summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-06-10perf tools: Use scnprintf() in cpu_map__snprint() to prevent overflowArnaldo Carvalho de Melo
cpu_map__snprint() accumulates snprintf() return values in ret. snprintf() returns the number of characters that *would have been written* on truncation, not the actual count. When a fragmented CPU list exceeds the buffer, ret grows past size, causing `size - ret` to underflow (both are size_t), and subsequent snprintf() calls write past the end of the caller's stack buffer. Switch to scnprintf() which returns the actual number of characters written, making ret accumulation safe by construction. Fixes: a24020e6b7cf6eb8 ("perf tools: Change cpu_map__fprintf output") Reported-by: sashiko-bot <sashiko-bot@kernel.org> Reviewed-by: Ian Rogers <irogers@google.com> Cc: Jiri Olsa <jolsa@kernel.org> Cc: Ian Rogers <irogers@google.com> Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-06-10perf tools: Fix get_max_num() size_t underflow on empty sysfs fileArnaldo Carvalho de Melo
get_max_num() reads a sysfs file (cpu/possible, cpu/present, or node/possible) and scans backward from the end to find the last number. If the file is empty, filename__read_str() returns num == 0. The loop `while (--num)` decrements the size_t from 0 to SIZE_MAX, reading backward across the heap until a comma or hyphen is found or unmapped memory is hit. Add an early return for empty files before the backward scan. Fixes: 7780c25bae59fd04 ("perf tools: Allow ability to map cpus to nodes easily") Reported-by: sashiko-bot <sashiko-bot@kernel.org> Reviewed-by: Ian Rogers <irogers@google.com> Cc: Don Zickus <dzickus@redhat.com> Cc: Ian Rogers <irogers@google.com> Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-06-10nvme-fc: Do not cancel requests in io target before it is initializedMohamed Khalfella
A new nvme-fc controller in CONNECTING state sees admin request timeout schedules ctrl->ioerr_work to abort inflight requests. This ends up calling __nvme_fc_abort_outstanding_ios() which aborts requests in both admin and io tagsets. In case fc_ctrl->tag_set was not initialized we see the warning below. This is because ctrl.queue_count is initialized early in nvme_fc_alloc_ctrl(). nvme nvme0: NVME-FC{0}: starting error recovery Connectivity Loss INFO: trying to register non-static key. The code is fine but needs lockdep annotation, or maybe lpfc 0000:ab:00.0: queue 0 connect admin queue failed (-6). you didn't initialize this object before use? turning off the locking correctness validator. Workqueue: nvme-reset-wq nvme_fc_ctrl_ioerr_work [nvme_fc] Call Trace: <TASK> dump_stack_lvl+0x57/0x80 register_lock_class+0x567/0x580 __lock_acquire+0x330/0xb90 lock_acquire.part.0+0xad/0x210 blk_mq_tagset_busy_iter+0xf9/0xc00 __nvme_fc_abort_outstanding_ios+0x23f/0x320 [nvme_fc] nvme_fc_ctrl_ioerr_work+0x172/0x210 [nvme_fc] process_one_work+0x82c/0x1450 worker_thread+0x5ee/0xfd0 kthread+0x3a0/0x750 ret_from_fork+0x439/0x670 ret_from_fork_asm+0x1a/0x30 </TASK> Update the check in __nvme_fc_abort_outstanding_ios() confirm that io tagset was created before iterating over busy requests. Also make sure to cancel ctrl->ioerr_work before removing io tagset. Reviewed-by: Randy Jennings <randyj@purestorage.com> Reviewed-by: Hannes Reinecke <hare@kernel.org> Reviewed-by: Daniel Wagner <dwagner@suse.de> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Mohamed Khalfella <mkhalfella@purestorage.com> Signed-off-by: James Smart <jsmart833426@gmail.com> Signed-off-by: Maurizio Lombardi <mlombard@redhat.com> Signed-off-by: Keith Busch <kbusch@kernel.org>
2026-06-10nvme: make nvme_add_ns{_head}_cdev return voidJohn Garry
The return code from nvme_add_ns_head_cdev() and nvme_add_ns_cdev() is never checked, so make those functions return void. A cdev add failure is tolerated during initialization, and flags NVME_NS_CDEV_LIVE and NVME_NSHEAD_CDEV_LIVE are for determining whether a cdev needs to be deleted during un-initialization. Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Hannes Reinecke <hare@kernel.org> Signed-off-by: John Garry <john.g.garry@oracle.com> Signed-off-by: Keith Busch <kbusch@kernel.org>
2026-06-10nvme: make some sysfs diagnostic structures staticJohn Garry
Building with C=1 generates the following warnings: drivers/nvme/host/sysfs.c:397:25: warning: symbol 'dev_attr_io_errors' was not declared. Should it be static? drivers/nvme/host/sysfs.c:444:30: warning: symbol 'nvme_ns_diag_attr_group' was not declared. Should it be static? drivers/nvme/host/sysfs.c:1150:25: warning: symbol 'dev_attr_adm_errors' was not declared. Should it be static? Make those structures static. Closes: https://lore.kernel.org/oe-kbuild-all/202606101329.T3zXNqdy-lkp@intel.com/ Reviewed-by: Nilay Shroff <nilay@linux.ibm.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: John Garry <john.g.garry@oracle.com> Signed-off-by: Keith Busch <kbusch@kernel.org>
