Commit graph

1,461,726 commits

Author SHA1 Message Date
Rustam Adilov
40890b5fe7
i2c: rtl9300: add RTL9607C i2c controller support
Add support for the internal I2C controllers of RTL9607C series based
SoCs. Add register definitions, chip-specific functions and macros too.

Make use of the clk introduced from the previous patch to get the clk_div
value and use it during the rtl9607c channel configuration.

Introduce a new EXT_SCK_5MS field to the reg fields struct which is going
to be initialized by rtl9607c init function at the end of the probe.

This patch depends on all the previous patches in this patch series.

Signed-off-by: Rustam Adilov <adilov@disroot.org>
Reviewed-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://lore.kernel.org/r/20260401180648.337834-9-adilov@disroot.org
2026-04-02 00:09:34 +02:00
Rustam Adilov
991cd899ec
i2c: rtl9300: introduce new function properties to driver data
Due to the very nature of differences between RTL9607C i2c controller
and RTL9300 / RTL9310 that are incompatible with each other in some areas
of this driver, for example in clock configuration, channel configuration
and initialization at the end of the probe, introduce new function
properties to the driver data struct to handle those differences.

With these new properties, create configuration functions for RTL9300 and
RTL9310 and assign them to their respective driver data structs.

Signed-off-by: Rustam Adilov <adilov@disroot.org>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://lore.kernel.org/r/20260401180648.337834-8-adilov@disroot.org
2026-04-02 00:09:31 +02:00
Rustam Adilov
f60d27926c
i2c: rtl9300: introduce clk struct for upcoming rtl9607 support
In RTL9607C i2c controller, there is 10 bit CLK_DIV field for
setting the clock of i2c interface which depends on the rate
of i2c clk (which seems be fixed to 62.5MHz according to Realtek SDK).

Introduce the clk struct and the respective F_CLK_DIV and clk_div
which are going to be used in the upcoming patch for rtl9607c i2c
controller support addition.

devm_clk_get_optional_enabled() function was used for cleaner code
as it automatically returns NULL if the clk is not present, which is
going to be the case for RTL9300 and RTL9310 i2c controllers.

Signed-off-by: Rustam Adilov <adilov@disroot.org>
Reviewed-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://lore.kernel.org/r/20260401180648.337834-7-adilov@disroot.org
2026-04-02 00:09:27 +02:00
Rustam Adilov
1211ce1e11
dt-bindings: i2c: realtek,rtl9301-i2c: extend for clocks and RTL9607C support
Add the "realtek,rtl9607-i2c" compatible for i2c controller on the
RTL9607C SoC series.

Add a clocks property to the properties to describe the i2c reference
clock and make it available for all the compatibles. This i2c reference
clock is assumed to be coming from switchcore region via Lexra bus as
the other SoC peripherals.

According to the info available about the existing devices, they also
have the i2c master controller clocks.

RTL9607C requires the "realtek,scl" and "clocks" to be specified
and so handle it under separate if check for "realtek,rtl9607-i2c".

Signed-off-by: Rustam Adilov <adilov@disroot.org>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://lore.kernel.org/r/20260401180648.337834-6-adilov@disroot.org
2026-04-02 00:09:21 +02:00
Rustam Adilov
6afde011ba
i2c: rtl9300: introduce a property for 8 bit width reg address
In RTL9607C i2c controller, in order to indicate that the width of
memory address is 8 bits, 0 is written to MEM_ADDR_WIDTH field as
opposed to 1 for RTL9300 and RTL9310.

Introduce a new property to a driver data to indicate what value
need to written to MEM_ADDR_WIDTH field for this case.

Signed-off-by: Rustam Adilov <adilov@disroot.org>
Reviewed-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://lore.kernel.org/r/20260401180648.337834-5-adilov@disroot.org
2026-04-02 00:09:14 +02:00
Rustam Adilov
55284a806b
i2c: rtl9300: introduce F_BUSY to the reg_fields struct
In RTL9607C i2c controller the busy check operation is done on the
separate bit of the command register as opposed to self clearing
command trigger bit on the rtl9300 and rtl9310 i2c controllers.

Introduce a new F_BUSY field to the reg_fields struct for that
and change the regmap read poll function to use F_BUSY
instead of I2C_TRIG.

Signed-off-by: Rustam Adilov <adilov@disroot.org>
Reviewed-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://lore.kernel.org/r/20260401180648.337834-4-adilov@disroot.org
2026-04-02 00:09:11 +02:00
Rustam Adilov
98773df61f
i2c: rtl9300: introduce max length property to driver data
In RTL9607C i2c controller, theoretical maximum the data length
can be is 4 bytes as opposed to 16 bytes on rtl9300 and rtl9310.

Introduce a new property to the driver data struct for that.
Adjust if statement in prepare_xfer function to follow that new
property instead of the hardcoded value.

Signed-off-by: Rustam Adilov <adilov@disroot.org>
Reviewed-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://lore.kernel.org/r/20260401180648.337834-3-adilov@disroot.org
2026-04-02 00:09:06 +02:00
Rustam Adilov
4c53b2eb4f
i2c: rtl9300: split data_reg into read and write reg
In RTL9607C i2c controller, there are 2 separate registers for reads
and writes as opposed the combined 1 on rtl9300 and rtl9310.

In preparation for RTL9607C support, split it up into rd_reg and wd_reg
properties and change the i2c read and write functions accordingly.

Signed-off-by: Rustam Adilov <adilov@disroot.org>
Reviewed-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://lore.kernel.org/r/20260401180648.337834-2-adilov@disroot.org
2026-04-02 00:09:02 +02:00
Arnd Bergmann
9ac420358d Renesas ARM SoC updates for v7.1
- Use the of_phandle_args_equal() helper.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQQ9qaHoIs/1I4cXmEiKwlD9ZEnxcAUCacZO3wAKCRCKwlD9ZEnx
 cAb8AQClL+qxUrQcT9Yd+1KhMBfBNY8mLr9raw5SJF+CmwowowD/ZzRj0El5bMb8
 d2GrXJgUKsXFmbR3FuGfONgbC0NFDg8=
 =1NQY
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmnNlYoACgkQmmx57+YA
 GNl2Cw/8CElIRP0EWlMOlK4uZXOA4S5umcpFOeTaS0+XqyiVvVPJdnTEDdHeQvf8
 gtQaik1jxAMD1dSSwack16pmJYkzi3wszSsSm9V8HAgKKaqENMP66UlJBHi5RCKx
 S4Pk5sGlMyTXVSopbKv6uJ4Z7cMJMGTcZWnVdmAYyWqV+kEkxGMHXo6OU5DQQE8r
 V8/Mr/6ttdKd7c1DxHdIPcKYdOfCLqmF7tx/PsdrM/lLLoZQi1RCVDA3q82Cywli
 GoVfwOOIUm7ljNWv/xE6Wt/h+k53lJDWnVRkeisxIM3C1sLfnNRM4rYz0d0cBljJ
 sno3j8iN5p//qpXwxAyUqobl/1TcE582oD7nbx6rsPq7/K8jz7Vav48Nv2U48kvx
 Hr3cBupViWcIR8Qm3NxvjjC9WMFJzVVMew5LCRsh2pA+dL/HXJn2gCHcb9p7AQ6F
 fvTcHt4DpoOploj4vlW8o0wDczXjGZKe117fsLUYJ9V3kSeda9kIOF7yD8aw1I8N
 XwjLXqLwQfp4moiQsIFhI6FQs/eHveYvLmaCe18mzL45PN7SBm3znNQ+wjj5QKYE
 kUprrVtHeJKURLrUrOGaZc25XYcILR12nMRcBBYZwqRERwimnbNdgc9uH0fv3GyY
 +A0H0di158ThkOTnMqdgkCm3JLjAEv3TokpaFWnpxVg2gQoMTg0=
 =Xypy
 -----END PGP SIGNATURE-----

Merge tag 'renesas-arm-soc-for-v7.1-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/arm

Renesas ARM SoC updates for v7.1

  - Use the of_phandle_args_equal() helper.

* tag 'renesas-arm-soc-for-v7.1-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel:
  ARM: shmobile: rcar-gen2: Use of_phandle_args_equal() helper

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-04-02 00:00:31 +02:00
Arnd Bergmann
23e4b0532d Samsung mach/soc changes for v7.1
Fix booting of secondary CPU on Exynos5250 based Google Manta board -
 difference in TZ firmware.
 -----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCgAuFiEE3dJiKD0RGyM7briowTdm5oaLg9cFAmnCh6gQHGtyemtAa2Vy
 bmVsLm9yZwAKCRDBN2bmhouD1zU2D/0QTAYrlF/kBBIXB8kKPcO6DWMFoQu3MUhg
 bjXSfkpHU9hPykyvm7+k33zfISskfHsormFvF8RH87rBTTAjojzorD4uu/SvmNbA
 DeVeeNkNIHP55jtdj9d4vgBaGaOLU2Pvkz1zof6/udown6wH+mDWDttFBTiY0r60
 26VDC0dVSUVnRWMW+fUkKjJdUefj4KSjcA0ZrpFEnOaDPIdC7BSUCY/XPYXoth41
 un6BDF7JBGOXQZe4qiFFk4RFCJT1M2d3odA838be0XHITs6zdsjFNfGBWEjJuI5Q
 MavacV7aRld4cCwEIYHyqBkwkb2f9m3S90tEH7GO1LrTw9bb3HQdSZhuLm/z9pr9
 22m1m1aNsiPF8XoHq2avskBkXDgI5GL4VDOMMYQIeMlGV2wTZeuZMqUNWIUZoqN1
 SOPuszcSmV3DFAwiOzXo6WTZ+efTh0zPSfPjSI9OsXPDHEIcTArU41tLkZCsZdKx
 7Mfke87lMLSnafx8BVfjYKm4BTyXT9wTE0kDJy4xoA67+92z1yxWWJJH+le3+siX
 NYXAcE0iZlXS2bL1u/ofxjCh/mB5YvYH9TJDMM57p7UdIjh/7QW68n+cuuNJadDJ
 KyawCq7DyPlAMkaT6CsYuQea3M7qLDLqwxLXfDqUJ3H2a/i6wp4c2pOrkXenk4xz
 PdBU4+BJVg==
 =DZeH
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmnNlUcACgkQmmx57+YA
 GNk13A//ab3JC5TKmlgkS2iSXdvbNUlhtCu3WvfpYzeel4hUoym+aM2UEfSANlHg
 iimbzdBh/9tIYDNqptHC1+XjvaqMlT5jghres+RPE4FEitw4LojjV5KXAMr2QmbC
 XDdNfcM9nahntMgh0Joqu1/QEuWXoTSC3uA+iMvfx9k7TkM8ygbHPRe0wUCJZmIN
 bq4i8AFm5hS9WM0pntqMN6vJgRF7dgvb7zLGWGVSthg9nb+ghP1AHuv0cdAR1UPT
 1Tbqpx7yylFaOMdSEwr+gpe80NZlUllOlC/98FaA2E3rTz3rqvHpVJVOlIUdEViW
 EicIjsPk+okWAE1m5DAR4OlyYdjwbNUn8MShRCmS7tiuCJU2UPiZUDikufcHlDMr
 R/osvJHcvCzVO/mO67vhfa6l8/EFHig7H8SGTFrMgiIsWrqsexGonwWxwprk51iR
 9BtHAgMmo1GqPmg8r6zx0mjB9wyXH2F/s9aCp+wXnjvMf/31dKXWoPBdgHTaxdBc
 3CP/sKfT9cxInE7StM9/JQRXlF0Gxmn9aW5bR9EwMFiOY2XLSJpayKfOyFRr02aF
 1nttmjQUvsVAm10TqEtT72yDpKxjpCtYfv4VUjXQquJrCTnfs5t6lIqYEn48Gsku
 yVl9Vx3HH0e6Du/N5JNwOSdWltMpOPWa51YYv/OAzOwP3hWYAhI=
 =iNBO
 -----END PGP SIGNATURE-----

Merge tag 'samsung-soc-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/arm

Samsung mach/soc changes for v7.1

Fix booting of secondary CPU on Exynos5250 based Google Manta board -
difference in TZ firmware.

* tag 'samsung-soc-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux:
  ARM: samsung: exynos5250: Allow CPU1 to boot

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-04-01 23:59:32 +02:00
Arnd Bergmann
84a5fe2ee0 i.MX SoC update for 7.1:
- Updates MAINTAINERS file to include i.MX team coverage for ARM NXP platforms
 - Sets default values for OPACR (Off-Platform Peripheral Access Control
   Register) in the i.MX AIPSTZ bus driver
 -----BEGIN PGP SIGNATURE-----
 
 iQHFBAABCgAvFiEEJS45w2QNr0ezLVaoNF3oRQ23YkwFAmnFk5URHGZyYW5rLmxp
 QG54cC5jb20ACgkQNF3oRQ23YkxWxgwAyKOXAFEb8nD9qGmOvd+dsopZ91ZZLCun
 lqBDWz0B+IpPFGwO7NzpWjEcyeMJWAPpKzmRtaSETrCEymoIISm87CgDlrTsRTKi
 THLFk3fh6vT0JDCu3RzqYW4KLdb29p7ejVqcCzqcyAP5IjX1AN7HuBLI7Qd1CaHO
 tfU6+STyFrkRrMQv2y6ce04vv4DNWbnDSv7Z3/1lsk7s4VuQMS7yDPsL7k75t+Wo
 fqRu3nKBMok+XWtxHHaE04zZNvnQcBbY7FSR8XGhNOlSDv2l9rRxh4rlcFvpum4Q
 gbzqXa4zEmczZtn1c7YcP5ieMHGPrEuM1xYXi6k9io5xhD/4UIG1Q4jNTeZMw/vZ
 pjqnqNFeqMyy8ZcclYTvcUN0Mwqt1h83NsgD4qsly9Ofl8Q59BA58ZYJvOUjJ7wn
 25yKDB3WRClJFGhZnfAQG33yGt2xMOXjuV9bC7byWx263/WM0P5ll77YOneansj1
 2DA9kjss2QrrRVryeVpuZpnc6iRDIwNl
 =/y4n
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmnNlIsACgkQmmx57+YA
 GNkf2BAAmExEqG510/98TAphhmDr2X65Gg4aORXfl1S4R3FUAvcU7ExCy05H7O1b
 PJmZqT0Wm8u9F/iGQjl8dOkO/kmCVBaNvrJOwr72yOwqxNsHJrKYFz872sjxM96s
 k1UMOq/aSe5xCz5bKWsXHPJMAMYald7Gbr97gsvwmnqngzTJzMSdAGLO9WCT2fn7
 pR+Ombdrz57d2CQ1XBs2xadD3uRNok2uuh4M+dVQqDUf+UfRWuTyu/5XnpSO7vNr
 zd105nFar/b1eiJA0DPtibnhUNoVG7QA//AoKC1TpEq1yz2kgmVGjWSVzFZMnfKz
 KaAsB/tDE/2MwGLfJuDHsLR8DLlTYEK8F2ICb+lG6EWS3MlP4C2SjVhKS89iUNXj
 rzrptW3iC21c4KOAKZRDUL4GnRknST4Hv0kJb/O6FEzHy4bJxm9RNlbZf5xVXuad
 2zlDVhg6gINZHNunIZPwjaR38KTIikzcvrwHnySWhRAQzbPguCpgzYTiZ8HotSkN
 b2iOTuFHQSAK492ECxJLCdVP9Od+7Wlh5V3+JW64KdKxtmTzCNw6DWv6OcZsZAyl
 OdkMgRWOwLzPBvDyiA9AlHZRCdUQz8d85bbaTnVePVOYfzMtJW2yzfRS/iqpDU4C
 ToXEtQFs9s9/7/vh92npAYaTP/ojxM2bGGgaDZgmeOAx3dSzDaU=
 =omNE
 -----END PGP SIGNATURE-----

Merge tag 'imx-soc-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux into soc/drivers

i.MX SoC update for 7.1:

- Updates MAINTAINERS file to include i.MX team coverage for ARM NXP platforms
- Sets default values for OPACR (Off-Platform Peripheral Access Control
  Register) in the i.MX AIPSTZ bus driver

* tag 'imx-soc-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux:
  MAINTAINERS: Add i.MX team to all arm NXP platforms
  bus: imx-aipstz: set default value for opacr registers

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-04-01 23:56:24 +02:00
Jan Kantert
879766b58e
i2c: rtl9300: add support for 50 kHz and 2.5 MHz bus speeds
Some SFP modules on certain switches (for example the ONTi ONT-S508CL-8S and
XikeStor SKS8300-8X) exhibit unreliable I2C communication at the currently
supported speeds. Add support for 50 kHz and 2.5 MHz I2C bus modes on the
RTL9300 to improve compatibility with these devices.

