Commit graph

84,747 commits

Author SHA1 Message Date
Vicki Pfau
c6f1363abb Input: userio - allow setting other id values
Previously, only the type value was settable. The proto value is used
internally for choosing the right drivers, so we should expose it. The
other values make sense to expose as well.

Signed-off-by: Vicki Pfau <vi@endrift.com>
Link: https://patch.msgid.link/20260522015040.3953472-2-vi@endrift.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-06-01 21:49:14 -07:00
Vicki Pfau
37340ac2c7 Input: userio - update maintainer name
She's been committing under the name Lyude Paul for a while

Signed-off-by: Vicki Pfau <vi@endrift.com>
Link: https://patch.msgid.link/20260522015040.3953472-1-vi@endrift.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-06-01 21:49:14 -07:00
Dmitry Torokhov
fff88709f9 Linux 7.1-rc6
-----BEGIN PGP SIGNATURE-----
 
 iQFSBAABCgA8FiEEq68RxlopcLEwq+PEeb4+QwBBGIYFAmocssAeHHRvcnZhbGRz
 QGxpbnV4LWZvdW5kYXRpb24ub3JnAAoJEHm+PkMAQRiGsvMIAIYkDW1HujnkP3/G
 SzQuQozH30O8Fpxdo+axRG6DweP2DTW1lD35YPJJsVto0G2BJZVjzsrx8RSgV6uz
 DDY+Y0x0/VknMZ4JDrDoWRIyHaVV6p3+NcSHhwrxctQsa8UdEf4aXGaTf91nIBSB
 GCX5R2YxxuQSTMZ19F/e+UShnRC5OO0FbCB5xhSnUJX3+eoRe0mcGAQB4DBUKxsx
 BZ5DMOmoiEyPFJbdmy11X0epgJ32qgL7HPYLEo44Vcfy/Ot9lrL9b4vKbG+b3N1P
 YAZccYH/dlpUuk7piR37H87Ntgz/SZcYbJlx2iAWoNk4tMmfRUO16igar8yFHjSt
 FLN2Zx4=
 =ufVr
 -----END PGP SIGNATURE-----

Merge tag 'v7.1-rc6' into next

Sync up with mainline to pull in a fix to IMS PCU driver and other
enhancements.
2026-05-31 19:43:25 -07:00
Linus Torvalds
968966c282 Miscellaneous x86 fixes:
- Make the clearcpuid= boot parameter less prominent
    and warn about its dangers & caveats (Borislav Petkov)
 
  - Do not access the (new) PLATFORM_ID MSR when running as a guest
    (Borislav Petkov)
 
  - x86 ftrace: Relocate %rip-relative percpu refs in dynamic
    trampolines, to fix crash when using such trampolines
    (Alexis Lothoré)
 
  - Fix x86-64 CFI build error (Peter Zijlstra)
 
  - Revert FPU signal return magic number check optimization, because
    it broke CRIU and gVisor in certain FPU configurations
    (Andrei Vagin)
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmob2swRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1jCdA//aKJpLZRwT3cHs/Wmu8oh+MbWVcOJqavz
 Vkdbh5EEDQJ0/HAbrt/ms3gismg08GBTSpycJIKCF+p98n0s3hjBSzVJjF1kLbT+
 vCZH4M3qXiYylghu+gHCYwCPr8cWEWjf+x8nIBlBdHgDPJ88g09VHmtHRdnwFMOt
 lA6lew7UfNlUqxMA6p58elIZtbJvRG7QpUHHjOidut5uBSvrij08vPo1IYFAqUw8
 DvQnvXEv1jit8zAOp7gQDheqdzP058zk6kR177taIxLDJsJlqL8ozJRDW4NB72v2
 HBaj8DiXzsXyovck/H/t36nv5ikotNjDvlP31RZfTZ5VIlfvyNPF1vb38kC8lVlC
 gfq2H8Bw3pktldDKTFh0f1XnkmmiDTEf/zsDqeMSDXfF4t5LPw15nfRLzU9rO4nd
 po6s9GhLdo5lOv6BG2dsFhYxLSZTEHFTe03Q8EzGNgYUJupJVAtRwmnGQP0zv9QJ
 /nMUhZQPGN5PCeXo2YMdyB+wWaKVRjfAE2lz/V97Vb3WfjSAQ1eF+kb0keDFFwQD
 3HQq8k2nxLFIXEX7LJa+qTH2Hnu0PZgoy9yRreo2sOaUHcTfzAIxyT5RzeKl+eDw
 0wUjDGkXS7vCzIOMp4+H2HC3r5aeCTX9YY0XWhxs8M0UcGzO8XEKdgjJTD6KiKCY
 RX9Uj2FmmIA=
 =4sLh
 -----END PGP SIGNATURE-----

Merge tag 'x86-urgent-2026-05-31' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull x86 fixes from Ingo Molnar:

 - Make the clearcpuid= boot parameter less prominent
   and warn about its dangers & caveats (Borislav Petkov)

 - Do not access the (new) PLATFORM_ID MSR when running
   as a guest (Borislav Petkov)

 - x86 ftrace: Relocate %rip-relative percpu refs in dynamic
   trampolines, to fix crash when using such trampolines
   (Alexis Lothoré)

 - Fix x86-64 CFI build error (Peter Zijlstra)

 - Revert FPU signal return magic number check optimization,
   because it broke CRIU and gVisor in certain FPU configurations
   (Andrei Vagin)

* tag 'x86-urgent-2026-05-31' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  Revert "x86/fpu: Refine and simplify the magic number check during signal return"
  x86/kvm/vmx: Fix x86_64 CFI build
  x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines
  x86/microcode: Do not access MSR_IA32_PLATFORM_ID when running as a guest
  Documentation/arch/x86: Hide clearcpuid=
2026-05-31 08:52:16 -07:00
Linus Torvalds
670b77dfeb USB and Thunderbolt fixes for 7.1-rc6
Here is a set of USB fixes and new device ids for 7.1-rc6.  Nothing
 major in here, just lots of tiny fixes for reported issues found by
 users and some older patches found by some scanning tools.  Included in
 here are:
   - typec fixes found by fuzzers that have decided to finally look at
     that device interaction path (i.e. before a driver is bound to a
     device).
   - typec fixes for issues found by users
   - thunderbolt driver fixes for reported problems
   - cdns3 driver fixes
   - dwc3 driver fixes
   - new device quirks added
   - usb serial driver fixes for broken devices
   - other small driver fixes
 
 All of these have been in linux-next for over a week with no reported
 issues.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCahrHyA8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ymLRgCeN/oLFmGYFHjcJEZ8d0AjKbRS34oAn3r822bO
 1mEsGeOojdWNUm4wzu1k
 =pf1m
 -----END PGP SIGNATURE-----

Merge tag 'usb-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB and Thunderbolt fixes from Greg KH:
 "Here is a set of USB fixes and new device ids for 7.1-rc6. Nothing
  major in here, just lots of tiny fixes for reported issues found by
  users and some older patches found by some scanning tools. Included in
  here are:

   - typec fixes found by fuzzers that have decided to finally look at
     that device interaction path (i.e. before a driver is bound to a
     device)

   - typec fixes for issues found by users

   - thunderbolt driver fixes for reported problems

   - cdns3 driver fixes

   - dwc3 driver fixes

   - new device quirks added

   - usb serial driver fixes for broken devices

   - other small driver fixes

  All of these have been in linux-next for over a week with no reported
  issues"

* tag 'usb-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (54 commits)
  USB: serial: cypress_m8: validate interrupt packet headers
  USB: serial: safe_serial: fix memory corruption with small endpoint
  USB: serial: omninet: fix memory corruption with small endpoint
  USB: serial: mxuport: fix memory corruption with small endpoint
  USB: serial: cypress_m8: fix memory corruption with small endpoint
  USB: cdc-acm: Fix bit overlap and move quirk definitions to header
  usb: dwc2: Fix use after free in debug code
  usb: chipidea: core: convert ci_role_switch to local variable
  usb: gadget: f_fs: serialize DMABUF cancel against request completion
  usb: gadget: f_fs: copy only received bytes on short ep0 read
  usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports
  dt-bindings: usb: Fix EIC7700 USB reset's issue
  usbip: vudc: Fix use after free bug in vudc_remove due to race condition
  dt-bindings: usb: ti,omap4-musb: Drop duplicate 'usb-phy' property constraints
  usb: storage: Add quirks for PNY Elite Portable SSD
  USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers
  usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize
  usb: usbtmc: check URB actual_length for interrupt-IN notifications
  xhci: tegra: Fix ghost USB device on dual-role port unplug
  usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind
  ...
2026-05-30 08:37:45 -07:00
Hendrik Noack
185cd1d8cb dt-bindings: Input: Add Wacom W9000-series penabled touchscreens
Add bindings for Wacom W9002 and two Wacom W9007 variants which can be
found in tablets.

W9002, W9007A LT03, and W9007A V1 differ in the length of the return
message containing coordinates, distance, pressure and button status.

Co-developed-by: Ferass El Hafidi <funderscore@postmarketos.org>
Signed-off-by: Ferass El Hafidi <funderscore@postmarketos.org>
Signed-off-by: Hendrik Noack <hendrik-noack@gmx.de>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Link: https://patch.msgid.link/20260528074818.12151-2-hendrik-noack@gmx.de
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-05-29 22:31:39 -07:00
Linus Torvalds
f5e5d3509b spi: Updaets for v7.1
One substantive fix here, fixing corruption of the maximum frequency for
 spi-mem operations which caused users to remember what should have been
 a temporarily modified maximum frequency as the standard going forward,
 potentially causing instability when the modification raised rather than
 lowered the frequency.
 
 We also have a trivial patch which just documents the correct way to
 describe the Qualcomm IPQ5210 SNAND controller in the DT, there are no
 code changes.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmoZyKAACgkQJNaLcl1U
 h9BkSQf+OPY/DuHr46oL4AH36df3FkihkFmaTlipyP2io7HiTgYG67wdXtVfh4H2
 w8D9GT+ukrCGgWkJK+Qgf3IbX19BkL/1kyeDATBJErMd/XHQqn6u38+Lhe3EAqzP
 L4S/pWHmtC/pKynPbsUUkunAYeUa3DK6ZHteZyCe/R+fTKizXOH5Lh74Dcm/pa+V
 b8Aut8Igq32K5KXDkk+TzACkiGDaFs+M7QDfNGI9WN3zBrzxWtS/9ktF5/cN5gBG
 dzjcLb+XJoZnJHwMa7geS7cVvKpPMbqX8fYwip+hhaPfyugP9EvdPibcAhUltGw3
 TNFYV4HpFeGuf7yIoEIzapvVdvvbjA==
 =iELF
 -----END PGP SIGNATURE-----

Merge tag 'spi-fix-v7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi

Pull spi fixes from Mark Brown:
 "One substantive fix here, fixing corruption of the maximum frequency
  for spi-mem operations which caused users to remember what should have
  been a temporarily modified maximum frequency as the standard going
  forward, potentially causing instability when the modification raised
  rather than lowered the frequency.

  We also have a trivial patch which just documents the correct way to
  describe the Qualcomm IPQ5210 SNAND controller in the DT, there are no
  code changes"

* tag 'spi-fix-v7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
  spi: spi-mem: avoid mutating op template in spi_mem_supports_op()
  spi: dt-bindings: spi-qpic-snand: Add ipq5210 compatible
2026-05-29 18:07:37 -07:00
Linus Torvalds
3e20009988 Including fixes from netfilter.
Current release - regressions:
 
   - netfilter: walk fib6_siblings under RCU
 
 Previous releases - regressions:
 
   - netlink: fix sending unassigned nsid after assigned one
 
   - bridge: fix sleep in atomic context in netlink path
 
   - sched: fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop
 
   - ipv4: fix net->ipv4.sysctl_local_reserved_ports UaF
 
   - eth: tun: free page on short-frame rejection in tun_xdp_one()
 
 Previous releases - always broken:
 
   - skbuff: fix missing zerocopy reference in pskb_carve helpers
 
   - handshake: drain pending requests at net namespace exit
 
   - ethtool:
     - rss: avoid modifying the RSS context response
     - module: avoid leaking a netdev ref on module flash errors
     - coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES
 
   - netfilter: fix dst corruption in same register operation
 
   - nfc: hci: fix out-of-bounds read in HCP header parsing
 
   - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()
 
   - eth: vti: use ip6_tnl.net in vti6_changelink().
 
