summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-03-27crypto: inside-secure/eip93 - correct ecb(des-eip93) typoMieczyslaw Nalewaj
Correct the typo in the name "ecb(des-eip93)". Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-03-27crypto: hisilicon/sec2 - prevent req used-after-free for secWenkai Lin
During packet transmission, if the system is under heavy load, the hardware might complete processing the packet and free the request memory (req) before the transmission function finishes. If the software subsequently accesses this req, a use-after-free error will occur. The qp_ctx memory exists throughout the packet sending process, so replace the req with the qp_ctx. Fixes: f0ae287c5045 ("crypto: hisilicon/sec2 - implement full backlog mode for sec") Signed-off-by: Wenkai Lin <linwenkai6@hisilicon.com> Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-03-27crypto: cryptd - Remove unused functionsEric Biggers
Many functions in cryptd.c no longer have any caller. Remove them. Also remove several associated structs and includes. Finally, inline cryptd_shash_desc() into its only caller, allowing it to be removed too. Signed-off-by: Eric Biggers <ebiggers@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-03-27crypto: inside-secure/eip93 - make it selectable for ECONETAleksander Jan Bajkowski
Econet SoCs feature an integrated EIP93 in revision 3.0p1. It is identical to the one used by the Airoha AN7581 and the MediaTek MT7621. Ahmed reports that the EN7528 passes testmgr's self-tests. This driver should also work on other little endian Econet SoCs. CC: Ahmed Naseef <naseefkm@gmail.com> Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl> Reviewed-by: Antoine Tenart <atenart@kernel.org> Tested-by: Ahmed Naseef <naseefkm@gmail.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-03-27crypto: ti - Add support for AES-CCM in DTHEv2 driverT Pratham
AES-CCM is an AEAD algorithm supporting both encryption and authentication of data. This patch introduces support for AES-CCM AEAD algorithm in the DTHEv2 driver. Signed-off-by: T Pratham <t-pratham@ti.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-03-27crypto: ti - Add support for AES-GCM in DTHEv2 driverT Pratham
AES-GCM is an AEAD algorithm supporting both encryption and authentication of data. This patch introduces support for AES-GCM as the first AEAD algorithm supported by the DTHEv2 driver. Signed-off-by: T Pratham <t-pratham@ti.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-03-27crypto: stm32 - use list_first_entry_or_null to simplify cryp_find_devThorsten Blum
Use list_first_entry_or_null() to simplify stm32_cryp_find_dev() and remove the now-unused local variable 'struct stm32_cryp *tmp'. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Reviewed-by: Kees Cook <kees@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-03-27crypto: stm32 - use list_first_entry_or_null to simplify hash_find_devThorsten Blum
Use list_first_entry_or_null() to simplify stm32_hash_find_dev() and remove the now-unused local variable 'struct stm32_hash_dev *tmp'. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-03-27crypto: testmgr - Add test vectors for authenc(hmac(md5),rfc3686(ctr(aes)))Aleksander Jan Bajkowski
Test vectors were generated starting from existing RFC3686(CTR(AES)) test vectors and adding HMAC(MD5) computed with software implementation. Then, the results were double-checked on Mediatek MT7986 (safexcel). Platform pass self-tests. Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-03-27crypto: qat - add anti-rollback support for GEN6 devicesSuman Kumar Chakraborty
Anti-Rollback (ARB) is a QAT GEN6 hardware feature that prevents loading firmware with a Security Version Number (SVN) lower than an authorized minimum. This protects against downgrade attacks by ensuring that only firmware at or above a committed SVN can run on the acceleration device. During firmware loading, the driver checks the SVN validation status via a hardware CSR. If the check reports a failure, firmware authentication is aborted. If it reports a retry status, the driver reissues the authentication command up to a maximum number of retries. Extend the firmware admin interface with two new messages, ICP_QAT_FW_SVN_READ and ICP_QAT_FW_SVN_COMMIT, to query and commit the SVN, respectively. Integrate the SVN check into the firmware authentication path in qat_uclo.c so the driver can react to anti-rollback status during device bring-up. Expose SVN information to userspace via a new sysfs attribute group, qat_svn, under the PCI device directory. The group provides read-only attributes for the active, enforced minimum, and permanent minimum SVN values, as well as a write-only commit attribute that allows a system administrator to commit the currently active SVN as the new authorized minimum. This is based on earlier work by Ciunas Bennett. Signed-off-by: Suman Kumar Chakraborty <suman.kumar.chakraborty@intel.com> Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-03-27crypto: caam - guard HMAC key hex dumps in hash_digest_keyThorsten Blum