Signed-off-by: Jan Kantert <jan-kernel@kantert.net>
Reviewed-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://lore.kernel.org/r/20260227111134.2163701-1-jan-kernel@kantert.net
2026-04-01 23:55:33 +02:00
Arnd Bergmann
78b06e0a76 Renesas driver updates for v7.1 (take two)
- Mark remaining rz_sysc_init_data structures __initconst.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQQ9qaHoIs/1I4cXmEiKwlD9ZEnxcAUCacZPdAAKCRCKwlD9ZEnx
 cIa3AP9jldP6tXheBHg/dEUixiO8ce+GUo7yqr6SqUPsoGidfAEAnwSHOmzmjKSY
 6fr2V4QLvQHII+sb+PlSKncwvZ6zdws=
 =jd3A
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmnNk7wACgkQmmx57+YA
 GNnYow/+LQRUo1LqRLmk5degpqhgQA3U5FDcxuDHkbyRDEWjSIN0OuqaTQx586oa
 9RRNvy3YRlZULseIp8PBzMYNJP3TjmfRnZd1wGjErnpxU3WJa8PF4QQIkZWVHcZU
 WQZhlkYxCksqE+1879gJgzC0+vy7Mp5VJdFdBhptmNv5XOjFK6tVfrFDRdpo8MgV
 8Ww6Grj6XDIdBMIK+C+NAKJG5V6K3V5HXgTPg9jCrxRYu0LayNneYSdfzRS969So
 m2XrnZk7mSbUtb5xs+XpCdK2tQhj6zbx3x6czxAn9jI/8oh97GsRLQmUCs+HgvrM
 BV4PIKH+QBqsKKTGfHoTVVLjXHNIHrz8z7r5DfVFuVfkXmjaTlrsemt6U4RXJpzT
 xxUppC1KlDw8ARPfjAETtyyVKbfBGrAl48LTkDTWgZmOSj2Ep4zKPvZlaBARo++S
 4BawpPHvLPBZ3pYw5TJ7UG320xd0Xg90RmRwcb23Gu51EtlqoIHlAlCEcSAZuhd0
 JfeZUi2Ho0B4vqqciugHe00GjZpKg+OZG60LmffBb9UyUpG2NQrqSSKwHeTE1Bxg
 gwWiSBMUDacopK8sYx1JTafelBQww8bBaSlji6w9HeoHak9Jib4KnWFLimrWHYpO
 DKpBw8aliux25G0VqnbFBdZUqc7USvEI0JOHedpMe2lo1IZ4s5o=
 =+/O0
 -----END PGP SIGNATURE-----

Merge tag 'renesas-drivers-for-v7.1-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/drivers

Renesas driver updates for v7.1 (take two)

  - Mark remaining rz_sysc_init_data structures __initconst.

* tag 'renesas-drivers-for-v7.1-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel:
  soc: renesas: r9a09g056-sys: Mark rzv2n_sys_init_data as __initconst
  soc: renesas: r9a09g047-sys: Mark rzg3e_sys_init_data as __initconst
  soc: renesas: r9a09g057-sys: Mark rzv2h_sys_init_data as __initconst

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-04-01 23:52:57 +02:00
Arnd Bergmann
95ff410d15 OP-TEE update for 7.1
Simplify TEE implementor ID match logic
 -----BEGIN PGP SIGNATURE-----
 
 iQJOBAABCgA4FiEE0qerISgy2SKkqO79Wr/6JGat8H4FAmnGgx4aHGplbnMud2lr
 bGFuZGVyQGxpbmFyby5vcmcACgkQWr/6JGat8H6umBAAucz456oX9sVT/8VEp+jU
 E92lFEH69o46uvF2ItzBrlo+U1K2ylECOUytexiaiPCz4XW7uSACOEARUOypc15x
 0NSTZC+P048kcDka8mpSdeJ4RbkA2qk8wQjOJJvILBAwjZsFCwczkhNRANGg4GxS
 G8CkT2m9n6fxwNgsPuxlah4+ywQ7DQyG4JJ+HYQCDuqZ+T76a7o15NVYiKMYN9de
 W4Xe71ZIPubGkK/K4Cb4FTo8OAHe1jLnFMtTfWq+p4RDO5GCHyHNw4X4thZoO1GO
 3RidNfK5AJS2r761mU+YYRY74gfilZsRYaGZSi9xHlKQRoUoCT6RlwJ/UgwIJMvp
 uInPHgAwIo8poaz9UOsqzrEALpLXWWf5evLNQsL9OjVfQDLPTzwTKPm8aZHnqmK5
 3JYEBpAkz7gjKr3+xBOL3E6M2JTkxVF2bTD8ELPc2wH8D0mKdPv15NGN1qUBHy9w
 PT47yYdJ3/rSdCTqzczbI8ebTdQhNdi8feATD2TNy++vrsy/srzxtCeI/stjqmME
 6k0wE3wRr4L16sfCYjEeHUunsqZEnQ40NZNGN5t5Ktio1tlQPlmycZNT8/kBQxfU
 XrcYRKVHJfVp3gp8FpOk4I8woTc6S78uQoccqKHxT+jIyfXHk19tf+Pot3W7pl+L
 B8oG4cu+CxMlquggU6aG/i4=
 =tXqq
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmnNk5QACgkQmmx57+YA
 GNneVQ//e5D0/A+YL/yFR2rshZ0z6HqabYk5GugwCF6IJ3TujnQ4bebh3LhkE4w+
 UCY0RqugD7DJnMrBqSOB9P+bLk2GVg9ZOT9APUHec1Qc5Z6Is/VuQcUbhMMSROdn
 vMv2VkHxA2yYNLzvRROQf51flWD3Hoo6Gkjye/gI0GEU96bJ9G6BjO9884TjnNfD
 jWFAj7iqSwM/a9HMhd6EzxZSZe/0A80AwKmdY1pxi/6q7jxqAiAG5daqkUvp9tXU
 fOD7YcZymCVTufjffzkc686sVSmud1PMgUBOBNLEmi9vvKmLxk8WWWRmurqP8yyC
 SWPE4LqOlwVCYeGhYMdKK7dIO0ehzig0RXunUR66lzlaWJQxs+UTjAgocV7X6kQu
 cIEi9HgTQmLyGXl987eVDx7AZI1WDYwqzxfvJ0wS4tFbu7HwjKCpj2JwaJaEH8J7
 vEFXUA7f3kQ9HUkG9BIrJL3UC7HdfFfAnzgiiEPRi4ZP9xhq0MmyRIWetPne4gmI
 9udHJbjdJ0/+1pQLm45szqaSJvcqV23f3BiOfHT84XkekOzMpcjq/Hxj5DccfSN0
 8XiDr+stshAPasuESPiBRw9DmS/IlKi+YWTFBOFoATu1HYG3Xw89cfgPWEMK/NpN
 NpnrO13PZYy/KtX5vIIU76S/Dd9A+1dUQHadjHkAkPI/Q6K5Jj0=
 =8g4u
 -----END PGP SIGNATURE-----

Merge tag 'optee-for-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into soc/drivers

OP-TEE update for 7.1

Simplify TEE implementor ID match logic

* tag 'optee-for-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee:
  optee: simplify OP-TEE context match

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-04-01 23:52:18 +02:00
Julian Ruess
ad6ed97f8c MAINTAINERS: add VFIO ISM PCI DRIVER section
ism_vfio_pci is a new kernel component that allows
to use the ISM device from userspace. Add myself
as a maintainer.

Reviewed-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Julian Ruess <julianr@linux.ibm.com>
Link: https://lore.kernel.org/r/20260325-vfio_pci_ism-v8-3-ddc504cde914@linux.ibm.com
Signed-off-by: Alex Williamson <alex@shazbot.org>
2026-04-01 15:51:35 -06:00
Arnd Bergmann
d752790a4b TEE update for 7.1
Clean up tee_core.h kernel-doc to eliminate build warnings
 -----BEGIN PGP SIGNATURE-----
 
 iQJOBAABCgA4FiEE0qerISgy2SKkqO79Wr/6JGat8H4FAmnGgZYaHGplbnMud2lr
 bGFuZGVyQGxpbmFyby5vcmcACgkQWr/6JGat8H6yOQ//REPB4USw/k6NQOzQNsgC
 mLYX7SLbZ/EwcjxJQ9poZ6NwDB/NT6itA2m9m909rvFyi83jSGZBlTs8ma7o/bIf
 cUrfv8ooxOrVaX6x9oSTO/8rqEPj0rd67wqebHXXclQrpRFrBU1PXxw8NDhblw6J
 p2dHhKRqQPETmEiFFCjebLkAZ7Qlsi4Vz49uxDM3DIAc2KVpXR0dWwDpjggBf5xH
 PBgGIWk3CKYC5jh1T1C9ftznRm/vKByl4GK0+h7JNaq7/THOGyQqwIZErGqFvgyV
 kjAkoN2JS7BPsNvNpBktPBQ8SmKssND45iXkxOnpiRtLVhe0UiMfHjhk8Ebv1412
 WXcSzvQ3nVm7jSQpOETosioEk+pr1dWZAGIEnlFBj4RzeaIOaIMf8vLkSusOU3m9
 43un0KwvvFvUK+/xjTJ/DyQNj5qKaZVW8nJgzZTkUQDE79or8eKbcsmvKlIvyk+z
 1HYY3/HGXdSA1Qj2LedfcoAjAZ+4zDn70KGizA/LSuovWSR5CIboB5uercSgFU4K
 +C3JMzK5OxKx1Es8akZt8+Qs+XiNoLwyVsv8gbwNIIPUW1epjNzEDrSm14APH4Il
 ZHVxsN3oTI3pXOkW5xPhV9C0TznvJ5E76Lv/7x7+JuagwmVeonQCB+gWKrJ6F/sQ
 tXk+Y0OBleo33HRW8oginbM=
 =i/KD
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmnNk2oACgkQmmx57+YA
 GNlhpRAAvlX7zj4nE6QWv0KJV5q1FyIvm24OPUq6hVZCzigkYsftM7TYTRS8IFYU
 Q7GAeSwQRbNJK8NPW0MCKTM65cyVGsOuG/LHsZnEeyDcV9Aj+B4v13ys8CORJazv
 N3FGqLkhqBY6Ji7YEqm4nWF2UJrFA4WfdSoiav/Nd2Fdmn6VIwaYmr5CG2URoKA1
 mHO8/neKTVqGyFuF7igyN3ei3e9oEAyAX15nceSls+3tNnMI50MjVol/66sUMbvE
 4ZXeajBDCfT5aPl6htzb2y+IgRaCZ6P/FCH8Vl5FI2mgz8mvaXaZ5mhf98sES8EF
 hZIUgolEhtrmZ1quNjFufstR+FNDxYEocp32flxiUzNHYTDaQSONP68jyhnmWqNU
 HL/w/iRgA+LuqHnX1fWvMhoT8qIYt8PUvXDp11u+pxMKuiHHtLHXz3wfLHEOYTAM
 mcWq+fkc1WFadTi2GkPy8t/glrrsiqAMX+IsLnZRZ37pjRAqTNYfCq0JsLHoWOP4
 +YcSWWnntEjD58o0s5UwLwees1djfJ4Ww8GwNkc6XpM0rwy178G81x0LGuzdUVWu
 0v5Z9Sd81R7bND//DB7CMudw9ZNpSePRGM9jjl1FHdZv8KsBwRFe5m1MALxggVnO
 K/lxlUi3j62ukALmIC/SsYDoXmtT3VnSBzT8Qfv2WiLfDlwOmmM=
 =6X4n
 -----END PGP SIGNATURE-----

Merge tag 'tee-for-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into soc/drivers

TEE update for 7.1

Clean up tee_core.h kernel-doc to eliminate build warnings

* tag 'tee-for-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee:
  tee: clean up tee_core.h kernel-doc

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-04-01 23:51:34 +02:00
Julian Ruess
bf4197be96 vfio/ism: Implement vfio_pci driver for ISM devices
Add a vfio_pci variant driver for the s390-specific Internal Shared
Memory (ISM) devices used for inter-VM communication.

This enables the development of vfio-pci-based user space drivers for
ISM devices.

On s390, kernel primitives such as ioread() and iowrite() are switched
over from function-handle-based PCI load/stores instructions to PCI
memory-I/O (MIO) loads/stores when these are available and not
explicitly disabled. Since these instructions cannot be used with ISM
devices, ensure that classic function-handle-based PCI instructions are
used instead.

The driver is still required even when MIO instructions are disabled, as
the ISM device relies on the PCI store block (PCISTB) instruction to
perform write operations.

Stores are not fragmented, therefore one ioctl corresponds to exactly
one PCISTB instruction. User space must ensure to not write more than
4096 bytes at once to an ISM BAR which is the maximum payload of the
PCISTB instruction.

