summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-05-15Merge tag 'renesas-r8a73a4-dt-binding-defs-tag1' into renesas-clk-for-v7.2Geert Uytterhoeven
Renesas R-Mobile APE6 Coresight Clock DT Binding Definitions ZT trace bus and ZTR trace clock DT binding definitions for the Renesas R-Mobile APE6 (R8A73A4) SoC, shared by driver and DT source files.
2026-05-15dt-bindings: clock: renesas,cpg-clocks: Document ZT/ZTR trace clock on ↵Marek Vasut
R-Mobile APE6 Document the ZT trace bus and ZTR trace clocks on R-Mobile APE6. These clocks supply the coresight tracing modules, PTM, TPIU, ETB and replicator. Without these clocks, coresight tracing can not be operated. While this does change the ABI, it does so by extending the existing clock-output-names, therefore if old software is used with new DT, the coresight tracing parts will likely fail to probe, otherwise if new software is used with an old DT, there is no impact. Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260502185557.93061-2-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-05-15ALSA: virtio: Validate control metadata from the deviceCássio Gabriel
virtio-snd control handling trusts the device-provided control type and value count returned by the device. That metadata is then used directly to index g_v2a_type_map[] in virtsnd_kctl_info(), and to size loops and memcpy() operations in virtsnd_kctl_get() and virtsnd_kctl_put() against fixed-size virtio_snd_ctl_value and snd_ctl_elem_value arrays. A buggy or malicious device can therefore trigger out-of-bounds access by advertising an invalid control type or an oversized value count. Validate control type and count once in virtsnd_kctl_parse_cfg(), before querying enumerated items or exposing the control to ALSA. Fixes: d6568e3de42d ("ALSA: virtio: add support for audio controls") Cc: stable@vger.kernel.org Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com> Link: https://patch.msgid.link/20260507-alsa-virtio-validate-kctl-info-v1-1-7404fb12ec37@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-05-15ALSA: hda/ca0132: Disable auto-detect on manual output selectMatt DeVillier
Commit 778031e1658d ("ALSA: hda/ca0132: Set HP/Speaker auto-detect default from headphone pin verb") enables HP/Speaker auto-detect by default when the headphone pin supports presence detect. With auto-detect enabled, ca0132_select_out() and ca0132_alt_select_out() choose the output from jack presence instead of the manual HP/Speaker selection. This means selecting speaker output while headphones are plugged in updates the control state, but audio still routes to the headphones. Treat an explicit manual output selection as a request to leave auto-detect mode. Clear the HP/Speaker auto-detect switch before applying the manual selection, and notify userspace so the auto-detect control state is updated in mixers. Do this for both the normal HP/Speaker Playback Switch and the alternate Output Select control used by desktop cards. This keeps auto-detect enabled by default for devices with jack presence detection, while preserving the expected behavior that a manual output choice takes effect immediately. Fixes: 778031e1658d ("ALSA: hda/ca0132: Set HP/Speaker auto-detect default from headphone pin verb") Signed-off-by: Matt DeVillier <matt.devillier@gmail.com> Link: https://lore.kernel.org/CAFTm+6AfeXKf=b2frG4xC5yC4jjM9TkD6c8+dOWWFw6BDjDESw@mail.gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-05-15pinctrl: renesas: sh-pfc: Implement .pin_config_group_get() callbackGeert Uytterhoeven
When reading /sys/kernel/debug/pinctrl/*.pinctrl-sh-pfc/pinconf-groups while CONFIG_DEBUG_PINCTRL is enabled, the user is confronted with a seemlingly endless stream of identical messages on the console: sh-pfc e6060000.pinctrl: cannot get configuration for pin group, missing group config get function in driver Fix this by implementing the sh_pfc_pinconf_ops.pin_config_group_get() callback. Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/130ce567f23fd6eef8f5fa7273480a0e3ff2d1d9.1777562482.git.geert+renesas@glider.be
2026-05-15batman-adv: tp_meter: directly shut down timer on cleanupSven Eckelmann
batadv_tp_sender_cleanup() was calling timer_delete_sync() followed by timer_delete() to guard against the timer handler re-arming itself between the two calls. This double-deletion hack relied on the sending status being set to 0 to suppress re-arming. Replace both calls with a single timer_shutdown_sync(). This function both waits for any running timer callback to complete (like timer_delete_sync()) and permanently disarms the timer so it cannot be re-armed afterwards, making re-arming prevention unconditional and self-documenting. The re-arming property is also required because otherwise: 1. context 0 (batadv_tp_recv_ack()) checks in batadv_tp_reset_sender_timer() if sending is still 1 -> it is 2. context 1 changes in batadv_tp_sender_shutdown() sending to 0 and in this process forces the kthread to stop timer in batadv_tp_sender_cleanup() 3. context 0 continues in batadv_tp_reset_sender_timer() and rearms the timer -> but the reference for it is already gone Cc: stable@kernel.org Fixes: 33a3bb4a3345 ("batman-adv: throughput meter implementation") Signed-off-by: Sven Eckelmann <sven@narfation.org>
