wifi: mac80211: check ieee80211_rx_data_set_link return in pubsta MLO path
__ieee80211_rx_handle_packet() resolves the link via
ieee80211_rx_data_set_link() on the pubsta->mlo path but ignores the
helper's return value. Inside the helper,
rx->link = rcu_dereference(rx->sdata->link[link_id]);
can leave rx->link NULL if link_id references a slot already cleared
by ieee80211_vif_set_links() during station-initiated ML
reconfiguration (see mlme.c's ieee80211_ml_reconfiguration(), which
invalidates sdata->link[] before the matching
ieee80211_sta_remove_link() loop walks the link-sta hash). RX dispatch
still resolves a link_sta from the hash and then drops into
ieee80211_prepare_and_rx_handle(), which dereferences link->conf->addr.
Every other user site of ieee80211_rx_data_set_link() checks the return
and bails on failure; only this branch did not. Mirror the safe
pattern.
Fixes: e66b7920aa5a ("wifi: mac80211: fix initialization of rx->link and rx->link_sta") Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com> Link: https://patch.msgid.link/20260422000651.4184602-1-michael.bommarito@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
wifi: nl80211: require admin perm on SET_PMK / DEL_PMK
NL80211_CMD_SET_PMK and NL80211_CMD_DEL_PMK manage the offloaded
4-way-handshake PMK state used by drivers advertising
NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X. The only in-tree
driver that wires up both ->set_pmk / ->del_pmk and advertises
the feature today is brcmfmac, so the practical reach of this
patch is narrow.
Both ops were introduced without a .flags gate, so the generic
netlink layer dispatches them to an unprivileged caller instead
of rejecting with -EPERM at the permission check. Every other
connection-state op in the adjacent block (CONNECT, ASSOCIATE,
AUTHENTICATE, SET_KEY, ...) carries GENL_UNS_ADMIN_PERM; SET_PMK
/ DEL_PMK were introduced without the flag in 2017 and left
unchanged by later refactors. Johannes checked the original
Intel submission history and confirmed there is no admin check
in any prior revision either, so this seems likely to be a
simple oversight rather than an intentional carve-out.
Require GENL_UNS_ADMIN_PERM so the genl layer performs the same
capable(CAP_NET_ADMIN) check as its siblings. wpa_supplicant
already needs CAP_NET_ADMIN for every other nl80211 op it issues,
so supplicant operation is unaffected. The worst case the missing
gate enables today is an unprivileged local process on a
multi-user system invalidating the offloaded PMK state of another
user's 4-way-handshake session, forcing a full EAP re-auth on the
next reconnect.
Verified in UML: an unprivileged probe (uid=1000) sees
SET_MULTICAST_TO_UNICAST (sibling op with GENL_UNS_ADMIN_PERM)
return -EPERM on both pre- and post-fix kernels, while SET_PMK /
DEL_PMK return -ENODEV from nl80211_pre_doit()'s wdev lookup pre-
fix (proving dispatch crossed the genl permission check) and
-EPERM post-fix (rejected at the genl layer as intended).
Suggested-by: Johannes Berg <johannes@sipsolutions.net> Fixes: 3a00df5707b6 ("cfg80211: support 4-way handshake offloading for 802.1X") Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com> Acked-by: Arend van Spriel <arend.vanspriel@broadcom> Link: https://patch.msgid.link/20260421224552.4044147-1-michael.bommarito@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
wifi: libertas: fix integer underflow in process_cmdrequest()
The existing validation only checks if recvlength exceeds
LBS_CMD_BUFFER_SIZE, but doesn't check the lower bound. When a
USB device sends a response shorter than MESSAGE_HEADER_LEN, the
subtraction (recvlength - MESSAGE_HEADER_LEN) wraps to a huge
value, causing memcpy to corrupt the heap.
Add the same lower bound check that libertas_tf already has.
wifi: b43legacy: enforce bounds check on firmware key index in RX path
Same fix as b43: the firmware-controlled key index in b43legacy_rx()
can exceed dev->max_nr_keys. The existing B43legacy_WARN_ON is
non-enforcing in production builds, allowing an out-of-bounds read of
dev->key[].
Make the check enforcing by dropping the frame for invalid indices.
wifi: b43: enforce bounds check on firmware key index in b43_rx()
The firmware-controlled key index in b43_rx() can exceed the dev->key[]
array size (58 entries). The existing B43_WARN_ON is non-enforcing in
production builds, allowing an out-of-bounds read.
Make the B43_WARN_ON check enforcing by dropping the frame when the
firmware returns an invalid key index.
