summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2026-02-19Merge tag 'net-7.0-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from Netfilter. Current release - new code bugs: - net: fix backlog_unlock_irq_restore() vs CONFIG_PREEMPT_RT - eth: mlx5e: XSK, Fix unintended ICOSQ change - phy_port: correctly recompute the port's linkmodes - vsock: prevent child netns mode switch from local to global - couple of kconfig fixes for new symbols Previous releases - regressions: - nfc: nci: fix false-positive parameter validation for packet data - net: do not delay zero-copy skbs in skb_attempt_defer_free() Previous releases - always broken: - mctp: ensure our nlmsg responses to user space are zero-initialised - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() - fixes for ICMP rate limiting Misc: - intel: fix PCI device ID conflict between i40e and ipw2200" * tag 'net-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (85 commits) net: nfc: nci: Fix parameter validation for packet data net/mlx5e: Use unsigned for mlx5e_get_max_num_channels net/mlx5e: Fix deadlocks between devlink and netdev instance locks net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event net/mlx5: Fix misidentification of write combining CQE during poll loop net/mlx5e: Fix misidentification of ASO CQE during poll loop net/mlx5: Fix multiport device check over light SFs bonding: alb: fix UAF in rlb_arp_recv during bond up/down bnge: fix reserving resources from FW eth: fbnic: Advertise supported XDP features. rds: tcp: fix uninit-value in __inet_bind net/rds: Fix NULL pointer dereference in rds_tcp_accept_one octeontx2-af: Fix default entries mcam entry action net/mlx5e: XSK, Fix unintended ICOSQ change ipv6: icmp: icmpv6_xrlim_allow() optimization if net.ipv6.icmp.ratelimit is zero ipv4: icmp: icmpv4_xrlim_allow() optimization if net.ipv4.icmp_ratelimit is zero ipv6: icmp: remove obsolete code in icmpv6_xrlim_allow() inet: move icmp_global_{credit,stamp} to a separate cache line icmp: prevent possible overflow in icmp_global_allow() selftests/net: packetdrill: add ipv4-mapped-ipv6 tests ...
2026-02-19net/mlx5e: Use unsigned for mlx5e_get_max_num_channelsCosmin Ratiu
The max number of channels is always an unsigned int, use the correct type to fix compilation errors done with strict type checking, e.g.: error: call to ‘__compiletime_assert_1110’ declared with attribute error: min(mlx5e_get_devlink_param_num_doorbells(mdev), mlx5e_get_max_num_channels(mdev)) signedness error Fixes: 74a8dadac17e ("net/mlx5e: Preparations for supporting larger number of channels") Signed-off-by: Cosmin Ratiu <cratiu@nvidia.com> Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Reviewed-by: Jacob Keller <Jacob.e.keller@intel.com> Link: https://patch.msgid.link/20260218072904.1764634-7-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-19net/mlx5e: Fix deadlocks between devlink and netdev instance locksCosmin Ratiu
In the mentioned "Fixes" commit, various work tasks triggering devlink health reporter recovery were switched to use netdev_trylock to protect against concurrent tear down of the channels being recovered. But this had the side effect of introducing potential deadlocks because of incorrect lock ordering. The correct lock order is described by the init flow: probe_one -> mlx5_init_one (acquires devlink lock) -> mlx5_init_one_devl_locked -> mlx5_register_device -> mlx5_rescan_drivers_locked -...-> mlx5e_probe -> _mlx5e_probe -> register_netdev (acquires rtnl lock) -> register_netdevice (acquires netdev lock) => devlink lock -> rtnl lock -> netdev lock. But in the current recovery flow, the order is wrong: mlx5e_tx_err_cqe_work (acquires netdev lock) -> mlx5e_reporter_tx_err_cqe -> mlx5e_health_report -> devlink_health_report (acquires devlink lock => boom!) -> devlink_health_reporter_recover -> mlx5e_tx_reporter_recover -> mlx5e_tx_reporter_recover_from_ctx -> mlx5e_tx_reporter_err_cqe_recover The same pattern exists in: mlx5e_reporter_rx_timeout mlx5e_reporter_tx_ptpsq_unhealthy mlx5e_reporter_tx_timeout Fix these by moving the netdev_trylock calls from the work handlers lower in the call stack, in the respective recovery functions, where they are actually necessary. Fixes: 8f7b00307bf1 ("net/mlx5e: Convert mlx5 netdevs to instance locking") Signed-off-by: Cosmin Ratiu <cratiu@nvidia.com> Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Reviewed-by: Jacob Keller <Jacob.e.keller@intel.com> Link: https://patch.msgid.link/20260218072904.1764634-6-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-19net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_eventGal Pressman
The macsec_aso_set_arm_event function calls mlx5_aso_poll_cq once without a retry loop. If the CQE is not immediately available after posting the WQE, the function fails unnecessarily. Use read_poll_timeout() to poll 3-10 usecs for CQE, consistent with other ASO polling code paths in the driver. Fixes: 739cfa34518e ("net/mlx5: Make ASO poll CQ usable in atomic context") Signed-off-by: Gal Pressman <gal@nvidia.com> Reviewed-by: Jianbo Liu <jianbol@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Reviewed-by: Jacob Keller <Jacob.e.keller@intel.com> Link: https://patch.msgid.link/20260218072904.1764634-5-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-19net/mlx5: Fix misidentification of write combining CQE during poll loopGal Pressman
The write combining completion poll loop uses usleep_range() which can sleep much longer than requested due to scheduler latency. Under load, we witnessed a 20ms+ delay until the process was rescheduled, causing the jiffies based timeout to expire while the thread is sleeping. The original do-while loop structure (poll, sleep, check timeout) would exit without a final poll when waking after timeout, missing a CQE that arrived during sleep. Instead of the open-coded while loop, use the kernel's poll_timeout_us() which always performs an additional check after the sleep expiration, and is less error-prone. Note: poll_timeout_us() doesn't accept a sleep range, by passing 10 sleep_us the sleep range effectively changes from 2-10 to 3-10 usecs. Fixes: d98995b4bf98 ("net/mlx5: Reimplement write combining test") Signed-off-by: Gal Pressman <gal@nvidia.com> Reviewed-by: Jianbo Liu <jianbol@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Reviewed-by: Jacob Keller <Jacob.e.keller@intel.com> Link: https://patch.msgid.link/20260218072904.1764634-4-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-19net/mlx5e: Fix misidentification of ASO CQE during poll loopGal Pressman
The ASO completion poll loop uses usleep_range() which can sleep much longer than requested due to scheduler latency. Under load, we witnessed a 20ms+ delay until the process was rescheduled, causing the jiffies based timeout to expire while the thread is sleeping. The original do-while loop structure (poll, sleep, check timeout) would exit without a final poll when waking after timeout, missing a CQE that arrived during sleep. Instead of the open-coded while loop, use the kernel's read_poll_timeout() which always performs an additional check after the sleep expiration, and is less error-prone. Note: read_poll_timeout() doesn't accept a sleep range, by passing 10 sleep_us the sleep range effectively changes from 2-10 to 3-10 usecs. Fixes: 739cfa34518e ("net/mlx5: Make ASO poll CQ usable in atomic context") Fixes: 7e3fce82d945 ("net/mlx5e: Overcome slow response for first macsec ASO WQE") Signed-off-by: Gal Pressman <gal@nvidia.com> Reviewed-by: Jianbo Liu <jianbol@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Reviewed-by: Jacob Keller <Jacob.e.keller@intel.com> Link: https://patch.msgid.link/20260218072904.1764634-3-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-19bonding: alb: fix UAF in rlb_arp_recv during bond up/downHangbin Liu
