summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-03-26ASoC: SOF: Intel: Add a is_amp flag to fix the wrong name prefixDerek Fang
According to the Intel sof design, it will create the name prefix appended with amp index for the amp codec only, such as: rt1318-1, rt1318-2, etc... But the rt1320 is a codec with amp and mic codec functions, it doesn't have the amp index in its name prefix as above. And then it will be hard to identify the codec if in multi-rt1320 case. So we add a flag to force the amp index to be appended. Signed-off-by: Derek Fang <derek.fang@realtek.com> Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com> Link: https://patch.msgid.link/20260326075303.1083567-3-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-26ASoC: Intel: soc-acpi-intel-ptl-match: drop rt722 monolithic match tablesMac Chiang
Use functional topologies to support RT722 topologies with/without amplifiers, e.g. sof-ptl-rt722.tplg, sof-ptl-rt722-rt1320.tplg... If these entries are not removed, they will find the first same link of sof-ptl-rt722.tplg. Signed-off-by: Mac Chiang <mac.chiang@intel.com> Co-developed-by: Derek Fang <derek.fang@realtek.com> Signed-off-by: Derek Fang <derek.fang@realtek.com> Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com> Link: https://patch.msgid.link/20260326075303.1083567-2-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-26dt-bindings: arm: fsl: add Verdin iMX95Ernest Van Hoecke
Add DT compatible strings for the Verdin i.MX95 SoM and its supported carrier boards: the Verdin Development Board, and the Dahlia, Ivy, Mallow and Yavia carrier boards. Link: https://www.toradex.com/computer-on-modules/verdin-arm-family/nxp-imx95 Link: https://www.toradex.com/products/carrier-board/verdin-development-board-kit Link: https://www.toradex.com/products/carrier-board/dahlia-carrier-board-kit Link: https://www.toradex.com/products/carrier-board/ivy-carrier-board Link: https://www.toradex.com/products/carrier-board/mallow-carrier-board Link: https://www.toradex.com/products/carrier-board/yavia Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Ernest Van Hoecke <ernest.vanhoecke@toradex.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-03-26dt-bindings: arm: fsl: add MBa93xxLA-MINIMartin Schmiedel
Adds support for the MBa93xxLA-MINI SBC. https://www.tq-group.com/en/products/tq-embedded/arm-architecture/mba93xxla-mini/ Signed-off-by: Martin Schmiedel <Martin.Schmiedel@tq-group.com> Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com> Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com> Acked-by: Conor Dooley <conor.dooley@microchip.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-03-26dt-bindings: arm: add bindings for TQMa95xxLAMarkus Niebel
TQMa95xxLA is a SOM using NXP i.MX95 CPU. MBa95xxCA is a carrier reference design / starter kit board. [1] https://www.tq-group.com/en/products/tq-embedded/arm-architecture/tqma95xxla/ Signed-off-by: Markus Niebel <Markus.Niebel@ew.tq-group.com> Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com> Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-03-26dt-bindings: arm: lpc: add missed lpc43xx boardFrank Li
Add missed legancy lpc43xx board compatible string to fix below CHECK_DTB warnings: arch/arm/boot/dts/nxp/lpc/lpc4337-ciaa.dtb: /: failed to match any schema with compatible: ['ciaa,lpc4337', 'nxp,lpc4337', 'nxp,lpc4350'] Reviewed-by: Vladimir Zapolskiy <vz@mleia.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-03-26dt-bindings: arm: fsl: Add NXP S32N79 SoC and RDB boardCiprian Marian Costea
Add device tree binding documentation for the NXP S32N79 automotive SoC and the S32N79 Reference Design Board (S32N79-RDB). The S32N79 is an automotive-grade SoC featuring eight ARM Cortex-A78AE cores organized for high-performance networking and gateway applications in vehicles. Co-developed-by: Larisa Grigore <larisa.grigore@nxp.com> Signed-off-by: Larisa Grigore <larisa.grigore@nxp.com> Signed-off-by: Ciprian Marian Costea <ciprianmarian.costea@oss.nxp.com> Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-03-26dt-bindings: interrupt-controller: fsl,irqsteer: add S32N79 supportCiprian Marian Costea
