Takashi Iwai [Wed, 10 Dec 2025 13:15:51 +0000 (14:15 +0100)]
ALSA: hda: intel-dsp-config: Prefer legacy driver as fallback
When config table entries don't match with the device to be probed,
currently we fall back to SND_INTEL_DSP_DRIVER_ANY, which means to
allow any drivers to bind with it.
This was set so with the assumption (or hope) that all controller
drivers should cover the devices generally, but in practice, this
caused a problem as reported recently. Namely, when a specific
kconfig for SOF isn't set for the modern Intel chips like Alderlake,
a wrong driver (AVS) got probed and failed. This is because we have
entries like:
so this entry is effective only when CONFIG_SND_SOC_SOF_ALDERLAKE is
set. If not set, there is no matching entry, hence it returns
SND_INTEL_DSP_DRIVER_ANY as fallback. OTOH, if the kconfig is set, it
explicitly falls back to SND_INTEL_DSP_DRIVER_LEGACY when no DMIC or
SoundWire is found -- that was the working scenario. That being said,
the current setup may be broken for modern Intel chips that are
supposed to work with either SOF or legacy driver when the
corresponding kconfig were missing.
For addressing the problem above, this patch changes the fallback
driver to the legacy driver, i.e. return SND_INTEL_DSP_DRIVER_LEGACY
type as much as possible. When CONFIG_SND_HDA_INTEL is also disabled,
the fallback is set to SND_INTEL_DSP_DRIVER_ANY type, just to be sure.
Junrui Luo [Tue, 9 Dec 2025 05:16:41 +0000 (13:16 +0800)]
ALSA: firewire-motu: add bounds check in put_user loop for DSP events
In the DSP event handling code, a put_user() loop copies event data.
When the user buffer size is not aligned to 4 bytes, it could overwrite
beyond the buffer boundary.
Joakim Zhang [Fri, 5 Dec 2025 15:46:21 +0000 (23:46 +0800)]
ALSA: hda: add CIX IPBLOQ HDA controller support
Add CIX IPBLOQ HDA controller support, which is integrated into
CIX SKY1 audio subsystem. HDA controller supports 64bit, but the
audio subsystem can only 32bit transaction. Use jack polling mode
as there is a hardware issue, lead to interrupt strom if the RIRB
interrupt enabled. Host and hdac has different view of memory, so
need do dma address translation.
Joakim Zhang [Fri, 5 Dec 2025 15:46:20 +0000 (23:46 +0800)]
ALSA: hda/core: add addr_offset field for bus address translation
Add bus addr_offset field for dma address translation,
for some SoCs such as CIX SKY1 which is ARM64 Arch, HOST
and HDAC has different memory view, so need to do dma address
translation between HOST and HDAC.
Joakim Zhang [Fri, 5 Dec 2025 15:46:19 +0000 (23:46 +0800)]
ALSA: hda: dt-bindings: add CIX IPBLOQ HDA controller support
Add CIX IPBLOQ HDA controller support, which is integrated into
CIX SKY1 audio subsystem. HDA controller supports 64bit, but the
audio subsystem can only 32bit transaction. Use jack polling mode
as there is a hardware issue, lead to interrupt strom if the RIRB
interrupt enabled. Host and hdac has different view of memory, so
need do dma address translation.
ALSA: usb-audio: Initialize status1 to fix uninitialized symbol errors
Initialize 'status1' with a default value to resolve the static analysis
smatch reported error "uninitialized symbol 'status1'".
The 'status1' variable is used to create a buff using "kmemdup".
So, ensure to initialize the value before it is read.
Junrui Luo [Wed, 3 Dec 2025 04:27:03 +0000 (12:27 +0800)]
ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events
The DSP event handling code in hwdep_read() could write more bytes to
the user buffer than requested, when a user provides a buffer smaller
than the event header size (8 bytes).
Fix by using min_t() to clamp the copy size, This ensures we never copy
more than the user requested.
Denis Arefev [Tue, 2 Dec 2025 10:13:36 +0000 (13:13 +0300)]
ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi()
The acpi_get_first_physical_node() function can return NULL, in which
case the get_device() function also returns NULL, but this value is
then dereferenced without checking,so add a check to prevent a crash.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 7b2f3eb492da ("ALSA: hda: cs35l41: Add support for CS35L41 in HDA systems") Cc: stable@vger.kernel.org Signed-off-by: Denis Arefev <arefev@swemel.ru> Reviewed-by: Richard Fitzgerald <rf@opensource.cirrus.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20251202101338.11437-1-arefev@swemel.ru
The HDA GPIO indices for the mic mute (0x1) and speaker mute (0x2) LEDs
are virtually guaranteed to be identical for the HP ProBook 440/450 G8
variants with motherboard SSIDs 8A74/8A75 (BIOS T87) and 8A76/8A77 (BIOS
T88); especially since spare keyboard parts are interchangeable between
different revisions of the same notebook models, and thus necessarily
have the same slot pinouts.