The ALB RX path may access rx_hashtbl concurrently with bond teardown. During rapid bond up/down cycles, rlb_deinitialize() frees rx_hashtbl while RX handlers are still running, leading to a null pointer dereference detected by KASAN. However, the root cause is that rlb_arp_recv() can still be accessed after setting recv_probe to NULL, which is actually a use-after-free (UAF) issue. That is the reason for using the referenced commit in the Fixes tag. [ 214.174138] Oops: general protection fault, probably for non-canonical address 0xdffffc000000001d: 0000 [#1] SMP KASAN PTI [ 214.186478] KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef] [ 214.194933] CPU: 30 UID: 0 PID: 2375 Comm: ping Kdump: loaded Not tainted 6.19.0-rc8+ #2 PREEMPT(voluntary) [ 214.205907] Hardware name: Dell Inc. PowerEdge R730/0WCJNT, BIOS 2.14.0 01/14/2022 [ 214.214357] RIP: 0010:rlb_arp_recv+0x505/0xab0 [bonding] [ 214.220320] Code: 0f 85 2b 05 00 00 48 b8 00 00 00 00 00 fc ff df 40 0f b6 ed 48 c1 e5 06 49 03 ad 78 01 00 00 48 8d 7d 28 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 06 0f 8e 12 05 00 00 80 7d 28 00 0f 84 8c 00 [ 214.241280] RSP: 0018:ffffc900073d8870 EFLAGS: 00010206 [ 214.247116] RAX: dffffc0000000000 RBX: ffff888168556822 RCX: ffff88816855681e [ 214.255082] RDX: 000000000000001d RSI: dffffc0000000000 RDI: 00000000000000e8 [ 214.263048] RBP: 00000000000000c0 R08: 0000000000000002 R09: ffffed11192021c8 [ 214.271013] R10: ffff8888c9010e43 R11: 0000000000000001 R12: 1ffff92000e7b119 [ 214.278978] R13: ffff8888c9010e00 R14: ffff888168556822 R15: ffff888168556810 [ 214.286943] FS: 00007f85d2d9cb80(0000) GS:ffff88886ccb3000(0000) knlGS:0000000000000000 [ 214.295966] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 214.302380] CR2: 00007f0d047b5e34 CR3: 00000008a1c2e002 CR4: 00000000001726f0 [ 214.310347] Call Trace: [ 214.313070] <IRQ> [ 214.315318] ? __pfx_rlb_arp_recv+0x10/0x10 [bonding] [ 214.320975] bond_handle_frame+0x166/0xb60 [bonding] [ 214.326537] ? __pfx_bond_handle_frame+0x10/0x10 [bonding] [ 214.332680] __netif_receive_skb_core.constprop.0+0x576/0x2710 [ 214.339199] ? __pfx_arp_process+0x10/0x10 [ 214.343775] ? sched_balance_find_src_group+0x98/0x630 [ 214.349513] ? __pfx___netif_receive_skb_core.constprop.0+0x10/0x10 [ 214.356513] ? arp_rcv+0x307/0x690 [ 214.360311] ? __pfx_arp_rcv+0x10/0x10 [ 214.364499] ? __lock_acquire+0x58c/0xbd0 [ 214.368975] __netif_receive_skb_one_core+0xae/0x1b0 [ 214.374518] ? __pfx___netif_receive_skb_one_core+0x10/0x10 [ 214.380743] ? lock_acquire+0x10b/0x140 [ 214.385026] process_backlog+0x3f1/0x13a0 [ 214.389502] ? process_backlog+0x3aa/0x13a0 [ 214.394174] __napi_poll.constprop.0+0x9f/0x370 [ 214.399233] net_rx_action+0x8c1/0xe60 [ 214.403423] ? __pfx_net_rx_action+0x10/0x10 [ 214.408193] ? lock_acquire.part.0+0xbd/0x260 [ 214.413058] ? sched_clock_cpu+0x6c/0x540 [ 214.417540] ? mark_held_locks+0x40/0x70 [ 214.421920] handle_softirqs+0x1fd/0x860 [ 214.426302] ? __pfx_handle_softirqs+0x10/0x10 [ 214.431264] ? __neigh_event_send+0x2d6/0xf50 [ 214.436131] do_softirq+0xb1/0xf0 [ 214.439830] </IRQ> The issue is reproducible by repeatedly running ip link set bond0 up/down while receiving ARP messages, where rlb_arp_recv() can race with rlb_deinitialize() and dereference a freed rx_hashtbl entry. Fix this by setting recv_probe to NULL and then calling synchronize_net() to wait for any concurrent RX processing to finish. This ensures that no RX handler can access rx_hashtbl after it is freed in bond_alb_deinitialize(). Reported-by: Liang Li <liali@redhat.com> Fixes: 3aba891dde38 ("bonding: move processing of recv handlers into handle_frame()") Reviewed-by: Nikolay Aleksandrov <nikolay@nvidia.com> Acked-by: Jay Vosburgh <jv@jvosburgh.net> Signed-off-by: Hangbin Liu <liuhangbin@gmail.com> Link: https://patch.msgid.link/20260218060919.101574-1-liuhangbin@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-19bnge: fix reserving resources from FWVikas Gupta
HWRM_FUNC_CFG is used to reserve resources, whereas HWRM_FUNC_QCFG is intended for querying resource information from the firmware. Since __bnge_hwrm_reserve_pf_rings() reserves resources for a specific PF, the command type should be HWRM_FUNC_CFG. Fixes: 627c67f038d2 ("bng_en: Add resource management support") Signed-off-by: Vikas Gupta <vikas.gupta@broadcom.com> Reviewed-by: Bhargava Chenna Marreddy <bhargava.marreddy@broadcom.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260218052755.4097468-1-vikas.gupta@broadcom.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-19eth: fbnic: Advertise supported XDP features.Dimitri Daskalakis
Drivers are supposed to advertise the XDP features they support. This was missed while adding XDP support. Before: $ ynl --family netdev --dump dev-get ... {'ifindex': 3, 'xdp-features': set(), 'xdp-rx-metadata-features': set(), 'xsk-features': set()}, ... After: $ ynl --family netdev --dump dev-get ... {'ifindex': 3, 'xdp-features': {'basic', 'rx-sg'}, 'xdp-rx-metadata-features': set(), 'xsk-features': set()}, ... Fixes: 168deb7b31b2 ("eth: fbnic: Add support for XDP_TX action") Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Dimitri Daskalakis <dimitri.daskalakis1@gmail.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260218030620.3329608-1-dimitri.daskalakis1@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-18Merge tag 'mm-stable-2026-02-18-19-48' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull more MM updates from Andrew Morton: - "mm/vmscan: fix demotion targets checks in reclaim/demotion" fixes a couple of issues in the demotion code - pages were failed demotion and were finding themselves demoted into disallowed nodes (Bing Jiao) - "Remove XA_ZERO from error recovery of dup_mmap()" fixes a rare mapledtree race and performs a number of cleanups (Liam Howlett) - "mm: add bitmap VMA flag helpers and convert all mmap_prepare to use them" implements a lot of cleanups following on from the conversion of the VMA flags into a bitmap (Lorenzo Stoakes) - "support batch checking of references and unmapping for large folios" implements batching to greatly improve the performance of reclaiming clean file-backed large folios (Baolin Wang) - "selftests/mm: add memory failure selftests" does as claimed (Miaohe Lin) * tag 'mm-stable-2026-02-18-19-48' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (36 commits) mm/page_alloc: clear page->private in free_pages_prepare() selftests/mm: add memory failure dirty pagecache test selftests/mm: add memory failure clean pagecache test selftests/mm: add memory failure anonymous page test mm: rmap: support batched unmapping for file large folios arm64: mm: implement the architecture-specific clear_flush_young_ptes() arm64: mm: support batch clearing of the young flag for large folios arm64: mm: factor out the address and ptep alignment into a new helper mm: rmap: support batched checks of the references for large folios tools/testing/vma: add VMA userland tests for VMA flag functions tools/testing/vma: separate out vma_internal.h into logical headers tools/testing/vma: separate VMA userland tests into separate files mm: make vm_area_desc utilise vma_flags_t only mm: update all remaining mmap_prepare users to use vma_flags_t mm: update shmem_[kernel]_file_*() functions to use vma_flags_t mm: update secretmem to use VMA flags on mmap_prepare mm: update hugetlbfs to use VMA flags on mmap_prepare mm: add basic VMA flag operation helper functions tools: bitmap: add missing bitmap_[subset(), andnot()] mm: add mk_vma_flags() bitmap flag macro helper ...