Use print_hex_dump_devel() for dumping sensitive HMAC key bytes in hash_digest_key() to avoid leaking secrets at runtime when CONFIG_DYNAMIC_DEBUG is enabled. Fixes: 045e36780f11 ("crypto: caam - ahash hmac support") Fixes: 3f16f6c9d632 ("crypto: caam/qi2 - add support for ahash algorithms") Cc: stable@vger.kernel.org Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-03-27printk: add print_hex_dump_devel()Thorsten Blum
Add print_hex_dump_devel() as the hex dump equivalent of pr_devel(), which emits output only when DEBUG is enabled, but keeps call sites compiled otherwise. Suggested-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Reviewed-by: John Ogness <john.ogness@linutronix.de> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-03-27crypto: nx - Fix packed layout in struct nx842_crypto_headerGustavo A. R. Silva
struct nx842_crypto_header is declared with the __packed attribute, however the fields grouped with struct_group_tagged() were not packed. This caused the grouped header portion of the structure to lose the packed layout guarantees of the containing structure. Fix this by replacing struct_group_tagged() with __struct_group(..., ..., __packed, ...) so the grouped fields are packed, and the original layout is preserved, restoring the intended packed layout of the structure. Before changes: struct nx842_crypto_header { union { struct { __be16 magic; /* 0 2 */ __be16 ignore; /* 2 2 */ u8 groups; /* 4 1 */ }; /* 0 6 */ struct nx842_crypto_header_hdr hdr; /* 0 6 */ }; /* 0 6 */ struct nx842_crypto_header_group group[]; /* 6 0 */ /* size: 6, cachelines: 1, members: 2 */ /* last cacheline: 6 bytes */ } __attribute__((__packed__)); After changes: struct nx842_crypto_header { union { struct { __be16 magic; /* 0 2 */ __be16 ignore; /* 2 2 */ u8 groups; /* 4 1 */ } __attribute__((__packed__)); /* 0 5 */ struct nx842_crypto_header_hdr hdr; /* 0 5 */ }; /* 0 5 */ struct nx842_crypto_header_group group[]; /* 5 0 */ /* size: 5, cachelines: 1, members: 2 */ /* last cacheline: 5 bytes */ } __attribute__((__packed__)); Fixes: 1e6b251ce175 ("crypto: nx - Avoid -Wflex-array-member-not-at-end warning") Cc: stable@vger.kernel.org Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org> Reviewed-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-03-27crypto: nx - annotate struct nx842_crypto_header with __counted_byThorsten Blum
Add the __counted_by() compiler attribute to the flexible array member 'group' to improve access bounds-checking via CONFIG_UBSAN_BOUNDS and CONFIG_FORTIFY_SOURCE. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-03-27crypto: marvell/cesa - use memcpy_and_pad in mv_cesa_ahash_exportThorsten Blum
Replace memset() followed by memcpy() with memcpy_and_pad() to simplify the code and to write to 'cache' only once. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-03-27crypto: s5p-sss - use unregister_{ahashes,skciphers} in probe/removeThorsten Blum
Replace multiple for loops with calls to crypto_unregister_ahashes() and crypto_unregister_skciphers(). If crypto_register_skcipher() fails in s5p_aes_probe(), log the error directly instead of checking 'i < ARRAY_SIZE(algs)' later. Also drop now-unused local index variables. No functional changes. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Reviewed-by: Vladimir Zapolskiy <vz@mleia.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-03-27ALSA: usb-audio: Add iface reset and delay quirk for AB17X USB AudioLianqin Hu
Setting up the interface when suspended/resumeing fail on this card. Adding a reset and delay quirk will eliminate this problem. usb 1-1: new full-speed USB device number 2 using xhci-hcd usb 1-1: New USB device found, idVendor=001f, idProduct=0b23 usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: AB17X USB Audio usb 1-1: Manufacturer: Generic usb 1-1: SerialNumber: 20241228172028 Signed-off-by: Lianqin Hu <hulianqin@vivo.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/PUZPR06MB6224CA59AD2B26054120B276D249A@PUZPR06MB6224.apcprd06.prod.outlook.com
