summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-07-28clk: mvebu: clean-up simple provider misuse of the consumer APIJerome Brunet
Clock provider should not be using the consumer interface. In other words, a provider should not be dealing with struct clk. This change targets occurrences for which the provider uses the consumer interface and corresponding clk_hw interface exist. Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Jerome Brunet <jbrunet@baylibre.com> Reviewed-by: Thierry Reding <treding@nvidia.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: remove conditional return with no effectSang-Heon Jeon
Both branches of the check return the same value, so the check has no effect. Remove it and return the value directly. In the lmk04832 driver, the hardware sequence comments are moved above the final return by hand. This is the result of running the Coccinelle script from scripts/coccinelle/misc/cond_return_no_effect.cocci. Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: Add devm_clk_bulk_get_enable()Suraj Gupta
devm_clk_bulk_get_optional_enable() gets, prepares and enables a set of clocks with device-managed cleanup, but treats every clock as optional: a missing clock is silently returned as NULL instead of failing. Consumers that need a fixed set of mandatory clocks enabled for the lifetime of the device currently have to open-code devm_clk_bulk_get() followed by clk_bulk_prepare_enable(), which loses the managed disable on unbind, or fall back to per-clock devm_clk_get_enabled() calls. Add devm_clk_bulk_get_enable() as the non-optional counterpart. The underlying __devm_clk_bulk_get_enable() helper already supports the required (optional = false) path, so only export a thin wrapper for it. Signed-off-by: Suraj Gupta <suraj.gupta2@amd.com> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: en7523: add support for dedicated PCIe PERSTOUT resetChristian Marangi
Add support for resetting the PCIe lines with the PERSTOUT reset. These special reset are controlled by the PCIC register and are specific to each of the 3 PCIe lines. Contrary to the dedicated reset register where 0 deassert and 1 assert the reset line for the related bit, for PCIe PERSTOUT reset in the PCIC register, the deassert and assert value is swapped, with 1 for deassert and 0 for assert. (HW have these bit set as 1 by default after a cold boot) This is internally handled in the reset function. PCI enable/disable are updated to drop PERSTOUT bits in favor dedicated reset handling. Signed-off-by: Christian Marangi <ansuelsmth@gmail.com> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28dt-bindings: clock: airoha: Add additional reset for PCIe PERSTOUTChristian Marangi
Add additional reset to control PCIe PERSTOUT reset line for each of the 3 PCIe lines. Signed-off-by: Christian Marangi <ansuelsmth@gmail.com> Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28arm64: dts: cix: sky1: add audss cruJoakim Zhang
Add the AUDSS CRU device node providing clocks and software resets for audio subsystem peripherals. Signed-off-by: Joakim Zhang <joakim.zhang@cixtech.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28reset: cix: add sky1 audss auxiliary reset driverJoakim Zhang
Add an auxiliary reset controller driver for the AUDSS CRU. Sixteen software reset lines for audio subsystem peripherals are controlled through one register in the CRU register map. The driver is created by the AUDSS clock platform driver and registers the reset controller on the CRU device node. Signed-off-by: Joakim Zhang <joakim.zhang@cixtech.com> Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de> Acked-by: Philipp Zabel <p.zabel@pengutronix.de> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: cix: add sky1 audss clock controllerJoakim Zhang
Add a platform driver for the Cix Sky1 AUDSS CRU. The driver maps the CRU registers and registers mux, divider and gate clocks for DSP, SRAM, HDA, DMAC, I2S, mailbox, watchdog and timer blocks. Four SoC-level audio reference clocks are enabled as inputs to the internal clock tree. The driver releases the AUDSS NOC reset, enables runtime PM and instantiates the auxiliary reset device. Signed-off-by: Joakim Zhang <joakim.zhang@cixtech.com> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28dt-bindings: soc: cix: add sky1 audss cru controllerJoakim Zhang
