summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2026-10-19net: ethernet: qualcomm: ppe: Add IPQ5424 scheduler resource configurationLuo Jie
The PPE scheduler resources, such as queues and scheduler nodes, are assigned per PPE port, followed by one reserved resource entry. IPQ5424 has fewer PPE ports than IPQ9574, so its reserved resource is located at a different position. Add the dedicated scheduler resource configuration for IPQ5424. Signed-off-by: Luo Jie <jie.luo@oss.qualcomm.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20261011-qcom_ipq5424_ppe-v2-8-8c7b057e2c43@oss.qualcomm.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-19net: ethernet: qualcomm: ppe: Add IPQ5424 QM configurationLuo Jie
Multicast queues are dedicated per PPE port. IPQ5424 has only 3 physical PPE ports, versus IPQ9574's 6 PPE ports, so multicast queues 284 to 299 are not available on IPQ5424, and 2010 buffers are assigned to the shared group0 buffer pool, instead of IPQ9574's 2000. Signed-off-by: Luo Jie <jie.luo@oss.qualcomm.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20261011-qcom_ipq5424_ppe-v2-7-8c7b057e2c43@oss.qualcomm.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-19net: ethernet: qualcomm: ppe: Add IPQ5424 BM buffer configurationLuo Jie
IPQ5424 has fewer PPE ports than IPQ9574, so it requires a different buffer configuration per port, and more buffers are left for the shared buffer pool. IPQ5424 also has more BM ports than IPQ9574, 19 versus 15, so some BM register tables have more entries on IPQ5424, and some of them are located at different addresses. Signed-off-by: Luo Jie <jie.luo@oss.qualcomm.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20261011-qcom_ipq5424_ppe-v2-6-8c7b057e2c43@oss.qualcomm.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-19net: ethernet: qualcomm: ppe: Add platform support for IPQ5424Luo Jie
IPQ5424 integrates the same PPE switch core as IPQ9574, but has only 3 Ethernet ports plus the EDMA FIFO, without the EIP FIFO. The PPE clock runs at 375 MHz instead of IPQ9574's 353 MHz, and IPQ5424 requires a different, smaller set of interconnect paths. The register space of the unavailable MAC3 to MAC5 must also not be accessed on IPQ5424. Add the platform data per SoC to describe these differences, and add the IPQ5424 compatible. Signed-off-by: Luo Jie <jie.luo@oss.qualcomm.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20261011-qcom_ipq5424_ppe-v2-5-8c7b057e2c43@oss.qualcomm.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-19net: ethernet: qualcomm: ppe: Fix multicast queue config table accessLuo Jie
PPE queues 0-255 are unicast queues and queues from 256 onwards are multicast queues. The multicast queue configuration table has its own index, starting from 0 for the first multicast queue, and each entry has 3 words. The driver uses the absolute queue ID as the index of this table, which is out of range for every multicast queue. As a result, the multicast queue thresholds are never configured, and unrelated QM registers are written instead. The driver also accesses 5 words per entry instead of 3. Fix it by converting the queue ID to the index of the multicast queue configuration table and accessing only the 3 words of the entry. Signed-off-by: Luo Jie <jie.luo@oss.qualcomm.com> Fixes: 806268dc7efd ("net: ethernet: qualcomm: Initialize PPE queue management for IPQ9574") Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20261011-qcom_ipq5424_ppe-v2-2-8c7b057e2c43@oss.qualcomm.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-19net/dcb: Validate bandwidth for non-ETS traffic classesAlexei Lazar
The IEEE 802.1Qaz standard defines that bandwidth allocation percentages only apply to ETS traffic classes. Reject ETS configurations that specify non-zero bandwidth for non-ETS traffic classes. Placing this check in dcbnl_ieee_set() enforces the constraint uniformly for all drivers rather than relying on each driver to validate it independently. Drop the equivalent check from NFP's dcb_ets_check(). Keep ETS bandwidth-sum validation unchanged. Signed-off-by: Alexei Lazar <alazar@nvidia.com> Reviewed-by: Carolina Jubran <cjubran@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20261011083929.739261-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-19Merge branch 'next' into for-linusDmitry Torokhov
Prepare input updates for 7.4 merge window.
2026-10-19watchdog: mediatek: Apply the driver's mode to a watchdog left runningRyan Brue
When the bootloader leaves the watchdog enabled, probe only marks it running and sets the timeout, so WDT_MODE keeps whatever the bootloader wrote. The Amazon Fire HD 10 (2017) bootloader leaves dual mode with the bark IRQ enabled, and no pretimeout is configured, so each timeout only raises the IRQ and restarts the count: with the 20 s timeout systemd sets, a hung system was reset after 37.95-39.76 s, and after 18.25-20.92 s once IRQ_EN was cleared by hand. Program the mode as mtk_wdt_start() does, which also applies mediatek,disable-extrst and mediatek,reset-by-toprgu to a running watchdog; read those two properties first. Fixes: bbece05c0d3a ("watchdog: mtk_wdt: Remove mtk_wdt_stop() in probe() to prevent the system freeze and it doesn't reboot by watchdog problem") Assisted-by: LLM Signed-off-by: Ryan Brue <ryanbrue.dev@gmail.com> Link: https://patch.msgid.link/20260923-rbrue-suez-upstreaming-mtk-wdt-dual-mode-v1-1-0970852315e4@gmail.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-10-19netdevsim: reject cls_bpf programs bound to another deviceJamal Hadi Salim