Reviewed-by: Alexandra Winter <wintera@linux.ibm.com>
Reviewed-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Julian Ruess <julianr@linux.ibm.com>
Reviewed-by: Farhan Ali <alifm@linux.ibm.com>
Link: https://lore.kernel.org/r/20260325-vfio_pci_ism-v8-2-ddc504cde914@linux.ibm.com
Signed-off-by: Alex Williamson <alex@shazbot.org>
2026-04-01 15:51:21 -06:00
Arnd Bergmann
033d5c6cea HiSilicon driver updates for v7.1
- Fix two compiler warnings on kunpeng_hccs driver
 -----BEGIN PGP SIGNATURE-----
 
 iQJJBAABCgAzFiEEQeMYD8qOQTc1R/snC8hXbtmJZlwFAmm+PXwVHHh1d2VpNUBo
 aXNpbGljb24uY29tAAoJEAvIV27ZiWZc/7UP/R/5/KB/m8d3icwQvxu2gQjUYWWy
 7YO6KX3tveMg1xOEBpNznwY7ObEqLGUsgGcgoUiIaYwR/DOfAkV00bDpw1GoAE+O
 SmZq4/NwjP3TFdykM5mS+p0NzPj9UtnTFM2EjA2Y3KA4TSqM/YBpceHNQOztFw7J
 zEMPC/FPTusZzHg2ZEZnjmEhCgHF5p3OMpeqamxL6eti7vOppclax5awlLPKbfHW
 GQv5KkF9x0g6oi2+/oNLdgaI3ZVKeCO+48Ds8mAQOFktEynMa62IDedgooreh61m
 SiAWDpGFFMVC0rBevZDlDgCTiSgh1m3bgN17T9pRCTrLHwik2GRqufU95yjjhZ9w
 6MgPuGtiHgzAdxUuB2LMriOy9GodRo6dbJ+bth21g1xDdo/KxXg1Sm9Rqrp90XwX
 8dTK2/fLlqBe/B3g3yQx9h6IWspB/ETo5JmtK3H+7afkhhkQN/iHc7NCMbjM0vLz
 GiFxZ5lDrdQfkN9OCAbhJhhYenrXIEOMHuocw/PMSOUpyMskcGGrRcu/ZVhDtn0p
 vV/YRdZMFgxHGIdKWo97ubAnMfl6DrFVK2wEDqBknh8W1V5TH5BqzAB7/VLBCycM
 ULiR1cpyeU0jhGk3Fa5ntUJ98SXCDfPqB50rJthxEsmvO54Gexg7Y8aTGHAIneC2
 N8z0qi+5jr4CtVx2
 =wRln
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmnNk0IACgkQmmx57+YA
 GNkZPxAAjypsXNR+S5/VmtTwtXwtdT5qzaOCG/vzBE/qjuBfDdHnbWPcmTFzCMiF
 2ghDH3ibHC1xe4zMBEoz1E1NyXSMdJ2OxuPeJFfJX3O3lY9vRCIPFWxbje0FCbRi
 i61jVd9LCzZa4OjZkl1+DgMdDY+qQg+68LQzrSh+OvhiyrWNRuU2GX4T95rejlCi
 KvD9fiRnX1I/fqPBmpgrcrrrAdX0MRqhmoZAfMbgKZyXg1w9+ZvnoOLszdhPTar2
 nNZIoHPqyo6FaYv5iMU9qRXV8vhgaHoK9XOqquPau7VQgvvqzKVCKAfZeoKf7nn2
 3ayGHlVytMCX6FdhWKRxJR0Fph1sjQcHk84mYZHD9vvNvkIoP6ZAPhqBANzYSzPy
 baJ4Yz+ngwsFf5nzJtjGe0Cs3jQUuVI1IDYaa/BuCmDdAQgW8ljO9+F+pgqcT3xA
 KykIV7ogqLpo8FdqpOhOvKBxLvZaQn2SsoNHdAnPyDzC1hThseQ/lkH0kNGfC0TJ
 H4NKQ7JmmxfXe/Mlj9jyF+zj4bsFyFEFLqmad69//pBSvIi8g22Ymb07uu+lhM4c
 y0nP7e53JFE/JaZnq7ocSi9ZMJCHKdi7bvjfXLWFyiVKX6g93agUTBTDGY3quLG3
 JVnpJ1OzdPEuLblyBg9iGQSyrOFLFAX8xV7uEKbH3BhdmtB1/xc=
 =pWw+
 -----END PGP SIGNATURE-----

Merge tag 'hisi-drivers-for-7.1' of https://github.com/hisilicon/linux-hisi into soc/drivers

HiSilicon driver updates for v7.1

- Fix two compiler warnings on kunpeng_hccs driver

* tag 'hisi-drivers-for-7.1' of https://github.com/hisilicon/linux-hisi:
  soc: hisilicon: kunpeng_hccs: Remove unused input parameter
  soc: hisilicon: kunpeng_hccs: Fix discard ‘const’ qualifier compiling warning

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-04-01 23:50:55 +02:00
Namhyung Kim
d9db9c8db5 perf test: Fix perf stat --bpf-counters on hybrid machines
The test constantly fails on my Intel hybrid machine.  The issue was it
has two events in the output even if I only gave it one event.

  $ perf stat -e instructions -- perf test -w sqrtloop

   Performance counter stats for 'perf test -w sqrtloop':

         910,856,421      cpu_atom/instructions/                (28.05%)
      14,852,865,997      cpu_core/instructions/                (96.79%)

         1.014313341 seconds time elapsed

         1.004114000 seconds user
         0.008174000 seconds sys

Let's modify the awk script to add the values for each line and print
the total.  The variable 'i' has a number of input lines that have valid
output and variable 'c' has the sum of actual counter values.  That way
it should work on any platforms.

Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-04-01 14:50:53 -07:00
Ian Rogers
9b6c479c5f perf tests: Write test files to tmpdir
Writing to the test output files in the current working directory can
fail in various contexts such as continual test. Other tests write to
a mktemp-ed file, make the "perf script task-analyszer tests" follow
this convention too. Currently this isn't possible for the perf.data
file due to a lack of perf script support, add a variable for when
this support is available.

Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-04-01 14:50:53 -07:00
Ian Rogers
83c338369a libperf cpumap: Make index and nr types unsigned
The index into the cpumap array and the number of entries within the
array can never be negative, so let's make them unsigned. This is
prompted by reports that gcc 13 with -O6 is giving a
alloc-size-larger-than errors. The change makes the cpumap changes and
then updates the declaration of index variables throughout perf and
libperf to be unsigned. The two things are hard to separate as
compiler warnings about mixing signed and unsigned types breaks the
build.

Reported-by: Chingbin Li <liqb365@163.com>
Closes: https://lore.kernel.org/lkml/20260212025127.841090-1-liqb365@163.com/
Tested-by: Chingbin Li <liqb365@163.com>
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-04-01 14:50:53 -07:00
Arnd Bergmann
dc26ea325f STM32 Firewall bus for v7.1, round 1
Highlights:
 ----------
 Stm32 SoCs embed debug peripherals such as Coresight. These peripherals
 can monitor the activity of the cores. Because of that, they can be
 used only if some features in the debug configuration are enabled.
 Else, errors or firewall exceptions can be observed. Similarly to
 the ETZPC(on stm32mp1x platforms) or the RIFSC(on stm32mp2x platforms),
 debug-related peripherals access can be assessed at bus level to
 prevent these issues from happening.
 
 The debug configuration can only be accessed by the secure world.
 That means that a service must be implemented in the secure world for
 the kernel to check the firewall configuration. On OpenSTLinux, it is
 done through a Debug access PTA in OP-TEE [1].
 To represent the debug peripherals present on a dedicated debug bus,
 create a debug bus node in the device tree and the associated driver
 that will interact with this PTA.
 
 Plus some fixes.
 -----BEGIN PGP SIGNATURE-----
 
 iQJRBAABCgA7FiEEctl9+nxzUSUqdELdf5rJavIecIUFAmnEEb8dHGFsZXhhbmRy
 ZS50b3JndWVAZm9zcy5zdC5jb20ACgkQf5rJavIecIX6EA//bOrRFlKpMFFTWuKB
 ueVMShipitZ0rwEz8zyCfNfKZ15hIASVb1DrnnW4RK68Q2zbuE3ZG373TM4Q7InA
 GiX4fqW2LMaJElHAzZA39bjgrvtvfyDBc/LKokbJO53HiQFrwFDfzsoTp03Juo5z
 +hoQcQaHRef1HSwJR2puj23oNYnGDxhoqUEkUAF/RQYQk32im5MUNUNSstXrKac0
 lL5adScbHdQ6YmhQ4jB/mQw9kWBEdSpC/HB3S/rbBSveGRgL2kedLnhr3z9kDbEE
 YnikgpR8LCPfwzp/bXMCRdr4eR4o8IbzzTpV/ZY6PBlKJh8DM9wM/zz+mx4AZ8ku
 g9uQpxUZp65N1We19+fsAylP50m3dnwbvite0gyLffjjWz/kc5N3FWQOcl4pIrF5
 7l1EjkbFkDAQnaec7a+OZoUd8Xw+KAd8nSBtAzpQROspxkTxmPd3gQxuAX3U3xn3
 FBYO9hSIWQ8VTMaC0bHABCybuNTBHehE20AlQBP26SA+RfooCHq8aEIqG9/J8UJW
 x9Sqja1CMZ3/MnLMbz8cmrR26GZZPDnwgErpH9mxHIUDEMaBaxE7M/raURCALkY0
 qiOJNzXwYySEkPIHQ/b8VapiKE/v6lij+XAQWk6LyVKMOu2LD0n3Zaf+tUmEc/TF
 Df6L0gSS/YOmuEe2yHSYji8b514=
 =f7UB
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmnNku8ACgkQmmx57+YA
 GNm+3BAAogWy8Imbks8fi/3AZPwMx3fbCG5Pk92ObuXGP8a2u6pbuFTMah1ZakWD
 1jeHK+Z0LUwsS9N/YQ8CpgT5cgklF7RZUcUDKQqTQMhFMzyBoVFJChdMHxHgmajx
 XD/2t8bC5EfwytnLbfeOqaYB6CpdikA6cMlLA8pJzggD+g5zHWvGIOvfYqVCe9KE
 /XO1f3yuXB2oXShml+pdEuXzuqBd87lxpS+9sD+24AcBNzpPbZ2P3Nkubn8TEJ3K
 AtPF2vAB244YLTFOjXOGDUbIOrr2duflUSw3sNEziGrNot+l+DbD/+tRCs8zeIvx
 N5Q6pyXg6AR+oNcdFW9s3qxn5DCUedIdkNHIF0EXjVqcGdu9/Zxmu1IlnAmFrBy3
 vOOOMgWCkbMB+bvtApdhzvhmiVuNxCuTesp2QdTxg9jbfXYUaMfzwoAf4L9uAYQT
 ZLzulpYjkR6xAKD5MJJSn9e58Ut01FLEdomY39f069VIIPMkNvjec4P/Ll1xrSaj
 rS6ni8VAGZwbD+Y6PuYXo4t+D613AzHx4VkaePpRXbihAUOhmuJ9h9p95egNxi+9
 MRVVjtq7DJgJ+BwH/QteCmvQrqu1lkMoWpHxDQJwkBDgWDU1+c6RnvHMibwq5NX1
 Ribleap9ANiMwZhPWrWIaH/wBxOanuL74SWCUvWKlCuyjLG3ITw=
 =gD+b
 -----END PGP SIGNATURE-----

Merge tag 'stm32-bus-firewall-for-7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/atorgue/stm32 into soc/drivers

STM32 Firewall bus for v7.1, round 1

Highlights:
----------
Stm32 SoCs embed debug peripherals such as Coresight. These peripherals
can monitor the activity of the cores. Because of that, they can be
used only if some features in the debug configuration are enabled.
Else, errors or firewall exceptions can be observed. Similarly to
the ETZPC(on stm32mp1x platforms) or the RIFSC(on stm32mp2x platforms),
debug-related peripherals access can be assessed at bus level to
prevent these issues from happening.

The debug configuration can only be accessed by the secure world.
That means that a service must be implemented in the secure world for
the kernel to check the firewall configuration. On OpenSTLinux, it is
done through a Debug access PTA in OP-TEE [1].
To represent the debug peripherals present on a dedicated debug bus,
create a debug bus node in the device tree and the associated driver
that will interact with this PTA.

Plus some fixes.

* tag 'stm32-bus-firewall-for-7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/atorgue/stm32:
  pinctrl: stm32: add firewall checks before probing the HDP driver
  drivers: bus: add the stm32 debug bus driver
  bus: stm32_firewall: add stm32_firewall_get_grant_all_access() API
  bus: stm32_firewall: allow check on different firewall controllers
  dt-bindings: bus: document the stm32 debug bus
  dt-bindings: pinctrl: document access-controllers property for stm32 HDP
  dt-bindings: document access-controllers property for coresight peripherals
  bus: rifsc: fix RIF configuration check for peripherals
  bus: rifsc: Replace snprintf("%s") with strscpy
  bus: stm32_firewall: Simplify with scoped for each OF child loop
  bus: firewall: move stm32_firewall header file in include folder

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-04-01 23:49:17 +02:00
Arnd Bergmann
720d813b53 Arm SCMI updates for v7.1
This batch mainly improves SCMI robustness on systems where the SCP does
 not generate completion interrupts, and includes two small follow-up
 cleanups in the SCMI core.
 
 The main functional change adds support for the new DT property
 'arm,no-completion-irq'. When present for mailbox/shared-memory based
 SCMI implementations, the driver forces SCMI operations into polling
 mode so affected platforms can continue to operate even with broken
 firmware interrupt behavior.
 
 In addition, it
  - replaces open-coded size rounding in the base protocol path with
    round_up() for clarity, with no functional change
  - updates the SCMI quirk snippet macro implementation so quirk handlers
   can use break and continue directly when invoked inside loop contexts
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEunHlEgbzHrJD3ZPhAEG6vDF+4pgFAmnD/hEACgkQAEG6vDF+
 4phtuxAAgkZT4P4EjKcS8T0FcACZ9Fi6TbICEiVpIATPscf9vi0zstRvqZ/TpUCL
 0UU/WPnBWITAC2FLemUmbK9uUJTO7De+lpoTaFLdaA/Eke/RnsQIYCxcTlN3Kuss
 MAmMYZwq/nWrz6v2yGygaoP7+VGWayoWDklJVRSsRyUAPw+3+QeIYSPCeeHYshCw
 JwAZ1KCfBodTsecxEF902o6eyJrLfIrYUo0FvTQPxchG82wKfFLGCigXjGVQnc0S
 yeXdkefXDQRq6MQKChTrcjL8ZXl+U7oqTcOXLF6IFmcpKn4gSp6Knkw9FzLjIdwR
 fz6/vdRA2sOcpYYC6CFD4qeCBwpO6D1NMAP656FdDOOmU3KU3u2msRE/XD94QCDE
 e8e/PaOY1CAzF4V659dgp0kQSkWdX4foKztTRpiBTdTla5jwmjDRbnezczcUKJtb
 2DeQBprMLwMpuufo3bZM4LNZBi6qIl8uZzVkAYgE7abQ8FkRiWcy2eSnl2SoaR9p
 IPrJlsS8RIugQQl8AzBDV7C0XAtK7yAhpoDzLmGaP/PJYLhN4dVFr5pMDkHEyrpQ
 brSflQwE5sNZ8FAg/X4elgi05i/wevvXtDh/qkTtTlAC+yhKIb1DPnJy9fuH5/P4
 JyPY3FxVzWbXUnaZr/x+C/5NUdSBOa2U6i/DE3AP+t5lvUZAb2A=
 =5Gaw
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmnNkrAACgkQmmx57+YA
 GNkh2w//bBVuOadMZl5bWM302Qc7qIP7N1nOCPhUl7YrXoc4NQFMbCMbfyun9QzS
 /gdazRvcYMQJE5p14/qhKMLXzUdpA5Ry25DgcQRaQNVk57iIN997XyznNs2OxI8o
 TllzhW9Okf0cdZIhiY9XP3gQJsZ8VTGuG0beGdKv+DqkT3P9XsVUiQ5trj+0y4af
 J2cVOBnzDvzxKplZ1ll1DLJDvy5xwmDEcQi+hAq1uAOMwd4izxxrQK7iofRn/495
 35bCFH7vigBEG3XASByNtbBktvgPRUMaxDLLUbluMTUxH9tqj9uzyi5qxkmOp2Qn
 azlAEyv9hxCnVC2Nnfoh8W4GpPVJ1znevakBvIjzeNYlh1SMPHG7cedvrEpzerFQ
 PiRKrgqP2Shx1D1dsgv7kib5lXhO0hYmIb/oe74Rqox4pIxnboKxC/IZ9ChPIazp
 LUGfHk6k/uEWHYFm3luCV8PPsSvNlAr7RsH9Q2qDshjoXnq6WnUVTE3n9tQ97gjD
 RnpWCKlQkh0OUSMGafWbswlvfyvTtUTa8c6bFo5HEimQiWfZYeADiJJf88+VMq7m
 Yy+8VjjWyOqdAqKuISLVnWXsEHJwiQRM6hxUjYmdQsfJG8FGLWU5e1c+2kVHB9Ff
 nB1OBxTXwbj9I2KSRBesrS92fVj0u95OmPh51dScnURFjL7d0BQ=
 =vQ0q
 -----END PGP SIGNATURE-----

Merge tag 'scmi-updates-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into soc/drivers

Arm SCMI updates for v7.1

This batch mainly improves SCMI robustness on systems where the SCP does
not generate completion interrupts, and includes two small follow-up
cleanups in the SCMI core.

