summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)AuthorFilesLines
2026-07-28clk: tegra: support 48MHz clock for pll_p_out1Dmitry Osipenko1-0/+1
UEFI on Surface2 sets pll_p_out1 to 48MHz which is not supported by kernel and causes BUG() early on. Add 48MHz clock support for pll_p_out1. Acked-by: Thierry Reding <treding@nvidia.com> Signed-off-by: Dmitry Osipenko <digetx@gmail.com> Signed-off-by: Jonas Schwöbel <jonasschwoebel@yahoo.de> Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: aspeed: add AST2700 PECI clockRyan Chen1-0/+10
Register the SoC1 PECI clock as a mux selected by SCU1_CLK_SEL2 bit 16, choosing between the 25MHz CLKIN and HPLL/4. Add the HPLL/4 fixed factor clock to serve as the second mux parent. Signed-off-by: Ryan Chen <ryan_chen@aspeedtech.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: mediatek: Add mt8173-mfgtop driverChen-Yu Tsai3-0/+253
The MFG (GPU) block on the MT8173 has a small glue layer, named MFG_TOP in the datasheet, that contains clock gates, some power sequence signal delays, and other unknown registers that get toggled when the GPU is powered on. The clock gates are exposed as clocks provided by a clock controller, while the power sequencing bits are exposed as one singular power domain. Tested-by: Icenowy Zheng <zhengxingda@iscas.ac.cn> Reviewed-by: Brian Masney <bmasney@redhat.com> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Chen-Yu Tsai <wenst@chromium.org> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: tegra: clean-up simple provider misuse of the consumer APIJerome Brunet1-1/+1
Clock provider should not be using the consumer interface. In other words, a provider should not be dealing with struct clk. This change targets occurrences for which the provider uses the consumer interface and corresponding clk_hw interface exist. Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Jerome Brunet <jbrunet@baylibre.com> Reviewed-by: Thierry Reding <treding@nvidia.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: st: clean-up simple provider misuse of the consumer APIJerome Brunet1-10/+10
Clock provider should not be using the consumer interface. In other words, a provider should not be dealing with struct clk. This change targets occurrences for which the provider uses the consumer interface and corresponding clk_hw interface exist. Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Jerome Brunet <jbrunet@baylibre.com> Reviewed-by: Thierry Reding <treding@nvidia.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: mvebu: clean-up simple provider misuse of the consumer APIJerome Brunet1-1/+1
Clock provider should not be using the consumer interface. In other words, a provider should not be dealing with struct clk. This change targets occurrences for which the provider uses the consumer interface and corresponding clk_hw interface exist. Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Jerome Brunet <jbrunet@baylibre.com> Reviewed-by: Thierry Reding <treding@nvidia.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: remove conditional return with no effectSang-Heon Jeon2-13/+5
Both branches of the check return the same value, so the check has no effect. Remove it and return the value directly. In the lmk04832 driver, the hardware sequence comments are moved above the final return by hand. This is the result of running the Coccinelle script from scripts/coccinelle/misc/cond_return_no_effect.cocci. Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: Add devm_clk_bulk_get_enable()Suraj Gupta1-0/+7
devm_clk_bulk_get_optional_enable() gets, prepares and enables a set of clocks with device-managed cleanup, but treats every clock as optional: a missing clock is silently returned as NULL instead of failing. Consumers that need a fixed set of mandatory clocks enabled for the lifetime of the device currently have to open-code devm_clk_bulk_get() followed by clk_bulk_prepare_enable(), which loses the managed disable on unbind, or fall back to per-clock devm_clk_get_enabled() calls. Add devm_clk_bulk_get_enable() as the non-optional counterpart. The underlying __devm_clk_bulk_get_enable() helper already supports the required (optional = false) path, so only export a thin wrapper for it. Signed-off-by: Suraj Gupta <suraj.gupta2@amd.com> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: en7523: add support for dedicated PCIe PERSTOUT resetChristian Marangi1-10/+26