The Cix Sky1 Audio Subsystem (AUDSS) Clock and Reset Unit (CRU) groups clock muxing, gating and block-level software reset control in a single register block. Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Joakim Zhang <joakim.zhang@cixtech.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: ultrarisc: Add DP1000 clock driverJia Wang
Add a clock driver for the UltraRISC DP1000 SoC. The clock tree is driven by a SYSPLL and provides fixed-factor clocks for the subsystem and PCIe, divider-based root clocks for GMAC and the UART, I2C, and SPI blocks, and per-instance gate clocks for UART0-3, I2C0-3, and SPI0-1. Signed-off-by: Jia Wang <wangjia@ultrarisc.com> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28dt-bindings: clock: ultrarisc: Add DP1000 Clock ControllerJia Wang
Add doc for the clock controller on the UltraRISC DP1000 RISC-V SoC. Signed-off-by: Jia Wang <wangjia@ultrarisc.com> Reviewed-by: Conor Dooley <conor.dooley@microchip.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: composite: Export devm composite pdata helperJia Wang
Allow modular clock drivers to use devm_clk_hw_register_composite_pdata() by exporting the helper. The non-devm composite helpers are already available to modules. Export this devm variant as well so users do not need to open-code devres cleanup. Signed-off-by: Jia Wang <wangjia@ultrarisc.com> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: hisilicon: hi3660-stub: use devm_platform_ioremap_resourceRosen Penev
Replace the open-coded platform_get_resource() plus devm_ioremap() sequence with devm_platform_ioremap_resource(), which fetches the resource, requests the region and maps it in one call. Switch the error check to IS_ERR()/PTR_ERR() and drop the now-unused struct resource pointer. The only in-tree user (stub_clock@e896b500 in hi3660.dtsi) has a single 0x100-byte reg region, so the region reservation added by devm_ioremap_resource() is exclusive and does not introduce overlap failures. Built for ARM (drivers/clk/hisilicon/clk-hi3660-stub.o) with LLVM=1. Assisted-by: opencode:hy3-free Signed-off-by: Rosen Penev <rosenp@gmail.com> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: stm32: allow STM32MP COMPILE_TEST buildsRosen Penev
COMMON_CLK_STM32MP already allows COMPILE_TEST, but the parent clock Makefile only descends into drivers/clk/stm32 for ARCH_STM32. Use the STM32MP clock symbol for that directory gate instead. Tested with: make LLVM=1 ARCH=loongarch drivers/clk/stm32/ Assisted-by: Codex:GPT-5.5 Signed-off-by: Rosen Penev <rosenp@gmail.com> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: stm32: add missing bitfield.h headerRosen Penev
It seems some ARM header includes this and the build passes there, but nowhere else. Note that the driver has COMPILE_TEST in depends. Fixes: 37ae8501cdb0 ("clk: stm32: introduce clocks for STM32MP21 platfor") Signed-off-by: Rosen Penev <rosenp@gmail.com> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: document that clk_get_parent() returns NULLDan Carpenter
The documentation in the clk.h file says that clk_get_parent() returns error pointers but it doesn't. It's also not consistent with the comments next to the clk_get_parent() implementation which say that it returns NULL when the clk is NULL. Update the comments so they are consistent and accurate and say that it returns NULL. Signed-off-by: Dan Carpenter <error27@gmail.com> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk/x86: pmc_atom: add kasprintf return value checklonglong yan
The kasprintf() function returns NULL on memory allocation failure, but the code in plt_clk_register() was not checking this return value. If kasprintf fails, init.name would be NULL and could cause NULL pointer dereference when clkdev_hw_create() uses it. Add proper error checking for the kasprintf() return value and return ERR_PTR(-ENOMEM) on failure. Fixes: 1141d9d08184 ("clk: x86: Add Atom PMC platform clocks") Signed-off-by: longlong yan <yanlonglong@kylinos.cn> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: mmp: pxa1908-apbcp: Remove unneeded semicolonChen Ni
Remove unnecessary semicolons reported by Coccinelle/coccicheck and the semantic patch at scripts/coccinelle/misc/semicolon.cocci. Signed-off-by: Chen Ni <nichen@iscas.ac.cn> Reviewed-by: Brian Masney <bmasney@redhat.com> Acked-by: Duje Mihanović <duje@dujemihanovic.xyz> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: mmp: pxa1908-apbc: Remove unneeded semicolonChen Ni