2026-05-15batman-adv: frag: disallow unicast fragment in fragmentSven Eckelmann
batadv_frag_skb_buffer() is called by batadv_batman_skb_recv() when a BATADV_UNICAST_FRAG packet is received. Once all fragments are collected and the packet is reassembled, batadv_recv_frag_packet() calls batadv_batman_skb_recv() again to process the defragmented payload. A malicious sender can craft a BATADV_UNICAST_FRAG packet whose reassembled payload is itself a BATADV_UNICAST_FRAG packet (matryoshka-style nesting). Each nesting level recurses through batadv_batman_skb_recv() without bound, growing the kernel stack until it is exhausted. Since refragmentation or fragments in fragments are not actually allowed, discard all packets which are still BATADV_UNICAST_FRAG packets after the defragmentation process. Cc: stable@kernel.org Fixes: 610bfc6bc99b ("batman-adv: Receive fragmented packets and merge") Reported-by: Yuan Tan <yuantan098@gmail.com> Reported-by: Yifan Wu <yifanwucs@gmail.com> Reported-by: Juefei Pu <tomapufckgml@gmail.com> Reported-by: Xin Liu <bird@lzu.edu.cn> Reviewed-by: Yuan Tan <yuantan098@gmail.com> Signed-off-by: Sven Eckelmann <sven@narfation.org>
2026-05-15Merge tag 'counter-fixes-for-7.1' of ↵Greg Kroah-Hartman
ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/wbg/counter into char-misc-linus William writes: Counter fixes for 7.1 A fix to plug a refcount leak in counter_alloc() if dev_set_name() fails and the error path is taken. * tag 'counter-fixes-for-7.1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/wbg/counter: counter: Fix refcount leak in counter_alloc() error path
2026-05-15interconnect: qcom: eliza: Add SDCC1 slave nodeAbel Vesa
The Eliza interconnect provider is missing the SDCC1 CNOC CFG slave node. Add qhs_sdc1 to the provider node table so SDCC1 interconnect paths can resolve to a provider node. Hook qhs_sdc1 up to qsm_cfg and CN0, and bump the corresponding qsm_cfg.num_links and bcm_cn0.num_nodes counts. Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Abel Vesa <abel.vesa@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://patch.msgid.link/20260514-eliza-interconnect-add-missing-sdcc1-slave-node-v2-2-13c03bc890cb@oss.qualcomm.com Signed-off-by: Georgi Djakov <djakov@kernel.org>
2026-05-15dt-bindings: interconnect: qcom,eliza-rpmh: Add SDCC1 slaveAbel Vesa
The Eliza RPMh interconnect binding is missing the SDCC1 CNOC CFG slave ID. Add it so SDCC1 consumer can describe the corresponding interconnect path. Append the new ID to preserve the existing ABI values. Signed-off-by: Abel Vesa <abel.vesa@oss.qualcomm.com> Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://patch.msgid.link/20260514-eliza-interconnect-add-missing-sdcc1-slave-node-v2-1-13c03bc890cb@oss.qualcomm.com Signed-off-by: Georgi Djakov <djakov@kernel.org>
2026-05-15Merge branch 'for-linus' into for-nextTakashi Iwai
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-05-15ALSA: hda/realtek: Add mute LED quirk for HP Pavilion Laptop 16-ag0xxxAdrien Burnett
Add a SND_PCI_QUIRK entry for the HP Pavilion Laptop 16-ag0xxx (subsystem 0x103c:0x8cbc, Realtek ALC245). The ALC245_FIXUP_HP_X360_MUTE_LEDS fixup is already used by the neighbouring HP Pavilion Aero Laptop 13-bg0xxx (0x103c:0x8cbd); it chains the master-mute COEF handler with the GPIO mic-mute LED handler, which is what this machine needs. Tested on the affected hardware: both the mute and mic-mute key LEDs respond correctly to the keyboard hotkeys after this change. Cc: <stable@vger.kernel.org> Signed-off-by: Adrien Burnett <an.arctic.pigeon@gmail.com> Link: https://patch.msgid.link/20260514165905.21175-1-an.arctic.pigeon@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-05-15ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Pro 7 15ASH111 audioJackie Dong
Volume control for the speakers on the Lenovo Yoga Pro 7 15ASH11 laptop doesn't work. The DAC routing is the same as on the ThinkPad X1 Gen7 function, so reuse the alc285_fixup_thinkpad_x1_gen7 to get it working. Signed-off-by: Jackie Dong <xy-jackie@139.com> Link: https://patch.msgid.link/20260514153940.7320-1-xy-jackie@139.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-05-15ALSA: hda: Fix NULL pointer dereference in snd_hda_ctl_add()Quan Sun