2026-06-10ALSA: pcm: Fix unlocked state reads in read/write file opsCássio Gabriel
The PCM read/write and readv/writev file operations reject streams in OPEN or DISCONNECTED state before accessing the configured runtime parameters. However, each operation reads runtime->state without the PCM stream lock. PCM state updates are serialized by the stream lock and may occur concurrently from IRQ context. Use a local predicate based on snd_pcm_get_state() to take a locked state snapshot for these VFS entry checks. This also consolidates the duplicated OPEN and DISCONNECTED tests. The conditions and returned errors remain unchanged. Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com> Link: https://patch.msgid.link/20260610-alsa-pcm-read-write-state-helper-v1-1-93b7b992db09@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-06-10s390: Enable Rust supportJan Polensky
Enable building Rust code on s390 by wiring the architecture into the kernel Rust infrastructure. Add s390 to the Rust arch support documentation, provide the s390 Rust target and required compiler flags, and set the bindgen target for arch/s390. Adjust the Rust target generation and minimum rustc version gating so the s390 setup is handled explicitly. The Rust toolchain uses the "s390x" triple naming for the 64 bit target. Rust support is currently incompatible with CONFIG_EXPOLINE, which relies on compiler support for the -mindirect-branch= and -mfunction_return= options. Therefore, select HAVE_RUST only when EXPOLINE is disabled. Acked-by: Miguel Ojeda <ojeda@kernel.org> Acked-by: Gary Guo <gary@garyguo.net> Acked-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Jan Polensky <japo@linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
2026-06-10s390/cmpxchg: Fix KASAN stack-out-of-bounds in atomic helpersJan Polensky
The __arch_cmpxchg1, __arch_cmpxchg2, __arch_xchg1, and __arch_xchg2 functions emulate 1-byte and 2-byte atomic operations using 4-byte cmpxchg instructions, since s390 lacks native 1/2-byte cmpxchg support. When KASAN is enabled, the READ_ONCE() operations in these functions trigger stack-out-of-bounds warnings because they perform 4-byte reads when only 1 or 2 bytes should be accessed. Mark these functions as __no_sanitize_or_inline to prevent KASAN instrumentation while maintaining correct functionality. This resolves the following KASAN error during rust_atomics KUnit tests: BUG: KASAN: stack-out-of-bounds in rust_helper_atomic_i8_xchg+0xb2/0xc0 Read of size 4 at addr 001bff7ffdbefcf0 by task kunit_try_catch/142 Reported-by: Miguel Ojeda <miguel.ojeda.sandonis@gmail.com> Link: https://lore.kernel.org/rust-for-linux/CANiq72m4GVWFYqnxNtCHTPu7XcGewHB5LNwOoayTfnXs9pPbNg@mail.gmail.com/ Suggested-by: Gary Guo <gary@garyguo.net> Link: https://lore.kernel.org/rust-for-linux/DITFTAVVHTNQ.380OHUHGTOI6M@garyguo.net/ Acked-by: Heiko Carstens <hca@linux.ibm.com> Acked-by: Gary Guo <gary@garyguo.net> Signed-off-by: Jan Polensky <japo@linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
2026-06-10rust: helpers: Add memchr wrapper for string operationsJan Polensky
Add a dedicated string helper file with a memchr wrapper that uses the kernel's instrumented memchr() function to ensure KASAN and FORTIFY_SOURCE protections are preserved for Rust code. Reported-by: Miguel Ojeda <miguel.ojeda.sandonis@gmail.com> Link: https://lore.kernel.org/rust-for-linux/CANiq72mXAZc0sNM7ShX8VDVs_7zJddawP-e=wt+ERr1YUCcWUw@mail.gmail.com/ Signed-off-by: Jan Polensky <japo@linux.ibm.com> Acked-by: Heiko Carstens <hca@linux.ibm.com> Acked-by: Gary Guo <gary@garyguo.net> Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
2026-06-10rust/bindgen_parameters: Mark s390 types as opaque to prevent repr conflictsJan Polensky
Bindgen attempts to generate Rust layouts for a number of s390 structs that are packed but contain, or transitively contain, aligned fields. Rust rejects such layouts with E0588 ("packed type cannot transitively contain a #[repr(align)] type"). Add the affected s390 types to the opaque type list so bindgen emits opaque blob types instead of full representations. This matches existing workarounds for x86 types such as alt_instr and x86_msi_data. Link: https://lore.kernel.org/all/e5c7aa10-590d-0d20-dd3b-385bee2377e7@intel.com/ Acked-by: Miguel Ojeda <ojeda@kernel.org> Reviewed-by: Gary Guo <gary@garyguo.net> Acked-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Jan Polensky <japo@linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
2026-06-10s390/jump_label: Implement ARCH_STATIC_BRANCH_JUMP_ASM and ↵Jan Polensky
