summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-08-04Merge tag 'tegra-for-7.3-soc' of ↵Arnd Bergmann
git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/drivers soc/tegra: Changes for v7.3-rc1 Various small fixes for multi-socket devices, redundant error prints, a Kconfig dependency as well as a patch to remove FUSE data as an entropy source. * tag 'tegra-for-7.3-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: soc/tegra: Add PM dependency to SOC_TEGRA_PMC Kconfig soc/tegra: fuse: Use device-specific instance in suspend/resume soc/tegra: fuse: Do not use fuse data as entropy source soc/tegra: cbb: Remove redundant dev_err() soc/tegra: pmc: Don't register sys-off handler for multi-socket devices Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-08-04Merge tag 'amlogic-drivers-for-v7.3' of ↵Arnd Bergmann
https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux into soc/drivers Amlogic drivers for v7.3: - Clock measure debugfs fixup - Clock measure support for Amlogic A1 & T7 * tag 'amlogic-drivers-for-v7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux: soc: amlogic: meson-clk-measure: remove debugfs tree soc: amlogic: clk-measure: Add A1 and T7 support dt-bindings: soc: amlogic: clk-measure: Add A1 and T7 compatible Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-08-04Merge tag 'tegra-for-7.3-arm-core' of ↵Arnd Bergmann
git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/arm ARM: Core Tegra changes for v7.3-rc1 We haven't had one of these in a long time, but a __ASSEMBLY__ cleanup patch and a OF reference leak fix came in that make changes to the core Tegra code. * tag 'tegra-for-7.3-arm-core' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: ARM: tegra: Replace __ASSEMBLY__ with __ASSEMBLER__ ARM: tegra: Fix OF node reference leaks in IRQ init Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-08-04ASoC: xilinx: replace OF with device handlersRosen Penev
All of these usages of OF handlers use the node from the platform_device. Use the device member to simplify slightly. Signed-off-by: Rosen Penev <rosenp@gmail.com> Reviewed-by: Vincenzo Frascino <vincenzo.frascino@arm.com> Link: https://patch.msgid.link/20260803231823.95147-1-rosenp@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-04Merge tag 'sunxi-config-for-7.3' of ↵Arnd Bergmann
https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into soc/defconfig Allwinner defconfig changes for 7.3 Enable the LRADC for arm64_defconfig. * tag 'sunxi-config-for-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: arm64: defconfig: Enable Allwinner LRADC input driver Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-08-04Merge tag 'omap-for-v7.3/defconfig-signed' of ↵Arnd Bergmann
git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap into soc/defconfig arm/omap: defconfig updates for v7.3 - omap2plus_defconfig: Enable multi-LED - omap2plus_defconfig: enable things required by iwd - multi_v7_defconfig: Enable BRIDGE and DP83848_PHY for TI AM57xx, AM437x and AM335x * tag 'omap-for-v7.3/defconfig-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap: arm: omap2plus_defconfig: Enable multi-LED ARM: omap2plus_defconfig: enable things required by iwd arm: multi_v7_defconfig: Enable BRIDGE and DP83848_PHY for TI AM57xx, AM437x and AM335x Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-08-04Merge tag 'qcom-arm64-defconfig-for-7.3' of ↵Arnd Bergmann
https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/defconfig Qualcomm Arm64 defconfig updates for v7.3 Enable the Qualcomm reference device embedded-controller driver for Hamoa and Glymur, the DMIC sound driver for Monaco and Lemans platforms, and the BAM-DMUX WWAN driver for Shikra and other platforms using A2 BAM hardware. * tag 'qcom-arm64-defconfig-for-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: arm64: defconfig: Enable Qualcomm BAM-DMUX WWAN driver arm64: defconfig: Enable Sound DMIC driver arm64: defconfig: Enable Qualcomm reference device EC driver Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-08-04Merge tag 'aspeed-7.3-maintainers-0' of ↵Arnd Bergmann
