summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-07-24Merge branch 'bpf-fix-warning-in-bpf_tracing_link_release'Kumar Kartikeya Dwivedi
Leon Hwang says: ==================== bpf: Fix WARNING in bpf_tracing_link_release The trampoline could be corrupted by the blindly 'tr->flags = BPF_TRAMP_F_TAIL_CALL_CTX' in verifier. 1. A fexit attached to a tail_call_reachable prog. 'tr->flags' became 'BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_TAIL_CALL_CTX'. And, the trampoline would poke the target prog's nop insn using jmp insn instead of call insn. 2. Another fexit loaded with the same tail_call_reachable prog target. 'tr->flags' became 'BPF_TRAMP_F_TAIL_CALL_CTX'. 3. Close the first fexit link. Due to no BPF_TRAMP_F_CALL_ORIG in 'tr->flags', the trampoline will fail to restore the prog's nop insn using call insn. [ 3.410719] WARNING: kernel/bpf/syscall.c:3551 at bpf_tracing_link_release+0x53/0x60, CPU#1: test_progs/98 ... [ 3.428793] bpf_link_free+0x58/0x130 [ 3.429293] bpf_link_release+0x23/0x30 Fix the warning by updating 'tr->flags' with '|=' and lock. Changes: v1 -> v2: * Update the patch #1 message with 'tr->flags' change. (per Jiri) * Drop the 'link' and the last 'if' in patch #2. (per Jiri) * v1: https://lore.kernel.org/bpf/20260721133036.49265-1-leon.hwang@linux.dev/ ==================== Link: https://patch.msgid.link/20260722151909.69142-1-leon.hwang@linux.dev Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-24selftests/bpf: Verify no warning when close fexit linkLeon Hwang
Add a test to verify that there's no WARNING when detaching fexit link by following the repro steps of previous commit. Without the fix, the WARNING could be triggered by this test. Signed-off-by: Leon Hwang <leon.hwang@linux.dev> Reviewed-by: Pu Lehui <pulehui@huawei.com> Acked-by: Jiri Olsa <jolsa@kernel.org> Link: https://lore.kernel.org/bpf/20260722151909.69142-3-leon.hwang@linux.dev Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-24bpf: Fix WARNING in bpf_tracing_link_releaseLeon Hwang
The trampoline could be corrupted by the blindly 'tr->flags = BPF_TRAMP_F_TAIL_CALL_CTX' in verifier. 1. A fexit attached to a tail_call_reachable prog. 'tr->flags' became 'BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_TAIL_CALL_CTX'. And, the trampoline would poke the target prog's nop insn using jmp insn instead of call insn. 2. Another fexit loaded with the same tail_call_reachable prog target. 'tr->flags' became 'BPF_TRAMP_F_TAIL_CALL_CTX'. 3. Close the first fexit link. Due to no BPF_TRAMP_F_CALL_ORIG in 'tr->flags', the trampoline will fail to restore the prog's nop insn using call insn. [ 3.410719] WARNING: kernel/bpf/syscall.c:3551 at bpf_tracing_link_release+0x53/0x60, CPU#1: test_progs/98 ... [ 3.428793] bpf_link_free+0x58/0x130 [ 3.429293] bpf_link_release+0x23/0x30 Fix the warning by updating 'tr->flags' with '|=' and lock. Fixes: 2b5dcb31a19a ("bpf, x64: Fix tailcall infinite loop") Signed-off-by: Leon Hwang <leon.hwang@linux.dev> Reviewed-by: Pu Lehui <pulehui@huawei.com> Acked-by: Jiri Olsa <jolsa@kernel.org> Link: https://lore.kernel.org/bpf/20260722151909.69142-2-leon.hwang@linux.dev Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-24ARM: lpc32xx: remove a few manually populated OF devicesVladimir Zapolskiy
For a good while the common for all NXP LPC32xx platforms lpc32xx.dtsi file contains proper descriptions of DMA, SLC and MLC NAND controllers, this allows to remove populated device tree nodes from platform code. At the end of the last year it was announced that this change to happen, unlikely there are still users with such old dtbs to be affected by this change, but if there are such users, they should update board dtb file, if DMA or NAND controller decriptions are not found in them. Signed-off-by: Vladimir Zapolskiy <vz@kernel.org> Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
2026-07-24ARM: lpc32xx: only run SoC init on LPC32xx hardwareKarl Mehltretter
lpc32xx_check_uid() and lpc32xx_pm_init() are arch_initcalls that poke LPC32xx-only registers. Since the multiplatform conversion they also run on other ARCH_MULTI_V5 boards where access faults e.g. on versatile: Unable to handle kernel paging request at virtual address f4004130 PC is at lpc32xx_check_uid+0x2c/0x9c Drop the arch_initcall() registrations and call both functions directly from lpc3250_machine_init(), the machine's .init_machine hook. The calls are placed in link order (common.c, pm.c, phy3250.c) to keep their previous relative ordering. Fixes: 75bf1bd7d2f9 ("ARM: lpc32xx: allow multiplatform build") Suggested-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Reviewed-by: Vladimir Zapolskiy <vz@kernel.org> Reviewed-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
2026-07-24firmware: imx: scu: manage mailbox channels and global handlePengpeng Hou
