Akshay Jindal [Sun, 12 Oct 2025 18:06:10 +0000 (23:36 +0530)]
iio: accel: bma400: Use index-based register addressing and lookup
Introduce formula-based macros to compute GEN INTR configuration register
addresses from the interrupt number and register index. This reduces the
need for 22 explicit register macros to three base definitions.
Add a centralized lookup table keyed by IIO event direction and replace
get_gen_config_reg() with a helper integrated with this table.
Apply these changes across the affected callbacks to ensure consistent
access to generic interrupt registers.
No functional changes are intended.
Signed-off-by: Akshay Jindal <akshayaj.lkd@gmail.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Akshay Jindal [Sun, 12 Oct 2025 18:06:09 +0000 (23:36 +0530)]
iio: accel: bma400: Use macros for generic event configuration values
Add macros and enums for configuration values used in generic event
handling for activity and inactivity detection. Replace hard-coded
values in activity_event_en() with the new definitions to make the
configuration explicit.
No functional changes are intended.
Signed-off-by: Akshay Jindal <akshayaj.lkd@gmail.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Akshay Jindal [Sun, 12 Oct 2025 18:06:08 +0000 (23:36 +0530)]
iio: accel: bma400: Reorganize and rename register and field macros
Reorganize register and field macros to improve consistency with the
datasheet and naming style:
- Move field macros next to their corresponding register macros
- Reorder register macros to follow address order from the datasheet
- Rename field macros to include the register name in the macro name
- Add a _REG suffix to register macros where missing
- Add INT_STAT register fields corresponding to used INT_CONFIG fields
No functional changes are intended.
Signed-off-by: Akshay Jindal <akshayaj.lkd@gmail.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Shrikant Raskar [Sun, 12 Oct 2025 17:30:35 +0000 (23:00 +0530)]
iio: health: max30100: Make LED pulse-width configurable via DT
The required LED pulse width depends on board-specific optical and
mechanical design, which affects measurement accuracy and power use.
Making it configurable via Device Tree allows each platform to define
an appropriate value instead of relying on a hardcoded default.
If unspecified, the driver defaults to 1600 us for backward compatibility.
Tested on: Raspberry Pi 3B + MAX30100 breakout board.
Reviewed-by: Nuno Sa <nuno.sa@analog.com> Signed-off-by: Shrikant Raskar <raskar.shree97@gmail.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Shrikant Raskar [Sun, 12 Oct 2025 17:30:34 +0000 (23:00 +0530)]
dt-bindings: iio: health: max30100: Add LED pulse-width property
The LED pulse width on the MAX30100 sensor determines how long the
IR/Red LEDs are driven during each sample, directly affecting the
emitted optical energy and hence the received signal amplitude.
This parameter is highly dependent on the mechanical and optical
integration of the sensor, such as:
- The type and thickness of the optical window or lens covering
the sensor.
- The distance between the LED and photodiode.
- The reflectivity of the target surface.
For example:
- A smartwatch or wearable ring with a thin glass window can operate
with shorter pulses (200-400 us) to save power.
- A medical-grade pulse oximeter or sensor mounted behind a thicker
protective layer may require longer pulses (800-1600 us) for
reliable signal amplitude.
Because this configuration is determined by hardware design rather than
by runtime conditions, it is appropriate to describe it in the DT.
If not specified, the driver defaults to 1600 us to maintain
existing behavior.
Tested on: Raspberry Pi 3B + MAX30100 breakout board.
Signed-off-by: Shrikant Raskar <raskar.shree97@gmail.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Wolfram Sang [Sat, 11 Oct 2025 20:59:09 +0000 (22:59 +0200)]
dt-bindings: iio: accel: adxl345: document second interrupt
The pinout of all the supported chips in this binding have two interrupt
pins. Document the second one, too, even though the Linux driver
currently does not support the second interrupt. Boards may have it
wired nonetheless. While here, drop the dependency of interrupt-names
which is already described in the core.
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Acked-by: Conor Dooley <conor.dooley@microchip.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Dixit Parmar [Sat, 11 Oct 2025 08:11:49 +0000 (13:41 +0530)]
iio: adc: ti-ads131e08: return correct error code
The error code returned from devm_iio_trigger_register() inturn
iio_trigger_register() can be other than -ENOMEM. Hence return the
same value as it was returned from the function call.
This change makes devm_iio_trigger_register() handling uniform with
other iio drivers.