https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux into arm/fixes aspeed: Update MAINTAINERS for 7.3 Add Ryan and Billy as reviewers for ASPEED SoC patches. I asked both to add themselves to increase ASPEED's visibility of upstream changes. * tag 'aspeed-7.3-maintainers-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux: MAINTAINERS: add Ryan Chen and Billy Tsai as reviewer for ARM/ASPEED Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-08-04Merge tag 'nuvoton-7.2-arm-fixes-0' of ↵Arnd Bergmann
https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux into arm/fixes nuvoton: First batch of ARM arch fixes for 7.2 Again a one-off change, fixing OF resource leaks in the SMP-bringup code for the NPCM7xx SoCs. * tag 'nuvoton-7.2-arm-fixes-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux: ARM: npcm: Fix OF node refcount leaks in SMP setup Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-08-04docs: pt_BR: process: Translate CVE documentationFabio Pereira da Silva
Translate Documentation/process/cve.rst into Brazilian Portuguese and link it from the pt_BR documentation index. Signed-off-by: Fabio Pereira da Silva <silvapfabio@gmail.com> Acked-by: Daniel Pereira <danielmaraboo@gmail.com> Signed-off-by: Jonathan Corbet <corbet@lwn.net>
2026-08-04ASoC: tas2781: add capture_profile_id field and update the tuning_switch ↵Shenghao Ding
function Currently, the TAS2781 SmartAMP driver uses the same profile ID for both playback and capture scenarios (e.g., PDM microphone recording or IV data capture). This makes it impossible to apply different DSP configurations for capture and playback, which is required in real-world tuning and production use cases. With these changes, capture and playback paths now use their own DSP profiles, improving tuning flexibility and avoiding unintended profile conflicts between SmartAMP capture and playback scenarios. Signed-off-by: Shenghao Ding <shenghao-ding@ti.com> Link: https://patch.msgid.link/20260804111433.1148-1-shenghao-ding@ti.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-04cpupower: remove conditional return with no effectSang-Heon Jeon
Both branches of the check return the same value, so the check has no effect. Remove it and return the value directly. This is the result of running the Coccinelle script from scripts/coccinelle/misc/cond_return_no_effect.cocci. Link: https://lore.kernel.org/linux-pm/20260723184538.3888637-36-ekffu200098@gmail.com/raw Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
2026-08-04spi: bcm63xx: disable clock on resume failureCan Peng
bcm63xx_spi_resume() enables the controller clock before restarting the SPI controller queue. If spi_controller_resume() fails, the function currently reports success and leaves the clock enabled. Propagate the error and disable the clock before returning. Fixes: b42dfed83d95 ("spi: add Broadcom BCM63xx SPI controller driver") Cc: stable@vger.kernel.org Signed-off-by: Can Peng <pengcan@kylinos.cn> Link: https://patch.msgid.link/20260804071831.860784-1-pengcan@kylinos.cn Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-04spi: bcm63xx-hsspi: disable clocks on resume failureCan Peng
bcm63xx_hsspi_resume() enables the HSSPI clock, and optionally the PLL clock, before restarting the SPI controller queue. If spi_controller_resume() fails, the function currently reports success and leaves those clocks enabled. Propagate the error and disable the clocks before returning. Fixes: 142168eba9dc ("spi: bcm63xx-hsspi: add bcm63xx HSSPI driver") Cc: stable@vger.kernel.org Signed-off-by: Can Peng <pengcan@kylinos.cn> Reviewed-by: Kursad Oney <kursad.oney@broadcom.com> Link: https://patch.msgid.link/20260804072017.860974-1-pengcan@kylinos.cn Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-04Merge tag 'locking-urgent-2026-08-04' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull futex fix from Ingo Molnar: - Fix a robust futexes exit race (Keno Fischer) * tag 'locking-urgent-2026-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: futex: Prevent robust futex exit race some more
2026-08-04Merge tag 'integrity-v7.2-rc7' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity Pull integrity fixes from Mimi Zohar: "Two IMA bug fixes: one addresses a potential integer underflow, the other instantiates two LSM hooks" * tag 'integrity-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity: ima: Instantiate file_truncate and path_truncate hooks ima: fix out-of-bounds read in xattr_verify()