Add compatible string for the interrupt steering controller used in NXP S32N79 SoC. The S32N79 SoC differs from the i.MX version by not implementing the CHANCTRL register, but otherwise maintains the same programming model and register layout. Co-developed-by: Larisa Grigore <larisa.grigore@nxp.com> Signed-off-by: Larisa Grigore <larisa.grigore@nxp.com> Signed-off-by: Ciprian Marian Costea <ciprianmarian.costea@oss.nxp.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-03-26dt-bindings: arm: fsl: Add compatible for i.MX8MP audio board (version 2)Shengjiu Wang
Introduce a new DT compatible string for the NXP i.MX8MP audio board (version 2). i.MX Audio Board is a configurable and functional audio processing platform. Integrating a variety of audio input and output interfaces into the system, the i.MX Audio Board supports HDMI input, HDMI eARC, S/PDIF I/O, 2-ch ADC line-in, 24-ch DAC line-out and more. Based on these features, rich audio application cases can be realized. Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com> Acked-by: Conor Dooley <conor.dooley@microchip.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-03-26dt-bindings: arm: fsl: Add various solidrun i.MX8M boardsJosua Mayer
Add bindings for various SolidRun boards: - i.MX8MP HummingBoard IIoT - based on the SolidRun i.MX8M Plus SoM - SolidSense N8 - single-board design with i.MX8M Nano - i.MX8M Mini System on Module - i.MX8M Mini HummingBoard Ripple Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Josua Mayer <josua@solid-run.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-03-26accel/amdxdna: Fix leak when pinning ubuf pagesMax Zhen
When pin_user_pages_fast() returns fewer pages than requested, the pages that were successfully pinned are not released, leading to a leak. Fix this by unpinning any partially pinned pages before returning failure. Fixes: bd72d4acda10 ("accel/amdxdna: Support user space allocated buffer") Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Signed-off-by: Max Zhen <max.zhen@amd.com> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com> Link: https://patch.msgid.link/20260326010642.2596525-1-lizhi.hou@amd.com
2026-03-26irqchip/renesas-rzg2l: Add shared interrupt supportBiju Das
The RZ/G3L SoC has 16 external interrupts, of which 8 are shared with TINT (GPIO interrupts), whereas RZ/G2L has only 8 external interrupts with no sharing. The shared interrupt line selection between external interrupt and GPIO interrupt is based on the INTTSEL register. Add shared_irq_cnt variable to struct rzg2l_hw_info handle these differences. Add used_irqs bitmap to struct rzg2l_irqc_priv to track allocation state. In the alloc callback, use test_and_set_bit() to enforce mutual exclusion and configure the INTTSEL register to route to either the external interrupt or TINT. In the free callback, use test_and_clear_bit() to release the shared interrupt line and reset the INTTSEL. Also add INTTSEL register save/restore support to the suspend/resume path. Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260325192451.172562-17-biju.das.jz@bp.renesas.com
2026-03-26irqchip/renesas-rzg2l: Add RZ/G3L supportBiju Das
The IRQC block on the RZ/G3L SoC is almost identical to the one found on the RZ/G2L SoC, with the following differences: - The number of GPIO interrupts for TINT selection is 113 instead of 123. - The pin index and TINT selection index are not in the 1:1 map. - The number of external interrupts are 16 instead of 8, out of these 8 external interrupts are shared with TINT. Add support for the RZ/G3L driver by filling the rzg2l_hw_info table and adding LUT for mapping between pin index and TINT selection index. Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260325192451.172562-16-biju.das.jz@bp.renesas.com
2026-03-26irqchip/renesas-rzg2l: Drop IRQC_IRQ_COUNT macroBiju Das
The total number of external interrupts in RZ/G2L and RZ/G3L SoC are different. The RZ/G3L has 16 external interrupts whereas RZ/G2L has only 8 external interrupts. Add irq_count variable in struct rzg2l_hw_info to handle these differences and drop the macro IRQC_IRQ_COUNT. Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260325192451.172562-15-biju.das.jz@bp.renesas.com
2026-03-26irqchip/renesas-rzg2l: Drop IRQC_TINT_START macroBiju Das
The IRQC_TINT_START value is different for RZ/G3L and RZ/G2L SoC. Add tint_start variable in struct rzg2l_hw_info to handle this difference and drop the macro IRQC_TINT_START. While at it, update the variable type of titseln, tssr_offset, tssr_index, index, and sense to unsigned int, in rzg2l_tint_set_edge() as these variables are used only for calculation. Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260325192451.172562-14-biju.das.jz@bp.renesas.com