2026-03-27arm64: futex: Refactor futex atomic operationYeoreum Yun
Refactor the futex atomic operations using ll/sc instructions in preparation for FEAT_LSUI support. In addition, use named operands for the inline asm. No functional change. Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com> [catalin.marinas@arm.com: remove unnecessary stringify.h include] Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2026-03-27ALSA: hda/realtek: add HP Laptop 15-fd0xxx mute LED quirkKshamendra Kumar Mishra
HP Laptop 15-fd0xxx with ALC236 codec does not handle the toggling of the mute LED. This patch adds a quirk entry for subsystem ID 0x8dd7 using ALC236_FIXUP_HP_MUTE_LED_COEFBIT2 fixup, enabling correct mute LED behavior. Signed-off-by: Kshamendra Kumar Mishra <kshamendrakumarmishra@gmail.com> Link: https://patch.msgid.link/DHAB51ISUM96.2K9SZIABIDEQ0@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-03-27ALSA: usb-audio: Exclude Scarlett 2i4 1st Gen from SKIP_IFACE_SETUPGeoffrey D. Bennett
Same issue that the Scarlett 2i2 1st Gen had: QUIRK_FLAG_SKIP_IFACE_SETUP causes distorted/flanging audio on the Scarlett 2i4 1st Gen (1235:800a). Fixes: 38c322068a26 ("ALSA: usb-audio: Add QUIRK_FLAG_SKIP_IFACE_SETUP") Reported-by: dcferreira [https://github.com/geoffreybennett/linux-fcp/issues/54] Signed-off-by: Geoffrey D. Bennett <g@b4.vu> Link: https://patch.msgid.link/acEkEbftzyNe8W7C@m.b4.vu Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-03-27ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxxCésar Montoya
The HP Pavilion 15-eg0xxx with subsystem ID 0x103c87cb uses a Realtek ALC287 codec with a mute LED wired to GPIO pin 4 (mask 0x10). The existing ALC287_FIXUP_HP_GPIO_LED fixup already handles this correctly, but the subsystem ID was missing from the quirk table. GPIO pin confirmed via manual hda-verb testing: hda-verb SET_GPIO_MASK 0x10 hda-verb SET_GPIO_DIRECTION 0x10 hda-verb SET_GPIO_DATA 0x10 Signed-off-by: César Montoya <sprit152009@gmail.com> Link: https://patch.msgid.link/20260321153603.12771-1-sprit152009@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-03-27ALSA: hda/realtek - Fixed Speaker Mute LED for HP EliteBoard G1a platformKailang Yang
On the HP EliteBoard G1a platform (models without a headphone jack). the speaker mute LED failed to function. The Sysfs ctl-led info showed empty values because the standard LED registration couldn't correctly bind to the master switch. Adding this patch will fix and enable the speaker mute LED feature. Tested-by: Chris Chiu <chris.chiu@canonical.com> Signed-off-by: Kailang Yang <kailang@realtek.com> Link: https://lore.kernel.org/279e929e884849df84687dbd67f20037@realtek.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-03-27mmc: core: Switch to use pm_ptr() for mmc_host_class_dev_pm_opsShawn Lin
Currently, the mmc_host_class_dev_pm_ops and its callback functions are wrapped in #ifdef CONFIG_PM_SLEEP to handle the conditional compilation when PM support is disabled. Replace this #ifdef usage with the standard pm_ptr() helpers. This allows the compiler to automatically optimize away the unused code paths when CONFIG_PM_SLEEP is not selected, resulting in cleaner and more maintainable code. Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-03-27mmc: core: Remove legacy 'enable-sdio-wakeup' DT property supportShawn Lin
The 'enable-sdio-wakeup' device tree property was marked as legacy and superseded by the standard 'wakeup-source' property in commit 71a0151c5c82 ("Documentation: devicetree: fix reference to legacy wakeup properties") back in 2015. Since it has been a decade and the migration to the standard property has long been completed, remove this obsolete legacy support. Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-03-27mmc: mmc_test: use kzalloc_flexRosen Penev
Simplifies allocations by using a flexible array member in these structs. Add __counted_by to get extra runtime analysis. Signed-off-by: Rosen Penev <rosenp@gmail.com> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-03-27Merge tag 'asoc-fix-v7.0-rc5' of ↵Takashi Iwai
https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v7.0 This is two week's worth of fixes and quirks so it's a bit larger than you might expect, there's nothing too exciting individually and nothing in core code.