2026-08-04drm/xe/uc: Apply RCS/CCS yield policy to SR-IOV VFsMarcin Bernatowicz
VFs were missing the call to apply the global scheduling policy. Call xe_guc_submit_enable() during vf_uc_load_hw() to ensure VFs get the same policy enforcement as PF. Fixes: 26caeae9fb48 ("drm/xe/guc: Set RCS/CCS yield policy") Suggested-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Signed-off-by: Marcin Bernatowicz <marcin.bernatowicz@linux.intel.com> Cc: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com> Cc: Michal Wajdeczko <michal.wajdeczko@intel.com> Reviewed-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com> Link: https://patch.msgid.link/20260709075945.1337660-1-marcin.bernatowicz@linux.intel.com Signed-off-by: Michał Winiarski <michal.winiarski@intel.com> (cherry picked from commit f09360e857130f7ab7f069e2421e6b4a6e502531) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-08-04drm/xe: Fix memory leak in exec_queue_set_hang_replay_state()Michał Winiarski
The q->replay_state is blindly overwritten, which can potentially leak memory that was previously allocated by vmemdup_user(). Return an error if q->replay_state is not empty. Discovered using AI-assisted static analysis confirmed by Intel Product Security. Reported-by: Martin Hodo <martin.hodo@intel.com> Fixes: 1026c1a73a96 ("drm/xe: Implement DRM_XE_EXEC_QUEUE_SET_HANG_REPLAY_STATE") Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260624111421.1258364-1-michal.winiarski@intel.com Signed-off-by: Michał Winiarski <michal.winiarski@intel.com> (cherry picked from commit f6b6cc1118bdbc4265fa8b3bdf8565b26f13e56e) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-08-04spi: Few cleanups while looking at num-csMark Brown
Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> says: Few minor cleanups for DT bindings and Andes driver. Patches do not have inter-dependencies. Link: https://patch.msgid.link/20260804-spi-num-cs-v1-0-4ccb13dcc7b0@oss.qualcomm.com
2026-08-04spi: atcspi200: Drop redundant andestech,qilai-spi compatibleKrzysztof Kozlowski
"andestech,qilai-spi" compatible can only be used with a fallback, which is already matched by the driver's OF device ID table, thus it is redundant in the driver. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://patch.msgid.link/20260804-spi-num-cs-v1-5-4ccb13dcc7b0@oss.qualcomm.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-04spi: dt-bindings: spi-cadence: Drop duplicated type/refKrzysztof Kozlowski
spi-controller.yaml schema already defines this $ref for this property, so binding does not have to. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://patch.msgid.link/20260804-spi-num-cs-v1-4-4ccb13dcc7b0@oss.qualcomm.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-04spi: dt-bindings: axiado,ax3000-spi: Drop duplicated type/refKrzysztof Kozlowski
spi-controller.yaml schema already defines this $ref for this property, so binding does not have to. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://patch.msgid.link/20260804-spi-num-cs-v1-3-4ccb13dcc7b0@oss.qualcomm.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-04spi: dt-bindings: marvell,armada-3700-spi: Drop redundant num-csKrzysztof Kozlowski
'num-cs' property is a single integer, thus the binding should not set maxItems. This could be replaced with proper min/max constraints for values, except that such constraints are not known. spi-controller.yaml schema already defines this property, so its presence here is redundant. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://patch.msgid.link/20260804-spi-num-cs-v1-2-4ccb13dcc7b0@oss.qualcomm.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-04spi: dt-bindings: andestech,ae350-spi: Drop redundant num-csKrzysztof Kozlowski
'num-cs' property is a single integer, thus the binding should not set maxItems. This could be replaced with proper min/max constraints for values, except that hardware (as expressed in driver) supports only one native chipselect, thus constraint of "const:1" would make the property implied by the compatible. spi-controller.yaml schema already defines this property, so its presence here is redundant. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://patch.msgid.link/20260804-spi-num-cs-v1-1-4ccb13dcc7b0@oss.qualcomm.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-04x86/boot: Use bool and IS_ENABLED() to simplify query_edd()Thorsten Blum