The issue: nsim_bpf_setup_tc_block_cb() installs any device-bound SCHED_CLS program without checking that its offload device matches the target netdev. The core cls_bpf attach path rejects a mismatching program, but a netdev that joins a shared block later is replayed the stored filter by cls_bpf_reoffload() before it is inserted into block->ports, so the attach-time check cannot see it. The driver callback is the authoritative per-device acceptance boundary and must enforce the match itself, as nfp already does in nfp_net_bpf_offload(). Without the check, replaying a device-bound program onto a different bpf_offload_dev installs it into that device's netdevsim state, which trips the WARN in nsim_bpf_uninit() (ns->bpf_offloaded set on a foreign device) and can dereference a NULL prog->aux->offload in nsim_prog_set_loaded(). The Fix: Reject a device-bound program whose offload device does not match the target netdev, with -EINVAL and an extack so the rejected replay is not silent. The check is intentionally narrower than nfp's: it fires only for a dev-bound program, so nsim's bpf_tc_non_bound_accept mode (which admits an unbound program onto the device) is unaffected. Teardown is never blocked: the guard is on the program being installed and an unbind passes cls_bpf.prog = NULL. Conditions to recreate the bug: - CONFIG_NETDEVSIM=y, CONFIG_NET_CLS_BPF=y - load and pin a dev-bound SCHED_CLS program for netdevsim device B - install the program on a shared block owned by B - add an independently backed netdevsim device C to that block; the bind replays the filter to C's callback, and C's ports/0/bpf_offloaded_id takes the B-bound program id. The reported Sashiko review is at https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260809094418.901607-1-jhs@mojatatu.com Fixes: 31d3ad832948 ("netdevsim: add bpf offload support") Reported-by: Sashiko (nipa) <sashiko-bot@kernel.org> Link: https://lore.kernel.org/netdev/20260809094418.901607-1-jhs@mojatatu.com/ Link: https://lore.kernel.org/netdev/QDISC-PYC7.v1.20261003103747@mojatatu.com/ Cc: stable@vger.kernel.org Reviewed-by: Victor Nogueira <victor@mojatatu.com> Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/QDISC-PYC7.v2.20261010165947-2@mojatatu.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-19PCI/sysfs: Reject unaligned resource I/O port accessesDeepanshu Kartikey
pci_resource_io() validates that off+count stays within the BAR's range but never checks that the resulting port is aligned to the access size. A pwrite64()/pread64() on a resourceN file with an odd offset and count=2 or count=4 reaches outw()/outl() with a misaligned address. On arm64 this becomes a store/load to a Device-memory mapping (PCI_IOBASE + port), which architecturally requires natural alignment, causing an alignment fault and kernel oops. Reject misaligned accesses before they reach the low-level accessor. Reported-by: syzbot+7134530b25073b4ef373@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=7134530b25073b4ef373 Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Tested-by: Rihyeon Kim <rihyeon8648@gmail.com> Acked-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Link: https://patch.msgid.link/20260809045946.15638-1-kartikey406@gmail.com
2026-10-19Revert "Input: matrix_keypad - force switch rows to input mode"Alexander Kochetkov
This reverts commit 01c84b03d80aab9f04c4e3e1f9085f4202ff7c29. The commit makes every scan call gpiod_direction_input() on the row GPIOs. On pin controllers where GPIO input and interrupt are separate pinmux functions this switches the row pins out of interrupt mode, and enable_row_irqs() does not switch them back: it only unmasks the interrupts. Row interrupts then never arrive and the keypad stops working. Seen with a matrix keypad on an Allwinner A64 board (PINE A64-LTS); it works again with the commit reverted. The workaround is not needed on Ingenic either: the author of the reverted commit re-tested all available JZ47xx SoCs and they all report the live pin state in interrupt mode, see the thread in Link. Fixes: 01c84b03d80a ("Input: matrix_keypad - force switch rows to input mode") Link: https://lore.kernel.org/all/4130C026-2A83-408B-836A-ECA044491C47@gmail.com/ Cc: stable@vger.kernel.org Signed-off-by: Alexander Kochetkov <al.kochet@gmail.com> Acked-by: Siarhei Volkau <lis8215@gmail.com> Acked-by: Paul Cercueil <paul@crapouillou.net> Link: https://patch.msgid.link/20261002100935.449473-1-al.kochet@gmail.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-10-19r8169: add get_channel support for ethtoolJaven Xu
Add get_channel support for ethtool. In multi-vector mode, it reports the active RX channel count and a single TX channel. Additionly, it reports one other channel to account for the dedicated link-change interrupt vector. In single-vector mode, where RX, TX, link-change events share the same interrupt, it reports a single combined channel. Signed-off-by: Javen Xu <javen_xu@realsil.com.cn> Link: https://patch.msgid.link/20261008065722.1026-8-javen_xu@realsil.com.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-19r8169: move struct ethtool_opsJaven Xu
The patch moves the rtl8169_ethtool_ops definition further down in r8169_main.c so that subsequent additions of rtl8169_get_channels and can be referenced from the ops struct without needing forward declarations. Signed-off-by: Javen Xu <javen_xu@realsil.com.cn> Link: https://patch.msgid.link/20261008065722.1026-7-javen_xu@realsil.com.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-19r8169: add support and enable rssJaven Xu
This patch adds support and enable rss for RTL8127. It requests 30 to 32 MSI-X vectors. To support RSS, this patch converts struct RxDesc into a union. Additionly, this patch fixes a potential skb overrun issue. Previously, with NETIF_F_RXALL enabled, a runt or CRC-error desc with a length below 4 would fall through to subtract ETH_FCS_LEN. This will lead to a memory overrun. Fix this by explicitly dropping packets smaller than ETH_HLEN + ETH_FCS_LEN. Note that this fix introduces a behavior change on non-RSS chips: with both RXALL and RXFCS enabled, runt frames of 14 to 17 bytes that used to be delivered are now dropped. Ethtool rss tools will be contained in another series patched instead of this patch. Signed-off-by: Javen Xu <javen_xu@realsil.com.cn> Link: https://patch.msgid.link/20261008065722.1026-6-javen_xu@realsil.com.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-19r8169: prepare for new interrupt mappingJaven Xu