ARCH_STATIC_BRANCH_ASM macros Rust static branch support needs the s390 jump label instruction sequence and __jump_table emission in a reusable form. The current implementation embeds the sequence directly in the C asm goto blocks, which cannot be shared with Rust. Introduce ARCH_STATIC_BRANCH_ASM and ARCH_STATIC_BRANCH_JUMP_ASM to describe the brcl sequences for the likely-false and likely-true cases and to emit the same __jump_table entries as before. Switch the existing C helpers to use the new macros to avoid duplication without changing the generated code. Acked-by: Gary Guo <gary@garyguo.net> Acked-by: Miguel Ojeda <ojeda@kernel.org> Acked-by: Heiko Carstens <hca@linux.ibm.com> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Jan Polensky <japo@linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
2026-06-10s390/bug: Provide ARCH_WARN_ASM for Rust WARN/BUG supportJan Polensky
Rust WARN and BUG support relies on ARCH_WARN_ASM to emit __bug_table entries. On s390 the macro is missing, so Rust code cannot generate proper WARN/BUG metadata for the kernel's bug reporting infrastructure. Define ARCH_WARN_ASM to produce the same assembly sequence and __bug_table entry format as the existing s390 BUG handling, including the monitor call. Define ARCH_WARN_REACHABLE as empty since s390 does not provide reachability analysis for warning paths. Acked-by: Gary Guo <gary@garyguo.net> Acked-by: Miguel Ojeda <ojeda@kernel.org> Acked-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Jan Polensky <japo@linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
2026-06-10Merge tag 'riscv-for-linux-7.1-rc8' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Paul Walmsley: - Fix the implementation of the CFI branch landing pad control prctl()s to return -EINVAL if unknown control bits are set, rather than silently ignoring the request; and add a kselftest for this case - Fix unaligned access performance testing to happen earlier in boot, which fixes a performance regression in the lib/checksum code - Fix a binfmt_elf warning when dumping core (due to missing .core_note_name for CFI registers) * tag 'riscv-for-linux-7.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: cfi: reject unknown flags in PR_SET_CFI riscv: Fix fast_unaligned_access_speed_key not getting initialized riscv/ptrace: Use USER_REGSET_NOTE_TYPE for REGSET_CFI
2026-06-10namespace: restrict OPEN_TREE_NAMESPACE/FSMOUNT_NAMESPACE to directoriesJann Horn
open_tree(..., OPEN_TREE_NAMESPACE) and fsmount(..., FSMOUNT_NAMESPACE, ...) currently work on non-directories, like regular files. That's bad for two reasons: - It ends up mounting a regular file over the inherited namespace root, which is a directory; mounting a non-directory over a directory is normally explicitly forbidden, see for example do_move_mount() - It causes setns() on the new namespace to set the cwd to a regular file, which the rest of VFS does not expect Fix it by restricting create_new_namespace() (which is used by both of these flags) to directories. Leave the behavior for OPEN_TREE_CLONE as-is, that seems unproblematic. Fixes: 9b8a0ba68246 ("mount: add OPEN_TREE_NAMESPACE") Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: Christian Brauner <brauner@kernel.org> Cc: Jan Kara <jack@suse.cz> Cc: stable@kernel.org Signed-off-by: Jann Horn <jannh@google.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2026-06-10PCI: imx6: Integrate new pwrctrl APISherry Sun
Integrate the PCI pwrctrl framework into the pci-imx6 driver to provide standardized power management for PCI devices. Legacy regulator handling (vpcie-supply at controller level) is maintained for backward compatibility with existing device trees. New device trees should specify power supplies at the Root Port level to utilize the pwrctrl framework. Signed-off-by: Sherry Sun <sherry.sun@nxp.com> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260520084904.2424253-2-sherry.sun@oss.nxp.com
2026-06-10platform/x86: ISST: Restore SST-PP control to all domainsSrinivas Pandruvada
The SST-PP control offset is only restored to power domain 0 after resume. During suspend, control values are read and stored for all power domains. Use pd_info->sst_base instead of power_domain_info->sst_base, which only points to power domain 0 base address. Fixes: dc7901b5a156 ("platform/x86: ISST: Store and restore all domains data") Reported-by: Yi Lai <yi1.lai@intel.com> Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@intel.com> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260528204521.3531456-1-srinivas.pandruvada@linux.intel.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-06-10hwmon: (gpd-fan): fix race condition between device removal and sysfs accessPei Xiao
