summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)AuthorFilesLines
2026-07-19iio: buffer-dmaengine: Add support for cyclic DMA transfersNuno Sá1-3/+39
Allow buffer blocks flagged as cyclic to be submitted as repeating DMA transfers. For cyclic blocks, use DMA_PREP_REPEAT so the engine keeps replaying the descriptor. This is useful for output buffers where the same data should be driven continuously without userspace having to requeue it. Examples include continuous RF transmit paths replaying a calibration, test or beacon pattern. Skip installing the completion callback for cyclic blocks. Since the transfer is continuously replayed, the callback would fire on every period, throwing off the block refcount. Because nothing prevents a new cyclic transfer from replacing an already active cyclic one, always set DMA_PREP_LOAD_EOT so the engine correctly terminates the active transfer before loading the new descriptor. Limit the DMA buffer queue to one cyclic DMABUF at a time. There is currently no known use case for queueing multiple cyclic blocks, and cyclic blocks stay referenced until the buffer is disabled. Signed-off-by: Nuno Sá <nuno.sa@analog.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-07-19iio: light: tsl2583: migrate to sysfs_emit() and sysfs_emit_at()Chengrui Liu1-6/+6
Replace sprintf() with sysfs_emit() for single-value sysfs show functions, and use sysfs_emit_at() for lux_table_show() which concatenates multiple values. This ensures buffer safety and follows the modern kernel sysfs API. Signed-off-by: Chengrui Liu <OrangeBlack0765@outlook.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-07-19iio: dac: ad5686: add gain control supportRodrigo Alencar2-7/+125
Most of the supported devices rely on a GAIN pin to control a 2x multiplier applied to the output voltage. Other devices, e.g. the single-channel ones, provides a gain control through a bit field in the control register. Some designs might have the GAIN pin hardwired to VDD/VLOGIC or GND, which would have no "gain-gpios" device property, being able to set "adi,range-double" if it is hardwired to VDD. The vref_mv field is moved down in the struct ad5686_state, so that the overall size increase is reduced. Reviewed-by: David Lechner <dlechner@baylibre.com> Signed-off-by: Rodrigo Alencar <rodrigo.alencar@analog.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-07-19iio: dac: ad5686: add triggered buffer supportRodrigo Alencar2-0/+67
Implement trigger handler by leveraging the LDAC gpio to update all DAC channels at once when it is available. Also, the multiple channel writes can be flushed at once with the sync() operation. Reviewed-by: David Lechner <dlechner@baylibre.com> Signed-off-by: Rodrigo Alencar <rodrigo.alencar@analog.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-07-19iio: dac: ad5686: read_raw/write_raw: use guard(mutex)()Rodrigo Alencar1-11/+8
Use guarded mutex lock to facilitate code review when adding new attributes. This will allow for early returns, avoiding error-prone locking and unlocking in error paths. This also adds missing include linux/cleanup.h. Gain-control support will allow the scale attribute to be configurable. Reviewed-by: Maxwell Doose <m32285159@gmail.com> Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Reviewed-by: David Lechner <dlechner@baylibre.com> Signed-off-by: Rodrigo Alencar <rodrigo.alencar@analog.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-07-19iio: dac: ad5686: implement new sync() op for the spi busRodrigo Alencar4-34/+108
Use of local SPI bus data to manage a collection of SPI transfers and flush them to the SPI platform driver with the sync() operation. This allows for faster handling of multiple channel DAC writes, avoiding kernel overhead per spi_sync() call, which will be helpful when enabling triggered buffer support. For consistency, the read operation leverages the same transfer data rather than a stack-allocated array. Reviewed-by: David Lechner <dlechner@baylibre.com> Signed-off-by: Rodrigo Alencar <rodrigo.alencar@analog.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-07-19iio: dac: ad5686: introduce sync operationRodrigo Alencar1-1/+9
Add sync() to operation to ad5686_bus_ops, which can be used to flush multiple pending data transfers at once. This is going to be used when implementing triggered buffer support. Reviewed-by: David Lechner <dlechner@baylibre.com> Signed-off-by: Rodrigo Alencar <rodrigo.alencar@analog.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-07-19iio: dac: ad5686: refactor command/data macrosRodrigo Alencar4-30/+34