This patch enables new interrupt mapping for RTL8127 and add error pkts counter per ring. Note that tp->irq_nvecs and tp->num_rx_rings are still hard-coded to 1. The new mapping and multi-ring stats will actually become active in a later patch that requests multiple MSI-X vector. Signed-off-by: Javen Xu <javen_xu@realsil.com.cn> Link: https://patch.msgid.link/20261008065722.1026-5-javen_xu@realsil.com.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-19r8169: add support for new interrupt mappingJaven Xu
To support RSS, the number of hardware interrupt bits should match the interrupt of software. So we add support for new interrupt mapping here. ISR_VEC_MAP_REG is the hardware register to indicate interrupt status. IMR_SET_VEC_MAP_REG is interrupt mask which is set to enable irq. Note that this patch only adds the infrastructure. All of the new paths are gated on tp->irq_nvecs > 1. At this stage, irq_nvecs is still 1, so this code will remain inactive until the subsequent patch requsets multiple MSI-X vectors. Signed-off-by: Javen Xu <javen_xu@realsil.com.cn> Link: https://patch.msgid.link/20261008065722.1026-4-javen_xu@realsil.com.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-19r8169: refactor RX path to prepare for multi-queueJaven Xu
This patch is a preparatory refactoring of the RX path. It introduces struct rtl8169_rx_ring and turns the previously embedded RX state in rtl8169_private into a per-queue array. The original DMA address of rx buffer is read back directly from desc->addr. But when we enable rss, desc->addr will be overwritten. So this patch introduces a array to cache the DMA address of rx buffers which we name it as rx_buf_dma_addr. While the netdev allocation is changed to devm_alloc_etherdev_mqs() with up to 8 RX queues, the actual number of active RX rings (num_rx_rings) is currently kept at 1. The actual multi-queue operation and RSS enablement will be introduced in subsequent patches. Signed-off-by: Javen Xu <javen_xu@realsil.com.cn> Link: https://patch.msgid.link/20261008065722.1026-3-javen_xu@realsil.com.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-19r8169: prepare for multi irqs and napiJaven Xu
This patch converts the single struct napi_struct into a dynamically allocated array indexed by IRQ. This is a preparation step for adding RSS support. Currently, irq_nvecs and num_rx_rings are still hard-coded to 1. Note that this patch adds netif_napi_set_irq() to expose NAPI-IRQ mapping via netlink, and updates probe log format to show the total number of IRQs. Signed-off-by: Javen Xu <javen_xu@realsil.com.cn> Link: https://patch.msgid.link/20261008065722.1026-2-javen_xu@realsil.com.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-19Input: s6sy761 - drop duplicate axis initialization in s6sy761_probe()Dmitry Torokhov
ABS_MT_TOUCH_MAJOR and ABS_MT_TOUCH_MINOR are initialized twice with identical parameters in s6sy761_probe(). Remove the duplicate calls. Reported-by: sashiko-bot@kernel.org Assisted-by: LLM Reviewed-by: David Heidelberg <david@ixit.cz> Link: https://patch.msgid.link/asdjLHHNrrtjIKCb@google.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-10-19Input: always accept EV_SYN in input_event()Dmitry Torokhov
Commit 0cd587735205 ("Input: preallocate memory to hold event values") moved allocation of dev->vals into input_allocate_device(), which caused input core to accumulate events reported while seeding initial device state before input_register_device(). However, because EV_SYN is only set in dev->evbit during input_register_device() (and some drivers also overwrite dev->evbit directly before registration), any EV_SYN/SYN_REPORT events sent before registration were dropped by is_event_supported(), leaving those seeded events stuck in dev->vals until the next SYN_REPORT after registration. Always accept EV_SYN in input_event() and input_inject_event() without checking dev->evbit so input_sync() flushes dev->vals as intended. Reported-by: Karlos Abel <kabel@voidship.net>, Fixes: 0cd587735205 ("Input: preallocate memory to hold event values") Cc: stable@vger.kernel.org Assisted-by: LLM Acked-by: Jiri Kosina <jkosina@suse.com> Link: https://patch.msgid.link/asx50uz6iafsyAd5@google.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-10-19hwmon: (acpi_power_meter) Fix 18.45 TW bugArmin Wolf
The ACPI specification says: "If an error occurs while obtaining the meter reading or if the value is not available then an Integer with all bits set is returned" This integer can also be 64-bit wide on ACPI 2.0 and later systems, so we have to check for that too. Compile-tested only. Reported-by: Grant Slater <github@firefishy.com> Closes: https://github.com/lm-sensors/lm-sensors/issues/460 Fixes: 1fefca6c57fb ("hwmon: (acpi_power_meter) Fix 4.29 MW bug") Cc: stable@vger.kernel.org Signed-off-by: Armin Wolf <W_Armin@gmx.de> Link: https://patch.msgid.link/20261006234618.10943-1-W_Armin@gmx.de Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-10-19rtc: rs5c372: support eco mode on R2223xHeiko Schocher
The R2223x can run in an eco mode that lowers its current consumption from the backup supply. Follow the ricoh,eco-mode property from the device tree: enable the mode when the property is set, turn it off when it is not set, as the bit is in CTRL2 register, which is backed by the same supply and keeps its contents across a reset, and no other path in the driver touches it. Signed-off-by: Heiko Schocher <hs@nabladev.com> Link: https://patch.msgid.link/20260825071927.4090460-4-hs@nabladev.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-10-19rtc: rs5c372: add support for Ricoh R2223xHeiko Schocher
The R2223x is an I2C RTC from the same family as the r2025sd and r2221tl that this driver already handles. It shares the R2x2x control register layout, so treat it like the r2221tl. The oscillator interrupt flag is reported through XSTP, and the 24 hour mode bit lives in CTRL1. It also has the DEV bit in the trim register, so same as r2221tl. Signed-off-by: Heiko Schocher <hs@nabladev.com> Reported-by: Sashiko AI review <sashiko-bot@kernel.org> Closes: https://sashiko.dev/#/patchset/20260824110452.4038870-1-hs@nabladev.com?part=2 Closes: https://sashiko.dev/#/patchset/20260824110452.4038870-1-hs@nabladev.com?part=3 Link: https://patch.msgid.link/20260825071927.4090460-3-hs@nabladev.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-10-19rtc: Add Raspberry Pi 5 RTC driverSander Speetjens