   - eth: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()
 
 Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 
 iQJGBAABCgAwFiEEg1AjqC77wbdLX2LbKSR5jcyPE6QFAmoYVTISHHBhYmVuaUBy
 ZWRoYXQuY29tAAoJECkkeY3MjxOkYfoP/jBxdUf2IirOjl/vjJFm7cXzcCdTWreb
 HmlvVRPF0YDuwQEjaZA+Ed/+wi0QIiyckI60Ltpfz9DbSm3ugstfUxPNWKVb5HZQ
 TI1diAa+uTmaXndC5Kb56U/KNMcMZOJ0FZwHheU2mC/7USpB9S/gaGYf2vxCOF9B
 huMrCuvoHhASxaL6W1xyYR3P4ouGS9XoQU/sGRWAynpi45BZdFF/Y8W2YrCk0IKc
 SwkWbId2Ek6/2+f3pWKYbE88UEjpNh2U6K+kcAgy/UN3N0+tb91kuOrn/5Z+WjE7
 3ZdEBvALj6K0P7BxsR64M1ikVgm2KcZAn8UH5UOqkzlP3VGWHYbbk/4KvEGD1oJF
 p0lauztIkPPdq16Dau8v+KHw5UU4vBpEDo3323hh7kcSIu7cJkWSVxo7/WDjokzT
 HlIZtzKpXwCUSSCNmV3y3zXR/Xl41HOzU5lZv6f8P2hkMfyIu9te9lXF6Foc6r2u
 Ng0oVkevURpGhqpKQKxRtaApPrfOCYFkN4aVzvm5haxhFcughJZmQcjVbu03l4CM
 /nddhYop7D2NdnZzSdlBO1bK/KBebZCYlSKZJGjdL7zqIOQAjjw9UoW0rU+84pkU
 dcvFBPm+iWAhvwWEGaUrnuNcYth/umNMTzC4domLUyPrVydSUH0zi0RQYc9mXffR
 EvWEj952b4o0
 =IBwj
 -----END PGP SIGNATURE-----

Merge tag 'net-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Paolo Abeni:
 "This is again significantly bigger than the same point into the
  previous cycle, but at least smaller than last week.

  I'm not aware of any pending regression for the current cycle.

  Including fixes from netfilter.

  Current release - regressions:

    - netfilter: walk fib6_siblings under RCU

  Previous releases - regressions:

    - netlink: fix sending unassigned nsid after assigned one

    - bridge: fix sleep in atomic context in netlink path

    - sched: fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop

    - ipv4: fix net->ipv4.sysctl_local_reserved_ports UaF

    - eth: tun: free page on short-frame rejection in tun_xdp_one()

  Previous releases - always broken:

    - skbuff: fix missing zerocopy reference in pskb_carve helpers

    - handshake: drain pending requests at net namespace exit

    - ethtool:
       - rss: avoid modifying the RSS context response
       - module: avoid leaking a netdev ref on module flash errors
       - coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES

    - netfilter: fix dst corruption in same register operation

    - nfc: hci: fix out-of-bounds read in HCP header parsing

    - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()

    - eth:
       - vti: use ip6_tnl.net in vti6_changelink().
       - vxlan: do not reuse cached ip_hdr() value after
         skb_tunnel_check_pmtu()"

* tag 'net-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (94 commits)
  dpll: zl3073x: make frequency monitor a per-device attribute
  dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work
  dpll: export __dpll_device_change_ntf() for use under dpll_lock
  net/handshake: Drain pending requests at net namespace exit
  net/handshake: Verify file-reference balance in submit paths
  net/handshake: Close the submit-side sock_hold race
  net/handshake: hand off the pinned file reference to accept_doit
  net/handshake: Take a long-lived file reference at submit
  net/handshake: Pass negative errno through handshake_complete()
  nvme-tcp: store negative errno in queue->tls_err
  net/handshake: Use spin_lock_bh for hn_lock
  net: skbuff: fix missing zerocopy reference in pskb_carve helpers
  net: hibmcge: move dma_rmb() after dma_sync_single_for_cpu() in RX path
  net: hibmcge: disable Relaxed Ordering to fix RX packet corruption
  selftests/tc-testing: Add netem test case exercising loops
  selftests/tc-testing: Add mirred test cases exercising loops
  net/sched: act_mirred: Fix return code in early mirred redirect error paths
  net/sched: act_mirred: Fix blockcast recursion bypass leading to stack overflow
  net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop
  net/sched: fix packet loop on netem when duplicate is on
  ...
2026-05-28 13:13:48 -07:00
Chuck Lever
6b22d433aa net/handshake: Pass negative errno through handshake_complete()
handshake_complete() declares status as unsigned int and
tls_handshake_done() negates that value (-status) before handing
it to the TLS consumer. Consumers match on negative errno
constants -- xs_tls_handshake_done() has

	switch (status) {
	case 0:
	case -EACCES:
	case -ETIMEDOUT:
		lower_transport->xprt_err = status;
		break;
	default:
		lower_transport->xprt_err = -EACCES;
	}

so the API as designed expects callers to pass positive errno
values that the tlshd shim then negates.

Three internal callers in handshake_nl_accept_doit(), the
net-exit drain, and a kunit test follow kernel convention and
pass negative errnos -- -EIO, -ETIMEDOUT, -ETIMEDOUT. The
implicit conversion to unsigned int turns -ETIMEDOUT into
0xFFFFFF92; the subsequent -status in tls_handshake_done()
wraps back to 110, the consumer's switch falls through, and
the xprt reports -EACCES on what should be -ETIMEDOUT or -EIO.

Fix the API rather than the call sites. The natural kernel
convention is negative errno in, negative errno out. Change
handshake_complete() and hp_done to take int status, drop the
negation in tls_handshake_done(), and negate once in
handshake_nl_done_doit() where status arrives from the wire
as an unsigned netlink attribute. The three internal callers
were already correct under that convention and need no change.

At the same wire boundary, declare MAX_ERRNO as the netlink
policy upper bound for HANDSHAKE_A_DONE_STATUS. Attribute
validation rejects out-of-range values before
handshake_nl_done_doit() runs, and negating a bounded u32 there
stays within int range -- closing the UBSAN-visible signed-
integer overflow that an unconstrained u32 would invoke.

Fixes: 3b3009ea8a ("net/handshake: Create a NETLINK service for handling handshake requests")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Reviewed-by: Hannes Reinecke <hare@kernel.org>
Link: https://patch.msgid.link/20260525-handshake-file-pin-v3-3-66c616906ead@oracle.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-05-28 13:35:31 +02:00
Varadarajan Narayanan
60474437af
spi: dt-bindings: spi-qpic-snand: Add ipq5210 compatible
Since the QPIC-SPI-NAND flash controller present in ipq5210 is the same
as the one found in ipq9574, document the ipq5210 compatible and with
ipq9574 as the fallback.

Signed-off-by: Varadarajan Narayanan <varadarajan.narayanan@oss.qualcomm.com>
Link: https://patch.msgid.link/20260514-ipq5210-nand-v1-1-cbdd7492e826@oss.qualcomm.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2026-05-26 19:38:46 +01:00
Borislav Petkov (AMD)
80501dff81 Documentation/arch/x86: Hide clearcpuid=
This option was never meant to be used in production because it solely
clears the X86_FEATURE kernel-internal representation of what CPUID bits
it has detected and doesn't do any *proper* feature disablement like
clearing CR4.CET in the user shadow stack case, for example.

So remove its documentation so that it doesn't get used in production
and people get silly ideas. It is meant strictly for debugging; and if
a chicken bit for properly disabling a feature is warranted, then that
would need proper enablement.

No functional changes.

Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Cc: Mathias Krause <minipli@grsecurity.net>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Link: https://patch.msgid.link/20260520202508.160112-1-bp@kernel.org
2026-05-26 05:37:20 +02:00
Linus Torvalds
4a5860ea60 drm fixes for 7.1-rc5
gem:
 - clean up LRU locking
 
 msm:
 - Core:
  - Fixed bindings for SM8650, SM8750 and Eliza
  - Don't use UTS_RELEASE directly
  - Fix typo in clock-names property
 - DPU:
   - Fixed CWB description on Kaanapali
   - Fixed scanline strides for YUV UBWC formats
   - Stopped DSI register dumping to access past the end of region
 - DSI:
   - Fix dumping unaligned regions
 - GPU:
   - Fix GMEM_BASE for a6xx gen3
   - Fix userspace reachable crash on a2xx-a4xx
   - Fix sysprof_active for counter collection with IFPC enabled GPUs
   - Fix shrinker lockdep
 
 amdgpu:
 - Userq fixes
 - VPE fix
 - SMU 15 fix
 - Misc fixes
 - VCE fixes
 - DC bios parsing fixes
 - DC aux fix
 - Mode1 reset fix
 - RAS fixes
 
 amdkfd:
 - Misc fixes
 
 radeon:
 - CS parser fix
 
 xe:
 - SRIOV related fixes
 - Fix leak and double-free
 - Multi-cast register fixes
 - Multi-queue fix
 
 i915:
 - Fix joiner color pipeline selection [display]
 - Fix readback for target_rr in Adaptive Sync SDP [dp]
 - Apply Intel DPCD workaround when SDP on prior line used [psr]
 
 amdxdna:
 - remove mmap and export for ubuf
 
 bridge:
 - chipone-icn6211: managed bridge cleanup
 - lt66121: acquire reset GPIO
 - megachips: fix clean up on failed IRQ requests
 
 v3d:
 - fix UAF in error code paths
 - release GEM-object ref on free'd jobs
 
 virtio:
 - use uninterruptible resv locking in plane updates
 
 mediatek:
 - fix sparse warnings
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmoQ1MQACgkQDHTzWXnE
 hr6iOQ/9FmcbV1C3rSE3UxrWrxpUnP++f4kxUu8Ol6KX3SJLgeCqlUsoX7XC1hyH
 tPsbRyfNhHOUL3j2QGEkXko/Ip4BodykzIqU9rnA+mdFMwD7DvKOC6irUz8SrDg3
 re7b8OZVkI5EfK6GK0wpjuzWOVnfVXHn4mtPhTrnS4EqoznM4g12bReW0qx0j0m3
 m877elDJZf8YHbU69qa7ulXJYUCSVz6wbLBpKE1lLv+GrJ0ijLAX1F5xNEIcezeA
 bGwj/tY+mfYc8SdvTC3y2fB4mssFErmtQ/TOx0PYpU38mdFhNdJkUm1QOHjI6ty1
 7CiyZqJmVAPBxvj/omRROeR7DFkytnweYOaFhGXPIdXYGvm5Kf5QunqmhU880Do7
 FXAZUaKJdLY5VrJ1tuqSqH8uw/ZX7TZo6sPgamsXxDf8cxHkPNbHfEoA1vRMO7Iy
 tqgfFl1sYXFvVBB0AZd0CKBefElZXw2Nwzs7Um4dPL/nMvk5wC2n/mQYaM9a9BCi
 jLwVQT5FXUU2YY47AwUz+1Sxg4EwBAdflncKGS7xyHvmhJrVrOdUrZ1wIg2+19ug
 gjV4DO2J6iYMI9ZaSe1I/KSxtHJYGM0U59bcNH7ycUuSQwn6M9918KQKNNPXu50h
 vt0rvbUM09Bvq3GWtk6f+Fx20s9Aj+2F/h/nLjnam2DULUoCwB4=
 =E/kQ
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-2026-05-23' of https://gitlab.freedesktop.org/drm/kernel

Pull drm fixes from Dave Airlie:
 "Regular fixes pull, amdgpu/xe being the usual, with bonus msm content
  to bulk things out, otherwise it has the usual scattered changes, with
  amdxdna dropping a badly thought out userspace api.

