHPP
 jeEqINv6aXzw3YZOA+XFeNfqbUwyUSWp0e4KzONgrupFZxV7aqFBIlDYPFnsBMku
 yh0jYQwJZmStIzMoLfElPyudtNNZlssj9egby3b5J4n5npDg2ZZGjfbBmmhFXY4I
 madjzj22EJ/6RyVuieskKG+1P8cUlRJcvHNGAgNmhwKZxz19J5jPceQe0mit1Ofq
 lxAkbsT6XsHoqpcwmYCnsNlO9g3yiUTDjk769wK0mLe28I95Qz/t8KMVQK+PO+ij
 gCWgu/PvsnodIMBJTpiNAJNRHc3YKpevqdTdFY9o2VyZJV+mkdQVjRlYSWxtm4s0
 Liz0f5vP3SVavwqAh9iSs8SUgUSrH5hvLltyj7LBaOF/eGaVqGL8nVj0oWloL1WX
 F7sjO1HSYSWRlJRQoi0/NBE8163JfLpHJih3gZfkRKv1+vqcdvw=
 =4Qne
 -----END PGP SIGNATURE-----

Merge tag 'gpio-fixes-for-v7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux

Pull gpio fixes from Bartosz Golaszewski:

 - propagate the error code from regulator_enable() in resume path in
   gpio-pca953x

 - take the device lock when calling device_is_bound() in virtual GPIO
   drivers

 - fix software node leak in remove path in gpio-aggregator

 - fix a potential use-after-free in gpio-aggregator

 - harden the GPIO character device uAPI: check that line config
   attributes are correctly zeroed

* tag 'gpio-fixes-for-v7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
  gpio: virtuser: lock device when calling device_is_bound()
  gpio: aggregator: lock device when calling device_is_bound()
  gpio: sim: lock device when calling device_is_bound()
  gpio: aggregator: remove the software node when deactivating the aggregator
  gpio: aggregator: fix a potential use-after-free
  gpio: cdev: check if uAPI v2 config attributes are correctly zeroed
  gpio: pca953x: propagate regulator_enable() error from resume
 2026-05-22 12:28:47 -07:00