Upstreaming the downstream Raspberry Pi 5 RTC driver. This driver supports the custom DA9091, which is accessed through the firmware mailbox. Based on code originally written by Jonathan Bell <jonathan@raspberrypi.com> and Dom Cobley <popcornmix@gmail.com> Reviewed-by: Stefan Wahren <wahrenst@gmx.net> Signed-off-by: Sander Speetjens <sander.speetjens@gmail.com> Link: https://patch.msgid.link/20261018151056.1051330-4-sander.speetjens@gmail.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-10-19hwmon: (sht3x) Return the consumed count for heater writesBaek Kyu, Kim
heater_enable_store() returns the result of i2c_master_send(), which is the two-byte command length on success rather than the sysfs input count. This can report more bytes than were supplied, or a partial write for a fully processed input. For example, writing "on\n" returns two instead of three, so a caller retrying the remaining newline gets -EINVAL even though the heater command succeeded. Retrying the remainder of "off\n" can also send the heater-off command twice. Return count after a complete command transfer. Preserve negative I2C errors and return -EIO for nonnegative incomplete transfers, so a zero-message transfer is not reported as a successful zero-byte write. Keep the existing boolean parsing, command selection and locking. Fixes: 50c22cd154e5 ("hwmon: (sht3x) add humidity heater element control") Cc: stable@vger.kernel.org Signed-off-by: Baek Kyu, Kim <pocj8ur4in@gmail.com> Link: https://patch.msgid.link/20261019154718.2328055-1-pocj8ur4in@gmail.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-10-19hwmon: (mcp9982) Update the interval cache only after successful writesBaek Kyu, Kim
mcp9982_write() updates interval_idx before writing the conversion-rate register. If the write fails without changing the register, subsequent update_interval reads report the requested interval instead of the previous setting. Update interval_idx only after regmap_write() succeeds, leaving the previous cached interval in place on error. Fixes: e2fe950f34e5 ("hwmon: add support for MCP998X") Cc: stable@vger.kernel.org Signed-off-by: Baek Kyu, Kim <pocj8ur4in@gmail.com> Acked-by: Duicu Victor <victor.duicu@microchip.com> Link: https://patch.msgid.link/20261018055750.1318723-1-pocj8ur4in@gmail.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-10-19rtc: pcf8563: pass the driver data to the alarm interrupt handlerIgor Velkov
pcf8563_irq() takes its dev_id as struct pcf8563, but probe still registers the interrupt with the i2c client. The handler then takes the regmap pointer from the wrong structure: the first alarm oopses, the level-low INT is never acknowledged, and the interrupt gets disabled as spurious. Only an RTC that has an interrupt (client->irq > 0) reaches this path. Fixes: 00f1bb9b8486 ("rtc: pcf8563: Switch to regmap") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Igor Velkov <iav@iav.lv> Reviewed-by: Nobuhiro Iwamtasu <iwamatsu@nigauri.org> Link: https://patch.msgid.link/20261004-pcf8563-irq-data-v1-1-f176763ddf2f@iav.lv Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-10-19rtc: nvidia-vrs10: remove locking in IRQ handlerAlexandre Belloni
Remove locking in the interrupt handler as it is not necessary to be locked while calling rtc_update_irq(). Link: https://patch.msgid.link/20261009212347.490403-1-alexandre.belloni@bootlin.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-10-19platform/x86/amd/pmc: Fix RTC reference leak in amd_pmc_verify_czn_rtc()Ma Ke
amd_pmc_verify_czn_rtc() opens the RTC with rtc_class_open(), which takes both a device reference and a module reference on the RTC driver. The matching release is rtc_class_close(), and it is never called. Every return path after the device has been opened, the ones that return 0 as well as the ones that report an error, leaves both references behind, so each S0i3 suspend leaks them. Release the reference with a __free() cleanup on the declaration, which covers every return path without adding labels. rtc_class_close() does not accept a NULL argument, so the cleanup helper has to guard against one: rtc_class_open() may fail and the declaration still has to be cleaned up. Found by code review. Fixes: 59348401ebed ("platform/x86: amd-pmc: Add special handling for timer based S0i3 wakeup") Cc: stable@vger.kernel.org Signed-off-by: Ma Ke <make_ruc2021@163.com> Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Link: https://patch.msgid.link/20261011121759.3267678-1-make_ruc2021@163.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-10-19rtc: sun6i: add Allwinner B288 compatiblePablo Mazzini
The 32 kHz clocks are the same as the A23's. Only one alarm interrupt is wired, which is all the driver uses. Signed-off-by: Pablo Mazzini <pmazzini@gmail.com> Link: https://patch.msgid.link/20261012100816.331033-7-pmazzini@gmail.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-10-19rtc: sun6i: fix error handling in sun6i_rtc_clk_init()Pablo Mazzini
Set sun6i_rtc only once all clocks are registered, and unwind fully on error. Signed-off-by: Pablo Mazzini <pmazzini@gmail.com> Link: https://patch.msgid.link/20261014193220.38055-1-pmazzini@gmail.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-10-19rtc: cmos: Honor explicit use_acpi_alarm parameter valueGregory Price
An explicit rtc_cmos.use_acpi_alarm=0 command-line argument is ignored on systems where use_acpi_alarm_quirks() enables ACPI RTC alarms. The argument appears in /proc/cmdline, but the read-only parameter reports Y. The boolean parameter defaults to false, so the driver cannot distinguish an omitted argument from an explicit false value. Use a custom setter to record whether parsing occurred and skip automatic selection when it did. Preserve the bool parameter type metadata. Automatic selection remains unchanged when the parameter is omitted. On the affected system, the explicit false value reports N after this change. The HPET-emulated path completed 100 test runs without a failure while the ACPI RTC event counter remained at zero. Fixes: 36d91a4d401c ("rtc: cmos: introduce quirks to enable use_acpi_alarm mode") Cc: stable@vger.kernel.org Signed-off-by: Gregory Price (Meta) <gourry@gourry.net> Link: https://patch.msgid.link/20261015173029.3091872-3-gourry@gourry.net Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-10-19rtc: cmos: Disable ACPI RTC event before handling itGregory Price