2026-03-26irqchip/renesas-rzg2l: Drop IRQC_NUM_IRQ macroBiju Das
The total number of interrupts in RZ/G2L and RZ/G3L SoC are different. Introduce struct rzg2l_hw_info to handle the hardware differences and replace the macro IRQC_NUM_IRQ with num_irq variable in struct rzg2l_hw_info. Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260325192451.172562-13-biju.das.jz@bp.renesas.com
2026-03-26irqchip/renesas-rzg2l: Dynamically allocate fwspec arrayBiju Das
The total number of interrupts in RZ/G2L and RZ/G3L SoC are different. The RZ/G3L has 16 external interrupts whereas RZ/G2L has only 8 external interrupts. Dynamically allocate fwspec memory instead of static allocation to support both SoCs. Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260325192451.172562-12-biju.das.jz@bp.renesas.com
2026-03-26irqchip/renesas-rzg2l: Split rzfive_irqc_{mask,unmask} into separate IRQ and ↵Biju Das
TINT handlers rzfive_irqc_mask() and rzfive_irqc_unmask() use hw_irq range checks to dispatch between IRQ and TINT masking operations. Split each into two dedicated handlers — rzfive_irqc_irq_mask(), rzfive_irqc_tint_mask(), rzfive_irqc_irq_unmask(), and rzfive_irqc_tint_unmask() — each operating unconditionally on its respective interrupt type, removing the runtime conditionals. Assign the IRQ-specific handlers to rzfive_irqc_irq_chip and the TINT-specific handlers to rzfive_irqc_tint_chip, consistent with the separation applied to the EOI, set_type, and enable/disable callbacks in previous patches. While at it, simplify rzfive_irqc_{irq,tint}_{mask,unmask}() by replacing raw_spin_lock locking/unlocking with scoped_guard(). Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260325192451.172562-11-biju.das.jz@bp.renesas.com
2026-03-26irqchip/renesas-rzg2l: Split rzfive_tint_irq_endisable() into separate IRQ ↵Biju Das
and TINT helpers rzfive_tint_irq_endisable() handles both IRQ and TINT enable/disable paths via a hw_irq range check. Split this into two dedicated helpers, rzfive_irq_endisable() for IRQ interrupts and rzfive_tint_endisable() for TINT interrupts, each operating unconditionally on their respective interrupt type. While at it, simplify rzfive_{irq,tint}_endisable by replacing raw_spin_lock locking/unlocking with guard() and update the variable types of offset, tssr_offset, and tssr_index to unsigned int, as these variables are used only for calculation. Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260325192451.172562-10-biju.das.jz@bp.renesas.com
2026-03-26irqchip/renesas-rzg2l: Replace rzg2l_irqc_irq_{enable,disable} with ↵Biju Das
TINT-specific handlers rzg2l_irqc_irq_disable() and rzg2l_irqc_irq_enable() are used by both the IRQ and TINT chips, but only perform TINT-specific work via rzg2l_tint_irq_endisable(), guarded by a hw_irq range check. Since the IRQ chip does not require this extra enable/disable handling, replace its callbacks with the generic irq_chip_disable_parent() and irq_chip_enable_parent() directly. While at it, simplify rzfive_irqc_irq_enable() by replacing raw_spin_lock locking/unlocking with guard() and update the variable types of offset, tssr_offset, and tssr_index to unsigned int, as these variables are used only for calculation. Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260325192451.172562-9-biju.das.jz@bp.renesas.com
2026-03-26irqchip/renesas-rzg2l: Split set_type handler into separate IRQ and TINT ↵Biju Das
functions The common rzg2l_irqc_set_type() handler uses hw_irq range checks to dispatch to either rzg2l_irq_set_type() or rzg2l_tint_set_edge(). Split this into two dedicated handlers, rzg2l_irqc_irq_set_type() and rzg2l_irqc_tint_set_type(), each calling only their respective type configuration function without runtime conditionals. Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260325192451.172562-8-biju.das.jz@bp.renesas.com
2026-03-26irqchip/renesas-rzg2l: Split EOI handler into separate IRQ and TINT functionsBiju Das
The common rzg2l_irqc_eoi() handler uses a conditional to determine whether to clear an IRQ or an TINT interrupt. Split this into two dedicated handlers, rzg2l_irqc_irq_eoi() and rzg2l_irqc_tint_eoi(), each handling only their respective interrupt type without the need for range checks. While at it, simplify rzg2l_irqc_{irq,tint}_eoi() by replacing raw_spin_lock locking/unlocking with scoped_guard(). Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260325192451.172562-7-biju.das.jz@bp.renesas.com