snd_hda_ctl_add() dereferences kctl->id.subdevice without checking whether kctl is NULL. Multiple callers in sound/hda/codecs/ca0132.c pass the return value of snd_ctl_new1() directly to snd_hda_ctl_add() without a NULL check: return snd_hda_ctl_add(codec, nid, snd_ctl_new1(&knew, codec)); snd_ctl_new1() returns NULL when the underlying snd_ctl_new() fails on memory allocation (kzalloc_flex),which can occur under memory pressure or via fault injection. Add a NULL check at the entry of snd_hda_ctl_add(), matching the pattern already used by snd_ctl_add_replace() at the same call path (sound/core/control.c:515). Return -EINVAL to let callers handle the error gracefully. Fixes: 44f0c9782cc6 ("ALSA: hda/ca0132: Add tuning controls") Signed-off-by: Quan Sun <2022090917019@std.uestc.edu.cn> Link: https://patch.msgid.link/20260514132245.3062884-1-2022090917019@std.uestc.edu.cn Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-05-15ALSA: hda/realtek: Add quirk for Samsung Galaxy Book5 360 headphoneMarkus Kramer
The Samsung Galaxy Book5 360 (NP750QHA, PCI subsystem ID 0x144d:0xc902) has severe audio distortion on the 3.5mm headphone jack. Applying ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET corrects the output path configuration, consistent with fixes already applied to other Samsung Galaxy Book models using the same ALC256 codec. Cc: stable@vger.kernel.org Link: https://github.com/thesofproject/linux/issues/5648 Signed-off-by: Markus Kramer <linux@markus-kramer.de> Link: https://patch.msgid.link/20260513222818.14351-1-linux@markus-kramer.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-05-15ALSA: hda/cs35l56: Drop malformed default N from KconfigAndy Shevchenko
First of all, it has to be 'default n' (small letter n), otherwise it looks for CONFIG_N which is absent and in case of appearance will enable something unrelated. Second and most important is that 'n' *is* the default 'default' already. Hence just drop malformed line. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Reviewed-by: Richard Fitzgerald <rf@opensource.cirrus.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260513162758.365972-1-andriy.shevchenko@linux.intel.com
2026-05-15ALSA: hda/realtek: fix mic boost on Framework PTLDaniel Schaefer
In addition to the mic jack fix, also need to avoid boosting the internal mic too much, otherwise >50% input volume clips a lot. Also add a second SSID. We have one for the classic chassis/speaker and one for the new Pro chassis/speaker. To: Jaroslav Kysela <perex@perex.cz> To: Takashi Iwai <tiwai@suse.com> To: linux-sound@vger.kernel.org Cc: Dustin L. Howett <dustin@howett.net> Cc: linux@frame.work Signed-off-by: Daniel Schaefer <dhs@frame.work> Link: https://patch.msgid.link/20260513155513.11683-1-dhs@frame.work Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-05-15ALSA: asihpi: Use flexible array for control cacheRosen Penev
Store the ASIHPI control-cache lookup table in the control-cache allocation instead of allocating it separately. This keeps the lookup table tied to the cache object lifetime and removes the extra allocation and free path. Assisted-by: Codex:GPT-5.5 Signed-off-by: Rosen Penev <rosenp@gmail.com> Link: https://patch.msgid.link/20260511230121.28606-1-rosenp@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-05-15ALSA: ctxfi: Use flexible array for SRCIMP imappersRosen Penev
Store the SRCIMP imapper entries in the SRCIMP resource allocation instead of allocating a separate array. This keeps the mapper table tied to the SRCIMP lifetime and removes the extra allocation and cleanup paths. Assisted-by: Codex:GPT-5.5 Signed-off-by: Rosen Penev <rosenp@gmail.com> Link: https://patch.msgid.link/20260511230026.28488-1-rosenp@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-05-15ALSA: M-Audio C600 disable Output Gain KnobSimon Wood
The C400/C600 interfaces have a large output gain knob which attenuates the outputs as stereo pairs (1/2, 3/4 and 5/6). The Windows driver/app provides a control to disable this knob/behaviour on any/all outputs, forcing maximum gain on each. The 'disable behaviour' is desirable if any outputs are being used for aux/effects sends, or if interface is being used as a live/matrix mixer. This patch adds a control to select which output pairs are affected by the Output Gain Knob. Default behaviour is to select all outputs. Tested on the C600, likely also works for the C400. Signed-off-by: Simon Wood <simon@mungewell.org> Link: https://patch.msgid.link/20260511212458.44142-1-simon@mungewell.org Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-05-15ALSA: hda/realtek: Limit mic boost on Positivo DN50EEdson Juliano Drosdeck
The internal mic boost on the Positivo DN50E is too high. Fix this by applying the ALC269_FIXUP_LIMIT_INT_MIC_BOOST fixup to the machine to limit the gain. Signed-off-by: Edson Juliano Drosdeck <edson.drosdeck@gmail.com> Link: https://patch.msgid.link/20260511181558.670563-1-edson.drosdeck@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-05-15ALSA: doc: cs35l56: Update path to HDA driver sourceRichard Fitzgerald
The HDA drivers were moved to sound/hda/... so update a Documentation reference that still pointed to the old location. Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com> Link: https://patch.msgid.link/20260511104148.36382-1-rf@opensource.cirrus.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-05-15ALSA: seq: Use flexible array for MIDI channelsRosen Penev