Replace usage of bit shifting macros for FIELD_PREP(), which would not ignore bit masking when preparing SPI/I2C commands. This change is a code hardening measure to be paired with the upcoming triggered buffer support. For the AD5310 regmap case, 16-bit data coming from the buffer may overlap with command bits if the data field is unmasked. *_REF_BIT_MSK and *_PD_MSK bit position macros are renamed (with a DATA prefix) so to indicate that they are relative to the DATA field. Reported-by: sashiko-bot@kernel.org Closes: https://lore.kernel.org/all/20260628143026.EC6CA1F000E9@smtp.kernel.org/ Reviewed-by: David Lechner <dlechner@baylibre.com> Signed-off-by: Rodrigo Alencar <rodrigo.alencar@analog.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-07-19iio: dac: ad5686: missing NULL check on match dataRodrigo Alencar2-4/+14
Verify that chip_info pointer is not NULL. If a user binds the driver using driver_override via sysfs with a device name not present in the id_table or of_match_table, match data will be NULL. Fixes: 0eb1728461a1 ("iio: dac: ad5686: drop enum id") Reported-by: sashiko-bot@kernel.org Closes: https://lore.kernel.org/all/20260710113149.53EC51F000E9@smtp.kernel.org/ Signed-off-by: Rodrigo Alencar <rodrigo.alencar@analog.com> Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-07-19spi: atmel-quadspi: add support for LAN969xMark Brown399-1915/+4525
Robert Marko <robert.marko@sartura.hr> says: This series adds QSPI support for the Microchip LAN969x which has two QSPI controllers based on SAMA7G5. It requires pad calibration, supports DMA, and supports 100 MHz operation. It requires a different init sequence to SAMA7G5 so support for custom .init per controller caps is added, and existing controllers relying on checking gclk are converted to it. Signed-off-by: Robert Marko <robert.marko@sartura.hr> Link: https://patch.msgid.link/20260709112006.390742-1-robert.marko@sartura.hr
2026-07-19spi: atmel-quadspi: add LAN969x QSPI supportRobert Marko2-2/+66
Microchip LAN969x has two QSPI controllers based on SAMA7G5 QSPI. It requires pad calibration, supports DMA, and supports 100 MHz operation. Signed-off-by: Robert Marko <robert.marko@sartura.hr> Link: https://patch.msgid.link/20260709112006.390742-5-robert.marko@sartura.hr Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-19spi: atmel-quadspi: use init callback for gclk variantsRobert Marko1-8/+7
Assign the existing SAMA7G5 initialization routine to every generic clock variant and dispatch initialization exclusively through the capability callback. This keeps hardware capabilities separate from initialization selection and lets variants override the sequence explicitly. Signed-off-by: Robert Marko <robert.marko@sartura.hr> Link: https://patch.msgid.link/20260709112006.390742-4-robert.marko@sartura.hr Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-19spi: atmel-quadspi: add controller init callbackRobert Marko1-0/+9
Allow controller variants to provide a custom initialization callback through their capability data. This prepares the driver for variants which require a different hardware initialization sequence without adding SoC checks to the common path. Signed-off-by: Robert Marko <robert.marko@sartura.hr> Link: https://patch.msgid.link/20260709112006.390742-3-robert.marko@sartura.hr Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-19spi: spacemit: Correct TX FIFO slot calculationZhengyu He1-2/+2
In k1_spi_write, the count variable is intended to represent the number of slots available for writing into the TX FIFO. The current implementation uses FIELD_GET(SSP_STATUS_TFL, val) in an attempt to determine this count, but this register field returns the number of occupied slots, not the available space. The previous implementation attempted to handle this via a ternary operator (? : K1_SPI_FIFO_SIZE), which incorrectly assumed that the hardware returned 0 when the FIFO was empty (meaning all slots were available), leading to incorrect accounting of the buffer space. Fix this by calculating the free slots: count = K1_SPI_FIFO_SIZE - FIELD_GET(SSP_STATUS_TFL, val); The associated comment has been updated to reflect the logic change: The old comment reflected an incorrect assumption about the hardware behavior, which was the root cause of the previous buggy logic. This patch accurately and concisely describes the purpose of the new calculation. Signed-off-by: Peixin Xie <peixin.xie@spacemit.com> Signed-off-by: Zhengyu He <hezhy472013@gmail.com> Link: https://patch.msgid.link/20260715-k1-spi-tx-fifo-fix-v1-for-next-v1-1-02024223b08a@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-19pwm: rzg2l-gpt: Drop unused rzg2l_gpt_chip parameter from ↵Biju Das1-3/+2