Remove unnecessary semicolons reported by Coccinelle/coccicheck and the semantic patch at scripts/coccinelle/misc/semicolon.cocci. Signed-off-by: Chen Ni <nichen@iscas.ac.cn> Reviewed-by: Brian Masney <bmasney@redhat.com> Acked-by: Duje Mihanović <duje@dujemihanovic.xyz> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: palmas: Use devm_of_clk_add_hw_provider()Myeonghun Pak
Use devm_of_clk_add_hw_provider() to register the clock provider so its lifetime is tied to the device. This removes the need for a remove callback that only unregisters the provider. Co-developed-by: Ijae Kim <ae878000@gmail.com> Signed-off-by: Ijae Kim <ae878000@gmail.com> Signed-off-by: Myeonghun Pak <mhun512@gmail.com> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: palmas: Manage external-control prepare with devmMyeonghun Pak
palmas_clks_init_configure() prepares the clock when an external control pin is configured. The current driver only drops that prepare reference when external control configuration fails. If provider registration fails after that point, or if the driver is later removed, the prepare reference remains held. Register a device-managed action after clk_prepare() succeeds. This balances the prepare reference on subsequent probe failure and driver removal. Fixes: 942d1d674931 ("clk: Add driver for Palmas clk32kg and clk32kgaudio clocks") Co-developed-by: Ijae Kim <ae878000@gmail.com> Signed-off-by: Ijae Kim <ae878000@gmail.com> Signed-off-by: Myeonghun Pak <mhun512@gmail.com> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: eswin: Zero-initialize stack-allocated clk_init_dataKostas Damaskinakis
eswin_clk_register_pll() and eswin_register_clkdiv() declare a struct clk_init_data on the stack and only initialize some of its fields (parent_data respectively parent_hws). clk_core_populate_parent_map() checks parent_names first and parent_data second before falling back to parent_hws, so leftover stack garbage in the uninitialized fields hijacks parent resolution and the clk core dereferences a bogus pointer: Unable to handle kernel NULL pointer dereference at virtual address 000000000000000c Oops [#1] epc : __clk_register+0x31a/0x7f0 [<ffffffff805dc774>] __clk_register+0x31a/0x7f0 [<ffffffff805dcd76>] devm_clk_hw_register+0x2a/0x94 [<ffffffff805e319a>] eswin_register_clkdiv+0x80/0xd0 [<ffffffff805e34a0>] eswin_clk_register_clks+0x162/0x1a0 [<ffffffff805e3736>] eic7700_clk_probe+0x146/0x180 [<ffffffff8065d23c>] platform_probe+0x3c/0x7a Observed on EIC7700 hardware (with the driver backported to a 6.17 tree); whether the bug triggers depends entirely on what the stack happens to contain when the registration helpers run. Zero-initialize both structures. Fixes: cd44f127c1d4 ("clk: eswin: Add eic7700 clock driver") Signed-off-by: Kostas Damaskinakis <kostas.damaskinakis@gmail.com> Reviewed-by: Brian Masney <bmasney@redhat.com> Acked-by: Xuyang Dong <dongxuyang@eswincomputing.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error pathLouis-Alexis Eyraud
When mtk_clk_register_pllfhs function fails to register a PLL, it unregisters all PLLs and cleans up itself in its error path before returning, so the function callers don't need to do it. But contrary to mtk_clk_unregister_pllfhs function, that does almost the same sequence, it does not free the IO memory mapped on fhctl node, leading to a leak. Fix this leak by factorizing the cleanup sequence in a new private function and use it both mtk_clk_register_pllfhs and mtk_clk_unregister_pllfhs functions. Also, change the loop index start value to avoid the -1 operation on index at each loop. Fixes: d7964de8a8ea ("clk: mediatek: Add new clock driver to handle FHCTL hardware") Signed-off-by: Louis-Alexis Eyraud <louisalexis.eyraud@collabora.com> Reviewed-by: Brian Masney <bmasney@redhat.com> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: tegra: tegra124-emc: put EMC node on register failureGuangshuo Li
tegra124_clk_register_emc() stores a device node reference returned by of_parse_phandle() in tegra->emc_node. If clk_register() fails, the function returns an error before that reference can be consumed and released by the normal runtime path. The tegra_clk_emc object is freed on this failure path, but freeing the object does not drop the OF node reference stored in it. Drop the EMC node reference before freeing the tegra_clk_emc object. of_node_put() is safe for a NULL node, so this also covers the case where the phandle is absent. Fixes: 2db04f16b589 ("clk: tegra: Add EMC clock driver") Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: en7523: reset PCIE HB on init for AN7581Christian Marangi