The main functional change adds support for the new DT property
'arm,no-completion-irq'. When present for mailbox/shared-memory based
SCMI implementations, the driver forces SCMI operations into polling
mode so affected platforms can continue to operate even with broken
firmware interrupt behavior.

In addition, it
 - replaces open-coded size rounding in the base protocol path with
   round_up() for clarity, with no functional change
 - updates the SCMI quirk snippet macro implementation so quirk handlers
  can use break and continue directly when invoked inside loop contexts

* tag 'scmi-updates-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux:
  firmware: arm_scmi: Support loop control in quirk code snippets
  firmware: arm_scmi: Use round_up() for base protocol list size calculation
  firmware: arm_scmi: Implement arm,no-completion-irq property
  dt-bindings: firmware: arm,scmi: Document arm,no-completion-irq property

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-04-01 23:48:30 +02:00
Haoxiang Li
a0ac82cbed
clk: spear: fix resource leak in clk_register_vco_pll()
Add a goto label in clk_register_vco_pll(), unregister vco_clk
if tpll_clk is failed to be registered.

Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
Link: https://lore.kernel.org/r/20260325062204.169648-1-lihaoxiang@isrc.iscas.ac.cn
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-04-01 23:46:18 +02:00
Arnd Bergmann
c7091fd5eb Memory controller drivers for v7.1
1. TegraMC:
  - Few fixes for older issues - missing clock on Tegra264,
    missing enabling of DLL for Tegra30 and Tegra124.
  - Simplify the code in a few places.
  - Rework handling interrupts on different variants and add support for
    error logging on Tegra 264.
 
 2. Drop Baikal SoC bt1-l2-ctl driver, because SoC support is being
    removed tree-wide.
 -----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCgAuFiEE3dJiKD0RGyM7briowTdm5oaLg9cFAmnCj2oQHGtyemtAa2Vy
 bmVsLm9yZwAKCRDBN2bmhouD15akD/9ROv+8UYFkZe1uHd1vmPe+x9DmSq2t0TUz
 dycW91jyahQ2Tb57HSayBObLDN/xKK985+DCqILZsXUtY1KpkyMfS4nfKUM9mQA0
 ihNm/IPVx2soGG/qPMBOMYMK+RObXGeA5pXWbz6T7ty94sRPDPk5HSMiDLRBk9xk
 Df48KitcQM/jAzE/y4kWcqA0Mynb6Ngs6yr0fqkd+YtRbEzq/sgAzhIlfoPyzdOC
 5+lNme3AFJ0EM7a3jclF0Wt2jGZAHp7gbINBRhiDqLL8bve2PT4en92/sKub1g+n
 Vqp0A7W/wfGg8DOmYzj/9AjhWP4B6Omwm8/2wCNTHXRrViAqosKj5E0i7+s+zNbC
 D5kd7d3rdIfE4PfIl5zRmgZ9Z5pMhJvun6mc70+EkDfWuO6zDx6xYS7UxyQELw2d
 F+vMJI9rnjBR26fUyNeQUrChWR7U2H3UkwVQp7OUv7ieGNPB2F2pQDULHHjamhSA
 PXmJ2R2rwSWAYPA/jrz3zw9HC7432V448RBcg188vTSeobScY81Xdw8XmYgKMNfx
 RTykyDrvHUpraO1FkJmxRFWXHnz0FxwBxFtX8UZsf/Wz98IaUihqAPJnalHHmwUa
 fjAJQwOEEbg4YGpjpA9uadoancNLPsPlS+iwBoPJzULv1tQhRsZ2/TInR9uXweTe
 Ca1QV/YHug==
 =AJYZ
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmnNkd4ACgkQmmx57+YA
 GNmALRAAs/2faPGjhBgpYnfZp+5Mh9NqaeIekT2Fg6iOUibWihTMpPmTxdZdfo7v
 2jIaE0uDksaXyDDvCeKHhmVumZPNwhVodB2O4cEIN7qUUaRa6iQA9A1L0wKPCMxt
 aqW+YML5yvHRV0QefZ497bDBhSXUvcqRUDePznTwNn4RV1y0cnuNIQTN+lbuiZij
 4WnRNrsWzOiSGZKczJaBPY7X+o54CyLOYDB2UTzHepY7GYmh8/T/FvU2uS0Z5MN+
 mtE5jH5+8QrsPTGXCVE4/2NpYTrr0ODNpSHBH1MYwltxxY0f7Euoo76ShbtAdvDL
 EFnX1OjV+/V9bBVVypQJ5TPDNDcqhMzctupkYO3L6/C9Sh8EKi//7xaoQJKLKTiz
 kGLfKljW85YnbQtpJmXNxJFMcrNxUz+oS+pZJOvARFEwDYOUtTF5BfzxKqqVJIba
 YE9TupN78Slzx0X9+MXt161FVX8SCRa/izRCZTvLS6d1k1WPKV9d6amZT6pxsHXY
 AXeRcX7SEBEG3R/ratgP+MhAC9w1X5wLNbA7XyBy2AKVyJi6uRVvq3iKlKelzqXY
 mK/EK903WNGpJ0jeARDOHTEmeUdy6Ao2+DcztqriZCAFyPEj6+zT/zqPLZwofOWd
 cRtKcwiXs63RLymJj+koxlkhOId7NHgjFu1JiV+oIJbC2vpS0gU=
 =VH6z
 -----END PGP SIGNATURE-----

Merge tag 'memory-controller-drv-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl into soc/drivers

Memory controller drivers for v7.1

1. TegraMC:
 - Few fixes for older issues - missing clock on Tegra264,
   missing enabling of DLL for Tegra30 and Tegra124.
 - Simplify the code in a few places.
 - Rework handling interrupts on different variants and add support for
   error logging on Tegra 264.

2. Drop Baikal SoC bt1-l2-ctl driver, because SoC support is being
   removed tree-wide.

* tag 'memory-controller-drv-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl:
  memory: tegra: Add MC error logging support for Tegra264
  memory: tegra: Prepare for supporting multiple intmask registers
  memory: tegra: Group SoC specific fields
  memory: tegra: Add support for multiple IRQs
  memory: tegra: Group register and fields
  memory: tegra: Group error handling related registers
  memory: tegra-mc: Use %pe format
  memory: tegra-mc: Simplify printing PTR_ERR with dev_err_probe
  memory: tegra-mc: Drop tegra_mc_setup_latency_allowance() return value
  memory: renesas-rpc-if: Simplify printing PTR_ERR with dev_err_probe
  memory: brcmstb_memc: Expand LPDDR4 check to cover for LPDDR5
  dt-bindings: cache: bt1-l2-ctl: Remove unused bindings
  memory: bt1-l2-ctl: Remove not-going-to-be-supported code for Baikal SoC
  memory: tegra30-emc: Fix dll_change check
  memory: tegra124-emc: Fix dll_change check
  memory: tegra: Add support for DBB clock on Tegra264

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-04-01 23:44:56 +02:00
Arnd Bergmann
fb5fee1cbc Samsung SoC drivers for v7.1
Few cleanups in ACPM firmware drivers, used on Google GS101 and newer
 Samsung Exynos SoCs.  Notable change is removing 'const' in
 'struct acpm_handle' pointers, because even though the code does not
 modify pointed data, it immediately drops the const via cast.  Also code
 is not logically readable when a reference getters/putters (e.g.
 acpm_handle_put()) take a pointer to const, because the meaning of "get"
 and "put" implies changing the memory, even if that changeable field is
 outside of pointed data.
 -----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCgAuFiEE3dJiKD0RGyM7briowTdm5oaLg9cFAmnCiMEQHGtyemtAa2Vy
 bmVsLm9yZwAKCRDBN2bmhouD1x0tD/4mDlUO7FilWlNO9WwQSlNDT5lAwejozMEr
 PhP/k5mfDKn0zwXvqjq7dAHE2VP9Odw6o2QpGZRY1+rSGXUPYu0BXP/t7J1Q//ND
 MQittsPNqwLdwdSBu88lzV+kzpGYLJumL+f4auIKDER/VyE0f8TRI5Ms61PH2xZ2
 ayXzAeJCj+OCG4Ib8bdzil7L0T48HEfDlhC6d0vjrU7sbnnuC1HtjMhUnzzTjuie
 3C0hd6/mYqRL84m9O0km+DZPkJwS8yXCXl5P2pZqdZsUc1d+BKrKpWuJDBfjugB6
 fw1dFpqIKtphONryMZ8BCJ2vQD/fi0JaUHzh774JVNjVchrKlxW0DF7h1JHzupeM
 uVeiU0nqpanWjkoO3KuKC5et7MBsN+HJ7rfb4BuXtoSYh8OMWdo3nNlLeevn6HeB
 BS6yGv7U7Pwq7eXH2mPPpOlu4Ub2ddwMxXYZHPf2W5f8zfGMzyVjeYqmty47tMYC
 RzNLfPZheNg6RhsyL7BzaU/guiFpLow6c3PYgJuVDrkPotMgK8L0/XR0+xxdVGpu
 Y1DLDdPMyReSPIrA0TwoHjD6TLqoODAehUH+TRrrzCNrRIYkJmJ1GV2VtK1Qpsck
 s76TEa5fE4OXbRA7jlZrK+CeybItl6a/Z/u96yBl/mLbQJ855g8gsZc5SSo7az0z
 lQvvxSb08w==
 =BDkF
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmnNkaAACgkQmmx57+YA
 GNmSQg//W+MuGGRlNQr5gZPzmDWhisuYj/rJK7I4Lc/Ukg5LTHWJDB9hpRkUPV1q
 5vdArhURcwWpP8tcqz6ouursLiZShOn4bIllb7wPg9dSSEfzW33jytj2tWgFKKXx
 oV3uKrPJcwglwEhPBv57/hC+nk2C5pWUxiwqMrni2L/NZZM7MeM0qtFPUadRVtE8
 SZ3RupwE/eQ2IvFXbAyM7dqzPTO0H0xVMNjnfbMkuVT75316/Oy/d+Eu2aHlL5x9
 T1AydFOTNdMygb3XNNBECTYdUTyJ4bodeKly0EHSZXIvzO3nzjbeY022vka2jLhM
 4wT8ussjGY+SWNc/nEsqdwQVcVRF1Gg6v8qEEyC5S8IG0Ug1x26FbU+iu2dWOkfD
 2MM2cEGsVE05rjlI9rFzPdu6UMl28GFqpGLTEzq4kIYLdutLr6kDnIs9azJbvHuR
 v2y/jJL3TrJlOQ24VsrLmvp/k0Aj14O1qO7BHiNcC9DVJMp8h4cwrgpauE5nJn8z
 kRoYvpAwSvL3A7xlBaiV8shX6LjQrltvYSFZnDFKMqArh0DuoVHrL3vuysiknKdP
 72ghXc17RkxTbvdv971ou/YxYoQ3DYbPA2YlJ7NFeE1SQdp09VK1BFBw5E1pfrN1
 MHSbxmqGKJME1rUTGdZUlbFl6Bf2RooStiwmDvfttIpgkLk9j40=
 =T6Y1
 -----END PGP SIGNATURE-----

Merge tag 'samsung-drivers-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/drivers

Samsung SoC drivers for v7.1

Few cleanups in ACPM firmware drivers, used on Google GS101 and newer
Samsung Exynos SoCs.  Notable change is removing 'const' in
'struct acpm_handle' pointers, because even though the code does not
modify pointed data, it immediately drops the const via cast.  Also code
is not logically readable when a reference getters/putters (e.g.
acpm_handle_put()) take a pointer to const, because the meaning of "get"
and "put" implies changing the memory, even if that changeable field is
outside of pointed data.

* tag 'samsung-drivers-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux:
  firmware: exynos-acpm: Drop fake 'const' on handle pointer
  dt-bindings: firmware: google,gs101-acpm-ipc: add S2MPG11 secondary PMIC
  firmware: exynos-acpm: Count acpm_xfer buffers with __counted_by_ptr
  firmware: exynos-acpm: Count number of commands in acpm_xfer
  firmware: exynos-acpm: Use unsigned int for acpm_pmic_linux_errmap index

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-04-01 23:43:58 +02:00
Julian Ruess
29afd0c70d vfio/pci: Rename vfio_config_do_rw() to vfio_pci_config_rw_single() and export it
A follow-up patch adds a new variant driver for s390 ISM devices. Since
this device uses a 256 TiB BAR 0 that is never mapped, the variant
driver needs its own ISM_VFIO_PCI_OFFSET_MASK. To minimally mirror the
functionality of vfio_pci_config_rw() with such a custom mask, export
vfio_config_do_rw(). To better distinguish the now exported function
from vfio_pci_config_rw(), rename it to vfio_pci_config_rw_single()
emphasizing that it does a single config space read or write.

Reviewed-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Julian Ruess <julianr@linux.ibm.com>
Link: https://lore.kernel.org/r/20260325-vfio_pci_ism-v8-1-ddc504cde914@linux.ibm.com
Signed-off-by: Alex Williamson <alex@shazbot.org>
2026-04-01 15:41:02 -06:00
Arnd Bergmann
b986e98ccd More Qualcomm Arm64 DeviceTree fixes for v7.0
The shuffling of reset and wake GPIO properties across various Hamoa
 devices left things in an incomplete state, fix this.
 