2026-02-18octeontx2-af: Fix default entries mcam entry actionHariprasad Kelam
As per design, AF should update the default MCAM action only when mcam_index is -1. A bug in the previous patch caused default entries to be changed even when the request was not for them. Fixes: 570ba37898ec ("octeontx2-af: Update RSS algorithm index") Signed-off-by: Hariprasad Kelam <hkelam@marvell.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260216090338.1318976-1-hkelam@marvell.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-18net/mlx5e: XSK, Fix unintended ICOSQ changeTariq Toukan
XSK wakeup must use the async ICOSQ (with proper locking), as it is not guaranteed to run on the same CPU as the channel. The commit that converted the NAPI trigger path to use the sync ICOSQ incorrectly applied the same change to XSK, causing XSK wakeups to use the sync ICOSQ as well. Revert XSK flows to use the async ICOSQ. XDP program attach/detach triggers channel reopen, while XSK pool enable/disable can happen on-the-fly via NDOs without reopening channels. As a result, xsk_pool state cannot be reliably used at mlx5e_open_channel() time to decide whether an async ICOSQ is needed. Update the async_icosq_needed logic to depend on the presence of an XDP program rather than the xsk_pool, ensuring the async ICOSQ is available when XSK wakeups are enabled. This fixes multiple issues: 1. Illegal synchronize_rcu() in an RCU read- side critical section via mlx5e_xsk_wakeup() -> mlx5e_trigger_napi_icosq() -> synchronize_net(). The stack holds RCU read-lock in xsk_poll(). 2. Hitting a NULL pointer dereference in mlx5e_xsk_wakeup(): [] BUG: kernel NULL pointer dereference, address: 0000000000000240 [] #PF: supervisor read access in kernel mode [] #PF: error_code(0x0000) - not-present page [] PGD 0 P4D 0 [] Oops: Oops: 0000 [#1] SMP [] CPU: 0 UID: 0 PID: 2255 Comm: qemu-system-x86 Not tainted 6.19.0-rc5+ #229 PREEMPT(none) [] Hardware name: [...] [] RIP: 0010:mlx5e_xsk_wakeup+0x53/0x90 [mlx5_core] Reported-by: Daniel Borkmann <daniel@iogearbox.net> Closes: https://lore.kernel.org/all/20260123223916.361295-1-daniel@iogearbox.net/ Fixes: 56aca3e0f730 ("net/mlx5e: Use regular ICOSQ for triggering NAPI") Tested-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com> Acked-by: Alice Mikityanska <alice.kernel@fastmail.im> Link: https://patch.msgid.link/20260217074525.1761454-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-18Merge tag 'thermal-7.0-rc1-2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull thermal control fix from Rafael Wysocki: "This fixes a sysfs group leak on DLVR registration failure in the Intel int340x thermal driver (Kaushlendra Kumar)" * tag 'thermal-7.0-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: thermal: int340x: Fix sysfs group leak on DLVR registration failure
2026-02-18Merge tag 'acpi-7.0-rc1-2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull more ACPI support updates from Rafael J. Wysocki: "These are mostly fixes and cleanups on top of the ACPI support updates merged recently, including two new quirks, an ACPI CPPC library fix, and fixes and cleanups of a few core ACPI device drivers: - Add an unused power resource handling quirk for THUNDEROBOT ZERO (Zhai Can) - Fix remaining for_each_possible_cpu() in the ACPI CPPC library to use online CPUs (Sean V Kelley) - Drop redundant checks from the ACPI notify handler and the driver remove callback in the ACPI battery driver (Rafael Wysocki) - Move the creation of the wakeup source during the ACPI button driver probe to an earlier point to avoid missing a wakeup event due to a race and clean up system wakeup handling and remove callback in that driver (Rafael Wysocki) - Drop unnecessary driver_data pointer clearing from the ACPI EC and SMBUS HC drivers and make the ACPI backlight (video) driver clear the device's driver_data pointer on remove (Rafael Wysocki) - Force enabling of PWM2 on the Yogabook YB1-X90 tablets (Yauhen Kharuzhy)" * tag 'acpi-7.0-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO ACPI: driver: Drop driver_data pointer clearing from two drivers ACPI: video: Clear driver_data pointer on remove ACPI: button: Tweak acpi_button_remove() ACPI: button: Tweak system wakeup handling ACPI: battery: Drop redundant checks from acpi_battery_remove() ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 ACPI: button: Call device_init_wakeup() earlier during probe ACPI: battery: Drop redundant check from acpi_battery_notify()
2026-02-18Merge tag 'pm-7.0-rc1-2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull more power management updates from Rafael Wysocki: "These are mostly fixes on top of the power management updates merged recently in cpuidle governors, in the Intel RAPL power capping driver and in the wake IRQ management code: - Fix the handling of package-scope MSRs in the intel_rapl power capping driver when called from the PMU subsystem and make it add all package CPUs to the PMU cpumask to allow tools to read RAPL events from any CPU in the package (Kuppuswamy Satharayananyan) - Rework the invalid version check in the intel_rapl_tpmi power capping driver to account for the fact that on partitioned systems, multiple TPMI instances may exist per package, but RAPL registers are only valid on one instance (Kuppuswamy Satharayananyan) - Describe the new intel_idle.table command line option in the admin-guide intel_idle documentation (Artem Bityutskiy) - Fix a crash in the ladder cpuidle governor on systems with only one (polling) idle state available by making the cpuidle core bypass the governor in those cases and adjust the other existing governors to that change (Aboorva Devarajan, Christian Loehle) - Update kerneldoc comments for wake IRQ management functions that have not been matching the code (Wang Jiayue)" * tag 'pm-7.0-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpuidle: menu: Remove single state handling cpuidle: teo: Remove single state handling cpuidle: haltpoll: Remove single state handling cpuidle: Skip governor when only one idle state is available powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check PM: sleep: wakeirq: Update outdated documentation comments Documentation: PM: Document intel_idle.table command line option powercap: intel_rapl: Expose all package CPUs in PMU cpumask powercap: intel_rapl: Remove incorrect CPU check in PMU context
2026-02-18Merge branches 'acpi-battery', 'acpi-button' and 'acpi-driver'Rafael J. Wysocki
Merge additional updates of multiple core ACPI device drivers (battery, button, video, EC, SMBUS HC) for 7.0-rc1: - Drop redundant checks from the ACPI notify handler and the driver remove callback in the ACPI battery driver (Rafael Wysocki) - Move the creation of the wakeup source during the ACPI button driver probe to an earlier point to avoid missing a wakeup event due to a race and clean up system wakeup handling and remove callback in that driver (Rafael Wysocki) - Drop unnecessary driver_data pointer clearing from the ACPI EC and SMBUS HC drivers and make the ACPI backlight (video) driver clear the device's driver_data pointer on remove (Rafael Wysocki) * acpi-battery: ACPI: battery: Drop redundant checks from acpi_battery_remove() ACPI: battery: Drop redundant check from acpi_battery_notify() * acpi-button: ACPI: button: Tweak acpi_button_remove() ACPI: button: Tweak system wakeup handling ACPI: button: Call device_init_wakeup() earlier during probe * acpi-driver: ACPI: driver: Drop driver_data pointer clearing from two drivers ACPI: video: Clear driver_data pointer on remove
2026-02-18Merge branches 'acpi-pm' and 'acpi-cppc'Rafael J. Wysocki
Merge an ACPI power management update and an ACPI CPPC library update for 7.0-rc1: - Add an unused power resource handling quirk for THUNDEROBOT ZERO (Zhai Can) - Fix remaining for_each_possible_cpu() in the ACPI CPPC library to use online CPUs (Sean V Kelley) * acpi-pm: ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO * acpi-cppc: ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs
2026-02-18Merge branches 'pm-powercap' and 'pm-cpuidle'Rafael J. Wysocki
Merge additional power capping and cpuidle updates for 7.0-rc1: - Fix the handling of package-scope MSRs in the intel_rapl power capping driver when called from the PMU subsystem and make it add all package CPUs to the PMU cpumask to allow tools to read RAPL events from any CPU in the package (Kuppuswamy Sathyanarayanan) - Rework the invalid version check in the intel_rapl_tpmi power capping driver to account for the fact that on partitioned systems, multiple TPMI instances may exist per package, but RAPL registers are only valid on one instance (Kuppuswamy Satharayananyan) - Describe the new intel_idle.table command line option in the admin-guide intel_idle documentation (Artem Bityutskiy) - Fix a crash in the ladder cpuidle governor on systems with only one (polling) idle state available by making the cpuidle core bypass the governor in those cases and adjust the other existing governors to that change (Aboorva Devarajan, Christian Loehle) * pm-powercap: powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check powercap: intel_rapl: Expose all package CPUs in PMU cpumask powercap: intel_rapl: Remove incorrect CPU check in PMU context * pm-cpuidle: cpuidle: menu: Remove single state handling cpuidle: teo: Remove single state handling cpuidle: haltpoll: Remove single state handling cpuidle: Skip governor when only one idle state is available Documentation: PM: Document intel_idle.table command line option