Replace the manual gpd_fan_remove() callback with a devres-managed action using devm_add_action_or_reset(). The original remove hook resets the fan to AUTOMATIC mode, but the hwmon sysfs interface (registered with devm_hwmon_device_register_with_info()) remains active until after the remove callback completes. This creates a race window where a concurrent userspace sysfs access can interleave with the EC I/O sequence, potentially corrupting EC registers. Using devm_add_action_or_reset() registers the reset function as a devres action. Due to the LIFO release order of devres, the hwmon device is unregistered (sysfs removed) before the reset action executes, eliminating the race condition. Fixes: 0ab88e239439 ("hwmon: add GPD devices sensor driver") Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn> Link: https://lore.kernel.org/r/4400828422cf3a88adad4db224d9efccdb1049d2.1781055639.git.xiaopei01@kylinos.cn Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-06-10hwmon: (gpd-fan): upgrade log level from warn to err for platform device ↵Pei Xiao
creation failure When platform_create_bundle() fails, the error is fatal and prevents the driver from loading. Use pr_err() instead of pr_warn() to clearly indicate a critical failure. Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn> Link: https://lore.kernel.org/r/aeb2eaa6df90178b18057a8022a0eccde7bbc82c.1781055639.git.xiaopei01@kylinos.cn Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-06-10hwmon: (gpd-fan): Initialize EC before registering hwmon devicePei Xiao
Move the gpd_init_ec() call to before devm_hwmon_device_register_with_info in the probe function. With the previous ordering the hwmon device was registered and exposed to userspace before the EC initialization completes, creating a window where sysfs reads could return invalid values. Some buggy firmware won't initialize EC properly on boot. Before its initialization, reading RPM will always return 0, and writing PWM will have no effect. So move gpd_init_ec to before hwmon device register. Fixes: 0ab88e239439 ("hwmon: add GPD devices sensor driver") Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn> Link: https://lore.kernel.org/r/4be3734b135c8013157979ab5e80c7ee51243ddd.1781055639.git.xiaopei01@kylinos.cn Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-06-10hwmon: (gpd-fan): drop global driver data and use per-device allocationPei Xiao
replace the global state gpd_driver_priv with per-device private data (struct gpd_fan_data) allocated in probe. This allows the driver to support multiple instances in the future and aligns with kernel best practices. No functional change intended. Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn> Link: https://lore.kernel.org/r/1cd3e13033fdd3d0f9b59322f7c86e350d113b92.1781055639.git.xiaopei01@kylinos.cn Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-06-10hwmon: (pmbus/max34440): add support adpm12250Alexis Czezar Torreno
ADPM12250 is a quarter brick DC/DC Power Module. It is a high power non-isolated converter capable of delivering regulated 12V with continuous power level of 2500W. Uses PMBus. Signed-off-by: Alexis Czezar Torreno <alexisczezar.torreno@analog.com> Reviewed-by: Nuno Sá <nuno.sa@analog.com> Link: https://lore.kernel.org/r/20260610-dev-adpm12250-v1-1-422760bb80da@analog.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-06-10watchdog: sc1200: Drop unused assignment of pnp_device_id driver dataUwe Kleine-König (The Capable Hub)
The driver explicitly sets the .driver_data member of struct pnp_device_id to zero without relying on that value. Drop this unused assignments. While touching this array simplify the list terminator. This patch doesn't modify the compiled array, only its representation in source form benefits. The former was confirmed with builds on x86 and arm64. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Link: https://lore.kernel.org/r/0793f81a854f9e5880ad38f54c8583b3d56e5d60.1781081216.git.u.kleine-koenig@baylibre.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-06-10floppy: Drop unused pnp driver dataUwe Kleine-König (The Capable Hub)
The pnp_device_id array is only used for module data to support auto-loading the floppy module. So the .driver_data member is unused and this assignment can be dropped. While touching that array, align the coding style to what is used most for these. This patch doesn't modify the compiled array, only its representation in source form benefits. The former was confirmed with x86 and arm64 builds. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Reviewed-by: Denis Efremov (Oracle) <efremov@linux.com> Link: https://patch.msgid.link/99dbf851ffb99229ea1dcfd8f58e9ee6a1f05349.1781075967.git.u.kleine-koenig@baylibre.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-06-10KVM: arm64: nv: Hold kvm->mmu_lock while initialising vcpu->arch.vncr_tlbMarc Zyngier
