Commit graph

1,464,522 commits

Author SHA1 Message Date
Tomas Glozar
82374995b6 Documentation/rtla: Document SIGINT behavior
The behavior of RTLA on receiving SIGINT is currently undocumented.

Describe it in RTLA's common appendix that appears in man pages for all
RTLA tools to avoid confusion.

Suggested-by: Attila Fazekas <afazekas@redhat.com>
Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Link: https://lore.kernel.org/r/20260324123229.152424-1-tglozar@redhat.com
Signed-off-by: Tomas Glozar <tglozar@redhat.com>
2026-03-27 10:58:30 +01:00
Mario Limonciello
ed4da361bf Revert "ALSA: hda/intel: Add MSI X870E Tomahawk to denylist"
commit 30b3211aa2 ("ALSA: hda/intel: Add MSI X870E Tomahawk
to denylist") was added to silence a warning, but this effectively
reintroduced commit df42ee7e22 ("ALSA: hda: Add ASRock
X670E Taichi to denylist") which was already reported to cause
problems and reverted in commit ee8f161359 ("Revert "ALSA: hda:
Add ASRock X670E Taichi to denylist"")

Revert it yet again.

Cc: stable@vger.kernel.org
Reported-by: Juhyun Song <juju6985@outlook.kr>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221274
Cc: Stuart Hayhurst <stuart.a.hayhurst@gmail.com>
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Link: https://patch.msgid.link/20260326190542.524515-1-mario.limonciello@amd.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-03-27 10:54:04 +01:00
Thorsten Blum
be0240f657 crypto: qce - use memcpy_and_pad in qce_aead_setkey
Replace memset() followed by memcpy() with memcpy_and_pad() to simplify
the code and to write to ->auth_key only once.

Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-03-27 18:52:44 +09:00
Mieczyslaw Nalewaj
fdacdc8cf8 crypto: inside-secure/eip93 - add missing address terminator character
Add the missing > characters to the end of the email address

Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-03-27 18:52:44 +09:00
Mieczyslaw Nalewaj
9503ab5a1d crypto: inside-secure/eip93 - correct ecb(des-eip93) typo
Correct the typo in the name "ecb(des-eip93)".

Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-03-27 18:52:44 +09:00
Wenkai Lin
67b53a660e crypto: hisilicon/sec2 - prevent req used-after-free for sec
During packet transmission, if the system is under heavy load,
the hardware might complete processing the packet and free the
request memory (req) before the transmission function finishes.
If the software subsequently accesses this req, a use-after-free
error will occur. The qp_ctx memory exists throughout the packet
sending process, so replace the req with the qp_ctx.

Fixes: f0ae287c50 ("crypto: hisilicon/sec2 - implement full backlog mode for sec")
Signed-off-by: Wenkai Lin <linwenkai6@hisilicon.com>
Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-03-27 18:52:44 +09:00
Eric Biggers
07fa25957a crypto: cryptd - Remove unused functions
Many functions in cryptd.c no longer have any caller.  Remove them.

Also remove several associated structs and includes.  Finally, inline
cryptd_shash_desc() into its only caller, allowing it to be removed too.

Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-03-27 18:52:44 +09:00
Aleksander Jan Bajkowski
5c8009f3c1 crypto: inside-secure/eip93 - make it selectable for ECONET
Econet SoCs feature an integrated EIP93 in revision 3.0p1. It is identical
to the one used by the Airoha AN7581 and the MediaTek MT7621. Ahmed reports
that the EN7528 passes testmgr's self-tests. This driver should also work
on other little endian Econet SoCs.

CC: Ahmed Naseef <naseefkm@gmail.com>
Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
Reviewed-by: Antoine Tenart <atenart@kernel.org>
Tested-by: Ahmed Naseef <naseefkm@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-03-27 18:52:44 +09:00
T Pratham
a09c5e0649 crypto: ti - Add support for AES-CCM in DTHEv2 driver
AES-CCM is an AEAD algorithm supporting both encryption and
authentication of data. This patch introduces support for AES-CCM AEAD
algorithm in the DTHEv2 driver.

Signed-off-by: T Pratham <t-pratham@ti.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-03-27 18:52:44 +09:00
T Pratham
37b902c603 crypto: ti - Add support for AES-GCM in DTHEv2 driver
AES-GCM is an AEAD algorithm supporting both encryption and
authentication of data. This patch introduces support for AES-GCM as the
first AEAD algorithm supported by the DTHEv2 driver.

Signed-off-by: T Pratham <t-pratham@ti.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-03-27 18:52:43 +09:00
Thorsten Blum
92c0a9bbcd crypto: stm32 - use list_first_entry_or_null to simplify cryp_find_dev
Use list_first_entry_or_null() to simplify stm32_cryp_find_dev() and
remove the now-unused local variable 'struct stm32_cryp *tmp'.

Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Reviewed-by: Kees Cook <kees@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-03-27 18:52:43 +09:00
Thorsten Blum
1a9670df56 crypto: stm32 - use list_first_entry_or_null to simplify hash_find_dev
Use list_first_entry_or_null() to simplify stm32_hash_find_dev() and
remove the now-unused local variable 'struct stm32_hash_dev *tmp'.

Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-03-27 18:52:43 +09:00
Aleksander Jan Bajkowski
d0c0a414cc crypto: testmgr - Add test vectors for authenc(hmac(md5),rfc3686(ctr(aes)))
Test vectors were generated starting from existing RFC3686(CTR(AES)) test
vectors and adding HMAC(MD5) computed with software implementation.
Then, the results were double-checked on Mediatek MT7986 (safexcel).
Platform pass self-tests.

Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-03-27 18:52:43 +09:00
Suman Kumar Chakraborty
6ac142bf26 crypto: qat - add anti-rollback support for GEN6 devices
Anti-Rollback (ARB) is a QAT GEN6 hardware feature that prevents loading
firmware with a Security Version Number (SVN) lower than an authorized
minimum. This protects against downgrade attacks by ensuring that only
firmware at or above a committed SVN can run on the acceleration device.

During firmware loading, the driver checks the SVN validation status via
a hardware CSR. If the check reports a failure, firmware authentication
is aborted. If it reports a retry status, the driver reissues the
authentication command up to a maximum number of retries.

Extend the firmware admin interface with two new messages,
ICP_QAT_FW_SVN_READ and ICP_QAT_FW_SVN_COMMIT, to query and commit the
SVN, respectively. Integrate the SVN check into the firmware
authentication path in qat_uclo.c so the driver can react to
anti-rollback status during device bring-up.

Expose SVN information to userspace via a new sysfs attribute group,
qat_svn, under the PCI device directory. The group provides read-only
attributes for the active, enforced minimum, and permanent minimum SVN
values, as well as a write-only commit attribute that allows a system
administrator to commit the currently active SVN as the new authorized
minimum.

This is based on earlier work by Ciunas Bennett.

Signed-off-by: Suman Kumar Chakraborty <suman.kumar.chakraborty@intel.com>
Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-03-27 18:52:43 +09:00
Thorsten Blum
177730a273 crypto: caam - guard HMAC key hex dumps in hash_digest_key
Use print_hex_dump_devel() for dumping sensitive HMAC key bytes in
hash_digest_key() to avoid leaking secrets at runtime when
CONFIG_DYNAMIC_DEBUG is enabled.

Fixes: 045e36780f ("crypto: caam - ahash hmac support")
Fixes: 3f16f6c9d6 ("crypto: caam/qi2 - add support for ahash algorithms")
Cc: stable@vger.kernel.org
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-03-27 18:52:43 +09:00
Thorsten Blum
d134feeb5d printk: add print_hex_dump_devel()
Add print_hex_dump_devel() as the hex dump equivalent of pr_devel(),
which emits output only when DEBUG is enabled, but keeps call sites
compiled otherwise.

Suggested-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Reviewed-by: John Ogness <john.ogness@linutronix.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-03-27 18:52:43 +09:00
Gustavo A. R. Silva
b0bfa49c03 crypto: nx - Fix packed layout in struct nx842_crypto_header
struct nx842_crypto_header is declared with the __packed attribute,
however	the fields grouped with struct_group_tagged() were not packed.
This caused the grouped header portion of the structure to lose the
packed layout guarantees of the containing structure.

Fix this by replacing struct_group_tagged() with __struct_group(...,
..., __packed, ...) so the grouped fields are packed, and the original
layout is preserved, restoring the intended packed layout of the
structure.

Before changes:
struct nx842_crypto_header {
	union {
		struct {
			__be16     magic;                /*     0     2 */
			__be16     ignore;               /*     2     2 */
			u8         groups;               /*     4     1 */
		};                                       /*     0     6 */
		struct nx842_crypto_header_hdr hdr;      /*     0     6 */
	};                                               /*     0     6 */
	struct nx842_crypto_header_group group[];        /*     6     0 */

	/* size: 6, cachelines: 1, members: 2 */
	/* last cacheline: 6 bytes */
} __attribute__((__packed__));

After changes:
struct nx842_crypto_header {
	union {
		struct {
			__be16     magic;                /*     0     2 */
			__be16     ignore;               /*     2     2 */
			u8         groups;               /*     4     1 */
		} __attribute__((__packed__));           /*     0     5 */
		struct nx842_crypto_header_hdr hdr;      /*     0     5 */
	};                                               /*     0     5 */
	struct nx842_crypto_header_group group[];        /*     5     0 */

	/* size: 5, cachelines: 1, members: 2 */
	/* last cacheline: 5 bytes */
} __attribute__((__packed__));

Fixes: 1e6b251ce1 ("crypto: nx - Avoid -Wflex-array-member-not-at-end warning")
Cc: stable@vger.kernel.org
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-03-27 18:52:43 +09:00
Thorsten Blum
928c5e894c crypto: nx - annotate struct nx842_crypto_header with __counted_by
Add the __counted_by() compiler attribute to the flexible array member
'group' to improve access bounds-checking via CONFIG_UBSAN_BOUNDS and
CONFIG_FORTIFY_SOURCE.

Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-03-27 18:52:25 +09:00
Thorsten Blum
914b0c68d4 crypto: marvell/cesa - use memcpy_and_pad in mv_cesa_ahash_export
Replace memset() followed by memcpy() with memcpy_and_pad() to simplify
the code and to write to 'cache' only once.

Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-03-27 18:52:25 +09:00
Thorsten Blum
f30579bbae crypto: s5p-sss - use unregister_{ahashes,skciphers} in probe/remove
Replace multiple for loops with calls to crypto_unregister_ahashes() and
crypto_unregister_skciphers().

If crypto_register_skcipher() fails in s5p_aes_probe(), log the error
directly instead of checking 'i < ARRAY_SIZE(algs)' later.  Also drop
now-unused local index variables.  No functional changes.

Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Reviewed-by: Vladimir Zapolskiy <vz@mleia.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-03-27 18:52:25 +09:00
Lianqin Hu
ee6c551a7d ALSA: usb-audio: Add iface reset and delay quirk for AB17X USB Audio
Setting up the interface when suspended/resumeing fail on this card.
Adding a reset and delay quirk will eliminate this problem.

usb 1-1: new full-speed USB device number 2 using xhci-hcd
usb 1-1: New USB device found, idVendor=001f, idProduct=0b23
usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 1-1: Product: AB17X USB Audio
usb 1-1: Manufacturer: Generic
usb 1-1: SerialNumber: 20241228172028

Signed-off-by: Lianqin Hu <hulianqin@vivo.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/PUZPR06MB6224CA59AD2B26054120B276D249A@PUZPR06MB6224.apcprd06.prod.outlook.com
2026-03-27 10:50:57 +01:00
Yeoreum Yun
eaa3babcce arm64: futex: Refactor futex atomic operation
Refactor the futex atomic operations using ll/sc instructions in
preparation for FEAT_LSUI support. In addition, use named operands for
the inline asm.

No functional change.

Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
[catalin.marinas@arm.com: remove unnecessary stringify.h include]
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2026-03-27 09:47:33 +00:00
Kshamendra Kumar Mishra
faceb5cf5d ALSA: hda/realtek: add HP Laptop 15-fd0xxx mute LED quirk
HP Laptop 15-fd0xxx with ALC236 codec does not handle the toggling of
the mute LED.
This patch adds a quirk entry for subsystem ID 0x8dd7 using
ALC236_FIXUP_HP_MUTE_LED_COEFBIT2 fixup, enabling correct mute LED
behavior.

Signed-off-by: Kshamendra Kumar Mishra <kshamendrakumarmishra@gmail.com>
Link: https://patch.msgid.link/DHAB51ISUM96.2K9SZIABIDEQ0@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-03-27 10:43:56 +01:00
Geoffrey D. Bennett
990a8b0732 ALSA: usb-audio: Exclude Scarlett 2i4 1st Gen from SKIP_IFACE_SETUP
Same issue that the Scarlett 2i2 1st Gen had:
QUIRK_FLAG_SKIP_IFACE_SETUP causes distorted/flanging audio on the
Scarlett 2i4 1st Gen (1235:800a).

Fixes: 38c322068a ("ALSA: usb-audio: Add QUIRK_FLAG_SKIP_IFACE_SETUP")
Reported-by: dcferreira [https://github.com/geoffreybennett/linux-fcp/issues/54]
Signed-off-by: Geoffrey D. Bennett <g@b4.vu>
Link: https://patch.msgid.link/acEkEbftzyNe8W7C@m.b4.vu
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-03-27 10:43:14 +01:00
César Montoya
2f388b4e8f ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx
The HP Pavilion 15-eg0xxx with subsystem ID 0x103c87cb uses a Realtek
ALC287 codec with a mute LED wired to GPIO pin 4 (mask 0x10). The
existing ALC287_FIXUP_HP_GPIO_LED fixup already handles this correctly,
but the subsystem ID was missing from the quirk table.