In query_edd(), use bool for do_edd and initialize it directly from CONFIG_EDD_OFF via IS_ENABLED(). Also use bool for do_mbr and be_quiet. No change in functionality intended. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Ingo Molnar <mingo@kernel.org> Link: https://patch.msgid.link/20260804115227.62158-5-thorsten.blum@linux.dev
2026-08-04x86/boot: Use IS_ENABLED() to simplify built-in-or-module checksThorsten Blum
Replace open-coded built-in-or-module checks for CONFIG_APM, CONFIG_EDD, and CONFIG_X86_SPEEDSTEP_SMI with IS_ENABLED(). No change in functionality intended. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Ingo Molnar <mingo@kernel.org> Link: https://patch.msgid.link/20260804115227.62158-4-thorsten.blum@linux.dev
2026-08-04perf vendor events intel: Fix Novalake CPUID regex in mapfile.csvChun-Tse Shao
Based on offline discussion with Intel in lore.kernel.org/20260715211144.3144895-1-ctshao@google.com, we decided to drop the leading zero from Nova Lake models 0x01 and 0x03 in mapfile.csv to match single-digit model numbers without zero padding (GenuineIntel-18-[13]). The updated mapfile entry was published in: github.com/intel/perfmon/commit/00167baed45ac3b2708e89dbf1b9ce4769e9d115 Signed-off-by: Chun-Tse Shao <ctshao@google.com> Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-04parisc: Use asm-generic/serial.hThorsten Blum
asm/serial.h only redefines BASE_BAUD with the same value as asm-generic/serial.h. Remove the arch-specific header and fall back to generic implementation. Suggested-by: Helge Deller <deller@gmx.de> Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-04parisc: sba_iommu: Remove dead DEBUG_DMB_TRAP codeMuhammad Usama Anjum
DEBUG_DMB_TRAP is unconditionally undefined, so the guarded declarations and calls can never be built. The declared iterate_pages() and set_data_memory_break() functions also have no definitions in the tree; removing the #undef would therefore leave unresolved references. Remove the unused option and its guarded code. Signed-off-by: Muhammad Usama Anjum <usama.anjum@arm.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-04UAPI: Drop PER_HPUX personalityHelge Deller
Two and a half decades ago, there were plans to support HP-UX syscalls in Linux. This was never fully implemented, never worked and was never actually used by anybody. Let's simply drop this define now and free it up for other usages. Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-04parisc: superio: Spelling s/Peterson/Petersen/Geert Uytterhoeven
Correct a typo in Martin's surname. Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-04Merge tag 'nfs-for-7.2-3' of git://git.linux-nfs.org/projects/anna/linux-nfsLinus Torvalds
Pull NFS client fixes from Anna Schumaker: - Pin the 'struct nfs_server' during a FREE_STATEID call - Decrement refcounts if allocating nfs_free_stateid_data fails - Fix nfs4_listxattr size accounting for * tag 'nfs-for-7.2-3' of git://git.linux-nfs.org/projects/anna/linux-nfs: NFSv4.2: fix nfs4_listxattr size accounting NFS: Decrement refcounts if allocating nfs_free_stateid_data fails NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
2026-08-04ASoC: rt766: add RT766/RT767 SDCA driverShuming Fan
This patch adds the initial SDCA multi-function codec driver for the RT766 and RT767. Signed-off-by: Shuming Fan <shumingf@realtek.com> Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com> Link: https://patch.msgid.link/20260804104828.557228-1-shumingf@realtek.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-04ima: measure userspace policy writes before parsingEnrico Bravi