Users of RTC_UIE_ON can stop receiving update interrupts when rtc-cmos handles alarms through ACPI. In one 50-run test, 40 runs passed and 10 timed out after receiving between one and four of five expected events. The ACPI ff_rt_clk counter stopped at 218, exactly matching the number of events delivered to userspace, and reported: 218 STS disabled unmasked rtc_handler() runs in the threaded ACPI SCI handler and calls cmos_interrupt(), which schedules rtc->irqwork. The work can run before rtc_handler() returns: ACPI SCI thread rtc->irqwork cmos_interrupt() schedule_work() __rtc_set_alarm() rtc_wake_on() acpi_clear_event() acpi_disable_event() The SCI thread then disables the event that the worker enabled for the next alarm. That alarm sets its status while delivery remains disabled, so no update interrupt reaches userspace. Clear and disable the current ACPI RTC event before cmos_interrupt() schedules the work. The worker can then enable the next event without the handler undoing it. With this ordering, 150 runs delivered all 750 events without a stall. Fixes: 311ee9c151ad ("rtc: cmos: allow using ACPI for RTC alarm instead of HPET") Cc: stable@vger.kernel.org Signed-off-by: Gregory Price (Meta) <gourry@gourry.net> Link: https://patch.msgid.link/20261015173029.3091872-2-gourry@gourry.net Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-10-19zloop: print device that had errorsJohannes Thumshirn
When testing zoned filesystems that span multiple zloop drives it can be difficult to figure out which devices access caused an error. Prefix the error messages where we have the disk available with the disk name. Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Damien Le Moal <dlemoal@kernel.org> Signed-off-by: Johannes Thumshirn <johannes.thumshirn@wdc.com> Link: https://patch.msgid.link/20261019150936.1819956-1-johannes.thumshirn@wdc.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-10-19regmap: Merge up fixesMark Brown
The main thing here is a fix for lockdep warnings with MMIO regmaps that use a raw spinlock and a cache, some other lockdep fixes we'd done for the benefit of the maple tree on sleeping buses meant that we were doing allocations for those MMIO regmaps under a raw spinlock. While fixing that Michael Reeves also noticed that the debugfs files were briefly available without the cache structures backing them. There's also a fix for interrupt freeing on error in regmap-irq which had been hanging around because it's not super urgent.
2026-10-19Merge tag 'asoc-v7.4' of ↵Takashi Iwai
https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Updates for v7.4 There's an awful lot of cleanup work in this pull request, lots from Bui Duc Phuc, Pengpeng Hou, HyeongJun An and Chancel Liu cleaning up detail issues in drivers in addition to Mormoto-san's ongoing framework work. This time Morimoto-san's work included enabling auto_selectable_formats so there's less manual configuration required for DAI links. There's also been a huge amount of upstreaming activity from Qualcomm, some pain there but hopefully enough has now landed for things to be smoother in future. - Use auto_selectable_formats in most drivers to reduce the amount of manual configuration required for DAI links. - Support for compressed audio on SOF IPC4 systems. - Support for AMD ACP 7.B and 7.F, AmLogic A9 and T7, Airoha AN7581, ESS Technology ES9039Q2M, Intel Cherry Trail with RT5688, Nuvoton NAU83G60, nVidia systems with WM8994, Qualcomm QAIF, Senary I2S, WCD9378 and various platforms, Realtek RT766 and RT767, Senary SN624x I also mistakenly merged some SPI changes in here then applied more patches on top before I noticed (it looks like this was b4's base selection logic picking a bad base for some ASoC work), highlights there are: - Improvements for spidev_test to cover additional use cases, plus be a bit easier to use. - Push more Tegra210 QSPI handling into interrupt context for performance improvements. - Support for Qualcomm QPIC SNAND v2 and RealTek RTD1625 NOR. - Documentation clarifications. - Fixes for some runtime PM and error handling issues. - Support for R-Car Gen5. (this should also be going in via my SPI pull request)
2026-10-19PCI: rcar-gen4: Add missing PM opsMarek Vasut
The R-Car Gen4 PCIe controller is part of a power domain. On R-Car S4 and V4H, this is an always-on power domain which is not shut down in suspend. On R-Car V4M, this is a dedicated A2PCIPHY power domain, which is shut down during suspend, and the controller loses state, which prevents the PCIe from working after resume. Fix this by adding generic suspend/resume noirq ops for the controller, which tear the link down on suspend, and restart it on resume. Use the same PM ops on all of R-Car Gen4 to gracefully suspend and resume the PCIe link on V4H and S4 too. Test case which demonstrates the problem on R-Car V4M: $ hexdump -vC /sys/bus/pci/devices/0000:00:00.0/config > /tmp/pre $ echo s2idle > /sys/power/mem_sleep $ echo platform > /sys/power/pm_test $ echo mem > /sys/power/state $ hexdump -vC /sys/bus/pci/devices/0000:00:00.0/config > /tmp/post $ diff -Naru /tmp/pre /tmp/post ... -00000000 12 19 32 00 07 05 10 00 00 00 04 06 00 00 01 00 +00000000 12 19 32 00 07 05 10 00 00 00 00 ff 00 00 80 00 ^^^^^ Class 0604->00ff Fixes: 0270dbe4f891 ("arm64: dts: renesas: r8a779h0: Add PCIe Host and Endpoint nodes") Reported-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Tested-by: Geert Uytterhoeven <geert+renesas@glider.be> Tested-by: Koichiro Den <den@valinux.co.jp> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20261004011851.866833-1-marek.vasut+renesas@mailbox.org
2026-10-19spi: Merge up fixesMark Brown
A small collection of driver specific fixes, all quite important if you have the relevant hardware.