 Add the missing "ranges" property to the QCM2290 MDSS DeviceTree binding
 example, to fix the validation warning that was introduced by the
 previous fix.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEBd4DzF816k8JZtUlCx85Pw2ZrcUFAmnMNBkACgkQCx85Pw2Z
 rcV7Ew/9HTWGi/VEdxQ74WwKjmKTVNZ1zN78VpIE4LO/5HBUyNCCCxHMLRmzSptM
 nopqcA9wdUTBSJBhBjCPLNmkowCsyKqoa8Wd8fIdzv/quNXOYHzVFUfKLRzfB2De
 WZoz3sJAgoNqObqh/6A+YZ+bem7mAHy0+U5FuJnenyNJObrVJTJRlHileo4y6ufp
 3gqlP9znSloZA8Szn9i1yN3VGcmrafAioMFw4wWvIfrkplJMVY8pyM6MiMSLivja
 34XoxiD3OaDzjfcmZ8xLE0Sy4VB0Cj0i5YlFH+aCy+xmQEAQJnp2Yb55GYTZs/Am
 Mvln825GlKuMX4TK18RUFppPPTqJf6IVUANOGgx5CgDlThq3PX/qNpouRKkpTqr7
 NJG1xB0DpDKGglx1Yl7quR/zvWi5MxGUDpWgGDMjrlcvvlImLHKNocpSlQRf64w/
 36Mxa9kzFuxAgH+XJ6bNK+kewYyV4Ec4FR59G8SukyEgqCz66B/G18wI4qKHF4HU
 XhbB9cOzQhNkrcKd76QcDx0gNWknLgpK1sENqK+OL9LZpzDtAp7/Il/+tV12LogK
 4aVkwBLx2w2Vc8Z45MvQADcs0UIILNeTIwduzogVQogcJi7vCxSKglDFGMUnUzxu
 X7LcO+hRmrwRoRFWYoQaM9GmXzrU6k8h2H4zROJfXY14vLZGhPI=
 =iljH
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmnNj98ACgkQmmx57+YA
 GNmSWhAAi0AJen2M2A/cfSXEJvHlbk+y8Wf8GR9V0ZOIc9/FmVDxovUSGJTi/0g0
 aDXwj2PmaH2EJ5xnL+mow2U+gTW4NwjYz+WJNQbzZhuu6r2uPoYovVN+8NM0nYws
 pDw8IaD1PWKHOPcum1pLGrG7vEtQ9cGoRL8gXvP4toCWt6pu5yhi5qjqnJxGJKhw
 fYkiWSJOk8lTj8GoxtBrGbXoGGQdsuMqzgiL+n/xLtQezGzR9CZ6G6daSaKAgM9z
 ji35yJFqvQl2/qfeWvWsBbvZtMZ5uxGSYBMxiKUjsuuOu8f2wFOU64mDJLdwaSGG
 YJ3gdu/DGN8+6Q+iQZV5n6ARI0Qcbe94w5Wck96u14uDbeNLDgnEueYKQEzK23mz
 RWrLCErIckH1/cCpuaawEZ8IU3rvMrPXMKRYn96yfO+JhxFY0gpzZsR2odKuCsf+
 E6FE6JWf2KI8rS6JkZyemkvkogg/tjEJKFQ8FJ1M3UY9ZlNe4iI/nC/TPZ3/Lyci
 9+Q6TPPU/LMqNc57JSBLPpT+pA+bvAG9Sde7TWcNFPJKsIHHUBrfjE060VhMAdsd
 B4GdpB14XHZR4UVPmngvi7sYhUGA1Z+HiBuCa3GPxi6/Kozq9vVX9N+po74tsH/9
 tM2g9iOYHHMv9O2hvg4tX1BXPuUW+/xcfK4FTClitoA/aNPzS/Q=
 =HmIq
 -----END PGP SIGNATURE-----

Merge tag 'qcom-arm64-fixes-for-7.0-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into arm/fixes

More Qualcomm Arm64 DeviceTree fixes for v7.0

The shuffling of reset and wake GPIO properties across various Hamoa
devices left things in an incomplete state, fix this.

Add the missing "ranges" property to the QCM2290 MDSS DeviceTree binding
example, to fix the validation warning that was introduced by the
previous fix.

* tag 'qcom-arm64-fixes-for-7.0-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux:
  arm64: dts: qcom: hamoa: Fix incomplete Root Port property migration
  dt-bindings: display/msm: qcm2290-mdss: Fix missing ranges in example
  arm64: dts: qcom: agatti: Fix IOMMU DT properties
  dt-bindings: media: venus: Fix iommus property
  dt-bindings: display: msm: qcm2290-mdss: Fix iommus property
  arm64: dts: qcom: monaco: Reserve full Gunyah metadata region
  arm64: dts: qcom: monaco: Fix UART10 pinconf
  arm64: dts: qcom: qcm6490-idp: Fix WCD9370 reset GPIO polarity
  arm64: dts: qcom: hamoa/x1: fix idle exit latency

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-04-01 23:36:29 +02:00
Arnd Bergmann
14edf33d1b Allwinner fixes for 7.0
Just one fix to make the r-spi SPI controller use the mcu-dma DMA
 controller for DMA instead of the main DMA controller.
 -----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCgAuFiEE2nN1m/hhnkhOWjtHOJpUIZwPJDAFAmnJKlEQHHdlbnNAa2Vy
 bmVsLm9yZwAKCRA4mlQhnA8kMKy3EADBWn65Iqkl2SDvRy7UTB94BqCf16jZnI27
 j7jUe8hLPQ94QjRczkz9NuB9/iQoMAXbd+lqf/p8Ku+cRPlnt2Pt6/yBGvdpIBTo
 KBEK3skSabk3FoHvcA1EJc6VyBfack/cloJiall4/IMw73pXFNKirpKhZ6vtDijT
 jS9XexW4eNgV5/LIX1C6Ly+uQRv/5NSGEMf1QE8yNeeafPymRCws0xTIuYb8wSlh
 XrEY3T9X52tUld8/+mUd5UyokIc7K94DrnAXFVSJDwFT4powurI8PIpIa9ZnfzUq
 M3lQFzk2PHpVkNJqoPgGESy2+lYyf3+orP8VABLv8advxkpoHR/mrWgLLv4sJl60
 FdlLhqui3i4/w4ycYmqmEUu98Ef2sOrYB4bVzMHh4ANIVoFyC8PT29K3PdcvM1yK
 0Dhtk02yQRafz4s5h/pl1+nU0RVEga/L1c0Vk7fX7eQCah3xl1KI6i8KURi3vtDS
 g5bRE+x/ASvVHd3pk4wfu0u6gDoCq84JrvNYgivgl9+rypNuh+KRIfaOkJnMxAid
 y9D2//Mh3l3affO1EdaRj0IcGBdoBIIw91g1CUKe0kh5GnzMbnDZfg+7+Hsw314u
 X7qwvVspE7SHc5LpkHNmJiM/e3+Ptz1CYm72caoBAbwZE4MH37qGfrODQqA/CPLX
 QsfYCIIumA==
 =T2us
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmnNj7sACgkQmmx57+YA
 GNn5kQ//QjTCkaaCqztXhSjjlLgvq54Ck/6O9gV3wt7cZaPOUc628bnkircS91u0
 qwSQqlU4/RCrhu/2I4LsPwkPif1LLXj3dPrqhHqomIjPeIiVGFP7CJwrqddDhqjA
 0YFHy+9sVWnctt3Prff3wFya2N4oECpQBHRL7/j5O3aXBewfBpqqDL0MLs0aWA/k
 n/gREbf7NCAb18l9MlrKCMctj1X24Phm/Q1Am5JuAPEwnWwqHX3fntiXLTN2fNJl
 Jo8LwvhwMPiUn3aVpcwijHR/klb5AErCNp/+aSECXGQdc0A3Y2QqngbvIzX1lqhi
 IPgM7ao2NLeBfnvucjDKZo5I8GieCLbrUKnUNfsH2HAu2aQWqwptXEbTMOMub/m3
 1Ho+s2k9B6IY0EykBuhEoDPDmwkfGYQqI7hZDYpwxWexjKF27sytVYqEgU8CJiNJ
 ksr1cT732Jfig2mr94OhVKyx2cCBx8UwLHcRksReFlkrL6EYOE22HGIfdIDKxgIr
 1YoxUXY6Gvvt+qhOdzChXv4T+AB8cJuKwwgPwIbcB2ZjHfGX5Nt9eXIXq7j2Rd9G
 MMmMICHWFhxsgqiIbWH96Y1ZGd+a8JrDlzymT9qVDIEHynL+ZfIwG1iTHrX56LeI
 FAIyJMk35MXQUYo6P7EkKP3peBlo/q3lAizuI7pHTbSJphD13eE=
 =pJhF
 -----END PGP SIGNATURE-----

Merge tag 'sunxi-fixes-for-7.0' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into arm/fixes

Allwinner fixes for 7.0

Just one fix to make the r-spi SPI controller use the mcu-dma DMA
controller for DMA instead of the main DMA controller.

* tag 'sunxi-fixes-for-7.0' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux:
  arm64: dts: allwinner: sun55i: Fix r-spi DMA

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-04-01 23:35:36 +02:00
Arnd Bergmann
b09719b9b0 Renesas fixes for v7.0 (take two)
- Fix TFA BL31 memory corruption on Sparrow Hawk.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQQ9qaHoIs/1I4cXmEiKwlD9ZEnxcAUCacZOwgAKCRCKwlD9ZEnx
 cJLGAQC+ITBQHuHm1t675uUf6KjZi7rtFIHwLuMahmaIx/nKnAEAxDZz74TQrphw
 lDyToZaAM0vfOKSiDgh9USsy5oR84AA=
 =cysH
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmnNj3QACgkQmmx57+YA
 GNncig/+MCtWCNonRXdzZFWCti+SMimSsAYWYsxLMQ8AcU5WgVbObZFw67CAzH8g
 m8ZCWUpt4oVqqGT0+TA7T5IU9EZj4KEltiNnIDZ9+YYM1BQYZqYaN2nQX3mWEaeN
 LXxfyEZI/Ykc0x5NOH/qeCYQFaLZTHS4spOMlMVX3fLMqw8D/GZBMq802mHW0ope
 2/kYpduqTuy9hjAiNYWwDvl9Ng7glDlcxj9aFFiobJ9h9UvsFR9v16f+YFG4PoJJ
 wgUQ4/mEj5s7O/HbIO6rtS1U9m9eYUemmbAoIxyUtJLEQ32HOTZVsE9gbyJCu2Db
 VVaLl8AUtBySG1dp47/b+ybenJILNCodwyhn6bEM2+Gs11I3ZtZpJ9yOEMIu3ZlL
 6YQXBPnYEGCrI7UVe1VQkwwewZhFMsgglpc4/5tXVKyyhDZIMmUAywofHEWLfBDq
 gnmh/os+sovFDiDcfsmrw8fR3ECwZpxcmQuLZu6QIKKbuLuqCHtAsSS0eznnrf9Z
 V3N2zB+06GbW6oUnakE2GC1tSpv9nQdJcgLZZLfcUvEa5sX6MqJVcMmbhf9ahd1g
 5QYKpUWUL4V8FW1I17opx1BvQNkuQGJ6/dlNGL0qFD7Ay87UjJxYtHPlGgFU3xFo
 3ZqUO38Ih288LNqA6wcpYymj0fyy4OUgp8KhBt9MezUqXIdq5vQ=
 =yCU9
 -----END PGP SIGNATURE-----

Merge tag 'renesas-fixes-for-v7.0-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into arm/fixes

Renesas fixes for v7.0 (take two)

  - Fix TFA BL31 memory corruption on Sparrow Hawk.

* tag 'renesas-fixes-for-v7.0-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel:
  arm64: dts: renesas: sparrow-hawk: Reserve first 128 MiB of DRAM

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-04-01 23:34:22 +02:00
Arnd Bergmann
0a1f536c9f Allwinner device tree changes for 7.1 - part 1
Only minor additions this cycle.
 
 Allwinner A523 SoC family had LED controller enabled.
 
 Avaota A1 board had SPI NAND enabled.
 
 New board added:
 - TaiqiCat (TQC) A01
 -----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCgAuFiEE2nN1m/hhnkhOWjtHOJpUIZwPJDAFAmnJKccQHHdlbnNAa2Vy
 bmVsLm9yZwAKCRA4mlQhnA8kMLtLD/9KMA/u8W1bQcI1bTLi89ikQ4WVXCX2mAnG
 hdHpzUnjrL6HxJF8mAIYcadZBt3TmY+nRPCUgUvKsHh0eAqoz89VIPxdYsqQ8sOX
 8GMaijS/VGM0jP4JYrJDEaeEdT9mjm9eefqIZrxgUXSTw3hj/C6uFxoLvmoC+P0n
 TXxjW5V4+5qQXl1lLMUiJDovqjvhGZYW6c/V1gogQeXFTtUeoyWPYkuuksMCq3ix
 XMWapArA/aBIf4HCDqZ5GbAAm0/jcx6tNcFbN3qWvzHgw/S5gL+dTRKgyw/3GIl/
 1CUBRLHjM5nfyMMtQ1WKX5p+oj99D5/izdZ2CyX4vPn0SDz+mzCGB3x6hg+yIDEY
 URnhds5BDkXmpcFsKIhAbMaVGgkLE+0MvWfRl9/OXwYV3qy7I6cW/9fRbt3YEK2K
 EgGdxFdyyFjXWOYzfN9DKytz1capfboZXDuK4NEpuIXFVl00qgSdpXf73Tf6S7e1
 9tCvhuGyVqHfnilKp3ibiFceVhfaklmpv9GfViix9ETfO3myZ2jaqZl6w3AS0TT0
 3xD6g+zhzyoWv+9gr1TiJ59JcBQhq4ANeaU54xVwVlwsaf8GFD7I0P8u0hHD0V7T
 +McUPtQqPn4i60qoNrXDoNxK42OIpPqqVZNvplPRRq+3mg3MhrFKh3PaalZV0U7w
 0dlJ/s3ysQ==
 =A7Bm
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmnNiUQACgkQmmx57+YA
 GNn39w/+J+mOmFnVfpoyjpRx/yJZuGPP+aUZxtovzVXrvPXKd6kKqWkwz9bhGoBN
 +FbIWw2ZVppO7dIBJPQt7nU+BIJ6EWlEci91NiR1gVOQDmevwk9IBye5VWgMUUQ4
 0TqFaJNyxytZ7O9H/A4HE4DYZ6ph4TKq4p1DzUAdvZifeSM4OzBVjIXe8H92+Q/w
 7/iIyrFkixHEMriojYOdDN4W08OkB7MQGjm47KyB2LgyzQj3jQY+oLEsL7U6AL42
 qQhU44TgscxO5pxcC3jHPqZ3PdGI/6bS/pv4ISIkE7EF9teXFGjXOduiY3TgQ64S
 HJ9y7yqHUB2dLTjgtlzhvDAwzfhPihddUCUSeet2Excn3ZVqZXqhC0OtcLoBWF6x
 TUrdjXet4AoVrDIobwSORkETYUfSPH0WJpyh88h1Bh/3v58oX5ABuCqd58R6yzvr
 VNPLVRQMIcqJyJ6DKHcCsx1dnZKXzmhyFb+0YGxPqAyHivoRPA42vCTRna01jDTO
 +pV500mKaMx+eFwh7ld3Y7+wqm+8fOe5RXev3z8eJjYvZJ0KPa5uIuSOmVVI3qnv
 rT5n4Ey7sUSFUdceEYVKMlVXheZlD79nLSYnUuL2+UCCqips3kcz+C8QdeqH/Y08
 KruqkTOFS/YsJZa7eOkj142wwgLC1qDpxVjOJX8JEDzzPre0o4c=
 =iSgy
 -----END PGP SIGNATURE-----

Merge tag 'sunxi-dt-for-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into soc/dt

Allwinner device tree changes for 7.1 - part 1

Only minor additions this cycle.