2026-02-18eth: fbnic: Add validation for MTU changesDimitri Daskalakis
Increasing the MTU beyond the HDS threshold causes the hardware to fragment packets across multiple buffers. If a single-buffer XDP program is attached, the driver will drop all multi-frag frames. While we can't prevent a remote sender from sending non-TCP packets larger than the MTU, this will prevent users from inadvertently breaking new TCP streams. Traditionally, drivers supported XDP with MTU less than 4Kb (packet per page). Fbnic currently prevents attaching XDP when MTU is too high. But it does not prevent increasing MTU after XDP is attached. Fixes: 1b0a3950dbd4 ("eth: fbnic: Add XDP pass, drop, abort support") Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Dimitri Daskalakis <dimitri.daskalakis1@gmail.com> Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2026-02-17net: ethernet: ec_bhf: Fix dma_free_coherent() dma handleThomas Fourier
dma_free_coherent() in error path takes priv->rx_buf.alloc_len as the dma handle. This would lead to improper unmapping of the buffer. Change the dma handle to priv->rx_buf.alloc_phys. Fixes: 6af55ff52b02 ("Driver for Beckhoff CX5020 EtherCAT master module.") Cc: <stable@vger.kernel.org> Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com> Link: https://patch.msgid.link/20260213164340.77272-2-fourier.thomas@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-17macvlan: observe an RCU grace period in macvlan_common_newlink() error pathEric Dumazet
valis reported that a race condition still happens after my prior patch. macvlan_common_newlink() might have made @dev visible before detecting an error, and its caller will directly call free_netdev(dev). We must respect an RCU period, either in macvlan or the core networking stack. After adding a temporary mdelay(1000) in macvlan_forward_source_one() to open the race window, valis repro was: ip link add p1 type veth peer p2 ip link set address 00:00:00:00:00:20 dev p1 ip link set up dev p1 ip link set up dev p2 ip link add mv0 link p2 type macvlan mode source (ip link add invalid% link p2 type macvlan mode source macaddr add 00:00:00:00:00:20 &) ; sleep 0.5 ; ping -c1 -I p1 1.2.3.4 PING 1.2.3.4 (1.2.3.4): 56 data bytes RTNETLINK answers: Invalid argument BUG: KASAN: slab-use-after-free in macvlan_forward_source (drivers/net/macvlan.c:408 drivers/net/macvlan.c:444) Read of size 8 at addr ffff888016bb89c0 by task e/175 CPU: 1 UID: 1000 PID: 175 Comm: e Not tainted 6.19.0-rc8+ #33 NONE Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 Call Trace: <IRQ> dump_stack_lvl (lib/dump_stack.c:123) print_report (mm/kasan/report.c:379 mm/kasan/report.c:482) ? macvlan_forward_source (drivers/net/macvlan.c:408 drivers/net/macvlan.c:444) kasan_report (mm/kasan/report.c:597) ? macvlan_forward_source (drivers/net/macvlan.c:408 drivers/net/macvlan.c:444) macvlan_forward_source (drivers/net/macvlan.c:408 drivers/net/macvlan.c:444) ? tasklet_init (kernel/softirq.c:983) macvlan_handle_frame (drivers/net/macvlan.c:501) Allocated by task 169: kasan_save_stack (mm/kasan/common.c:58) kasan_save_track (./arch/x86/include/asm/current.h:25 mm/kasan/common.c:70 mm/kasan/common.c:79) __kasan_kmalloc (mm/kasan/common.c:419) __kvmalloc_node_noprof (./include/linux/kasan.h:263 mm/slub.c:5657 mm/slub.c:7140) alloc_netdev_mqs (net/core/dev.c:12012) rtnl_create_link (net/core/rtnetlink.c:3648) rtnl_newlink (net/core/rtnetlink.c:3830 net/core/rtnetlink.c:3957 net/core/rtnetlink.c:4072) rtnetlink_rcv_msg (net/core/rtnetlink.c:6958) netlink_rcv_skb (net/netlink/af_netlink.c:2550) netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344) netlink_sendmsg (net/netlink/af_netlink.c:1894) __sys_sendto (net/socket.c:727 net/socket.c:742 net/socket.c:2206) __x64_sys_sendto (net/socket.c:2209) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:131) Freed by task 169: kasan_save_stack (mm/kasan/common.c:58) kasan_save_track (./arch/x86/include/asm/current.h:25 mm/kasan/common.c:70 mm/kasan/common.c:79) kasan_save_free_info (mm/kasan/generic.c:587) __kasan_slab_free (mm/kasan/common.c:287) kfree (mm/slub.c:6674 mm/slub.c:6882) rtnl_newlink (net/core/rtnetlink.c:3845 net/core/rtnetlink.c:3957 net/core/rtnetlink.c:4072) rtnetlink_rcv_msg (net/core/rtnetlink.c:6958) netlink_rcv_skb (net/netlink/af_netlink.c:2550) netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344) netlink_sendmsg (net/netlink/af_netlink.c:1894) __sys_sendto (net/socket.c:727 net/socket.c:742 net/socket.c:2206) __x64_sys_sendto (net/socket.c:2209) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:131) Fixes: f8db6475a836 ("macvlan: fix error recovery in macvlan_common_newlink()") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: valis <sec@valis.email> Link: https://patch.msgid.link/20260213142557.3059043-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-17net: dsa: MxL862xx: don't force-enable MAXLINEAR_GPHYArnd Bergmann
The newly added dsa driver attempts to enable the corresponding PHY driver, but that one has additional dependencies that may not be available: WARNING: unmet direct dependencies detected for MAXLINEAR_GPHY Depends on [m]: NETDEVICES [=y] && PHYLIB [=y] && (HWMON [=m] || HWMON [=m]=n [=n]) Selected by [y]: - NET_DSA_MXL862 [=y] && NETDEVICES [=y] && NET_DSA [=y] aarch64-linux-ld: drivers/net/phy/mxl-gpy.o: in function `gpy_probe': mxl-gpy.c:(.text.gpy_probe+0x13c): undefined reference to `devm_hwmon_device_register_with_info' aarch64-linux-ld: drivers/net/phy/mxl-gpy.o: in function `gpy_hwmon_read': mxl-gpy.c:(.text.gpy_hwmon_read+0x48): undefined reference to `polynomial_calc' There is actually no compile-time dependency, as DSA correctly uses the PHY abstractions. Remove the 'select' statement to reduce the complexity. Fixes: 23794bec1cb6 ("net: dsa: add basic initial driver for MxL862xx switches") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Reviewed-by: Daniel Golle <daniel@makrotopia.org> Link: https://patch.msgid.link/20260216105522.2382373-1-arnd@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-17dpll: zl3073x: Fix ref frequency settingIvan Vecera
The frequency for an input reference is computed as: frequency = freq_base * freq_mult * freq_ratio_m / freq_ratio_n Before commit 5bc02b190a3fb ("dpll: zl3073x: Cache all reference properties in zl3073x_ref"), zl3073x_dpll_input_pin_frequency_set() explicitly wrote 1 to both the REF_RATIO_M and REF_RATIO_N hardware registers whenever a new frequency was set. This ensured the FEC ratio was always reset to 1:1 alongside the new base/multiplier values. The refactoring in that commit introduced zl3073x_ref_freq_set() to update the cached ref state, but this helper only sets freq_base and freq_mult without resetting freq_ratio_m and freq_ratio_n to 1. Because zl3073x_ref_state_set() uses a compare-and-write strategy, unchanged ratio fields are never written to the hardware. If the device previously had non-unity FEC ratio values, they remain in effect after a frequency change, resulting in an incorrect computed frequency. Explicitly set freq_ratio_m and freq_ratio_n to 1 in zl3073x_ref_freq_set() to restore the original behavior. Fixes: 5bc02b190a3fb ("dpll: zl3073x: Cache all reference properties in zl3073x_ref") Signed-off-by: Ivan Vecera <ivecera@redhat.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260216194007.680416-1-ivecera@redhat.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-17Merge tag 'dmaengine-7.0-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine Pull dmaengine updates from Vinod Koul: "Core: - Add Frank Li as susbstem reviewer to help with reviews New Support: - Mediatek support for Dimensity 6300 and 9200 controller - Qualcomm Kaanapali and Glymur GPI DMA engine - Synopsis DW AXI Agilex5 - Renesas RZ/V2N SoC - Atmel microchip lan9691-dma - Tegra ADMA tegra264 Updates: - sg_nents_for_dma() helper use in subsystem - pm_runtime_mark_last_busy() redundant call update for subsystem - Residue support for xilinx AXIDMA driver - Intel Max SGL Size Support and capabilities for DSA3.0 - AXI dma larger than 32bits address support" * tag 'dmaengine-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: (64 commits) dmaengine: add Frank Li as reviewer dt-bindings: dma: qcom,gpi: Update max interrupts lines to 16 dmaengine: fsl-edma: don't explicitly disable clocks in .remove() dmaengine: xilinx: xdma: use sg_nents_for_dma() helper dmaengine: sh: use sg_nents_for_dma() helper dmaengine: sa11x0: use sg_nents_for_dma() helper dmaengine: qcom: bam_dma: use sg_nents_for_dma() helper dmaengine: qcom: adm: use sg_nents_for_dma() helper dmaengine: pxa-dma: use sg_nents_for_dma() helper dmaengine: lgm: use sg_nents_for_dma() helper dmaengine: k3dma: use sg_nents_for_dma() helper dmaengine: dw-axi-dmac: use sg_nents_for_dma() helper dmaengine: bcm2835-dma: use sg_nents_for_dma() helper dmaengine: axi-dmac: use sg_nents_for_dma() helper dmaengine: altera-msgdma: use sg_nents_for_dma() helper scatterlist: introduce sg_nents_for_dma() helper dmaengine: idxd: Add Max SGL Size Support for DSA3.0 dmaengine: idxd: Expose DSA3.0 capabilities through sysfs dmaengine: sh: rz-dmac: Make channel irq local dmaengine: pl08x: Fix comment stating the difference between PL080 and PL081 ...