Sashiko reports that there is a race between initialising vncr_tlb and making use of it, as we don't hold the mmu_lock at this point. Additionally, it identifies a memory leak, should userspace repeatedly invokes the KVM_RUN ioctl after a failure of kvm_arch_vcpu_run_pid_change(), as we assign vncr_tlb blindly on first run, irrespective of prior allocations. Slap the two bugs in one go by taking the kvm->mmu_lock on assigning vncr_tlb, preventing the race for good, and by checking that vncr_tlb is indeed NULL prior to allocation. Reported-by: Sashiko <sashiko-bot@kernel.org> Link: https://lore.kernel.org/r/20260607180815.85FBC1F00893@smtp.kernel.org Reviewed-by: Oliver Upton <oupton@kernel.org> Link: https://patch.msgid.link/20260608081108.2244133-1-maz@kernel.org Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-06-10platform/x86/intel-uncore-freq: Fix current_freq_khz after CPU hotplugGuixiong Wei
When the last CPU of a legacy uncore die goes offline, uncore_freq_remove_die_entry() clears control_cpu. During CPU hotplug re-add, uncore_freq_add_entry() still populates sysfs attributes before assigning the new control CPU. As a result, the current frequency read returns -ENXIO and current_freq_khz is omitted from the recreated sysfs group. Assign control_cpu before the initial read paths and before create_attr_group() so sysfs recreation uses the new online CPU. If sysfs creation fails, restore control_cpu to -1 to keep the error path state consistent. Fixes: 4d73c6772ab7 ("platform/x86: intel-uncore-freq: Conditionally create attribute for read frequency") Cc: stable@vger.kernel.org Signed-off-by: Guixiong Wei <weiguixiong@bytedance.com> Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> Link: https://patch.msgid.link/20260602020752.3126-1-weiguixiong@bytedance.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-06-10platform/x86: intel-hid: Protect ACPI notify handler against recursionHyeongJun An
Since commit e2ffcda16290 ("ACPI: OSL: Allow Notify () handlers to run on all CPUs") ACPI notify handlers like the intel-hid notify_handler() may run on multiple CPU cores racing with themselves. On convertibles and detachables (matched by DMI chassis-type 31 and 32 in dmi_auto_add_switch[]) the SW_TABLET_MODE input device is registered lazily from notify_handler() on the first tablet-mode event, via intel_hid_switches_setup(). When two such events race on different CPUs both can pass the !priv->switches check and register the priv->switches input device twice, resulting in a duplicate sysfs entry and a subsequent NULL pointer dereference. This is the same class of bug fixed by commit e075c3b13a0a ("platform/x86: intel-vbtn: Protect ACPI notify handler against recursion") for the sibling intel-vbtn driver. Protect intel-hid notify_handler() from racing with itself with a mutex to fix this. Fixes: e2ffcda16290 ("ACPI: OSL: Allow Notify () handlers to run on all CPUs") Cc: stable@vger.kernel.org Signed-off-by: HyeongJun An <sammiee5311@gmail.com> Link: https://patch.msgid.link/20260605174905.131095-1-sammiee5311@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-06-10platform/x86/intel/vsec: Restore BAR fallback for header walkDavid E. Box
The base_addr refactor changed intel_vsec_walk_header() to pass info->base_addr as the discovery-table base address. For the PCI VSEC driver this info comes from driver_data, but exported callers may provide their own static headers and leave base_addr unset. For xe, this made the discovery-table base address zero instead of the BAR selected by header->tbir, preventing PMT endpoints from being created. Restore the previous behavior for the header-walk path by falling back to pci_resource_start(pdev, header->tbir) when base_addr is not specified. Keep explicit base_addr override behavior unchanged. This preserves the refactor structure while fixing the functional regression in manual-header users. Fixes: 904b333fc51c ("platform/x86/intel/vsec: Refactor base_addr handling") Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: David E. Box <david.e.box@linux.intel.com> Reviewed-by: Michael J. Ruhl <michael.j.ruhl@intel.com> Link: https://patch.msgid.link/20260529183150.129744-1-david.e.box@linux.intel.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-06-10platform/x86: dell-laptop: fix missing cleanups in init error pathHaoxiang Li
dell_init() initializes several resources after dell_setup_rfkill(), including the optional touchpad LED, keyboard backlight LED, battery hook, debugfs directory and dell-laptop notifier. If a later LED or backlight registration fails, the error path only tears down the battery hook and rfkill resources. This leaves the notifier, debugfs directory, keyboard backlight LED and optional touchpad LED registered after dell_init() returns an error. Add the missing cleanup calls before tearing down rfkill. Fixes: 9c656b07997f ("platform/x86: dell-*: Call new led hw_changed API on kbd brightness change") Fixes: 037accfa14b2 ("dell-laptop: Add debugfs support") Fixes: 2d8b90be4f1c ("dell-laptop: support Synaptics/Alps touchpad led") Fixes: 6cff8d60aa0a ("platform: x86: dell-laptop: Add support for keyboard backlight") Cc: stable@vger.kernel.org Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn> Link: https://patch.msgid.link/20260609081419.1995169-1-lihaoxiang@isrc.iscas.ac.cn Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-06-10ASoC: remove .debugfs_prefix from ComponentMark Brown
Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> says: Basically, we are assuming to use snd_soc_register_component() (X) to register Component. It requests Component driver (A). And, current Component has .debugfs_prefix (B). Now we can set component->debugfs_prefix (B) via component_driver->debugfs_prefix (A) today. But some drivers are still trying to set it via (B). Thus, they need to use snd_soc_component_initialize() (1) / snd_soc_component_add() (2) instead of (X), because they need to access component->debugfs_prefix (B). These functions (= 1, 2) should be capsuled into soc-xxx.c, but can't because of above drivers. This patch-set removes component->debugfs_prefix (B). The functions (= 1, 2) are still not yet be capsuled. This is step1 for it, step2 will be posted after this. Link: https://patch.msgid.link/87ldcxk5wz.wl-kuninori.morimoto.gx@renesas.com
2026-06-10ASoC: soc-component: remove .debugfs_prefix from ComponentKuninori Morimoto
All drivers are now setting .debugfs_prefix via Component driver. Remove it from Component. Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87cxy9k5vj.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-06-10ASoC: mediatek: mt8173-afe-pcm: set debugfs_prefix via Component driverKuninori Morimoto
We can set component->debugfs_prefix via component_driver->debugfs_prefix. Use it. Now it no longer need to use snd_soc_component_initialize() / snd_soc_component_add(). use snd_soc_component_register() instead. Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87ecipk5vo.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-06-10ASoC: stm: stm32_adfsdm: set debugfs_prefix via Component driverKuninori Morimoto
We can set component->debugfs_prefix via component_driver->debugfs_prefix. Use it. Now it no longer need to use snd_soc_component_initialize() / snd_soc_component_add(). Use snd_soc_component_register() instead. Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87fr35k5vs.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-06-10ASoC: soc-generic-dmaengine: set debugfs_prefix via Component driverKuninori Morimoto
We can set component->debugfs_prefix via component_driver->debugfs_prefix. Use it. Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87h5nlk5vx.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-06-10ASoC: fsl: imx-pcm-rpmsg: set debugfs_prefix via Component driverKuninori Morimoto
We can set component->debugfs_prefix via component_driver->debugfs_prefix. Use it. Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87ik81k5w2.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-06-10ASoC: soc-component: remove CONFIG_DEBUG_FS for debugfs_prefixKuninori Morimoto
Both (A) and (B) have debugfs_prefix, but (B) is using CONFIG_DEBUG_FS (C) (A) struct snd_soc_component { ... const char *debugfs_prefix; }; (B) struct snd_soc_component_driver { ... (C) ifdef CONFIG_DEBUG_FS const char *debugfs_prefix; endif }; Remove (C) which makes code cleanup difficult. Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87jyshk5wc.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-06-10platform/x86/amd/pmc: Add PMC driver support for AMD 1Ah M80H SoCShyam Sundar S K
The 1Ah M80H SoC uses a different set of SMU mailbox register offsets compared to the existing 1Ah variants: message at 0xA10, argument at 0xA18, and response at 0xA14. Add amd_1ah_m80_cpu_info with these offsets, wire it into the PCI ID table via PCI_DEVICE_DATA(), populate scratch_reg field with AMD_PMC_SCRATCH_REG_1AH and add the corresponding ACPI ID AMDI000C. Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Co-developed-by: Sanket Goswami <Sanket.Goswami@amd.com> Signed-off-by: Sanket Goswami <Sanket.Goswami@amd.com> Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com> Link: https://patch.msgid.link/20260609143952.2999707-3-Shyam-sundar.S-k@amd.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-06-10platform/x86/amd/pmc: Use per-SoC cpu_info struct for SMU mailbox and IP infoShyam Sundar S K