Allwinner A523 SoC family had LED controller enabled.

Avaota A1 board had SPI NAND enabled.

New board added:
- TaiqiCat (TQC) A01

* tag 'sunxi-dt-for-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux:
  arm64: dts: allwinner: h6: Add TaiqiCat (TQC) A01 support
  dt-bindings: arm: sunxi: Add TaiqiCat (TQC) A01
  dt-bindings: vendor-prefixes: Add Beijing Ultrapower Software Co., Ltd.
  arm64: dts: allwinner: sun55i-t527: avaota-a1: Add SPI NAND
  arm64: dts: allwinner: sun55i-a523: Add pinmux for spi0 on PJ pins
  arm64: dts: allwinner: sun55i-t527: avaota-a1: Enable LEDs
  arm64: dts: allwinner: sun55i-a523: Add LED controller
  dt-bindings: leds: sun50i-a100: Add compatible for Allwinner A523 SoC

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-04-01 23:08:16 +02:00
Arnd Bergmann
710c166c0f Qualcomm Arm32 DeviceTree updates for v7.1
Qualcomm APQ8084 is incomplete and hasn't seen functional contributions
 since 2016, so drop the platform (for now?). Also drop a number of
 unused IPQ-related dtsi files.
 
 Lastly clean up the RPM bus clocks in MSM8974 interconnect nodes.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEBd4DzF816k8JZtUlCx85Pw2ZrcUFAmnMOWcACgkQCx85Pw2Z
 rcX0vhAAm6jfQxvLYZIYJq/gMHa7nlENhxcmkrfeouJxRwZlv7O69TuyW9Ei0IPT
 IlN+JkRtWNrEHjVEMZG1+xu36GDTG7VM8fQ9ovnJcGvKxMZwHe5Jneg5gBBndys5
 aR2AnB8w7zp8HlFaa2QP0yRBvx2PPcV7d5jfwOGTL44rSnFd8ZvaeOun5dXdIBHc
 0QMQRn0+jyB08Iv0JqMUZCwn3vZgOGmHgmD9gMIGnqa+yF5ai4g8Lbn67PqEZ5IW
 /niwqvg757TiuZPVBU+Pv2SdFBjB9+iG4wkDcOdPoikLwimk/u4VvUsVufuyPPjZ
 ADWnqG1itNUt+JRVx/oP2m/C2+b9UbpxEgkZk8HXYIbbPGgLp5GN28W42kFQRCae
 4HPC7ZPtncSiy45UuGgGzsySiVZai3XCVgnJQ8mwrrynZ63Gnii8B7mqYb86IYql
 Q4+0u3FLc+06ksl1Ohsvn3EK01oLXnvlxncOWd3Qen4p5Trc/E/5rKc3TwecnVSz
 NJuhiGGVkROwMMk/b716Dz2n0ZPX+S3fjG+TyUx34jdN56E8c9dL8to1PPJc3/3P
 23/PGoLKLxSOePbLYzKT4B9YdsCyeXRkrKpLiDxFgKZFMc/0prs4jJnfihrYUu/e
 WTr3ZNtdTXhlS97SUiRM37Nh97E+L7Fs9tQK2XIKgFpakhBkSpw=
 =l50h
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmnNiKIACgkQmmx57+YA
 GNkwZRAAqMy2pTJnkGZXWxHAUfROCax/n3EtdK4h7svG8KjEqUSAaXLh0GsrC32m
 CjHy0/Zrxvtx18GBLS+8ijpMf1Fj0vZw7et3TRVBH49nBhMwnd4W00NTojM05kF0
 QRExUDSV9BHDHPQZytrvnbG5DP5R91G/QkeYriLbOzokLAKRYQv/tEdQLYFQr/WF
 oBkjSW3p30scNtTvQNss39z9hep9j5s43n0jXLPwBxp8RM1XtotV9Vt1LmJA/dcf
 ZGfyvyafFTjHQuhTo/0CL7XuAn5vOgBwhwhHZzp6tQKAyP2RzER4UebCwL7/+mJo
 +lD8yyMXdOlbehxmXGyCaGjFUqamHCHCgKe+/NZFGyZmWPi8/cihvaHnXWMKShXW
 BrzIjxTHEgb6KbE98yOvDJE7O3YLAMQUB/fER0aqKCj0rNRTX3Su1ufLQbqMd6SV
 wnQcdUDZ5ej2ZupQ/MUMQKO27PIjgYG2yKZ/xU497k9F6nzXT0q51pyJ+enZqNwB
 Uc8J6bMPWui137ZymUL1wGfeQe9RAZMgCG3256T0L/uZSZreUtwaqMsjlQ5zA3yp
 aueCJBKNKwK/b21HPOwacM+sIMGrdMjJEHvvI3jnIcOxIiY9P9FXXOzfyPTlXDkl
 CHimwaUjz6h9rzULJ42g5rqXX85B3AKr786sIyek9dIj6yKmjuc=
 =odV/
 -----END PGP SIGNATURE-----

Merge tag 'qcom-arm32-for-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/dt

Qualcomm Arm32 DeviceTree updates for v7.1

Qualcomm APQ8084 is incomplete and hasn't seen functional contributions
since 2016, so drop the platform (for now?). Also drop a number of
unused IPQ-related dtsi files.

Lastly clean up the RPM bus clocks in MSM8974 interconnect nodes.

* tag 'qcom-arm32-for-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux:
  ARM: dts: qcom: msm8974: Drop RPM bus clocks
  ARM: dts: qcom: drop apq8084 support
  ARM: dts: qcom: Drop unused .dtsi

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-04-01 23:05:35 +02:00
Arnd Bergmann
e0c2f14a36 ARM64: DT: HiSilicon ARM64 DT updates for v7.1
- Rename dwmmc nodes to mmc to comply with the schema
 -----BEGIN PGP SIGNATURE-----
 
 iQJJBAABCgAzFiEEQeMYD8qOQTc1R/snC8hXbtmJZlwFAmnGM2gVHHh1d2VpNUBo
 aXNpbGljb24uY29tAAoJEAvIV27ZiWZcpG8P/0VIz8r60UcKoPCkjD9cfu1i2PSj
 ENtSpuTLM/A7QPNvdFfKtgKHBks58iq7s6C3qR6e421GVc2h0L6mICECK848uu3d
 MK4NR6wOm6P6VxCfi8F8D8g0KfVnUoRKC83aVf4zpJuFhEfTSWd+JJRw9Pnk9X5u
 AW+G369S18l07yoNni8kNslIbSzOrtJanXhBFi4eZJsfTo+/zvVOsA0E9NOG7E3Y
 zbM2PB2O3I2dTm78UkqxuZPdOBqWk6OLEuMVUoeiikUa2jY7Bzb4flVHSDHbrgDN
 bZV4wi6zUXQ+nFxHsflyxHDufJ4lXvQ+hx2is2T/nxSYTM/QlLojUYO4wfJ0BfIl
 au5UtOccD/ycSK3LbUf/6pru0CNTdesRF+M3nJpZwT4UL5Up/cOkcA4LpPHK6LYC
 cULDJgxk7Y+tOO9aGrpRTohW6Bxw1vHQwSDEyGR9cDo63VqgpEGYSlb0KCb19J3a
 jRIHsIb1I2bsszwKAQu3H0ykjh/eCaHorA1J1xuYp5ToxQb+v+y4yNyTBvH4fwMi
 /mveTD5/7Ed0V3xfjF0C5zKq4Q8H5jTz00exPZXB0man3xtuLGGeMoXm30xF4dor
 JoQByedBVQBWwHEL8bGXMypsbyPsMrsKeoRCN4YnbwD1mSG9a11a11xjEgLj3VLF
 KvaG6Jlg0f+UuMVe
 =dVbP
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmnNiHoACgkQmmx57+YA
 GNluyg//RoFMl+th8pS3zceIZe7uegZJar2mdmbUMLRNf+e7z11NJ9+1L9V7A1aj
 x2ANcXm3xpk6+GI22suKudQ3zfgnwDGxJs/IXu0BMWyR4bEabkwGYFTugFuHubaf
 TIpDbXIA4ed7ZusLmDC2R1newvcBpkVE2kzyalOqYyNb94Toc0K/xkygc1hG0c43
 D7OdQUopErdSroKMVtO8yB3dgThQqEO3SBXXuWshYgWtYHPId5tB/9vcBACN9DPa
 DpZtAZ5qu9VCqwCkq6LnSW6PlgE/tcys6+wY09tZeS8wN/nSIU88PfSeu/IMfHUY
 65UqWJSzlRR+3nKDRp/c0i9aps/inEU4YE8PRZkVI9cFzVAN43bOmO3NZUXPNoBn
 1I2z06DFbIa/+2+O9G2V7ZLNrvY6JFHjkWgqO5LmyXIlfeVMx17Ehu/Xtit2JAfz
 PIfzQPzsab/SY3ww9VsZv/BSxlM0jf+HuytOXQZvbWcNCku5gIJ3Sv1a102heDYS
 wqvFQ0mVq3eXoLcChPp1xEN4mB23f1z7Hn7CsndPVc+DEGsW5J9hbPMcMIOG5spo
 H4ATvh17m564vlcEKnBajTM4slch5Jtr5PoLkcrzmUlS8pg9LtZWLJ+jTgJ7+Cd9
 3zhrGmST98AW4MzMjcbxbvwboy5wysoTavMIzDyWNG9IJy0F7y8=
 =J1El
 -----END PGP SIGNATURE-----

Merge tag 'hisi-arm64-dt-for-7.1' of https://github.com/hisilicon/linux-hisi into soc/dt

ARM64: DT: HiSilicon ARM64 DT updates for v7.1

- Rename dwmmc nodes to mmc to comply with the schema

* tag 'hisi-arm64-dt-for-7.1' of https://github.com/hisilicon/linux-hisi:
  arm64: dts: hisilicon: Rename dwmmc nodes to mmc

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-04-01 23:04:56 +02:00
Arnd Bergmann
6935cce658 SoCFPGA DTS updates for v7.1
- dt-bindings updates:
 	- Document fallback compatible for Stratix10 SoCDK eMMC board
 	- Document compatible for the Agilex5 SoCFPGA modular board
 
 - Add emmc support for the Stratix10
 - Drop CPU masks from the GICv3 PPI interrupts for Agilex5
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEoHhMeiyk5VmwVMwNGZQEC4GjKPQFAmnLMagACgkQGZQEC4Gj
 KPQ7uBAAgTu4ifShxyIfwlnC7LXxMBbjKvCiDTv7aUQzTyv3eAXG4Vy6YyV07Dw/
 0+ccAZj+dyyRf/vTRNWUYhCmu3X8iTUmlMj1IS9gCwYsBi/YJH5F5ZVUmEXPLm7m
 gR/AYgdWUOdM1dOm6NsPNL+lRS9yjN4mkNq2rKZa+/VdSf6I9ErkOauVmaGAGTiD
 72MpzQ+0UvAIrmKXhgELLlgBwVzQBQfbLEYGIbys4UgzIKs7EmtFXnQ9XSM0PGPB
 DZwZRrOWPVyTo7wxNZxQsnSKxDwGY2ZLQZQ6rg7TqY5FKnqg9XDJyMBWkhVM/Jhh
 Fry1/DVUCH/xuljSzppKWEccZ9HqZRlTTFfN2FshVJ8pMco7A6CrHdpC/3ZcTvHb
 pmtFdr6hdPxXDZVVa4AXkp7dp+n5ikwCHh+luoww+Vk29KBcFYqQBytgQ9WRLQZU
 X34CnbCKOvvRoMnkpmq0nblJeyPnY+Ibn9/dBlFqYjJ/lUsfCudD5/FVjDmRoDhe
 eriH4p2zDo3hYrB0vuKlGEHYLpa+j4n9pJ8qAHSPp5YVVvqpHJGWKO81kAcAJfPn
 IyUOl1SSUDdJIVO5AZDEsze5FWQwshz1BHUAMeWFOw4Hz/5QyqzTP3mVXQqSgRp+
 ykiCasMFsUDkZmAmVql/60LgmhBoi4SM5tDNyGQl1qyIEm+igAU=
 =3/wH
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmnNiDkACgkQmmx57+YA
 GNnbWQ/9HOxDXWo5g8CKDhuC3EyMQn8W/UXiS/pjulNECTpLwQQS42DKVhgfMogy
 AMyh4jqr2KENCGnICdtDDRqTKAOMdngOyr5nB4Wmit2gGo9EdW/52Y3PnygfDBiT
 hAjQh7MimD9vag8e6S/8o51pZwZIpp3wDlGTO5vhWDYTWRN0Ia0Dvq8SSyHdcEnL
 WMj3tFkjVfiEAmVZSl3V34EuWwXZrTLetipJEdasSsKI0WTyYaApDv3jFdMjAMDu
 tvQh2hf0mZgiuU30yAZ4Be6n93QV2oKbRPDEyFFKi5ig7TeL5+hMfaA9APegjWoY
 LAqd9PNqn2katag8kA4Ve1NceHwPDcgQ6or/MNU+x7WN0fSEnQa1bp9xd//bCN8e
 Omag/xf7owWbQgFnoi7lubbj+8dX2QczdZMh5vQ6vBw7aL/qPVp7Zjs1rLC7P1n1
 O+Hx2b1x+GWK0wP62xT4zmkoNfllFfl62VAUk29DiGXFcaV5JjSt7OIbwBOhm0uK
 ouqzdFXiMO/9hCIeQlI4zOvi55twMNmgLAuz2LxCxCSJ5UYTkCrAiPyG//nQAbr8
 4tQeVEEMgictas/gxRUQ/70jOy+OsBw3MDzUKeEb1UDBeLACbJlaOFHsIrJF3z4v
 ZyF58kA7oFiI89TvF69EPrkCCXY993aQzrS9jXnQZXiVN2LpnmI=
 =6ggO
 -----END PGP SIGNATURE-----

Merge tag 'socfpga_updates_for_v7.1_v2' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux into soc/dt

SoCFPGA DTS updates for v7.1
- dt-bindings updates:
	- Document fallback compatible for Stratix10 SoCDK eMMC board
	- Document compatible for the Agilex5 SoCFPGA modular board

- Add emmc support for the Stratix10
- Drop CPU masks from the GICv3 PPI interrupts for Agilex5

* tag 'socfpga_updates_for_v7.1_v2' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux:
  arm64: dts: intel: agilex5: Drop CPU masks from GICv3 PPI interrupts
  dt-bindings: intel: Add Agilex5 SoCFPGA modular board
  arm64: dts: socfpga: stratix10: Add emmc support
  dt-bindings: altera: Add fallback compatible for Stratix 10 SoCDK eMMC variant

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-04-01 23:03:50 +02:00
Arnd Bergmann
9988201705 T-HEAD Devicetrees for 7.1, part 2
Additional updates to T-Head device trees for v7.1:
 
  - Enable the display pipeline for the TH1520-based BeagleV Ahead board
    by adding the HDMI connector node, connecting it to the HDMI
    controller, and activating the DPU and HDMI nodes.
 