GPIO pin confirmed via manual hda-verb testing:
  hda-verb SET_GPIO_MASK 0x10
  hda-verb SET_GPIO_DIRECTION 0x10
  hda-verb SET_GPIO_DATA 0x10

Signed-off-by: César Montoya <sprit152009@gmail.com>
Link: https://patch.msgid.link/20260321153603.12771-1-sprit152009@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-03-27 10:31:47 +01:00
Kailang Yang
d3be95efc6 ALSA: hda/realtek - Fixed Speaker Mute LED for HP EliteBoard G1a platform
On the HP EliteBoard G1a platform (models without a headphone jack).
the speaker mute LED failed to function. The Sysfs ctl-led info showed
empty values because the standard LED registration couldn't correctly
bind to the master switch.
Adding this patch will fix and enable the speaker mute LED feature.

Tested-by: Chris Chiu <chris.chiu@canonical.com>
Signed-off-by: Kailang Yang <kailang@realtek.com>
Link: https://lore.kernel.org/279e929e884849df84687dbd67f20037@realtek.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-03-27 10:27:58 +01:00
Shawn Lin
0aa7a5723c mmc: core: Switch to use pm_ptr() for mmc_host_class_dev_pm_ops
Currently, the mmc_host_class_dev_pm_ops and its callback
functions are wrapped in #ifdef CONFIG_PM_SLEEP to handle the
conditional compilation when PM support is disabled.

Replace this #ifdef usage with the standard pm_ptr() helpers. This
allows the compiler to automatically optimize away the unused code
paths when CONFIG_PM_SLEEP is not selected, resulting in cleaner and
more maintainable code.

Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-03-27 10:25:16 +01:00
Shawn Lin
3c3b759be1 mmc: core: Remove legacy 'enable-sdio-wakeup' DT property support
The 'enable-sdio-wakeup' device tree property was marked as legacy and
superseded by the standard 'wakeup-source' property in commit 71a0151c5c
("Documentation: devicetree: fix reference to legacy wakeup properties")
back in 2015.

Since it has been a decade and the migration to the standard property
has long been completed, remove this obsolete legacy support.

Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-03-27 10:24:51 +01:00
Rosen Penev
c3126dccfd mmc: mmc_test: use kzalloc_flex
Simplifies allocations by using a flexible array member in these structs.

Add __counted_by to get extra runtime analysis.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-03-27 10:24:35 +01:00
Takashi Iwai
50c8f83c41 ASoC: Fixes for v7.0
This is two week's worth of fixes and quirks so it's a bit larger than
 you might expect, there's nothing too exciting individually and nothing
 in core code.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmnFNW4ACgkQJNaLcl1U
 h9Diogf9HkMR5tCunQCIUaDEUt6nFdipOueBXilfPdRbhoRSHIUXtkrkYd1TzAT/
 Fu/dxUPb3dBO/Q4K8JxmbA/nxK7wEvtrHSSTrfLHzze9bc+h1a+g13b47PhrVnZg
 JDZC3YbyaAV/wnsUtK04h2dif91w7MR/UBrKhk9QZjk4ZZKMvVxEYBOY9wwa5QaK
 lAg16LflPqViL7cpTK1BEIY7UCIwXgCvPxZGnzvylA+kbopQSk18CjKcmer0RLXe
 dLoX3uP7/8aBSRVRpM/okFqyyWUJcXC0rgHGOdr6JbazYl3GSlbW28EdtbuyAZb8
 /RBLZlLaxq8Yshgc6Kim2d7RpUllEQ==
 =ox08
 -----END PGP SIGNATURE-----

Merge tag 'asoc-fix-v7.0-rc5' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus

ASoC: Fixes for v7.0

This is two week's worth of fixes and quirks so it's a bit larger than
you might expect, there's nothing too exciting individually and nothing
in core code.
2026-03-27 10:16:52 +01:00
Andy Shevchenko
b4e93cbc60 pinctrl: core: Don't use "proxy" headers
Update header inclusions to follow IWYU (Include What You Use)
principle.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-03-27 10:00:33 +01:00
Guangshuo Li
7f138de156 auxdisplay: line-display: fix NULL dereference in linedisp_release
linedisp_release() currently retrieves the enclosing struct linedisp via
to_linedisp(). That lookup depends on the attachment list, but the
attachment may already have been removed before put_device() invokes the
release callback. This can happen in linedisp_unregister(), and can also
be reached from some linedisp_register() error paths.

In that case, to_linedisp() returns NULL and linedisp_release()
dereferences it while freeing the display resources.

The struct device released here is the embedded linedisp->dev used by
linedisp_register(), so retrieve the enclosing object directly with
container_of() instead.