It was reported that PCIE HB should be reset for AN7581 or some instability or link training issue will be present on warm boot scenario. Reset PCIE HB on clk HW init to handle warm boot problem with PCIe. Signed-off-by: Christian Marangi <ansuelsmth@gmail.com> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: mediatek: remove unneeded 'fast_io' parameter in regmap_configWolfram Sang
When using MMIO with regmap, fast_io is implied. No need to set it again. Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Reviewed-by: Brian Masney <bmasney@redhat.com> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: mediatek: mt6735-vencsys: add missing MODULE_DEVICE_TABLE()Pengpeng Hou
The driver has an OF match table wired to .of_match_table, but does not export the table with MODULE_DEVICE_TABLE(). Add the missing MODULE_DEVICE_TABLE(of, ...) entry so module alias information is generated for OF based module autoloading. This is a source-level fix. It does not claim dynamic hardware reproduction; the evidence is the driver-owned match table, its use by the platform driver, and the missing module alias publication. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: mediatek: mt6735-vdecsys: add missing MODULE_DEVICE_TABLE()Pengpeng Hou
The driver has an OF match table wired to .of_match_table, but does not export the table with MODULE_DEVICE_TABLE(). Add the missing MODULE_DEVICE_TABLE(of, ...) entry so module alias information is generated for OF based module autoloading. This is a source-level fix. It does not claim dynamic hardware reproduction; the evidence is the driver-owned match table, its use by the platform driver, and the missing module alias publication. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: si544: add support for si549Pavel Löbl
Add support for Si549, which only differs from Si544 in internal oscilator frequency. Si549 also comes in three types A,B and C. Each having different maximum output frequency. This patch also fixes maximum frequency of Si544 C. Which should be 325MHz according to datasheet. Signed-off-by: Pavel Löbl <pavel@loebl.cz> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28dt-bindings: clock: si544: add si549 compatiblePavel Löbl
Adding Si549 compatible, which uses different internal oscillator frequency. Like in Si544 case, there are three types ending with latters a,b and c. Each with different maximum output frequency. Also fix datasheet links after Silicon Labs acquisition by Skyworks Solutions. Signed-off-by: Pavel Löbl <pavel@loebl.cz> Acked-by: Conor Dooley <conor.dooley@microchip.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: lan966x: Add MCHP_LAN966X_PCI dependencyHerve Codina
The lan966x clock controller depends on the LAN969x architecture or the LAN966x SoC. This clock controller can be used by the LAN966x PCI device and so it needs to be available when the LAN966x PCI device is enabled. Signed-off-by: Herve Codina <herve.codina@bootlin.com> Acked-by: Stephen Boyd <sboyd@kernel.org> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28Merge tag 'for-7.2-rc5-tag' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: "Zoned mode: - fix assertion and handle case of finished zone and truncated extent - fix zone metadata write pointer on actual zone reset - fix deadlock caused metadata writeback and transaction commit - fix return value reuse leading to confusion about chunk reservations raid56 scrub: - fix tracking of sector checksums when there are not checksums found - fix inverted logic when submitting parity read bio mount/remount fixes: - fix leaking 'remount in progress' state which can break other operations to work (qgroup rescan, autodefrag, reclaim) - adjust using global block reserve after read-only mount when using rescue= option - handle missing raid stripe tree when mounted with 'ignorebadroots' Misc: - fix -Wmaybe-uninitialized warning in GET_CSUMS ioctl" * tag 'for-7.2-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: raid56: fix scrub read assembly submitting no reads btrfs: zoned: skip fully truncated ordered extents at zone finish btrfs: initialize 'args' to avoid compiler warning in btrfs_ioctl_get_csums() btrfs: zoned: fix missing chunk metadata reservation btrfs: raid56: fix an incorrect csum skip during scrub btrfs: report missing raid stripe tree root during lookup btrfs: skip global block reserve accounting for rescue mounts btrfs: zoned: reset meta_write_pointer on zone reset btrfs: zoned: fix deadlock between metadata writeback and transaction commit btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag
2026-07-28Merge branch 'i2c/i2c' into i2c/i2c-nextAndi Shyti
2026-07-28dt-bindings: i2c: cdns: add Axiado AX3005 I2C variantSwark Yang
Add binding for Axiado AX3005 I2C controller. So far, no changes are known, so it can fall back to the cdns,i2c-r1p14 compatible. Signed-off-by: Swark Yang <syang@axiado.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Andi Shyti <andi.shyti@kernel.org> Link: https://lore.kernel.org/r/20260716-upstream-axiado-ax3005-upstream-v3-3-c429095143ec@axiado.com
2026-07-28tracing/probes: Reject $arg0 in meta argument expansionRaushan Patel
traceprobe_expand_meta_args() parses $argN with simple_strtoul() and calls sprint_nth_btf_arg(n - 1, ...). For $arg0, n is 0 so the index is -1. Because ctx->nr_params is signed, the "idx >= nr_params" guard in sprint_nth_btf_arg() does not catch the negative index, and ctx->params[-1].name_off is read out of bounds. The normal per-argument path (parse_probe_vars()) already rejects $arg0 via its argument-number check, but meta-argument expansion runs before per-argument parsing and substitutes the value first, bypassing that check. Reject $arg0 explicitly during expansion. Link: https://lore.kernel.org/all/20260724054435.146279-1-raushan.jhon@gmail.com/ Fixes: 18b1e870a496 ("tracing/probes: Add $arg* meta argument for all function args") Cc: stable@vger.kernel.org Signed-off-by: Raushan Patel <raushan.jhon@gmail.com> Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
2026-07-28tracing/probes: Treating longer symbol name on event comparationMasami Hiramatsu (Google)
MAX_COMMON_HEAD_LEN (63) was used to allocate a temporary buffer for formatting command heads in trace_kprobe_match_command_head() and trace_uprobe_match_command_head(). However, the buffer size is too short for some longer symbols. Especially, with rust code, the symbol can be mangled and become very long. Refactor trace_kprobe_match_command_head() to perform direct string comparisons using strcmp() and strncmp(), eliminating the need for a temporary buffer and removing the MAX_COMMON_HEAD_LEN string length restriction on probe symbol names. For trace_uprobe_match_command_head(), since tu->filename is already matched via strncmp(), use a fixed 64-byte stack buffer solely for formatting offset and ref_ctr_offset (which requires at most 39 bytes). With all users converted, remove the MAX_COMMON_HEAD_LEN definition from trace_probe.h. Link: https://lore.kernel.org/all/178521361102.34226.9650586522488974115.stgit@devnote2/ Reported-by: Zhan Xusheng <zhanxusheng1024@gmail.com> Link: https://lore.kernel.org/all/20260724023317.624074-1-zhanxusheng@xiaomi.com/ Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
2026-07-28docs: trace: fprobe: fix 'thos' spellingshaikh.kamal
Fix spelling error reported by codespell: thos -> those. No functional change. Link: https://lore.kernel.org/all/20260726065633.20897-1-shaikhkamal2012@gmail.com/ Signed-off-by: shaikh.kamal <shaikhkamal2012@gmail.com> Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
2026-07-28media: em28xx: defer audio-only extension registrationDiego Fernando Mancera Gomez
The audio-only path registers extensions while probing the primary device. For a dual-TS board, this happens before dev_next is created. The duplicate device inherits is_audio_only and is then independently inserted into em28xx_devlist. The list is intended to contain only primary devices: extension operations reach the secondary device through dev_next. The independently linked secondary can be freed during disconnect while its list node remains reachable, resulting in a use-after-free. Defer audio-only extension registration to the module-request work item. It runs only after probing has completed construction of the optional secondary device, so only the primary is registered and extension callbacks reach the secondary through dev_next. Fixes: 4a089668ef22 ("media: em28xx-cards: rework the em28xx probing code") Cc: stable@vger.kernel.org Reported-by: syzbot+a11c46f37ee083a73deb@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/66ec3c83.050a0220.29194.002f.GAE@google.com/T/ Suggested-by: Fedor Pchelkin <pchelkin@ispras.ru> Signed-off-by: Diego Fernando Mancera Gomez <diegomancera.dev@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-28Documentation: media: fix spelling errorsshaikh.kamal