Signed-off-by: Dixit Parmar <dixitparmar19@gmail.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Antoniu Miclaus [Tue, 7 Oct 2025 11:15:25 +0000 (11:15 +0000)]
iio: adc: ad4080: add support for AD4081
Add support for AD4081 20-bit SAR ADC. The AD4081 has the same
resolution as AD4080 (20-bit) but differs in LVDS CNV clock count
maximum (2 vs 7).
Changes:
- Add AD4081_CHIP_ID definition (0x0051)
- Create ad4081_channel with 20-bit resolution and 32-bit storage
- Add ad4081_chip_info with lvds_cnv_clk_cnt_max = 2
- Register AD4081 in device ID and OF match tables
Reviewed-by: Nuno Sá <nuno.sa@analog.com> Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Antoniu Miclaus [Tue, 7 Oct 2025 11:15:24 +0000 (11:15 +0000)]
dt-bindings: iio: adc: adi,ad4080: add support for AD4081
Add device tree binding support for the AD4081 20-bit SAR ADC.
Add adi,ad4081 to the compatible enum.
A fallback compatible string to adi,ad4080 is not appropriate as the
AD4081 has a different LVDS CNV clock count maximum (2 vs 7), requiring
different driver configuration.
Antoniu Miclaus [Tue, 7 Oct 2025 11:15:23 +0000 (11:15 +0000)]
iio: adc: ad4080: add support for AD4084
Add support for AD4084 16-bit SAR ADC. The AD4084 differs from
AD4080 in resolution (16-bit vs 20-bit) and LVDS CNV clock count
maximum (2 vs 7).
Changes:
- Add AD4084_CHIP_ID definition (0x0054)
- Create ad4084_channel with 16-bit resolution and storage
- Add ad4084_chip_info with appropriate configuration
- Register AD4084 in device ID and OF match tables
Reviewed-by: Nuno Sá <nuno.sa@analog.com> Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Antoniu Miclaus [Tue, 7 Oct 2025 11:15:22 +0000 (11:15 +0000)]
dt-bindings: iio: adc: adi,ad4080: add support for AD4084
Add device tree binding support for the AD4084 16-bit SAR ADC.
Add adi,ad4084 to the compatible enum.
A fallback compatible string to adi,ad4080 is not appropriate as the
AD4084 has different resolution (16-bit vs 20-bit) and LVDS CNV clock
count maximum (2 vs 7), requiring different driver configuration.
Antoniu Miclaus [Tue, 7 Oct 2025 11:15:21 +0000 (11:15 +0000)]
iio: adc: ad4080: prepare driver for multi-part support
Refactor the ad4080 driver to support multiple ADC variants with
different resolution bits and LVDS CNV clock count maximums.
Changes:
- Add lvds_cnv_clk_cnt_max field to chip_info structure
- Create AD4080_CHANNEL_DEFINE macro for variable resolution/storage bits
- Make LVDS CNV clock count configurable per chip variant
- Use chip_info->product_id for chip identification comparison
This prepares the infrastructure for adding support for additional
ADC parts with different specifications while maintaining backward
compatibility with existing AD4080 functionality.
Reviewed-by: Nuno Sá <nuno.sa@analog.com> Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Antoniu Miclaus [Tue, 7 Oct 2025 11:15:20 +0000 (11:15 +0000)]
iio: adc: ad4080: fix chip identification
Fix AD4080 chip identification by using the correct 16-bit product ID
(0x0050) instead of GENMASK(2, 0). Update the chip reading logic to
use regmap_bulk_read to read both PRODUCT_ID_L and PRODUCT_ID_H
registers and combine them into a 16-bit value.
The original implementation was incorrectly reading only 3 bits,
which would not correctly identify the AD4080 chip.
Add IIO device for accelerometer sensor
with data polling interface and FIFO parsing.
Attributes: raw, scale, sampling_frequency, calibbias.
Temperature is available as a processed channel.
Signed-off-by: Remi Buisson <remi.buisson@tdk.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Add IIO device for gyroscope sensor
with data polling interface and FIFO parsing.
Attributes: raw, scale, sampling_frequency, calibbias.
Temperature is available as a processed channel.
Signed-off-by: Remi Buisson <remi.buisson@tdk.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Remi Buisson [Tue, 7 Oct 2025 07:20:03 +0000 (07:20 +0000)]
iio: imu: inv_icm45600: add new inv_icm45600 driver
Core component of a new driver for InvenSense ICM-45600 devices.
It includes registers definition, main probe/setup, and device
utility functions.