  gem:
   - clean up LRU locking

  msm:
   - Core:
     - Fixed bindings for SM8650, SM8750 and Eliza
     - Don't use UTS_RELEASE directly
     - Fix typo in clock-names property
   - DPU:
      - Fixed CWB description on Kaanapali
      - Fixed scanline strides for YUV UBWC formats
      - Stopped DSI register dumping to access past the end of region
   - DSI:
      - Fix dumping unaligned regions
   - GPU:
      - Fix GMEM_BASE for a6xx gen3
      - Fix userspace reachable crash on a2xx-a4xx
      - Fix sysprof_active for counter collection with IFPC enabled GPUs
      - Fix shrinker lockdep

  amdgpu:
   - Userq fixes
   - VPE fix
   - SMU 15 fix
   - Misc fixes
   - VCE fixes
   - DC bios parsing fixes
   - DC aux fix
   - Mode1 reset fix
   - RAS fixes

  amdkfd:
   - Misc fixes

  radeon:
   - CS parser fix

  xe:
   - SRIOV related fixes
   - Fix leak and double-free
   - Multi-cast register fixes
   - Multi-queue fix

  i915:
   - Fix joiner color pipeline selection [display]
   - Fix readback for target_rr in Adaptive Sync SDP [dp]
   - Apply Intel DPCD workaround when SDP on prior line used [psr]

  amdxdna:
   - remove mmap and export for ubuf

  bridge:
   - chipone-icn6211: managed bridge cleanup
   - lt66121: acquire reset GPIO
   - megachips: fix clean up on failed IRQ requests

  v3d:
   - fix UAF in error code paths
   - release GEM-object ref on free'd jobs

  virtio:
   - use uninterruptible resv locking in plane updates

  mediatek:
   - fix sparse warnings"

* tag 'drm-fixes-2026-05-23' of https://gitlab.freedesktop.org/drm/kernel: (78 commits)
  drm/xe/oa: Fix exec_queue leak on width check in stream open
  drm/virtio: use uninterruptible resv lock for plane updates
  drm/amdgpu: fix handling in amdgpu_userq_create
  drm/radeon/evergreen_cs: Add missing NULL prefix check in surface check
  drm/amdgpu: userq_va_mapped should remain true once done
  drm/amdgpu: avoid integer overflow in VA range check
  drm/amd/ras: Fix UMC error address allocation leak
  drm/amdgpu: unmap all user mappings of framebuffer and doorbell before mode1 reset
  drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async
  drm/amd/display: Validate GPIO pin LUT table size before iterating
  drm/amd/display: Fix integer overflow in bios_get_image()
  drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id
  drm/amdgpu: use atomic operation to achieve lockless serialization
  drm/amdkfd: Check bounds on allocate_doorbell
  drm/amdgpu/vce3: Fix VCE 3 firmware size and offsets
  drm/amdgpu/vce2: Fix VCE 2 firmware size and offsets
  drm/amdgpu/vce1: Stop using amdgpu_vce_resume
  drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets
  drm/amdgpu/vce1: Don't repeat GTT MGR node allocation
  drm/amdgpu/vce1: Check if VRAM address is lower than GART.
  ...
2026-05-22 16:15:32 -07:00
Linus Torvalds
59825bc9ce platform-drivers-x86 for v7.1-4
Fixes and New HW Support
 
 - Add ACPI_HANDLE()/ACPI_COMPANION() NULL checks (many drivers) to
   handle match overrides gracefully
 
 - asus-armoury:
 
   - Fix mini-LED mode get/set
 
   - Add support for FA401EA, FX607VU, G614FR, and GU605CP
 
 - bitland-mifs-wmi: Add CONFIG_LEDS_CLASS dependency
 
 - hp-wmi: Add thermal support for Omen 16-c0xxx (board 8902)
 
 - intel/vsec: Fix enable_cnt imbalance due to PCIe error recovery
 
 - surface/aggregator_registry: Remove battery & AC nodes on Surface
 			       Laptop 7 to avoid duplicated devices
 
 - uniwill-laptop:
 
   - Handle uninitialized and invalid charging threshold values
 
   - Accept charging threshold of 0 through power supply sysfs ABI and
     clamp it to 1
 
   - Make 'force' parameter to work also when device descriptor is found
 
   - Do not enable charging limit despite the 'force' parameter to avoid
     permanent damage to battery
 
 The following is an automated shortlog grouped by driver:
 
 acer-wireless:
  -  Check ACPI_COMPANION() against NULL
 
 adv_swbutton:
  -  Check ACPI_HANDLE() against NULL
 
 asus-armoury:
  -  add support for FA401EA
  -  add support for FX607VU
  -  add support for G614FR
  -  add support for GU605CP
  -  fix mini-LED mode get/set on MODE2 devices
 
 asus-laptop:
  -  Check ACPI_COMPANION() against NULL
 
 bitland-mifs-wmi:
  -  add CONFIG_LEDS_CLASS dependency
 
 dell/dell-rbtn:
  -  Check ACPI_COMPANION() against NULL
 
 eeepc-laptop:
  -  Check ACPI_COMPANION() against NULL
 
 fujitsu:
  -  Check ACPI_COMPANION() against NULL
 
 fujitsu-tablet:
  -  Check ACPI_COMPANION() against NULL
 
 hp_accel:
  -  Check ACPI_COMPANION() against NULL
 
 hp-wmi:
  -  fix support for thermal profile Omen 16-с0xxx laptops
 
 intel-hid:
  -  Check ACPI_HANDLE() against NULL
 
 intel/rst:
  -  Check ACPI_COMPANION() against NULL
 
 intel_sar:
  -  Check ACPI_HANDLE() against NULL
 
 intel/smartconnect:
  -  Check ACPI_HANDLE() against NULL
 
 intel-vbtn:
  -  Check ACPI_HANDLE() against NULL
 
 intel/vsec:
  -  Fix enable_cnt imbalance on PCIe error recovery
 
 lg-laptop:
  -  Check ACPI_COMPANION() against NULL
 
 panasonic-laptop:
  -  Check ACPI_COMPANION() against NULL
 
 sony-laptop:
  -  Check ACPI_COMPANION() against NULL
 
 surface: aggregator_registry:
  -  omit battery & AC nodes on Surface Laptop 7
 
 surface: surfacepro3_button:
  -  Check ACPI_COMPANION()
 
 system76:
  -  Check ACPI_COMPANION() against NULL
 
 toshiba_acpi:
  -  Check ACPI_COMPANION() against NULL
 
 toshiba_bluetooth:
  -  Check ACPI_COMPANION() against NULL
 
 toshiba_haps:
  -  Check ACPI_COMPANION() against NULL
 
 uniwill-laptop:
  -  Accept charging threshold of 0
  -  Do not enable the charging limit even when forced
  -  Fix behavior of "force" module param
  -  Properly initialize charging threshold
 
 wireless-hotkey:
  -  Check ACPI_COMPANION() against NULL
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQSCSUwRdwTNL2MhaBlZrE9hU+XOMQUCahBSaQAKCRBZrE9hU+XO
 MXuOAQDhdhmEHMF6DLGsS1oYVgRmLe+JTH7sC+j4GX7EXzdKYQEAtBWYBsVl6FXF
 2ICXDIIg1nUX4L8Ilr5pqnC4qYYLQAM=
 =rdI2
 -----END PGP SIGNATURE-----

Merge tag 'platform-drivers-x86-v7.1-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86

Pull x86 platform driver fixes from

 - Add ACPI_HANDLE()/ACPI_COMPANION() NULL checks (many drivers) to
   handle match overrides gracefully

 - asus-armoury:
    - Fix mini-LED mode get/set
    - Add support for FA401EA, FX607VU, G614FR, and GU605CP

 - bitland-mifs-wmi:
    - Add CONFIG_LEDS_CLASS dependency

 - hp-wmi:
    - Add thermal support for Omen 16-c0xxx (board 8902)

 - intel/vsec:
    - Fix enable_cnt imbalance due to PCIe error recovery

 - surface/aggregator_registry:
    - Remove battery & AC nodes on Surface Laptop 7 to avoid duplicated
      devices

 - uniwill-laptop:
    - Handle uninitialized and invalid charging threshold values
    - Accept charging threshold of 0 through power supply sysfs ABI and
      clamp it to 1
    - Make 'force' parameter to work also when device descriptor is
      found
    - Do not enable charging limit despite the 'force' parameter to
      avoid permanent damage to battery

* tag 'platform-drivers-x86-v7.1-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (35 commits)
  platform/x86: bitland-mifs-wmi: add CONFIG_LEDS_CLASS dependency
  platform/x86: wireless-hotkey: Check ACPI_COMPANION() against NULL
  platform/x86: toshiba_haps: Check ACPI_COMPANION() against NULL
  platform/x86: toshiba_bluetooth: Check ACPI_COMPANION() against NULL
  platform/x86: toshiba_acpi: Check ACPI_COMPANION() against NULL
  platform/x86: system76: Check ACPI_COMPANION() against NULL
  platform/x86: sony-laptop: Check ACPI_COMPANION() against NULL
  platform/x86: panasonic-laptop: Check ACPI_COMPANION() against NULL
  platform/x86: lg-laptop: Check ACPI_COMPANION() against NULL
  platform/x86: intel/smartconnect: Check ACPI_HANDLE() against NULL
  platform/x86: intel/rst: Check ACPI_COMPANION() against NULL
  platform/x86: fujitsu-tablet: Check ACPI_COMPANION() against NULL
  platform/x86: fujitsu: Check ACPI_COMPANION() against NULL
  platform/x86: eeepc-laptop: Check ACPI_COMPANION() against NULL
  platform/x86: dell/dell-rbtn: Check ACPI_COMPANION() against NULL
  platform/x86: asus-laptop: Check ACPI_COMPANION() against NULL
  platform/x86: acer-wireless: Check ACPI_COMPANION() against NULL
  platform/x86: asus-armoury: add support for GU605CP
  platform/x86: asus-armoury: add support for FA401EA
  platform/x86: asus-armoury: add support for G614FR
  ...
2026-05-22 15:45:26 -07:00
Linus Torvalds
e216d85eaf spi: Fixes for v7.1
Another batch of driver fixes from Johan fixing error handling paths,
 plus another from Felix.  We also have a new device ID added in the DT
 bindings for SpacemiT K3.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmoQOJYACgkQJNaLcl1U
 h9Cv9AgAg9YV8hoCA8qMNcIurXXnaaJ8+SU2zqOdN9fuHMuxFCnxY+J4xjp1V5b6
 waIJxCFX6qqPMEAzmJrqWkGyJtcE2B3sGioJ++mmNWVAJOwbc8/4QWbQyZHdyvuS
 Zk/NjdAV7BOC30CAO6DfVGi4rXCZEA3ul8I+qCQYl9KOnu8j5tQTVbhZijC9MHBG
 YG+e7stFnx44Psl/IiGvlbVvG6AUi3whlMkX7ep0aeGnz6/g1IVyGty0cMaWlW8K
 8DXOlzmDoCTKLdlqAHO5sN063nA/3utjkFzoTZ98THvsL2vaQnNWxZI1bxyfhG45
 xZAPcx4Q9DTm/REyZnja19E1x6+wsQ==
 =qdyL
 -----END PGP SIGNATURE-----

Merge tag 'spi-fix-v7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi

Pull spi fixes from Mark Brown:
 "Another batch of driver fixes from Johan fixing error handling paths,
  plus another from Felix. We also have a new device ID added in the DT
  bindings for SpacemiT K3"

* tag 'spi-fix-v7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
  spi: dt-bindings: fsl-qspi: support SpacemiT K3
  spi: ti-qspi: fix use-after-free after DMA setup failure
  spi: sprd: fix error pointer deref after DMA setup failure
  spi: qup: fix error pointer deref after DMA setup failure
  spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache()
  spi: ep93xx: fix error pointer deref after DMA setup failure
2026-05-22 13:19:41 -07:00
Linus Torvalds
c22407252a sound fixes for 7.1-rc5
As expected, we still continue receiving lots of small fixes.
 One major change is about HD-audio pending IRQ handling, but this
 would influence only on odd machines or slow VMs.  There are a few
 other fixes for the core part, but most of them are not-too-serious
 UAF fixes, while the rest are mostly device-specific fixes and quirks.
 