Takashi Iwai [Tue, 2 Dec 2025 06:12:56 +0000 (07:12 +0100)]
Merge tag 'asoc-v6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus
ASoC: Updates for v6.19
This is a very large set of updates, as well as some more extensive
cleanup work from Morimto-san we've also added a generic SCDA class
driver for SoundWire devices enabling us to support many chips with
no custom code. There's also a batch of new drivers added for both
SoCs and CODECs.
- Added a SoundWire SCDA generic class driver, pulling in a little
regmap work to support it.
- A *lot* of cleaup and API improvement work from Morimoto-san.
- Lots of work on the existing Cirrus, Intel, Maxim and Qualcomm
drivers.
- Support for Allwinner A523, Mediatek MT8189, Qualcomm QCM2290,
QRB2210 and SM6115, SpacemiT K1, and TI TAS2568, TAS5802, TAS5806,
TAS5815, TAS5828 and TAS5830.
This also pulls in some gpiolib changes supporting shared GPIOs in the
core there so we can convert some of the ASoC drivers open coding
handling of that to the core functionality.
Junrui Luo [Fri, 28 Nov 2025 04:06:31 +0000 (12:06 +0800)]
ALSA: dice: fix buffer overflow in detect_stream_formats()
The function detect_stream_formats() reads the stream_count value directly
from a FireWire device without validating it. This can lead to
out-of-bounds writes when a malicious device provides a stream_count value
greater than MAX_STREAMS.
Fix by applying the same validation to both TX and RX stream counts in
detect_stream_formats().
Reported-by: Yuhao Jiang <danisjiang@gmail.com> Reported-by: Junrui Luo <moonafterrain@outlook.com> Fixes: 58579c056c1c ("ALSA: dice: use extended protocol to detect available stream formats") Cc: stable@vger.kernel.org Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Junrui Luo <moonafterrain@outlook.com> Link: https://patch.msgid.link/SYBPR01MB7881B043FC68B4C0DA40B73DAFDCA@SYBPR01MB7881.ausprd01.prod.outlook.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
Mark Brown [Sat, 29 Nov 2025 00:48:15 +0000 (00:48 +0000)]
firmware: cs_dsp: Remove need for clients to supply
Merge series from Richard Fitzgerald <rf@opensource.cirrus.com>:
Clients of cs_dsp can provide optional callback function pointers, in
a struct cs_dsp_client_ops. The client had to provide a pointer to a
struct even if it didn't implement any of the callbacks.
Charles Keepax [Fri, 28 Nov 2025 10:28:41 +0000 (10:28 +0000)]
ASoC: SDCA: Fixup some more Kconfig issues
As the class driver is manually selectable, it needs to depend on
SOUNDWIRE, which is obviously necessary. Also the depends on in
SND_SOC_SDCA_HID needs to be pulled into SND_SOC_SDCA_CLASS as well,
since HID is selected by the class driver.
Fixes: 2d877d0659cb ("ASoC: SDCA: Add basic SDCA class driver") Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202511281223.DDs12LiC-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202511280822.i2fveMpR-lkp@intel.com/ Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Link: https://patch.msgid.link/20251128102841.2930808-1-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
ASoC: cs35l56: Log a message if firmware is missing
If the amp is still reporting FIRMWARE_MISSING after cs35l56_patch()
has completed it is helpful to log a warning.
After a complete firmware download the FIRMWARE_MISSING flag will be
clear. If this isn't the case, the driver should log a message to
report this.
The amp can produce basic audio output without firmware, as a fallback,
so this wasn't originally logged as a warning condition because the amp
is still in an operational state - just not with full functionality.
However, it was not at all obvious to an end user that anything is
unusual.
firmware: cs_dsp: Add test cases for client_ops == NULL
Add test cases for the client not providing a pointer to a
struct cs_dsp_client_ops. This proves that it is safe for the client
to leave the client_ops pointer at NULL if it does not need to
implement any of the callbacks.
firmware: cs_dsp: Don't require client to provide a struct cs_dsp_client_ops
A client of cs_dsp does not necessarily need to implement any of the
optional callbacks in struct cs_dsp_client_ops, so allow the client_ops
pointer to be NULL.
This has been done by pointing client_ops at a default empty
cs_dsp_client_ops. It keeps the code cleaner by avoiding having to add
double nested NULL checks everywhere one of these callbacks is called.
Chancel Liu [Thu, 27 Nov 2025 02:26:52 +0000 (11:26 +0900)]
ASoC: fsl_micfil: Set channel range control
The range control register can't directly adjust volume gain according
to specification. It's the dynamic range of the CIC filter. The range
value should meet some conditions otherwise the channel data is not
reliable. Add an array in soc data to store const value in formula
with which range with all quality on different platforms can be
calculated. If the value set to range control exceeds the max range
there'll be warning logs.
Chancel Liu [Thu, 27 Nov 2025 02:26:51 +0000 (11:26 +0900)]
ASoC: fsl_micfil: Add default quality for different platforms
Add a default quality flag in soc data. For i.MX8MP/93/943 platforms on
which range control is constrained, set medium quality by default to
achieve better audio performance and wider adjustable range control.