2026-02-17Merge tag 'phy-for-7.0' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy Pull phy updates from Vinod Koul: "Core: - Add suuport for "rx-polarity" and "tx-polarity" device tree properties and phy common properties to manage this New Support: - Qualcomm Glymur PCIe Gen4 2-lanes PCIe phy, DP and edp phy, USB UNI PHY and SMB2370 eUSB2 repeater. SC8280xp QMP UFS PHY, Kaanapali PCIe phy and QMP PHY, QCS615 QMP USB3+DP PHY and driver support for that. - SpacemiT PCIe/combo PHY and K1 USB2 PHY driver. - HDMI 2.1 FRL configuration support and driver enabling for rockchip samsung-hdptx driver - TI TCAN1046 phy - Renesas RZ/V2H(P) and RZ/V2N usb3 - Mediatek MT8188 hdmi-phy - Google Tensor SoC USB PHY driver - Apple Type-C PHY Updates: - Subsystem conversion for clock round_rate() to determine_rate() - TI USB3 DT schema conversion - Samsung ExynosAutov920 usb3, combo hsphy and ssphy support" * tag 'phy-for-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: (143 commits) phy: ti: phy-j721e-wiz: convert from divider_round_rate() to divider_determine_rate() dt-bindings: phy: ti,control-phy-otghs: convert to DT schema dt-bindings: phy: ti,phy-usb3: convert to DT schema phy: tegra: xusb: Remove unused powered_on variable phy: renesas: rcar-gen3-usb2: add regulator dependency phy: GOOGLE_USB: add TYPEC dependency phy: enter drivers/phy/Makefile even without CONFIG_GENERIC_PHY phy: renesas: rcar-gen3-usb2: Use mux-state for phyrst management phy: renesas: rcar-gen3-usb2: Add regulator for OTG VBUS control phy: renesas: rcar-gen3-usb2: Use devm_pm_runtime_enable() phy: renesas: rcar-gen3-usb2: Factor out VBUS control logic dt-bindings: phy: renesas,usb2-phy: Document RZ/G3E SoC dt-bindings: phy: renesas,usb2-phy: Document mux-states property dt-bindings: phy: renesas,usb2-phy: Document USB VBUS regulator phy: rockchip: samsung-hdptx: Add HDMI 2.1 FRL support phy: rockchip: samsung-hdptx: Extend rk_hdptx_phy_verify_hdmi_config() helper phy: rockchip: samsung-hdptx: Switch to driver specific HDMI config phy: rockchip: samsung-hdptx: Drop hw_rate driver data phy: rockchip: samsung-hdptx: Compute clk rate from PLL config phy: rockchip: samsung-hdptx: Cleanup *_cmn_init_seq lists ...
2026-02-17Merge tag 'soundwire-7.0-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire Pull soundwire updates from Vinod Koul: - support for Qualcomm v2.2.0 controllers - bus method updates for .probe(), .remove() and .shutdown() and remove function return value updates - Avell B.ON dmi-quirks mapping - mark cs42l45 codec as wake capable * tag 'soundwire-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire: soundwire: intel_ace2x: add SND_HDA_CORE dependency dt-bindings: soundwire: qcom: Add SoundWire v2.2.0 compatible soundwire: Use bus methods for .probe(), .remove() and .shutdown() soundwire: Make remove function return no value soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) soundwire: qcom: Use guard to avoid mixing cleanup and goto soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list
2026-02-17Merge tag 'usb-7.0-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB / Thunderbolt updates from Greg KH: "Here is the "big" set of USB and Thunderbolt driver updates for 7.0-rc1. Overall more lines were removed than added, thanks to dropping the obsolete isp1362 USB host controller driver, always a nice change. Other than that, nothing major happening here, highlights are: - lots of dwc3 driver updates and new hardware support added - usb gadget function driver updates - usb phy driver updates - typec driver updates and additions - USB rust binding updates for syntax and formatting changes - more usb serial device ids added - other smaller USB core and driver updates and additions All of these have been in linux-next for a long time, with no reported problems" * tag 'usb-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (77 commits) usb: typec: ucsi: Add Thunderbolt alternate mode support usb: typec: hd3ss3220: Check if regulator needs to be switched usb: phy: tegra: parametrize PORTSC1 register offset usb: phy: tegra: parametrize HSIC PTS value usb: phy: tegra: return error value from utmi_wait_register usb: phy: tegra: cosmetic fixes dt-bindings: usb: renesas,usbhs: Add RZ/G3E SoC support usb: dwc2: fix resume failure if dr_mode is host usb: cdns3: fix role switching during resume usb: dwc3: gadget: Move vbus draw to workqueue context USB: serial: option: add Telit FN920C04 RNDIS compositions usb: dwc3: Log dwc3 address in traces usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN usb: phy: tegra: add HSIC support usb: phy: tegra: use phy type directly usb: typec: ucsi: Enforce mode selection for cros_ec_ucsi usb: typec: ucsi: Support mode selection to activate altmodes usb: typec: Introduce mode_selection bit usb: typec: Implement mode selection usb: typec: Expose alternate mode priority via sysfs ...
2026-02-17Merge tag 'tty-7.0-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty / serial driver updates from Greg KH: "Here is the small amount of tty and serial driver updates for 7.0-rc1. Nothing major in here at all, just some driver updates and minor tweaks and cleanups including: - sh-sci serial driver updates - 8250 driver updates - attempt to make the tty ports have their own workqueue, but was reverted after testing found it to have problems on some platforms. This will probably come back for 7.1 after it has been reworked and resubmitted - other tiny tty driver changes All of these have been in linux-next for a while with no reported problems" * tag 'tty-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (49 commits) Revert "tty: tty_port: add workqueue to flip TTY buffer" tty: tty_port: add workqueue to flip TTY buffer serial: 8250_pci: Remove custom deprecated baud setting routine serial: 8250_omap: Remove custom deprecated baud setting routine dt-bindings: serial: renesas,scif: Document RZ/G3L SoC serial: 8250: omap: set out-of-band wakeup if wakeup pinctrl exists tty: hvc-iucv: Remove KMSG_COMPONENT macro dt-bindings: serial: google,goldfish-tty: Convert to DT schema dt-bindings: serial: sh-sci: Fold single-entry compatibles into enum serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done serial: 8250: 8250_omap.c: Add support for handling UART error conditions serial: SH_SCI: improve "DMA support" prompt serial: Kconfig: fix ordering of entries for menu display serial: 8250: fix ordering of entries for menu display serial: imx: change SERIAL_IMX_CONSOLE to bool 8250_men_mcb: drop unneeded MODULE_ALIAS serial: men_z135_uart: drop unneeded MODULE_ALIAS dt-bindings: serial: renesas,rsci: Document RZ/V2H(P) and RZ/V2N SoCs serial: rsci: Convert to FIELD_MODIFY() dt-bindings: serial: 8250: add SpacemiT K3 UART compatible ...
2026-02-17Merge tag 'staging-7.0-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver updates from Greg KH: "Here is the big set of staging driver updates for 7.0-rc1. Well, not that big, just lots of tiny coding style cleanups primarily in one driver as everyone seems to have glomed onto it for some reason that escapes me (is there a tutorial out there somewhere pointing people at this?) Not much overall, the changes can be summarized as: - cleanups for the rtl8723bs driver, so many cleanups... - vme_user driver cleanups - sm750fb driver cleanups - tiny greybus driver cleanups - other really small staging driver cleanups All of these have been in linux-next for a while with no reported issues" * tag 'staging-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (119 commits) staging: rtl8723bs: refactor ODM_SetIQCbyRFpath to reduce duplication staging: rtl8723bs: rename CamelCase function Set_MSR to set_msr staging: rtl8723bs: remove unnecessary blank lines in rtw_io.c staging: rtl8723bs: remove stale TODO item regarding %pM staging: rtl8723bs: remove unused allocation wrapper functions staging: rtl8723bs: use standard skb allocation APIs staging: rtl8723bs: replace rtw_zmalloc() with kzalloc() staging: rtl8723bs: replace rtw_malloc() with kmalloc() staging: rtl8723bs: introduce kmemdup() where applicable staging: sm750fb: Clean up variable names staging: rtl8723bs: fix null dereference in find_network staging: rtl8723bs: use unaligned access macros in rtw_security.c staging: rtl8723bs: fix potential race in expire_timeout_chk staging: rtl8723bs: remove dead debugging code in rtw_mlme_ext.c staging: rtl8723bs: modernize hex output in rtw_report_sec_ie staging: rtl8723bs: fix spacing around operators staging: rtl8723bs: rename u1bTmp to val staging: rtl8723bs: remove unused private debug counters staging: rtl8723bs: remove thread wraper functions and add IS_ERR() check staging: rtl8723bs: fix firmware memory leak on error ...