 ALSA Core:
 - Fix for PCM silencing with bogus iov_iter
 - Fixes for past-the-end iterators in timer and seq
 - Serialization of UMP output teardown
 - Rate-limit ELD parsing errors
 
 HD-audio:
 - Fixes for IRQ work handling and SSID matching
 - Various Realtek quirks for HP and ASUS laptops, including LED fixes
 
 ASoC:
 - Intel: ACPI match table updates for PTL, NVL, and ARL platforms
 - Cirrus Logic: Fixes for cs-amp-lib and cs35l56 codecs
 - Various platform fixes for AMD, FSL SAI, TI OMAP, and Qualcomm
 - DT-binding fix for MediaTek
 
 Others:
 - USB ua101: Reject too-short USB descriptors
 - Scarlett2: Fix for flash writes
 - ASIHPI: Fix for potential OOB access
 - AMD SPI: Fix for bus number in ACPI probe
 
 MAINTAINERS:
 - Updates for SOF and TI maintainers
 -----BEGIN PGP SIGNATURE-----
 
 iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmoQGYEOHHRpd2FpQHN1
 c2UuZGUACgkQLtJE4w1nLE++khAAxtTrTwq5GZMAA0C1OMBI9SxclGABBTaMMkYD
 lXjX7z/59Iw5YMkIuKEPZUn9Q9huoTd9vgfWUgCANP5zRGO63Tm+jottFco8w+YU
 KrOvBjy8kQ9GOjrN5Hoy8DKz1tJBz8SXQW08/GEL1gUqHdgxJjunAiYXcTJ+A3jo
 yL5GASW+C/G1sErpC+ixAlnRRnjt8PP4xtX05BtSQMw4hsEtlalBR20VqCKwUNpi
 9T2wxxB8+GwybeFE+3KTl2T3IsFPtUiqDfph54MW+9GaYGVcmxKR98Cs0EAx+ABZ
 XgnwofwTOSMOfpmjSBG4oCVyWL7RPd8thjcT52qrYECPLWiPwguvO0tc2dnWIiFN
 m1qsZh7lCEiROZ6ZRefQTLWTHzs/yo2oW41I+owJCERyw23IzuCJm2+JvCyepz4h
 wBxdnr6lC8DimwAOaqHM0eSmPLBGz//YW+lHwkVIsMMjEhCexm0BVDSjhh1beC0N
 NijeMeIDVj666hs41AcejWqOutSm37amWaCSpfiWNWqE6tJljPny+p9qwgzunb4d
 /NLxNSPIQaohQJ12axSR3fMU7FgMK56hzbb3x4t/da++JfJOviOA01zJq3oaHMOK
 XIpqt5W5c/mNRJWvnOKFXNbOGpLmfsI8ox7mbqZdHFpvqzpK2VDw6jQRMbagPZFL
 nOjwHWE=
 =7KbQ
 -----END PGP SIGNATURE-----

Merge tag 'sound-7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "As expected, we still continue receiving lots of small fixes.

  One major change is about HD-audio pending IRQ handling, but this
  would influence only on odd machines or slow VMs. There are a few
  other fixes for the core part, but most of them are not-too-serious
  UAF fixes, while the rest are mostly device-specific fixes and quirks.

  ALSA Core:
   - Fix for PCM silencing with bogus iov_iter
   - Fixes for past-the-end iterators in timer and seq
   - Serialization of UMP output teardown
   - Rate-limit ELD parsing errors

  HD-audio:
   - Fixes for IRQ work handling and SSID matching
   - Various Realtek quirks for HP and ASUS laptops, including LED fixes

  ASoC:
   - Intel: ACPI match table updates for PTL, NVL, and ARL platforms
   - Cirrus Logic: Fixes for cs-amp-lib and cs35l56 codecs
   - Various platform fixes for AMD, FSL SAI, TI OMAP, and Qualcomm
   - DT-binding fix for MediaTek

  Others:
   - USB ua101: Reject too-short USB descriptors
   - Scarlett2: Fix for flash writes
   - ASIHPI: Fix for potential OOB access
   - AMD SPI: Fix for bus number in ACPI probe

  MAINTAINERS:
   - Updates for SOF and TI maintainers"

* tag 'sound-7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (47 commits)
  ASoC: codecs: pcm512x: fix null-ptr dereference in pcm512x_overclock_xxx_put()
  ASoC: Intel: soc-acpi-intel-ptl-match: Remove unnecessary cs42l43 match
  ASoC: soc-acpi-intel-ptl-match: Make Chrome matches conditional
  ASoC: Intel: soc-acpi: Add entry for sof_es8336 in NVL match table.
  ASoC: Intel: sof_sdw: Add support for nvlrvp in NVL platform
  ASoC: cs-amp-lib: Fix typo in error message: write -> read
  ASoC: cs-amp-lib: Fix missing dput() after debugfs_lookup()
  ASoC: cs-amp-lib: Fix wrong sizeof() in _cs_amp_set_efi_calibration_data()
  ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove()
  MAINTAINERS: ASoC: Intel/SOF: Remove Ranjani Sridharan as maintainer
  ALSA: seq: Serialize UMP output teardown with event_input
  ALSA: scarlett2: Allow flash writes ending at segment boundary
  ALSA: hda/realtek: Add LED quirk for HP ProBook 430 G6
  ALSA: hda/intel: Make sure to cancel irq-pending work at closing PCM stream
  ALSA: hda: Move irq pending work into hda-intel stream
  ASoC: soc-utils: Add missing va_end in snd_soc_ret()
  ALSA: ua101: Reject too-short USB descriptors
  ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP 16 Piston OmniBook X
  ALSA: seq: avoid past-the-end iterator in snd_seq_create_port()
  ALSA: timer: avoid past-the-end iterator in snd_timer_dev_register()
  ...
2026-05-22 12:22:22 -07:00
Linus Torvalds
45255ea1ca Power management fixes for 7.1-rc5
- Fix maximum frequency computation in the intel_pstate driver for
    Raptor Lake-E and Bartlett Lake that are SMP platforms derived from
    hybrid ones (Rafael Wysocki, Henry Tseng)
 
  - Fix the description of asymmetric packing with SMT in the
    intel_pstate driver documentation (Ricardo Neri)
 
  - Fix multiple amd-pstate driver issues related to dynamic EPP support
    added recently, including making it opt-in only (K Prateek Nayak,
    Mario Limonciello)
 -----BEGIN PGP SIGNATURE-----
 
 iQFGBAABCAAwFiEEcM8Aw/RY0dgsiRUR7l+9nS/U47UFAmoQUcUSHHJqd0Byand5
 c29ja2kubmV0AAoJEO5fvZ0v1OO11vsH/jvBd0iLTh4n5yqReewjoRMsEox2xM+j
 z+GjLcLINdb5Tfafbj9N19O7l1KrmlliFWv0aVEHkMhwByP/mrLHKqAwk11HpYlj
 4qctvsBjaT0NMjF3+yQ3k8aL1eUL8HhHND9WHNJBiZgh1VT2hgJ/63MXFeL/dBH4
 gK9UUdb0JPBso0XxUFtPKfbSYnzTZTX1WBWsNdkFFbb6gzaO68FQFocls2c/7Ykn
 ctrLEAo/cKbL817osKiwcTlmTwXC85L5eF1woWyLMdqHJ4MnmaVhQGZgirXdoDV+
 1gZPaO3M/bm+B1esI35B2Jhkml5t9ejooqAg9SO4JJ1LcoxvltwOBJw=
 =ufSV
 -----END PGP SIGNATURE-----

Merge tag 'pm-7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull power management fixes from Rafael Wysocki:
 "These fix maximum frequency computation in the intel_pstate driver for
  two processor models, update its documentation and fix issues related
  to the dynamic EPP support (added during the current development
  cycle) in the amd-pstate driver:

   - Fix maximum frequency computation in the intel_pstate driver for
     Raptor Lake-E and Bartlett Lake that are SMP platforms derived from
     hybrid ones (Rafael Wysocki, Henry Tseng)

   - Fix the description of asymmetric packing with SMT in the
     intel_pstate driver documentation (Ricardo Neri)

   - Fix multiple amd-pstate driver issues related to dynamic EPP
     support added recently, including making it opt-in only (K Prateek
     Nayak, Mario Limonciello)"

* tag 'pm-7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  cpufreq/amd-pstate: Drop Kconfig option for dynamic EPP
  cpufreq: intel_pstate: Use HYBRID_SCALING_FACTOR_ADL for Bartlett Lake
  cpufreq: intel_pstate: Use correct scaling factor on Raptor Lake-E
  Documentation: intel_pstate: Fix description of asymmetric packing with SMT
  cpufreq/amd-pstate-ut: Drop policy reference before driver switch
  cpufreq/amd-pstate: Use "epp_default_dc" as default when dynamic_epp is disabled
  cpufreq/amd-pstate: Reorder notifier unregistration and floor perf reset
  cpufreq/amd-pstate: Allow writes to dynamic_epp when state isn't modified
  cpufreq/amd-pstate: Return -ENOMEM on failure to allocate profile_name
  cpufreq/amd-pstate: Grab "amd_pstate_driver_lock" when toggling dynamic_epp
2026-05-22 07:13:13 -07:00
Hang Cao
f1ecb0e563 dt-bindings: usb: Fix EIC7700 USB reset's issue
The EIC7700 USB requires a USB PHY reset operation; otherwise, the USB
will not work. The reason why the USB driver that was applied can work
properly is that the USB PHY has already been reset in ESWIN's U-Boot.

However, the proper functioning of the USB driver should not be dependent
on the bootloader. Therefore, it is necessary to incorporate the USB PHY
reset signal into the DT bindings.

This patch does not introduce any backward incompatibility since the dts
is not upstream yet. As array of reset operations are used in the driver,
no modifications to the USB controller driver are needed.

Fixes: c640a4239d ("dt-bindings: usb: Add ESWIN EIC7700 USB controller")
Cc: stable <stable@kernel.org>
Signed-off-by: Hang Cao <caohang@eswincomputing.com>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Link: https://patch.msgid.link/20260415064238.1784-1-caohang@eswincomputing.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-22 11:13:19 +02:00
Rob Herring (Arm)
0b5bde9e1c dt-bindings: usb: ti,omap4-musb: Drop duplicate 'usb-phy' property constraints
The deprecated 'usb-phy' property is documented already in usb.yaml and
doesn't need a type definition here. It just needs constraints on how
many entries there are.

As this is a host controller, reference usb-hcd.yaml which then
references usb.yaml.

Fixes: 70fcdc82cf ("dt-bindings: usb: ti,omap4-musb: convert to DT schema")
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Link: https://patch.msgid.link/20260508182556.1759173-1-robh@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-22 11:12:57 +02:00
Linus Torvalds
68993ced0f Including fixes from Bluetooth, wireless and netfilter.
Current release - fix to a fix:
 
  - Bluetooth: btmtk: accept too short WMT FUNC_CTRL events
 
  - vsock/virtio: relax the recently added memory limit a little
 
 Current release - regressions:
 
  - IB/IPoIB: make sure IB drivers always use async set_rx_mode since
    some (mlx5) are now required to use it due to locking changes
 
 Previous releases - regressions:
 
  - udp: fix UDP length on last GSO_PARTIAL segment
 
  - af_unix: fix UAF read of tail->len in unix_stream_data_wait()
 
  - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction
 
  - mlx5e: fix unlocked writing to ICOSQ, breaking AF_XDP
 
 Previous releases - always broken:
 
  - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR
 
  - ipv4: raw: reject IP_HDRINCL packets with ihl < 5
 
  - Bluetooth: a lot of locking and concurrency fixes (as always)
 
  - batman-adv (mesh wireless networking): a lot of random fixes
    for issues reported by security researchers and Sashiko
 
  - netfilter: same thing, a lot of small security-ish fixes
    all over the place, nothing really stands out
 
 Misc:
 
  - bring back the old 3c509 driver, Maciej wants to maintain it
 
 Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE6jPA+I1ugmIBA4hXMUZtbf5SIrsFAmoPULUACgkQMUZtbf5S
 IrtAvA//bfjxxazZKkGqL8mp6uMYS5Su81Oh/pBcyEWC7q2xv3ftNp5pt8oCTWYP
 eryKi7XrxfNHrkFcmnH+aWQ431UekZLfAjrSd+5V0YvE1nQDnKrgbat5qx2SYSsr
 ZA7EYnJjvAtPMb0KqUJlYPMSfVdFA0H3gEOdnawkGRnizkKNO5NsNRkC4rHzpCil
 hzW5SCTZWQ0r1Cm3IxcTnSCJEOYRqH0BUBbiSRFCWNMZZpq0xKi3UiJFOdgRvqgc
 VoPz6sMRPxZyL8gW8i2jJVz6vj2yuWifJwbl8y3ZkqJJy4HvNXfcPIBH5+vBIWlB
 hWMuYlUv5F0w+h4+UKeDr789Tdpv12edUIDX+prbsJ8c4bXmBflt069HlFjG9Pto
 /k2e5owR0NYSaLt4WvAM6Tr5j1ralzQjHKVDg8JbPaAD+0dtb+e3dXE8J3MBPrw6
 EWtdg9jX+vqsbVoHwMQO9Xp2waNY9+97L07w+I0nVf7NLJvrvz0lkSjMKfNPNyV1
 C5W7McAbSOx3nJ+XzYwMoVK0wP9OunKA73EhAoEdvQSyOGLqQT+iZzDoTMnwKJFs
 2L3fbc8LQ10WBG2B2rCPB/gaGQ1ZZD8uSlZoS9N31dvUPFDaCnCYgKIze/pdcE/R
 KOQskME2xd61KzpYlJszkrjJIbnppkNt/mBvvfNUP+zJZPFRyuA=
 =ei7U
 -----END PGP SIGNATURE-----

Merge tag 'net-7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Jakub Kicinski:
 "Including fixes from Bluetooth, wireless and netfilter.