Add support for resetting the PCIe lines with the PERSTOUT reset. These special reset are controlled by the PCIC register and are specific to each of the 3 PCIe lines. Contrary to the dedicated reset register where 0 deassert and 1 assert the reset line for the related bit, for PCIe PERSTOUT reset in the PCIC register, the deassert and assert value is swapped, with 1 for deassert and 0 for assert. (HW have these bit set as 1 by default after a cold boot) This is internally handled in the reset function. PCI enable/disable are updated to drop PERSTOUT bits in favor dedicated reset handling. Signed-off-by: Christian Marangi <ansuelsmth@gmail.com> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28reset: cix: add sky1 audss auxiliary reset driverJoakim Zhang3-0/+141
Add an auxiliary reset controller driver for the AUDSS CRU. Sixteen software reset lines for audio subsystem peripherals are controlled through one register in the CRU register map. The driver is created by the AUDSS clock platform driver and registers the reset controller on the CRU device node. Signed-off-by: Joakim Zhang <joakim.zhang@cixtech.com> Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de> Acked-by: Philipp Zabel <p.zabel@pengutronix.de> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: cix: add sky1 audss clock controllerJoakim Zhang5-0/+1227
Add a platform driver for the Cix Sky1 AUDSS CRU. The driver maps the CRU registers and registers mux, divider and gate clocks for DSP, SRAM, HDA, DMAC, I2S, mailbox, watchdog and timer blocks. Four SoC-level audio reference clocks are enabled as inputs to the internal clock tree. The driver releases the AUDSS NOC reset, enables runtime PM and instantiates the auxiliary reset device. Signed-off-by: Joakim Zhang <joakim.zhang@cixtech.com> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: ultrarisc: Add DP1000 clock driverJia Wang7-0/+648
Add a clock driver for the UltraRISC DP1000 SoC. The clock tree is driven by a SYSPLL and provides fixed-factor clocks for the subsystem and PCIe, divider-based root clocks for GMAC and the UART, I2C, and SPI blocks, and per-instance gate clocks for UART0-3, I2C0-3, and SPI0-1. Signed-off-by: Jia Wang <wangjia@ultrarisc.com> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: composite: Export devm composite pdata helperJia Wang1-0/+1
Allow modular clock drivers to use devm_clk_hw_register_composite_pdata() by exporting the helper. The non-devm composite helpers are already available to modules. Export this devm variant as well so users do not need to open-code devres cleanup. Signed-off-by: Jia Wang <wangjia@ultrarisc.com> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: hisilicon: hi3660-stub: use devm_platform_ioremap_resourceRosen Penev1-7/+3
Replace the open-coded platform_get_resource() plus devm_ioremap() sequence with devm_platform_ioremap_resource(), which fetches the resource, requests the region and maps it in one call. Switch the error check to IS_ERR()/PTR_ERR() and drop the now-unused struct resource pointer. The only in-tree user (stub_clock@e896b500 in hi3660.dtsi) has a single 0x100-byte reg region, so the region reservation added by devm_ioremap_resource() is exclusive and does not introduce overlap failures. Built for ARM (drivers/clk/hisilicon/clk-hi3660-stub.o) with LLVM=1. Assisted-by: opencode:hy3-free Signed-off-by: Rosen Penev <rosenp@gmail.com> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: stm32: allow STM32MP COMPILE_TEST buildsRosen Penev1-1/+1
COMMON_CLK_STM32MP already allows COMPILE_TEST, but the parent clock Makefile only descends into drivers/clk/stm32 for ARCH_STM32. Use the STM32MP clock symbol for that directory gate instead. Tested with: make LLVM=1 ARCH=loongarch drivers/clk/stm32/ Assisted-by: Codex:GPT-5.5 Signed-off-by: Rosen Penev <rosenp@gmail.com> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: stm32: add missing bitfield.h headerRosen Penev2-0/+2
It seems some ARM header includes this and the build passes there, but nowhere else. Note that the driver has COMPILE_TEST in depends. Fixes: 37ae8501cdb0 ("clk: stm32: introduce clocks for STM32MP21 platfor") Signed-off-by: Rosen Penev <rosenp@gmail.com> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk/x86: pmc_atom: add kasprintf return value checklonglong yan1-0/+3