2026-03-27pinctrl: core: Don't use "proxy" headersAndy Shevchenko
Update header inclusions to follow IWYU (Include What You Use) principle. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-03-27auxdisplay: line-display: fix NULL dereference in linedisp_releaseGuangshuo Li
linedisp_release() currently retrieves the enclosing struct linedisp via to_linedisp(). That lookup depends on the attachment list, but the attachment may already have been removed before put_device() invokes the release callback. This can happen in linedisp_unregister(), and can also be reached from some linedisp_register() error paths. In that case, to_linedisp() returns NULL and linedisp_release() dereferences it while freeing the display resources. The struct device released here is the embedded linedisp->dev used by linedisp_register(), so retrieve the enclosing object directly with container_of() instead. Fixes: 66c93809487e ("auxdisplay: linedisp: encapsulate container_of usage within to_linedisp") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com> Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
2026-03-27iommupt/amdv1: mark amdv1pt_install_leaf_entry as __always_inlineSherry Yang
After enabling CONFIG_GCOV_KERNEL and CONFIG_GCOV_PROFILE_ALL, following build failure is observed under GCC 14.2.1: In function 'amdv1pt_install_leaf_entry', inlined from '__do_map_single_page' at drivers/iommu/generic_pt/fmt/../iommu_pt.h:650:3, inlined from '__map_single_page0' at drivers/iommu/generic_pt/fmt/../iommu_pt.h:661:1, inlined from 'pt_descend' at drivers/iommu/generic_pt/fmt/../pt_iter.h:391:9, inlined from '__do_map_single_page' at drivers/iommu/generic_pt/fmt/../iommu_pt.h:657:10, inlined from '__map_single_page1.constprop' at drivers/iommu/generic_pt/fmt/../iommu_pt.h:661:1: ././include/linux/compiler_types.h:706:45: error: call to '__compiletime_assert_71' declared with attribute error: FIELD_PREP: value too large for the field 706 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) | ...... drivers/iommu/generic_pt/fmt/amdv1.h:220:26: note: in expansion of macro 'FIELD_PREP' 220 | FIELD_PREP(AMDV1PT_FMT_OA, | ^~~~~~~~~~ In the path '__do_map_single_page()', level 0 always invokes 'pt_install_leaf_entry(&pts, map->oa, PAGE_SHIFT, …)'. At runtime that lands in the 'if (oasz_lg2 == isz_lg2)' arm of 'amdv1pt_install_leaf_entry()'; the contiguous-only 'else' block is unreachable for 4 KiB pages. With CONFIG_GCOV_KERNEL + CONFIG_GCOV_PROFILE_ALL, the extra instrumentation changes GCC's inlining so that the "dead" 'else' branch still gets instantiated. The compiler constant-folds the contiguous OA expression, runs the 'FIELD_PREP()' compile-time check, and produces: FIELD_PREP: value too large for the field gcov-enabled builds therefore fail even though the code path never executes. Fix this by marking amdv1pt_install_leaf_entry as __always_inline. Fixes: dcd6a011a8d5 ("iommupt: Add map_pages op") Suggested-by: Jason Gunthorpe <jgg@nvidia.com> Signed-off-by: Sherry Yang <sherry.yang@oracle.com> Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
2026-03-27pinctrl: amd: Support new ACPI ID AMDI0033Basavaraj Natikar
Add AMDI0033 to the AMD GPIO ACPI match table. This lets the driver bind on new AMD platforms that expose this HID. Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-03-27iommu/amd: Fix illegal cap/mmio access in IOMMU debugfsGuanghui Feng
In the current AMD IOMMU debugfs, when multiple processes simultaneously access the IOMMU mmio/cap registers using the IOMMU debugfs, illegal access issues can occur in the following execution flow: 1. CPU1: Sets a valid access address using iommu_mmio/capability_write, and verifies the access address's validity in iommu_mmio/capability_show 2. CPU2: Sets an invalid address using iommu_mmio/capability_write 3. CPU1: accesses the IOMMU mmio/cap registers based on the invalid address, resulting in an illegal access. This patch modifies the execution process to first verify the address's validity and then access it based on the same address, ensuring correctness and robustness. Signed-off-by: Guanghui Feng <guanghuifeng@linux.alibaba.com> Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