Suggested-by: Jonas Gorski <jonas.gorski@gmail.com> Acked-by: Michael Büsch <m@bues.ch> Fixes: e4d6b7951812 ("[B43]: add mac80211-based driver for modern BCM43xx devices") Cc: stable@vger.kernel.org Signed-off-by: Tristan Madani <tristan@talencesecurity.com> Link: https://patch.msgid.link/20260417111145.2694196-1-tristmd@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Marek Szyprowski [Thu, 16 Apr 2026 09:33:39 +0000 (11:33 +0200)]
wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task
Watchdog task might end between send_sig() and kthread_stop() calls, what
results in the use-after-free issue. Fix this by increasing watchdog task
reference count before calling send_sig() and dropping it by switching to
kthread_stop_put().
Cc: stable@vger.kernel.org Fixes: 373c83a801f1 ("brcmfmac: stop watchdog before detach and free everything") Fixes: a9ffda88be74 ("brcm80211: fmac: abstract bus_stop interface function pointer") Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com> Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com> Link: https://patch.msgid.link/20260416093339.2066829-1-m.szyprowski@samsung.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
i2c: ls2x-v2: Add driver for Loongson-2K0300 I2C controller
This I2C module is integrated into the Loongson-2K0300 SoCs.
It provides multi-master functionality and controls all I2C bus-specific
timing, protocols, arbitration, and timing. It supports both standard
and fast modes.
Add "loongson,ls2k0300-i2c" dedicated compatible for representing I2C of
Loongson-2K0300 chip, because its HW integration is quiet different from
others.
arm64: dts: rockchip: fix Ethernet PHY not found on PX30 Ringneck
When not passing the PHY ID with an ethernet-phy-idX.Y compatible
property, the MDIO bus will attempt to auto-detect the PHY by reading
its registers and then probing the appropriate driver. For this to work,
the PHY needs to be in a working state.
Unfortunately, the net subsystem doesn't control the PHY reset GPIO when
attempting to auto-detect the PHY. This means the PHY needs to be in a
working state when entering the Linux kernel. This historically has been
the case for this device, but only because the bootloader was taking
care of initializing the Ethernet controller even when not using it.
We're attempting to support the removal of the network stack in the
bootloader, which means the Linux kernel will be entered with the PHY
still in reset and now Ethernet doesn't work anymore.
The devices in the field only ever had a TI DP83825, so let's simply
bypass the auto-detection mechanism entirely by passing the appropriate
PHY IDs via the compatible.
Note that this is only an issue since commit e463625af7f9 ("arm64: dts:
rockchip: move reset to dedicated eth-phy node on ringneck") as before
that commit the reset was done by the MAC controller before starting the
MDIO auto-detection mechanism, via the snps,reset-* properties.
arm64: dts: rockchip: fix Ethernet PHY not found on PX30 Cobra
When not passing the PHY ID with an ethernet-phy-idX.Y compatible
property, the MDIO bus will attempt to auto-detect the PHY by reading
its registers and then probing the appropriate driver. For this to work,
the PHY needs to be in a working state.
Unfortunately, the net subsystem doesn't control the PHY reset GPIO when
attempting to auto-detect the PHY. This means the PHY needs to be in a
working state when entering the Linux kernel. This historically has been
the case for this device, but only because the bootloader was taking
care of initializing the Ethernet controller even when not using it.
We're attempting to support the removal of the network stack in the
bootloader, which means the Linux kernel will be entered with the PHY
still in reset and now Ethernet doesn't work anymore.
The devices in the field only ever had a TI DP83825, so let's simply
bypass the auto-detection mechanism entirely by passing the appropriate
PHY IDs via the compatible.
arm64: dts: rockchip: Update vdec register blocks order on RK3588
With the introduction of the RK3588 SoC, three register blocks have been
provided for the video decoder unit instead of just one, which are
further referenced in the vendor's datasheet by 'link table', 'function'
and 'cache'. The former is present at the top of the listing, starting
at video decoder unit base address, but the binding got this wrong
initially, i.e. the 'function' block got listed before the 'link' one.
Since the video decoder support for the aforementioned SoC in mainline
driver and devicetrees hasn't been released yet (just landed in
v7.0-rc1), address the problem by providing the register blocks for
vdec0 & vdec1 nodes using the 'link,function,cache' listing, which
ensures the unit address points to the primary register range.
This aligns with a similar fix for RK3576, where DTC also complained
about the bus address format.
arm64: dts: rockchip: Fix vdec register blocks order on RK3576
When building device trees for the RK3576 based boards, DTC shows the
following complaint:
rk3576.dtsi:1282.30-1304.5: Warning (simple_bus_reg): /soc/video-codec@27b00000: simple-bus unit address format error, expected "27b00100"
Since the video decoder support for the aforementioned SoC in mainline
driver and devicetrees hasn't been released yet (just landed in
v7.0-rc1), fix the issue by providing the register blocks using the
'link,function,cache' listing, which follows the address-based order as
shown in the vendor's datasheet and, implicitly, ensures the unit
address points to the primary register range.