Fixes: 66c9380948 ("auxdisplay: linedisp: encapsulate container_of usage within to_linedisp")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
2026-03-27 09:54:31 +01:00
Sherry Yang
8b72aa5704 iommupt/amdv1: mark amdv1pt_install_leaf_entry as __always_inline
After enabling CONFIG_GCOV_KERNEL and CONFIG_GCOV_PROFILE_ALL, following
build failure is observed under GCC 14.2.1:

In function 'amdv1pt_install_leaf_entry',
    inlined from '__do_map_single_page' at drivers/iommu/generic_pt/fmt/../iommu_pt.h:650:3,
    inlined from '__map_single_page0' at drivers/iommu/generic_pt/fmt/../iommu_pt.h:661:1,
    inlined from 'pt_descend' at drivers/iommu/generic_pt/fmt/../pt_iter.h:391:9,
    inlined from '__do_map_single_page' at drivers/iommu/generic_pt/fmt/../iommu_pt.h:657:10,
    inlined from '__map_single_page1.constprop' at drivers/iommu/generic_pt/fmt/../iommu_pt.h:661:1:
././include/linux/compiler_types.h:706:45: error: call to '__compiletime_assert_71' declared with attribute error: FIELD_PREP: value too large for the field
  706 |         _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
      |

......

drivers/iommu/generic_pt/fmt/amdv1.h:220:26: note: in expansion of macro 'FIELD_PREP'
  220 |                          FIELD_PREP(AMDV1PT_FMT_OA,
      |                          ^~~~~~~~~~

In the path '__do_map_single_page()', level 0 always invokes
'pt_install_leaf_entry(&pts, map->oa, PAGE_SHIFT, …)'. At runtime that
lands in the 'if (oasz_lg2 == isz_lg2)' arm of 'amdv1pt_install_leaf_entry()';
the contiguous-only 'else' block is unreachable for 4 KiB pages.

With CONFIG_GCOV_KERNEL + CONFIG_GCOV_PROFILE_ALL, the extra
instrumentation changes GCC's inlining so that the "dead" 'else' branch
still gets instantiated. The compiler constant-folds the contiguous OA
expression, runs the 'FIELD_PREP()' compile-time check, and produces:

    FIELD_PREP: value too large for the field

gcov-enabled builds therefore fail even though the code path never executes.

Fix this by marking amdv1pt_install_leaf_entry as __always_inline.

Fixes: dcd6a011a8 ("iommupt: Add map_pages op")
Suggested-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sherry Yang <sherry.yang@oracle.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
2026-03-27 09:41:48 +01:00
Basavaraj Natikar
127e98c05c pinctrl: amd: Support new ACPI ID AMDI0033
Add AMDI0033 to the AMD GPIO ACPI match table.
This lets the driver bind on new AMD platforms that expose this HID.

Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-03-27 09:40:58 +01:00
Guanghui Feng
0e59645683 iommu/amd: Fix illegal cap/mmio access in IOMMU debugfs
In the current AMD IOMMU debugfs, when multiple processes simultaneously
access the IOMMU mmio/cap registers using the IOMMU debugfs, illegal
access issues can occur in the following execution flow:

1. CPU1: Sets a valid access address using iommu_mmio/capability_write,
and verifies the access address's validity in iommu_mmio/capability_show

2. CPU2: Sets an invalid address using iommu_mmio/capability_write

3. CPU1: accesses the IOMMU mmio/cap registers based on the invalid
address, resulting in an illegal access.

This patch modifies the execution process to first verify the address's
validity and then access it based on the same address, ensuring
correctness and robustness.

Signed-off-by: Guanghui Feng <guanghuifeng@linux.alibaba.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
2026-03-27 09:26:59 +01:00
Guanghui Feng
e4172c5b53 iommu/amd: Fix illegal device-id access in IOMMU debugfs
In the current AMD IOMMU debugFS, when multiple processes use the IOMMU
debugFS process simultaneously, illegal access issues can occur in the
following execution flow:

1. CPU1: Sets a valid sbdf via devid_write, then checks the sbdf's
validity in execution flows such as devid_show, iommu_devtbl_show,
and iommu_irqtbl_show.

2. CPU2: Sets an invalid sbdf via devid_write, at which point the sbdf
value is -1.

3. CPU1: accesses the IOMMU device table, IRQ table, based on the
invalid SBDF value of -1, resulting in illegal access.

This is especially problematic in monitoring scripts, where multiple
scripts may access debugFS simultaneously, and some scripts may
unexpectedly set invalid values, which triggers illegal access in
debugfs.

This patch modifies the execution flow of devid_show,
iommu_devtbl_show, and iommu_irqtbl_show to ensure that these
processes determine the validity and access based on the
same device-id, thus guaranteeing correctness and robustness.

Signed-off-by: Guanghui Feng <guanghuifeng@linux.alibaba.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
2026-03-27 09:26:58 +01:00
Jason Gunthorpe
ee6e69d032 iommupt: Fix short gather if the unmap goes into a large mapping
unmap has the odd behavior that it can unmap more than requested if the
ending point lands within the middle of a large or contiguous IOPTE.