2026-03-27iommu/amd: Fix illegal device-id access in IOMMU debugfsGuanghui Feng
In the current AMD IOMMU debugFS, when multiple processes use the IOMMU debugFS process simultaneously, illegal access issues can occur in the following execution flow: 1. CPU1: Sets a valid sbdf via devid_write, then checks the sbdf's validity in execution flows such as devid_show, iommu_devtbl_show, and iommu_irqtbl_show. 2. CPU2: Sets an invalid sbdf via devid_write, at which point the sbdf value is -1. 3. CPU1: accesses the IOMMU device table, IRQ table, based on the invalid SBDF value of -1, resulting in illegal access. This is especially problematic in monitoring scripts, where multiple scripts may access debugFS simultaneously, and some scripts may unexpectedly set invalid values, which triggers illegal access in debugfs. This patch modifies the execution flow of devid_show, iommu_devtbl_show, and iommu_irqtbl_show to ensure that these processes determine the validity and access based on the same device-id, thus guaranteeing correctness and robustness. Signed-off-by: Guanghui Feng <guanghuifeng@linux.alibaba.com> Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
2026-03-27iommupt: Fix short gather if the unmap goes into a large mappingJason Gunthorpe
unmap has the odd behavior that it can unmap more than requested if the ending point lands within the middle of a large or contiguous IOPTE. In this case the gather should flush everything unmapped which can be larger than what was requested to be unmapped. The gather was only flushing the range requested to be unmapped, not extending to the extra range, resulting in a short invalidation if the caller hits this special condition. This was found by the new invalidation/gather test I am adding in preparation for ARMv8. Claude deduced the root cause. As far as I remember nothing relies on unmapping a large entry, so this is likely not a triggerable bug. Cc: stable@vger.kernel.org Fixes: 7c53f4238aa8 ("iommupt: Add unmap_pages op") Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com> Reviewed-by: Samiullah Khawaja <skhawaja@google.com> Reviewed-by: Vasant Hegde <vasant.hegde@amd.com> Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
2026-03-27iommu: Do not call drivers for empty gathersJason Gunthorpe
An empty gather is coded with start=U64_MAX, end=0 and several drivers go on to convert that to a size with: end - start + 1 Which gives 2 for an empty gather. This then causes Weird Stuff to happen (for example an UBSAN splat in VT-d) that is hopefully harmless, but maybe not. Prevent drivers from being called right in iommu_iotlb_sync(). Auditing shows that AMD, Intel, Mediatek and RSIC-V drivers all do things on these empty gathers. Further, there are several callers that can trigger empty gathers, especially in unusual conditions. For example iommu_map_nosync() will call a 0 size unmap on some error paths. Also in VFIO, iommupt and other places. Cc: stable@vger.kernel.org Reported-by: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com> Closes: https://lore.kernel.org/r/11145826.aFP6jjVeTY@jkrzyszt-mobl2.ger.corp.intel.com Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com> Reviewed-by: Samiullah Khawaja <skhawaja@google.com> Reviewed-by: Robin Murphy <robin.murphy@arm.com> Reviewed-by: Vasant Hegde <vasant.hegde@amd.com> Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
2026-03-27Merge branch 'dt-reserved-mem-cleanups' into dma-mapping-for-nextMarek Szyprowski
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
2026-03-27Merge tag 'drm-xe-fixes-2026-03-26' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes - Fix UAF in SRIOV migration restore (Winiarski) - Updates to HW W/a (Roper) - VMBind remap fix (Auld) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Rodrigo Vivi <rodrigo.vivi@intel.com> Link: https://patch.msgid.link/acUgq2q2DrCUzFql@intel.com