Randy Dunlap [Sat, 11 Apr 2026 23:35:26 +0000 (16:35 -0700)]
docs: xforms_lists: allow __maybe_unused in func parameters
Bart has a patch (not yet merged) that causes kernel-doc warnings:
WARNING: ./include/linux/highmem.h:235 function parameter '__maybe_unused' not described in 'clear_user_pages'
Documentation/mm/highmem:211: ./include/linux/highmem.h:222: WARNING: Error in declarator or parameters
Handle this by adding "__maybe_unused" to the list of known function
parameter modifiers.
Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202604120025.jtlnpWff-lkp@intel.com/ Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Cc: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20260411233526.3909303-1-rdunlap@infradead.org>
Signed-off-by: Hyeonjin Kim <fruitworld.planet@gmail.com> Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20260415001204.6428-1-fruitworld.planet@gmail.com>
Rio Liu [Wed, 15 Apr 2026 16:57:13 +0000 (16:57 +0000)]
wifi: mac80211: skip ieee80211_verify_sta_ht_mcs_support check in non-strict mode
Some Xfinity XB8 firmware advertises >1 spatial stream MCS indexes in
their basic HT-MCS set. On cards with lower spatial streams, the check
would fail, and we'd be stuck with no HT when in fact work fine with its
own supported rate. This change makes it so the check is only performed
in strict mode.
docs: staging: fix various typos and grammar issues
Fix a few typographical and grammatical issues across several
staging documentation files to improve readability:
- crc32.rst: replace "decide in" with "decide on"
- lzo.rst: replace "independent on" with "independent of"
- remoteproc.rst: fix word order in dependent clause
- static-keys.rst: add hyphen to "low-level"
Signed-off-by: Zhang Xiaolei <zxl434815272@gmail.com> Reviewed-by: Mathieu Poirier <mathieu.poirier@linaro.org> Acked-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20260416105854.788-1-zxl434815272@gmail.com>
Charlie Jenkins [Sat, 18 Apr 2026 21:08:49 +0000 (17:08 -0400)]
Documentation/binfmt-misc.rst: Specify aux vector for "O" flag description
Instead of replacing the file path in the argument vector, the file
descriptor is passed as AT_EXECFD in the auxilary vector. This appears
to have been the case at least since the git port, update the
documentation to reflect this.
Signed-off-by: Charlie Jenkins <thecharlesjenkins@gmail.com> Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20260418-binfmt_misc_doc_update-v1-1-c2e9601ab868@gmail.com>
Baolin Liu [Fri, 24 Apr 2026 09:06:54 +0000 (17:06 +0800)]
Documentation: proc: fix section numbering in table of contents
Commit e24ccaaf7ec4 ("block: remove last remaining traces of IDE
documentation") removed the IDE section but left its table of
contents entry behind.
Fix the stale entry and renumber the following sections.
Fixes: e24ccaaf7ec4 ("block: remove last remaining traces of IDE documentation") Signed-off-by: Baolin Liu <liubaolin@kylinos.cn> Acked-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20260424090654.19229-1-liubaolin12138@163.com>
Marek Vasut [Wed, 22 Apr 2026 23:36:27 +0000 (01:36 +0200)]
dt-bindings: clock: renesas,cpg-clocks: Document ZT/ZTR trace clock on R-Mobile A1
Document the ZT trace bus and ZTR trace clocks on R-Mobile A1. These
clocks supply the coresight tracing modules, PTM, TPIU, ETB and
replicator. Without these clocks, coresight tracing can not be
operated. While this does change the ABI, it does so by extending the
existing clock-output-names, therefore if old software is used with new
DT, the coresight tracing parts will likely fail to probe, otherwise if
new software is used with an old DT, there is no impact.
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260422233744.149872-2-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
The Renesas RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs have a MTU3
block connected to the PCLKH and with a module clock controlled by
register 0x308, bit 0.
Biju Das [Thu, 26 Mar 2026 11:06:38 +0000 (11:06 +0000)]
clk: renesas: r9a08g046: Add GBETH clocks and resets
Add clock and reset entries for the Gigabit Ethernet Interfaces (GBETH
0-1) IPs found on the RZ/G3L SoC. This includes various dividers and
mux clocks needed by these two GBETH IPs. Also add the tx, tx-180, rx,
rx-180, rmii, rmii-tx and rmii-rx clocks to the r9a08g046_no_pm_mod_clk
table to avoid enabling both normal and RMII clocks by the PM framework.
Biju Das [Thu, 26 Mar 2026 11:06:36 +0000 (11:06 +0000)]
clk: renesas: rzg2l: Add support for enabling PLLs
Add support for enabling PLL clocks in the RZ/G3L CPG driver to turn off
some PLLs, if they are not in use (e.g. PLL6, PLL7).