The kasprintf() function returns NULL on memory allocation failure, but the code in plt_clk_register() was not checking this return value. If kasprintf fails, init.name would be NULL and could cause NULL pointer dereference when clkdev_hw_create() uses it. Add proper error checking for the kasprintf() return value and return ERR_PTR(-ENOMEM) on failure. Fixes: 1141d9d08184 ("clk: x86: Add Atom PMC platform clocks") Signed-off-by: longlong yan <yanlonglong@kylinos.cn> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: mmp: pxa1908-apbcp: Remove unneeded semicolonChen Ni1-1/+1
Remove unnecessary semicolons reported by Coccinelle/coccicheck and the semantic patch at scripts/coccinelle/misc/semicolon.cocci. Signed-off-by: Chen Ni <nichen@iscas.ac.cn> Reviewed-by: Brian Masney <bmasney@redhat.com> Acked-by: Duje Mihanović <duje@dujemihanovic.xyz> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: mmp: pxa1908-apbc: Remove unneeded semicolonChen Ni1-1/+1
Remove unnecessary semicolons reported by Coccinelle/coccicheck and the semantic patch at scripts/coccinelle/misc/semicolon.cocci. Signed-off-by: Chen Ni <nichen@iscas.ac.cn> Reviewed-by: Brian Masney <bmasney@redhat.com> Acked-by: Duje Mihanović <duje@dujemihanovic.xyz> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: palmas: Use devm_of_clk_add_hw_provider()Myeonghun Pak1-8/+2
Use devm_of_clk_add_hw_provider() to register the clock provider so its lifetime is tied to the device. This removes the need for a remove callback that only unregisters the provider. Co-developed-by: Ijae Kim <ae878000@gmail.com> Signed-off-by: Ijae Kim <ae878000@gmail.com> Signed-off-by: Myeonghun Pak <mhun512@gmail.com> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: palmas: Manage external-control prepare with devmMyeonghun Pak1-1/+13
palmas_clks_init_configure() prepares the clock when an external control pin is configured. The current driver only drops that prepare reference when external control configuration fails. If provider registration fails after that point, or if the driver is later removed, the prepare reference remains held. Register a device-managed action after clk_prepare() succeeds. This balances the prepare reference on subsequent probe failure and driver removal. Fixes: 942d1d674931 ("clk: Add driver for Palmas clk32kg and clk32kgaudio clocks") Co-developed-by: Ijae Kim <ae878000@gmail.com> Signed-off-by: Ijae Kim <ae878000@gmail.com> Signed-off-by: Myeonghun Pak <mhun512@gmail.com> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: eswin: Zero-initialize stack-allocated clk_init_dataKostas Damaskinakis1-2/+2
eswin_clk_register_pll() and eswin_register_clkdiv() declare a struct clk_init_data on the stack and only initialize some of its fields (parent_data respectively parent_hws). clk_core_populate_parent_map() checks parent_names first and parent_data second before falling back to parent_hws, so leftover stack garbage in the uninitialized fields hijacks parent resolution and the clk core dereferences a bogus pointer: Unable to handle kernel NULL pointer dereference at virtual address 000000000000000c Oops [#1] epc : __clk_register+0x31a/0x7f0 [<ffffffff805dc774>] __clk_register+0x31a/0x7f0 [<ffffffff805dcd76>] devm_clk_hw_register+0x2a/0x94 [<ffffffff805e319a>] eswin_register_clkdiv+0x80/0xd0 [<ffffffff805e34a0>] eswin_clk_register_clks+0x162/0x1a0 [<ffffffff805e3736>] eic7700_clk_probe+0x146/0x180 [<ffffffff8065d23c>] platform_probe+0x3c/0x7a Observed on EIC7700 hardware (with the driver backported to a 6.17 tree); whether the bug triggers depends entirely on what the stack happens to contain when the registration helpers run. Zero-initialize both structures. Fixes: cd44f127c1d4 ("clk: eswin: Add eic7700 clock driver") Signed-off-by: Kostas Damaskinakis <kostas.damaskinakis@gmail.com> Reviewed-by: Brian Masney <bmasney@redhat.com> Acked-by: Xuyang Dong <dongxuyang@eswincomputing.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error pathLouis-Alexis Eyraud1-49/+49
When mtk_clk_register_pllfhs function fails to register a PLL, it unregisters all PLLs and cleans up itself in its error path before returning, so the function callers don't need to do it. But contrary to mtk_clk_unregister_pllfhs function, that does almost the same sequence, it does not free the IO memory mapped on fhctl node, leading to a leak. Fix this leak by factorizing the cleanup sequence in a new private function and use it both mtk_clk_register_pllfhs and mtk_clk_unregister_pllfhs functions. Also, change the loop index start value to avoid the -1 operation on index at each loop. Fixes: d7964de8a8ea ("clk: mediatek: Add new clock driver to handle FHCTL hardware") Signed-off-by: Louis-Alexis Eyraud <louisalexis.eyraud@collabora.com> Reviewed-by: Brian Masney <bmasney@redhat.com> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: tegra: tegra124-emc: put EMC node on register failureGuangshuo Li1-0/+1