When a signed policy is not mandatory, userspace can write IMA policy rules directly to the securityfs policy file: echo -e "measure func=BPRM_CHECK mask=MAY_EXEC\n" \ "audit func=BPRM_CHECK mask=MAY_EXEC\n" \ > /sys/kernel/security/ima/policy or by cat'ing the entire IMA custom policy file: cat ima-policy-file > /sys/kernel/security/ima/policy Because these rules originate from userspace and cross the userspace/kernel trust boundary, measure the raw write buffer before parsing, regardless of whether the new policy will be accepted or not. This can be caught when 'measure func=POLICY_CHECK' is enabled (e.g., ima_policy=tcb). The measurement template is forced to ima-buf. This follows the "measure & load" paradigm, exposing potential bugs in the policy code and detecting attempts to corrupt IMA. It also completes the POLICY_CHECK hook, which already measures partial policy load by file. To verify the template data hash value, convert the buffer policy data to binary: grep "ima_policy_written" \ /sys/kernel/security/integrity/ima/ascii_runtime_measurements | \ tail -1 | cut -d' ' -f 6 | xxd -r -p | sha256sum Suggested-by: Roberto Sassu <roberto.sassu@huawei.com> Signed-off-by: Enrico Bravi <enrico.bravi@polito.it> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
2026-08-04ima: add critical data measurement for loaded policyEnrico Bravi
IMA policy can be written multiple times in the securityfs policy file at runtime if CONFIG_IMA_WRITE_POLICY=y. When IMA_APPRAISE_POLICY is required, the policy needs to be signed to be loaded, writing the absolute path of the file containing the new policy: echo /path/of/custom_ima_policy > /sys/kernel/security/ima/policy When this is not required, policy can be written directly, rule by rule: echo -e "measure func=BPRM_CHECK mask=MAY_EXEC\n" \ "audit func=BPRM_CHECK mask=MAY_EXEC\n" \ > /sys/kernel/security/ima/policy In this case, a new policy can be loaded without being measured or appraised. Add a new critical data record to measure the textual policy representation when it becomes effective. Include in the architecture-specific policy the new critical data record only when it is not mandatory to load a signed policy. Additionally, enable the policy serialization code even when CONFIG_IMA_READ_POLICY=n. To verify the template data hash value, convert the buffer policy data to binary: grep "ima_policy_loaded" \ /sys/kernel/security/integrity/ima/ascii_runtime_measurements | \ tail -1 | cut -d' ' -f 6 | xxd -r -p | sha256sum Signed-off-by: Enrico Bravi <enrico.bravi@polito.it> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
2026-08-04ima: Instantiate file_truncate and path_truncate hooksMimi Zohar
Instantiate the file_truncate and path_truncate LSM hooks to reset the action cache flags (IMA_DONE_MASK) as soon as truncation is requested, so the file, based on policy, is re-collected, re-measured, re-audited, and re-appraised on next access. Tested-by: Frederick Lawler <fred@cloudflare.com> Cc: stable@vger.kernel.org Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
2026-08-04security: ima: rename boot_aggregate when ima is initialised at late_syncJonathan McDowell
The Linux IMA (Integrity Measurement Architecture) subsystem used for secure boot, file integrity, or remote attestation cannot be a loadable module for few reasons listed below: o Boot-Time Integrity: IMA’s main role is to measure and appraise files before they are used. This includes measuring critical system files during early boot (e.g., init, init scripts, login binaries). If IMA were a module, it would be loaded too late to cover those. o TPM Dependency: IMA integrates tightly with the TPM to record measurements into PCRs. The TPM must be initialized early (ideally before init_ima()), which aligns with IMA being built-in. o Security Model: IMA is part of a Trusted Computing Base (TCB). Making it a module would weaken the security model, as a potentially compromised system could delay or tamper with its initialization. IMA must be built-in to ensure it starts measuring from the earliest possible point in boot which inturn implies TPM must be initialised and ready to use before IMA. Unfortunately some TPM drivers (such as Arm FF-A, or SPI attached TPM devices) are not reliably available during the initcall_late stage, resulting in a log error: ima: No TPM chip found, activating TPM-bypass! To address this issue, IMA_INIT_LATE_SYNC is introduced. However, a remote attestation service cannot determine when IMA has been initialized because the boot_aggregate measurement name remains unchanged, even though IMA is initialized later at late_initcall_sync when IMA_INIT_LATE_SYNC is enabled. Therefore, use a distinct boot_aggregate name when IMA_INIT_LATE_SYNC is enabled, allowing the remote attestation service to identify when IMA has been initialized. Signed-off-by: Jonathan McDowell <noodles@meta.com> [yeoreum.yun@arm.com: modified to align with the IMA_INIT_LATE_SYNC change] Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