Mark Brown [Thu, 27 Nov 2025 21:50:47 +0000 (21:50 +0000)]
ASoC: Intel: catpt: Round of fixes and PM changes
Merge series from Cezary Rojewski <cezary.rojewski@intel.com>:
Set of changes addressing gaps in DRAM offset checks, error paths and
PM.
The first three patches are straight-forward, the last three relate to
the power management. The standing out PM change is removal of the
catpt-driver as a system-suspend (S3) blocker. This is a suggestion from
Andy as indeed, audio is not a critical component that should prevent
the system from going into S3. Whatever happens, the driver can recover
on a follow up resume (S3 -> S0).
Mark Brown [Thu, 27 Nov 2025 21:50:42 +0000 (21:50 +0000)]
Add support for cs42l45 into the Intel machine driver
Merge series from Charles Keepax <ckeepax@opensource.cirrus.com>:
Now that the full class driver is in place we can add support to the
Intel machine driver for Cirrus's new SDCA audio CODEC the cs42l45. This
makes some minor tweaks to the machine driver itself to support SDCA
devices, and then adds the necessary tables etc. to define the device.
Note, this series shouldn't have any dependencies on the other series of
improvements to the class driver that is already on the list. So either
can be merged first.
Charles Keepax [Thu, 27 Nov 2025 16:34:25 +0000 (16:34 +0000)]
ASoC: sdw_utils: Add cs42l45 support functions
Add the helper functions into the machine driver for the cs42l45,
this will register a jack for jack detection and add things into
to the components string if they are needed.
Charles Keepax [Thu, 27 Nov 2025 16:34:24 +0000 (16:34 +0000)]
ASoC: intel: sof_sdw: Add ability to have auxiliary devices
Currently the sof_sdw machine driver assumes that all devices involved
in the sound card are connected through a DAI link. However for SDCA
devices we still want the HID (Human Interface Device, used for jack
buttons) to be part of the sound card, but it contains no DAI links.
Add support into the machine driver to specify a list of auxiliary
devices to merged into the card.
Charles Keepax [Thu, 27 Nov 2025 16:34:23 +0000 (16:34 +0000)]
ASoC: sdw_utils: Move codec_name to dai info
As SDCA devices will support each DAI link on a different child device,
move the codec name from codec_info to each dai_info. To allow the
appropriate function device to be bound to each DAI link.
Charles Keepax [Thu, 27 Nov 2025 16:34:22 +0000 (16:34 +0000)]
ASoC: sdw_utils: Add codec_conf for every DAI
The assumption so far is that all the DAI links for a given audio part
would be on the same device. However, as SDCA implements each audio
function on a separate auxiliary driver this will no longer be true.
This means it is necessary to add additional codec_conf structures to
get the prefix for an audio part to apply to all the auxiliary drivers
that make up that part.
Charles Keepax [Thu, 27 Nov 2025 16:34:21 +0000 (16:34 +0000)]
ASoC: SDCA: Add terminal type into input/output widget name
There have been some complaints around the UCM files for SDCA
devices that the control system is quite hard to follow. This is
definitely true without the specification handy the naming can be
a little cryptic. However, as most of the information is parsed
from DisCo there are some limits to what the driver can safely do
to improve this.
However, one area that can be improved is the non-streaming
input/output terminals. These have a field (enum sdca_terminal_type)
that describes the usage of that terminal. These types can be
appended to the entity name to give the users a better clue as
to the purpose. For example "OT 43", would now become "OT 43
Headphone". This would follow through into the jack controls which
would change from "OT 43 Jack" to "OT 43 Headphone Jack", making the
purpose much more obvious to the user.
This provides slightly more readable controls without relying on
implicit knowledge that individual parts might not conform to.
Charles Keepax [Thu, 27 Nov 2025 16:34:20 +0000 (16:34 +0000)]
ASoC: SDCA: Align mute controls to ALSA expectations
Currently mute controls will be called "FU xx Mute Switch" (note
the switch is added programmatically outside the coverage of this
patch) and the accompanying volume control would be called "FU xx
Channel Volume". These names are taken from the SDCA specification,
however, this does not mesh well with the ALSA naming system. ALSA
generally expects enables rather than mutes and expects that mutes
and volumes have matching names.
Update the names and invert the mute controls to make them more
standard "FU XX Channel Switch", this does slightly deviate from
the SDCA specification but it makes the rest of the Linux ecosystem
a lot happier.
firmware: cs_dsp: Take pwr_lock around reading controls debugfs
In cs_dsp_debugfs_read_controls_show() take the pwr_lock mutex
around the list walk. This protects against debugfs returning
a partial set of new controls if those controls are being added
to the list while it is being walked.
Controls are never deleted from this list, and are only added to
the end of the list. So there was never a danger of following a
stale pointer to garbage.
The worst case was that the printed list is truncated if it saw an
entry that was the list end just before a new entry was appended to
the list.
With the original code, the truncated list from the debugfs could
show only _some_ of the new entries. This could be confusing because
it appears that some new entries are missing.
Adding the mutex means that the debugfs read provides an atomic view.