2026-03-27Merge tag 'drm-misc-fixes-2026-03-26' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes A page mapping fix for shmem fault handler, a power-off fix for ivpu, a GFP_* flag fix for syncobj, and a MAINTAINERS update. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maxime Ripard <mripard@redhat.com> Link: https://patch.msgid.link/20260326-lush-cuddly-limpet-ab2aa9@houat
2026-03-27Docs: iio: ad7191 Correct clock configurationAmmar Mustafa
Correct the ad7191 documentation to match the datasheet: - Fix inverted CLKSEL pin logic: device uses external clock when pin is inactive, and internal CMOS/crystal when high. - Correct CMOS-compatible clock pin from MCLK2 to MCLK1. Signed-off-by: Ammar Mustafa <ammarmustafa34@gmail.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-03-27um: Replace strncpy() with strnlen()+memcpy_and_pad() in ↵Kees Cook
strncpy_chunk_from_user() Replace the deprecated[1] strncpy() with strnlen() on the source followed by memcpy_and_pad(). This function is a chunk callback for UML's strncpy_from_user() implementation, called by buffer_op() to process userspace memory one page at a time. The source is a kernel-mapped userspace address that is not guaranteed to be NUL-terminated; "len" bounds how many bytes to read from it. By measuring the source string length first with strnlen(), we avoid reading past the NUL terminator in the source. memcpy_and_pad() then copies the string content and zero-fills the remainder of the chunk, preserving the original strncpy() behavior exactly: copy up to the first NUL, then pad with zeros to the full length. strtomem_pad() would be the idiomatic helper for this strnlen() + memcpy_and_pad() pattern, but it requires a compile-time-determinable destination size (via ARRAY_SIZE()). Here the destination is a char * into a caller-provided buffer and the chunk length is a runtime value, so the explicit two-step is necessary. No behavioral change: the same bytes are written to the destination (string content followed by zero padding), the pointer advances by the same amount, and the NUL-found return condition is unchanged. Link: https://github.com/KSPP/linux/issues/90 [1] Signed-off-by: Kees Cook <kees@kernel.org> Link: https://patch.msgid.link/20260323171713.work.839-kees@kernel.org Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-03-27Merge tag 'drm-intel-fixes-2026-03-26' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - DP tunnel error handling fix - Spurious GMBUS timeout fix - Unlink NV12 planes earlier - Order OP vs. timeout correctly in __wait_for() Signed-off-by: Dave Airlie <airlied@redhat.com> From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> Link: https://patch.msgid.link/acTdjAoOGkzl3dcc@jlahtine-mobl
2026-03-27Merge tag 'mediatek-drm-next-20260325' of ↵Dave Airlie
https://git.kernel.org/pub/scm/linux/kernel/git/chunkuang.hu/linux into drm-next Mediatek DRM Next - 20260325 1. mtk_dsi: enable hs clock during pre-enable 2. Remove all conflicting aperture devices during probe 3. Add support for mt8167 display blocks Signed-off-by: Dave Airlie <airlied@redhat.com> From: Chun-Kuang Hu <chunkuang.hu@kernel.org> Link: https://patch.msgid.link/20260325160721.4891-1-chunkuang.hu@kernel.org
2026-03-27Merge tag 'amd-drm-fixes-7.0-2026-03-25' of ↵Dave Airlie
https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-7.0-2026-03-25: amdgpu: - DSC fix - Module parameter parsing fix - PASID reuse fix - drm_edid leak fix - SMU 13.x fixes - SMU 14.x fix - Fence fix in amdgpu_amdkfd_submit_ib() - LVDS fixes - GPU page fault fix for non-4K pages amdkfd: - Ordering fix in kfd_ioctl_create_process() Signed-off-by: Dave Airlie <airlied@redhat.com> From: Alex Deucher <alexander.deucher@amd.com> Link: https://patch.msgid.link/20260325155600.4184877-1-alexander.deucher@amd.com