rzg2l_gpt_calculate_prescale() The rzg2l_gpt parameter was passed to rzg2l_gpt_calculate_prescale() but never used inside the function. Remove it and update the sole call site accordingly. Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Link: https://patch.msgid.link/20260604095647.108654-6-biju.das.jz@bp.renesas.com Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
2026-07-19pwm: Use seq_putc() calls in pwm_dbg_show()Markus Elfring1-3/+3
Single characters should occasionally be put into a sequence. Thus use the corresponding function `seq_putc()`. The source code was transformed by using the Coccinelle software. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Link: https://patch.msgid.link/5cc95f1d-a9f4-4ba4-8411-56cfb16d996a@web.de [ukleinek: fixup for a third instance, originally addressed differently] Link: https://patch.msgid.link/03062fdb-cc4f-47c7-a007-4ac67ded6377@web.de Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
2026-07-19dmaengine: dw-edma: Defer channel IRQ handling to workqueueKoichiro Den2-5/+75
On some SoCs (e.g. R-Car S4) the endpoint-side eDMA raises a single fixed SPI that is hardwired to CPU0 and covers every read and write channel. Handling channel events directly in that hard IRQ context serializes the completion processing of all channels on one CPU: descriptor recycling and refill, client callbacks (the vchan tasklet runs on the scheduling CPU) and the doorbell writes all funnel through CPU0, while the handler additionally spins on each channel's vc.lock. Especially under heavy multichannel load, this contention becomes a performance bottleneck. Keep the hard IRQ handler minimal: clear the status, dispatch channel events, and defer per-channel processing to work items. A work item per channel preserves ordering while allowing different channels to run in parallel on any CPU. Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Koichiro Den <den@valinux.co.jp> Link: https://patch.msgid.link/20260717180639.2643243-10-den@valinux.co.jp Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-07-19dmaengine: dw-edma: Snapshot the v0 interrupt status once per handler passKoichiro Den1-14/+13
The v0 interrupt handler reads the interrupt status register twice per invocation, once through the DONE accessor and once through the ABORT accessor, although both fields live in the same 32-bit register. On remote setups (dw-edma-pcie) each read is a non-posted round trip across the PCIe link costing on the order of a microsecond, and with one completion interrupt per element the duplicate adds up. As an example, profiling the R-Car S4 remote path put the handler at ~7us per invocation, dominated by such reads. Read the register once and derive the DONE and ABORT views from the snapshot. No abort is lost to this because the pass only clears status bits it observed, so an abort raised after the snapshot keeps its status and its own interrupt delivery brings it to the next pass. An abort on an observed channel cannot race the clear either. Software can restart the halted channel only after abort() runs, and abort() is called after dw_edma_v0_core_clear_abort_int(). Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Koichiro Den <den@valinux.co.jp> Link: https://patch.msgid.link/20260717180639.2643243-9-den@valinux.co.jp Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-07-19dmaengine: dw-edma-pcie: Drop redundant pci_free_irq_vectors()Koichiro Den1-3/+0
dw_edma_pcie enables the PCI device with pcim_enable_device(), so IRQ vectors allocated by pci_alloc_irq_vectors() are released by pcim_msi_release() on device release. The driver should not call pci_free_irq_vectors() manually. Drop the redundant remove-time cleanup and rely on the managed PCI device lifetime instead, as documented by commit 03e4905402ae ("PCI/MSI: Clarify pci_free_irq_vectors() usage for managed devices"). Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Koichiro Den <den@valinux.co.jp> Link: https://patch.msgid.link/20260717180639.2643243-8-den@valinux.co.jp Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-07-19dmaengine: dw-edma: Clear stale requests on terminationKoichiro Den1-0/+2