Either it shows the old content before any of the new controls were
added; or it shows the new content after all the new controls are
added.
Cezary Rojewski [Wed, 26 Nov 2025 09:55:23 +0000 (10:55 +0100)]
ASoC: Intel: catpt: Do not block the system from suspending
Even if something goes wrong when performing suspend on DSP, from the
system perspective the component is not critical enough to block the
suspend operation entirely. Leaving recovery to next resume() suffices.
Suggested-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com> Link: https://patch.msgid.link/20251126095523.3925364-7-cezary.rojewski@intel.com Signed-off-by: Mark Brown <broonie@kernel.org>
Cezary Rojewski [Wed, 26 Nov 2025 09:55:21 +0000 (10:55 +0100)]
ASoC: Intel: catpt: Fix probing order of driver components
catpt_dai_pcm_new() is called during the bring up sequence of the
machine board device which is a different device to the parent (DSP)
device yet utilizes pm_runtime_xxx() against it in order to send IPCs.
If the parent's pm_runtime is not configured before that happens,
errors will occur.
Cezary Rojewski [Wed, 26 Nov 2025 09:55:19 +0000 (10:55 +0100)]
ASoC: Intel: catpt: Switch to resource_xxx() API
There is a number of interfaces available for manipulating instances of
struct resource. To improve readability, move away from manual editing
in favor of the common interface.
While at it, adjust spacing so that both code blocks, while found in
separate functions, looks cohesive.
Suggested-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://patch.msgid.link/20251126095523.3925364-3-cezary.rojewski@intel.com Signed-off-by: Mark Brown <broonie@kernel.org>
Smatch complains that the call to snd_soc_component_get_drvdata(component)
will dereference "component" so this NULL check is too late. The probe()
function will never be called with a NULL component pointer so just
delete the check.
Now that cs_dsp uses regmap_raw_write() instead of regmap_raw_write_async()
it doesn't need to keep multiple DMA-safe buffers of every chunk of data
it wrote.
See commit fe08b7d5085a ("firmware: cs_dsp: Remove async regmap writes")
Only one write can be in progress at a time, so one DMA-safe buffer can be
re-used. The single DMA-safe buffer is reallocated if the next write chunk
is larger. Reallocation size is rounded up to reduce the amount of churn.
PAGE_SIZE is used as a convenient size multiple. Typically for .wmfw files
the first chunk is the largest.
A DMA-safe intermediate buffer is used because we can't assume that the
bus underlying regmap can accept non-DMA-safe buffers.
Note that a chunk from the firmware file cannot simply be split into
arbitrarily-sized chunks to avoid buffer reallocation. The data in the
firmware file is preformatted to be written directly to the device as one
block. It already takes account of alignment, write-bursts and write
length requirements of the target hardware, so that the cs_dsp driver can
treat it as an opaque blob.
Shengjiu Wang [Wed, 26 Nov 2025 06:45:09 +0000 (14:45 +0800)]
ASoC: fsl_xcvr: clear the channel status control memory
memset_io() writes memory byte by byte with __raw_writeb() on the arm
platform if the size is word. but XCVR data RAM memory can't be accessed
with byte address, so with memset_io() the channel status control memory
is not really cleared, use writel_relaxed() instead.
Jaroslav Kysela [Wed, 26 Nov 2025 09:16:34 +0000 (10:16 +0100)]
ASoC: nau8325: use simple i2c probe function
The i2c probe functions here don't use the id information provided in
their second argument, so the single-parameter i2c probe function
("probe_new") can be used instead.
This avoids scanning the identifier tables during probes.
Tasos Sahanidis [Wed, 26 Nov 2025 00:29:57 +0000 (02:29 +0200)]
ALSA: usb-audio: Implement jack detection for HP Thunderbolt Dock G2
The HP Thunderbolt Dock G2 includes a headset jack with support for
jack detection. However, this being a UAC1 device, detection is
implemented via vendor-defined URB Controls.
Implement it in a similar way to the Dell WD15/19 docks, but with
different commands.
Ilyas Gasanov [Tue, 25 Nov 2025 23:54:41 +0000 (03:54 +0400)]
ALSA: hda/realtek: Add quirk for HP ProBook 450 G8
My laptop, HP ProBook 450 G8 (32M40EA), has Realtek ALC236 codec on its
integrated sound card, and uses GPIO pins 0x2 and 0x1 for speaker mute
and mic mute LEDs correspondingly, as found out by me through hda-verb
invocations. This matches the GPIO masks used by the
alc236_fixup_hp_gpio_led() function.
PCI subsystem vendor and device IDs happen to be 0x103c and 0x8a75,
which has not been covered in the ALC2xx driver code yet.
Johan Hovold [Mon, 24 Nov 2025 10:49:07 +0000 (11:49 +0100)]
ASoC: stm32: sai: fix OF node leak on probe
The reference taken to the sync provider OF node when probing the
platform device is currently only dropped if the set_sync() callback
fails during DAI probe.
Make sure to drop the reference on platform probe failures (e.g. probe
deferral) and on driver unbind.