2026-03-26irqchip/renesas-rzg2l: Replace single irq_chip with per-region irq_chip ↵Biju Das
instances The driver uses a single irq_chip instance shared across all interrupt types, relying on dispatcher callbacks to differentiate between IRQ and TINT regions at runtime. Replace the per-SoC irq_chip and its dispatcher callbacks with dedicated irq_chip instances for each interrupt region: IRQ and TINT. Subsequent patches will add per-region callbacks for IRQ and TINT from the common code. Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260325192451.172562-6-biju.das.jz@bp.renesas.com
2026-03-26irqchip/renesas-rzg2l: Drop redundant IRQC_TINT_START check in ↵Biju Das
rzg2l_irqc_alloc() The check `hwirq < IRQC_TINT_START` in rzg2l_irqc_alloc() is unnecessary as the condition is already guaranteed to be false at that point in the code. The outer `if (hwirq > IRQC_IRQ_COUNT)` block ensures that hwirq is always above IRQC_IRQ_COUNT before reaching this check, and since IRQC_TINT_START <= IRQC_IRQ_COUNT, the guard can never trigger. Remove the dead code to simplify the allocation path. Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260325192451.172562-5-biju.das.jz@bp.renesas.com
2026-03-26irqchip/renesas-rzg2l: Fix error path in rzg2l_irqc_common_probe()Biju Das
Replace pm_runtime_put() with pm_runtime_put_sync() when irq_domain_create_hierarchy() fails to ensure the device suspends synchronously before devres cleanup disables runtime PM via pm_runtime_disable(). [ tglx: Fix up subject and change log to be precise ] Fixes: 7de11369ef30 ("irqchip/renesas-rzg2l: Use devm_pm_runtime_enable()") Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260325192451.172562-4-biju.das.jz@bp.renesas.com
2026-03-26dt-bindings: interrupt-controller: renesas,rzg2l-irqc: Document RZ/G3L SoCBiju Das
Document RZ/G3L (R9A08G046) IRQC. The IRQC block on the RZ/G3L SoC is nearly identical to that found on the RZ/G3S SoC, with the following differences: it supports more external interrupts and GPT error interrupts, and adds registers for GPT/MTU interrupt selection and shared interrupt selection between external interrupt and TINT. A new compatible string "renesas,r9a08g046-irqc" is therefore introduced for the RZ/G3L SoC. Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Reviewed-by: Rob Herring (Arm) <robh@kernel.org> Link: https://patch.msgid.link/20260325192451.172562-3-biju.das.jz@bp.renesas.com
2026-03-26dt-bindings: interrupt-controller: renesas,rzg2l-irqc: Use pattern for ↵Biju Das
interrupt-names Simplify the bindings by using pattern property for interrupt-names. It also allows to change the ordering of interrupts. Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Reviewed-by: Rob Herring (Arm) <robh@kernel.org> Link: https://patch.msgid.link/20260325192451.172562-2-biju.das.jz@bp.renesas.com
2026-03-26dt-bindings: firmware: qcom,scm: Document ipq9650 SCMKathiravan Thirumoorthy
Document the scm compatible for ipq9650 SoC. Signed-off-by: Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com> Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260325-ipq9650_scm-v1-1-ad6a3fe53f38@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-03-26RISC-V: KVM: selftests: Add RISC-V SBI STA shmem alignment testsJiakai Xu
Add RISC-V KVM selftests to verify the SBI Steal-Time Accounting (STA) shared memory alignment requirements. The SBI specification requires the STA shared memory GPA to be 64-byte aligned, or set to all-ones to explicitly disable steal-time accounting. This test verifies that KVM enforces the expected behavior when configuring the SBI STA shared memory via KVM_SET_ONE_REG. Specifically, the test checks that: - misaligned GPAs are rejected with -EINVAL - 64-byte aligned GPAs are accepted - all-ones GPA is accepted Signed-off-by: Jiakai Xu <xujiakai2025@iscas.ac.cn> Signed-off-by: Jiakai Xu <jiakaiPeanut@gmail.com> Reviewed-by: Andrew Jones <andrew.jones@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260303010859.1763177-4-xujiakai2025@iscas.ac.cn Signed-off-by: Anup Patel <anup@brainfault.org>
2026-03-26KVM: selftests: Refactor UAPI tests into dedicated functionJiakai Xu