terminate_all() can finish immediately when the channel is unconfigured, paused, idle, or already stopped in hardware. A pending PAUSE request can survive these paths and block issue_pending() even after termination. Clear the request whenever termination leaves the channel idle. A running channel keeps its STOP request until the interrupt handler consumes it. Fixes: e63d79d1ffcd ("dmaengine: Add Synopsys eDMA IP core driver") Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Koichiro Den <den@valinux.co.jp> Link: https://patch.msgid.link/20260717180639.2643243-7-den@valinux.co.jp Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-07-19dmaengine: dw-edma: Serialize channel state checksKoichiro Den1-4/+6
pause() and resume() read and update channel state without holding vc.lock, while the interrupt handlers update the same state under it. Take the same lock around those state checks so that request, status, and configured stay consistent. For example, pause() can observe EDMA_ST_BUSY right before the interrupt handler completes the final descriptor and moves the channel to EDMA_ST_IDLE, and then record EDMA_REQ_PAUSE on an already idle channel. No further interrupt will acknowledge the request, and since issue_pending() requires EDMA_REQ_NONE, the channel is wedged for good: terminate_all() leaves the stale request behind, so even reconfiguring the channel does not recover it. issue_pending() already runs under vc.lock, but it tests configured before taking it. Move that test under the lock as well, so configured, request, and status are evaluated as one channel-state snapshot. Fixes: e63d79d1ffcd ("dmaengine: Add Synopsys eDMA IP core driver") Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Koichiro Den <den@valinux.co.jp> Link: https://patch.msgid.link/20260717180639.2643243-6-den@valinux.co.jp Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-07-19dmaengine: dw-edma: Complete descriptors before pausingKoichiro Den1-6/+14
If PAUSE is requested while the final burst of a descriptor is in flight, the DONE interrupt takes the PAUSE path without checking whether the descriptor has been depleted. The depleted descriptor remains on the issued list and the channel enters EDMA_ST_PAUSE. On resume, dw_edma_start_transfer() can select that depleted descriptor again even though no burst remains, leaving the channel in an invalid busy state. Check for descriptor completion before acknowledging PAUSE. If there is no work to start on resume, leave the channel idle. Also ignore DONE interrupts while the channel is paused so a stale or repeated interrupt cannot change its state or start queued work. Fixes: e63d79d1ffcd ("dmaengine: Add Synopsys eDMA IP core driver") Cc: stable@vger.kernel.org Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Koichiro Den <den@valinux.co.jp> Link: https://patch.msgid.link/20260717180639.2643243-5-den@valinux.co.jp Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-07-19dmaengine: dw-edma: Serialize abort state updatesKoichiro Den1-1/+1
dw_edma_abort_interrupt() drops vc.lock before changing request and status. issue_pending() can acquire the lock in that small window, observe the old busy state, and skip starting queued descriptors. Then the abort handler overwrites the channel status as idle, leaving the new descriptors stranded for good. Keep descriptor completion and the state transition in the same critical section. Fixes: e63d79d1ffcd ("dmaengine: Add Synopsys eDMA IP core driver") Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Koichiro Den <den@valinux.co.jp> Link: https://patch.msgid.link/20260717180639.2643243-4-den@valinux.co.jp Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-07-19dmaengine: dw-edma: Terminate all descriptors without callbacksKoichiro Den1-14/+76
The DMA Engine client documentation says in the "Terminate APIs" section of Documentation/driver-api/dmaengine/client.rst: "No callback functions will be called for any incomplete transfers." dw-edma instead calls vchan_cookie_complete() when a deferred STOP reaches the interrupt handler. This schedules a callback for the active descriptor and leaves other issued or submitted descriptors queued. A late callback after dmaengine_terminate_sync() can dereference client state that has already been freed, while leftover descriptors may later restart into reused buffers or leak. Move all issued and submitted descriptors to the terminated list whenever termination completes. For a pending STOP, do this from both the DONE and ABORT paths. Complete their cookies in order without scheduling callbacks. A STOP can remain pending until the running transfer raises an interrupt. Make device_synchronize() wait for such a pending STOP to complete before releasing terminated descriptors. Reuse it from free_chan_resources(), then release the remaining virt-dma resources. Sleep instead of busy-polling while waiting, and warn if the existing timeout expires. Fixes: e63d79d1ffcd ("dmaengine: Add Synopsys eDMA IP core driver") Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Koichiro Den <den@valinux.co.jp> Link: https://patch.msgid.link/20260717180639.2643243-3-den@valinux.co.jp Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-07-19dmaengine: dw-edma: Fix HDMA channel status register accessKoichiro Den1-1/+1