This also avoids a potential use-after-free in case the DAI is ever
reprobed without first rebinding the platform driver.
Dan Carpenter [Tue, 25 Nov 2025 13:55:28 +0000 (16:55 +0300)]
ASoC: SDCA: Fix NULL vs IS_ERR() bug in sdca_dev_register_functions()
The sdca_dev_register() function never returns NULL, it returns error
pointers on error. Fix the error checking to match.
Fixes: 4496d1c65bad ("ASoC: SDCA: add function devices") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com> Link: https://patch.msgid.link/aSW1UOgMCiQIaZG8@stanley.mountain Signed-off-by: Mark Brown <broonie@kernel.org>
ALSA: usb-audio: fix uac2 clock source at terminal parser
Since 8b3a087f7f65 ("ALSA: usb-audio: Unify virtual type units type to
UAC3 values") usb-audio is using UAC3_CLOCK_SOURCE instead of
bDescriptorSubtype, later refactored with e0ccdef9265 ("ALSA: usb-audio:
Clean up check_input_term()") into parse_term_uac2_clock_source().
This breaks the clock source selection for at least my
1397:0003 BEHRINGER International GmbH FCA610 Pro.
Fix by using UAC2_CLOCK_SOURCE in parse_term_uac2_clock_source().
Harin Lee [Mon, 24 Nov 2025 18:05:01 +0000 (03:05 +0900)]
ALSA: ctxfi: Add support for Onkyo SE-300PCIE (OK0010)
Add support for the Onkyo SE-300PCIE, a Creative X-Fi CA20K2-based
sound card with a custom hardware implementation that differs
significantly from other CA20K2-based variants.
Changes:
- PCI quirk entry for OK0010
- Port 0x3 is utilized for dedicated RCA output (configured as I2S)
- Modified GPIO pin mappings and states
- 4-channel simultaneous ADC input support for line and microphone
capture without input switching (similar to SB1270)
- Simplified ADC initialization (no manual setup required)
Harin Lee [Mon, 24 Nov 2025 18:05:00 +0000 (03:05 +0900)]
ALSA: ctxfi: Add support for dedicated RCA switching
Add feature to support switching between the dedicated RCA output and
the 7.1ch Front output. This is required for hardware that utilizes
separate DAC circuits for RCA and 7.1ch channels.
Changes:
- Add dedicated_rca capability flag
- Add "Analog Playback Route" mixer control
- Implement logic to swap DAO inputs between RCA and Front ports
Harin Lee [Mon, 24 Nov 2025 18:04:59 +0000 (03:04 +0900)]
ALSA: ctxfi: Refactor resource alloc for sparse mappings
Refactor atc_get_resources(), atc_connect_resources(), and
atc_release_resources() to allocate resources based on maximum type
definitions.
This allows specific resources to be conditionally skipped based on
capabilities. This is necessary for hardware variants where resource
allocations do not follow a sequential order.
Harin Lee [Mon, 24 Nov 2025 18:04:58 +0000 (03:04 +0900)]
ALSA: ctxfi: Use explicit output flag for DAIO resources
Replace the index-based type check with an explicit output flag in
struct daio and struct daio_desc.
This allows handling DAIO resource types correctly regardless of their
index. This is necessary for hardware variants where resource types do
not follow a sequential order.
Harin Lee [Mon, 24 Nov 2025 18:04:57 +0000 (03:04 +0900)]
ALSA: ctxfi: Add ADC helper functions for GPIO
Add helper functions hw_adc_stop(), hw_adc_start(), and hw_adc_reset()
to encapsulate ADC reset sequence operations. These functions reduce
duplication by centralizing the GPIO-based ADC control logic.
Harin Lee [Mon, 24 Nov 2025 18:04:56 +0000 (03:04 +0900)]
ALSA: ctxfi: Add hw parameter to daio_mgr_dao_init()
Add a hw parameter to the daio_mgr_dao_init() function to provide
access to model-specific information. This is necessary for proper
configuration of S/PDIF and I2S output ports on different hardware
variants.
Dylan Robinson [Mon, 24 Nov 2025 21:05:18 +0000 (16:05 -0500)]
ALSA: usb-audio: Fix max bytes-per-interval calculation
The maxpacksize field in struct audioformat represents the maximum number
of bytes per isochronous interval. The current implementation only
special-cases high-speed endpoints and does not account for the different
computations required for SuperSpeed, SuperSpeedPlus, or eUSB2. As a
result, USB audio class devices operating at these speeds may fail to
stream correctly. The issue was observed on a MOTU 16A (2025) interface,
which requires more than 1024 bytes per interval at SuperSpeed.
This patch replaces the existing logic with a helper that computes the
correct maximum bytes-per-interval for all USB speeds, borrowing the logic
used in drivers/usb/core/urb.c.
ASoC: cs-amp-lib: Remove redundant calls to kunit_deactivate_static_stub()
KUnit automatically deactivates stubs when a test case exits, so there
is no need to explicitly call kunit_deactivate_static_stub() in every
test function.