2026-10-19net: stmmac: leave the datapath running for normal-size MTU changesJames Hilliard
When both MTUs are at most ETH_DATA_LEN, the receive buffer size and MAC receive limit do not change. Update the MTU without restarting the datapath. This also avoids rebinding a live AF_XDP pool to a temporary RXQ. XDP rejects jumbo MTUs, so all supported XDP MTU changes take this path. Jumbo transitions still use the existing reopen path. Found by source review while working on the stmmac MTU/resume recovery series. The fast path was tested on Allwinner H616 with sun8i EMAC1 and an AC300 PHY. The AF_XDP scenario was identified by inspection. Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de> Signed-off-by: James Hilliard <james.hilliard1@gmail.com> Reviewed-by: Daniel Machon <daniel.machon@microchip.com> Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Link: https://patch.msgid.link/20261013-stmmac-mtu-fastpath-v2-1-1e4ce8137689@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-10-19net: stmmac: disable TX checksum offload for jumbo frames on bugged coresLorenzo Bianconi
stmmac_xdp_xmit_xdpf() decides TX checksum insertion from the queue COE capability only: csum = !priv->plat->tx_queues_cfg[queue].coe_unsupported; and lets the enhanced descriptor set TX_CIC_FULL accordingly. On the bugged_jumbo cores (snps,dwmac-3.40a, snps,dwmac-3.610 and snps,dwmac-3.710) hardware checksum insertion is broken for jumbo frames; the skb path works around it by clearing NETIF_F_CSUM_MASK in stmmac_fix_features() when the MTU exceeds ETH_DATA_LEN, so skbs are never marked CHECKSUM_PARTIAL and no checksum is inserted. The XDP TX path bypasses that workaround, so once XDP is allowed at MTU > ETH_DATA_LEN, jumbo frames sent via XDP_TX or redirected into the device would leave the interface with a full checksum insertion enabled on those cores - exactly what the workaround is meant to avoid. Disable checksum insertion for oversized frames on bugged_jumbo cores in the XDP TX path too. Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@oss.qualcomm.com> Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Link: https://patch.msgid.link/20261012-stmmac-xdp-tx-pre-fixes-v1-2-05fd0c90f7e1@oss.qualcomm.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-10-19net: stmmac: fix XDP TX DMA address for compound RX pagesLorenzo Bianconi
When RX buffers are compound pages (order > 0), only the head page carries the DMA address programmed by the page pool (page_pool_get_dma_addr()). stmmac_xdp_xmit_xdpf() computed the head buffer's bus address from the page that happens to contain the data: page = frag ? skb_frag_page(frag) : virt_to_page(xdpf->data); dma_addr = page_pool_get_dma_addr(page); ... RX pages become compound as soon as dma_buf_sz needs more than one page (pp_params.order = order_base_2(num_pages) > 0), which happens from an MTU around 3000 bytes once dma_buf_sz reaches 4096. If an XDP program moves the data forward with bpf_xdp_adjust_head() by more than about a page, xdpf->data points into a tail page whose struct page has no DMA address: page_pool_get_dma_addr() then returns a bogus bus address, and dma_sync_single_for_device() together with the TX descriptor transmit from the wrong location. Use virt_to_head_page() to read the DMA base of the buffer and keep the offset relative to the head page (sizeof(*xdpf) + xdpf->headroom), which is correct no matter which page the data ends up in. Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@oss.qualcomm.com> Reviewed-by: Daniel Machon <daniel.machon@microchip.com> Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Link: https://patch.msgid.link/20261012-stmmac-xdp-tx-pre-fixes-v1-1-05fd0c90f7e1@oss.qualcomm.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-10-19Merge branch 'thermal-drivers'Rafael J. Wysocki
Merge updates of assorted thermal control drivers for 7.4: - Add the Exynos ACPM thermal driver for Google GS101, along with DT bindings and a MAINTAINERS entry (Tudor Ambarus) - Add Renesas RZ/G3L thermal sensor support and DT bindings, and move default calibration values to per-SoC match data (Biju Das) - Add Qualcomm MSM8952 TSENS support and the corresponding DT binding compatible (Muzaffer Kadir) - Document the Qualcomm PMAU0102 Master BandGap temperature monitor compatible in the DT bindings (Dhruvin Rajpura) - Extend the QCom TSENS v2 trip temperature limits to the hardware range of -204°C to +204°C to prevent interrupt storms when operating beyond the previous software limits (Priyansh Jain) - Fix temperature threshold map indexing in the QCom SPMI temperature alarm driver to prevent out-of-bounds reads (Georgi Djakov) - Describe the additional bus clock required by the Amlogic T7 thermal sensor and switch the driver to the clk_bulk API to manage multiple clocks (Ronald Claveau) - Request the Airoha EN7581 IRQ after thermal zone registration to prevent the interrupt handler from accessing an unregistered or already freed thermal zone (Vitaliy Sochnev) - Fix the Airoha AN7583 ADC mux field mapping, serialize access to the shared ADC, and verify mux selection to avoid invalid temperature readings and spurious critical shutdowns (Vitaliy Sochnev) - Register separate thermal zones for the AN7583 bandgap, GbE and CPU sensors, and update the DT bindings to use one thermal sensor cell to select the sensor (Vitaliy Sochnev) - Fix signed integer overflow in the Renesas RZ/G3E temperature-to-code conversion, preserve compare interrupt state across runtime PM, and prevent overlapping temperature conversions (Ovidiu Panait) - Remove redundant trip window validation and runtime PM pm_runtime_mark_last_busy() calls from the Renesas RZ/G3E driver (Ovidiu Panait) - Propagate reset assertion failures from Renesas RZ/G3E suspend and attempt to restore power if the sensor was active (Pengpeng Hou) - Stop the TI bandgap alert IRQ before removing sensor interfaces and cancel pending alert work to prevent use-after-free on driver removal (Weigang He) - Validate Spreadtrum sensor IDs read from the device tree before using them for register offsets and array indexing (Weigang He) - Convert the TI OMAP bandgap DT bindings to schema and document the DRA752 compatible and thermal sensor cells (Bhargav Joshi) - Use DT property helpers matching the signed temperature and unsigned hysteresis types defined by the thermal zone bindings (Rob Herring) - Reuse common error handling code in the power allocator governor bind callback (Markus Elfring) - Constify the thermal zone device operations in the i.MX9 driver (Christophe JAILLET) - Fix kernel-doc parameter names and firmware node references in the cooling device registration helpers (Aryan Sinha) - Correct the documented return value of ti_bandgap_get_sensor_data() to describe validation errors and potentially NULL stored data (Karl Mehltretter) - Ensure NUL-termination when copying the cooling device command-line argument in tmon and fix