ICM-456xx devices are latest generation of 6-axis IMU,
gyroscope+accelerometer and temperature sensor. This device
includes a 8K FIFO, supports I2C/I3C/SPI, and provides
intelligent motion features like pedometer, tilt detection,
and tap detection.
Signed-off-by: Remi Buisson <remi.buisson@tdk.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Remi Buisson [Tue, 7 Oct 2025 07:20:02 +0000 (07:20 +0000)]
dt-bindings: iio: imu: Add inv_icm45600
Document the ICM-45600 devices devicetree bindings.
Specific variants of the device are defined because of their
differences in terms of FSR or advanced features like eDMP.
The DPS310 is a barometric pressure and temperature sensor with
an I2C interface. Remove it from trivial-devices.yaml and add its
own documentation to allow for consumers of this device such as
the iio/hwmon bridge.
Signed-off-by: Eddie James <eajames@linux.ibm.com> Reviewed-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Petre Rodan [Sun, 5 Oct 2025 13:12:24 +0000 (16:12 +0300)]
iio: accel: bma220: add i2c watchdog feature
Sometimes the sensor gets stuck and enters a condition in which it pulls
SDA low, thus making the entire i2c bus unusable.
This problem is mitigated by activating a 1ms watchdog implemented in
the sensor.
Signed-off-by: Petre Rodan <petre.rodan@subdimension.ro> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Petre Rodan [Sun, 5 Oct 2025 13:12:16 +0000 (16:12 +0300)]
iio: accel: bma220: split original driver
In preparation for the i2c module, move the original code into multiple
source files without any other functional change.
Create the additional bma220_core module which currently is not
providing an abstracted bus type (this will change with the regmap
patch).
Fix a few includes in the context of this patch.
Signed-off-by: Petre Rodan <petre.rodan@subdimension.ro> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Cosmin Tanislav [Sun, 5 Oct 2025 11:13:18 +0000 (14:13 +0300)]
iio: adc: add RZ/T2H / RZ/N2H ADC driver
Add support for the A/D 12-Bit successive approximation converters found
in the Renesas RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs.
RZ/T2H has two ADCs with 4 channels and one with 6.
RZ/N2H has two ADCs with 4 channels and one with 15.
Conversions can be performed in single or continuous mode. Result of the
conversion is stored in a 16-bit data register corresponding to each
channel.
The conversions can be started by a software trigger, a synchronous
trigger (from MTU or from ELC) or an asynchronous external trigger (from
ADTRGn# pin).
Only single mode with software trigger is supported for now.
Signed-off-by: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com> Reviewed-by: Nuno Sá <nuno.sa@analog.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Nuno Sá [Tue, 30 Sep 2025 15:33:12 +0000 (16:33 +0100)]
iio: adc: mcp3564: replace sprintf() with sysfs_emit()
Update the mcp3564_read_label() function to use sysfs_emit() for
generating labels.
Signed-off-by: Nuno Sá <nuno.sa@analog.com> Reviewed-by: Marius Cristea <marius.cristea@microchip.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
When the device is in ACTIVE mode the temperature and pressure measurements
are collected with a frequency determined by the ST[3:0] bits of CTRL_REG2
register.
Reviewed-by: Nuno Sá <nuno.sa@analog.com> Signed-off-by: Antoni Pokusinski <apokusinski01@gmail.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
dt-bindings: iio: pressure: add binding for mpl3115
MPL3115 is an I2C pressure and temperature sensor. It features 2
interrupt lines which can be configured to indicate events such as data
ready or pressure/temperature threshold reached.
Reviewed-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Antoni Pokusinski <apokusinski01@gmail.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Change the allocation strategy of the 8 SETUP registers from a least-
recently-used (LRU) to a first-come-first-served basis.
The AD7124 chips can have up to 16 channels enabled at a time in the
sequencer for buffered reads, but only have 8 SETUP configurations
(namely the OFFSET, GAIN, CONFIG and FILTER registers) that must be
shared among the 16 channels. This means some of the channels must use
the exact same configuration parameters so that they can share a single
SETUP group of registers. The previous LRU strategy did not keep track
of how many different configurations were requested at the same time,
so if there were more than 8 different configurations requested, some
channels would end up using the incorrect configuration because the slot
assigned to them would also be assigned to a different configuration
that wrote over it later.
Adding such tracking to solve this would make an already complex
algorithm even more complex. Instead we can replace it with a simpler
first-come-first-serve strategy. This makes it easy to track how many
different configurations are being requested at the same time. This
comes at the expense of slightly longer setup times for buffered reads
since all setup registers must be written each time when a buffered read
is enabled. But this is generally not considered a hot path where
performance is critical, so should be acceptable.