Move steal time UAPI tests from steal_time_init() into a separate check_steal_time_uapi() function for better code organization and maintainability. Previously, x86 and ARM64 architectures performed UAPI validation tests within steal_time_init(), mixing initialization logic with uapi tests. Changes by architecture: x86_64: - Extract MSR reserved bits test from steal_time_init() - Move to check_steal_time_uapi() which tests that setting MSR_KVM_STEAL_TIME with KVM_STEAL_RESERVED_MASK fails ARM64: - Extract three UAPI tests from steal_time_init(): Device attribute support check Misaligned IPA rejection (EINVAL) Duplicate IPA setting rejection (EEXIST) - Move all tests to check_steal_time_uapi() RISC-V: - Add empty check_steal_time_uapi() stub for future use - No changes to steal_time_init() (had no tests to extract) The new check_steal_time_uapi() function: - Is called once before the per-VCPU test loop No functional change intended. Suggested-by: Andrew Jones <andrew.jones@oss.qualcomm.com> Signed-off-by: Jiakai Xu <xujiakai2025@iscas.ac.cn> Signed-off-by: Jiakai Xu <jiakaiPeanut@gmail.com> Reviewed-by: Andrew Jones <andrew.jones@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260303010859.1763177-3-xujiakai2025@iscas.ac.cn Signed-off-by: Anup Patel <anup@brainfault.org>
2026-03-26RISC-V: KVM: Validate SBI STA shmem alignment in kvm_sbi_ext_sta_set_reg()Jiakai Xu
The RISC-V SBI Steal-Time Accounting (STA) extension requires the shared memory physical address to be 64-byte aligned, or set to all-ones to explicitly disable steal-time accounting. KVM exposes the SBI STA shared memory configuration to userspace via KVM_SET_ONE_REG. However, the current implementation of kvm_sbi_ext_sta_set_reg() does not validate the alignment of the configured shared memory address. As a result, userspace can install a misaligned shared memory address that violates the SBI specification. Such an invalid configuration may later reach runtime code paths that assume a valid and properly aligned shared memory region. In particular, KVM_RUN can trigger the following WARN_ON in kvm_riscv_vcpu_record_steal_time(): WARNING: arch/riscv/kvm/vcpu_sbi_sta.c:49 at kvm_riscv_vcpu_record_steal_time WARN_ON paths are not expected to be reachable during normal runtime execution, and may result in a kernel panic when panic_on_warn is enabled. Fix this by validating the computed shared memory GPA at the KVM_SET_ONE_REG boundary. A temporary GPA is constructed and checked before committing it to vcpu->arch.sta.shmem. The validation allows either a 64-byte aligned GPA or INVALID_GPA (all-ones), which disables STA as defined by the SBI specification. This prevents invalid userspace state from reaching runtime code paths that assume SBI STA invariants and avoids unexpected WARN_ON behavior. Fixes: f61ce890b1f074 ("RISC-V: KVM: Add support for SBI STA registers") Signed-off-by: Jiakai Xu <xujiakai2025@iscas.ac.cn> Signed-off-by: Jiakai Xu <jiakaiPeanut@gmail.com> Reviewed-by: Andrew Jones <andrew.jones@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260303010859.1763177-2-xujiakai2025@iscas.ac.cn Signed-off-by: Anup Patel <anup@brainfault.org>
2026-03-26rust: drm: use new sync::aref path for importsAlice Ryhl
ARef and AlwaysRefCounted are being moved to sync::aref, and the re-exports under types are planned to be removed. Thus, update imports to the new path. Acked-by: Danilo Krummrich <dakr@kernel.org> Reviewed-by: Gary Guo <gary@garyguo.net> Link: https://patch.msgid.link/20260326-drm-rust-next-fix-aref-v1-2-7f6f58d2828a@google.com Signed-off-by: Alice Ryhl <aliceryhl@google.com>
2026-03-26rust: workqueue: use new sync::aref path for importsAlice Ryhl
ARef and AlwaysRefCounted are being moved to sync::aref, and the re-exports under types are planned to be removed. Thus, update imports to the new path. Acked-by: Danilo Krummrich <dakr@kernel.org> Reviewed-by: Gary Guo <gary@garyguo.net> Link: https://patch.msgid.link/20260326-drm-rust-next-fix-aref-v1-1-7f6f58d2828a@google.com Signed-off-by: Alice Ryhl <aliceryhl@google.com>
2026-03-26Merge tag 'pinctrl-v7.0-3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fixes from Linus Walleij: - Implement .get_direction() in the spmi-gpio gpio_chip Recent changes makes this start to print warnings and it's not nice, let's just fix it - Clamp the return value of gpio_get() in the Renesas RZA1 driver - Add the GPIO_GENERIC dependency to the STM32 HDP driver - Modify the Mediatek driver to accept devices that do not use external interrupts (EINT) at all - Fix flag propagation in the Sunxi driver, so that we can fix an issue with uninitialized pins in a follow-up patch using said flags * tag 'pinctrl-v7.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl: sunxi: fix gpiochip_lock_as_irq() failure when pinmux is unknown pinctrl: sunxi: pass down flags to pinctrl routines pinctrl: mediatek: common: Fix probe failure for devices without EINT pinctrl: stm32: fix HDP driver dependency on GPIO_GENERIC pinctrl: renesas: rza1: Normalize return value of gpio_get() pinctrl: qcom: spmi-gpio: implement .get_direction() pinctrl: renesas: rzt2h: Fix invalid wait context pinctrl: renesas: rzt2h: Fix device node leak in rzt2h_gpio_register()