2026-08-04ima: fix out-of-bounds read in xattr_verify()Lincoln Wallace
The digest-length check in xattr_verify() mixes int and size_t: if (xattr_len - sizeof(xattr_value->type) - hash_start >= iint->ima_hash->length) sizeof() yields size_t, so the usual arithmetic conversions promote the whole left-hand side to unsigned 64-bit before the subtraction runs. For a truncated xattr this underflows instead of going negative: a 1-byte IMA_XATTR_DIGEST_NG xattr (xattr_len == 1, hash_start == 1) turns "1 - 1 - 1" into SIZE_MAX, which is trivially >= ima_hash->length. The check then passes and the following memcmp() reads iint->ima_hash->length bytes starting past the end of the buffer vfs_getxattr_alloc() allocated for it. Nothing upstream clamps xattr_len back into a safe range first: ima_get_hash_algo() only special-cases xattr_len < 2 to pick a default algorithm, and evm_verifyxattr() returns INTEGRITY_UNKNOWN rather than failing when no HMAC key is loaded, so a truncated security.ima value reaches the length check as-is. Rewrite the comparison so every operand stays a signed int and no implicit conversion to size_t can occur. Fixes: 3ea7a56067e6 ("ima: provide hash algo info in the xattr") Cc: stable@vger.kernel.org Signed-off-by: Lincoln Wallace <locnnil0@gmail.com> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
2026-08-04security: ima: introduce IMA_INIT_LATE_SYNC optionYeoreum Yun
To generate the boot_aggregate log in the IMA subsystem with TPM PCR values, the TPM driver must be built as built-in and must be probed before the IMA subsystem is initialized. However, when the TPM device operates over the FF-A protocol using the CRB interface, probing fails and returns -EPROBE_DEFER if the tpm_crb_ffa device — an FF-A device that provides the communication interface to the tpm_crb driver — has not yet been probed. To ensure the TPM device operating over the FF-A protocol with the CRB interface is probed before IMA initialization, the following conditions must be met: 1. The corresponding ffa_device must be registered, which is done via ffa_init(). 2. The tpm_crb_driver must successfully probe this device via tpm_crb_ffa_init(). 3. The tpm_crb driver using CRB over FF-A can then be probed successfully. (See crb_acpi_add() and tpm_crb_ffa_init() for reference.) Unfortunately, ffa_init(), tpm_crb_ffa_init(), and crb_acpi_driver_init() are all registered with device_initcall, which means crb_acpi_driver_init() may be invoked before ffa_init() and tpm_crb_ffa_init() are completed. When this occurs, probing the TPM device is deferred. However, the deferred probe can happen after the IMA subsystem has already been initialized, since IMA initialization is performed during late_initcall, and deferred_probe_initcall() is performed at the same level. And the similar situation is reported on TPM devices attached on SPI bus[0]. To resolve this, introduce IMA_INIT_LATE_SYNC option to initialise IMA at late_inicall_sync so that IMA is initialized with the TPM device probed deferred. When this option is enabled, modules that access files in the initramfs through usermode helper calls such as request_module() during initcall must not be built-in. Otherwise, IMA may miss measuring those files [1]. Link: https://lore.kernel.org/all/aYXEepLhUouN5f99@earth.li/ [0] Link: https://lore.kernel.org/all/2b3782398cc17ce9d355490a0c42ebce9120a9ae.camel@linux.ibm.com/ [1] Suggested-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com> [zohar@linux.ibm.com: Fixed Kconfig merge conflict] Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
2026-08-04security: lsm: allow LSMs to register for late_initcall_sync initYeoreum Yun
There are situations where LSMs have dependencies that might mean they want to be initialised later in the boot process, to ensure those dependencies are available. In particular there are some TPM setups (Arm FF-A devices, SPI attached TPMs) required by IMA which are not guaranteed to be initialised for regular initcall_late. Add an initcall_late_sync option that can be used in these situations. Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com> Cc: Paul Moore <paul@paul-moore.com> Acked-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