This new strategy also makes hardware debugging easier since SETUPs are
now assigned in a deterministic manner and in a logical order.
Signed-off-by: David Lechner <dlechner@baylibre.com> Reviewed-by: Nuno Sá <nuno.sa@analog.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
David Lechner [Tue, 23 Sep 2025 20:33:18 +0000 (15:33 -0500)]
iio: adc: ad7124: add ext attributes to temperature channel
Use the same .ext_info for the temperature channel as for the voltage
channels. In the ADC, these all go though a mux to select the source
and otherwise operate the same.
These attributes probably won't be used much, but since it is trivial
to add this, we might as well include them.
Signed-off-by: David Lechner <dlechner@baylibre.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Cross-references to iio_tools.rst (IIO Interfacing Tools) and
iio_devbuf.rst (Industrial IIO device buffers) are shown in inline
code instead. Convert them to proper cross-references.
Signed-off-by: Bagas Sanjaya <bagasdotme@gmail.com> Reviewed-by: Randy Dunlap <rdunlap@infradead.org> Tested-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Add ABI documentation for accelerometer event-related sysfs attributes
exposed by the bmi270 driver. These include threshold, period, and
enable controls for adaptive magnitude (any-motion) and rate of change
(no-motion) event detection.
Signed-off-by: Gustavo Silva <gustavograzs@gmail.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Any-motion event can be enabled on a per-axis basis and triggers a
combined event when motion is detected on any axis.
No-motion event is triggered if the rate of change on all axes falls
below a specified threshold for a configurable duration. A fake channel
is used to report this event.
Threshold and duration can be configured from userspace.
Signed-off-by: Gustavo Silva <gustavograzs@gmail.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
David Lechner [Tue, 16 Sep 2025 21:02:57 +0000 (16:02 -0500)]
iio: buffer: document that buffer callback must be context safe
Document that the callback registered with iio_channel_get_all_cb()
must be safe to call from any context since it is called from by
iio_push_to_buffer() which can be called in any context.
Signed-off-by: David Lechner <dlechner@baylibre.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
David Lechner [Tue, 16 Sep 2025 21:02:56 +0000 (16:02 -0500)]
iio: buffer: document store_to() callback may be called in any context
Document that the struct iio_buffer_access_funcs.store_to() callback
must be safe to call from any context since it is called from
iio_push_to_buffer() which may be called from any context.
Signed-off-by: David Lechner <dlechner@baylibre.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Call might_sleep() in iio_push_to_buffers_with_ts_unaligned() since it
can allocate memory, which may sleep.
Suggested-by: Andy Shevchenko <andy.shevchenko@gmail.com> Signed-off-by: David Lechner <dlechner@baylibre.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
David Lechner [Tue, 16 Sep 2025 21:02:51 +0000 (16:02 -0500)]
iio: buffer: document iio_push_to_buffers_with_ts_unaligned() may sleep
Add Context: documentation comment that
iio_push_to_buffers_with_ts_unaligned() may sleep because it calls
devm_krealloc().
Also document Return: value while here.
Suggested-by: Andy Shevchenko <andy.shevchenko@gmail.com> Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com> Signed-off-by: David Lechner <dlechner@baylibre.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
David Lechner [Tue, 16 Sep 2025 21:39:39 +0000 (16:39 -0500)]
iio: adc: ad7124: remove __ad7124_set_channel()
Remove __ad7124_set_channel() wrapper function. This just added an
unnecessary layer of indirection with an extra call to container_of().
Signed-off-by: David Lechner <dlechner@baylibre.com> Reviewed-by: Nuno Sá <nuno.sa@analog.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
David Lechner [Wed, 17 Sep 2025 14:17:23 +0000 (09:17 -0500)]
iio: adc: ad7124: use AD7124_MAX_CHANNELS
Use AD7124_MAX_CHANNELS macro instead of hardcoding 16 in
ad7124_disable_all(). We already have the macro, so we should use it.
Signed-off-by: David Lechner <dlechner@baylibre.com> Reviewed-by: Nuno Sá <nuno.sa@analog.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
David Lechner [Wed, 17 Sep 2025 20:39:23 +0000 (15:39 -0500)]
iio: adc: ad7124: remove unused `nr` field
Remove the unused `nr` field from the `ad7124_channel` struct. There
are no more users of this field (it is only assigned to but never read)
so can be removed.