the associated string truncation warning (Florian Fainelli) - Fix undefined behavior caused by a signed shift in the tmon thermal zone binding display (Liu Jing) - Fix wording in tmon comments (Hemanth Selam) - Simplify cpufreq_set_cur_state() in the cpufreq_cooling thermal control driver (Thorsten Blum) * thermal-drivers: (36 commits) thermal/drivers/rzg3e: Propagate reset assertion failure from suspend thermal: ti-soc-thermal: Fix the return value in ti_bandgap_get_sensor_data() kernel-doc thermal/fw: Fix kernel-doc parameter names thermal/qcom/tsens: Add support for MSM8952 tsens dt-bindings: thermal: tsens: Add MSM8952 thermal/drivers/amlogic: Switch to clk_bulk API to support multiple clocks dt-bindings: thermal: amlogic: describe bus clock for t7-thermal tools/thermal/tmon: Fix string truncation warning in optarg copy thermal/drivers/airoha: Register a thermal zone per AN7583 sensor dt-bindings: arm: airoha: Use one thermal sensor cell for AN7583 thermal/drivers/airoha: Serialise access to the shared ADC thermal/drivers/airoha: Fix AN7583 ADC mux field mapping thermal/drivers/sprd: validate the sensor id from the device tree thermal/drivers/ti-soc-thermal: Cancel pending alert work on remove thermal/drivers/qcom-spmi-temp-alarm: Fix temp_map indexing thermal: gov_power_allocator: Use common error handling code in power_allocator_bind() tools/thermal/tmon: Fix signed shift UB in binding display MAINTAINERS: Add entry for Samsung Exynos ACPM thermal driver thermal/drivers/samsung: Add Exynos ACPM TMU driver GS101 dt-bindings: thermal: Add Google GS101 TMU ...
2026-10-19net: stmmac: unwind the WoL IRQ after a safety IRQ request failureJames Hilliard
The safety IRQ is requested after the MAC and optional WoL IRQs. If its request fails, stmmac_free_irq() frees the unregistered safety IRQ and leaks the WoL handler. This can warn about an already-free IRQ and make the next open fail. Move the safety and WoL cleanup labels into reverse acquisition order. This was found by code inspection while working on the stmmac MTU/resume recovery series. Injecting a safety IRQ request failure in QEMU with mocked MAC/DMA hardware reproduced the "Trying to free already-free IRQ" warning and leaked WoL handler. The failure has not been observed without fault injection. Signed-off-by: James Hilliard <james.hilliard1@gmail.com> Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de> Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Link: https://patch.msgid.link/20261013-stmmac-irq-unwind-v3-1-fff4e2db805a@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-10-19Merge branches 'thermal-intel', 'thermal-docs' and 'thermal-misc'Rafael J. Wysocki
Merge updates of thermal control drivers for Intel platforms, a thermal control documentation update and two miscellaneous thermal control updates for 7.4: - Make the Intel powerclamp thermal driver reject invalid window_size values, drop redundant clamp() from duration_set() in it, and simplify 4 functions in it (Thorsten Blum) - Add rugged Panther Lake support to the intel_tcc_cooling thermal driver (Srinivas Pandruvada) - Fix temperature selection around 0 C in the int340x thermal driver, drop redundant else from proc_thermal_add() in it, and simplify slider_def_*_set() in it (Thorsten Blum) - Drop unbalanced paren from cpu-idle-cooling.rst (Manuel Ebner) - Use %pe to print error pointers symbolically in the thermal control code and fix assorted typos in comments in it (Sumeet Pawnikar and Hemanth Selam) * thermal-intel: thermal: intel: int340x: soc_slider: Simplify slider_def_*_set() thermal: intel: powerclamp: Simplify max_idle_set() thermal: intel: powerclamp: Simplify duration_get() thermal: intel: powerclamp: Simplify idle_inject_update() thermal: intel: int340x: Fix temperature selection around 0 C thermal: intel: powerclamp: Simplify check_invalid() thermal: intel: intel_tcc_cooling: Add rugged Panther Lake support thermal: intel: powerclamp: Drop redundant clamp() in duration_set() thermal: intel: int340x: Drop redundant else in proc_thermal_add() thermal: intel: powerclamp: Reject invalid window_size values * thermal-docs: thermal: docs: cpu-idle-cooling.rst: Drop unbalanced paren * thermal-misc: thermal: Use %pe to print error pointers symbolically thermal: fix assorted typos in comments
2026-10-19bnxt_en: don't leave an XDP program installed when the open failsVaibhav Nagare
bnxt_xdp_set() stores the new program and drops the reference on the old one before reopening the NIC. If bnxt_open_nic() then fails, ndo_bpf() returns an error with the new program still in bp->xdp_prog. The caller treats the error as "nothing was installed" and drops its own reference, so bp->xdp_prog is left pointing at a freed program and the next XDP update dereferences it: BUG: unable to handle page fault for address: ff78ecc80ddd1038 RIP: 0010:__bpf_prog_put+0x5/0x80 Call Trace: bnxt_xdp_set+0xad/0x1b0 [bnxt_en] dev_xdp_propagate+0x36/0xa0 bond_xdp_set+0xeb/0x2d0 [bonding] dev_xdp_install+0x1b1/0x350 bpf_xdp_link_update+0xc5/0x1b0 link_update+0x104/0x1e0 __sys_bpf+0x662/0xcf0 Seen on a 6.12 based kernel after bnxt_alloc_mem() failed an order-4 allocation on a fragmented host: bnxt_en 0000:a0:00.1 ens4f1np1: nic open fail (rc: fffffff4) bond1: (slave ens4f1np1): Error -12 calling ndo_bpf Bonding is not required to hit this; a plain XDP attach on a bnxt interface takes the same path. Restore the previous program when an attach or a replace fails, and recompute the page-mode and XDP TX ring configuration from it. The configuration matters because bnxt_init_one_rx_ring() only assigns rxr->xdp_prog in page mode, and __bnxt_set_rx_skb_mode() derives dev->max_mtu from the installed program. Release the old program only once the change has been committed. A detach is not undone. dev_xdp_detach_link() clears the core's record of the program even when the driver returns an error, so putting the program back would leave the driver running a program the core has already dropped. If the reopen fails during a detach, bnxt_xdp_set() therefore returns 0 with the device closed; bnxt_open_nic() has already logged the failure. Found in a crash dump; the change was not tested on hardware. Fixes: c6d30e8391b8 ("bnxt_en: Add basic XDP support.") Cc: stable@vger.kernel.org Signed-off-by: Vaibhav Nagare <vnagare@redhat.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20261012072802.2153706-1-vnagare@redhat.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-10-19Merge tag 'kvm-s390-next-7.4-2' of ↵Paolo Bonzini
git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD KVM: s390: Changes for 7.4 - rework page allocation for secure guest variable storage - selftests - documentation - replace get_zeroed_page with kzalloc - fix floating interrupt inject for corner cases - initial arm64 on s390 support This also contains the patch "arm64: Use proper include variant" as a build fix. It is also part of the arm tree.