tegra124_clk_register_emc() stores a device node reference returned by of_parse_phandle() in tegra->emc_node. If clk_register() fails, the function returns an error before that reference can be consumed and released by the normal runtime path. The tegra_clk_emc object is freed on this failure path, but freeing the object does not drop the OF node reference stored in it. Drop the EMC node reference before freeing the tegra_clk_emc object. of_node_put() is safe for a NULL node, so this also covers the case where the phandle is absent. Fixes: 2db04f16b589 ("clk: tegra: Add EMC clock driver") Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: en7523: reset PCIE HB on init for AN7581Christian Marangi1-0/+7
It was reported that PCIE HB should be reset for AN7581 or some instability or link training issue will be present on warm boot scenario. Reset PCIE HB on clk HW init to handle warm boot problem with PCIe. Signed-off-by: Christian Marangi <ansuelsmth@gmail.com> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: mediatek: remove unneeded 'fast_io' parameter in regmap_configWolfram Sang1-1/+0
When using MMIO with regmap, fast_io is implied. No need to set it again. Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Reviewed-by: Brian Masney <bmasney@redhat.com> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: mediatek: mt6735-vencsys: add missing MODULE_DEVICE_TABLE()Pengpeng Hou1-0/+1
The driver has an OF match table wired to .of_match_table, but does not export the table with MODULE_DEVICE_TABLE(). Add the missing MODULE_DEVICE_TABLE(of, ...) entry so module alias information is generated for OF based module autoloading. This is a source-level fix. It does not claim dynamic hardware reproduction; the evidence is the driver-owned match table, its use by the platform driver, and the missing module alias publication. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: mediatek: mt6735-vdecsys: add missing MODULE_DEVICE_TABLE()Pengpeng Hou1-0/+1
The driver has an OF match table wired to .of_match_table, but does not export the table with MODULE_DEVICE_TABLE(). Add the missing MODULE_DEVICE_TABLE(of, ...) entry so module alias information is generated for OF based module autoloading. This is a source-level fix. It does not claim dynamic hardware reproduction; the evidence is the driver-owned match table, its use by the platform driver, and the missing module alias publication. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: si544: add support for si549Pavel Löbl2-20/+68
Add support for Si549, which only differs from Si544 in internal oscilator frequency. Si549 also comes in three types A,B and C. Each having different maximum output frequency. This patch also fixes maximum frequency of Si544 C. Which should be 325MHz according to datasheet. Signed-off-by: Pavel Löbl <pavel@loebl.cz> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28clk: lan966x: Add MCHP_LAN966X_PCI dependencyHerve Codina1-1/+1
The lan966x clock controller depends on the LAN969x architecture or the LAN966x SoC. This clock controller can be used by the LAN966x PCI device and so it needs to be available when the LAN966x PCI device is enabled. Signed-off-by: Herve Codina <herve.codina@bootlin.com> Acked-by: Stephen Boyd <sboyd@kernel.org> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-07-28media: em28xx: defer audio-only extension registrationDiego Fernando Mancera Gomez1-2/+1
The audio-only path registers extensions while probing the primary device. For a dual-TS board, this happens before dev_next is created. The duplicate device inherits is_audio_only and is then independently inserted into em28xx_devlist. The list is intended to contain only primary devices: extension operations reach the secondary device through dev_next. The independently linked secondary can be freed during disconnect while its list node remains reachable, resulting in a use-after-free. Defer audio-only extension registration to the module-request work item. It runs only after probing has completed construction of the optional secondary device, so only the primary is registered and extension callbacks reach the secondary through dev_next. Fixes: 4a089668ef22 ("media: em28xx-cards: rework the em28xx probing code") Cc: stable@vger.kernel.org Reported-by: syzbot+a11c46f37ee083a73deb@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/66ec3c83.050a0220.29194.002f.GAE@google.com/T/ Suggested-by: Fedor Pchelkin <pchelkin@ispras.ru> Signed-off-by: Diego Fernando Mancera Gomez <diegomancera.dev@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-28wifi: mwifiex: Remove WQ_HIGHPRI from main workqueueFabio Estevam1-2/+2