Fix spelling errors reported by codespell: thare -> there (vidioc-subdev-g-routing.rst) stuct -> struct (legacy_dvb_video.rst) No functional change. Signed-off-by: shaikh.kamal <shaikhkamal2012@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-28arm64: dts: allwinner: a523: Enable SPDIF on X96QPRO+Per Larsson
The X96QPro+ TV box uses the PH7 pin for its SPDIF output. Add the relevant bits to the dts now that the dtsi knows about the pin. Signed-off-by: Per Larsson <per@palvencia.se> Link: https://patch.msgid.link/20260720174253.7686-2-per@palvencia.se [wens@kernel.org: reorder property order for spdif-out] [wens@kernel.org: fix up commit message] Signed-off-by: Chen-Yu Tsai <wens@kernel.org>
2026-07-28arm64: dts: allwinner: a523: Add SPDIF output PH pin mux optionPer Larsson
When SPDIF support was added for the Allwinner A523 family of SoCs, only two of the three possible pins were added to the dtsi, since the third would clash with the first ethernet port (gmac0). However, some devices don't use gmac0 and instead use gmac1 for the only available ethernet port, leaving the pin free to use for SPDIF. Add the remaining pin mux option from the PH pin group to the dtsi so such devices can (later) use it. Signed-off-by: Per Larsson <per@palvencia.se> Reviewed-by: Andre Przywara <andre.przywara@arm.com> Link: https://patch.msgid.link/20260720174253.7686-1-per@palvencia.se [wens@kernel.org: fix up commit message] Signed-off-by: Chen-Yu Tsai <wens@kernel.org>
2026-07-28arm64: dts: allwinner: sun50i-a64-pinephone: Fix mpu6050 mount matrixOndrej Jirman
The current mount matrix for mpu6050 is wrong. The mount matrix is a simple transform from the sensor coordinate space to the device coordinate space described in DT, where, looking at the screen, X points to the right, Y to the top, and Z towards the user. The mpu6050 is mounted like this (looking at the screen from the front; the sensor is on the near side of the PCB, so its Z axis points towards the user; o marks the pin 1 corner): +Xs ^ | +------+ +Ys <--| | | o | +------+ so this gives: Xd = -Ys [0, -1, 0] Yd = Xs [1, 0, 0] Zd = Zs [0, 0, 1] Fixes: 2496b2aaacf1 ("arm64: dts: allwinner: pinephone: Add mount matrix to accelerometer") Signed-off-by: Ondrej Jirman <megi@xff.cz> Link: https://patch.msgid.link/20260725111909.2244868-1-megi@xff.cz Signed-off-by: Chen-Yu Tsai <wens@kernel.org>
2026-07-28i2c: busses: drop redundant dev_err_probe() around irq helpersPei Xiao
platform_get_irq(), devm_request_irq() and devm_request_threaded_irq() already print an error message via dev_err_probe() on failure, so wrapping their return value with another dev_err_probe() results in duplicate error output. Drop these redundant dev_err_probe() calls across i2c bus drivers and return the error code directly instead. Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn> Signed-off-by: Andi Shyti <andi.shyti@kernel.org> Link: https://lore.kernel.org/r/aea09858af6be39497325e2560267771ed62e6b0.1784537126.git.xiaopei01@kylinos.cn
2026-07-28wifi: mac80211: fix per-STA profile length in cross-link CSA parsingZhao Li
ieee80211_mgd_check_cross_link_csa() starts parsing elements after the fixed per-STA profile header and the STA Info field, but subtracts only the STA Info length from the profile length. As a result, ieee802_11_parse_elems() is given sizeof(*prof) == 3 bytes beyond the current profile's element area, and data following the profile may be interpreted as belonging to it. Subtract the fixed profile header as well. The preceding ieee80211_mle_basic_sta_prof_size_ok() check guarantees that the corrected calculation cannot underflow, and ieee80211_rx_uhr_link_reconfig_req() uses the same calculation. The call site currently states that cross-link CSA parsing has no effect because the broader parsing is still incorrect. This patch does not address that broader problem; it only makes the per-STA profile parser stop at the end of that profile. No production allocation over-read or user-visible failure has been demonstrated. Fixes: 7ef8f6821d16 ("wifi: mac80211: mlme: handle cross-link CSA") Assisted-by: Codex:gpt-5.6-sol Assisted-by: Kimi:K3 Signed-off-by: Zhao Li <enderaoelyther@gmail.com> Link: https://patch.msgid.link/20260728111326.63087-1-enderaoelyther@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-28wifi: mac80211: simplify airtime_flags_write()Dmitry Antipov