2026-03-27arm64: dts: hisilicon: Rename dwmmc nodes to mmcBhargav Joshi
The core mmc devicetree schema expects mmc controller nodes to be named using '^mmc(@.*)?$' pattern. The legacy Hisilicon SoC files (hi3660, hi3670, and hi6220) previously used the 'dwmmc' prefix for their nodes. This caused warnings during dtbs_check. Rename the 'dwmmc' nodes to 'mmc' to comply with the standard schema and dtbs_check warnings. The legacy phandle labels are kept intact. Signed-off-by: Bhargav Joshi <rougueprince47@gmail.com> Acked-by: Zhangfei Gao <zhangfei.gao@linaro.org> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Wei Xu <xuwei5@hisilicon.com>
2026-03-27arm64: dts: ti: k3-am642-evm: Add ICSSG0 overlay for dual EMAC supportMeghana Malladi
Add device tree overlay to enable ICSSG0 dual EMAC support on AM642 EVM. This overlay enables both ICSSG0 Ethernet interfaces (port0 and port1) in dual EMAC mode. Users can combine this with the existing ICSSG1 overlay to enable all four ICSSG interfaces if needed. Signed-off-by: Meghana Malladi <m-malladi@ti.com> Link: https://patch.msgid.link/20260323090358.632329-2-m-malladi@ti.com Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
2026-03-27arm64: dts: ti: k3-am62p-verdin: Add ZinniaFrancesco Dolcini
Add Zinnia Carrier Board mated with Verdin AM62P. It features 1 x RS232, 1 x RS485, 1 x CAN, 3 x isolated digital I/O, 2 x 1GBit/s Ethernet, a mini PCIe slot with USB / SIM card connector for a modem, USB and SD card interfaces. Link: https://www.toradex.com/products/carrier-board/zinnia-carrier-board Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com> Link: https://patch.msgid.link/20260324093705.26730-8-francesco@dolcini.it Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
2026-03-27arm64: dts: ti: k3-am62p-verdin: Add SPI_1_CS as GPIOFrancesco Dolcini
Add a pinctrl to use SPI_1 CS as GPIO. Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com> Link: https://patch.msgid.link/20260324093705.26730-7-francesco@dolcini.it Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
2026-03-27arm64: dts: ti: k3-am62p-verdin: Split UART_2 pinctrl groupFrancesco Dolcini
Some carrier board reuse the UART_2 control signals as GPIO, split the pinctrl RTS/CTS in separated nodes to maximize flexibility. Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com> Link: https://patch.msgid.link/20260324093705.26730-6-francesco@dolcini.it Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
2026-03-27arm64: dts: ti: k3-am62-verdin: Add ZinniaFrancesco Dolcini
Add Zinnia Carrier Board mated with Verdin AM62. It features 1 x RS232, 1 x RS485, 1 x CAN, 3 x isolated digital I/O, 2 x 1GBit/s Ethernet, a mini PCIe slot with USB / SIM card connector for a modem, USB and SD card interfaces. Link: https://www.toradex.com/products/carrier-board/zinnia-carrier-board Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com> Link: https://patch.msgid.link/20260324093705.26730-5-francesco@dolcini.it Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
2026-03-27arm64: dts: ti: k3-am62-verdin: Split UART_2 pinctrl groupFrancesco Dolcini
Some carrier board reuse the UART_2 control signals as GPIO, split the pinctrl RTS/CTS in separated nodes to maximize flexibility. Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com> Link: https://patch.msgid.link/20260324093705.26730-4-francesco@dolcini.it Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
2026-03-27arm64: dts: ti: k3-am62-verdin: Fix SPI_1 GPIO CS pinctrl labelFrancesco Dolcini
Fix SPI_1_CS GPIO pinmux label, this is spi1_cs, not qspi1_io4. There are no user of this label yet, therefore this change does not create any compatibility issue. Fixes: fcb335934c51 ("arm64: dts: ti: verdin-am62: Improve spi1 chip-select pinctrl") Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com> Link: https://patch.msgid.link/20260324093705.26730-3-francesco@dolcini.it Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>