2026-03-26clk: qcom: gcc-eliza: Enable FORCE_MEM_CORE_ON for UFS AXI PHY clockAbel Vesa
According to internal documentation, the UFS AXI PHY clock requires FORCE_MEM_CORE_ON to be enabled for UFS MCQ mode to work. Without this, the UFS controller fails when operating in MCQ mode, which is already enabled in the device tree. The UFS PHY ICE core clock already has this bit set, so apply the same configuration to the UFS PHY AXI clock. Fixes: 3d356ab4a1ec ("clk: qcom: Add support for Global clock controller on Eliza") Reported-by: Nitin Rawat <nitin.rawat@oss.qualcomm.com> Signed-off-by: Abel Vesa <abel.vesa@oss.qualcomm.com> Reviewed-by: Taniya Das <taniya.das@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260323-eliza-gcc-set-ufs-axi-phyforce-mem-core-on-v1-1-b6b7a6f3f8c5@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-03-26perf/arm-cmn: Fix resource_size_t printk specifier in arm_cmn_init_dtc()Nathan Chancellor
When building for 32-bit ARM, there is a warning when using the %llx specifier to print a resource_size_t variable: drivers/perf/arm-cmn.c: In function 'arm_cmn_init_dtc': drivers/perf/arm-cmn.c:2149:73: error: format '%llx' expects argument of type 'long long unsigned int', but argument 4 has type 'resource_size_t' {aka 'unsigned int'} [-Werror=format=] 2149 | "Failed to request DTC region 0x%llx\n", base); | ~~~^ ~~~~ | | | | | resource_size_t {aka unsigned int} | long long unsigned int | %x Use the %pa specifier to handle the possible sizes of phys_addr_t properly. This requires passing the variable by reference. Fixes: 5394396ff548 ("perf/arm-cmn: Stop claiming entire iomem region") Signed-off-by: Nathan Chancellor <nathan@kernel.org> Reviewed-by: Robin murphy <robin.murphy@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-03-26perf/arm-cmn: Fix incorrect error check for devm_ioremap()Chen Ni
Check devm_ioremap() return value for NULL instead of ERR_PTR and return -ENOMEM on failure. devm_ioremap() never returns ERR_PTR, using IS_ERR() skips the error path and may cause a NULL pointer dereference. Fixes: 5394396ff548 ("perf/arm-cmn: Stop claiming entire iomem region") Signed-off-by: Chen Ni <nichen@iscas.ac.cn> Signed-off-by: Will Deacon <will@kernel.org>
2026-03-26Merge tag 'dma-mapping-7.0-2026-03-25' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux Pull dma-mapping fixes from Marek Szyprowski: "A set of fixes for DMA-mapping subsystem, which resolve false- positive warnings from KMSAN and DMA-API debug (Shigeru Yoshida and Leon Romanovsky) as well as a simple build fix (Miguel Ojeda)" * tag 'dma-mapping-7.0-2026-03-25' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux: dma-mapping: add missing `inline` for `dma_free_attrs` mm/hmm: Indicate that HMM requires DMA coherency RDMA/umem: Tell DMA mapping that UMEM requires coherency iommu/dma: add support for DMA_ATTR_REQUIRE_COHERENT attribute dma-direct: prevent SWIOTLB path when DMA_ATTR_REQUIRE_COHERENT is set dma-mapping: Introduce DMA require coherency attribute dma-mapping: Clarify valid conditions for CPU cache line overlap dma-mapping: handle DMA_ATTR_CPU_CACHE_CLEAN in trace output dma-debug: Allow multiple invocations of overlapping entries dma: swiotlb: add KMSAN annotations to swiotlb_bounce()
2026-03-26arm64: dts: qcom: hamoa-evk: Add DP0/DP1 audio playback supportLe Qi
The hamoa-evk DTS currently lacks DAI links for DP0 and DP1, preventing the sound card from exposing these playback paths. Add the missing links to enable audio output on both DP interfaces. Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Le Qi <le.qi@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260210024037.3719191-1-le.qi@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-03-26irqchip/loongson-pch-lpc: Enable building on MIPS Loongson64Icenowy Zheng