Signed-off-by: David Lechner <dlechner@baylibre.com> Reviewed-by: Nuno Sá <nuno.sa@analog.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
David Lechner [Wed, 17 Sep 2025 20:39:22 +0000 (15:39 -0500)]
iio: adc: ad7124: inline ad7124_enable_channel()
Inline ad7124_enable_channel() at the only call site. This simplifies
the code by avoiding a bit of extra indirection.
ch->nr is replaced by address as that is the same value and avoids more
indirection.
Signed-off-by: David Lechner <dlechner@baylibre.com> Reviewed-by: Nuno Sá <nuno.sa@analog.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
David Lechner [Wed, 17 Sep 2025 23:03:17 +0000 (18:03 -0500)]
iio: adc: ad7124: add debugfs to disable single cycle mode
Add a boolean debugfs attribute to allow disabling the SINGLE_CYCLE
bit in the FILTER registers.
This causes data to be read on every conversion instead of doing the
usual 3 or 4 conversions per sample (depending on the filter). This is
only needed for very specific use cases, such as validating the
performance of the ADC. So we just expose this feature through debugfs
for the rare cases where it is needed by people who really know what
they are doing.
Signed-off-by: David Lechner <dlechner@baylibre.com> Reviewed-by: Nuno Sá <nuno.sa@analog.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Linus Torvalds [Sun, 12 Oct 2025 20:27:56 +0000 (13:27 -0700)]
Merge tag 'i2c-for-6.18-rc1-hotfix' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux
Pull i2c fix from Wolfram Sang:
"One revert because of a regression in the I2C core which has sadly not
showed up during its time in -next"
* tag 'i2c-for-6.18-rc1-hotfix' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
Revert "i2c: boardinfo: Annotate code used in init phase only"
Linus Torvalds [Sun, 12 Oct 2025 15:45:52 +0000 (08:45 -0700)]
Merge tag 'irq_urgent_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull irq fixes from Borislav Petkov:
- Skip interrupt ID 0 in sifive-plic during suspend/resume because
ID 0 is reserved and accessing reserved register space could result
in undefined behavior
- Fix a function's retval check in aspeed-scu-ic
* tag 'irq_urgent_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume
irqchip/aspeed-scu-ic: Fix an IS_ERR() vs NULL check
Linus Torvalds [Sat, 11 Oct 2025 23:06:04 +0000 (16:06 -0700)]
Merge tag 'trace-v6.18-3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull tracing fixes from Steven Rostedt:
"The previous fix to trace_marker required updating trace_marker_raw as
well. The difference between trace_marker_raw from trace_marker is
that the raw version is for applications to write binary structures
directly into the ring buffer instead of writing ASCII strings. This
is for applications that will read the raw data from the ring buffer
and get the data structures directly. It's a bit quicker than using
the ASCII version.
Unfortunately, it appears that our test suite has several tests that
test writes to the trace_marker file, but lacks any tests to the
trace_marker_raw file (this needs to be remedied). Two issues came
about the update to the trace_marker_raw file that syzbot found:
- Fix tracing_mark_raw_write() to use per CPU buffer
The fix to use the per CPU buffer to copy from user space was
needed for both the trace_maker and trace_maker_raw file.
The fix for reading from user space into per CPU buffers properly
fixed the trace_marker write function, but the trace_marker_raw
file wasn't fixed properly. The user space data was correctly
written into the per CPU buffer, but the code that wrote into the
ring buffer still used the user space pointer and not the per CPU
buffer that had the user space data already written.
- Stop the fortify string warning from writing into trace_marker_raw
After converting the copy_from_user_nofault() into a memcpy(),
another issue appeared. As writes to the trace_marker_raw expects
binary data, the first entry is a 4 byte identifier. The entry
structure is defined as:
struct {
struct trace_entry ent;
int id;
char buf[];
};
The size of this structure is reserved on the ring buffer with:
size = sizeof(*entry) + cnt;
Then it is copied from the buffer into the ring buffer with:
memcpy(&entry->id, buf, cnt);
This use to be a copy_from_user_nofault(), but now converting it to
a memcpy() triggers the fortify-string code, and causes a warning.
The allocated space is actually more than what is copied, as the
cnt used also includes the entry->id portion. Allocating
sizeof(*entry) plus cnt is actually allocating 4 bytes more than
what is needed.