Introduce .is_enabled() and .enable() callbacks to handle PLL state
transitions. With the .enable() callback, the PLL will be turned ON
only when the PLL consumer device is enabled; otherwise, it will remain
off. Define new macros for PLL standby and monitor registers to
facilitate this process.
My Outlook email address often sends emails from kernel devs to the junk
folder. Also, emails from some addresses (eg suse.de) are not received
at all. Update the email to my alternate Proton Mail address.
Ravi Singh [Wed, 22 Apr 2026 07:39:59 +0000 (07:39 +0000)]
xfs: flush delalloc blocks on ENOSPC in xfs_trans_alloc_icreate
xfs_trans_alloc_icreate() can fail with ENOSPC when delalloc
reservations have consumed most of the available block count
(fdblocks). xfs_trans_alloc() already retries internally with
xfs_blockgc_flush_all(), but that only trims post-EOF speculative
preallocation and may not free enough space for the transaction
reservation.
Add a retry with xfs_flush_inodes() when xfs_trans_alloc() returns
ENOSPC. This forces writeback of all dirty inodes via
sync_inodes_sb(), converting delalloc reservations to real
allocations and freeing the over-reserved portion back to fdblocks.
This fixes all callers of xfs_trans_alloc_icreate() and removes
the existing caller-level retry from xfs_create(), which is now
handled centrally.
Signed-off-by: Ravi Singh <ravising@redhat.com> Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Carlos Maiolino <cem@kernel.org>
display_get_pci_dev_of() gets a referenced PCI device via
pci_get_device(). Drop that reference when pci_enable_device() fails and
release it during the managed teardown path after pci_disable_device().
Without that, ofdrm leaks the pci_dev reference on both the error path
and the normal cleanup path.
Fixes: c8a17756c425 ("drm/ofdrm: Add ofdrm for Open Firmware framebuffers") Co-developed-by: Myeonghun Pak <mhun512@gmail.com> Signed-off-by: Myeonghun Pak <mhun512@gmail.com> Co-developed-by: Ijae Kim <ae878000@gmail.com> Signed-off-by: Ijae Kim <ae878000@gmail.com> Co-developed-by: Taegyu Kim <tmk5904@psu.edu> Signed-off-by: Taegyu Kim <tmk5904@psu.edu> Signed-off-by: Yuho Choi <dbgh9129@gmail.com> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patch.msgid.link/20260420002513.216-1-dbgh9129@gmail.com
drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()
drm_gem_fb_init_with_funcs() computes sub-sampled plane dimensions
using plain integer division:
unsigned int width = mode_cmd->width / (i ? info->hsub : 1);
unsigned int height = mode_cmd->height / (i ? info->vsub : 1);
However, the ioctl-level framebuffer_check() in drm_framebuffer.c uses
drm_format_info_plane_width/height() which round up dimensions via
DIV_ROUND_UP(). This inconsistency corrupts the subsequent GEM object
size check for certain pixel format and dimension combinations.
For example, with NV12 (vsub=2) and a 1-pixel-tall framebuffer the
GEM size validation path sees height=0 instead of height=1. The
expression (height - 1) then wraps to UINT_MAX as an unsigned int,
causing min_size to overflow and wrap back to a small value. A tiny
GEM object therefore passes the size guard, yet when the GPU accesses
the chroma plane it will read or write memory beyond the object's
bounds.
Fix by replacing the open-coded divisions with drm_format_info_plane_width()
and drm_format_info_plane_height(), which use DIV_ROUND_UP() and match
the calculation already used in framebuffer_check().
pinctrl: renesas: rzg2l: Handle PUPD for RZ/V2H(P) dedicated pins in PM
On RZ/V2H(P), dedicated pins support pull-up/pull-down configuration
via PIN_CFG_PUPD. Add PUPD handling for dedicated pins in the PM
save/restore path.
pinctrl: renesas: rzg2l: Handle RZ/V2H(P) IOLH configuration in PM cache
Include PIN_CFG_IOLH_RZV2H in the IOLH capability checks when saving
and restoring pin configuration registers.
On RZ/V2H(P), RZ/V2N, and RZ/G3E, the IOLH configuration is defined by
the PIN_CFG_IOLH_RZV2H capability. The previous implementation did not
account for this, causing the IOLH registers to be skipped during PM
save/restore.
Store SMT register cache per bank instead of using a single array.
On RZ/V2H(P), RZ/V2N, and RZ/G3E, the SMT register is split across two
32-bit registers: bits 0/8/16/24 control pins 0-3, while pins 4-7 are
controlled by the corresponding bits in the next register. The previous
implementation cached only a single SMT register, leading to incomplete
save/restore of SMT state.
Convert cache->smt to a per-bank array and allocate storage for both
halves. Update suspend/resume handling to save and restore both SMT
registers when present.