2026-02-17Merge tag 'char-misc-7.0-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc/IIO driver updates from Greg KH: "Here is the big set of char/misc/iio and other smaller driver subsystem changes for 7.0-rc1. Lots of little things in here, including: - Loads of iio driver changes and updates and additions - gpib driver updates - interconnect driver updates - i3c driver updates - hwtracing (coresight and intel) driver updates - deletion of the obsolete mwave driver - binder driver updates (rust and c versions) - mhi driver updates (causing a merge conflict, see below) - mei driver updates - fsi driver updates - eeprom driver updates - lots of other small char and misc driver updates and cleanups All of these have been in linux-next for a while, with no reported issues" * tag 'char-misc-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (297 commits) mux: mmio: fix regmap leak on probe failure rust_binder: return p from rust_binder_transaction_target_node() drivers: android: binder: Update ARef imports from sync::aref rust_binder: fix needless borrow in context.rs iio: magn: mmc5633: Fix Kconfig for combination of I3C as module and driver builtin iio: sca3000: Fix a resource leak in sca3000_probe() iio: proximity: rfd77402: Add interrupt handling support iio: proximity: rfd77402: Document device private data structure iio: proximity: rfd77402: Use devm-managed mutex initialization iio: proximity: rfd77402: Use kernel helper for result polling iio: proximity: rfd77402: Align polling timeout with datasheet iio: cros_ec: Allow enabling/disabling calibration mode iio: frequency: ad9523: correct kernel-doc bad line warning iio: buffer: buffer_impl.h: fix kernel-doc warnings iio: gyro: itg3200: Fix unchecked return value in read_raw MAINTAINERS: add entry for ADE9000 driver iio: accel: sca3000: remove unused last_timestamp field iio: accel: adxl372: remove unused int2_bitmask field iio: adc: ad7766: Use iio_trigger_generic_data_rdy_poll() iio: magnetometer: Remove IRQF_ONESHOT ...
2026-02-17Merge tag 'block-7.0-20260216' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull more block updates from Jens Axboe: - Fix partial IOVA mapping cleanup in error handling - Minor prep series ignoring discard return value, as the inline value is always known - Ensure BLK_FEAT_STABLE_WRITES is set for drbd - Fix leak of folio in bio_iov_iter_bounce_read() - Allow IOC_PR_READ_* for read-only open - Another debugfs deadlock fix - A few doc updates * tag 'block-7.0-20260216' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: blk-mq: use NOIO context to prevent deadlock during debugfs creation blk-stat: convert struct blk_stat_callback to kernel-doc block: fix enum descriptions kernel-doc block: update docs for bio and bvec_iter block: change return type to void nvmet: ignore discard return value md: ignore discard return value block: fix partial IOVA mapping cleanup in blk_rq_dma_map_iova block: fix folio leak in bio_iov_iter_bounce_read() block: allow IOC_PR_READ_* ioctls with BLK_OPEN_READ drbd: always set BLK_FEAT_STABLE_WRITES
2026-02-17cpuidle: menu: Remove single state handlingChristian Loehle
cpuidle systems where the governor has no choice because there's only a single idle state are now handled by cpuidle core and bypass the governor, so remove the related handling. Signed-off-by: Christian Loehle <christian.loehle@arm.com> [ rjw: Rebase on top of the cpuidle changes merged recently ] Link: https://patch.msgid.link/20260216185005.1131593-5-aboorvad@linux.ibm.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-02-17cpuidle: teo: Remove single state handlingChristian Loehle
cpuidle systems where the governor has no choice because there's only a single idle state are now handled by cpuidle core and bypass the governor, so remove the related handling. Signed-off-by: Christian Loehle <christian.loehle@arm.com> Link: https://patch.msgid.link/20260216185005.1131593-4-aboorvad@linux.ibm.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-02-17cpuidle: haltpoll: Remove single state handlingAboorva Devarajan
cpuidle systems where the governor has no choice because there's only a single idle state are now handled by cpuidle core and bypass the governor, so remove the related handling. Signed-off-by: Aboorva Devarajan <aboorvad@linux.ibm.com> Reviewed-by: Christian Loehle <christian.loehle@arm.com> [ rjw: Extended the change to drop a redundant local variable ] Link: https://patch.msgid.link/20260216185005.1131593-3-aboorvad@linux.ibm.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-02-17cpuidle: Skip governor when only one idle state is availableAboorva Devarajan
On certain platforms (PowerNV systems without a power-mgt DT node), cpuidle may register only a single idle state. In cases where that single state is a polling state (state 0), the ladder governor may incorrectly treat state 1 as the first usable state and pass an out-of-bounds index. This can lead to a NULL enter callback being invoked, ultimately resulting in a system crash. [ 13.342636] cpuidle-powernv : Only Snooze is available [ 13.351854] Faulting instruction address: 0x00000000 [ 13.376489] NIP [0000000000000000] 0x0 [ 13.378351] LR [c000000001e01974] cpuidle_enter_state+0x2c4/0x668 Fix this by adding a bail-out in cpuidle_select() that returns state 0 directly when state_count <= 1, bypassing the governor and keeping the tick running. Fixes: dc2251bf98c6 ("cpuidle: Eliminate the CPUIDLE_DRIVER_STATE_START symbol") Signed-off-by: Aboorva Devarajan <aboorvad@linux.ibm.com> Reviewed-by: Christian Loehle <christian.loehle@arm.com> Link: https://patch.msgid.link/20260216185005.1131593-2-aboorvad@linux.ibm.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-02-17printk: add CONFIG_PRINTK dependency for netconsoleArnd Bergmann
The 'select PRINTK_EXECUTION_CTX' line now causes a harmless warning when NETCONSOLE_DYNAMIC is enabled but PRINTK is not: WARNING: unmet direct dependencies detected for PRINTK_EXECUTION_CTX Depends on [n]: PRINTK [=n] Selected by [y]: - NETCONSOLE_DYNAMIC [=y] && NETDEVICES [=y] && NET_CORE [=y] && NETCONSOLE [=y] && SYSFS [=y] && CONFIGFS_FS [=y] && (NETCONSOLE [=y]!=y [=y] || CONFIGFS_FS [=y]!=m [=m]) In that configuration, the netconsole driver is useless anyway, so avoid this with an added dependency that prevents CONFIG_NETCONSOLE to be enabled without CONFIG_PRINTK. Fixes: 60325c27d3cf ("printk: Add execution context (task name/CPU) to printk_info") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260213074431.1729627-1-arnd@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-17net: arcnet: com20020-pci: fix support for 2.5Mbit cardsEthan Nelson-Moore
Commit 8c14f9c70327 ("ARCNET: add com20020 PCI IDs with metadata") converted the com20020-pci driver to use a card info structure instead of a single flag mask in driver_data. However, it failed to take into account that in the original code, driver_data of 0 indicates a card with no special flags, not a card that should not have any card info structure. This introduced a null pointer dereference when cards with no flags were probed. Commit bd6f1fd5d33d ("net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe()") then papered over this issue by rejecting cards with no driver_data instead of resolving the problem at its source. Fix the original issue by introducing a new card info structure for 2.5Mbit cards that does not set any flags and using it if no driver_data is present. Fixes: 8c14f9c70327 ("ARCNET: add com20020 PCI IDs with metadata") Fixes: bd6f1fd5d33d ("net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe()") Cc: stable@vger.kernel.org Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com> Link: https://patch.msgid.link/20260213045510.32368-1-enelsonmoore@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-17xen-netback: reject zero-queue configuration from guestZiyi Guo
A malicious or buggy Xen guest can write "0" to the xenbus key "multi-queue-num-queues". The connect() function in the backend only validates the upper bound (requested_num_queues > xenvif_max_queues) but not zero, allowing requested_num_queues=0 to reach vzalloc(array_size(0, sizeof(struct xenvif_queue))), which triggers WARN_ON_ONCE(!size) in __vmalloc_node_range(). On systems with panic_on_warn=1, this allows a guest-to-host denial of service. The Xen network interface specification requires the queue count to be "greater than zero". Add a zero check to match the validation already present in xen-blkback, which has included this guard since its multi-queue support was added. Fixes: 8d3d53b3e433 ("xen-netback: Add support for multiple queues") Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu> Reviewed-by: Juergen Gross <jgross@suse.com> Link: https://patch.msgid.link/20260212224040.86674-1-n7l8m4@u.northwestern.edu Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-17net: usb: catc: enable basic endpoint checkingZiyi Guo