2026-08-04ASoC: qcom: add AudioReach TDM backend supportMark Brown
Prasad Kumpatla <prasad.kumpatla@oss.qualcomm.com> says: Add AudioReach support for LPASS Audio IF based TDM backends and wire it up for the sc8280xp machine driver. The series first adds topology-driven Audio IF source/sink handling so the DSP interface parameters can be described by topology while runtime media format and slot configuration still come from the machine driver. It then adds TDM DAI operations for q6apm-lpass-dais, exposes the Audio IF clock IDs through the q6dsp-lpass-ports binding and q6prm clock tables, and introduces common QCOM helpers for parsing standard dai-tdm-slot-* properties from backend CPU and codec endpoints. Finally, sc8280xp uses the common helpers during hw_params to program CPU and codec TDM slots, derive the backend bit clock from the active PCM parameters, and request the CPU and codec clocks before the stream is started. Link: https://patch.msgid.link/20260804070307.117119-1-prasad.kumpatla@oss.qualcomm.com
2026-08-04ASoC: qcom: sc8280xp: add TDM hw_params supportPrasad Kumpatla
Add TDM backend handling to the sc8280xp machine driver. Use the common QCOM DAI-node TDM helper to parse the standard DAI TDM slot properties from backend CPU and codec endpoints. Reuse the parsed configuration when programming DAIs so hw_params does not need a second DT traversal. Derive the LPASS backend bit clock from the runtime TDM parameters and request it through the backend child-clock path using LPAIF_MI2S_BCLK. Program codec sysclk in hw_params so codec PLL setup happens before the stream is triggered. Signed-off-by: Prasad Kumpatla <prasad.kumpatla@oss.qualcomm.com> Link: https://patch.msgid.link/20260804070307.117119-8-prasad.kumpatla@oss.qualcomm.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-04ASoC: qcom: common: add DAI-node TDM slot helpersPrasad Kumpatla
Add common helpers to parse standard dai-tdm-slot-* properties from the CPU and codec child nodes of a backend DAI link and apply the result to the active DAIs. QCOM machine drivers already use qcom_snd_parse_of() to build links from DT, but they lacked a shared helper to translate endpoint TDM properties into snd_soc_dai_set_tdm_slot() calls. Boards therefore had to carry ad hoc parsing or rely on non-standard DT properties. The helpers parse endpoint masks, validate the shared slot count and slot width, and program CPU and codec DAIs with the resulting slot configuration. A cfg-based apply helper is provided for callers that already parsed the DT data and want to avoid a second DT traversal. Signed-off-by: Prasad Kumpatla <prasad.kumpatla@oss.qualcomm.com> Link: https://patch.msgid.link/20260804070307.117119-7-prasad.kumpatla@oss.qualcomm.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-04dt-bindings: sound: qcom,sm8250: allow TDM slot propertiesPrasad Kumpatla
Allow standard dai-tdm-slot-* properties in the CPU and codec child nodes of a DAI link. The QCOM machine driver parses these child nodes to configure TDM slots on the active CPU and codec DAIs. The properties are already defined by the common tdm-slot binding, but qcom,sm8250.yaml currently rejects them because the CPU and codec child nodes set additionalProperties: false. Permit dai-tdm-slot-num, dai-tdm-slot-width and dai-tdm-slot-[rt]x-mask there so boards using TDM backends can describe the slot layout without schema warnings. Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Prasad Kumpatla <prasad.kumpatla@oss.qualcomm.com> Link: https://patch.msgid.link/20260804070307.117119-6-prasad.kumpatla@oss.qualcomm.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-04ASoC: qcom: q6prm: add Audio IF clock IDsPrasad Kumpatla
Add the q6prm clock table entries and internal DSP clock IDs for LPASS Audio IF backend clocks. The public binding IDs map to q6prm DSP clock IDs starting at 0x500 for Audio IF0 IBIT/EBIT. Add the internal definitions and register all Audio IF IBIT and EBIT clocks so machine drivers can request them through the APM clock controller. Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com> Signed-off-by: Prasad Kumpatla <prasad.kumpatla@oss.qualcomm.com> Link: https://patch.msgid.link/20260804070307.117119-5-prasad.kumpatla@oss.qualcomm.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-04dt-bindings: sound: qcom,q6dsp-lpass-ports: add Audio IF clocksPrasad Kumpatla