As the driver now supports OF-based platforms, it's now possible to use it on MIPS Loongson64 machines. Drop the requirement of LOONGARCH for this driver, to allow build on both MIPS-based and LoongArch-based Loongson systems. Signed-off-by: Icenowy Zheng <zhengxingda@iscas.ac.cn> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Reviewed-by: Jiaxun Yang <jiaxun.yang@flygoat.com> Reviewed-by: Huacai Chen <chenhuacai@loongson.cn> Link: https://patch.msgid.link/20260321092032.3502701-7-zhengxingda@iscas.ac.cn
2026-03-26irqchip/loongson-pch-lpc: Add OF init codeIcenowy Zheng
The OF-based MIPS Loongson-3 systems can also have a PCH LPC interrupt controller. Add OF-based initialization code for this driver. Co-developed-by: Jiaxun Yang <jiaxun.yang@flygoat.com> Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com> Signed-off-by: Icenowy Zheng <zhengxingda@iscas.ac.cn> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Reviewed-by: Huacai Chen <chenhuacai@loongson.cn> Link: https://patch.msgid.link/20260321092032.3502701-6-zhengxingda@iscas.ac.cn
2026-03-26irqchip/loongson-pch-lpc: Extract non-ACPI-related code from ACPI initIcenowy Zheng
A lot of code can be shared between the existing ACPI init flow with the upcoming OF init flow. Extract it into a dedicated function. The re-ordering of parent interrupt allocation requires the architecture code to reserve legacy interrupts from the dynamic allocation by overriding arch_dynirq_lower_bound(), otherwise the parent of LPC irqchip will be allocated in the intended static range of LPC interrupts, which leads to allocation failure of LPC interrupts. Co-developed-by: Jiaxun Yang <jiaxun.yang@flygoat.com> Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com> Signed-off-by: Icenowy Zheng <zhengxingda@iscas.ac.cn> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Reviewed-by: Huacai Chen <chenhuacai@loongson.cn> Link: https://patch.msgid.link/20260321092032.3502701-5-zhengxingda@iscas.ac.cn
2026-03-26dt-bindings: interrupt-controller: Add LS7A PCH LPCIcenowy Zheng
Loongson 7A series PCH contains an LPC controller with an interrupt controller. Add the device tree binding for the interrupt controller. Signed-off-by: Icenowy Zheng <zhengxingda@iscas.ac.cn> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Reviewed-by: Jiaxun Yang <jiaxun.yang@flygoat.com> Reviewed-by: Huacai Chen <chenhuacai@loongson.cn> Reviewed-by: Rob Herring (Arm) <robh@kernel.org> Link: https://patch.msgid.link/20260321092032.3502701-4-zhengxingda@iscas.ac.cn
2026-03-26LoongArch: Override arch_dynirq_lower_bound to reserve LPC IRQsIcenowy Zheng
Loongson 7A PCH chips all contain a LPC controller, which is used in some devices to connect legacy ISA devices (e.g. 8259 PS/2 controller). The LPC irqchip driver will register LPC interrupts at the fixed range 0~15, and the PCH PIC irqchip driver uses dynamic allocation. However the LPC interrupt numbers are currently not exempted from dynamic allocation. The current setup work by accident because the LPC interrupt controller is the first consumer of PIC interrupt controller, and the PIC interrupt number is allocated after LPC interrupts are registered. Such setup is fragile and will stop to work when the LPC irqchip driver is reworked. Override arch_dynirq_lower_bound() to reserve LPC interrupts from dynamic allocation, to prevent interrupt number collision and allow rework of the LPC irqchip driver. Signed-off-by: Icenowy Zheng <zhengxingda@iscas.ac.cn> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Reviewed-by: Huacai Chen <chenhuacai@loongson.cn> Link: https://patch.msgid.link/20260321092032.3502701-3-zhengxingda@iscas.ac.cn
2026-03-26MIPS: loongson64: Override arch_dynirq_lower_bound to reserve LPC IRQsIcenowy Zheng
On some Loongson 3A devices, a LPC bus is present and some legacy devices (e.g. 8259) on it expect hardcoded low interrupt numbers. However currently the expected low range interrupt numbers are not exempted from the dynamic allocation, which leads to conflicts when registering LPC interrupts in the fixed range. Override arch_dynirq_lower_bound() to reserve these low range interrupt numbers and prevent them from being dynamically allocated. Signed-off-by: Icenowy Zheng <zhengxingda@iscas.ac.cn> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Reviewed-by: Huacai Chen <chenhuacai@loongson.cn> Link: https://patch.msgid.link/20260321092032.3502701-2-zhengxingda@iscas.ac.cn
2026-03-26Merge branch 'irq/urgent' into irq/driversThomas Gleixner
to fixup a trivial conflict with pending upstream fixes.