Store MIDI channel entries in the MIDI channel set allocation instead of allocating them separately. This ties the channel array lifetime directly to the channel set, removes a separate allocation failure path, and lets __counted_by() describe the array bounds. Move the embedded emux channel set to the end of its containing structure so it can carry the flexible array. Assisted-by: Codex:GPT-5.5 Signed-off-by: Rosen Penev <rosenp@gmail.com> Link: https://patch.msgid.link/20260511075447.445350-1-rosenp@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-05-15ALSA: usb-audio: qcom: Check offload mapping failuresCássio Gabriel
uaudio_transfer_buffer_setup() calls dma_get_sgtable() and then passes the sg_table to uaudio_iommu_map_xfer_buf() without checking whether sg table construction succeeded. If dma_get_sgtable() fails, the sg_table contents are not valid. uaudio_iommu_map_pa() also ignores iommu_map() failures for the event and transfer rings and still returns the allocated IOVA to the QMI response. That can expose an unmapped IOVA to the audio DSP. For transfer rings, the failed mapping also leaves the IOVA allocator state marked in use. Check both operations. Free the coherent transfer buffer when sg table construction fails, free the sg table when transfer-buffer IOMMU mapping fails, and release the transfer-ring IOVA if iommu_map() fails. Also return the existing event-ring IOVA when the event ring is already mapped, matching the pre-split helper behavior. Fixes: 326bbc348298 ("ALSA: usb-audio: qcom: Introduce QC USB SND offloading support") Fixes: 44499ecb4f28 ("ALSA: usb: qcom: Fix false-positive address space check") Cc: stable@vger.kernel.org Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com> Link: https://patch.msgid.link/20260511-alsa-usb-qcom-offload-map-errors-v1-1-6502695e58bc@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-05-15drm/loongson: Use managed KMS pollingMyeonghun Pak
lsdc_pci_probe() initializes KMS polling before setting up vblank support, requesting the IRQ and registering the DRM device. If any of those later steps fails, probe returns without finalizing polling. The driver also never finalizes polling on regular removal. Use drmm_kms_helper_poll_init() so polling is tied to the DRM device lifetime and automatically finalized on probe failure and device removal. This issue was identified during our ongoing static-analysis research while reviewing kernel code. Fixes: f39db26c5428 ("drm: Add kms driver for loongson display controller") Cc: stable@vger.kernel.org Co-developed-by: Ijae Kim <ae878000@gmail.com> Signed-off-by: Ijae Kim <ae878000@gmail.com> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Acked-by: Jianmin Lv <lvjianmin@loongson.cn> Reviewed-by: Huacai Chen <chenhuacai@loongson.cn> Signed-off-by: Myeonghun Pak <mhun512@gmail.com> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patch.msgid.link/20260513065706.23803-1-mhun512@gmail.com
2026-05-15ALSA: hda/realtek: Add micmute quirk to Acer Nitro AN515-58Dirga Yuza
The Acer Nitro AN515-58 uses GPIO 4 in active-low configuration to control the mic-mute LED. This patch adds a fixup to register the LED classdev and associate it with the mic-mute trigger, while chaining to the existing headset mic fixup. Signed-off-by: Dirga Yuza <dirgayuza123@gmail.com> Link: https://patch.msgid.link/20260510055951.9035-1-dirgayuza123@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-05-15ALSA: hda/realtek: Fix Legion 7 16ITHG6 speaker amp bindingNicholas Bonello
The Lenovo Legion 7 16ITHG6 uses codec SSID 17aa:3855, but its PCI SSID is 17aa:3811. The latter is now also used by the Legion S7 15IMH05 quirk, which is matched before codec SSID fallback and incorrectly routes Legion 7 16ITHG6 machines to ALC287_FIXUP_LEGION_15IMHG05_SPEAKERS. That fixup does not bind the CLSA0101 CS35L41 companion amplifiers, making the built-in speakers silent even though playback appears to be active. Add a codec SSID quirk for 17aa:3855 before the conflicting PCI SSID quirk so that the Legion 7 16ITHG6 uses ALC287_FIXUP_LEGION_16ITHG6. This restores CS35L41 firmware loading and binds both speaker amplifiers. Fixes: 67f4c61a73e9 ("ALSA: hda/realtek: Add quirk for Legion S7 15IMH") Cc: stable@vger.kernel.org Tested-by: Nicholas Bonello <hadobedo@gmail.com> Assisted-by: Codex:GPT-5 Signed-off-by: Nicholas Bonello <hadobedo@gmail.com> Link: https://patch.msgid.link/20260508225507.47667-1-hadobedo@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-05-15ALSA: usb-audio: Add iface reset and delay quirk for TTGK Technology USB-C AudioLianqin Hu
Setting up the interface when suspended/resumeing fail on this card. Adding a reset and delay quirk will eliminate this problem. usb 1-1: new full-speed USB device number 2 using xhci-hcd usb 1-1: New USB device found, idVendor=3302, idProduct=17c2 usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: USB-C Audio usb 1-1: Manufacturer: TTGK Technology usb 1-1: SerialNumber: 170120210706 Signed-off-by: Lianqin Hu <hulianqin@vivo.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/TYUPR06MB621720E4E8F99A42E162FD51D23D2@TYUPR06MB6217.apcprd06.prod.outlook.com