Add the LPASS Audio IF clock IDs used by newer backend interfaces. Platforms using Audio IF module backends request the interface bit clocks through q6prm. Add the Audio IF IBIT and EBIT IDs to the binding header so these clocks can be referenced from device trees. Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com> Signed-off-by: Prasad Kumpatla <prasad.kumpatla@oss.qualcomm.com> Link: https://patch.msgid.link/20260804070307.117119-4-prasad.kumpatla@oss.qualcomm.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-04ASoC: qcom: q6apm-lpass-dais: add TDM DAI operationsPrasad Kumpatla
Add TDM DAI operations to q6apm-lpass-dais so AudioReach TDM backends can be configured through the normal ASoC hw_params and DAI setup flow. The TDM set_tdm_slot() callback validates the supported slot width and slot count, stores the active slot mask in the AudioReach module configuration, and leaves existing DMA, I2S and HDMI paths unchanged. Reuse the existing LPASS child-clock handling for TDM nodes as well as MI2S nodes, since TDM backends also request optional backend clocks through the machine driver set_sysclk() path. Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com> Signed-off-by: Prasad Kumpatla <prasad.kumpatla@oss.qualcomm.com> Link: https://patch.msgid.link/20260804070307.117119-3-prasad.kumpatla@oss.qualcomm.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-04ASoC: qcom: qdsp6: add topology-driven Audio IF supportPrasad Kumpatla
Add topology parsing and media-format programming for Audio IF source and sink modules. Add the Audio IF module IDs, the required topology tokens, and a dedicated topology loader that stores the parsed interface configuration in the AudioReach module state. Also add the Audio IF media-format path that sends the interface configuration, hardware endpoint media format, and frame-duration parameters for Audio IF modules. This keeps the serial-interface configuration topology-driven while still allowing the machine driver to provide runtime slot and media format settings. The same Audio IF path can then be reused for TDM, PCM, and I2S style backends. The new UAPI tokens (AR_TKN_U16_MODULE_SYNC_SRC=262 through AR_TKN_U8_MODULE_INV_EXT_BIT_CLK=276) are added, together with the value defines used by the sync source, sync mode, data delay, interface mode, bit clock type, and polarity tokens. MODULE_ID_AUDIO_IF_SINK (0x0700117C) and MODULE_ID_AUDIO_IF_SOURCE (0x0700117D) are introduced in this patch. This Module is validated on Hawi and Shikra platforms. Signed-off-by: Prasad Kumpatla <prasad.kumpatla@oss.qualcomm.com> Link: https://patch.msgid.link/20260804070307.117119-2-prasad.kumpatla@oss.qualcomm.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-04ASoC: SOF: ipc4-topology: Pipeline params improvementsMark Brown
Peter Ujfalusi <peter.ujfalusi@linux.intel.com> says: Improve handling of some corner cases that are not used by current topology designs, but can be crafted within the rules of a topology file. For example branching topologies, where a single input routed to multiple output endpoints. The already configured part of the graph places constraint on how the new branch can be configured. Handling of process modules also updated to be able to 'guess' what parameters can be changed by the module and allow flexible operation. Link: https://patch.msgid.link/20260730121729.18673-1-peter.ujfalusi@linux.intel.com
2026-08-04ASoC: SOF: ipc4-topology: Update the pipeline_params of prepared modulesPeter Ujfalusi
If the module in path has been already prepared on a branch type of topology, where the branching happens downstream: A1--> A2 ---> B1 --> B2 ... B-branch |-> C1 --> C2 ... C-branch In this case if B-branch is started then A1/A2 is prepared, but when C-branch starts we still need to refine the parameters up to C1 to arrive with a correct params to configure C1. This branching can happen with copiers process modules. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com> Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com> Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com> Link: https://patch.msgid.link/20260730121729.18673-4-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org>