* tag 'trace-v6.18-3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
tracing: Stop fortify-string from warning in tracing_mark_raw_write()
tracing: Fix tracing_mark_raw_write() to use buf and not ubuf
Linus Torvalds [Sat, 11 Oct 2025 22:47:12 +0000 (15:47 -0700)]
Merge tag 'kbuild-fixes-6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux
Pull Kbuild fixes from Nathan Chancellor:
- Fix UAPI types check in headers_check.pl
- Only enable -Werror for hostprogs with CONFIG_WERROR / W=e
- Ignore fsync() error when output of gen_init_cpio is a pipe
- Several little build fixes for recent modules.builtin.modinfo series
* tag 'kbuild-fixes-6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux:
kbuild: Use '--strip-unneeded-symbol' for removing module device table symbols
s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections
kbuild: Add '.rel.*' strip pattern for vmlinux
kbuild: Restore pattern to avoid stripping .rela.dyn from vmlinux
gen_init_cpio: Ignore fsync() returning EINVAL on pipes
scripts/Makefile.extrawarn: Respect CONFIG_WERROR / W=e for hostprogs
kbuild: uapi: Strip comments before size type check
Reported-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Closes: https://lore.kernel.org/r/29ec0082-4dd4-4120-acd2-44b35b4b9487@oss.qualcomm.com Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Linus Torvalds [Sat, 11 Oct 2025 18:56:47 +0000 (11:56 -0700)]
Merge tag 'rtc-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux
Pull RTC updates from Alexandre Belloni:
"This cycle, we have a new RTC driver, for the SpacemiT P1. The optee
driver gets alarm support. We also get a fix for a race condition that
was fairly rare unless while stress testing the alarms.
Subsystem:
- Fix race when setting alarm
- Ensure alarm irq is enabled when UIE is enabled
- remove unneeded 'fast_io' parameter in regmap_config
New driver:
- SpacemiT P1 RTC
Drivers:
- efi: Remove wakeup functionality
- optee: add alarms support
- s3c: Drop support for S3C2410
- zynqmp: Restore alarm functionality after kexec transition"
* tag 'rtc-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: (29 commits)
rtc: interface: Ensure alarm irq is enabled when UIE is enabled
rtc: tps6586x: Fix initial enable_irq/disable_irq balance
rtc: cpcap: Fix initial enable_irq/disable_irq balance
rtc: isl12022: Fix initial enable_irq/disable_irq balance
rtc: interface: Fix long-standing race when setting alarm
rtc: pcf2127: fix watchdog interrupt mask on pcf2131
rtc: zynqmp: Restore alarm functionality after kexec transition
rtc: amlogic-a4: Optimize global variables
rtc: sd2405al: Add I2C address.
rtc: Kconfig: move symbols to proper section
rtc: optee: make optee_rtc_pm_ops static
rtc: optee: Fix error code in optee_rtc_read_alarm()
rtc: optee: fix error code in probe()
dt-bindings: rtc: Convert apm,xgene-rtc to DT schema
rtc: spacemit: support the SpacemiT P1 RTC
rtc: optee: add alarm related rtc ops to optee rtc driver
rtc: optee: remove unnecessary memory operations
rtc: optee: fix memory leak on driver removal
rtc: x1205: Fix Xicor X1205 vendor prefix
dt-bindings: rtc: Fix Xicor X1205 vendor prefix
...
Linus Torvalds [Sat, 11 Oct 2025 18:49:00 +0000 (11:49 -0700)]
Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
Pull SCSI fixes from James Bottomley:
"Fixes only in drivers (ufs, mvsas, qla2xxx, target) that came in just
before or during the merge window.