2026-05-15ALSA: scarlett2: Add missing error check when initialise Autogain StatusRobertus Diawan Chris
When initialise new control with scarlett2_add_new_ctl() function for Autogain Status, scarlett2_add_new_ctl() might throw an error. So, add error check after initialise new control for Autogain Status. This is reported by Coverity Scan with CID 1598781 as UNUSED_VALUE. Fixes: 0a995e38dc44 ("ALSA: scarlett2: Add support for software-controllable input gain") Signed-off-by: Robertus Diawan Chris <robertusdchris@gmail.com> Link: https://patch.msgid.link/20260508033914.111596-1-robertusdchris@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-05-15counter: intel-qep: Replace manual mutex logic with lock guardsJoao Paulo Menezes Linaris
Use guard() for handling mutex lock instead of locking and unlocking mutex explicitly. This improves readability by eliminating the need for gotos and by clearly indicating mutex will be locked only when execution is in guard scope. Signed-off-by: Joao Paulo Menezes Linaris <jplinaris@usp.br> Co-developed-by: Guilherme Dias <guilhermeabreu200105@usp.br> Signed-off-by: Guilherme Dias <guilhermeabreu200105@usp.br> Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Link: https://lore.kernel.org/r/20260512173058.14858-1-jplinaris@usp.br Signed-off-by: William Breathitt Gray <wbg@kernel.org>
2026-05-15Merge tag 'drm-intel-next-2026-05-14' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/i915/kernel into drm-next - A Revert of a Kconfig patch that broke some builds (Jani) - New fb_pin abstraction for xe and i915 fb transparent handling (Ville, Tvrtko) - Skip inactive MST connectors on HDCP cases (Suraj) - Reduce redundant intel_panel_fixed_mode (Ankit) - Some general fixes (Imre, Chaitanya) - Reorganize display documentation (Jani) - Start switching to display specific reg types (Jani) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Rodrigo Vivi <rodrigo.vivi@intel.com> Link: https://patch.msgid.link/agXbLMtMECnKy-YV@intel.com
2026-05-15iommupt: Fixup build warning by using BIT_ULL() for RISCVPT_NC/IOFangyu Yu
Fix build warning on 32-bit configurations by using BIT_ULL() for RISCVPT_NC and RISCVPT_IO. Fixes: 6c21eb174c6c ("iommupt: Encode IOMMU_MMIO/IOMMU_CACHE via RISC-V Svpbmt bits") Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202605121350.wZxB51k0-lkp@intel.com/ Signed-off-by: Fangyu Yu <fangyu.yu@linux.alibaba.com> Reviewed-by: Jason Gunthorpe <jgg@nvidia.com> Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
2026-05-15MAINTAINERS: update Tomasz Jeznach's email addressTomasz Jeznach
Switch from the previous work address to a linux.dev account, as the work address is no longer actively monitored. Signed-off-by: Tomasz Jeznach <tomasz.jeznach@linux.dev> Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
2026-05-15iommupt: Fix the end_index calculation in __map_range_leaf()Jason Gunthorpe
Sashiko noticed a mismatch of units in this math: num_leaves is actually the number of leaf *entries* (so a 16-item contiguous leaf is one num_leaves), while index is in items. The mismatch in maths causes __map_range_leaf() to exit early instead of efficiently filling a larger range of contiguous PTEs. The early exit is caught by the functions above and then __map_range_leaf() is re-invoked, so there is no functional issue. Correct the misuse of units by adjusting num_leaves with the leaf size and avoid the performance cost of looping externally. There are also some mismatched types for num_leaves; simplify things to remove the duplicated calculations. Fixes: d6c65b0fd621 ("iommupt: Avoid rewalking during map") Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> Reviewed-by: Samiullah Khawaja <skhawaja@google.com> Reviewd-by: Pranjal Shrivastava <praan@google.com> Tested-by: Josua Mayer <josua@solid-run.com> Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
2026-05-15iommupt: Check for missing PAGE_SIZE in the pgsize_bitmapJason Gunthorpe
Sashiko pointed out that the driver could drop PAGE_SIZE from the pgsize_bitmap. That is technically allowed but nothing does it, and such an iommu_domain would not be used with the DMA API today. Still, it is against the design and it is trivial to fix up. Lift the PT_WARN_ON to the if branch and just skip the fast path. Fixes: dcd6a011a8d5 ("iommupt: Add map_pages op") Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> Reviewed-by: Pranjal Shrivastava <praan@google.com> Reviewed-by: Samiullah Khawaja <skhawaja@google.com> Tested-by: Josua Mayer <josua@solid-run.com> Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
2026-05-15iommu: Handle unmap error when iommu_debug is enabledJason Gunthorpe