2026-03-26futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy()Hao-Yu Yang
During futex_key_to_node_opt() execution, vma->vm_policy is read under speculative mmap lock and RCU. Concurrently, mbind() may call vma_replace_policy() which frees the old mempolicy immediately via kmem_cache_free(). This creates a race where __futex_key_to_node() dereferences a freed mempolicy pointer, causing a use-after-free read of mpol->mode. [ 151.412631] BUG: KASAN: slab-use-after-free in __futex_key_to_node (kernel/futex/core.c:349) [ 151.414046] Read of size 2 at addr ffff888001c49634 by task e/87 [ 151.415969] Call Trace: [ 151.416732] __asan_load2 (mm/kasan/generic.c:271) [ 151.416777] __futex_key_to_node (kernel/futex/core.c:349) [ 151.416822] get_futex_key (kernel/futex/core.c:374 kernel/futex/core.c:386 kernel/futex/core.c:593) Fix by adding rcu to __mpol_put(). Fixes: c042c505210d ("futex: Implement FUTEX2_MPOL") Reported-by: Hao-Yu Yang <naup96721@gmail.com> Suggested-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Hao-Yu Yang <naup96721@gmail.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Eric Dumazet <edumazet@google.com> Acked-by: David Hildenbrand (Arm) <david@kernel.org> Link: https://patch.msgid.link/20260324174418.GB1850007@noisy.programming.kicks-ass.net
2026-03-26futex: Require sys_futex_requeue() to have identical flagsPeter Zijlstra
Nicholas reported that his LLM found it was possible to create a UaF when sys_futex_requeue() is used with different flags. The initial motivation for allowing different flags was the variable sized futex, but since that hasn't been merged (yet), simply mandate the flags are identical, as is the case for the old style sys_futex() requeue operations. Fixes: 0f4b5f972216 ("futex: Add sys_futex_requeue()") Reported-by: Nicholas Carlini <npc@anthropic.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
2026-03-26KVM: s390: Fix KVM_S390_VCPU_FAULT ioctlClaudio Imbrenda
A previous commit changed the behaviour of the KVM_S390_VCPU_FAULT ioctl. The current (wrong) implementation will trigger a guest addressing exception if the requested address lies outside of a memslot, unless the VM is UCONTROL. Restore the previous behaviour by open coding the fault-in logic. Fixes: 3762e905ec2e ("KVM: s390: use __kvm_faultin_pfn()") Acked-by: Christian Borntraeger <borntraeger@linux.ibm.com> Reviewed-by: Steffen Eiden <seiden@linux.ibm.com> Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
2026-03-26KVM: s390: vsie: Fix guest page tables protectionClaudio Imbrenda
When shadowing, the guest page tables are write-protected, in order to trap changes and properly unshadow the shadow mapping for the nested guest. Already shadowed levels are skipped, so that only the needed levels are write protected. Currently the levels that get write protected are exactly one level too deep: the last level (nested guest memory) gets protected in the wrong way, and will be protected again correctly a few lines afterwards; most importantly, the highest non-shadowed level does *not* get write protected. Moreover, if the nested guest is running in a real address space, there are no DAT tables to shadow. Write protect the correct levels, so that all the levels that need to be protected are protected, and avoid double protecting the last level; skip attempting to shadow the DAT tables when the nested guest is running in a real address space. Fixes: e38c884df921 ("KVM: s390: Switch to new gmap") Tested-by: Christian Borntraeger <borntraeger@linux.ibm.com> Reviewed-by: Janosch Frank <frankja@linux.ibm.com> Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
generated by cgit v1.2.3 (git 2.25.1) at 2026-09-16 07:47:13 +0000