catc_probe() fills three URBs with hardcoded endpoint pipes without verifying the endpoint descriptors: - usb_sndbulkpipe(usbdev, 1) and usb_rcvbulkpipe(usbdev, 1) for TX/RX - usb_rcvintpipe(usbdev, 2) for interrupt status A malformed USB device can present these endpoints with transfer types that differ from what the driver assumes. Add a catc_usb_ep enum for endpoint numbers, replacing magic constants throughout. Add usb_check_bulk_endpoints() and usb_check_int_endpoints() calls after usb_set_interface() to verify endpoint types before use, rejecting devices with mismatched descriptors at probe time. Similar to - commit 90b7f2961798 ("net: usb: rtl8150: enable basic endpoint checking") which fixed the issue in rtl8150. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Suggested-by: Simon Horman <horms@kernel.org> Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu> Link: https://patch.msgid.link/20260212214154.3609844-1-n7l8m4@u.northwestern.edu Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-17ovpn: tcp - don't deref NULL sk_socket member after tcp_close()Antonio Quartulli
When deleting a peer in case of keepalive expiration, the peer is removed from the OpenVPN hashtable and is temporary inserted in a "release list" for further processing. This happens in: ovpn_peer_keepalive_work() unlock_ovpn(release_list) This processing includes detaching from the socket being used to talk to this peer, by restoring its original proto and socket ops/callbacks. In case of TCP it may happen that, while the peer is sitting in the release list, userspace decides to close the socket. This will result in a concurrent execution of: tcp_close(sk) __tcp_close(sk) sock_orphan(sk) sk_set_socket(sk, NULL) The last function call will set sk->sk_socket to NULL. When the releasing routine is resumed, ovpn_tcp_socket_detach() will attempt to dereference sk->sk_socket to restore its original ops member. This operation will crash due to sk->sk_socket being NULL. Fix this race condition by testing-and-accessing sk->sk_socket atomically under sk->sk_callback_lock. Link: https://lore.kernel.org/netdev/176996279620.3109699.15382994681575380467@eldamar.lan/ Link: https://github.com/OpenVPN/ovpn-net-next/issues/29 Signed-off-by: Antonio Quartulli <antonio@openvpn.net> Fixes: 11851cbd60ea ("ovpn: implement TCP transport") Link: https://patch.msgid.link/20260212213130.11497-1-antonio@openvpn.net Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-17Merge tag 'ovpn-net-20260212' of https://github.com/OpenVPN/ovpn-net-nextPaolo Abeni
Antonio Quartulli says: ==================== This batch includes the following fixes: * set sk_user_data before installing callbacks, to avoid dropping early packets * fix use-after-free in ovpn_net_xmit when accessing shared skbs that got released * fix TX bytes stats by adding-up every positively processed GSO segment ==================== Link: https://patch.msgid.link/20260212210340.11260-1-antonio@openvpn.net Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-17eth: fbnic: set DMA_HINT_L4 for all flowsBobby Eshleman
fbnic always advertises ETHTOOL_TCP_DATA_SPLIT_ENABLED via ethtool .get_ringparam. To enable proper splitting for all flow types, even for IP/Ethernet flows, this patch sets DMA_HINT_L4 unconditionally for all RSS and NFC flow steering rules. According to the spec, L4 falls back to L3 if no valid L4 is found, and L3 falls back to L2 if no L3 is found. This makes sure that the correct header boundary is used regardless of traffic type. This is important for zero-copy use cases where we must ensure that all ZC packets are split correctly. Fixes: 2b30fc01a6c7 ("eth: fbnic: Add support for HDS configuration") Signed-off-by: Bobby Eshleman <bobbyeshleman@meta.com> Link: https://patch.msgid.link/20260211-fbnic-tcp-hds-fixes-v1-3-55d050e6f606@meta.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-17eth: fbnic: increase FBNIC_HDR_BYTES_MIN from 128 to 256 bytesBobby Eshleman
Increase FBNIC_HDR_BYTES_MIN from 128 to 256 bytes. The previous minimum was too small to guarantee that very long L2+L3+L4 headers always fit within the header buffer. When EN_HDR_SPLIT is disabled and a packet exceeds MAX_HEADER_BYTES, splitting occurs at that byte offset instead of the header boundary, resulting in some of the header landing in the payload page. The increased minimum ensures headers always fit with the MAX_HEADER_BYTES cut off and land in the header page. Fixes: 2b30fc01a6c7 ("eth: fbnic: Add support for HDS configuration") Signed-off-by: Bobby Eshleman <bobbyeshleman@meta.com> Acked-by: Mohsin Bashir <mohsin.bashr@gmail.com> Link: https://patch.msgid.link/20260211-fbnic-tcp-hds-fixes-v1-2-55d050e6f606@meta.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-17eth: fbnic: set FBNIC_QUEUE_RDE_CTL0_EN_HDR_SPLIT on RDE_CTL0Bobby Eshleman
Fix EN_HDR_SPLIT configuration by writing the field to RDE_CTL0 instead of RDE_CTL1. Because drop mode configuration and header splitting enablement both use RDE_CTL0, we consolidate these configurations into the single function fbnic_config_drop_mode. Fixes: 2b30fc01a6c7 ("eth: fbnic: Add support for HDS configuration") Signed-off-by: Bobby Eshleman <bobbyeshleman@meta.com> Acked-by: Mohsin Bashir <mohsin.bashr@gmail.com> Link: https://patch.msgid.link/20260211-fbnic-tcp-hds-fixes-v1-1-55d050e6f606@meta.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-16Merge tag 'linux-watchdog-6.20-rc1' of ↵Linus Torvalds
git://www.linux-watchdog.org/linux-watchdog Pull watchdog updates from Wim Van Sebroeck: - iTCO: Drop vendor support - s3c2410_wdt: Drop S3C2410 support - Convert mpc8xxx-wdt to YAML - Several small fixes and improvements * tag 'linux-watchdog-6.20-rc1' of git://www.linux-watchdog.org/linux-watchdog: dt-bindings: watchdog: qcom-wdt: Document Glymur watchdog dt-bindings: watchdog: Convert mpc8xxx-wdt to YAML dt-bindings: watchdog: samsung-wdt: Split if:then: and constrain more dt-bindings: watchdog: samsung-wdt: Drop S3C2410 watchdog: s3c2410_wdt: Drop S3C2410 support dt-bindings: watchdog: samsung-wdt: Define cluster constraints top-level watchdog: rzv2h_wdt: Discard pm_runtime_put() return value watchdog: rz: Discard pm_runtime_put() return values watchdog: Make API functions const correct watchdog: imx7ulp_wdt: handle the nowayout option watchdog: sbsa: Update the W_IIDR Implementer bit mask to 0xFFF watchdog: Always return time left until watchdog times out watchdog: iTCO: Drop vendor support watchdog: starfive-wdt: Fix PM reference leak in probe error path fix it87_wdt early reboot by reporting running timer
2026-02-16Merge tag 'leds-next-6.20' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds Pull LED updates from Lee Jones: "New Support & Features: - Add support for the TI LP5812 4x3 matrix RGB LED driver, including autonomous animation engine control and extensive scan multiplexing modes - Add a new driver for the ams Osram AS3668 4-channel I2C LED controller - Extend the is31fl32xx driver to support the is31fl3293 variant, which features 3 channels and 12-bit PWM resolution Improvements & Fixes: - Prevent the ExpressWire KTD2801 chip from entering an undefined state by disabling interrupts during time-sensitive communication - Ensure the Qualcomm LPG driver detects hardware write failures by checking the return value of regmap_bulk_write() during LUT programming - Fix kernel-doc warnings in the lm3692x driver by documenting missing struct members and standardizing the comment style - Update the ExpressWire library to use fsleep() and unexport internal-only functions - Improve the is31fl32xx driver by reordering code to eliminate unnecessary forward declarations Cleanups & Refactoring: - Simplify the LP55XX common LED driver by utilizing the for_each_available_child_of_node_scoped() macro for more concise node iteration Device Tree Bindings Updates: - Add new YAML bindings for the TI LP5860 and LP5812 LED controllers, and the ams Osram AS3668 - Convert the TI LM3697 white LED driver binding to DT schema format - Allow multicolor LED nodes to be named with numeric suffixes (e.g., multi-led-0) to handle multiple instances without unit addresses - Document support for the PMH0101 variant in the Qualcomm LPG PWM and SPMI Flash LED bindings - Add the issi,is31fl3293 compatible string to the is31fl32xx binding" * tag 'leds-next-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds: dt-bindings: leds: Convert ti,lm3697 to DT schema leds: as3668: Driver for the ams Osram 4-channel i2c LED driver dt-bindings: leds: Add new as3668 support docs: leds: Document TI LP5812 LED driver leds: Add basic support for TI/National Semiconductor LP5812 LED Driver leds: qcom-lpg: Check the return value of regmap_bulk_write() dt-bindings: leds: qcom,spmi-flash-led: Add PMH0101 compatible dt-bindings: leds: leds-qcom-lpg: Add support for PMH0101 PWM dt-bindings: leds: Allow differently named multicolor LEDs leds: lp55xx: Simplify with scoped for each OF child loop dt-bindings: leds: add TI/National Semiconductor LP5812 LED Driver leds: is31f132xx: Add support for is31fl3293 leds: is31f132xx: Re-order code to remove forward declarations dt-bindings: leds: Add issi,is31fl3293 to leds-is31fl32xx leds: expresswire: Fix chip state breakage dt-bindings: leds: Add LP5860 LED controller leds: lm3692x: Fix kernel-doc for struct lm3692x_led