  Craziness continues with no end in sight. Even discounting the driver
  revert this is a pretty huge PR for standards of the previous era. I'd
  speculate - we haven't seen the worst of it, yet. Good news, I guess,
  is that so far we haven't seen many (any?) cases of "AI reported a
  bug, we fixed it and a real user regressed".

  Current release - fix to a fix:

   - Bluetooth: btmtk: accept too short WMT FUNC_CTRL events

   - vsock/virtio: relax the recently added memory limit a little

  Current release - regressions:

   - IB/IPoIB: make sure IB drivers always use async set_rx_mode since
     some (mlx5) are now required to use it due to locking changes

  Previous releases - regressions:

   - udp: fix UDP length on last GSO_PARTIAL segment

   - af_unix: fix UAF read of tail->len in unix_stream_data_wait()

   - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction

   - mlx5e: fix unlocked writing to ICOSQ, breaking AF_XDP

  Previous releases - always broken:

   - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR

   - ipv4: raw: reject IP_HDRINCL packets with ihl < 5

   - Bluetooth: a lot of locking and concurrency fixes (as always)

   - batman-adv (mesh wireless networking): a lot of random fixes for
     issues reported by security researchers and Sashiko

   - netfilter: same thing, a lot of small security-ish fixes all over
     the place, nothing really stands out

  Misc:

   - bring back the old 3c509 driver, Maciej wants to maintain it"

* tag 'net-7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (187 commits)
  net: enetc: avoid VF->PF mailbox timeout during SR-IOV teardown
  net: enetc: fix init and teardown order to prevent use of unsafe resources
  net: enetc: fix unbounded loop and interrupt handling in VF-to-PF messaging
  net: enetc: fix DMA write to freed memory in enetc_msg_free_mbx()
  net: enetc: fix race condition in VF MAC address configuration
  net: enetc: fix TOCTOU race and validate VF MAC address
  net: enetc: add ratelimiting to VF mailbox error messages
  net: enetc: fix missing error code when pf->vf_state allocation fails
  net: enetc: fix incorrect mailbox message status returned to VFs
  net: bridge: prevent too big nested attributes in br_fill_linkxstats()
  l2tp: use list_del_rcu in l2tp_session_unhash
  net: bcmgenet: keep RBUF EEE/PM disabled
  ethernet: 3c509: Fix most coding style issues
  ethernet: 3c509: Update documentation to match MAINTAINERS
  ethernet: 3c509: Add GPL 2.0 SPDX license identifier
  ethernet: 3c509: Fix AUI transceiver type selection
  Revert "drivers: net: 3com: 3c509: Remove this driver"
  tools: ynl: support listening on all nsids
  net: gro: don't merge zcopy skbs
  pds_core: ensure null-termination for firmware version strings
  ...
2026-05-21 14:39:12 -07:00
Zhengyu He
27cd2dde35
spi: dt-bindings: fsl-qspi: support SpacemiT K3
Add the SpacemiT K3 QSPI compatible to the fsl-qspi binding.

K3 and K1 use the same QSPI controller, so document the K3 compatible
with "spacemit,k1-qspi" as fallback.

Signed-off-by: Cody Kang <cody.kang.hk@outlook.com>
Signed-off-by: Zhengyu He <hezhy472013@gmail.com>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Link: https://patch.msgid.link/20260521-k3-pico-itx-qspi-v2-for-next-20260521-v2-1-52bce26e5fd8@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2026-05-21 21:56:07 +01:00
Maciej W. Rozycki
75756cb4b2 ethernet: 3c509: Update documentation to match MAINTAINERS
There has been apparently a single message only ever publicly posted by
David Ruggiero, back in 2002, which added this documentation piece among
others, and MAINTAINERS was never updated accordingly.  It is therefore
doubtful that his maintainer status has actually come into effect.  Just
replace the reference then so as not to confuse people.

Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Link: https://patch.msgid.link/alpine.DEB.2.21.2605201207380.1450@angie.orcam.me.uk
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-21 08:28:56 -07:00
Maciej W. Rozycki
28db0338db Revert "drivers: net: 3com: 3c509: Remove this driver"
This reverts commit 91f3a27ae9.

Contrary to the assumption stated with the original commit description
this driver is in use and I'm going to maintain it for the foreseeable
future.

Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Link: https://patch.msgid.link/alpine.DEB.2.21.2605201204260.1450@angie.orcam.me.uk
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-21 08:28:56 -07:00
Mark Brown
1129c0011b
ASoC: cs-amp-lib: Some bug and typo fixes
Richard Fitzgerald <rf@opensource.cirrus.com> says:

This series fixes bugs and a typo in cs-amp-lib.

Link: https://patch.msgid.link/20260521122511.987322-1-rf@opensource.cirrus.com
2026-05-21 15:13:52 +01:00
Zhi Li
c36069c6f4 dt-bindings: ethernet: eswin: add optional TXD and RXD delay register offsets
Document two optional cells in eswin,hsp-sp-csr for the TXD and RXD
delay control register offsets.

These registers are used by the driver to clear any residual delay
configuration left by the bootloader, ensuring that MAC-side RGMII delay
settings are applied solely according to the kernel configuration.

Add a reference to the EIC7700X SoC Technical Reference Manual for
background information about the HSP CSR block.

Fixes: 888bd0eca9 ("dt-bindings: ethernet: eswin: Document for EIC7700 SoC")
Signed-off-by: Zhi Li <lizhi2@eswincomputing.com>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Link: https://patch.msgid.link/20260518022023.427-1-lizhi2@eswincomputing.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-05-21 11:58:16 +02:00
Dave Airlie
5b4a47dc54 Merge tag 'drm-msm-fixes-2026-05-17' of https://gitlab.freedesktop.org/drm/msm into drm-fixes
Fixes for v7.1:

Core:
- Fixed bindings for SM8650, SM8750 and Eliza
- Don't use UTS_RELEASE directly
- Fix typo in clock-names property

DPU:
- Fixed CWB description on Kaanapali
- Fixed scanline strides for YUV UBWC formats
- Stopped DSI register dumping to access past the end of region

DSI:
- Fix dumping unaligned regions

GPU:
- Fix GMEM_BASE for a6xx gen3
- Fix userspace reachable crash on a2xx-a4xx
- Fix sysprof_active for counter collection with IFPC enabled GPUs
- Fix shrinker lockdep

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Rob Clark <rob.clark@oss.qualcomm.com>
Link: https://patch.msgid.link/CACSVV02cTK7h=d0uqanRE-cj35THDqFjqsTB_2zQV1Mcw77aNw@mail.gmail.com
2026-05-21 10:12:22 +10:00
David Howells
2b50aceafe crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks
Change the krb5 crypto library to provide facilities to precheck the length
of the message about to be decrypted or verified.

Fix AF_RXRPC to make use of this to validate DATA packets secured with
RxGK.

Fixes: 9d1d2b5934 ("rxrpc: rxgk: Implement the yfs-rxgk security class (GSSAPI)")
Closes: https://sashiko.dev/#/patchset/20260511160753.607296-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Herbert Xu <herbert@gondor.apana.org.au>
cc: Simon Horman <horms@kernel.org>
cc: Chuck Lever <chuck.lever@oracle.com>
cc: linux-afs@lists.infradead.org
Reviewed-by: Jeffrey Altman <jaltman@auristor.com>
Tested-by: Marc Dionne <marc.dionne@auristor.com>
Link: https://patch.msgid.link/20260515230516.2718212-2-dhowells@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-20 16:36:45 -07:00
Rafael J. Wysocki
a67f311333 amd-pstate fixes for 7.1 (05/14/2026)
A number of fixes to the dynamic epp feature which was new
 to kernel 7.1, including making it opt in only.
 -----BEGIN PGP SIGNATURE-----
 
 iQJHBAABCgAxFiEECwtuSU6dXvs5GA2aLRkspiR3AnYFAmoF0zkTHHN1cGVybTFA
 a2VybmVsLm9yZwAKCRAtGSymJHcCdtBKEACyCL9xIVkFeall/cac9FzX7BbRYN6T
 fW+2CLOep12rgtmBeAfC0yZ6pD173SVfhp71KzsrG0u00VgjGiO1+3BhE6dSFYOx
 aPNSi/iCT2CAR9oMRSQDngeE9H/Ou7KafPVAEIiBSHVLKTnX5rmxuAko9Qp6VfGM
 rE4L8BW6GwlDs9JDfs0QLafTHlM6VCOjWx5SxTN8eqY9wkfas/ahpb4V3OVny3v+
 KiKU1720HQsynkiWWZK+IGOOubmo9o/mwdFQRVhnuxv3D0rrRe+PRR9DGgio+t3b
 lSt3VCP4NuvDMelNHr+T4QoGIWCpGP5LQbLUN+LVGjFOUM2Zo/GXm2prUejatnWw
 StmUVleRVzDfseXOfl30B6ImX4rC4f3d74lQ4pI/c7vDTRgSHJhLfYzNRuc324T5
 XsSrWnqTK4vN/RWQED89DDqTnI4vWTaY5Z4h5kmbGzZa4dQ88d8ydHRxiq9u3Bcl
 mpqEvTgoYJCpT2Xv91OjcQ4vcRjmtpsB93FOyY6WBHwoadfBjXv4UAcuOpCxDt9N
 qlGeBrYZvv822aaTsRJBvEJj9bwpDrLcoJNLpeQN6EL/LY1YwxIPiGQHOIrlf0iJ
 9ChLfR0gutkUBwW7djwubza8CSoNs4N5KsU4rRGjzaL3T2yy2tZB639HRw1ErRoL
 YWzf3jYNLYG2mw==
 =TNUP
 -----END PGP SIGNATURE-----

Merge tag 'amd-pstate-v7.1-2026-05-14' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/superm1/linux into pm-cpufreq-fixes

Merge amd-pstate fixes for 7.1 (05/14/2026) from Mario Limonciello:

"A number of fixes to the dynamic epp feature which was new
 to kernel 7.1, including making it opt in only."

* tag 'amd-pstate-v7.1-2026-05-14' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/superm1/linux:
  cpufreq/amd-pstate: Drop Kconfig option for dynamic EPP
  cpufreq/amd-pstate-ut: Drop policy reference before driver switch
  cpufreq/amd-pstate: Use "epp_default_dc" as default when dynamic_epp is disabled
  cpufreq/amd-pstate: Reorder notifier unregistration and floor perf reset
  cpufreq/amd-pstate: Allow writes to dynamic_epp when state isn't modified
  cpufreq/amd-pstate: Return -ENOMEM on failure to allocate profile_name
  cpufreq/amd-pstate: Grab "amd_pstate_driver_lock" when toggling dynamic_epp
2026-05-20 22:03:41 +02:00
Armin Wolf
26cbe119f9
platform/x86: uniwill-laptop: Do not enable the charging limit even when forced
It seems that on some older models (~2020) the battery charging limit
can permanently damage the battery. Prevent users from enabling this
feature thru the "force" module parameter to avoid causing permanent
hardware damage on such devices.