In this case the gather should flush everything unmapped which can be
larger than what was requested to be unmapped. The gather was only
flushing the range requested to be unmapped, not extending to the extra
range, resulting in a short invalidation if the caller hits this special
condition.

This was found by the new invalidation/gather test I am adding in
preparation for ARMv8. Claude deduced the root cause.

As far as I remember nothing relies on unmapping a large entry, so this is
likely not a triggerable bug.

Cc: stable@vger.kernel.org
Fixes: 7c53f4238a ("iommupt: Add unmap_pages op")
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
Reviewed-by: Samiullah Khawaja <skhawaja@google.com>
Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
2026-03-27 09:07:13 +01:00
Jason Gunthorpe
90c5def10b iommu: Do not call drivers for empty gathers
An empty gather is coded with start=U64_MAX, end=0 and several drivers go
on to convert that to a size with:

 end - start + 1

Which gives 2 for an empty gather. This then causes Weird Stuff to
happen (for example an UBSAN splat in VT-d) that is hopefully harmless,
but maybe not.

Prevent drivers from being called right in iommu_iotlb_sync().

Auditing shows that AMD, Intel, Mediatek and RSIC-V drivers all do things
on these empty gathers.

Further, there are several callers that can trigger empty gathers,
especially in unusual conditions. For example iommu_map_nosync() will call
a 0 size unmap on some error paths. Also in VFIO, iommupt and other
places.

Cc: stable@vger.kernel.org
Reported-by: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
Closes: https://lore.kernel.org/r/11145826.aFP6jjVeTY@jkrzyszt-mobl2.ger.corp.intel.com
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
Reviewed-by: Samiullah Khawaja <skhawaja@google.com>
Reviewed-by: Robin Murphy <robin.murphy@arm.com>
Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
2026-03-27 09:07:13 +01:00
Marek Szyprowski
ed734125ea Merge branch 'dt-reserved-mem-cleanups' into dma-mapping-for-next
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
2026-03-27 08:48:51 +01:00
Dave Airlie
83318d0c1f - Fix UAF in SRIOV migration restore (Winiarski)
- Updates to HW W/a (Roper)
 - VMBind remap fix (Auld)
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEbSBwaO7dZQkcLOKj+mJfZA7rE8oFAmnFIIoACgkQ+mJfZA7r
 E8orrAgAkgP8YtPdsf29W5aZZDIlHg07Jbtkf+DF+Bzdl2sz2apT7D2TDGd4KiAC
 fvCiDIF3tjvy4Br+WqUdSfWSTPOXDlLonpRUioQIl8a+etUv6+IRLUxHr81857GQ
 A4QnVT8Nn3+cGB41wJlNmcdgjJEtU+QiEoDt58CHuX7BCzT5bCH1WS751MMIbKhb
 diWgw5rsLqsH3k/1l4KTau5S0vq7yK+wn10+FaOAbFc8p8vS7Gi0072DbKNjtJRJ
 48KIyVdsRVS8xStTv5a4T+WastcWB5cY6fweKfOKucX+CryPqTM1rIGitZOhrkXs
 /0aC8Stz9dEn4K6HWRGX+OnbSr5xCw==
 =72tc
 -----END PGP SIGNATURE-----

Merge tag 'drm-xe-fixes-2026-03-26' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes

- Fix UAF in SRIOV migration restore (Winiarski)
- Updates to HW W/a (Roper)
- VMBind remap fix (Auld)

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Rodrigo Vivi <rodrigo.vivi@intel.com>
Link: https://patch.msgid.link/acUgq2q2DrCUzFql@intel.com
2026-03-27 17:48:48 +10:00
Dave Airlie
aab01a8808 A page mapping fix for shmem fault handler, a power-off fix for ivpu, a
GFP_* flag fix for syncobj, and a MAINTAINERS update.
 -----BEGIN PGP SIGNATURE-----
 
 iJUEABMJAB0WIQTkHFbLp4ejekA/qfgnX84Zoj2+dgUCacTdWwAKCRAnX84Zoj2+
 dk5tAX9XNlfUu2R/WImP3GyGkhfjfa7yhofxkxybzWlPzKvMMe5aCOc2wB+7e65b
 U8zG1S4BgPCDY0W2q3gnDfvk7A15UPP8oEED7b77CdykMhnrKXo4kOjlGGJGu7CM
 k9/G0vgnkg==
 =7M13
 -----END PGP SIGNATURE-----

Merge tag 'drm-misc-fixes-2026-03-26' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes

A page mapping fix for shmem fault handler, a power-off fix for ivpu, a
GFP_* flag fix for syncobj, and a MAINTAINERS update.