imx_scu_probe() requests mailbox channels with the non-managed mbox_request_channel_byname() helper and then publishes sc_ipc through the global imx_sc_ipc_handle. Later probe failures, including child population failure, can leave the channels and global handle live after the probe has failed. Register devres actions to free each mailbox channel and clear the global handle. Also depopulate partially created child devices when devm_of_platform_populate() reports an error. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-07-24bpf: Fix CFI mismatch in task work callbackMykyta Yatsenko
BPF subprograms use the bpf_callback_t ABI, but task work invokes the callback through a three-argument function pointer. This trips kCFI. Store and invoke the callback as bpf_callback_t. Fixes: 38aa7003e369 ("bpf: task work scheduling kfuncs") Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com> Link: https://lore.kernel.org/bpf/20260724-task_work_cfi-v1-1-2616691781ed@meta.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-24Merge tag 'ceph-for-7.2-rc5' of https://github.com/ceph/ceph-clientLinus Torvalds
Pull ceph fixes from Ilya Dryomov: "A bunch of assorted fixes with the majority being hardening against malformed input and invalid data scenarios that don't happen in real deployments but can be utilized to trigger use-after-free and similar issues, some error path leak fixups and two patches from Max to avoid a potential hang in __ceph_get_caps() and unintended nesting of current->journal_info while handling replies from the MDS. All marked for stable" * tag 'ceph-for-7.2-rc5' of https://github.com/ceph/ceph-client: ceph: avoid fs reclaim while using current->journal_info ceph: add owner/capability checks for CEPH_IOC_SET_LAYOUT* ceph: fix hanging __ceph_get_caps() with stale mds_wanted rbd: Reset positive result codes to zero in object map update path libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE libceph: refresh auth->authorizer_buf{,_len} after authorizer update ceph: fix refcount leak in ceph_readdir() libceph: guard missing CRUSH type name lookup libceph: remove debugfs files before client teardown libceph: bound get_version reply decode to front len ceph: fix writeback_count leak in write_folio_nounlock() libceph: fix two unsafe bare decodes in decode_lockers() ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() libceph: Reject monmaps advertising zero monitors libceph: reject zero bucket types in crush_decode libceph: Fix multiplication overflow in decode_new_up_state_weight()
2026-07-24Merge branch 'bpf-riscv-add-timed-may_goto-support'Kumar Kartikeya Dwivedi
Feng Jiang says: ==================== bpf, riscv: add timed may_goto support This series adds RISC-V JIT support for the timed may_goto loop bound. Patch 1 implements arch_bpf_timed_may_goto() and enables bpf_jit_supports_timed_may_goto() so the verifier uses the timed expansion path. Patch 2 adds a test that checks R0-R5 are preserved across arch_bpf_timed_may_goto() calls. Patch 3 enables the verifier_may_goto_1, stream_cond_break, and may_goto_interaction fastcall tests on riscv64. Tested on riscv64 QEMU (rva23s64): may_goto programs load and JIT correctly, and the 250ms timeout path works as expected. Signed-off-by: Feng Jiang <jiangfeng@kylinos.cn> Tested-by: Pu Lehui <pulehui@huawei.com> Reviewed-by: Björn Töpel <bjorn@kernel.org> Acked-by: Björn Töpel <bjorn@kernel.org> --- Changes in v5: - Use REG_S/REG_L/SZREG in arch_bpf_timed_may_goto assembly. (Pu Lehui) - Add __arch_s390x to the timed_may_goto_preserves_regs test. (Pu Lehui) - Switch the preserves-regs test to SEC("syscall") to fix bpf_prog_test_run() EINVAL. - Link to v4: https://lore.kernel.org/r/20260722-riscv-bpf-timed-may-goto-v4-0-e117e6337bc7@kylinos.cn Changes in v4: - Add 'bpf-next' prefix to match the BPF kernel tree workflow. - Add a test checking that R0-R5 are preserved across arch_bpf_timed_may_goto() calls. Use bpf_get_prandom_u32() to prevent the verifier from removing the checks via DCE. - Rename may_goto_interaction_arm64() to may_goto_interaction(). - Wrap the arch_bpf_timed_may_goto address check to a single line. - Link to v3: https://lore.kernel.org/r/20260715-riscv-bpf-timed-may-goto-v3-0-cf2a9c3d843f@kylinos.cn Changes in v3: - Set up the frame pointer in arch_bpf_timed_may_goto() so the function does not break stack unwinding under CONFIG_FRAME_POINTER. Changes in v2: - Fix BPF_REG_0 being clobbered after arch_bpf_timed_may_goto() calls. - Enable the may_goto_interaction fastcall test on riscv64. --- ==================== Link: https://patch.msgid.link/20260723-riscv-bpf-timed-may-goto-v5-0-86acb54e5642@kylinos.cn Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-24selftests/bpf: Enable timed may_goto tests for riscv64Feng Jiang
Enable verifier_may_goto_1 (raw instruction tests), stream_cond_break (250ms timeout path), and the may_goto_interaction fastcall test on riscv64 now that the JIT supports timed may_goto. Signed-off-by: Feng Jiang <jiangfeng@kylinos.cn> Reviewed-by: Pu Lehui <pulehui@huawei.com> Reviewed-by: Björn Töpel <bjorn@kernel.org> Acked-by: Björn Töpel <bjorn@kernel.org> Link: https://lore.kernel.org/bpf/20260723-riscv-bpf-timed-may-goto-v5-3-86acb54e5642@kylinos.cn Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-24selftests/bpf: Test timed may_goto preserves R0-R5Feng Jiang