The architectures supported by this driver have a maximum of 32-bits
of address, so we don't need more than 32-bits to store the length of
control data. Change the length in struct cs_dsp_coeff_ctl to an
unsigned int instead of a size_t. Also make a corresponding trivial
change to wm_adsp.c to prevent a compiler warning.
Tested on x86_64 builds this saves at least 4 bytes per control
(another 4 bytes might be saved if the compiler was inserting padding
to align the size_t).
Baojun Xu [Mon, 24 Nov 2025 03:15:42 +0000 (11:15 +0800)]
ASoC: tas2781: Correct the wrong chip ID for reset variable check
The new variable of reset was added for TAS58XX on TAS5825 first.
And TAS5802/5815... was added later, so this reset variable check
should be changed to lowest chip of TAS58XX.
Fixes: 53a3c6e22283 ("ASoC: tas2781: Support more newly-released amplifiers tas58xx in the driver") Signed-off-by: Baojun Xu <baojun.xu@ti.com> Link: https://patch.msgid.link/20251124031542.2793-1-baojun.xu@ti.com Signed-off-by: Mark Brown <broonie@kernel.org>
Linus Torvalds [Sun, 23 Nov 2025 20:03:28 +0000 (12:03 -0800)]
Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux
Pull clk fixes from Stephen Boyd:
"Fixes for the Allwinner A523 clk driver:
- Lower the minimum rate for the A523 audio PLL to support
frequencies required by audio devices
- Mark a couple clks critical on A523 so that Linux doesn't turn them
off when they're used by other code like TF-A"
* tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:
clk: sunxi-ng: sun55i-a523-ccu: Lower audio0 pll minimum rate
clk: sunxi-ng: sun55i-a523-r-ccu: Mark bus-r-dma as critical
clk: sunxi-ng: Mark A523 bus-r-cpucfg clock as critical
Linus Torvalds [Sun, 23 Nov 2025 16:23:30 +0000 (08:23 -0800)]
Merge tag 'timers-urgent-2025-11-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull timer fixes from Ingo Molnar:
- Fix a race in timer->function clearing in timer_shutdown_sync()
- Fix a timekeeper sysfs-setup resource leak in error paths
- Fix the NOHZ report_idle_softirq() syslog rate-limiting
logic to have no side effects on the return value
* tag 'timers-urgent-2025-11-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
timers: Fix NULL function pointer race in timer_shutdown_sync()
timekeeping: Fix resource leak in tk_aux_sysfs_init() error paths
tick/sched: Fix bogus condition in report_idle_softirq()
Yipeng Zou [Sat, 22 Nov 2025 09:39:42 +0000 (09:39 +0000)]
timers: Fix NULL function pointer race in timer_shutdown_sync()
There is a race condition between timer_shutdown_sync() and timer
expiration that can lead to hitting a WARN_ON in expire_timers().
The issue occurs when timer_shutdown_sync() clears the timer function
to NULL while the timer is still running on another CPU. The race
scenario looks like this:
CPU0 CPU1
<SOFTIRQ>
lock_timer_base()
expire_timers()
base->running_timer = timer;
unlock_timer_base()
[call_timer_fn enter]
mod_timer()
...
timer_shutdown_sync()
lock_timer_base()
// For now, will not detach the timer but only clear its function to NULL
if (base->running_timer != timer)
ret = detach_if_pending(timer, base, true);
if (shutdown)
timer->function = NULL;
unlock_timer_base()
[call_timer_fn exit]
lock_timer_base()
base->running_timer = NULL;
unlock_timer_base()
...
// Now timer is pending while its function set to NULL.
// next timer trigger
<SOFTIRQ>
expire_timers()
WARN_ON_ONCE(!fn) // hit
...
lock_timer_base()
// Now timer will detach
if (base->running_timer != timer)
ret = detach_if_pending(timer, base, true);
if (shutdown)
timer->function = NULL;
unlock_timer_base()
The problem is that timer_shutdown_sync() clears the timer function
regardless of whether the timer is currently running. This can leave a
pending timer with a NULL function pointer, which triggers the
WARN_ON_ONCE(!fn) check in expire_timers().
Fix this by only clearing the timer function when actually detaching the
timer. If the timer is running, leave the function pointer intact, which is
safe because the timer will be properly detached when it finishes running.