The most important one is the qla2xxx which reverts a conversion to
fix flexible array member warnings, that went up in this merge window
but which turned out on further testing to be causing data corruption"
* tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS
scsi: ufs: sysfs: Make HID attributes visible
scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
scsi: ufs: core: Fix PM QoS mutex initialization
scsi: ufs: core: Fix runtime suspend error deadlock
Revert "scsi: qla2xxx: Fix memcpy() field-spanning write issue"
scsi: target: target_core_configfs: Add length check to avoid buffer overflow
Linus Torvalds [Sat, 11 Oct 2025 18:19:16 +0000 (11:19 -0700)]
Merge tag 'x86_core_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull more x86 updates from Borislav Petkov:
- Remove a bunch of asm implementing condition flags testing in KVM's
emulator in favor of int3_emulate_jcc() which is written in C
- Replace KVM fastops with C-based stubs which avoids problems with the
fastop infra related to latter not adhering to the C ABI due to their
special calling convention and, more importantly, bypassing compiler
control-flow integrity checking because they're written in asm
- Remove wrongly used static branches and other ugliness accumulated
over time in hyperv's hypercall implementation with a proper static
function call to the correct hypervisor call variant
- Add some fixes and modifications to allow running FRED-enabled
kernels in KVM even on non-FRED hardware
- Add kCFI improvements like validating indirect calls and prepare for
enabling kCFI with GCC. Add cmdline params documentation and other
code cleanups
- Use the single-byte 0xd6 insn as the official #UD single-byte
undefined opcode instruction as agreed upon by both x86 vendors
- Other smaller cleanups and touchups all over the place
* tag 'x86_core_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (24 commits)
x86,retpoline: Optimize patch_retpoline()
x86,ibt: Use UDB instead of 0xEA
x86/cfi: Remove __noinitretpoline and __noretpoline
x86/cfi: Add "debug" option to "cfi=" bootparam
x86/cfi: Standardize on common "CFI:" prefix for CFI reports
x86/cfi: Document the "cfi=" bootparam options
x86/traps: Clarify KCFI instruction layout
compiler_types.h: Move __nocfi out of compiler-specific header
objtool: Validate kCFI calls
x86/fred: KVM: VMX: Always use FRED for IRQs when CONFIG_X86_FRED=y
x86/fred: Play nice with invoking asm_fred_entry_from_kvm() on non-FRED hardware
x86/fred: Install system vector handlers even if FRED isn't fully enabled
x86/hyperv: Use direct call to hypercall-page
x86/hyperv: Clean up hv_do_hypercall()
KVM: x86: Remove fastops
KVM: x86: Convert em_salc() to C
KVM: x86: Introduce EM_ASM_3WCL
KVM: x86: Introduce EM_ASM_1SRC2
KVM: x86: Introduce EM_ASM_2CL
KVM: x86: Introduce EM_ASM_2W
...
Linus Torvalds [Sat, 11 Oct 2025 17:51:14 +0000 (10:51 -0700)]
Merge tag 'x86_cleanups_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 cleanups from Borislav Petkov:
- Simplify inline asm flag output operands now that the minimum
compiler version supports the =@ccCOND syntax
- Remove a bunch of AS_* Kconfig symbols which detect assembler support
for various instruction mnemonics now that the minimum assembler
version supports them all
- The usual cleanups all over the place
* tag 'x86_cleanups_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/asm: Remove code depending on __GCC_ASM_FLAG_OUTPUTS__
x86/sgx: Use ENCLS mnemonic in <kernel/cpu/sgx/encls.h>
x86/mtrr: Remove license boilerplate text with bad FSF address
x86/asm: Use RDPKRU and WRPKRU mnemonics in <asm/special_insns.h>
x86/idle: Use MONITORX and MWAITX mnemonics in <asm/mwait.h>
x86/entry/fred: Push __KERNEL_CS directly
x86/kconfig: Remove CONFIG_AS_AVX512
crypto: x86 - Remove CONFIG_AS_VPCLMULQDQ
crypto: X86 - Remove CONFIG_AS_VAES
crypto: x86 - Remove CONFIG_AS_GFNI
x86/kconfig: Drop unused and needless config X86_64_SMP
Linus Torvalds [Sat, 11 Oct 2025 17:40:24 +0000 (10:40 -0700)]
Merge tag 'slab-for-6.18-rc1-hotfix' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab
Pull slab fix from Vlastimil Babka:
"A NULL pointer deref hotfix"
* tag 'slab-for-6.18-rc1-hotfix' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab:
slab: fix barn NULL pointer dereference on memoryless nodes
- Fix metadata_dst leak in __bpf_redirect_neigh_v{4,6}() (Daniel
Borkmann)
- Fix undefined behavior in {get,put}_unaligned_be32() (Eric Biggers)
- Use correct context to unpin bpf hash map with special types (KaFai
Wan)
* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:
selftests/bpf: Add test for unpinning htab with internal timer struct
bpf: Avoid RCU context warning when unpinning htab with internal structs
xsk: Harden userspace-supplied xdp_desc validation
bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}
libbpf: Fix undefined behavior in {get,put}_unaligned_be32()
bpf: Finish constification of 1st parameter of bpf_d_path()
Linus Torvalds [Sat, 11 Oct 2025 17:27:52 +0000 (10:27 -0700)]
Merge tag 'mm-nonmm-stable-2025-10-10-15-03' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Pull more updates from Andrew Morton:
"Just one series here - Mike Rappoport has taught KEXEC handover to
preserve vmalloc allocations across handover"
* tag 'mm-nonmm-stable-2025-10-10-15-03' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:
lib/test_kho: use kho_preserve_vmalloc instead of storing addresses in fdt
kho: add support for preserving vmalloc allocations
kho: replace kho_preserve_phys() with kho_preserve_pages()
kho: check if kho is finalized in __kho_preserve_order()
MAINTAINERS, .mailmap: update Umang's email address
Linus Torvalds [Sat, 11 Oct 2025 17:14:55 +0000 (10:14 -0700)]
Merge tag 'mm-hotfixes-stable-2025-10-10-15-00' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Pull misc fixes from Andrew Morton:
"7 hotfixes. All 7 are cc:stable and all 7 are for MM.