Add a test that checks R0-R5 are preserved across arch_bpf_timed_may_goto() calls. Use bpf_get_prandom_u32() to avoid the verifier removing the checks via DCE. Suggested-by: Björn Töpel <bjorn@kernel.org> Signed-off-by: Feng Jiang <jiangfeng@kylinos.cn> Reviewed-by: Pu Lehui <pulehui@huawei.com> Reviewed-by: Björn Töpel <bjorn@kernel.org> Acked-by: Björn Töpel <bjorn@kernel.org> Link: https://lore.kernel.org/bpf/20260723-riscv-bpf-timed-may-goto-v5-2-86acb54e5642@kylinos.cn Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-24bpf, riscv: Add support for timed may_gotoFeng Jiang
Implement arch_bpf_timed_may_goto() for the RV64 JIT. The argument and return value are carried in BPF_REG_AX, and BPF R0-R5 are preserved across the call to the generic bpf_check_timed_may_goto(). Enable bpf_jit_supports_timed_may_goto() so the verifier uses the timed expansion path. Signed-off-by: Feng Jiang <jiangfeng@kylinos.cn> Reviewed-by: Pu Lehui <pulehui@huawei.com> Reviewed-by: Björn Töpel <bjorn@kernel.org> Acked-by: Björn Töpel <bjorn@kernel.org> Link: https://lore.kernel.org/bpf/20260723-riscv-bpf-timed-may-goto-v5-1-86acb54e5642@kylinos.cn Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-24Merge branch 'for-7.3/cxl-fixes' into cxl-for-nextDave Jiang
Various CXL fixes cxl/features: Clamp Get Feature output size to the remaining buffer cxl/features: Reject Set Features output buffer smaller than the header cxl/features: Reject Get Feature count larger than the output buffer cxl/port: Restart port enumeration when a sibling adds the dport first cxl/features: Serialize multi-part Get/Set Feature transfers cxl/pci: Honor -EPROBE_DEFER from component register setup cxl/mbox: Break poison list loop on an empty payload cxl/memdev: Fix firmware upload exact-fit handling cxl/features: bound fwctl command payload to the input buffer cxl/mce: Make the MCE notifier per-region cxl/pci: Remove incorrect mbox.valid check in cxl_pci_type3_init_mailbox() cxl: docs/linux/dax-driver - fix typos cxl: fix mailbox return code description typo cxl/mbox: Clamp mailbox output allocation to the payload size
2026-07-24KVM: SVM: Always intercept ICEBP to workaround AMD ICEBP+TASK_SWITCH flawsDavid Woodhouse
Unconditionally intercept and emulate ICEBP, i.e. INT1 #DBs, on SVM to workaround a bug/misfeature in current AMD CPUs. AMD CPUs don't provide information to allow software to distinguish instruction-induced #DBs (i.e. ICEBP) from exception-induced #DBs (all others), and also don't report an instruction length for an ICEBP-induced TASK_SWITCH. On an intercepted TASK_SWITCH (which always has fault semantics), KVM (any hypervisor, really) looks at the vectoring event type to decide whether it was logically caused by a trap, and therefore whether to advance guest RIP before entering the new task. If the guest IDT is configured to deliver #DBs via a task gate, then the guest will see broken behavior for ICEBP #DB because KVM doesn't have enough information to detect and skip the ICEBP. The typical workaround is to intercept ICEBP unconditionally and handle the FAULT=>TRAP conversion in the hypervisor, at which point the #DB-induced TASK_SWITCH occurs with RIP on the correct instruction boundary regardless of whether it was instruction-induced or exception-induced. As a bonus, intercepting ICEBP more or less aligns SVM with VMX (KVM always intercepts #DBs on VMX, and ICEBP #DB VM-Exits on Intel have fault-like behavior). Signed-off-by: David Woodhouse <dwmw@amazon.co.uk> Link: https://patch.msgid.link/e03f092dfbb7d391a6bf2797ba01e122ba080bcd.camel@infradead.org [sean: drop selftest, reword changelog to provide more details] Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-25Merge tag 'drm-misc-next-2026-07-24' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/misc/kernel into drm-next drm-misc-next for v7.3: UAPI Changes: cgroup: - dmem: accept one region per limit drm: - send per-connector hotplug events Core Changes: buddy: - tests: test buffer clearence on resume panel: - implement ref counting for struct drm_panel throughout the DRM tree Driver Changes: etnaviv: - force flush on power register ops gma: - replace simple-kms helpers with regular atomic helpers - clean up host1x: - support Tegra264 plus DT bindings - fix minor issues throughout driver hypervdrm: - clean up PCI-device binding imagination: - mark BXM-4-64 MC1 (36.52.104.182) as supported - clean up ivpu: - clean up nouveau: - remove redundant call to pm_runtime_mark_last_busy() panel: - support Novatek NT36536 plus DT bindings - sofef00: fix backlight updates - osd101t2587: use mipi_dsi_*_multi interface - panel-edp: adjust timing for AUO displays - panel-lvds: support Opto Logic SCX1001511GGC49 - panel-simple: support Kyocera tcg070wvlq panfrost: - clean up solomon: - clean up variables tve200: - add OF module alias for autoloading v3d: - fix job BO handling vc4: - ref i2c-adapter module Signed-off-by: Dave Airlie <airlied@redhat.com> From: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patch.msgid.link/20260724082204.GA18774@linux.fritz.box