Fixes: 0cc04e80458a ("timers: Add shutdown mechanism to the internal functions") Signed-off-by: Yipeng Zou <zouyipeng@huawei.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251122093942.301559-1-zouyipeng@huawei.com
Linus Torvalds [Sat, 22 Nov 2025 19:53:53 +0000 (11:53 -0800)]
Merge tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux
Pull crypto library fix from Eric Biggers:
"Fix another KMSAN warning that made it in while KMSAN wasn't working
reliably"
* tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux:
lib/crypto: tests: Fix KMSAN warning in test_sha256_finup_2x()
Linus Torvalds [Sat, 22 Nov 2025 18:16:21 +0000 (10:16 -0800)]
Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
Pull SCSI fixes from James Bottomley:
"One target driver fix and one scsi-generic one. The latter is 10 lines
because the problem lock has to be dropped and re-taken around the
call causing the sleep in atomic"
* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
scsi: sg: Do not sleep in atomic context
scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show()
Linus Torvalds [Sat, 22 Nov 2025 17:58:41 +0000 (09:58 -0800)]
Merge tag 'input-for-v6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
Pull input fixes from Dmitry Torokhov:
- INPUT_PROP_HAPTIC_TOUCHPAD definition added early in 6.18 cycle has
been renamed to INPUT_PROP_PRESSUREPAD to better reflect the kind of
devices it is supposed to be set for
- a new ID for a touchscreen found in Ayaneo Flip DS in Goodix driver
- Goodix driver no longer tries to set reset pin as "input" as it
causes issues when there is no pull up resistor installed on the
board
- fixes for cros_ec_keyb, imx_sc_key, and pegasus-notetaker drivers to
deal with potential out-of-bounds access and memory corruption issues
* tag 'input-for-v6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
Input: rename INPUT_PROP_HAPTIC_TOUCHPAD to INPUT_PROP_PRESSUREPAD
Input: cros_ec_keyb - fix an invalid memory access
Input: imx_sc_key - fix memory corruption on unload
Input: pegasus-notetaker - fix potential out-of-bounds access
Input: goodix - remove setting of RST pin to input
Input: goodix - add support for ACPI ID GDIX1003
Linus Torvalds [Sat, 22 Nov 2025 17:44:50 +0000 (09:44 -0800)]
Merge tag 'riscv-for-linus-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux
Pull RISC-V fixes from Paul Walmsley:
- Correct the MIPS RISC-V/JEDEC vendor ID
- Fix the system shutdown behavior in the legacy case where
CONFIG_RISCV_SBI_V01 is set, but the firmware implementation
doesn't support the older v0.1 system shutdown method
- Align some tools/ macro definitions with the corresponding
kernel headers
* tag 'riscv-for-linus-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
tools: riscv: Fixed misalignment of CSR related definitions
riscv: sbi: Prefer SRST shutdown over legacy
riscv: Update MIPS vendor id to 0x127
Linus Torvalds [Sat, 22 Nov 2025 17:24:36 +0000 (09:24 -0800)]
Merge tag 'selinux-pr-20251121' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux
Pull selinux fixes from Paul Moore:
"Three SELinux patches for v6.18 to fix issues around accessing the
per-task decision cache that we introduced in v6.16 to help reduce
SELinux overhead on path walks. The problem was that despite the cache
being located in the SELinux "task_security_struct", the parent struct
wasn't actually tied to the task, it was tied to a cred.
Historically SELinux did locate the task_security_struct in the
task_struct's security blob, but it was later relocated to the cred
struct when the cred work happened, as it made the most sense at the
time.
Unfortunately we never did the task_security_struct to
cred_security_struct rename work (avoid code churn maybe? who knows)
because it didn't really matter at the time. However, it suddenly
became a problem when we added a per-task cache to a per-cred object
and didn't notice because of the old, no-longer-correct struct naming.
Thanks to KCSAN for flagging this, as the silly humans running things
forgot that the task_security_struct was a big lie.
This contains three patches, only one of which actually fixes the
problem described above and moves the SELinux decision cache from the
per-cred struct to a newly (re)created per-task struct.
The other two patches, which form the bulk of the diffstat, take care
of the associated renaming tasks so we can hopefully avoid making the
same stupid mistake in the future.
For the record, I did contemplate sending just a fix for the cache,
leaving the renaming patches for the upcoming merge window, but the
type/variable naming ended up being pretty awful and would have made
v6.18 an outlier stuck between the "old" names and the "new" names in
v6.19. The renaming patches are also fairly mechanical/trivial and
shouldn't pose much risk despite their size.
TLDR; naming things may be hard, but if you mess it up bad things
happen"
* tag 'selinux-pr-20251121' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:
selinux: rename the cred_security_struct variables to "crsec"
selinux: move avdcache to per-task security struct
selinux: rename task_security_struct to cred_security_struct
Mark Brown [Fri, 21 Nov 2025 21:28:19 +0000 (21:28 +0000)]
ASoC: cs35l56: Set access permissions on volatile
Merge series from Richard Fitzgerald <rf@opensource.cirrus.com>:
The CAL_SET_STATUS and CAL_DATA_RB controls are volatile and read-only, but
the existing ASoC macros to define controls don't allow setting access
permissions, so those controls were marked as non-volatile read/write.
These four patches fix that.
The first two patches add two new control macros to soc.h. I really don't
like codec drivers open-coding a kcontrol_new content for a control that
will be managed by the ASoC info/get/put handlers. If a new type of ASoC
control definition is needed it's better to have it in soc.h so all the
dependencies between ASoC and the kcontrol_new content are in one place.
Mark Brown [Fri, 21 Nov 2025 21:28:15 +0000 (21:28 +0000)]
Add SDCA class driver
Merge series from Charles Keepax <ckeepax@opensource.cirrus.com>:
This series adds an initial SDCA class driver, this consists of a
primary driver attached to the SoundWire device, and auxiliary drivers
representing each of the functions of the SDCA device. These drivers all
use the APIs added over the past series's to provide the class
functionality, as such these final drivers themselves are quite thin.