GET_CH_32() takes the direction before the channel ID, but dw_hdma_v0_core_ch_status() passed them in the opposite order. This can make the status callback read another HDMA channel status register. Use the same argument order as the other HDMA register accesses. Fixes: e74c39573d35 ("dmaengine: dw-edma: Add support for native HDMA") Cc: stable@vger.kernel.org Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Koichiro Den <den@valinux.co.jp> Link: https://patch.msgid.link/20260717180639.2643243-2-den@valinux.co.jp Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-07-19Merge tag 'block-7.2-20260717' of ↵Linus Torvalds1-18/+14
git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fixes from Jens Axboe: - Fixes for the dio bounce buffer helpers: correct the alignment of bounced dio read bios to avoid a double unpin, handle huge zero folios in bio_free_folios(), and don't warn on the larger-order folio attempts in the greedy allocation path. - Try a slab allocation in bio_alloc_bioset() before falling back to the mempool, restoring the previous behavior for non-sleeping allocations from a cache-enabled bioset. - Serialize elevator changes for the same queue using the writer lock. - Fix a race in blk_time_get_ns() where a task preempted between setting PF_BLOCK_TS and the cached-timestamp reload could return 0. - blk-cgroup fix for leaks and the online flag on a radix_tree_insert() failure in blkg_create(). - Free the copied pages when blk_rq_map_kern() fails after blk_rq_append_bio() rejects the bio. - Remove manually added partitions on loop device detach, fixing dead partition devices left behind and a subsequent LOOP_CONFIGURE -EBUSY - Bound the AIX partition lvd scan to the sector that was actually read. - Show the block operation in error injection rules (Jackie) * tag 'block-7.2-20260717' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: block: fix aligning of bounced dio read bios block: handle huge zero folios in bio_free_folios block: try slab allocation in bio_alloc_bioset() before mempool block: show operation in error injection rules block: serialize elevator changes for the same queue using a writer lock block: free copied pages when blk_rq_map_kern() fails block: do not warn when doing greedy allocation in folio_alloc_greedy() partitions: aix: bound the lvd scan to one sector blk-cgroup: fix leaks and online flag on radix_tree_insert failure loop: remove manually added partitions on detach block: fix race in blk_time_get_ns() returning 0
2026-07-19Merge tag 'spi-fix-v7.2-rc3' of ↵Linus Torvalds2-5/+10
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A couple of fairly routine driver fixes, nothing too remarkable" * tag 'spi-fix-v7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: cadence-quadspi: Fix indirect write timeout when DMA read mode is enabled spi: dw-dma: Wait for controller idle before completing Tx
2026-07-19ublk: wait on ublk_dev_ready() instead of ub->completionMing Lei1-17/+30
ub->completion is only re-armed by a successful START_USER_RECOVERY. If the ublk server sends END_USER_RECOVERY without one - e.g. its START failed with -EBUSY and the error was ignored - the wait is satisfied by the stale completion of the previous recovery cycle, and the device is marked LIVE and the requeue list kicked while the FETCH stream is still running and ubq->canceling is still set. The kick redispatches a previously requeued request, __ublk_queue_rq_common() sees ->canceling and parks it again via __ublk_abort_rq(), and after the last FETCH clears ->canceling nothing ever kicks the requeue list again: the request is stranded there while holding its tag. If it is the flush machinery's flush_rq, every subsequent fsync piles up in uninterruptible sleep and teardown hangs on tag draining. This matches a report of a lost PREFLUSH with ext4 on top of ublk after daemon crash recovery. ub->completion is an edge-triggered latch used as a proxy for the level condition "every queue has fetched all I/O commands", which can regress (F_BATCH's UNPREP, daemon death) and whose re-arm can be skipped. Drop it and wait on the real condition instead: the new helper ublk_wait_dev_ready_and_lock() waits on ublk_dev_ready() via wait_var_event_interruptible(), woken from ublk_mark_io_ready(), then re-checks it under ub->mutex, waiting again on regression, and returns with the mutex held and readiness guaranteed. Readiness becomes true in the same ub->mutex critical section that clears the last queue's ->canceling, so END_USER_RECOVERY marks the device LIVE and kicks the requeue list strictly after ->canceling clears. The wait stays interruptible, so a server whose daemon died can still be signalled out. For ublk_ctrl_start_dev() this replaces the fail-fast -EINVAL on an F_BATCH ready->UNPREP regression with waiting until the device is ready again. Reported-by: George Salisbury <gsalisbury@apnic.net> Fixes: 728cbac5fe21 ("ublk: move device reset into ublk_ch_release()") Cc: stable@vger.kernel.org Signed-off-by: Ming Lei <tom.leiming@gmail.com> Link: https://patch.msgid.link/20260719134540.120269-1-tom.leiming@gmail.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-07-19Merge tag 'regulator-fix-v7.2-rc3' of ↵Linus Torvalds1-5/+5
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fix from Mark Brown: "One straightforward driver fix for some incorrectly described bitfields in the ltc3676 driver" * tag 'regulator-fix-v7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: ltc3676: Fix incorrect IRQSTAT bit offsets
2026-07-19hwmon: (asus-ec-sensors) add missed handle for ENOMEMEugene Shalygin1-3/+5
Add missing return value check in the setup function. Fixes: d0ddfd241e57 ("hwmon: (asus-ec-sensors) add driver for ASUS EC") Signed-off-by: Eugene Shalygin <eugene.shalygin@gmail.com> Link: https://lore.kernel.org/r/20260712130602.1256700-2-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-07-19hwmon: (asus-ec-sensors) fix EC read intervalsEugene Shalygin1-4/+4
Take INITIAL_JIFFIES into account when setting up next update time. Fixes: d0ddfd241e57 ("hwmon: (asus-ec-sensors) add driver for ASUS EC") Signed-off-by: Eugene Shalygin <eugene.shalygin@gmail.com> Link: https://lore.kernel.org/r/20260712110650.1240071-2-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-07-19hwmon: (asus-ec-sensors) fix looping over banks while reading from ECEugene Shalygin1-1/+1
Do not assume there are only bank 0 and bank 1 available, just use '!=' for bank comparison. Fixes: d0ddfd241e57 ("hwmon: (asus-ec-sensors) add driver for ASUS EC") Signed-off-by: Eugene Shalygin <eugene.shalygin@gmail.com> Link: https://lore.kernel.org/r/20260711074217.554656-1-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-07-19hwmon: (pmbus/max34440) block unsupported VIN and IIN limit registersAlexis Czezar Torreno1-0/+80
MAX34451 and ADPM chips do not support standard PMBus VIN/IIN limit registers, manufacturer specific min/max registers, or undercurrent or undertemperature fault limits. STATUS_BYTE and STATUS_OTHER are also not available. Accessing these non-existent registers during driver initialization triggers a CML error and asserts ALERT. Handled by blocking these functions during read/write. Fixes: 7a001dbab4ad ("hwmon: (pmbus/max34440) Add support for MAX34451.") Fixes: 629cf8f6c23a ("hwmon: (pmbus/max34440) Add support for ADPM12160") Fixes: 2e0b52f1ae88 ("hwmon: (pmbus/max34440): add support adpm12200") Fixes: 479bfeba2eb6 ("hwmon: (pmbus/max34440): add support adpm12250") Signed-off-by: Alexis Czezar Torreno <alexisczezar.torreno@analog.com> Link: https://lore.kernel.org/r/20260716-max34451_fixes-v1-1-a941b27eaecb@analog.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-07-18iio: resolver: ad2s1200: use dev_err_probe()Vojtěch Krátký1-10/+6
Use dev_err_probe() instead of dev_err() to simplify the error path and cleanly handle deferred probing. Signed-off-by: Vojtěch Krátký <vo.kratky@seznam.cz> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-07-18clk: qcom: camcc-glymur: Add const qualifier for driver_data & CBCRs listJagadeesh Kona1-2/+2
The qcom_cc_driver_data and critical CBCRs list are never modified by common code and are expected to be const. Hence add const qualifier for these fields. Signed-off-by: Jagadeesh Kona <jagadeesh.kona@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260714-glymur_camcc_const_fixes-v1-1-c635123ebbeb@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-18wifi: iwlwifi: mld: move BIOS reading code to where it belongsMiri Korenblit2-2/+3