Fixes: 837afa592c623 ("pinctrl: renesas: rzg2l: Add suspend/resume support for Schmitt control registers") Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260413182456.811543-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Biju Das [Sat, 28 Mar 2026 09:05:45 +0000 (09:05 +0000)]
pinctrl: renesas: rzg2l: Fix incorrect PUPD register offset for high pins during suspend/resume
When saving/restoring pull-up/down register state during suspend/resume,
the second PUPD register access was incorrectly using the same base offset
as the first, effectively reading/writing the same register twice instead
of the adjacent one.
Add the correct + 4 byte offset to the second RZG2L_PCTRL_REG_ACCESS32
call so that pupd[1][port] is properly saved and restored from the next
32-bit register in the PUPD register pair, covering pins 4–7 of ports
with 4 or more pins.
Fixes: b2bd65fbb617 ("pinctrl: renesas: rzg2l: Add suspend/resume support for pull up/down") Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260328090548.84124-1-biju.das.jz@bp.renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Matthew Rosato [Fri, 24 Apr 2026 19:39:00 +0000 (15:39 -0400)]
KVM: s390: pci: Fix aisb calculation
The current implementation of aisb calculation will erroneously index
via an unsigned long * as well as multiply by 8B for every 64-bits in
the offset; only one or the other is required. This throws off aisb
calculations once the number of devices exceeds 64, and can result
in out-of-bounds access as well as failure to indicate summary bits
associated with those devices in guests.
Fix this by converting to a physical address before applying the
offset, as is already done in arch/s390/pci/pci_irq.c.
Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabling interrupt forwarding") Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com> Reviewed-by: Niklas Schnelle <schnelle@linux.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
arm64: dts: renesas: r9a09g056: Add #mux-state-cells to usb20phyrst
The renesas,rzv2h-usb2phy-reset binding schema defines #mux-state-cells
as a required property. Add it to the usb20phyrst node to fix the
following warnings:
arch/arm64/boot/dts/renesas/r9a09g056n48-rzv2n-evk.dtb: usb20phy-reset@15830000 (renesas,r9a09g056-usb2phy-reset): '#mux-state-cells' is a required property
arch/arm64/boot/dts/renesas/r9a09g056n48-rzv2n-evk-cn15-emmc.dtb: usb20phy-reset@15830000 (renesas,r9a09g056-usb2phy-reset): '#mux-state-cells' is a required property
arch/arm64/boot/dts/renesas/r9a09g056n48-rzv2n-evk-cn15-sd.dtb: usb20phy-reset@15830000 (renesas,r9a09g056-usb2phy-reset): '#mux-state-cells' is a required property
arm64: dts: renesas: r9a09g057: Add #mux-state-cells to usb2{0,1}phyrst
The renesas,rzv2h-usb2phy-reset binding schema defines #mux-state-cells
as a required property. Add it to the usb20phyrst and usb21phyrst nodes
to fix the following warnings:
arch/arm64/boot/dts/renesas/r9a09g057h44-rzv2h-evk.dtb: usb20phy-reset@15830000 (renesas,r9a09g057-usb2phy-reset): '#mux-state-cells' is a required property
arch/arm64/boot/dts/renesas/r9a09g057h44-rzv2h-evk.dtb: usb21phy-reset@15840000 (renesas,r9a09g057-usb2phy-reset): '#mux-state-cells' is a required property
arch/arm64/boot/dts/renesas/r9a09g057h44-rzv2h-evk-cn15-emmc.dtb: usb20phy-reset@15830000 (renesas,r9a09g057-usb2phy-reset): '#mux-state-cells' is a required property
arch/arm64/boot/dts/renesas/r9a09g057h44-rzv2h-evk-cn15-emmc.dtb: usb21phy-reset@15840000 (renesas,r9a09g057-usb2phy-reset): '#mux-state-cells' is a required property
arch/arm64/boot/dts/renesas/r9a09g057h44-rzv2h-evk-cn15-sd.dtb: usb20phy-reset@15830000 (renesas,r9a09g057-usb2phy-reset): '#mux-state-cells' is a required property
arch/arm64/boot/dts/renesas/r9a09g057h44-rzv2h-evk-cn15-sd.dtb: usb21phy-reset@15840000 (renesas,r9a09g057-usb2phy-reset): '#mux-state-cells' is a required property
Marek Vasut [Fri, 27 Mar 2026 23:42:11 +0000 (00:42 +0100)]
ARM: dts: renesas: rskrza1: Drop superfluous cells
Drop superfluous address-cells and size-cells to fix DTC W=1 warning:
arch/arm/boot/dts/renesas/r7s72100-rskrza1.dts:32.17-72.4: Warning (avoid_unnecessary_addr_size): /flash@18000000: unnecessary #address-cells/#size-cells without "ranges", "dma-ranges" or child "reg" or "ranges" property
Marek Vasut [Fri, 27 Mar 2026 23:42:10 +0000 (00:42 +0100)]
ARM: dts: renesas: genmai: Drop superfluous cells
Drop superfluous address-cells and size-cells to fix DTC W=1 warning:
arch/arm/boot/dts/renesas/r7s72100-genmai.dts:28.17-55.4: Warning (avoid_unnecessary_addr_size): /flash@18000000: unnecessary #address-cells/#size-cells without "ranges", "dma-ranges" or child "reg" or "ranges" property
Marek Vasut [Thu, 26 Mar 2026 04:24:01 +0000 (05:24 +0100)]
arm64: dts: renesas: rz-smarc-du-adv7513-smarc: Fix missing cells and reg in DU subnode
Add missing cells and reg DT property in the DU subnode to fix the
following DTC W=1 warning:
arch/arm64/boot/dts/renesas/rz-smarc-du-adv7513.dtsi:29.10-33.5: Warning (unit_address_vs_reg): /fragment@1/__overlay__/ports/port@0: node has a unit name, but no reg or ranges property
Marek Vasut [Thu, 26 Mar 2026 04:24:00 +0000 (05:24 +0100)]
arm64: dts: renesas: rz-smarc-cru-csi-ov5645: Fix missing cells and reg in CSI2 subnode
Add missing cells and reg DT property in the CSI2 subnode to fix the
following DTC W=1 warning:
arch/arm64/boot/dts/renesas/rz-smarc-cru-csi-ov5645.dtsi:49.10-55.5: Warning (unit_address_vs_reg): /fragment@2/__overlay__/ports/port@0: node has a unit name, but no reg or ranges property
Marek Vasut [Thu, 26 Mar 2026 04:23:59 +0000 (05:23 +0100)]
arm64: dts: renesas: salvator-panel: Fix missing cells and reg in DTO
Add missing cells and reg DT property in the Salvator-X panel DTO to fix
the following DTC W=1 warning:
arch/arm64/boot/dts/renesas/salvator-panel-aa104xd12.dtso:30.10-34.5: Warning (unit_address_vs_reg): /fragment@2/__overlay__/ports/port@1: node has a unit name, but no reg or ranges property
Marek Vasut [Thu, 26 Mar 2026 04:23:58 +0000 (05:23 +0100)]
arm64: dts: renesas: draak/ebisu-panel: Fix missing cells and reg in DTO
Add missing cells and reg DT property in the Draak/Ebisu panel DTO to
fix the following DTC W=1 warning:
arch/arm64/boot/dts/renesas/draak-ebisu-panel-aa104xd12.dtso:30.10-34.5: Warning (unit_address_vs_reg): /fragment@2/__overlay__/ports/port@1: node has a unit name, but no reg or ranges property
fuse: don't block in fuse_get_dev() for non-sync_init case
Commit a8dd5f1b73bc ("fuse: create fuse_dev on /dev/fuse open instead of
mount") changed behavior so that fuse_get_dev() now unconditionally
blocks waiting for a connection, even in the case where sync_init was
not set. Previously, non-sync_init opens returned -EPERM immediately.
Restore the previous behavior of returning -EPERM.
Fixes: a8dd5f1b73bc ("fuse: create fuse_dev on /dev/fuse open instead of mount") Reported-by: Mark Brown <broonie@kernel.org> Closes: https://lore.kernel.org/all/3c9f8396-41f4-4c88-b883-34bede72b427@sirena.org.uk/ Cc: <stable@vger.kernel.org> Signed-off-by: Joanne Koong <joannelkoong@gmail.com> Tested-by: Mark Brown <broonie@kernel.org> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
The APDS990x driver in misc lacks DeviceTree support, and no mainline
pre-DT board files configured this device using apds990x_platform_data.
This driver belongs to a legacy group of ambient light sensor drivers in
drivers/misc/ that predates the migration to DT and the standard IIO ABI.
Since the Avago APDS9900/9901 ALS/Proximity sensor is now supported by
the tsl2772 IIO driver and there are no active users in the kernel tree,
remove this old implementation.
iio: tsl2772: Add support for Avago APDS9900/9901 ALS/Proximity sensor
The Avago APDS9900/9901 has a similar register layout to the
TAOS/AMS TSL2772 but features a unique set of configurations. Add support
for the APDS9900/9901 into the TSL2772 driver by adding the required
device-specific configurations.
Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
iio: proximity: srf08: Replace sprintf() with sysfs_emit()
Replace sprintf() function calls with sysfs_emit() and
sysfs_emit_at(). While the current code is fine, sysfs_emit() is
preferred over sprintf(), and will help modernize the driver.