All singletons, please see the changelogs for details"
* tag 'mm-hotfixes-stable-2025-10-10-15-00' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:
mm: hugetlb: avoid soft lockup when mprotect to large memory area
fsnotify: pass correct offset to fsnotify_mmap_perm()
mm/ksm: fix flag-dropping behavior in ksm_madvise
mm/damon/vaddr: do not repeat pte_offset_map_lock() until success
mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage
mm/thp: fix MTE tag mismatch when replacing zero-filled subpages
memcg: skip cgroup_file_notify if spinning is not allowed
This is because fortify string sees that the size of entry->id is only 4
bytes, but it is writing more than that. But this is OK as the
dynamic_array is allocated to handle that copy.
The size allocated on the ring buffer was actually a bit too big:
size = sizeof(*entry) + cnt;
But cnt includes the 'id' and the buffer data, so adding cnt to the size
of *entry actually allocates too much on the ring buffer.
Vlastimil Babka [Sat, 11 Oct 2025 08:45:41 +0000 (10:45 +0200)]
slab: fix barn NULL pointer dereference on memoryless nodes
Phil reported a boot failure once sheaves become used in commits 59faa4da7cd4 ("maple_tree: use percpu sheaves for maple_node_cache") and 3accabda4da1 ("mm, vma: use percpu sheaves for vm_area_struct cache"):
Linus decoded the stacktrace to get_barn() and get_node() and determined
that kmem_cache->node[numa_mem_id()] is NULL.
The problem is due to a wrong assumption that memoryless nodes only
exist on systems with CONFIG_HAVE_MEMORYLESS_NODES, where numa_mem_id()
points to the nearest node that has memory. SLUB has been allocating its
kmem_cache_node structures only on nodes with memory and so it does with
struct node_barn.
For kmem_cache_node, get_partial_node() checks if get_node() result is
not NULL, which I assumed was for protection from a bogus node id passed
to kmalloc_node() but apparently it's also for systems where
numa_mem_id() (used when no specific node is given) might return a
memoryless node.
Fix the sheaves code the same way by checking the result of get_node()
and bailing out if it's NULL. Note that cpus on such memoryless nodes
will have degraded sheaves performance, which can be improved later,
preferably by making numa_mem_id() work properly on such systems.
Steven Rostedt [Sat, 11 Oct 2025 03:51:42 +0000 (23:51 -0400)]
tracing: Fix tracing_mark_raw_write() to use buf and not ubuf
The fix to use a per CPU buffer to read user space tested only the writes
to trace_marker. But it appears that the selftests are missing tests to
the trace_maker_raw file. The trace_maker_raw file is used by applications
that writes data structures and not strings into the file, and the tools
read the raw ring buffer to process the structures it writes.
The fix that reads the per CPU buffers passes the new per CPU buffer to
the trace_marker file writes, but the update to the trace_marker_raw write
read the data from user space into the per CPU buffer, but then still used
then passed the user space address to the function that records the data.
Pass in the per CPU buffer and not the user space address.
TODO: Add a test to better test trace_marker_raw.
Cc: stable@vger.kernel.org Cc: Masami Hiramatsu <mhiramat@kernel.org> Cc: Mark Rutland <mark.rutland@arm.com> Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Cc: Andrew Morton <akpm@linux-foundation.org> Link: https://lore.kernel.org/20251011035243.386098147@kernel.org Fixes: 64cf7d058a00 ("tracing: Have trace_marker use per-cpu data to read user space") Reported-by: syzbot+9a2ede1643175f350105@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68e973f5.050a0220.1186a4.0010.GAE@google.com/ Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
projects / thirdparty / kernel / linux.git / log