2026-07-24Merge tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linuxLinus Torvalds
Pull fscrypt fixes from Eric Biggers: "A couple fixes for AI-detected bugs" * tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux: fscrypt: Avoid dynamic allocation in fscrypt_get_devices() fscrypt: Add missing superblock check in find_or_insert_direct_key()
2026-07-25Merge tag 'amd-drm-fixes-v7.2-2026-07-24' of ↵Dave Airlie
git://git.kernel.org/pub/scm/linux/kernel/git/superm1/linux into drm-fixes amd-drm-fixes-v7.2-2026-07-04: - Fix a backport mistake for dm_gpureset_toggle_interrupts() - Fix a failure on flip-done timeouts for mode1 reset Signed-off-by: Dave Airlie <airlied@redhat.com> From: Mario Limonciello <superm1@kernel.org> Link: https://patch.msgid.link/5d5964a3-fb85-4a3c-9252-a43c93fe935d@kernel.org
2026-07-24arm64: dts: rockchip: Fix rk3566-bigtreetech-cb2 touchscreen propertyFabio Estevam
The TSC2007 driver uses the ti,max-rt property to specify the maximum touch resistance, but the rk3566-bigtreetech-cb2 device tree uses the undocumented ti,rt-thr property instead. As a result, the configured value is ignored and the driver falls back to its default maximum resistance value of 4095. Replace ti,rt-thr with ti,max-rt to preserve the intended resistance threshold of 3000. Fixes: bfbc663d2733 ("arm64: dts: rockchip: Add BigTreeTech CB2 and Pi2") Signed-off-by: Fabio Estevam <festevam@gmail.com> Link: https://patch.msgid.link/20260721135450.45286-1-festevam@gmail.com Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-24arm64: dts: rockchip: fix label of sys_led for nanopi-r4sVic B
This commit corrects the system LED configuration for the NanoPi R4S by replacing the deprecated label property with color and function. This changes the resulting label of mislabeled sys_led from red:power to green:status, while the labels of the other two leds stay intact (green:lan for lan_led and green:wan for wan_led). Signed-off-by: Vic B <linux@vicb.net> Link: https://patch.msgid.link/al0cKhqvPbBO_5q8@vicb.net Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-24arm64: dts: rockchip: Fix the rk3566-radxa-cm3 Wifi compatibleFabio Estevam
According to brcm,bcm4329-fmac.yaml, "brcm,bcm43455-fmac" needs the "brcm,bcm4329-fmac" fallback. Change it accordingly to fix the following dt-schema warning: ['brcm,bcm43455-fmac'] is too short Signed-off-by: Fabio Estevam <festevam@gmail.com> Link: https://patch.msgid.link/20260721133421.44258-1-festevam@gmail.com Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-24arm64: dts: rockchip: Fix Gru WLAN sideband interruptFabio Estevam
The Marvell WLAN host wake interrupt is wired to GPIO0 8 and is not one of the PCI INTx interrupts. The PCI device schema therefore interprets the two-cell GPIO interrupt specifier as an invalid PCI interrupt and reports dtbs_check warnings: pcie@0,0: wifi@0,0:interrupts:0:0: 8 is not one of [1, 2, 3, 4] pcie@0,0: wifi@0,0:interrupts:0: [8, 8] is too long Describe the sideband interrupt with interrupts-extended, which explicitly carries the interrupt controller and removes the ambiguity. Fixes: 48f4d9796d99 ("arm64: dts: rockchip: add Gru/Kevin DTS") Signed-off-by: Fabio Estevam <festevam@gmail.com> Link: https://patch.msgid.link/20260721133445.44283-1-festevam@gmail.com Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-24arm64: dts: rockchip: Add Vicharak Vaaman2 boardHrushiraj Gandhi
Add device tree for the Vicharak Vaaman2, a single-board computer based on the Rockchip RK3588 SoC. The board features: - RK3588 SoC with 4x Cortex-A76 (big) + 4x Cortex-A55 (little) - eMMC storage via SDHCI (HS400) - microSD card via SDMMC - RK806 PMIC on SPI2 providing all required power domains - Two RK8602/RK8603 CPU regulators on I2C0 (big clusters) - RK8602 NPU regulator on I2C1 - HYM8563 RTC on I2C0 - Status LED on GPIO2_C5 (active-low, heartbeat trigger) - UART2 as serial console at 1500000 baud - SARADC with 1.8V reference Signed-off-by: Hrushiraj Gandhi <hrushirajg23@gmail.com> Link: https://patch.msgid.link/20260714054653.266842-3-hrushirajg23@gmail.com Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-24dt-bindings: arm: rockchip: Add Vicharak Vaaman2Hrushiraj Gandhi
Add device tree binding documentation for the Vicharak Vaaman2, a single-board computer based on the Rockchip RK3588 SoC. Signed-off-by: Hrushiraj Gandhi <hrushirajg23@gmail.com> Acked-by: Conor Dooley <conor.dooley@microchip.com> Link: https://patch.msgid.link/20260714054653.266842-2-hrushirajg23@gmail.com Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-24arm64: dts: rockchip: add Vicharak Axon boardHrushiraj Gandhi
Add initial support for the Vicharak Axon single-board computer based on the Rockchip RK3588 SoC. The board supports: - eMMC storage - microSD card - Gigabit Ethernet - HDMI output (dual HDMI) - HDMI input - USB 2.0 host ports - PCIe 2.0 slots - PCIe 3.0 x4 slot - SATA - RTC - Status LEDs The board uses an RK806 PMIC and provides the regulators required by the RK3588 SoC. Signed-off-by: Hrushiraj Gandhi <hrushirajg23@gmail.com> Link: https://patch.msgid.link/20260714053419.265523-3-hrushirajg23@gmail.com [some sorting, dropped deprecated regulator-suspend-microvolt properties] Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-24dt-bindings: arm: rockchip: add Vicharak Axon boardHrushiraj Gandhi