Signed-off-by: Maxwell Doose <m32285159@gmail.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
iio: adc: ad7280a: use cleanup helpers guard() and scoped_guard() for mutex locking
Replace open-coded mutex_lock/unlock pairs with the cleanup-based
guard() and scoped_guard() helpers in ad7280a_write_thresh(),
ad7280_show_balance_timer(), ad7280_store_balance_sw(),
ad7280_store_balance_timer() and ad7280_read_raw().
This removes the need for the err_unlock label and explicit
mutex_unlock() calls, as the lock is now automatically released
when the function returns or the guarded scope exits, regardless
of the exit path.
Signed-off-by: Lucas Ivars Cadima Ciziks <lucas@ciziks.com> Co-developed-by: Matheus Giarola <matheusgiarola@usp.br> Signed-off-by: Matheus Giarola <matheusgiarola@usp.br> Co-developed-by: Felipe Ribeiro de Souza <felipers@usp.br> Signed-off-by: Felipe Ribeiro de Souza <felipers@usp.br> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
iio: adc: ad7280a: Extract chan->address bit fields into named local variables
Extract the upper and lower bytes of chan->address into named local
variables devaddr and ch across ad7280_read_raw(),
ad7280_show_balance_timer() and ad7280_store_balance_timer() to improve
readability and avoid inline bit manipulation in function calls.
Suggested-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Lucas Ivars Cadima Ciziks <lucas@ciziks.com> Co-developed-by: Matheus Giarola <matheusgiarola@usp.br> Signed-off-by: Matheus Giarola <matheusgiarola@usp.br> Co-developed-by: Felipe Ribeiro de Souza <felipers@usp.br> Signed-off-by: Felipe Ribeiro de Souza <felipers@usp.br> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
iio: adc: qcom: Unify user-visible "Qualcomm" name
Various names for Qualcomm as a company are used in user-visible config
options: QCOM, Qualcomm and Qualcomm Technologies. Switch to unified
"Qualcomm" so it will be easier for users to identify the options when
for example running menuconfig.
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Jonathan Santos [Wed, 1 Apr 2026 11:58:50 +0000 (08:58 -0300)]
iio: adc: ad4130: add new supported parts
Add support for AD4129-4/8, AD4130-4, and AD4131-4/8 variants.
The AD4129 series supports the same FIFO interface as the AD4130 but with
reduced resolution (16-bit). The AD4131 series lacks FIFO support, so
triggered buffer functionality is introduced.
The 4-channel variants feature fewer analog inputs, GPIOs, and sparse pin
mappings for VBIAS, analog inputs, and excitation currents. The driver now
handles these differences with chip-specific configurations, including pin
mappings and GPIO counts.
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Santos <Jonathan.Santos@analog.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Jonathan Santos [Wed, 1 Apr 2026 11:58:34 +0000 (08:58 -0300)]
iio: adc: ad4130: introduce chip info for future multidevice support
Introduce a chip_info structure to abstract device-specific parameters
and prepare the driver for supporting multiple AD4130 family variants.
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Santos <Jonathan.Santos@analog.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Jonathan Santos [Wed, 1 Apr 2026 11:58:22 +0000 (08:58 -0300)]
iio: adc: ad4130: Add SPI device ID table
Add SPI device ID table to enable non-device tree based device binding.
The id_table provides a fallback matching mechanism when of_match_table
cannot be used, which is required for proper SPI driver registration.
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Santos <Jonathan.Santos@analog.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
iio: adc: ti-ads7924: Use guard(mutex) in ADC read helper
Replace mutex_lock()/mutex_unlock() pair with guard(mutex)()
and move the lock into ads7924_get_adc_result(). Keeping the guard
in the helper makes the locking scope match the operation being protected.
Suggested-by: Jonathan Cameron <jic23@kernel.org> Signed-off-by: Giorgi Tchankvetadze <giorgitchankvetadze1997@gmail.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Kevin Tung [Mon, 20 Apr 2026 12:52:52 +0000 (20:52 +0800)]
iio: adc: rtq6056: add i2c_device_id support
Add i2c_device_id table to support legacy I2C instantiation.
Update probe to use i2c_get_match_data() so device data can be
retrieved consistently for both OF and legacy I2C instantiation.
Signed-off-by: Kevin Tung <kevin.tung.openbmc@gmail.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
iio: adc: ad4170: use lookup table for gpio mask selection
Both ad4170_gpio_direction_input() and
ad4170_gpio_direction_output() duplicate the same switch
statement to map a GPIO offset to its corresponding mask.
Replace the switch with a static lookup table, simplifying the code
and avoiding duplication. This also makes future extensions easier.
No functional change intended.
Signed-off-by: Guilherme Ivo Bozi <guilherme.bozi@usp.br> Acked-by: Marcelo Schmitt <marcelo.schmitt1@gmail.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Jonathan Santos [Wed, 1 Apr 2026 11:58:12 +0000 (08:58 -0300)]
dt-bindings: iio: adc: ad4130: Add new supported parts
Extend binding support for AD4129-4/8, AD4130-4, and AD4131-4/8 ADC
variants.