Replace the scattered per-field assignments in amd_pmc_get_ip_info() with a single amd_pmc_cpu_info struct capturing all SoC-specific parameters such as SMU offsets, IP block table, and OS hint. Define static const instances per SoC variant and embed them as driver_data in the PCI ID table via PCI_DEVICE_DATA(). Consolidate pci_match_id() into amd_pmc_set_cpu_info(), which assigns driver_data directly to cpu_info, the switch falls through only for 1Ah M20H/M60H variants requiring boot_cpu_data.x86_model detection to distinguish the M70 sub-variant. Add scratch_reg to amd_pmc_cpu_info and populate it for each SoC variant, allowing amd_pmc_idlemask_read() to drop its cpu_id switch in favour of a single cpu_info->scratch_reg lookup. Move dev->cpu_id assignment into amd_pmc_set_cpu_info() so it is valid before the switch statement. Handle SP/SHP directly in the switch since their NULL driver_data bypasses the early return, and remove the duplicate check from probe. Remove amd_pmc_get_os_hint() and use cpu_info->os_hint directly at call sites and rename AMD_CPU_ID_* to PCI_DEVICE_ID_AMD_CPU_ID_* with backward compatibility aliases. Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Co-developed-by: Sanket Goswami <Sanket.Goswami@amd.com> Signed-off-by: Sanket Goswami <Sanket.Goswami@amd.com> Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com> Link: https://patch.msgid.link/20260609143952.2999707-2-Shyam-sundar.S-k@amd.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-06-10ASoC: dt-bindings: everest,es8389: Document audio graph portDiederik de Haas
Provide an endpoint for binding with the other side of the audio link, which is achieved via the 'port' property. Signed-off-by: Diederik de Haas <diederik@cknow-tech.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://patch.msgid.link/20260607105913.355966-1-diederik@cknow-tech.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-06-10platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_tableNikolay Metchev
The volume rocker buttons on the HP ProBook x360 440 G1 convertible emit events 0xc4-0xc7 via the intel-hid ACPI device (INT33D5). These codes are only present in intel_array_keymap, which is used when the "5 button array" input device exists. On this machine button_array_present() returns false because the firmware does not advertise the array through the HEBC method, so notify_handler() routes the events to a NULL priv->array and they are dropped as "unknown event 0xc4". As a result the side volume keys do nothing. Add the machine to button_array_table so the array device is created and the volume rocker emits KEY_VOLUMEUP / KEY_VOLUMEDOWN. This is equivalent to booting with the enable_5_button_array=1 module parameter, which was used to confirm the fix on the affected hardware. Signed-off-by: Nikolay Metchev <nikolaymetchev@gmail.com> Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Link: https://patch.msgid.link/20260609213309.445019-1-nikolaymetchev@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-06-10spi: dt-bindings: nuvoton,npcm750-fiu: Convert to DT schemaTomer Maimon
Convert the Nuvoton NPCM FIU binding to DT schema format. Document the required control registers and the optional direct- mapped flash window separately, matching the driver behavior when the direct mapping is not described. Signed-off-by: Tomer Maimon <tmaimon77@gmail.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://patch.msgid.link/20260609163919.3321228-4-tmaimon77@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-06-10ASoC: SOF: topology: validate vendor array size before parsingCássio Gabriel
sof_parse_token_sets() reads array->size while iterating over topology private data. The loop condition only checks that some data remains, so a malformed topology with a truncated trailing vendor array can make the parser read the size field before a full vendor-array header is available. Validate that the remaining private data contains a complete snd_soc_tplg_vendor_array header before reading array->size. The declared array size check also needs to remain signed. asize is an int, but sizeof(*array) has type size_t, so comparing them directly promotes negative asize values to unsigned and lets them pass the check, as reported in the stable review thread reference below. Cast sizeof(*array) to int when validating the declared array size. This rejects negative, zero and otherwise too-small sizes before the parser dispatches to the tuple-specific code. Link: https://lore.kernel.org/stable/CANiDSCsjR5NHqu_Ui5cOqWdJgFqmYsQ9WR8O7m0WOhngaYXFpw@mail.gmail.com/t/#m9b3be379221e79327cc13fd71009287368ef4f23 Fixes: 215e5fe75881 ("ASoC: SOF: topology: reject invalid vendor array size in token parser") Cc: stable@vger.kernel.org Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com> Link: https://patch.msgid.link/20260603-sof-topology-array-size-signed-v1-1-84f97879a4ef@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-06-10ASoC: Use codec_info_list.is_amp directly in find_acpi_adr_device()Mark Brown