2026-10-19Merge branches 'pm-sleep', 'pm-em', 'pm-cpu', 'pm-misc' and 'pm-tools'Rafael J. Wysocki
Merge updates related to system sleep, an energy model handling update, a generic CPU PM driver update, a clock framework PM update, and a pm-graph utility update for 7.4: - Ignore page-zero RAM in E820 checksum during hibernation on x86 to avoid rejecting images created after kexec() (Matthias Goergens) - Add resume event mapping for PMSG_POWEROFF to the PM core to allow it to carry out device shutdown in the future (Mario Limonciello) - Add DPM watchdog to prepare/late/early/noirq/complete phases of device suspend and resume (Mayank Rungta) - Update swsusp.txt references to swsusp.rst in hibernation documentation (Li Jun) - Fix use-after-free of perf domain in netlink doit handlers for energy models (Fan Wu) - Add synchronize_rcu() back to cpu_pm_unregister_notifier() after it was removed inadvertently in previous development cycles to avoid use-after-free (Bradley Morgan) - Unregister CPU PM notifier outside the timer lock in the timer-ti-dm clocksource driver (Bradley Morgan) - Fix typo "sucessfully" in a comment in pm_clk_add_clk() kerneldoc comment and typo "hierachy" in a comment in pm-graph (Hemanth Selam) * pm-sleep: x86/hibernate: Ignore page-zero RAM in E820 checksum PM: sleep: Add resume event mapping for PMSG_POWEROFF PM: sleep: Add DPM watchdog to prepare/late/early/noirq/complete phases PM: hibernate: docs: update swsusp.txt references to swsusp.rst * pm-em: PM: EM: Fix use-after-free of perf domain in netlink doit handlers * pm-cpu: PM: CPU: Restore synchronize_rcu() to cpu_pm_unregister_notifier() clocksource/drivers/timer-ti-dm: Unregister CPU PM notifier outside of the timer lock * pm-misc: PM: clk: fix typo "sucessfully" in comment * pm-tools: tools: power: pm-graph: fix typo "hierachy" in comment
2026-10-19dax: use READ_ONCE() in dax_holder()Miklos Szeredi
A future fuse patch will utilize dax_holder() in RCU context to make sure that the holder can't be freed by a racing fs_put_dax. This patch just makes sure that dax_holder() works properly in such a context by adding READ_ONCE() (equivalent to rcu_dereference minus sanity checks). Fixing XFS is out of scope for this patchset. Reviewed-by: Gregory Price (Meta) <gourry@gourry.net> Reviewed-by: Dave Jiang <dave.jiang@intel.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2026-10-19dax: add fsdev_dax_from_file()Miklos Szeredi
If the file is a fsdev_dax open, take the dax_dev from the device inode's i_cdev. Return with a reference grabbed on the private dax inode. Make dax_dev_get() static again (internal to super.c for alloc_dax), export fsdev_dax_from_file() instead. This fix is in response to a Sashiko review, and some subsequent analysis. About the 'fixes' tag: this removes the export of dax_dev_get(), which was flawed, and replaces it with fsdev_dax_from_file(). It feels like the fixes tag makes sense for correcting an ABI error. Fixes: 2ae624d5a555d ("dax: export dax_dev_get()") Originally-by: John Groves <john@groves.net> Reviewed-by: Dave Jiang <dave.jiang@intel.com> Reviewed-by: Gregory Price (Meta) <gourry@gourry.net> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2026-10-19Merge branch 'pm-runtime'Rafael J. Wysocki
Merge updates related to runtime PM for 7.4: - Update and improve runtime PM documentation and add a kunit test for supplier idle/suspend (Brian Norris) - Add a pm_runtime_dont_use_autosuspend() call to pm_runtime_reinit() to ensure autosuspend disabling on driver teardown (Joshua Crofts) * pm-runtime: PM: runtime: Expand introduction with core concepts and structure PM: runtime: Clarify driver callback expectations and structure Section 2 PM: runtime: Clarify ->runtime_idle() callback return value handling PM: runtime: Add "Section" hyperlinks PM: runtime: Misc improvements to runtime_pm.rst PM: runtime: More kerneldoc formatting PM: runtime: Correct pm_runtime_autosuspend_expiration() doc PM: runtime: call pm_runtime_dont_use_autosuspend() on reinit() PM: core: Document struct dev_pm_info with kerneldoc PM: runtime: Pull API docs from kerneldoc PM: runtime: kerneldoc wording improvements PM: runtime: Improve set_{status,active,suspended} docs PM: runtime: kerneldoc fixes PM: runtime: Add kunit test for supplier idle/suspend PM: runtime: Only queue an idle check for RPM-linked suppliers