Add the device tree binding for the Vicharak Axon single-board computer based on the Rockchip RK3588 SoC. Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Hrushiraj Gandhi <hrushirajg23@gmail.com> Link: https://patch.msgid.link/20260608060940.52549-2-hrushirajg23@gmail.com Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-24arm64: dts: rockchip: Add LCKFB Taishan Pi 3MLiu Changjie
Add the device tree for LCKFB Taishan Pi 3M, a board based on the Rockchip RK3576 SoC. The board schematics are available at: https://oshwhub.com/li-chuang-kai-fa-ban/project_gzzvrwqn Describe the RK806 supplies, eMMC, recovery key, RTC, SD card, Gigabit Ethernet, USB Type-A hosts, source-only USB Type-C host, mSATA, HDMI video and audio, AP6256 Wi-Fi and Bluetooth, status LED, thermal sensors, and debug UART. The MAE0621A PHY CLKOUT supplies the GMAC reference-clock input, so request its validated 125 MHz setting. The following interfaces were tested on the hardware: eMMC, RTC register access, recovery key, SD card, 1GbE, USB 2.0 Type-A storage, USB 3.0 Type-A 5 Gbit/s enumeration and 64 MiB storage I/O, USB-C source/host enumeration in both orientations, mSATA, HDMI video and audio, AP6256 2.4/5 GHz Wi-Fi scan, WPA2 association, ping and bidirectional throughput, Bluetooth firmware load and HCI bring-up, and UART0. Bluetooth active discovery was additionally exercised during bring-up. Signed-off-by: Liu Changjie <liucj1228@outlook.com> Link: https://patch.msgid.link/MN0PR19MB6091D3101FD2D8F940F0CE4DACF92@MN0PR19MB6091.namprd19.prod.outlook.com Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-24dt-bindings: arm: rockchip: Add LCKFB Taishan Pi 3MLiu Changjie
Add the compatible string for LCKFB Taishan Pi 3M, a board based on the Rockchip RK3576 SoC. Acked-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Liu Changjie <liucj1228@outlook.com> Link: https://patch.msgid.link/MN0PR19MB6091201B6DAEE197762F6468ACF92@MN0PR19MB6091.namprd19.prod.outlook.com Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-24arm64: dts: rockchip: Add Orange Pi 5 Pro board supportDennis Gilmore
Add device tree for the Xunlong Orange Pi 5 Pro (RK3588S). - eMMC module, you can optionally solder a SPI NOR in place and turn off the eMMC - PCIe-attached NIC (pcie2x1l2) - PCIe NVMe slot (pcie2x1l1) - AP6256 WiFi (BCM43456) via SDIO with mmc-pwrseq - BCM4345C5 Bluetooth - es8388 audio - USB 2.0 and USB 3.0 - HDMI output is enabled - the second HDMI port connected to the DP bridge is left out for a followup set Vendors schematics are available at: https://drive.google.com/file/d/1qs1DratHuh7C6J6MEtQIwUsiSrg8qgTi/view Signed-off-by: Dennis Gilmore <dennis@ausil.us> Reviewed-by: Alexey Charkov <alchark@gmail.com> Link: https://patch.msgid.link/20260511025352.106126-5-dennis@ausil.us Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-24arm64: dts: rockchip: refactor items from Orange Pi 5/b to prep for ProDennis Gilmore
The Orange Pi 5 Pro uses the same SoC and base as the Orange Pi 5 and Orange Pi 5B but has had sound, USB, and leds wired up differently. The 5 and 5B boards use gmac for ethernet where the Pro has a PCIe attached NIC. Move the 5/5B-specific bits (analog-sound/es8388, FUSB302 Type-C, gmac1, pwm-leds, i2s1_8ch routing, USB role-switch plumbing) out of rk3588s-orangepi-5.dtsi into a new rk3588s-orangepi-5-5b.dtsi that is included by both 5 and 5B. The RK806 PLDO1 and PLDO2 outputs are wired differently between the 5/5B and the Pro (PLDO1/PLDO2 are swapped), so label the PMIC node rk806 in the base dtsi, drop pldo-reg1/pldo-reg2 from it, and define them via a &rk806 regulators augmentation in rk3588s-orangepi-5-5b.dtsi. The Pro will supply its own mapping. Signed-off-by: Dennis Gilmore <dennis@ausil.us> Reviewed-by: Alexey Charkov <alchark@gmail.com> Link: https://patch.msgid.link/20260511025352.106126-4-dennis@ausil.us Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-24arm64: dts: rockchip: rename PLDO regulator labels to match schematic on ↵Dennis Gilmore
rk3588s-orangepi-5 The Orange Pi 5, 5B and 5 Pro schematics label the RK806 PLDO outputs using the pattern VCC_*_S0 / VCCA_*_S0 / VDDA_*_S0. Rename the base dtsi regulator labels (and the es8388 supply references) to match: pldo-reg1: avcc_1v8_s0 -> vcc_1v8_s0 pldo-reg2: vcc_1v8_s0 -> vcca_1v8_s0 pldo-reg3: avdd_1v2_s0 -> vdda_1v2_s0 pldo-reg4: vcc_3v3_s0 -> vcca_3v3_s0 Also update the saradc vref-supply reference to track the pldo-reg1 rename. No functional change. Signed-off-by: Dennis Gilmore <dennis@ausil.us> Link: https://patch.msgid.link/20260511025352.106126-3-dennis@ausil.us Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-24dt-bindings: arm: rockchip: Add Orange Pi 5 ProDennis Gilmore
Add compatible string for the Orange Pi 5 Pro. Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Dennis Gilmore <dennis@ausil.us> Link: https://patch.msgid.link/20260511025352.106126-2-dennis@ausil.us Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-24arm64: dts: rockchip: Add devicetree for the Graperain G3568 v2Coia Prant