Sashiko noticed a latent bug where the map error flow called iommu_unmap() which calls iommu_debug_unmap_begin()/iommu_debug_unmap_end() however since this is an error path the map flow never actually established the original iommu_debug_map() it will malfunction. Lift the unmap error handling into iommu_map_nosync() and reorder it so the trace_map()/iommu_debug_map() records the partial mapping and then immediately unmaps it. This avoid creating the unbalanced tracking and provides saner tracing instead of a unmap unmatched to any map. Fixes: ccc21213f013 ("iommu: Add calls for IOMMU_DEBUG_PAGEALLOC") Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> Reviewed-by: Pranjal Shrivastava <praan@google.com> Reviewed-by: Samiullah Khawaja <skhawaja@google.com> Reviewed-by: Mostafa Saleh <smostafa@google.com> Tested-by: Josua Mayer <josua@solid-run.com> Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
2026-05-15iommu: Fix up map/unmap debugging for iommupt domainsJason Gunthorpe
Sashiko noticed a few issues in this path, and a few more were found on review. Tidy them up further. These are intertwined because the debug code depends on some of the WARN_ONs to function right: Lift into iommu_map_nosync(): - The might_sleep_if() - 0 pgsize_bitmap WARN_ON - Promote the illegal domain->type to a WARN_ON - WARN_ON for illegal gfp flags Then remove the return 0 since it is now safe to call iommu_debug_map(). Lift into __iommu_unmap(): - 0 pgsize_bitmap WARN_ON - Promote the illegal domain->type to a WARN_ON - iommu_debug_unmap_begin() This now pairs with the unconditional iommu_debug_map() on the mapping side. Thus iommu debugging now works for iommupt along with some of the other debugging features. Fixes: 99fb8afa16ad ("iommupt: Directly call iommupt's unmap_range()") Fixes: d6c65b0fd621 ("iommupt: Avoid rewalking during map") Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> Reviewed-by: Pranjal Shrivastava <praan@google.com> Reviewed-by: Samiullah Khawaja <skhawaja@google.com> Reviewed-by: Mostafa Saleh <smostafa@google.com> Tested-by: Josua Mayer <josua@solid-run.com> Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
2026-05-15iommu: Fix loss of errno on map failure for classic opsJason Gunthorpe
A typo, likely from a rebase, inverted the condition and caused errors to be lost. Fix it to be "if (ret)". This was breaking iommu_create_device_direct_mappings() on drivers that don't use iommupt and don't fully set up their domain in alloc_pages() (i.e., SMMUv2). In this case the first call of iommu_create_device_direct_mappings() should fail due to the incompletely initialized domain. Since it wrongly returns success, the second call to iommu_create_device_direct_mappings() doesn't happen and IOMMU_RESV_DIRECT is never set up. Cc: stable@vger.kernel.org Fixes: d6c65b0fd621 ("iommupt: Avoid rewalking during map") Reported-by: Josua Mayer <josua@solid-run.com> Closes: https://lore.kernel.org/all/321c2e57-6a17-4aef-ba42-d2ebd577e472@solid-run.com/ Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> Reviewed-by: Pranjal Shrivastava <praan@google.com> Reviewed-by: Samiullah Khawaja <skhawaja@google.com> Reviewed-by: Mostafa Saleh <smostafa@google.com> Tested-by: Josua Mayer <josua@solid-run.com> Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
2026-05-15Merge tag 'drm-xe-next-2026-05-14' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/xe/kernel into drm-next Driver Changes: - drm/xe/cri: Add new PCI IDs (Balasubramani Vivekanandan) - drm/xe/memirq: Enable GT_MI_USER_INTERRUPT only (Michal Wajdeczko) - drm/xe/memirq: Update interrupt handler logic (Michal Wajdeczko) - drm/xe: Drop unused ggtt_balloon field (Michal Wajdeczko) - drm/xe: Refactor emit_xy_fast_copy and emit_mem_copy functions (Balasubramani Vivekanandan) - drm/xe: Refactor emit_clear_link_copy (Balasubramani Vivekanandan) - drm/xe: Refactor emit_clear_main_copy (Balasubramani Vivekanandan) - drm/xe/devcoredump: Drop a FIXME in devcoredump (Shekhar Chauhan) - drm/xe/oa: MERTOA Wa_14026779378 (Ashutosh Dixit) - drm/xe/oa: Add val arg to xe_oa_is_valid_config_reg (Ashutosh Dixit) - drm/xe/oa: MERTOA Wa_14026746987 (Ashutosh Dixit) - drm/xe/oa: Refactor oa_unit_supports_oa_format (Ashutosh Dixit) - drm/xe/dma-buf: fix UAF with retry loop (Matthew Auld) - drm/xe/dma-buf: handle empty bo and UAF races (Matthew Auld) - drm/xe/multi_queue: Whitelist QUEUE_TIMESTAMP register (Umesh Nerlige Ramappa) - drm/xe/multi_queue: Use QUEUE_TIMESTAMP as job timestamp for multi-queue (Umesh Nerlige Ramappa) - drm/xe/multi_queue: Add trace event for the multi queue timestamp (Umesh Nerlige Ramappa) - drm/xe/multi_queue: Capture queue run times for active queues (Umesh Nerlige Ramappa) - drm/xe/lrc: Refactor out engine id to hwe conversion (Umesh Nerlige Ramappa) - drm/xe/multi_queue: Add helpers to access CS QUEUE TIMESTAMP from lrc (Umesh Nerlige Ramappa) - drm/xe/multi_queue: Store primary LRC and position info in LRC (Umesh Nerlige Ramappa) - drm/xe/multi_queue: Refactor check for multi queue support for engine class (Umesh Nerlige Ramappa) - drm/xe/lrc: Refactor xe_lrc_timestamp to simplify logic (Umesh Nerlige Ramappa) - drm/xe: Add timestamp_ms to LRC snapshot (Matthew Brost) - drm/xe/lrc: Use 64 bit ctx timestamp in the LRC snapshot (Umesh Nerlige Ramappa) - drm/xe/eustall: Return ENODEV from read if EU stall registers get reset (Harish Chegondi) - drm/xe/multi_queue: Refactor CGP_SYNC send path (Niranjana Vishwanathapura) - drm/xe/multi_queue: Remove redundant assignment in guc_exec_queue_run_job (Niranjana Vishwanathapura) - drm/xe: Make decision to use Xe2-style blitter instructions a feature flag (Matt Roper) - drm/xe: Convert stolen memory over to ttm_range_manager (Sanjay Yadav) - drm/xe/madvise: Track purgeability with BO-local counters (Arvind Yadav) - drm/xe/xe_survivability: Simplify runtime survivability error handling (Mallesh Koujalagi) - drm/xe/guc: Exclude indirect ring state page from ADS engine state size (Satyanarayana K V P) - drm/xe/hw_error: Cleanup array map (Raag Jadav) - drm/xe/pf: Fix MMIO access using PF view instead of VF view during migration (Shuicheng Lin) - drm/xe/pf: Fix EAGAIN sign in pf_migration_consume() (Shuicheng Lin) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Thomas Hellstrom <thomas.hellstrom@linux.intel.com> Link: https://patch.msgid.link/agXMKRRl1oxB204x@fedora
2026-05-15ASoC: Intel: sof_sdw: add es9356 supportZhang Yi
add Everest-semi ES9356 support Signed-off-by: Zhang Yi <zhangyi@everest-semi.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev> Link: https://patch.msgid.link/20260514075206.3483-6-zhangyi@everest-semi.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-05-15ASoC: Intel: soc-acpi: arl: Add es9356 supportZhang Yi
Add support for the es9356 codec in the ARL board configuration. Signed-off-by: Zhang Yi <zhangyi@everest-semi.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev> Link: https://patch.msgid.link/20260514075206.3483-5-zhangyi@everest-semi.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-05-15ASoC: es9356-sdca: Add ES9356 SDCA driverZhang Yi
This is the codec driver for es9356-sdca. Signed-off-by: Zhang Yi <zhangyi@everest-semi.com> Link: https://patch.msgid.link/20260514075206.3483-4-zhangyi@everest-semi.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-05-14scsi: isci: Remove unused macro scu_get_command_request_logical_port()Piotr Zarycki
The macro scu_get_command_request_logical_port() has never been used since it was introduced. Signed-off-by: Piotr Zarycki <piotr.zarycki@gmail.com> Link: https://patch.msgid.link/20260423081343.1813002-1-piotr.zarycki@gmail.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-05-14scsi: target: tcm_loop: Fix NULL ptr dereferenceGuixin Liu
The TCM_LOOP LUN creation process calls device_register() to create the device, which in turn invokes tcm_loop_driver_probe() registered with the TCM_LOOP bus to create and register the scsi_host. However, if the scsi_host memory allocation fails or scsi_add_host() fails, the device_register() process still returns success. Subsequently, when the user binds the LUN to a specific backend device, it accesses the NULL or freed scsi_host. Crash Call Trace: RIP: 0010:scsi_is_host_device+0x7/0x20 scsi_alloc_target+0x32/0x2c0 __scsi_add_device+0x41/0xf0 scsi_add_device+0xd/0x30 tcm_loop_port_link+0x25/0x50 [tcm_loop] target_fabric_port_link+0x9c/0xb0 [target_core_mod] ... This issue is fixed by: 1. Setting the tcm_loop_hba's scsi_host to NULL, if scsi_add_host() fails. 2. Checking the tcm_loop_hba's scsi_host after device_register(). 3. Checking the tcm_loop_hba's scsi_host in tcm_loop_driver_remove(). Fixes: 3703b2c5d041 ("[SCSI] tcm_loop: Add multi-fabric Linux/SCSI LLD fabric module") Signed-off-by: Guixin Liu <kanie@linux.alibaba.com> Reviewed-by: Mike Christie <michael.christie@oracle.com> Link: https://patch.msgid.link/20260424013923.25998-1-kanie@linux.alibaba.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-05-14scsi: ufs: ufs-qcom: Enable Auto Hibern8 clock request supportPalash Kambar
On platforms that support Auto Hibern8 (AH8), the UFS controller can autonomously de-assert clk_req signals to the Global Clock Controller when entering the Hibern8 state. This allows Global Clock Controller (GCC) to gate unused clocks, improving power efficiency. Enable the Clock Request feature by setting the UFS_HW_CLK_CTRL_EN bit in the UFS_AH8_CFG register, as recommended in the Hardware Programming Guidelines. Reviewed-by: Manivannan Sadhasivam <mani@kernel.org> Signed-off-by: Palash Kambar <palash.kambar@oss.qualcomm.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/20260423102023.3779489-3-palash.kambar@oss.qualcomm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-05-14scsi: ufs: core: Configure only active lanes during linkPalash Kambar