  - Add coefficients to the TH1520 PVT node as the values in the TH1520
    manual differ from the defaults in the driver.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQSy8G7QpEpV9aCf6Lbb7CzD2SixDAUCacidFQAKCRDb7CzD2Six
 DFkHAP9NsRtmq+55EDQgvc47B4L3tdSNnglbQ7EnASs4ralNMAD+LWr0aWKNCtzz
 OihmHGJ2Rn47huwl3rz3cJ2zsf1txQ4=
 =TrtU
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmnNh/4ACgkQmmx57+YA
 GNlSGQ/+I0hB1oQHRhNnFc1S03ZCj0XjGL5+VGfCncgcCbHpWdD9wgRygjhxjTjK
 /+OKefyzCwO637UTyRcSuRwnYSuan0p+X+QA35BE/Pg6XBcBe759yrndUH+DaTUo
 JJBHFv2D3d7vUcBggPVjOIZt6auVC9MXz0D1pL5LJYNxLzDKLsvObGUzCE5AUMZ/
 HDuyF9C5yywLpKLLLpT6kO6fjcMJ4jGMNcO9XhsQmMUjIJzS0ZVHMETJXt96BX9L
 vKbySxeMn9zg3dK6byR+lnVFFFlhW4/9MaiqzqM770+DcE1lWBa7Of3Hl8CkYq99
 B2u9QUYSVUnHGvzWVjfHevFKWa5cvWVNaZ+4uY14KNOqu+3l0kvgwtmEjxUToZJN
 NASk/qh8weMkORqLytHymsTLsFF/IQ0IyPcXWH562IhTshPVrzMO7TRrVuUw4+nq
 9E79WQGR9Zf793fB7YBWzSnH9Nq8kinS7eInoFlLDiYFS14MrpKykNHxHyolG7TA
 zxZp4CNn7WrPJc4UOEb0cRwzzWjyyZMRJFVec3/R8X8g8nP3DShHXJPtwNGGfqKM
 fiZ5weR4Lf3Zj/vStiENd/EUwELmL0oe5670XlhAr9tOghCVu2JbToGg1S3Cm2f+
 n/Jcwh5bESP/IV6PGh7TAriPQmy2jmb3J0Ah4wpz7Ess3t4dzXc=
 =Lzra
 -----END PGP SIGNATURE-----

Merge tag 'thead-dt-for-v7.1-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/fustini/linux into soc/dt

T-HEAD Devicetrees for 7.1, part 2

Additional updates to T-Head device trees for v7.1:

 - Enable the display pipeline for the TH1520-based BeagleV Ahead board
   by adding the HDMI connector node, connecting it to the HDMI
   controller, and activating the DPU and HDMI nodes.

 - Add coefficients to the TH1520 PVT node as the values in the TH1520
   manual differ from the defaults in the driver.

* tag 'thead-dt-for-v7.1-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/fustini/linux:
  riscv: dts: thead: beaglev-ahead: enable HDMI output
  riscv: dts: thead: th1520: add coefficients to the PVT node

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-04-01 23:02:52 +02:00
Arnd Bergmann
d2be897ff9 - Add power domain and reset for SoC
- Add GPIO for both SoC and Radxa Orion O6 board
 -----BEGIN PGP SIGNATURE-----
 
 iQHLBAABCgA1FiEEE9MyVaemtW1m4wM6rfNrQFP6hVAFAmnKMQ4XHHBldGVyLmNo
 ZW5AY2l4dGVjaC5jb20ACgkQrfNrQFP6hVBFHgwAgMcA3aiQyJlK2qoovziTXWrb
 9lPOXFthuNmoqlVUs7cYS/A3n/zkmIroc9tZ9xgMqHk0VfUdrvWs7R65+cNvQndE
 OumWt60WpRP3oT6l6zD1K/7lrFioBAs41zAyPzmtCFYeFwVrIig3nnrOaHp5+8H6
 Wc1gzARVhq7OhwP5+uct+28NPyYGkKov+B03ky1RFIcD8DnAha+19W+tVM5YI8X3
 cDESQJTw1TSTCB/R2VBHDYF+DiKCtOCfFK1PK4ULVcvbXBFK9Gf/lU81AiE+DZyA
 gLEphiYy1/YzpB7tOJBLuSUuZYqxUke3akwVz0tohvWThfGJbzoZWDw72KfzTgx5
 5Gqds40p1QDL9J7KLSN4HEn9SJ2SsNz6V9DXVG4lZeR2WJ9H8AIjA7CWXnj3G46Q
 a/ki3NB0E1w4vlFCKXiYYsIZbVk+Cz8cJmwv2Q7Wc/urY/lv7sSaKjNeW5/yCYW/
 3lmoe++i9ge3J/ZBfUYKt4iiCvItEU+LWJm5Br+L
 =LF6r
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmnNhz8ACgkQmmx57+YA
 GNnedw/9EcyKC8MP6deL28yvi23o64qtXsZfuchQYEjtwYhnw050rVF3aG2Ifoku
 QhdbMdM6MlzhU08jZuQXJTwoQ15eptSM2MkxT+nLCchQ+aFFa4Cz/Xk9u5UVBHHg
 +VPUWwo2ig0b003JTZA+rnHHD7r3kQ7jHS2Qm2hCKqAPII6ufP3J8eUsOeNu+1at
 BkLuxwaUxvQUq+0T+i6W0BcasFJv33sbWx30u7dSTpvFuLiSFnIDcXW+2/0R5Oa/
 PPxXibiCT74foKekg+KEFMOltPaOyAklAsCKLodvrfD3lvQvE9VVtMwtpkoXGwgn
 TFOQ4/fnO3VPx9/TseamfLQzgD1kL5tNLaN21VRDJ6UqAzK8RUaPfD5Du4G9EFor
 N0R3fVi9uNlPMKKv8bq0AaAhec5RrXlPgL4y7NIMYebSP1gGuhP46U1D3pd0veTr
 gbu0871I60gXSERvCwAG9ZA1YmMDwMyNd3jnQZsqPVF2ur3UaGw3LNvPlv+tmvQ6
 VNMDL+ZnNsKm+XR2wYGOilKer2JGyfFPOnUsAbDH2X+NOMfsJKj+2hVQVl9Jj60d
 pRfj+Jesjnk7XBasKx1grdiAa9i5amkfoTzMlEIEdzSB39FL8viKQU89yBiUwVrr
 h9BGoT4ueI3/pWFratN3AUSEQAz+GuoEdbQWCjnSwFDMO5g5Fho=
 =UosP
 -----END PGP SIGNATURE-----

Merge tag 'cix-dt-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/cix into soc/dt

- Add power domain and reset for SoC
- Add GPIO for both SoC and Radxa Orion O6 board

* tag 'cix-dt-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/cix:
  arm64: dts: cix: add FCH(S0)/S5 GPIO controllers for sky1
  arm64: dts: cix: Add scmi powerdomain nodes for sky1
  arm64: dts: cix: add support for cix sky1 resets

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-04-01 22:59:40 +02:00
Andrey Grodzovsky
93e8fd1a56 ftrace: Use kallsyms binary search for single-symbol lookup
When ftrace_lookup_symbols() is called with a single symbol (cnt == 1),
use kallsyms_lookup_name() for O(log N) binary search instead of the
full linear scan via kallsyms_on_each_symbol().

ftrace_lookup_symbols() was designed for batch resolution of many
symbols in a single pass.  For large cnt this is efficient: a single
O(N) walk over all symbols with O(log cnt) binary search into the
sorted input array.  But for cnt == 1 it still decompresses all ~200K
kernel symbols only to match one.

kallsyms_lookup_name() uses the sorted kallsyms index and needs only
~17 decompressions for a single lookup.

This is the common path for kprobe.session with exact function names,
where libbpf sends one symbol per BPF_LINK_CREATE syscall.

If binary lookup fails (duplicate symbol names where the first match
is not ftrace-instrumented), the function falls through to the existing
linear scan path.

Before (cnt=1, 50 kprobe.session programs):
  Attach: 858 ms  (kallsyms_expand_symbol 25% of CPU)

After:
  Attach:  52 ms  (16x faster)

Cc: <bpf@vger.kernel.org>
Link: https://patch.msgid.link/20260302200837.317907-3-andrey.grodzovsky@crowdstrike.com
Signed-off-by: Andrey Grodzovsky <andrey.grodzovsky@crowdstrike.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
2026-04-01 16:58:36 -04:00
hkbinbin
bc39a09473 Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync
hci_le_big_create_sync() uses DEFINE_FLEX to allocate a
struct hci_cp_le_big_create_sync on the stack with room for 0x11 (17)
BIS entries.  However, conn->num_bis can hold up to HCI_MAX_ISO_BIS (31)
entries — validated against ISO_MAX_NUM_BIS (0x1f) in the caller
hci_conn_big_create_sync().  When conn->num_bis is between 18 and 31,
the memcpy that copies conn->bis into cp->bis writes up to 14 bytes
past the stack buffer, corrupting adjacent stack memory.

This is trivially reproducible: binding an ISO socket with
bc_num_bis = ISO_MAX_NUM_BIS (31) and calling listen() will
eventually trigger hci_le_big_create_sync() from the HCI command
sync worker, causing a KASAN-detectable stack-out-of-bounds write:

  BUG: KASAN: stack-out-of-bounds in hci_le_big_create_sync+0x256/0x3b0
  Write of size 31 at addr ffffc90000487b48 by task kworker/u9:0/71

Fix this by changing the DEFINE_FLEX count from the incorrect 0x11 to
HCI_MAX_ISO_BIS, which matches the maximum number of BIS entries that
conn->bis can actually carry.

Fixes: 42ecf19471 ("Bluetooth: ISO: Do not emit LE BIG Create Sync if previous is pending")
Cc: stable@vger.kernel.org
Signed-off-by: hkbinbin <hkbinbinbin@gmail.com>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-04-01 16:48:28 -04:00
Oleh Konko
20756fec2f Bluetooth: SMP: derive legacy responder STK authentication from MITM state
The legacy responder path in smp_random() currently labels the stored
STK as authenticated whenever pending_sec_level is BT_SECURITY_HIGH.
That reflects what the local service requested, not what the pairing
flow actually achieved.

For Just Works/Confirm legacy pairing, SMP_FLAG_MITM_AUTH stays clear
and the resulting STK should remain unauthenticated even if the local
side requested HIGH security. Use the established MITM state when
storing the responder STK so the key metadata matches the pairing result.

This also keeps the legacy path aligned with the Secure Connections code,
which already treats JUST_WORKS/JUST_CFM as unauthenticated.

Fixes: fff3490f47 ("Bluetooth: Fix setting correct authentication information for SMP STK")
Cc: stable@vger.kernel.org
Signed-off-by: Oleh Konko <security@1seal.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-04-01 16:48:06 -04:00
Oleh Konko
d05111bfe3 Bluetooth: SMP: force responder MITM requirements before building the pairing response
smp_cmd_pairing_req() currently builds the pairing response from the
initiator auth_req before enforcing the local BT_SECURITY_HIGH
requirement. If the initiator omits SMP_AUTH_MITM, the response can
also omit it even though the local side still requires MITM.

tk_request() then sees an auth value without SMP_AUTH_MITM and may
select JUST_CFM, making method selection inconsistent with the pairing
policy the responder already enforces.

When the local side requires HIGH security, first verify that MITM can
be achieved from the IO capabilities and then force SMP_AUTH_MITM in the
response in both rsp.auth_req and auth. This keeps the responder auth bits
and later method selection aligned.

Fixes: 2b64d153a0 ("Bluetooth: Add MITM mechanism to LE-SMP")
Cc: stable@vger.kernel.org
Suggested-by: Luiz Augusto von Dentz <luiz.dentz@gmail.com>
Signed-off-by: Oleh Konko <security@1seal.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-04-01 16:47:43 -04:00
Keenan Dong
bda93eec78 Bluetooth: MGMT: validate mesh send advertising payload length
mesh_send() currently bounds MGMT_OP_MESH_SEND by total command
length, but it never verifies that the bytes supplied for the
flexible adv_data[] array actually match the embedded adv_data_len
field. MGMT_MESH_SEND_SIZE only covers the fixed header, so a
truncated command can still pass the existing 20..50 byte range
check and later drive the async mesh send path past the end of the
queued command buffer.

Keep rejecting zero-length and oversized advertising payloads, but
validate adv_data_len explicitly and require the command length to
exactly match the flexible array size before queueing the request.

Fixes: b338d91703 ("Bluetooth: Implement support for Mesh")
Reported-by: Keenan Dong <keenanat2000@gmail.com>
Signed-off-by: Keenan Dong <keenanat2000@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-04-01 16:47:19 -04:00
Pauli Virtanen
b255531b27 Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt
hci_conn lookup and field access must be covered by hdev lock in
hci_le_remote_conn_param_req_evt, otherwise it's possible it is freed
concurrently.

Extend the hci_dev_lock critical section to cover all conn usage.

Fixes: 95118dd4ed ("Bluetooth: hci_event: Use of a function table to handle LE subevents")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-04-01 16:46:55 -04:00
Pauli Virtanen
a2639a7f0f Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync
hci_conn lookup and field access must be covered by hdev lock in
set_cig_params_sync, otherwise it's possible it is freed concurrently.

Take hdev lock to prevent hci_conn from being deleted or modified
concurrently.  Just RCU lock is not suitable here, as we also want to
avoid "tearing" in the configuration.

Fixes: a091289218 ("Bluetooth: hci_conn: Fix hci_le_set_cig_params")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-04-01 16:46:33 -04:00
Keenan Dong
b8dbe9648d Bluetooth: MGMT: validate LTK enc_size on load
Load Long Term Keys stores the user-provided enc_size and later uses
it to size fixed-size stack operations when replying to LE LTK
requests. An enc_size larger than the 16-byte key buffer can therefore
overflow the reply stack buffer.

Reject oversized enc_size values while validating the management LTK
record so invalid keys never reach the stored key state.

Fixes: 346af67b8d ("Bluetooth: Add MGMT handlers for dealing with SMP LTK's")
Reported-by: Keenan Dong <keenanat2000@gmail.com>
Signed-off-by: Keenan Dong <keenanat2000@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-04-01 16:46:09 -04:00
Jonathan Rissanen
0ffac654e9 Bluetooth: hci_h4: Fix race during initialization
Commit 5df5dafc17 ("Bluetooth: hci_uart: Fix another race during
initialization") fixed a race for hci commands sent during initialization.
However, there is still a race that happens if an hci event from one of
these commands is received before HCI_UART_REGISTERED has been set at
the end of hci_uart_register_dev(). The event will be ignored which
causes the command to fail with a timeout in the log:

"Bluetooth: hci0: command 0x1003 tx timeout"

This is because the hci event receive path (hci_uart_tty_receive ->
h4_recv) requires HCI_UART_REGISTERED to be set in h4_recv(), while the
hci command transmit path (hci_uart_send_frame -> h4_enqueue) only
requires HCI_UART_PROTO_INIT to be set in hci_uart_send_frame().

The check for HCI_UART_REGISTERED was originally added in commit
c257820291 ("Bluetooth: Fix H4 crash from incoming UART packets")
to fix a crash caused by hu->hdev being null dereferenced. That can no
longer happen: once HCI_UART_PROTO_INIT is set in hci_uart_register_dev()
all pointers (hu, hu->priv and hu->hdev) are valid, and
hci_uart_tty_receive() already calls h4_recv() on HCI_UART_PROTO_INIT
or HCI_UART_PROTO_READY.

Remove the check for HCI_UART_REGISTERED in h4_recv() to fix the race
condition.