The Graperain G3568 v2 is an RK3568-based development board, just like the RK3568-EVB. It always uses soldered connections between the GR3568CV2 core board and the RK3568BV2/GR3568BV2 I/O board. The G3568 board has multiple hardware revisions, and we currently support v2 (I/O board). Specification: - SoC: RockChip RK3568 ARM64 (4 cores) - eMMC: 16-128 GB - RAM: 2-16 GB - Power: DC 12V 2A - Ethernet: 2x RTL8211F RGMII (10/100/1000 Mbps) - Wireless radio: 802.11b/g/n/ac dual-band - LED: Power: AlwaysOn User: GPIO - Button: ESC: SARADC/0 <1100k µV> MENU: SARADC/0 <1400k µV> VOL-: SARADC/0 <430k µV> VOL+: SARADC/0 <50k µV> Power/Reset: PMIC RK809 - CAN CAN/1: 4-pin (PH 2.0) - PWM PWM/4: Backlight PWM/5: Backlight PWM/7: IR Receiver - UART: UART/2: Debug TTL - 1500000 8N1 (1.25mm) UART/3: TTL (PH 2.0) UART/4: TTL (PH 2.0) UART/8: AP6356S Bluetooth UART/9: TTL (PH 2.0) - I2C: I2C/0: PMIC RK809 I2C/1: Touchscreen I2C/4: Camera I2C/5: RTC@51 PCF8563 - I2S: I2S/0: HDMI Sound I2S/1: RK809 Audio Codec I2S/3: AP6356S Bluetooth Sound - SDMMC: SDMMC/0: microSD (TF) slot SDMMC/2: AP6356S SDIO WiFi card - Camera: 1x CSI - Video: HDMI / DSI0 (MIPI/LVDS) / DSI1 (MIPI/EDP) - Audio: HDMI / MIC / Speaker / SPDIF / 3.5mm Headphones / AP6356S Bluetooth - USB: USB 2.0 HOST x2 USB 2.0 OTG x1 (shared with USB 3.0 OTG/HOST) USB 3.0 HOST x1 USB 3.0 OTG/HOST x1 - SATA: 1x SATA 3.0 with Power/4-pin - PCIe: 1x PCIe 3.0 x2 (x4 connector) Link: - https://image.chukouplus.com/upload/C_153/product_file/20211022/6daddec9e400458816dd4c57ba807fc3.pdf - https://blog.gov.cooking/archives/research-graperain-g3568-v2-and-flash.html Signed-off-by: Coia Prant <coiaprant@gmail.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> #gmac and mdio nodes Link: https://patch.msgid.link/20260702204628.2407308-5-coiaprant@gmail.com Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-24dt-bindings: arm: rockchip: Add Graperain G3568 seriesCoia Prant
Document the Graperain G3568 v2, which is a development board based on the Rockchip RK3568 SoC. Graperain G3568 series also have an SBC series with the suffix "box". Graperain G3568 v2 belongs to development board series, not SBC series. Link: https://www.graperain.cn/RK3568/RK3568-Development/ (China) Link: https://www.graperain.com/ARM-Embedded-RK3568-Development-Board/ (Global) Link: https://image.chukouplus.com/upload/C_153/product_file/20211022/6daddec9e400458816dd4c57ba807fc3.pdf Signed-off-by: Coia Prant <coiaprant@gmail.com> Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://patch.msgid.link/20260702204628.2407308-4-coiaprant@gmail.com Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-24dt-bindings: vendor-prefixes: Add graperainCoia Prant
Add graperain to the vendor prefixes. Link: https://www.graperain.cn/ (China) Link: https://www.graperain.com/ (Global) Signed-off-by: Coia Prant <coiaprant@gmail.com> Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://patch.msgid.link/20260702204628.2407308-3-coiaprant@gmail.com Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-24Revert "arm64: dts: rockchip: Further describe the WiFi for the Pinephone Pro"Oren Klopfer
This reverts commit 096bd8c679185f898cae9933c6a68650fa26ea4f. Just as with the Pinebook Pro, there are multiple chipset variants for the Pinephone Pro, and multiple firmware binaries for different distributions. The change causes issues with some of these combinations, and reverting it resolves the issues. See the Closes below for the full report. Similarly with the Pinebook Pro adjustment, the original commit only indicates "further description" and not indicative of fixing any existing issues, so reverting should not kick any back up. Fixes: 096bd8c67918 ("arm64: dts: rockchip: Further describe the WiFi for the Pinephone Pro") Cc: Heiko Stuebner <heiko@sntech.de> Cc: Peter Robinson <pbrobinson@gmail.com> Cc: Thorsten Leemhuis <regressions@leemhuis.info> Cc: stable@vger.kernel.org Closes: https://lore.kernel.org/r/20260607225901.64019-1-oklopfer37@gmail.com/ Signed-off-by: Oren Klopfer <oklopfer37@gmail.com> Link: https://patch.msgid.link/20260703201010.67311-1-oklopfer37@gmail.com Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-24arm64: dts: rockchip: fix HDMI-RX signal detect GPIO on yy3588Daniele Briguglio
The YY3588 declares the HDMI-RX signal detect on GPIO1_C6, but the receiver never sees an attached source there and cannot capture any input. That value was copied from the vendor device tree and is wrong. The core-board schematics are not available and the SoM documentation does not clearly show where this signal is routed, so the correct pin was read from the device tree in the board's Android image: GPIO1_D5. With GPIO1_D5 the receiver detects a connected source and locks, and v4l2 reports the input timing (1920x1080p60). Fixes: 19847bde695f ("arm64: dts: rockchip: Add Youyeetoo YY3588") Signed-off-by: Daniele Briguglio <hello@superkali.me> Link: https://patch.msgid.link/20260709-yy3588-hdmirx-d5-fix-v1-1-900a6790386c@superkali.me Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-24arm64: dts: rockchip: Enable USB device mode on rk3588s-roc-pcFabio Estevam