Fixes: d050479693 ("platform/x86: Add Uniwill laptop driver")
Link: https://www.reddit.com/r/XMG_gg/comments/ld9yyf/battery_limit_hidden_function_discovered_on/
Reviewed-by: Werner Sembach <wse@tuxedocomputers.com>
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20260512232145.329260-5-W_Armin@gmx.de
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-05-19 16:52:49 +03:00
Linus Torvalds
f7c79949be RISC-V updates for v7.1-rc4
- Disable satp register probing when no5lvl is specified on the kernel
   command line
 
 - Fix a CFI-related issue with the misaligned access speed measurement
   code
 
 - Reduce the CFI shadow stack size limit from 4GB to 2GB (following
   ARM64 GCS)
 
 - Prevent the kernel from requesting delegation of misaligned access
   faults unless a new Kconfig option,
   CONFIG_RISCV_SBI_FWFT_DELEGATE_MISALIGNED, is enabled.  This will
   depend on CONFIG_NONPORTABLE until the deficiencies of the kernel
   misaligned access fixup code are fixed
 
 - Fix some potential uninitialized memory accesses in error paths in
   compat_riscv_gpr_set() and compat_restore_sigcontext()
 
 - Fix a bug in the RISC-V MIPS vendor errata patching code where a
   logical-and was used in place of a bitwise-and
 
 - Drop some unnecessary code in riscv_fill_hwcap_from_isa_string()
 
 - Use macros for isa2hwcap indices in riscv_fill_hwcap(), rather than
   open-coding them
 
 - Fix some documentation typos (one affecting "make htmldocs")
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEElRDoIDdEz9/svf2Kx4+xDQu9KksFAmoI9x4ACgkQx4+xDQu9
 Kks8xhAApjbsnXnN7lKkLR9h65zMH6698QmbfeP8DPiwjoiVrhEPEnLwJavr7XcF
 riLPAR0gpc2WkExLHL5xa4H9pUfihDm2KRmoTdJi7bQQbYEGXeJ1cXWDMRW5OcxE
 aN4kVMnRpiYlh46IO6uyWToZCV0OJs2EqQvzP0qGdRqQRxfObkd+zeSDTCsmV6SR
 d4SUc10T3Ov2e04ClgPMRivrvrL7E8hSswAoSExVHwNj6izud2+1Ck0j2s5K//8d
 QWuKgNVlIhcQF0xIbiGjKx8Ihb2C3BcO+3eca4iBjygkBofEbrLHi5lvFlHbq0y4
 UiawmiKMZ61h/Hk+HNRxD/6OVRSj28P1LOgQQ0bLz58tVT+nay46PWf+GAt9iR9z
 SxgCuRgaEgmooBh6/pD6T6EQvnLYF0v4ZBfX6KRhzxyru+zf+onubBNXdkyyuSrA
 b0DrkSaaRwZrgUFH8fyQZ9BSi7DEd12lw3W7ZfNfz9dnfEflzSv0CxQQ2069OBkE
 MyZBKVVOtRKQwHKQdzmtvjOnjXqMgjldbPCj21wV17ARgzg4zmL+FZshHfhP6MbN
 BjeyGcpFrqVExDQtWQxSmytq4Oo6jhNiA0u20C7bA0q8xrL/cxyJxDFHdZIAal5K
 XlOj+FJI/oREe9YgleQ0d8YMtPA8JfjRYxaBWlyol7eyMxIj8w4=
 =yOtI
 -----END PGP SIGNATURE-----

Merge tag 'riscv-for-linus-7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux

Pull RISC-V fixes from Paul Walmsley:
 "Relatively low-impact fixes. Probably the most notable one is that we
  no longer ask the monitor-mode firmware to delegate misaligned access
  handling to the kernel by default, since the kernel code needs
  significant improvement to match the functionality of the firmware.
  This change avoids functional problems at some cost in performance,
  but shouldn't affect any system with misaligned access handling in
  hardware.

   - Disable satp register probing when no5lvl is specified on the
     kernel command line

   - Fix a CFI-related issue with the misaligned access speed
     measurement code

   - Reduce the CFI shadow stack size limit from 4GB to 2GB (following
     ARM64 GCS)

   - Prevent the kernel from requesting delegation of misaligned access
     faults unless a new Kconfig option, RISCV_SBI_FWFT_DELEGATE_MISALIGNED,
     is enabled. This will depend on CONFIG_NONPORTABLE until the
     deficiencies of the kernel misaligned access fixup code are fixed

   - Fix some potential uninitialized memory accesses in error paths in
     compat_riscv_gpr_set() and compat_restore_sigcontext()

   - Fix a bug in the RISC-V MIPS vendor errata patching code where a
     logical-and was used in place of a bitwise-and

   - Drop some unnecessary code in riscv_fill_hwcap_from_isa_string()

   - Use macros for isa2hwcap indices in riscv_fill_hwcap(), rather than
     open-coding them

   - Fix some documentation typos (one affecting 'make htmldocs')"

* tag 'riscv-for-linus-7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
  riscv: misaligned: Make enabling delegation depend on NONPORTABLE
  riscv: Docs: fix unmatched quote warning
  riscv: cfi: reduce shadow stack size limit from 4GB to 2GB
  riscv: cpufeature: Use pre-defined ISA ext macros to index isa2hwcap
  riscv: mm: Fixup no5lvl failure when vaddr is invalid
  riscv: Fix register corruption from uninitialized cregs on error
  riscv: errata: Fix bitwise vs logical AND in MIPS errata patching
  Documentation: riscv: cmodx: fix typos
  riscv: cpufeature: Drop this_hwcap clear in T-Head vector workaround
  riscv: Define __riscv_copy_{,vec_}{words,bytes}_unaligned() using SYM_TYPED_FUNC_START
2026-05-17 09:33:49 -07:00
Linus Torvalds
1405a07192 hwmon fixes for v7.1-rc4
- asus_atk0110, acpi_power_meter: Add missing NULL pointer checks
 
 - lm90: Fix locking and UAF issues
 
 - sy7636a: Fix sysfs attribute name in documentation
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEiHPvMQj9QTOCiqgVyx8mb86fmYEFAmoI8sIACgkQyx8mb86f
 mYEJ7Q//SOEdVoW7nubLZzjSHqlip7dIQe+m/scLRtMpZfM+T+FRsq8MT5VQuuOy
 YPsfl6AON+8oWwpbDy8k06tfDXzTOKg/aqzFwMOnM0WqnCpV2DxNOqUSgUdKaWH0
 Jyh97Jvm/KRyLdjbTCEHMrpmjylVcoK8eBBP9YLijMWWG9etATZxlTRpg8axPLCV
 9e2+NiMhDvDS2rPun78NWQPka9yLgxJFTuY0PzkdFjhaBcze/w1R9FDoO/ADPexD
 +diea3Vh+zDJIx9W+U2gRo4q0y44WZfdC/kC3Vesrrok5lFZOvY/mSG4g3o7ZtB1
 T970J9Ban+Q+KmPHc/u6+/Kbumy9lF0I/Qk1AFTatPD6eWEFzAiMVuWdMO1S88RS
 rGwpvGMua0Dpl5oOHhbwtKHv1ZQ4mI1ozNHmm9xt6tLPFYvR42Wz46O4/Z3idFTa
 YZAzxrsEE/6lWTwWuZx9eIn9LVrFyiJfR+0s/R8avj+ybqW5U2aKlMpixcVVykYW
 x1TKt91omszIaVaj6S5fsdMoiAh8yLEsEI5Hk2Kcf7Jh2Uj7kufJtNCsNa1+zQz9
 lxiGra2WKrKBEgrhv392369LQEiUyGWuU2loL0fQQFC33qTv9MoGKrM25YX8DuFB
 WjQBXOmOD33mnO5fojqshAa9RXX9AnntQfAYsB89Wz8G/mKMjio=
 =CZ6D
 -----END PGP SIGNATURE-----

Merge tag 'hwmon-for-v7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging

Pull hwmon fixes from Guenter Roeck:

 - asus_atk0110, acpi_power_meter: Add missing NULL pointer checks

 - lm90: Fix locking and UAF issues

 - sy7636a: Fix sysfs attribute name in documentation

* tag 'hwmon-for-v7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
  hwmon: (lm90) Add lock protection to lm90_alert
  hwmon: (lm90) Stop work before releasing hwmon device
  docs: hwmon: sy7636a: fix temperature sysfs attribute name
  hwmon: (asus_atk0110) Check ACPI_COMPANION() against NULL
  hwmon: (acpi_power_meter) Check ACPI_COMPANION() against NULL
2026-05-17 09:23:28 -07:00
Lad Prabhakar
db339b6bc9 dt-bindings: display/msm: Fix typo in clock-names property
Fix the typo "clocks-names" to "clock-names" in the allOf/if conditional
blocks.

Fixes: 9be5c47908 ("dt-bindings: display/msm: expand to support MST")
Fixes: 7403e87c13 ("dt-bindings: display: msm: Fix reg ranges and clocks on Glymur")
Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/721682/
Message-ID: <20260428100338.3179722-1-prabhakar.mahadev-lad.rj@bp.renesas.com>
Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
2026-05-17 06:33:28 -07:00
Linus Torvalds
b6a08b017f sound fixes for 7.1-rc4
A collection of small fixes.  All device-specific small changes.
 
 * HD-audio:
   - Fix NULL pointer dereference in snd_hda_ctl_add()
   - ACPI and Kconfig fixes for Cirrus drivers
   - A regression fix CA0132 codec
   - Various device-specific quirks for HP, Lenovo, Samsung, Framework,
     etc
   - Documentation path fix
 * USB-audio:
   - Boundary checks for MIDI endpoint descriptors
   - Offload mapping error handling for Qualcomm
   - A new device quirk for TTGK Technology USB-C Audio
   - A fix for Focusrite Scarlett2 mixer
 -----BEGIN PGP SIGNATURE-----
 
 iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmoHRhoOHHRpd2FpQHN1
 c2UuZGUACgkQLtJE4w1nLE9oERAAyOZw+QBHnmmdW4ONIqIPPWeKKfvwnWpu5Uqd
 2VAyZmJdntwMt6rnIeyNlxpSfTQP06+uMhOl/Yc9WVnFUxDxhaTPOJmkCC3DN5a3
 9ol9iT2XVzJx+EFkBAknWK/ledkQxF2b+2IUA8rPuN0sAh1bxZXkXOfCzv35Sjld
 +NzwoqHG7/udYf5iQUn3FlqpeoezmxP3kW6qDZkeJ9WB//HLlQ6JUbv/aeC5kk+G
 UjnqTT5NsjMeZKuyqZIBT5O4iEq5fkpa6SisM9vzuI1rE5g7Di/II9FmCrAju6bX
 V0D57trpNpoR+sNbjpMb8tBZmmoq0z05GVNkc4ayoL6cRQNobSkHYnQON5cmuaIu
 2VAOr1i1k/b+5S+dSiOSyBuFDaBrEAtlc1OA2cVjIg0pb56ijNrfkxGKsNrlNNRG
 RJgqyUGOp/YAT09HuuIMZDJ2kijj+XaFup+sq8+PSMT65QTw8kOHbTviypC0TtVD
 Q9pJbBp6lmd23G0xMY3/yo+zUR0X7qJPHOe6gT+roTXMMiX4KkO2qudqlVwR+GBb
 sDEDMMW6LKbH2YE7mYuZMm9z8pQnhb3O/+b2ZeiAB5g0oRqoSNNIAV8EcutpOLkY
 RUDs+0CIauLuNuegulSPNeG1iZbbNxrUD78ZE9BOL4VihR80vXJSQum8ScX9VSli
 Ie+R4QY=
 =0d+c
 -----END PGP SIGNATURE-----

Merge tag 'sound-7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "A collection of small fixes.  All device-specific small changes:

  HD-audio:
   - Fix NULL pointer dereference in snd_hda_ctl_add()
   - ACPI and Kconfig fixes for Cirrus drivers
   - A regression fix CA0132 codec
   - Various device-specific quirks for HP, Lenovo, Samsung, Framework etc
   - Documentation path fix

  USB-audio:
   - Boundary checks for MIDI endpoint descriptors
   - Offload mapping error handling for Qualcomm
   - A new device quirk for TTGK Technology USB-C Audio
   - A fix for Focusrite Scarlett2 mixer"