Fixes: 5df5dafc17 ("Bluetooth: hci_uart: Fix another race during initialization")
Signed-off-by: Jonathan Rissanen <jonathan.rissanen@axis.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-04-01 16:45:47 -04:00
Luiz Augusto von Dentz
035c25007c Bluetooth: hci_sync: Fix UAF in le_read_features_complete
This fixes the following backtrace caused by hci_conn being freed
before le_read_features_complete but after
hci_le_read_remote_features_sync so hci_conn_del -> hci_cmd_sync_dequeue
is not able to prevent it:

==================================================================
BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
BUG: KASAN: slab-use-after-free in atomic_dec_and_test include/linux/atomic/atomic-instrumented.h:1383 [inline]
BUG: KASAN: slab-use-after-free in hci_conn_drop include/net/bluetooth/hci_core.h:1688 [inline]
BUG: KASAN: slab-use-after-free in le_read_features_complete+0x5b/0x340 net/bluetooth/hci_sync.c:7344
Write of size 4 at addr ffff8880796b0010 by task kworker/u9:0/52

CPU: 0 UID: 0 PID: 52 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: hci0 hci_cmd_sync_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0xcd/0x630 mm/kasan/report.c:482
 kasan_report+0xe0/0x110 mm/kasan/report.c:595
 check_region_inline mm/kasan/generic.c:194 [inline]
 kasan_check_range+0x100/0x1b0 mm/kasan/generic.c:200
 instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
 atomic_dec_and_test include/linux/atomic/atomic-instrumented.h:1383 [inline]
 hci_conn_drop include/net/bluetooth/hci_core.h:1688 [inline]
 le_read_features_complete+0x5b/0x340 net/bluetooth/hci_sync.c:7344
 hci_cmd_sync_work+0x1ff/0x430 net/bluetooth/hci_sync.c:334
 process_one_work+0x9ba/0x1b20 kernel/workqueue.c:3257
 process_scheduled_works kernel/workqueue.c:3340 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3421
 kthread+0x3c5/0x780 kernel/kthread.c:463
 ret_from_fork+0x983/0xb10 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
 </TASK>

Allocated by task 5932:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:56
 kasan_save_track+0x14/0x30 mm/kasan/common.c:77
 poison_kmalloc_redzone mm/kasan/common.c:400 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:417
 kmalloc_noprof include/linux/slab.h:957 [inline]
 kzalloc_noprof include/linux/slab.h:1094 [inline]
 __hci_conn_add+0xf8/0x1c70 net/bluetooth/hci_conn.c:963
 hci_conn_add_unset+0x76/0x100 net/bluetooth/hci_conn.c:1084
 le_conn_complete_evt+0x639/0x1f20 net/bluetooth/hci_event.c:5714
 hci_le_enh_conn_complete_evt+0x23d/0x380 net/bluetooth/hci_event.c:5861
 hci_le_meta_evt+0x357/0x5e0 net/bluetooth/hci_event.c:7408
 hci_event_func net/bluetooth/hci_event.c:7716 [inline]
 hci_event_packet+0x685/0x11c0 net/bluetooth/hci_event.c:7773
 hci_rx_work+0x2c9/0xeb0 net/bluetooth/hci_core.c:4076
 process_one_work+0x9ba/0x1b20 kernel/workqueue.c:3257
 process_scheduled_works kernel/workqueue.c:3340 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3421
 kthread+0x3c5/0x780 kernel/kthread.c:463
 ret_from_fork+0x983/0xb10 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

Freed by task 5932:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:56
 kasan_save_track+0x14/0x30 mm/kasan/common.c:77
 __kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:587
 kasan_save_free_info mm/kasan/kasan.h:406 [inline]
 poison_slab_object mm/kasan/common.c:252 [inline]
 __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:284
 kasan_slab_free include/linux/kasan.h:234 [inline]
 slab_free_hook mm/slub.c:2540 [inline]
 slab_free mm/slub.c:6663 [inline]
 kfree+0x2f8/0x6e0 mm/slub.c:6871
 device_release+0xa4/0x240 drivers/base/core.c:2565
 kobject_cleanup lib/kobject.c:689 [inline]
 kobject_release lib/kobject.c:720 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x1e7/0x590 lib/kobject.c:737
 put_device drivers/base/core.c:3797 [inline]
 device_unregister+0x2f/0xc0 drivers/base/core.c:3920
 hci_conn_del_sysfs+0xb4/0x180 net/bluetooth/hci_sysfs.c:79
 hci_conn_cleanup net/bluetooth/hci_conn.c:173 [inline]
 hci_conn_del+0x657/0x1180 net/bluetooth/hci_conn.c:1234
 hci_disconn_complete_evt+0x410/0xa00 net/bluetooth/hci_event.c:3451
 hci_event_func net/bluetooth/hci_event.c:7719 [inline]
 hci_event_packet+0xa10/0x11c0 net/bluetooth/hci_event.c:7773
 hci_rx_work+0x2c9/0xeb0 net/bluetooth/hci_core.c:4076
 process_one_work+0x9ba/0x1b20 kernel/workqueue.c:3257
 process_scheduled_works kernel/workqueue.c:3340 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3421
 kthread+0x3c5/0x780 kernel/kthread.c:463
 ret_from_fork+0x983/0xb10 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

The buggy address belongs to the object at ffff8880796b0000
 which belongs to the cache kmalloc-8k of size 8192
The buggy address is located 16 bytes inside of
 freed 8192-byte region [ffff8880796b0000, ffff8880796b2000)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x796b0
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88813ff27280 0000000000000000 0000000000000001
raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88813ff27280 0000000000000000 0000000000000001
head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
head: 00fff00000000003 ffffea0001e5ac01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5657, tgid 5657 (dhcpcd-run-hook), ts 79819636908, free_ts 79814310558
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1af/0x220 mm/page_alloc.c:1845
 prep_new_page mm/page_alloc.c:1853 [inline]
 get_page_from_freelist+0xd0b/0x31a0 mm/page_alloc.c:3879
 __alloc_frozen_pages_noprof+0x25f/0x2440 mm/page_alloc.c:5183
 alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2416
 alloc_slab_page mm/slub.c:3075 [inline]
 allocate_slab mm/slub.c:3248 [inline]
 new_slab+0x2c3/0x430 mm/slub.c:3302
 ___slab_alloc+0xe18/0x1c90 mm/slub.c:4651
 __slab_alloc.constprop.0+0x63/0x110 mm/slub.c:4774
 __slab_alloc_node mm/slub.c:4850 [inline]
 slab_alloc_node mm/slub.c:5246 [inline]
 __kmalloc_cache_noprof+0x477/0x800 mm/slub.c:5766
 kmalloc_noprof include/linux/slab.h:957 [inline]
 kzalloc_noprof include/linux/slab.h:1094 [inline]
 tomoyo_print_bprm security/tomoyo/audit.c:26 [inline]
 tomoyo_init_log+0xc8a/0x2140 security/tomoyo/audit.c:264
 tomoyo_supervisor+0x302/0x13b0 security/tomoyo/common.c:2198
 tomoyo_audit_env_log security/tomoyo/environ.c:36 [inline]
 tomoyo_env_perm+0x191/0x200 security/tomoyo/environ.c:63
 tomoyo_environ security/tomoyo/domain.c:672 [inline]
 tomoyo_find_next_domain+0xec1/0x20b0 security/tomoyo/domain.c:888
 tomoyo_bprm_check_security security/tomoyo/tomoyo.c:102 [inline]
 tomoyo_bprm_check_security+0x12d/0x1d0 security/tomoyo/tomoyo.c:92
 security_bprm_check+0x1b9/0x1e0 security/security.c:794
 search_binary_handler fs/exec.c:1659 [inline]
 exec_binprm fs/exec.c:1701 [inline]
 bprm_execve fs/exec.c:1753 [inline]
 bprm_execve+0x81e/0x1620 fs/exec.c:1729
 do_execveat_common.isra.0+0x4a5/0x610 fs/exec.c:1859
page last free pid 5657 tgid 5657 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1394 [inline]
 __free_frozen_pages+0x7df/0x1160 mm/page_alloc.c:2901
 discard_slab mm/slub.c:3346 [inline]
 __put_partials+0x130/0x170 mm/slub.c:3886
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x4c/0xf0 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x195/0x1e0 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:352
 kasan_slab_alloc include/linux/kasan.h:252 [inline]
 slab_post_alloc_hook mm/slub.c:4948 [inline]
 slab_alloc_node mm/slub.c:5258 [inline]
 __kmalloc_cache_noprof+0x274/0x800 mm/slub.c:5766
 kmalloc_noprof include/linux/slab.h:957 [inline]
 tomoyo_print_header security/tomoyo/audit.c:156 [inline]
 tomoyo_init_log+0x197/0x2140 security/tomoyo/audit.c:255
 tomoyo_supervisor+0x302/0x13b0 security/tomoyo/common.c:2198
 tomoyo_audit_env_log security/tomoyo/environ.c:36 [inline]
 tomoyo_env_perm+0x191/0x200 security/tomoyo/environ.c:63
 tomoyo_environ security/tomoyo/domain.c:672 [inline]
 tomoyo_find_next_domain+0xec1/0x20b0 security/tomoyo/domain.c:888
 tomoyo_bprm_check_security security/tomoyo/tomoyo.c:102 [inline]
 tomoyo_bprm_check_security+0x12d/0x1d0 security/tomoyo/tomoyo.c:92
 security_bprm_check+0x1b9/0x1e0 security/security.c:794
 search_binary_handler fs/exec.c:1659 [inline]
 exec_binprm fs/exec.c:1701 [inline]
 bprm_execve fs/exec.c:1753 [inline]
 bprm_execve+0x81e/0x1620 fs/exec.c:1729
 do_execveat_common.isra.0+0x4a5/0x610 fs/exec.c:1859
 do_execve fs/exec.c:1933 [inline]
 __do_sys_execve fs/exec.c:2009 [inline]
 __se_sys_execve fs/exec.c:2004 [inline]
 __x64_sys_execve+0x8e/0xb0 fs/exec.c:2004
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94

Memory state around the buggy address:
 ffff8880796aff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8880796aff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8880796b0000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                         ^
 ffff8880796b0080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8880796b0100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Fixes: a106e50be7 ("Bluetooth: HCI: Add support for LL Extended Feature Set")
Reported-by: syzbot+87badbb9094e008e0685@syzkaller.appspotmail.com
Tested-by: syzbot+87badbb9094e008e0685@syzkaller.appspotmail.com
Closes: https://syzbot.org/bug?extid=87badbb9094e008e0685
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Pauli Virtanen <pav@iki.fi>
2026-04-01 16:45:24 -04:00
Pauli Virtanen
aca377208e Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails
When hci_cmd_sync_queue_once() returns with error, the destroy callback
will not be called.

Fix leaking references / memory on these failures.

Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-04-01 16:45:00 -04:00
Pauli Virtanen
2969554bcf Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists
hci_cmd_sync_queue_once() needs to indicate whether a queue item was
added, so caller can know if callbacks are called, so it can avoid
leaking resources.

Change the function to return -EEXIST if queue item already exists.

Modify all callsites to handle that.

Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-04-01 16:44:38 -04:00
Oleh Konko
2b2bf47cd7 Bluetooth: hci_event: move wake reason storage into validated event handlers
hci_store_wake_reason() is called from hci_event_packet() immediately
after stripping the HCI event header but before hci_event_func()
enforces the per-event minimum payload length from hci_ev_table.
This means a short HCI event frame can reach bacpy() before any bounds
check runs.

Rather than duplicating skb parsing and per-event length checks inside
hci_store_wake_reason(), move wake-address storage into the individual
event handlers after their existing event-length validation has
succeeded. Convert hci_store_wake_reason() into a small helper that only
stores an already-validated bdaddr while the caller holds hci_dev_lock().
Use the same helper after hci_event_func() with a NULL address to
preserve the existing unexpected-wake fallback semantics when no
validated event handler records a wake address.

Annotate the helper with __must_hold(&hdev->lock) and add
lockdep_assert_held(&hdev->lock) so future call paths keep the lock
contract explicit.

Call the helper from hci_conn_request_evt(), hci_conn_complete_evt(),
hci_sync_conn_complete_evt(), le_conn_complete_evt(),
hci_le_adv_report_evt(), hci_le_ext_adv_report_evt(),
hci_le_direct_adv_report_evt(), hci_le_pa_sync_established_evt(), and
hci_le_past_received_evt().

Fixes: 2f20216c1d ("Bluetooth: Emit controller suspend and resume events")
Cc: stable@vger.kernel.org
Signed-off-by: Oleh Konko <security@1seal.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-04-01 16:44:15 -04:00
Cen Zhang
8a5b0135d4 Bluetooth: SCO: fix race conditions in sco_sock_connect()
sco_sock_connect() checks sk_state and sk_type without holding
the socket lock. Two concurrent connect() syscalls on the same
socket can both pass the check and enter sco_connect(), leading
to use-after-free.

The buggy scenario involves three participants and was confirmed
with additional logging instrumentation:

  Thread A (connect):    HCI disconnect:      Thread B (connect):

  sco_sock_connect(sk)                        sco_sock_connect(sk)
  sk_state==BT_OPEN                           sk_state==BT_OPEN
  (pass, no lock)                             (pass, no lock)
  sco_connect(sk):                            sco_connect(sk):
    hci_dev_lock                                hci_dev_lock
    hci_connect_sco                               <- blocked
      -> hcon1
    sco_conn_add->conn1
    lock_sock(sk)
    sco_chan_add:
      conn1->sk = sk
      sk->conn = conn1
    sk_state=BT_CONNECT
    release_sock
    hci_dev_unlock
                           hci_dev_lock
                           sco_conn_del:
                             lock_sock(sk)
                             sco_chan_del:
                               sk->conn=NULL
                               conn1->sk=NULL
                               sk_state=
                                 BT_CLOSED
                               SOCK_ZAPPED
                             release_sock
                           hci_dev_unlock
                                                  (unblocked)
                                                  hci_connect_sco
                                                    -> hcon2
                                                  sco_conn_add
                                                    -> conn2
                                                  lock_sock(sk)
                                                  sco_chan_add:
                                                    sk->conn=conn2
                                                  sk_state=
                                                    BT_CONNECT
                                                  // zombie sk!
                                                  release_sock
                                                  hci_dev_unlock

Thread B revives a BT_CLOSED + SOCK_ZAPPED socket back to
BT_CONNECT. Subsequent cleanup triggers double sock_put() and
use-after-free. Meanwhile conn1 is leaked as it was orphaned
when sco_conn_del() cleared the association.

Fix this by:
- Moving lock_sock() before the sk_state/sk_type checks in
  sco_sock_connect() to serialize concurrent connect attempts
- Fixing the sk_type != SOCK_SEQPACKET check to actually
  return the error instead of just assigning it
- Adding a state re-check in sco_connect() after lock_sock()
  to catch state changes during the window between the locks
- Adding sco_pi(sk)->conn check in sco_chan_add() to prevent
  double-attach of a socket to multiple connections
- Adding hci_conn_drop() on sco_chan_add failure to prevent
  HCI connection leaks

Fixes: 9a8ec9e8eb ("Bluetooth: SCO: Fix possible circular locking dependency on sco_connect_cfm")
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-04-01 16:43:53 -04:00