Bard Liao <yung-chuan.liao@linux.intel.com> says: This series sets is_amp to all amp type codecs in codec_info_list[]. So that we can use the flag directly instead of using a local flag to check if the codec is an AMP type. The flag will be used to set different name_prefix for amp and non-amp codecs. Link: https://patch.msgid.link/20260605101805.121428-1-yung-chuan.liao@linux.intel.com
2026-06-10ASoC: SOF: Intel: Use codec_info_list.is_amp directlyBard Liao
Now we set is_amp to all amp type codecs. We can use the flag directly instead of using a local flag to check if the codec is an AMP type. Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com> Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com> Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com> Link: https://patch.msgid.link/20260605101805.121428-3-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-06-10ASoC: soc_sdw_utils: add is_amp flag to all ampsBard Liao
The is_amp flag will be used for the codec name_prefix. We detect it by checking if the codec support endpoints other than amp. However, it is not accurate. Currently, the is_amp flag is only set to the amps that include other types of endpoints. But it can't cover the case that a monolithic codec that only the amp endpoint is present. Add the is_amp flag to all amp type codecs and will set the name_prefix by the flag in the follow up commit. Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com> Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com> Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com> Link: https://patch.msgid.link/20260605101805.121428-2-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-06-10ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend failsRichard Fitzgerald
In cs35l56_system_suspend() re-enable the parent IRQ if the call to pm_runtime_force_suspend() returns an error. Fixes: f9dc6b875ec0 ("ASoC: cs35l56: Add basic system suspend handling") Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com> Link: https://patch.msgid.link/20260610105556.612830-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-06-10ASoC/sh: roll back Ecovec24/7724se Sound supportMark Brown
Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> says: Hi Mark, Adrian Due to a communication miss, the Ecovec24/7724se Sound support were removed. We need to keep them for a while, until they will support "DT-style". Roll back Ecovec24/7724se "platform data style", and its necessary header. Link: https://patch.msgid.link/87wlw743x2.wl-kuninori.morimoto.gx@renesas.com
2026-06-10ASoC: renesas: fsi: remove platform data style supportKuninori Morimoto
Renesas FSI driver has created for "platform data style" first, and expanded to "DT style". SuperH Ecovec24/7724se are the last user of "platform data style", but its sound should not work during almost 10 years, because Simple-Card's "platform data style" is broken, but no one reported it. SuperH is planning to switch to "DT style", "platform data style" is no longer working, and it seems there is no user. Let's remove "platform data style", because keeping compatibility is difficult. Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87tsrb43u3.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-06-10sh: roll back Ecovec24/7724se Sound supportKuninori Morimoto
Due to a communication miss, the Ecovec24/7724se Sound support were removed. We need to keep them for a while, until they will support "DT-style". Roll back Ecovec24/7724se "platform data style", and its necessary header. Fixes: deadb855b694d ("sh: 7724se: remove FSI/AK4642/Simple-Audio-Card support") Fixes: 9cc93ebc85e71 ("sh: ecovec24: remove FSI/DA7210/Simple-Audio-Card support") Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87v7br43vk.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-06-10arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPUWill Deacon
Commit fb091ff39479 ("arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata") states that Microsoft Azure Cobalt 100 CPU "is a Microsoft implemented CPU based on r0p0 of the ARM Neoverse N2 CPU, and therefore suffers from all the same errata.". So enable the workaround for the latest broadcast TLB invalidation bug on these parts. Signed-off-by: Will Deacon <will@kernel.org>
2026-06-10ASoC: tas2783A: remove unused tas25xx_(de)register_misc() functionsEthan Nelson-Moore
The tas2783 driver defines two functions tas25xx_register_misc and tas25xx_deregister_misc which have stub implementations. It uses external implementations if CONFIG_SND_SOC_TAS2783_UTIL is enabled, but that symbol has never been present in the kernel. Therefore, these functions are entirely unused. Remove them. Discovered while searching for CONFIG_* symbols referenced in code but not defined in any Kconfig file. Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com> Link: https://patch.msgid.link/20260610013534.30762-1-enelsonmoore@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>