* tag 'sound-7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ALSA: hda/ca0132: Disable auto-detect on manual output select
  ALSA: hda/realtek: Add mute LED quirk for HP Pavilion Laptop 16-ag0xxx
  ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Pro 7 15ASH111 audio
  ALSA: hda: Fix NULL pointer dereference in snd_hda_ctl_add()
  ALSA: hda/realtek: Add quirk for Samsung Galaxy Book5 360 headphone
  ALSA: hda/cs35l56: Drop malformed default N from Kconfig
  ALSA: hda/realtek: fix mic boost on Framework PTL
  ALSA: hda/realtek: Limit mic boost on Positivo DN50E
  ALSA: doc: cs35l56: Update path to HDA driver source
  ALSA: usb-audio: qcom: Check offload mapping failures
  ALSA: hda/realtek: Fix Legion 7 16ITHG6 speaker amp binding
  ALSA: usb-audio: Add iface reset and delay quirk for TTGK Technology USB-C Audio
  ALSA: scarlett2: Add missing error check when initialise Autogain Status
  ALSA: hda: cs35l41: Put ACPI device on missing physical node
  ALSA: hda: cs35l56: Put ACPI device after setting companion
  ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans
  ALSA: usb-audio: Bound MIDI endpoint descriptor scans
  ALSA: hda/realtek: Add codec SSID quirk for Lenovo Yoga Pro 9 16IMH9 (17aa:38d5)
2026-05-16 09:32:30 -07:00
Linus Torvalds
36d49bba19 This is Willy Tarreau's new document clarifying the definition and handling
of security-related bugs, which we're trying to get out there quickly on
 the theory that some of the bug reporters might actually read and pay
 attention to it.
 -----BEGIN PGP SIGNATURE-----
 
 iQFDBAABCgAtFiEEIw+MvkEiF49krdp9F0NaE2wMflgFAmoHIH8PHGNvcmJldEBs
 d24ubmV0AAoJEBdDWhNsDH5YE7QIAJM/pApXp1xRs6Kupspf0y+VzoWifY/guLhM
 IeWwmI8Zj6rw3LWSC8zGCpdJyqyTCq1q3AyeFlnhs+Xx+OFTzTFBxsNWfynzgud8
 91uHDWl00ZBBo5plJRXJQUqoPJr9CsQ/aUgaXYls7XujZMzqBNckMFxBWaCvPts6
 NRcOb6DccV4Q/do3Bzn8NY3sPqebsKsEUY19cH7z8aBoP/8Xc3PrJ1X2AUmEeHkm
 /lvJ5EA7CNKrGJWFwT1oe7vaZBj9hWkABn9GngxzFxdn4oPfJ8SUa4iqsPQHecgW
 SIgupjOwIR/dFwu99Q5auS3NRCANS0wNQ1Qaav83ztUZIQmQVEQ=
 =Sfh9
 -----END PGP SIGNATURE-----

Merge tag 'docs-7.1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/docs/linux

Pull documentation fixes from Jonathan Corbet:
 "This is Willy Tarreau's new document clarifying the definition and
  handling of security-related bugs, which we're trying to get out there
  quickly on the theory that some of the bug reporters might actually
  read and pay attention to it"

* tag 'docs-7.1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/docs/linux:
  docs: threat-model: don't limit root capabilities to CAP_SYS_ADMIN
  docs: security-bugs: add a link to the threat-model documentation
  Documentation: security-bugs: clarify requirements for AI-assisted reports
  Documentation: security-bugs: explain what is and is not a security bug
  Documentation: security-bugs: do not systematically Cc the security team
2026-05-15 12:24:09 -07:00
Richard Fitzgerald
74e8409821 ALSA: doc: cs35l56: Update path to HDA driver source
The HDA drivers were moved to sound/hda/... so update a Documentation
reference that still pointed to the old location.

Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Link: https://patch.msgid.link/20260511104148.36382-1-rf@opensource.cirrus.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-05-15 08:53:34 +02:00
Chen-Shi-Hong
51f57607e3 docs: hwmon: sy7636a: fix temperature sysfs attribute name
The hwmon sysfs naming convention uses
temp[1-*]_input for temperature channels.

Documentation/hwmon/sy7636a-hwmon.rst currently documents
temp0_input, while the driver uses the standard hwmon
temperature channel interface.

Update the documentation to use temp1_input.

Signed-off-by: Chen-Shi-Hong <eric039eric@gmail.com>
Link: https://lore.kernel.org/r/20260514154108.1937-1-eric039eric@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-05-14 15:48:57 -07:00
Linus Torvalds
66182ca873 Including fixes from netfilter.
Previous releases - regressions:
 
   - ethtool: fix NULL pointer dereference in phy_reply_size
 
   - netfilter:
     - allocate hook ops while under mutex
     - close dangling table module init race
     - restore nf_conntrack helper propagation via expectation
 
   - tcp:
     - fix potential UAF in reqsk_timer_handler().
     - fix out-of-bounds access for twsk in tcp_ao_established_key().
 
   - vsock: fix empty payload in tap skb for non-linear buffers
 
   - hsr: fix NULL pointer dereference in hsr_get_node_data()
 
   - eth: cortina: fix RX drop accounting
 
   - eth: ice: fix locking in ice_dcb_rebuild()
 
 Previous releases - always broken:
 
   - napi: avoid gro timer misfiring at end of busypoll
 
   - sched:
     - dualpi2: initialize timer earlier in dualpi2_init()
     - sch_cbs: Call qdisc_reset for child qdisc
 
   - shaper:
     - fix ordering issue in net_shaper_commit()
     - reject handle IDs exceeding internal bit-width
 
   - ipv6: flowlabel: enforce per-netns limit for unprivileged callers
 
   - tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring
 
   - smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint
 
   - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL
 
   - batman-adv:
     - reject new tp_meter sessions during teardown
     - purge non-released claims
 
   - eth: i40e: cleanup PTP registration on probe failure
 
   - eth: idpf: fix double free and use-after-free in aux device error paths
 
   - eth: ena: fix potential use-after-free in get_timestamp
 
 Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 
 iQJGBAABCgAwFiEEg1AjqC77wbdLX2LbKSR5jcyPE6QFAmoF2xoSHHBhYmVuaUBy
 ZWRoYXQuY29tAAoJECkkeY3MjxOk38gP/0aAvFK8YZiEbQ/XtxEHc/SQaOX0EmRI
 6TBAABW+pmf3YNIuMcFbMc4WdTDt2TDfqPONG70reqW/rut4e6kr8qGjY1ABEFYx
 BdMSafs4hxiychSHVWACygSHew8PblfKGkIgmDqGmRWJCHaCRs49m64nhZV3k5mO
 Q1s/O6JGDWmI1Z5/9UNgHefkQnfTRbqiKKFpYFT01yfxpjlqJyfGyXcDZqGS29n0
 f0xfCRrHvoA2DIkyVVZxjLHtqqvTfNyFRdvw+pBEuGvdmjiGkxUoHkHRuwlarJt3
 Ry2QDTakL2qRCrEzcSCbXaDKBcFKkpcQG22QYpl4yYpKR6JKZ+2G0inin1oJ3L77
 OpwY033ksPhdlegybINL5yN98P9Jq+jO3HYJbH9Z/1oInpgrAQJjAiS0LoK+qm37
 D3eag9Qsw+svdZ6HSMjUymS9GdKwShrya7YE8K8IVrTWWeGzUW/uw1hxcdr/5/ZC
 olJRa3aN80YhwlvHkkhOGvZZY1Xz2Vtds6uCY3zh/nFDoYlmJs08C9v7UE5/NH4x
 KpOY6nfa3RBl87ILFpzqpzP5fjHE1NbOJIfBCFdHpvhDWU7yCfmzhRBenrfXpnt9
 9teEalnA3jILlTXanLGxEhWFcMiSk2D+/sHYWYdGUth62YJpP6GkiUQK5OZPHv2x
 zDl02XCxq6Ag
 =l6fA
 -----END PGP SIGNATURE-----

Merge tag 'net-7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Paolo Abeni:
 "Including fixes from netfilter.

  Previous releases - regressions:

   - ethtool: fix NULL pointer dereference in phy_reply_size

   - netfilter:
      - allocate hook ops while under mutex
      - close dangling table module init race
      - restore nf_conntrack helper propagation via expectation

   - tcp:
      - fix potential UAF in reqsk_timer_handler().
      - fix out-of-bounds access for twsk in tcp_ao_established_key().

   - vsock: fix empty payload in tap skb for non-linear buffers

   - hsr: fix NULL pointer dereference in hsr_get_node_data()

   - eth:
      - cortina: fix RX drop accounting
      - ice: fix locking in ice_dcb_rebuild()

  Previous releases - always broken:

   - napi: avoid gro timer misfiring at end of busypoll

   - sched:
      - dualpi2: initialize timer earlier in dualpi2_init()
      - sch_cbs: Call qdisc_reset for child qdisc

   - shaper:
      - fix ordering issue in net_shaper_commit()
      - reject handle IDs exceeding internal bit-width

   - ipv6: flowlabel: enforce per-netns limit for unprivileged callers

   - tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring

   - smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint

   - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL

   - batman-adv:
      - reject new tp_meter sessions during teardown
      - purge non-released claims

   - eth:
      - i40e: cleanup PTP registration on probe failure
      - idpf: fix double free and use-after-free in aux device error paths
      - ena: fix potential use-after-free in get_timestamp"

* tag 'net-7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (88 commits)
  net: phy: DP83TC811: add reading of abilities
  net: tls: prevent chain-after-chain in plain text SG
  net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring
  net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot
  macsec: use rcu_work to defer TX SA crypto cleanup out of softirq
  macsec: use rcu_work to defer RX SA crypto cleanup out of softirq
  macsec: introduce dedicated workqueue for SA crypto cleanup
  net: net_failover: Fix the deadlock in slave register
  MAINTAINERS: update atlantic driver maintainer
  selftests/tc-testing: Add QFQ/CBS qlen underflow test
  net/sched: sch_cbs: Call qdisc_reset for child qdisc
  FDDI: defza: Sanitise the reset safety timer
  net: ethernet: ravb: Do not check URAM suspension when WoL is active
  ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics
  net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint
  net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS
  net: atm: fix skb leak in sigd_send() default branch
  net: ethtool: phy: avoid NULL deref when PHY driver is unbound
  net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled
  net: shaper: reject QUEUE scope handle with missing id
  ...
2026-05-14 08:57:43 -07:00
Mario Limonciello
e4e9b7b38d cpufreq/amd-pstate: Drop Kconfig option for dynamic EPP
There are some performance issues being identified by dynamic EPP
and we don't want to have distributions turning it on by default
exposing them to users at this time.

Drop the kconfig option, and require an explicit opt in from kernel
command line or runtime sysfs option to turn it on.

Reported-by: Viktor Jägersküpper <viktor_jaegerskuepper@freenet.de>
Closes: https://lore.kernel.org/linux-pm/14a87c99-785c-4b16-bfce-35ecbf053448@freenet.de/
Reported-by: Stuart Meckle <stuartmeckle@gmail.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221473
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Reviewed-by: K Prateek Nayak <kprateek.nayak@amd.com>
Link: https://lore.kernel.org/r/20260512221947.1652988-1-mario.limonciello@amd.com
(fix sysfs file path)
Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
2026-05-14 08:47:48 -05:00
Jonathan Corbet
f2e65e4e5b docs: threat-model: don't limit root capabilities to CAP_SYS_ADMIN
The threat-model document says that only users with CAP_SYS_ADMIN can carry
out a number of admin-level tasks, but there are numerous capabilities that
can confer that sort of power.  Generalize the text slightly to make it
clear that CAP_SYS_ADMIN is not the only all-powerful capability.

Acked-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
2026-05-14 06:23:44 -06:00
Jonathan Corbet
561458db0d docs: security-bugs: add a link to the threat-model documentation
Rather than make readers search for this document, just a link to it where
it is referenced.

(While I was at it, I removed the unused and unneeded _threatmodel label
from the top of threat-model.rst).

Acked-by: Willy Tarreau <w@1wt.eu>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
2026-05-14 06:23:06 -06:00
Randy Dunlap
50da1c9ccb riscv: Docs: fix unmatched quote warning
'make htmldocs' complains about ``prctrl` -- so add a second '`' to
avoid the warning.

Documentation/arch/riscv/zicfilp.rst:79: WARNING: Inline literal start-string without end-string. [docutils]

Fixes: 08ee155905 ("prctl: cfi: change the branch landing pad prctl()s to be more descriptive")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Link: https://patch.msgid.link/20260406232304.1892528-1-rdunlap@infradead.org
Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-05-13 22:21:32 -06:00
Ricardo Neri
ee047fc7a2 Documentation: intel_pstate: Fix description of asymmetric packing with SMT
Patchset [1], including commits

 046a5a95c3 ("x86/sched/itmt: Give all SMT siblings of a core the same priority")
 995998ebde ("x86/sched: Remove SD_ASYM_PACKING from the SMT domain flags")

overhauled asym_packing handling in the scheduler on x86 hybrid
processors with SMT. It removed SD_ASYM_PACKING from the x86 SMT
scheduling domain and made all SMT siblings of a core share the same
priority. As a result, asym_packing operates only across physical
cores, spreading tasks among them and only using idle SMT siblings
once all physical cores are busy.