Also a few fix ups at the start of the series that have gathered up
whilst the last SDCA series was in review.
Linus Torvalds [Fri, 21 Nov 2025 19:16:14 +0000 (11:16 -0800)]
Merge tag 'loongarch-fixes-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson
Pull LoongArch fixes from Huacai Chen:
"Use UAPI types in ptrace UAPI header to fix nolibc ptrace.
Fix CPU name display, NUMA node parsing, kexec/kdump, PCI init and BPF
trampoline"
* tag 'loongarch-fixes-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson:
LoongArch: BPF: Disable trampoline for kernel module function trace
LoongArch: Don't panic if no valid cache info for PCI
LoongArch: Mask all interrupts during kexec/kdump
LoongArch: Fix NUMA node parsing with numa_memblks
LoongArch: Consolidate CPU names in /proc/cpuinfo
LoongArch: Use UAPI types in ptrace UAPI header
Linus Torvalds [Fri, 21 Nov 2025 19:14:21 +0000 (11:14 -0800)]
Merge tag 'v6.18-rc6-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6
Pull smb client fixes from Steve French:
- Fix potential memory leak in mount
- Add some missing read tracepoints
- Fix locking issue with directory leases
* tag 'v6.18-rc6-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6:
cifs: Add the smb3_read_* tracepoints to SMB1
cifs: fix memory leak in smb3_fs_context_parse_param error path
smb: client: introduce close_cached_dir_locked()
Linus Torvalds [Fri, 21 Nov 2025 19:09:57 +0000 (11:09 -0800)]
Merge tag 'io_uring-6.18-20251120' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull io_uring fix from Jens Axboe:
"Just a single fix for a mixup of arguments for the skb_queue_splice()
call, in the io_uring timestamp retrieval code"
* tag 'io_uring-6.18-20251120' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
io_uring/cmd_net: fix wrong argument types for skb_queue_splice()
Linus Torvalds [Fri, 21 Nov 2025 18:59:35 +0000 (10:59 -0800)]
Merge tag 'block-6.18-20251120' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull block fixes from Jens Axboe:
"NVMe pull request via Keith:
- Admin queue use-after-free fix (Keith)
- Target authentication fix (Alistar)
- Multipath lockdeup fix (Shin'ichiro)
- FC transport teardown fixes (Ewan)"
* tag 'block-6.18-20251120' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()
nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl()
nvme-multipath: fix lockdep WARN due to partition scan work
nvmet-auth: update sc_c in target host hash calculation
nvme: fix admin request_queue lifetime
Linus Torvalds [Fri, 21 Nov 2025 18:53:23 +0000 (10:53 -0800)]
Merge tag 'ata-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux
Pull ata fixes from Niklas Cassel:
- Add a missing refcount decrement in ata_scsi_dev_rescan() when
the device or its queue is not running.
In the case where the device is running, the recount is already
decremented properly (Yihang Li)
- Generate the proper sense code for a Security locked device.
There was a regression caused by a recent change of how sense
data is generated for commands that did not provide any sense
data. This broke system suspend for Security locked devices.
Generate the sense data that the SCSI disk driver expects for a
Security locked device so that system suspend works again (me)
- Set capacity to zero for a Security locked device.
All I/O commands will be aborted by a Security locked device.
Thus, the block layer disk partition scanning will result in
a bunch of, for the user, confusing I/O errors in dmesg during
boot.
Since a Security locked device is unusable anyway, set the capacity
to zero, to avoid the disk partition scanning during boot. We still
create the block device in /dev such that the user may unlock the
device using e.g. hdparm (me)
* tag 'ata-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:
ata: libata-core: Set capacity to zero for a security locked drive
ata: libata-scsi: Fix system suspend for a security locked drive
ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan()
Linus Torvalds [Fri, 21 Nov 2025 18:47:24 +0000 (10:47 -0800)]
Merge tag 'pinctrl-v6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl
Pull pin control fixes from Linus Walleij:
- Fix register naming in the Mediatek mt8189 driver
- Select REGMAP_MMIO for the Realtek RTD driver
- Fix the number of items in groups in the Toshiba Visconti driver
- Fix a memory leak in the Cirrus CS42L43 driver
- Fix a deadlock (!) in Qualcomm pinmux configuration
- Fix use of uninitialized memory and list initialization in the S32CC
pin controller
* tag 'pinctrl-v6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
dt-bindings: pinctrl: xlnx,versal-pinctrl: Add missing unevaluatedProperties on '^conf' nodes
pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc()
pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc
pinctrl: qcom: msm: Fix deadlock in pinmux configuration
pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe()
dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups
pinctrl: realtek: Select REGMAP_MMIO for RTD driver
pinctrl: mediatek: mt8189: align register base names to dt-bindings ones
pinctrl: mediatek: mt8196: align register base names to dt-bindings ones
projects / thirdparty / kernel / linux.git / log