The number of connected lanes detected during UFS link startup can be fewer than the lanes specified in the device tree. The current driver logic attempts to configure all lanes defined in the device tree, regardless of their actual availability. This mismatch may cause failures during power mode changes. Hence, Add a check during link startup to ensure that only the lanes actually discovered are considered valid. If a mismatch is detected, fail the initialization early, preventing the driver from entering an unsupported configuration that could cause power mode transition failures. Reviewed-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Shawn Lin <shawn.lin@rock-chips.com> Reviewed-by: Manivannan Sadhasivam <mani@kernel.org> Signed-off-by: Palash Kambar <palash.kambar@oss.qualcomm.com> Link: https://patch.msgid.link/20260423102023.3779489-2-palash.kambar@oss.qualcomm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-05-15ASoC: codecs: fs210x: fix possible buffer overflowAlexander A. Klimov
In fs210x_effect_scene_info(), a string was copied like this: strscpy(DST, SRC, strlen(SRC) + 1); A buffer overflow would happen if strlen(SRC) >= sizeof(DST). Actually, strscpy() must be used this way: strscpy(DST, SRC, sizeof(DST)); strscpy(DST, SRC); // defaults to sizeof(DST) Fixes: 756117701779 ("ASoC: codecs: Add FourSemi FS2104/5S audio amplifier driver") Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de> Link: https://patch.msgid.link/20260513190852.196723-2-grandmaster@al2klimov.de Signed-off-by: Mark Brown <broonie@kernel.org>
2026-05-15Merge tag 'drm-misc-next-2026-05-14' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/misc/kernel into drm-next drm-misc-next for v7.2-rc1: UAPI Changes: - Update fourcc descriptions of BG(R) floating formats. - Add deferred mapping support to virtio. Cross-subsystem Changes: - Update lontium lt9211 bindings. Core Changes: - Bugfixes and cleanups to pagemap, dp/mst. - Add lockdep annotations to gpu buddy manager. - Updates to drm/dp for PR + VRR. - Improve documentation's table of contents. - Bump fpfn and lpfn in ttm to 64-bits. Driver Changes: - Assorted bugfixes, cleanups and updates to panthor, nouveau, qaic, hisilicon. - Add support for CMN N116BCN-EA1, CMN N140HCA-EEK, IVO M140NWFQ R5, IVO R140NWFW R0, BOE NT140*, BOE NV133FHM-N4F, AUO B140*, AUO B133HAN06.6 and AUO B116XTN02.3 eDP panels. - More implementation of AIE4 in amdxdna. - Update panels to use refcounts instead of devm_kzalloc to make drm_panel_init static. - Add support for the RCade Display Adapter to gud. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Link: https://patch.msgid.link/98788814-e462-4950-bb2a-ea493c30d0c0@linux.intel.com
2026-05-14scsi: isci: Fix use-after-free in device removal pathMichael Bommarito
The ISCI completion tasklet is initialized in isci_host_alloc() (drivers/scsi/isci/init.c:496) and scheduled from both MSI-X and legacy interrupt handlers (drivers/scsi/isci/host.c:223,613). isci_host_deinit() stops the controller and waits for stop completion, but it never kills completion_tasklet before teardown continues. A top-of-function tasklet_kill() is not sufficient here: interrupts are only disabled when isci_host_stop_complete() runs, so until wait_for_stop() returns the IRQ handlers can still requeue the tasklet. The tasklet callback also re-enables interrupts after draining completions, so killing the tasklet before the source is quiesced leaves the same race open. Once wait_for_stop() returns, no further IRQ-driven scheduling can occur. Kill completion_tasklet there so teardown cannot race a queued tasklet running on a dead ihost. On remove or unload, the stale callback can otherwise dereference ihost and touch ihost->smu_registers after the host lifetime ends. A UML + KASAN analogue reproduced the failure class both with no tasklet_kill() and with tasklet_kill() placed before source quiesce, and stayed clean once the kill happened after quiescing the scheduling source. This mirrors commit f6ab594672d4 ("scsi: aic94xx: fix use-after-free in device removal path"), but ISCI needs the kill after wait_for_stop(). Fixes: 6f231dda6808 ("isci: Intel(R) C600 Series Chipset Storage Control Unit Driver") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Assisted-by: Codex:gpt-5-4 Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com> Link: https://patch.msgid.link/20260419210420.2134639-1-michael.bommarito@gmail.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-05-14scsi: pm8001: Reject non-fatal dump when controller is crashedKumar Meiyappan
pm80xx_get_non_fatal_dump() can be called even after the controller has entered a fatal error state. In that case the forensic memory contents are not safe to access for a non-fatal dump request, and attempting to do so can trigger a call trace. Check controller_fatal_error before reading the non-fatal dump buffer and return -EINVAL when the controller is already in a crashed state. This prevents non-fatal dump collection from running in an invalid controller state. Signed-off-by: Kumar Meiyappan <kumar.meiyappan@microchip.com> Signed-off-by: Sagar Biradar <sagar.biradar@microchip.com> Link: https://patch.msgid.link/20260416154650.415624-1-sagar.biradar@microchip.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
generated by cgit v1.2.3 (git 2.25.1) at 2026-09-08 02:39:21 +0000