Use 'kstrtou16_from_user()' to simplify 'airtime_flags_write()'. Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Link: https://patch.msgid.link/20260727095714.347039-1-dmantipov@yandex.ru Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-28wifi: mwifiex: Remove WQ_HIGHPRI from main workqueueFabio Estevam
The MWIFIEX_WORK_QUEUE handles command and event processing, including the commands used for scheduled scans. Running this work on the high-priority worker pool can interfere with latency-sensitive workloads. On an i.MX8MP-based audio system using an 88W8997, background scheduled scans caused audible glitches in USB audio playback. Remove WQ_HIGHPRI from the main workqueue so that command and scan processing use the normal-priority worker pool. Leave the RX and host MLME workqueues unchanged. Signed-off-by: Fabio Estevam <festevam@nabladev.com> Link: https://patch.msgid.link/20260724203320.78793-2-festevam@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-28wifi: mwifiex: Detach sync cmd buffer on interrupted waitFabio Estevam
mwifiex synchronous commands keep the caller-provided data buffer in cmd_node->data_buf. Several callers pass stack-allocated objects there. If wait_event_interruptible_timeout() is interrupted, the caller can return and release that stack object while the firmware command is still the current command. A late firmware response then reaches the normal response handler, which can copy data through cmd_node->data_buf into the stale stack address. This fixes a stack corruption observed during repeated association and disassociation cycles. The panic trace showed the command wait being interrupted immediately before a bad pointer dereference: cmd_wait_q terminated: -512 Unable to handle kernel paging request at virtual address 002c583837384662 Kernel panic - not syncing: stack-protector: Kernel stack is corrupted ... Tainted: [M]=MACHINE_CHECK The fault address decodes as little-endian ASCII: 0x002c583837384662 -> "bF878X,\0" which is a fragment of the VERSION_EXT firmware string exposed as debugfs "verext": w8997o-V4, RF878X, FP92, 16.92.21.p153.7 The same runs also showed corrupted control data containing: 0x2400372e333531 -> "153.7\0$" which is the tail of the same VERSION_EXT string. This points at a late VERSION_EXT response writing through a stale stack-backed data_buf after the interrupted wait returned. After cancelling pending commands on an interrupted or timed-out wait, detach the caller-owned data buffer from the still-current command. This preserves the existing command cancellation behaviour while preventing a late response from writing through a pointer whose lifetime ended with the waiting caller. Tested on an i.MX8MP board using an 88W8997. Cc: stable@vger.kernel.org Fixes: 3d026d09b28d ("mwifiex: cancel pending commands for signal") Signed-off-by: Fabio Estevam <festevam@nabladev.com> Link: https://patch.msgid.link/20260724203320.78793-1-festevam@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-28wifi: mac80211: add ieee80211_txq_aql_pending()Felix Fietkau
Add a function to allow drivers to query the pending AQL airtime for a given txq, for both unicast and broadcast. This will be used for mt76 to limit buffering in AP mode for power-save stations. Signed-off-by: Felix Fietkau <nbd@nbd.name> Link: https://patch.msgid.link/20260724115429.3921457-4-nbd@nbd.name Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-28wifi: mac80211: add AQL support for multicast packetsFelix Fietkau
Excessive multicast traffic with little competing unicast traffic can easily flood hardware queues, leading to throughput issues. Additionally, filling the hardware queues with too many packets breaks FQ for multicast data. Fix this by enabling AQL for multicast packets. Signed-off-by: Felix Fietkau <nbd@nbd.name> Link: https://patch.msgid.link/20260724115429.3921457-3-nbd@nbd.name Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-28wifi: mac80211: estimate expected throughput if not provided by driver/rcFelix Fietkau
Estimate the tx throughput based on the expected per-packet tx time. This is useful for mesh implementations that rely on expected throughput, e.g. 802.11s or batman-adv. Signed-off-by: Felix Fietkau <nbd@nbd.name> Link: https://patch.msgid.link/20260724115429.3921457-2-nbd@nbd.name Signed-off-by: Johannes Berg <johannes.berg@intel.com>
generated by cgit v1.2.3 (git 2.39.1) at 2026-09-22 03:03:33 +0000