The USB3 OTG controller on the ROC-PC can be used in device mode, but the board description only enabled the DWC3 controller and USB2 PHY. The USBDP PHY remained disabled and the controller had no role-switch default, so DWC3 did not register a UDC and USB gadget drivers such as g_mass_storage failed to bind. Enable the USBDP PHY and describe the controller as a USB role switch with peripheral as the default role. This lets the controller register as a UDC when no external role provider has selected a host role. Tested on a Firefly Station M3 by binding g_mass_storage to expose the eMMC as a USB mass-storage gadget. Signed-off-by: Fabio Estevam <festevam@nabladev.com> Link: https://patch.msgid.link/20260709005006.413145-1-festevam@gmail.com Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-24arm64: dts: rockchip: Fix rk3588s-roc-pc audio descriptionFabio Estevam
The rk3588s-roc-pc ES8388 codec is connected to the i2s0_8ch audio interface. Use the matching I2S0 MCLK output for the codec clock instead of I2S1. Using the I2S1 MCLK can leave the ALSA PCM running while the codec has no usable master clock for the active audio path, resulting in silent headphone output. Also make the CPU DAI provide bitclock and frame clock. This matches the active Rockchip I2S controller side and avoids relying on the codec to drive the bus clocks. Route the headphone output to LOUT2 and ROUT2, matching the old 5.10 BSP device tree. LOUT1 and ROUT1 are used for the speaker route there, so using them for the headphone widget can leave the headphone jack silent even while the ALSA path is active. The old BSP also used hp-con-gpio on GPIO1_A4. Model that GPIO as a simple audio amplifier so DAPM enables the headphone connection when the headphone path is active. Cc: stable@vger.kernel.org Fixes: 7f9509791507 ("arm64: dts: rockchip: add DTs for Firefly ROC-RK3588S-PC") Signed-off-by: Fabio Estevam <festevam@nabladev.com> Link: https://patch.msgid.link/20260703025648.180135-1-festevam@gmail.com Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-24arm64: dts: rockchip: Fix incorrect interrupt for the 9Tripod X3568 v4Coia Prant
The recently changes for 9Tripod X3568 mistakenly configured the WiFi host-wake interrupt trigger type as IRQ_TYPE_LEVEL_LOW. However, the associated pin `wifi_host_wake_irq` is configured with an internal pull-down resistor. When the WiFi module enters a low-power sleep state and leaves the pin floating, this pull-down bias drives the pin low. Since the interrupt is incorrectly set to level-low, this combination traps the kernel in an endless interrupt loop. Correct the interrupt trigger type to IRQ_TYPE_LEVEL_HIGH based on the actual hardware logic: the pin is kept low by default and driven high by the WiFi module to wake up the host. Fixes: 993555b5476c ("arm64: dts: rockchip: Add AP6275S support for 9Tripod X3568 v4") Signed-off-by: Coia Prant <coiaprant@gmail.com> Link: https://patch.msgid.link/20260702202429.2341789-1-coiaprant@gmail.com Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-24arm64: dts: rockchip: fan speed control for FriendlyELEC CM3588 NASVsevolod Kozlov
The FriendlyELEC CM3588 NAS kit is often supplied with a case and a fan. Enable control of the speed of the fan using the trip points and cooling maps from rk3588-nanopc-t6.dtsi as a reference. Signed-off-by: Vsevolod Kozlov <zaba@mm.st> Link: https://patch.msgid.link/akkAvJap-MtbKp8B@Vsevolods-MacBook-Pro.local Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-24arm64: dts: rockchip: add HYM8563 RTC to Radxa CM5 IO boardBrian Mayer
Describe the Haoyu HYM8563 RTC connected to I2C6 on the Radxa CM5 IO carrier including its interrupt line. Assisted-by: Grok:grok-build Signed-off-by: Brian Mayer <bleemayer@gmail.com> Link: https://patch.msgid.link/20260705181920.8633-1-bleemayer@gmail.com Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-24arm64: dts: rockchip: Correct indentationKrzysztof Kozlowski
Correct spaces or mix of tabs+spaces into proper tab-indented lines. No functional impact (same DTB). Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://patch.msgid.link/20260706093419.273625-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-24arm64: dts: rockchip: Add HINLINK H28KChukun Pan
The HINLINK H28K (LinkStar H28K) is a SBC with the Rockchip RK3528 SoC. It has the following features: - 1x USB 2.0 - 8/32GB eMMC - 1/2/4GB LPDDR4 - MicroSD card slot - 1x 1GbE RTL8111H Ethernet - 1x 1GbE RTL8211F Ethernet Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn> Link: https://patch.msgid.link/20260610100006.366963-3-amadeus@jmu.edu.cn Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-24dt-bindings: arm: rockchip: Add HINLINK H28KChukun Pan