We have a dedicated function to fetch all the BIOS tables when the opmode starts, and yet we read a couple of tables directly from iwl_op_mode_mld_start, which is already a large function that does multiple things. Move the reading of the sgom, puncturing, and RFI enablement to the dedicated iwl_mld_get_bios_tables. Link: https://patch.msgid.link/20260717172958.b19a33e0b507.I73f6b5e6a81d0f411f12589ceb30afa655c0a16b@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-18wifi: iwlwifi: mld: add debug log after AP type commandPagadala Yesu Anjaneyulu1-0/+2
Add a radio debug trace when MCC_ALLOWED_AP_TYPE_CMD is sent successfully during AP type table initialization. This improves bring-up visibility without changing runtime behavior. Failures are still reported through the existing error log path. Signed-off-by: Pagadala Yesu Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com> Link: https://patch.msgid.link/20260717172958.18e1fc5ec109.I76dd832f62d00a8f358f8e4a705f25184ac53da2@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-18wifi: iwlwifi: mld: support update_mcc notification v2Pagadala Yesu Anjaneyulu2-2/+6
New firmware will support version 2 of the update_mcc notification. The extra field is used for a new feature, but we does not support it. Keep the existing payload definition compatible with both versions and register version 2 in the MLD notification version table so the driver accepts the newer notification without changing the behavior. This preserves version 1 support and adds compatibility with firmware that sends version 2. Signed-off-by: Pagadala Yesu Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com> Link: https://patch.msgid.link/20260717172958.9c5a940d37dc.I955800c2377b802ffb99003349552cc4036ca4bd@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-18wifi: iwlwifi: fw: move SAR defines from acpi.h to regulatory.hAvinash Bhatt2-5/+3
IWL_SAR_ENABLE_MSK and IWL_REDUCE_POWER_FLAGS_POS describe the layout of the shared WRDS/SAR table format. They are not ACPI-specific: the same bit positions are used regardless of whether the data originates from ACPI, UEFI, or another BIOS source. IWL_SAR_ENABLE_MSK was already duplicated in regulatory.h; remove it from acpi.h to eliminate the duplication. Move IWL_REDUCE_POWER_FLAGS_POS to regulatory.h alongside IWL_SAR_ENABLE_MSK so that both SAR field descriptors live in the shared regulatory header, accessible to all BIOS configuration sources. No functional change. Signed-off-by: Avinash Bhatt <avinash.bhatt@intel.com> Link: https://patch.msgid.link/20260717172958.32e5dcde4b90.I420c58b05ab6ab011c4c771ca9e4eb62740de549@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-18wifi: iwlwifi: mld: drop connection on D3 resume failureAyala Beker1-0/+3
When FW crashes on D3 exit, iwl_mld_nic_error() sets STATUS_RESET_PENDING and queues restart wk, but mac80211's resume callback synchronously calls iwl_trans_stop_device() which clears the flag. As a result restart wk skips sw_reset, and the FW error recovery buffer is never read. The new FW boots with empty BA state and initial sequence numbers, while the AP still holds its A-MPDU RX reorder window. This causes MPDUs to be dropped as IWL_RX_MPDU_REORDER_BA_OLD_SN until ADDBA is renegotiated. We don't know how long the firmware has been in an error state or whether the AP still considers us associated, so keeping the connection alive is not worth it. Call ieee80211_resume_disconnect() when iwl_mld_wait_d3_notif() fails, and let userspace reassociate. Signed-off-by: Ayala Beker <ayala.beker@intel.com> Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Link: https://patch.msgid.link/20260717172958.3e10c8498f53.Icf5644b42d79e984ecc16abfa873bd37f611e778@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-18wifi: iwlwifi: mvm: ignore sync frames when sync is disabledEmmanuel Grumbach1-0/+4
Gate time-sync frame interception on the active flag so frames are not queued after time-sync teardown. Assisted-by: GitHubCopilot:GPT-5.3-Codex Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Link: https://patch.msgid.link/20260717172958.ac73ee199a25.Ic1489244f9b02da93060f0a0e5b300a73527f265@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-18wifi: iwlwifi: mld: initialize scan-abort statusEmmanuel Grumbach1-1/+2
Initialize abort status before issuing the abort command so debug logging never reads an uninitialized value on error paths. Assisted-by: GitHubCopilot:GPT-5.3-Codex Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Link: https://patch.msgid.link/20260717172958.9d804f466534.I4e10270bd1dde4a80940a47ef5d383729cc66cb1@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-18wifi: iwlwifi: mld: validate wake packet crypto overheadEmmanuel Grumbach1-6/+57