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Maxime Ripard <mripard@redhat.com>
Link: https://patch.msgid.link/20260326-lush-cuddly-limpet-ab2aa9@houat
2026-03-27 17:46:26 +10:00
Ammar Mustafa
d2a4ec19d2 Docs: iio: ad7191 Correct clock configuration
Correct the ad7191 documentation to match the datasheet:
- Fix inverted CLKSEL pin logic: device uses external clock when pin is
  inactive, and internal CMOS/crystal when high.
- Correct CMOS-compatible clock pin from MCLK2 to MCLK1.

Signed-off-by: Ammar Mustafa <ammarmustafa34@gmail.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-03-27 07:31:19 +00:00
Kees Cook
8aae2da610 um: Replace strncpy() with strnlen()+memcpy_and_pad() in strncpy_chunk_from_user()
Replace the deprecated[1] strncpy() with strnlen() on the source
followed by memcpy_and_pad().

This function is a chunk callback for UML's strncpy_from_user()
implementation, called by buffer_op() to process userspace memory one
page at a time. The source is a kernel-mapped userspace address that
is not guaranteed to be NUL-terminated; "len" bounds how many bytes
to read from it.

By measuring the source string length first with strnlen(), we avoid
reading past the NUL terminator in the source. memcpy_and_pad() then
copies the string content and zero-fills the remainder of the chunk,
preserving the original strncpy() behavior exactly: copy up to the
first NUL, then pad with zeros to the full length.

strtomem_pad() would be the idiomatic helper for this strnlen() +
memcpy_and_pad() pattern, but it requires a compile-time-determinable
destination size (via ARRAY_SIZE()). Here the destination is a char *
into a caller-provided buffer and the chunk length is a runtime value,
so the explicit two-step is necessary.

No behavioral change: the same bytes are written to the destination
(string content followed by zero padding), the pointer advances by
the same amount, and the NUL-found return condition is unchanged.

Link: https://github.com/KSPP/linux/issues/90 [1]
Signed-off-by: Kees Cook <kees@kernel.org>
Link: https://patch.msgid.link/20260323171713.work.839-kees@kernel.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-03-27 08:21:09 +01:00
Dave Airlie
355223cb84 Merge tag 'drm-intel-fixes-2026-03-26' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes
- DP tunnel error handling fix
- Spurious GMBUS timeout fix
- Unlink NV12 planes earlier
- Order OP vs. timeout correctly in __wait_for()

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Link: https://patch.msgid.link/acTdjAoOGkzl3dcc@jlahtine-mobl
2026-03-27 17:19:34 +10:00
Dave Airlie
0d270f0df6 Mediatek DRM Next - 20260325
1. mtk_dsi: enable hs clock during pre-enable
 2. Remove all conflicting aperture devices during probe
 3. Add support for mt8167 display blocks
 -----BEGIN PGP SIGNATURE-----
 
 iQJMBAABCgA2FiEEACwLKSDmq+9RDv5P4cpzo8lZTiQFAmnEBjYYHGNodW5rdWFu
 Zy5odUBrZXJuZWwub3JnAAoJEOHKc6PJWU4kCSAP/jhZrTVEpj+bfSUa3m7NmWsb
 aEt6GUI/x/IOkpb3KcGE4JpQWIiUCn8Zp8WGQjDsmHreE2ibZUk47dpSRp6+7l93
 Gc+TLX2rLF2nj+1Utrj/9NFUfM4uYHuRlFU6y+uFHJ7IZsF89Fl2jHavoiJtm0Ld
 tqhMG5i2TuopqTGsvS4haZEISyYK9i0QOX0JH5bIwCN6Gxt1HIPexy0iZPgAGC/Q
 1u1Qz94iJpLfur4t4fAxZfsbcI7ATGGuwx1THcVsO/8SSsdG/GVT6WUvQdiGMv7B
 uJhIjXcyGMFRy9qr0iAhVNfiGTVcZyduR74+IZzZC2zKcAPMl/1LgfpuWsccb/nh
 FgQs8O2YjQ14UtAt+s1H5DMk9a+NX9tQzUtpHIIYi2zWrbKXdWKt5mxoLN1AH1vs
 kXc6CLcYw54XDCtqK0TInbw8pqENYfG0DmUEl+cDIwmf7853HkYryC2tbzQju5BP
 WYQJ87g58x/JvvjopNimOBJA2PwmJgakHlPoD7+bGlc4TPUL4Ux6XGTwbFv9s6Jv
 i4j7SN4RueQkZ3Cnxmb+0hwubYNDXqOtVBmgiQFFGSE128famG3IU88W9G6q27FU
 jOBYhCKDExupCRsJ7BQlSQfCJ2WFXGrqGa01XQv3cjCVUFFY8qKO7sytd4MTME/a
 zWkvA7Kd55eUhnnRRqCC
 =VZ5x
 -----END PGP SIGNATURE-----