2026-02-16Merge tag 'backlight-next-6.20' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight Pull backlight updates from Lee Jones: "New Support & Features: - Add a new driver for the Congatec Board Controller (CGBC) backlight, providing brightness control via the board controller's PWM interface Improvements & Fixes: - Resolve build failures in the Awinic AW99706 driver by switching to the correct GPIO consumer header - Extend the Qualcomm WLED driver to support the specific over-voltage protection (OVP) values required for the PMI8994 and PMI8950 variants Device Tree Bindings Updates: - Document the device-specific over-voltage protection (OVP) millivolt ranges and default values for Qualcomm PMI8994 and PMI8950 WLED controllers" * tag 'backlight-next-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight: backlight: qcom-wled: Change PM8950 WLED configurations dt-bindings: backlight: qcom-wled: Document ovp values for PMI8950 backlight: qcom-wled: Support ovp values for PMI8994 dt-bindings: backlight: qcom-wled: Document ovp values for PMI8994 backlight: aw99706: Fix build errors caused by wrong gpio header backlight: Add Congatec Board Controller (CGBC) backlight support
2026-02-16Merge tag 'mfd-next-6.20' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd Pull MFD updates from Lee Jones: "New Support & Features: - Add comprehensive support for the ROHM BD72720 PMIC, including core MFD, regulator, GPIO, clock gate, RTC, and power-supply drivers - Add support for the Rockchip RK801 PMIC, including core MFD and regulator drivers - Add support for the ROHM BD73900 PMIC by leveraging existing common drivers - Wire up RTC, hwmon, and input sub-devices for the Apple SMC (macsmc) driver - Add support for the Delta Networks TN48M switch CPLD via the simple-mfd-i2c driver - Add support for the TS133 variant to the QNAP MCU driver - Provide support for the sama7d65 XLCD controller in the Atmel HLCDC driver - Add backlight sub-device support to the Congatec Board Controller (cgbc) - Add Intel Nova Lake-S (NVL-S) PCI IDs to the Intel LPSS driver Improvements & Fixes: - Implement a "wrapper regmap" for the ROHM BD72720 to handle dual I2C slave addresses (0x4b and 0x4c) transparently for child devices - Introduce mutex locking around 'mfd_of_node_list' in the MFD core to ensure safe concurrent access - Fix a potential regulator resource leak in the Arizona core driver during boot sequence failures - Resolve child device duplication issues on driver rebind for Qualcomm PM8xxx and OMAP USB host drivers by using of_platform_depopulate() - Fix IRQ domain name duplication for the Samsung S2MPG10 by adding a unique domain suffix - Implement LOCK register handling for the TI TPS65214 variant to unlock registers at probe time - Fully convert the Loongson-2K BMC driver to use managed resources (pcim) and the standard PCI resource API - Ensure the Apple SMC mutex is correctly initialized during probe to prevent NULL pointer dereferences - Expand the ROHM BD71828 power-supply driver to support 9-bit register addresses - Simplify the Samsung S5M RTC driver by querying platform device IRQ resources directly - Revert an incorrect read-to-write mask change in the DA9052 SPI driver to restore default OTP behavior - Fix kernel-doc warnings in the TI TPS6105x driver - Cleanups & Refactoring - Simplify the MFD core by utilizing the scoped for_each_child_of_node_scoped() macro and streamlining device_node storage - Rename ROHM BD71828 IC-specific entities to use consistent prefixes for better extensibility - Refactor ROHM BD71828 regmap definitions using the regmap_reg_range() macro - Update the ROHM BD71828 driver to use standard C-style comment headers - Remove the now unused 'irq_data' field from the Samsung SEC core structure - Drop unnecessary use of irqd_get_trigger_type() in the Maxim MAX77759 driver - Default MFD_SPACEMIT_P1 to 'm' if ARCH_SPACEMIT is selected - Add missing charger-related registers to the ROHM BD71828 core header and Type-C CC registers to the AXP717 Device Tree Binding Updates: - Add new bindings for the ROHM BD72720 PMIC, Rockchip RK801 PMIC, Bitmain BM1880 System Controller, and NXP LPC32xx System Control Block - Clarify trickle-charge terminology and add properties for voltage drop (VDR) correction and upper charge limits to the generic battery binding - Document GPR syscon for NXP S32 SoCs and the smp-memram subnode for Aspeed SCU - Document numerous new Qualcomm SPMI PMIC compatibles (pmcx0102, pmh0101, pmk8850, etc) - Add compatibles for the sama7d65 XLCD (Atmel), LAN9691 Flexcom (Microchip), and various MediaTek SCPSYS and regulator components - Fix a dead link to the audio codec binding in the DA9055 documentation" * tag 'mfd-next-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (41 commits) dt-bindings: mfd: da9055: Fix dead link to codec binding mfd: cgbc: Add support for backlight dt-bindings: mfd: qcom,spmi-pmic: Document PMICs present on Glymur and Kaanapali dt-bindings: mfd: Document smp-memram subnode for aspeed,ast2x00-scu mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs mfd: ls2kbmc: Use PCI API instead of direct accesses mfd: ls2kbmc: Fully convert to use managed resources dt-bindings: mfd: mediatek: mt6397: Add missing MT6331 regulator compat dt-bindings: mfd: mediatek,mt8195-scpsys: Add mediatek,mt6795-scpsys dt-bindings: mfd: atmel,sama5d2-flexcom: Add microchip,lan9691-flexcom mfd: omap-usb-host: Fix OF populate on driver rebind mfd: qcom-pm8xxx: Fix OF populate on driver rebind dt-bindings: mfd: syscon: Allow syscon compatible for mediatek,mt7981-topmisc mfd: qnap-mcu: Add driver data for TS133 variant dt-bindings: mfd: qnap,ts433-mcu: Add qnap,ts133-mcu compatible mfd: sec: Fix IRQ domain names duplication mfd: simple-mfd-i2c: Add Delta TN48M CPLD support mfd: macsmc: Initialize mutex dt-bindings: mfd: nxp: Add NXP LPC32xx System Control Block mfd: Kconfig: Default MFD_SPACEMIT_P1 to 'm' if ARCH_SPACEMIT ...
2026-02-16Merge tag 'pinctrl-v7.0-1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control updates from Linus Walleij: "Core changes: - Drop the unused devm_pinctrl_unregister() function - Move pretended generic pin control functionality out of the core and into the Amlogic AM4 driver. We have something better coming (hopefully) New hardware support: - Spacemit K3 (RISC-V) pin control support - Atmel AT91 PIO4 (ARM32) SAMA7D65 pin control support - Exynos9610 (ARM64) pin control support - Qualcomm Mahua TLMM (ARM64) pin control support - Microchip Polarfire MSSIO (RISC-V) pin control support - Ocelot LAN9645XF (multiplatform) pin control support Improvements: - Using a few more guards for locking - Various nonurgent fixes and tweaks" * tag 'pinctrl-v7.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (73 commits) pinctrl: generic: move function to amlogic-am4 driver pinctrl: intel: Align Copyright note with corporate guidelines pinctrl: mediatek: remove unused drv_offset field pinctrl: canaan: k230: Fix NULL pointer dereference when parsing devicetree pinctrl: single: fix refcount leak in pcs_add_gpio_func() pinctrl: meson: amlogic-a4: Fix device node reference leak in bank helpers pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition pinctrl: core: Remove duplicate error messages pinctrl: core: Simplify devm_pinctrl_*() pinctrl: core: Remove unused devm_pinctrl_unregister() dt-bindings: pinctrl: spacemit: fix drive-strength check warning pinctrl: fix kismet issues with GENERIC_PINCTRL pinctrl: tangier: Join tng_pinctrl_probe() into its wrapper pinctrl: tangier: Remove duplicate error messages pinctrl: lynxpoint: Remove duplicate error messages pinctrl: cherryview: Remove duplicate error messages pinctrl: baytrail: Remove duplicate error messages pinctrl: intel: Remove duplicate error messages pinctrl: equilibrium: Fix device node reference leak in pinbank_init() dt-bindings: pinctrl: pinctrl-microchip-sgpio: add LAN969x ...
2026-02-16Merge tag 'mips_7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linuxLinus Torvalds
Pull MIPS updates from Thomas Bogendoerfer: "Cleanups and fixes" * tag 'mips_7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: (28 commits) Revert "clk: microchip: core: allow driver to be compiled with COMPILE_TEST" Revert "clk: microchip: fix typo in reference to a config option" MIPS: Implement ARCH_HAS_CC_CAN_LINK MIPS: rb532: Fix MMIO UART resource registration MIPS: Work around LLVM bug when gp is used as global register variable MIPS: Loongson64: env: Fixup serial clock-frequency when using LEFI MIPS: Loongson2ef: Use pcibios_align_resource() to block io range MIPS: Loongson2ef: Register PCI controller in early stage clk: microchip: fix typo in reference to a config option MIPS: Loongson64: dts: fix phy-related definition of LS7A GMAC clk: microchip: core: allow driver to be compiled with COMPILE_TEST MIPS: drop unused pic32.h header watchdog: pic32-wdt: update include to use pic32.h from platform_data watchdog: pic32-dmt: update include to use pic32.h from platform_data serial: pic32_uart: update include to use pic32.h from platform_data rtc: pic32: update include to use pic32.h from platform_data pinctrl: pic32: update include to use pic32.h from platform_data mmc: sdhci-pic32: update include to use pic32.h from platform_data irqchip/irq-pic32-evic: update include to use pic32.h from platform_data clk: microchip: core: update include to use pic32.h from platform_data ...