The HINLINK H28K (also known as LinkStar H28K) is a dual-gigabit SBC based on the RK3528 SoC. Add devicetree binding documentation for it. Link: https://wiki.seeedstudio.com/H28K_Datasheet/ Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn> Acked-by: Conor Dooley <conor.dooley@microchip.com> Link: https://patch.msgid.link/20260610100006.366963-2-amadeus@jmu.edu.cn Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-24arm64: dts: rockchip: Add eDP node for RK3576Damon Ding
Add full device tree definition for the integrated eDP controller on RK3576, following the existing RK3588 hardware layout. Configure required register range, clocks, interrupt, phy, power domain, reset and grf properties to fully describe the controller. Signed-off-by: Damon Ding <damon.ding@rock-chips.com> Reviewed-by: Nicolas Frattaroli <nicolas.frattaroli@collabora.com> Link: https://patch.msgid.link/20260605022305.3058853-4-damon.ding@rock-chips.com Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-24arm64: dts: rockchip: Add missing hclk for RK3588 eDP1Damon Ding
Add the required HCLK_VO1 bus clock to RK3588 eDP1 node with corresponding clock-name "hclk". This clock is necessary for the eDP controller to access video output GRF and work properly. Previously the clock was enabled implicitly via GRF phandle reference. Add it explicitly now to align with updated binding. Fixes: a481bb0b1ad9 ("arm64: dts: rockchip: Add eDP1 dt node for rk3588") Signed-off-by: Damon Ding <damon.ding@rock-chips.com> Link: https://patch.msgid.link/20260605022305.3058853-3-damon.ding@rock-chips.com Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-24arm64: dts: rockchip: Add missing hclk for RK3588 eDP0Damon Ding
Add the required HCLK_VO1 bus clock to RK3588 eDP0 node with corresponding clock-name "hclk". This clock is necessary for the eDP controller to access video output GRF and work properly. Previously the clock was enabled implicitly via GRF phandle reference. Add it explicitly now to align with updated binding. Fixes: dc79d3d5e7c7 ("arm64: dts: rockchip: Add eDP0 node for RK3588") Signed-off-by: Damon Ding <damon.ding@rock-chips.com> Link: https://patch.msgid.link/20260605022305.3058853-2-damon.ding@rock-chips.com Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-24arm64: dts: rockchip: fix eMMC reset polarity on PX30 RingneckQuentin Schulz
According to the Jedec 5.1 specification, the device is held in reset when RST_n is low, therefore the polarity of the line must be that, as specified in the Device Tree binding (mmc/mmc-pwrseq-emmc.yaml). Due to the wrong polarity, eMMC devices with RST_n_FUNCTION[162] bitfield [1:0] set to 0x1 (the default is 0x0) will be held in reset forever. Cc: stable@vger.kernel.org Fixes: c484cf93f61b ("arm64: dts: rockchip: add PX30-µQ7 (Ringneck) SoM with Haikou baseboard") Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de> Link: https://patch.msgid.link/20260626-ringneck-emmc-polarity-v1-1-90cefe57b316@cherry.de Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-24arm64: dts: rockchip: fix regulator names on NanoPC-T6Ricardo Pardini
Three fixed-regulator names on the NanoPC-T6 don't match the board schematic [1]. - vcc3v3_pcie2x1l0 -> vdd_mpcie_3v3 This GPIO-switched 3v3 regulator is labeled vcc3v3_pcie2x1l0, but it is wired to and consumed by &pcie2x1l1. Per the schematic, the GPIO PCIE_M2_1_PWREN controls the power net VDD_MPCIE_3.3V; rename to match. - vdd_2v0_pldo_s3 -> vcc_2v0_pldo_s3 Typo in the regulator-name property of RK806-1 DCDC reg7. The node label and the schematic power-net name both already use the vcc_ form; only the regulator-name string had vdd_. - vcc3v3_pcie30 -> vcc3v3_pcie_m2_0 The GPIO-switched 3v3 feeding the M.2 M-Key (NVMe) slot is named after the PCIe controller it sits behind rather than the schematic power net. The schematic names it VCC3V3_PCIE_M2_0 (produced by an MP2143-based buck off VCC_5V0, enabled by PCIE_M2_0_PWREN); rename to match. No functional change. [1] https://wiki.friendlyelec.com/wiki/images/9/97/NanoPC-T6_2301_SCH.PDF Signed-off-by: Ricardo Pardini <ricardo@pardini.net> Link: https://patch.msgid.link/20260605-rk3588-dts-rockchip-nanopct6-fix-schematic-names-v1-1-15dd3b23ab1a@pardini.net Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-24arm64: dts: rockchip: Add Youyeetoo YY3588Daniele Briguglio
The YY3588 is a single board computer built around the Rockchip RK3588. Specification: - Rockchip RK3588 SoC - 4/8/16/32 GB LPDDR4/4x - up to 256 GB eMMC - microSD card slot - 1x 1000Base-T (Realtek RTL8211F) and 1x 2500Base-T (Realtek RTL8125) - HDMI 2.1 output - HDMI input - 4x USB 3.0 Type-A via onboard hub, 1x USB 2.0 Type-A - USB Type-C with USB 3.0 - M.2 M-key with PCIe 3.0 x4 - Mini PCIe slot for WiFi/BT or 4G modules - SATA 3.0 - ES8388 audio codec with headphone jack and onboard microphone - fan connector, RTC, recovery key - 12 V DC input Both Ethernet ports, eMMC, SD card, USB, Type-C, HDMI output, WiFi on the Mini PCIe slot, audio, the recovery key and the fan have been tested on the board. Link: https://wiki.youyeetoo.com/YY3588 Signed-off-by: Daniele Briguglio <hello@superkali.me> Link: https://patch.msgid.link/20260610-yy3588-board-v1-3-4bb7176b6826@superkali.me Signed-off-by: Heiko Stuebner <heiko@sntech.de>
generated by cgit v1.2.3 (git 2.39.1) at 2026-08-16 03:20:29 +0000