Wake packet parsing only accounted for FCS and missed per-key IV/ICV overhead for protected data frames. Prevent size underflow and bad packet trimming when notifications are malformed or truncated. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Link: https://patch.msgid.link/20260717172958.e06595623533.Ie09494b7e34e5872b750fd90e325648ee469d0da@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-18wifi: iwlwifi: validate SEC_RT TLV minimum sizeEmmanuel Grumbach1-1/+4
Reject firmware section TLVs that are shorter than the offset field before subtracting sizeof(offset) from the section size. This prevents size underflow for malformed TLVs. Assisted-by: GitHubCopilot:GPT-5.3-Codex Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Link: https://patch.msgid.link/20260717173215.17b040b27edc.I6b32d1e9ad707417e2e604f08a63582456209372@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-18wifi: iwlwifi: uefi: bound PPAG revision bitmap shiftEmmanuel Grumbach1-1/+1
Validate revision is below 32 before BIT(revision) in PPAG parsing. Assisted-by: GitHubCopilot:GPT-5.3-Codex Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Link: https://patch.msgid.link/20260717173215.d116dd2efdc1.I3c6cae5cb9d0acc2d94544bc755b0754a91b10ba@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-18wifi: iwlwifi: acpi: validate WGDS table revision indexEmmanuel Grumbach1-0/+5
Check tbl_rev bounds before BIT(tbl_rev) to avoid undefined shifts when firmware reports an invalid revision value. Assisted-by: GitHubCopilot:GPT-5.3-Codex Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Link: https://patch.msgid.link/20260717173215.52a01f841f2a.Ic0131eaac31d9ff71b169138d9b0865cb39b44a9@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-18wifi: iwlwifi: dbg-tlv: bound aligned TLV walk lengthEmmanuel Grumbach1-2/+11
Validate ALIGN(tlv_len, 4) before advancing through external debug TLVs to prevent parser length underflow. Assisted-by: GitHubCopilot:GPT-5.3-Codex Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Link: https://patch.msgid.link/20260717173215.e08d6550c6ec.Iad64190a7d5cded553aff41973120396aef1b557@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-18wifi: iwlwifi: bound aligned TLV advance in FW parserEmmanuel Grumbach1-2/+11
Validate ALIGN(tlv_len, 4) against remaining parser length before consuming bytes from the firmware image. This avoids length underflow on malformed TLVs. Assisted-by: GitHubCopilot:GPT-5.3-Codex Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Link: https://patch.msgid.link/20260717173215.393c286488f9.Ia39144dc3ca334325ee4eacb7420901e2446fc23@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-18Merge tag 'scsi-fixes' of ↵Linus Torvalds14-49/+138
git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "The biggest core change is the reliable wake fix for scsi_schedule_eh which is used by both libata and libsas which could otherwise cause error handler hangs due to rare races. All other fixes are in drivers (well except the export symbol removal) the next biggest being the target PR-OUT transportid parsing fix" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path scsi: elx: efct: Fix refcount leak in efct_hw_io_abort() scsi: elx: efct: Fix I/O leak on unsupported additional CDB scsi: core: wake eh reliably when using scsi_schedule_eh scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE scsi: target: Bound PR-OUT TransportID parsing to the received buffer scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() scsi: sg: Report request-table problems when any status is set scsi: ufs: core: tracing: Do not dereference pointers in TP_printk() scsi: bfa: Reduce kernel stack usage in bfa_fcs_lport_fdmi_build_portattr_block() scsi: xen: scsiback: Free the command tag on the TMR submit-failure path scsi: xen: scsiback: Free unsubmitted command instead of double-putting it scsi: core: Remove export for scsi_device_from_queue()
2026-07-18clk: samsung: pll: use kzalloc_flexRosen Penev1-30/+26
Simplify allocation by using a flexible array member to combine allocations and remove a kfree. Use __counted_by for extra runtime analysis. Since rate_table is now a flexible array member, NULL checks don't work. So use the counting variable to check allocation. Signed-off-by: Rosen Penev <rosenp@gmail.com> Link: https://patch.msgid.link/20260629032540.2331559-4-rosenp@gmail.com Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>