Merge tag 'mediatek-drm-next-20260325' of https://git.kernel.org/pub/scm/linux/kernel/git/chunkuang.hu/linux into drm-next

Mediatek DRM Next - 20260325

1. mtk_dsi: enable hs clock during pre-enable
2. Remove all conflicting aperture devices during probe
3. Add support for mt8167 display blocks

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Chun-Kuang Hu <chunkuang.hu@kernel.org>
Link: https://patch.msgid.link/20260325160721.4891-1-chunkuang.hu@kernel.org
2026-03-27 17:05:06 +10:00
Dave Airlie
7261c2fceb amd-drm-fixes-7.0-2026-03-25:
amdgpu:
 - DSC fix
 - Module parameter parsing fix
 - PASID reuse fix
 - drm_edid leak fix
 - SMU 13.x fixes
 - SMU 14.x fix
 - Fence fix in amdgpu_amdkfd_submit_ib()
 - LVDS fixes
 - GPU page fault fix for non-4K pages
 
 amdkfd:
 - Ordering fix in kfd_ioctl_create_process()
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQQgO5Idg2tXNTSZAr293/aFa7yZ2AUCacQE6wAKCRC93/aFa7yZ
 2OakAQDMdRTZA2qWUKlEjLrXho1zPggNH3Ok1zkD9rjlmJ+rMgD+KBAM5zYsRHlP
 XkwAcn2nXVNOaDP9Y0KZQnj6pj/6yAw=
 =9uUp
 -----END PGP SIGNATURE-----

Merge tag 'amd-drm-fixes-7.0-2026-03-25' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes

amd-drm-fixes-7.0-2026-03-25:

amdgpu:
- DSC fix
- Module parameter parsing fix
- PASID reuse fix
- drm_edid leak fix
- SMU 13.x fixes
- SMU 14.x fix
- Fence fix in amdgpu_amdkfd_submit_ib()
- LVDS fixes
- GPU page fault fix for non-4K pages

amdkfd:
- Ordering fix in kfd_ioctl_create_process()

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Alex Deucher <alexander.deucher@amd.com>
Link: https://patch.msgid.link/20260325155600.4184877-1-alexander.deucher@amd.com
2026-03-27 16:57:05 +10:00
Bhargav Joshi
f17d7a0f8f arm64: dts: hisilicon: Rename dwmmc nodes to mmc
The core mmc devicetree schema expects mmc controller nodes to be named
using '^mmc(@.*)?$' pattern.

The legacy Hisilicon SoC files (hi3660, hi3670, and hi6220) previously
used the 'dwmmc' prefix for their nodes. This caused warnings during
dtbs_check.

Rename the 'dwmmc' nodes to 'mmc' to comply with the standard schema and
dtbs_check warnings. The legacy phandle labels are kept intact.

Signed-off-by: Bhargav Joshi <rougueprince47@gmail.com>
Acked-by: Zhangfei Gao <zhangfei.gao@linaro.org>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Wei Xu <xuwei5@hisilicon.com>
2026-03-27 06:53:02 +00:00
Meghana Malladi
8bafdf5dd8 arm64: dts: ti: k3-am642-evm: Add ICSSG0 overlay for dual EMAC support
Add device tree overlay to enable ICSSG0 dual EMAC support on AM642 EVM.
This overlay enables both ICSSG0 Ethernet interfaces (port0 and port1) in
dual EMAC mode.

Users can combine this with the existing ICSSG1 overlay to enable all four
ICSSG interfaces if needed.

Signed-off-by: Meghana Malladi <m-malladi@ti.com>
Link: https://patch.msgid.link/20260323090358.632329-2-m-malladi@ti.com
Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
2026-03-27 11:24:53 +05:30
Francesco Dolcini
71c2a81245 arm64: dts: ti: k3-am62p-verdin: Add Zinnia
Add Zinnia Carrier Board mated with Verdin AM62P.

It features 1 x RS232, 1 x RS485, 1 x CAN, 3 x isolated digital I/O,
2 x 1GBit/s Ethernet, a mini PCIe slot with USB / SIM card connector
for a modem, USB and SD card interfaces.

Link: https://www.toradex.com/products/carrier-board/zinnia-carrier-board
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Link: https://patch.msgid.link/20260324093705.26730-8-francesco@dolcini.it
Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
2026-03-27 11:24:53 +05:30
Francesco Dolcini
15da9d2915 arm64: dts: ti: k3-am62p-verdin: Add SPI_1_CS as GPIO
Add a pinctrl to use SPI_1 CS as GPIO.

Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Link: https://patch.msgid.link/20260324093705.26730-7-francesco@dolcini.it
Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
2026-03-27 11:24:52 +05:30