Dropped a reference to driver in the binding whilst here.
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Jonathan Santos <Jonathan.Santos@analog.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
The Data Ready/FIFO interrupt has a special behavior that inverts the
IRQ polarity when devices with FIFO support enter FIFO mode, while using
normal polarity for data ready.
Document the interrupts property to clarify this special behavior for
users.
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Jonathan Santos <Jonathan.Santos@analog.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
iio: adc: nxp-sar-adc: use field_get() for EOC bit check
Use field_get() here now that runtime-mask support exists, and drop
the obsolete TODO. Since NXP_SAR_ADC_EOC_CH(c) is BIT(c), the
resulting !-test is semantically identical.
No functional change.
Reviewed-by: David Lechner <dlechner@baylibre.com> Signed-off-by: Piyush Patle <piyushpatle228@gmail.com> Acked-by: Daniel Lezcano <daniel.lezcano@oss.qualcomm.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
David Lechner [Sat, 11 Apr 2026 22:13:33 +0000 (17:13 -0500)]
iio: adc: ti-ads7950: use spi_optimize_message()
Use spi_optimize_message() to reduce CPU usage during buffered reads.
On hardware with support for SPI_CS_WORD, this reduced the CPU usage
of the threaded interrupt by about 5%. On hardware without support, this
should reduce CPU usage even more since it won't have to split the SPI
transfers each time the interrupt handler is called.
The .update_scan_mode() callback hand to be moved to the buffer preenable
callback since the SPI transfer mode can't be changed after
spi_optimize_message() has been called. (The buffer postenable callback
can't be used because it happens after the trigger is enabled, so the
SPI message needs to be optimized before that.)
The indent of the pointer to ti_ads7950_read_raw() in the assignment
is changed since there is no longer anything else in the struct to
align with since removal of use of the pointer to
ti_ads7950_update_scan_mode().
Signed-off-by: David Lechner <dlechner@baylibre.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
iio: adc: ad799x: convert to fully managed resources and drop remove()
Convert the driver's remaining manual resource management to use the
devm_ infrastructure, allowing for the complete removal of the
ad799x_remove() function and the simplification of the probe error paths.
Specifically:
- Initialize the mutex using devm_mutex_init() and move it to the top
of probe() (before IRQ registration) to prevent a race condition where
an interrupt could attempt to take an uninitialized lock.
- Use devm_add_action_or_reset() to ensure that the VCC and VREF
regulators are disabled safely and in the correct order during driver
teardown or probe failure.
- Refactor the optional VREF error handling path for better readability.
- Convert iio_triggered_buffer_setup() and iio_device_register() to
their devm_ variants.
Because all resources are now managed by the devm core, the unwinding
order is guaranteed to follow the reverse order of allocation. All manual
error handling goto labels in ad799x_probe() have been removed.
Suggested-by: Jonathan Cameron <jic23@kernel.org> Suggested-by: David Lechner <dlechner@baylibre.com> Suggested-by: Andy Shevchenko <andriy.shevchenko@intel.com> Reviewed-by: David Lechner <dlechner@baylibre.com> Signed-off-by: Archit Anant <architanant5@gmail.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
iio: adc: ad799x: cache regulator voltages during probe
Since the reference voltage for this ADC is not expected to
change at runtime, determine the active reference voltage (either VREF
or VCC) during probe() and cache it in a single variable in the state
structure.
Suggested-by: Jonathan Cameron <jic23@kernel.org> Suggested-by: David Lechner <dlechner@baylibre.com> Reviewed-by: David Lechner <dlechner@baylibre.com> Signed-off-by: Archit Anant <architanant5@gmail.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
iio: adc: ad799x: use a static buffer for scan data
Currently, rx_buf is dynamically allocated using kmalloc() every time
ad799x_update_scan_mode() is called. This can lead to memory leaks if
the scan mask is updated multiple times.
Drop the dynamic allocation and replace it with a static buffer at the
end of the state structure using IIO_DECLARE_BUFFER_WITH_TS().
This eliminates the allocation overhead, prevents leaks, and removes
the need for manual kfree() on driver removal.
Suggested-by: David Lechner <dlechner@baylibre.com> Reviewed-by: David Lechner <dlechner@baylibre.com> Signed-off-by: Archit Anant <architanant5@gmail.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
iio: adc: ad799x: use local device pointer in probe
Introduce a local device pointer 'dev' in ad799x_probe() and use it
throughout the function instead of accessing &client->dev repeatedly.
Suggested-by: Andy Shevchenko <andriy.shevchenko@intel.com> Reviewed-by: David Lechner <dlechner@baylibre.com> Signed-off-by: Archit Anant <architanant5@gmail.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
projects / thirdparty / kernel / linux.git / log