Fix the documentation to reflect this behavior.

Fixes: f20af84c29 ("cpufreq: intel_pstate: Document hybrid processor support")
Link: https://lore.kernel.org/r/20230406203148.19182-1-ricardo.neri-calderon@linux.intel.com [1]
Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
[ rjw: Changelog edits ]
Link: https://patch.msgid.link/20260424-rneri-fix-intel-pstate-doc-smt-asym-packing-v1-1-317bf7d5c362@linux.intel.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-05-13 21:39:38 +02:00
Linus Torvalds
e1914add27 Arm:
* Add the pKVM side of the workaround for ARM's erratum 4193714, provided
   that the EL3 firmware does its part of the job. KVM will refuse to
   initialise otherwise.
 
 - Correctly handle 52bit VAs for guest EL2 stage-1 translations when
   running under NV with E2H==0.
 
 * Correctly deal with permission faults in guest_memfd memslots.
 
 * Fix the steal-time selftest after the infrastructure was reworked.
 
 * Make sure the host cannot pass a non-sensical clock update to the
   EL2 tracing infrastructure.
 
 * Appoint Steffen Eiden as a reviewer in anticipation of the KVM/s390
   ability to run arm64 guests, which will inevitably lead to arm64
   code being directly used on s390.
 
 * Make sure that EL2 is configured with both exception entry and exit
   being Context Synchronization Events.
 
 * Handle the current vcpu being NULL on EL2 panic.
 
 * Fix the selftest_vcpu memcache being empty at the point of donation or
   sharing.
 
 * Check that the memcache has enough capacity before engaging on the
   share/donate path.
 
 * Fix __deactivate_fgt() to use its parameter rather than a variable
   in the macro context.
 
 s390:
 
 * Fix array overrun with large amounts of PCI devices.
 
 x86:
 
 * Never use L0's PAUSE loop exiting while L2 is running, since it's
   unlikely that a nested guest will help solving the hypervisor's
   spinlock contention
 
 * Fix emulation of MOVNTDQA.
 
 * Fix typo in Xen hypercall tracepoint
 
 * Add back an optimization that was left behind when recently
   fixing a bug.
 
 * Add module parameter to disable CET, whose implementation seems
   to have issues.  For now it remains enabled by default.
 
 Generic:
 
 * Reject offset causing an unsigned overflow in kvm_reset_dirty_gfn()
 
 Documentation:
 
 * Update stale links
 
 Selftests:
 
 * Fix guest_memfd_test with host page size > guest page size.
 -----BEGIN PGP SIGNATURE-----
 
 iQFIBAABCgAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmoEnNgUHHBib256aW5p
 QHJlZGhhdC5jb20ACgkQv/vSX3jHroPOeAgArZ60yQGH0TJipyNsaPt+m+IEGMZ/
 UC1tRd384EJnwpjFfZOvwluNNxeFlSXlku7iEXHHveK1qqFXnh+WBXJ91ftfDK/+
 OOqVBBziOyxI6Mbsm2S415kzOQ15atsrclrcGC4emSydgX+JASZ4nsGx6MDRPu/8
 p4TNy3vD5wxe3UGttYElMoFcgT0N/HepMyvUlXohjcjl/hkgf5GL4yPc/TGuvdtz
 EJfmDRhJEwyzf4/Ut8tzX+LhNxSY2iBr5XBvC8XQMSJBVbU/CRGxUk28fEzo7ykx
 EHVOlkxgUN1zO0xh/8aMgRIZNDMveWupR2sJe6StCqOlcbBMI2oYFNnLfQ==
 =f8oe
 -----END PGP SIGNATURE-----

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

Pull kvm fixes from Paolo Bonzini:
 "arm64:

   - Add the pKVM side of the workaround for ARM's erratum 4193714,
     provided that the EL3 firmware does its part of the job. KVM will
     refuse to initialise otherwise

   - Correctly handle 52bit VAs for guest EL2 stage-1 translations when
     running under NV with E2H==0

   - Correctly deal with permission faults in guest_memfd memslots

   - Fix the steal-time selftest after the infrastructure was reworked

   - Make sure the host cannot pass a non-sensical clock update to the
     EL2 tracing infrastructure

   - Appoint Steffen Eiden as a reviewer in anticipation of the KVM/s390
     ability to run arm64 guests, which will inevitably lead to arm64
     code being directly used on s390

   - Make sure that EL2 is configured with both exception entry and exit
     being Context Synchronization Events

   - Handle the current vcpu being NULL on EL2 panic

   - Fix the selftest_vcpu memcache being empty at the point of donation
     or sharing

   - Check that the memcache has enough capacity before engaging on the
     share/donate path

   - Fix __deactivate_fgt() to use its parameter rather than a variable
     in the macro context

  s390:

   - Fix array overrun with large amounts of PCI devices

  x86:

   - Never use L0's PAUSE loop exiting while L2 is running, since it's
     unlikely that a nested guest will help solving the hypervisor's
     spinlock contention

   - Fix emulation of MOVNTDQA

   - Fix typo in Xen hypercall tracepoint

   - Add back an optimization that was left behind when recently fixing
     a bug

   - Add module parameter to disable CET, whose implementation seems to
     have issues. For now it remains enabled by default

  Generic:

   - Reject offset causing an unsigned overflow in kvm_reset_dirty_gfn()

  Documentation:

   - Update stale links

  Selftests:

   - Fix guest_memfd_test with host page size > guest page size"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (22 commits)
  KVM: VMX: introduce module parameter to disable CET
  KVM: x86: Swap the dst and src operand for MOVNTDQA
  KVM: x86: use again the flush argument of __link_shadow_page()
  KVM: selftests: Ensure gmem file sizes are multiple of host page size
  Documentation: kvm: update links in the references section of AMD Memory Encryption
  KVM: nSVM: Never use L0's PAUSE loop exiting while L2 is running
  KVM: x86: Fix Xen hypercall tracepoint argument assignment
  KVM: Reject wrapped offset in kvm_reset_dirty_gfn()
  KVM: arm64: Pre-check vcpu memcache for host->guest donate
  KVM: arm64: Pre-check vcpu memcache for host->guest share
  KVM: arm64: Seed pkvm_ownership_selftest vcpu memcache
  KVM: arm64: Fix __deactivate_fgt macro parameter typo
  KVM: arm64: Guard against NULL vcpu on VHE hyp panic path
  KVM: arm64: Make EL2 exception entry and exit context-synchronization events
  MAINTAINERS: Add Steffen as reviewer for KVM/arm64
  KVM: arm64: Remove potential UB on nvhe tracing clock update
  KVM: selftests: arm64: Fix steal_time test after UAPI refactoring
  KVM: arm64: Handle permission faults with guest_memfd
  KVM: arm64: nv: Consider the DS bit when translating TCR_EL2
  KVM: arm64: Work around C1-Pro erratum 4193714 for protected guests
  ...
2026-05-13 11:53:51 -07:00
Krzysztof Kozlowski
795b19cbcf dt-bindings: display/msm: qcom,eliza-mdss: Correct DPU and DP ranges in example
VBIF register range is 0x3000 long.  DisplayPort block has few too short
ranges and misses four more address spaces.  Similarly first part of DSI
space should be 0x300 long.

No practical impact, except when existing code is being re-used in new
contributions.

Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Acked-by: Rob Herring (Arm) <robh@kernel.org>
Patchwork: https://patchwork.freedesktop.org/patch/716460/
Link: https://lore.kernel.org/r/20260405-dts-qcom-display-regs-v2-5-34f4024c65dc@oss.qualcomm.com
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
2026-05-13 16:13:44 +03:00
Krzysztof Kozlowski
399f774878 dt-bindings: display/msm: sm8750-mdss: Correct DPU and DP ranges in example
VBIF register range is 0x3000 long. DisplayPort block has few too short
ranges and misses four more address spaces.

No practical impact, except when existing code is being re-used in new
contributions.

Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/716453/
Link: https://lore.kernel.org/r/20260405-dts-qcom-display-regs-v2-4-34f4024c65dc@oss.qualcomm.com
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
2026-05-13 16:13:44 +03:00
Krzysztof Kozlowski
bef8a15a6e dt-bindings: display/msm: sm8650: Correct VBIF range in example
VBIF register range is 0x3000 long, so correct the example.  No
practical impact, except when existing code is being re-used in new
contributions.

Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Acked-by: Rob Herring (Arm) <robh@kernel.org>
Patchwork: https://patchwork.freedesktop.org/patch/716454/
Link: https://lore.kernel.org/r/20260405-dts-qcom-display-regs-v2-3-34f4024c65dc@oss.qualcomm.com
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
2026-05-13 16:13:44 +03:00
Krzysztof Kozlowski
557226acef dt-bindings: display/msm: dp-controller: Allow DAI on SM8650 and others
DisplayPort on Qualcomm SoCs like SM8650 and compatible SM8750 supports
audio and there is already DTS having cells and sound-name-prefix.  The
"else:" clause for non-EDP and non-aux-bus cases already requires
'#sound-dai-cells', so it should actually reference the dai-common.yaml
for other properties, as pointed out by dtbs_check warnings like:

  sm8650-hdk-display-card-rear-camera-card.dtb:
    displayport-controller@af54000 (qcom,sm8650-dp): Unevaluated properties are not allowed ('sound-name-prefix' was unexpected)

Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/716452/
Link: https://lore.kernel.org/r/20260405-dts-qcom-display-regs-v2-2-34f4024c65dc@oss.qualcomm.com
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
2026-05-13 16:13:44 +03:00
Krzysztof Kozlowski
cb6f19552b dt-bindings: display/msm: dp-controller: Correct SM8650 IO range
DP on Qualcomm SM8650 come with nine address ranges, so describe the
remaining ones as optional to keep ABI backwards compatible.  Driver
also does not need them to operate correctly.

Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Acked-by: Rob Herring (Arm) <robh@kernel.org>
Patchwork: https://patchwork.freedesktop.org/patch/716450/
Link: https://lore.kernel.org/r/20260405-dts-qcom-display-regs-v2-1-34f4024c65dc@oss.qualcomm.com
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
2026-05-13 16:13:44 +03:00
Ninad Naik
80f4a7b8ce Documentation: kvm: update links in the references section of AMD Memory Encryption
Replace non-working links in the reference section with the working ones.

Signed-off-by: Ninad Naik <ninadnaik07@gmail.com>
Link: https://patch.msgid.link/20260511174302.811918-1-ninadnaik07@gmail.com/
Reviewed-by: Liam Merwick <liam.merwick@oracle.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-05-12 22:17:42 +02:00
Willy Tarreau
4bf85afb9f Documentation: security-bugs: clarify requirements for AI-assisted reports
AI tools are increasingly used to assist in bug discovery. While these
tools can identify valid issues, reports that are submitted without
manual verification often lack context, contain speculative impact
assessments, or include unnecessary formatting. Such reports increase
triage effort, waste maintainers' time and may be ignored.

Reports where the reporter has verified the issue and the proposed fix
typically meet quality standards. This documentation outlines specific
requirements for length, formatting, and impact evaluation to reduce
the effort needed to deal with these reports.

Cc: Greg KH <gregkh@linuxfoundation.org>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20260509094755.2838-4-w@1wt.eu>
2026-05-12 11:09:14 -06:00
Willy Tarreau
a03ef333fb Documentation: security-bugs: explain what is and is not a security bug
The use of automated tools to find bugs in random locations of the kernel
induces a raise of security reports even if most of them should just be
reported as regular bugs. This patch is an attempt at drawing a line
between what qualifies as a security bug and what does not, hoping to
improve the situation and ease decision on the reporter's side.

It defers the enumeration to a new file, threat-model.rst, that tries
to enumerate various classes of issues that are and are not security
bugs. This should permit to more easily update this file for various
subsystem-specific rules without having to revisit the security bug
reporting guide.

Cc: Greg KH <gregkh@linuxfoundation.org>
Cc: Leon Romanovsky <leon@kernel.org>
Suggested-by: Leon Romanovsky <leon@kernel.org>
Suggested-by: Greg KH <gregkh@linuxfoundation.org>
Reviewed-by: Leon Romanovsky <leon@kernel.org>
Reviewed-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20260509094755.2838-3-w@1wt.eu>
2026-05-12 11:09:14 -06:00