The MWIFIEX_WORK_QUEUE handles command and event processing, including the commands used for scheduled scans. Running this work on the high-priority worker pool can interfere with latency-sensitive workloads. On an i.MX8MP-based audio system using an 88W8997, background scheduled scans caused audible glitches in USB audio playback. Remove WQ_HIGHPRI from the main workqueue so that command and scan processing use the normal-priority worker pool. Leave the RX and host MLME workqueues unchanged. Signed-off-by: Fabio Estevam <festevam@nabladev.com> Link: https://patch.msgid.link/20260724203320.78793-2-festevam@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-28wifi: mwifiex: Detach sync cmd buffer on interrupted waitFabio Estevam1-0/+12
mwifiex synchronous commands keep the caller-provided data buffer in cmd_node->data_buf. Several callers pass stack-allocated objects there. If wait_event_interruptible_timeout() is interrupted, the caller can return and release that stack object while the firmware command is still the current command. A late firmware response then reaches the normal response handler, which can copy data through cmd_node->data_buf into the stale stack address. This fixes a stack corruption observed during repeated association and disassociation cycles. The panic trace showed the command wait being interrupted immediately before a bad pointer dereference: cmd_wait_q terminated: -512 Unable to handle kernel paging request at virtual address 002c583837384662 Kernel panic - not syncing: stack-protector: Kernel stack is corrupted ... Tainted: [M]=MACHINE_CHECK The fault address decodes as little-endian ASCII: 0x002c583837384662 -> "bF878X,\0" which is a fragment of the VERSION_EXT firmware string exposed as debugfs "verext": w8997o-V4, RF878X, FP92, 16.92.21.p153.7 The same runs also showed corrupted control data containing: 0x2400372e333531 -> "153.7\0$" which is the tail of the same VERSION_EXT string. This points at a late VERSION_EXT response writing through a stale stack-backed data_buf after the interrupted wait returned. After cancelling pending commands on an interrupted or timed-out wait, detach the caller-owned data buffer from the still-current command. This preserves the existing command cancellation behaviour while preventing a late response from writing through a pointer whose lifetime ended with the waiting caller. Tested on an i.MX8MP board using an 88W8997. Cc: stable@vger.kernel.org Fixes: 3d026d09b28d ("mwifiex: cancel pending commands for signal") Signed-off-by: Fabio Estevam <festevam@nabladev.com> Link: https://patch.msgid.link/20260724203320.78793-1-festevam@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-28wifi: nxpwifi: reject zero-length extension elements in beacon IEsLinmao Li1-0/+3
nxpwifi_update_bss_desc_with_ie() dispatches on elem->data[0] for WLAN_EID_EXTENSION without checking that the element has a payload. A well-formed extension element carries at least the element ID extension byte, but nothing enforces that in the IE stream, and the loop accepts a zero-length element because its header alone fits. elem->data[0] then reads the byte after the element, which is past the kmemdup()ed IE buffer when that element ends the stream. Fixes: 73b01e57ed3e ("wifi: nxp: add nxpwifi driver for IW61x") Signed-off-by: Linmao Li <lilinmao@kylinos.cn> Link: https://patch.msgid.link/20260724103656.2494129-1-lilinmao@kylinos.cn Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-28Merge tag 'iwlwifi-next-2026-07-23' of ↵Johannes Berg43-181/+535
https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next Miri Korenblit says: ==================== wifi: iwlwifi: updates - 2026-07-23 This comtains the usual features, fixes and cleanups. Notably: - Small fixes of bugs reported by LLMs - LARI command version 14 and 15 - MCC command version 10 - Support for core 107 ==================== Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-28net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controllerChenguang Zhao1-1/+1
mtk_handle_irq_rx expects a struct mtk_eth * (matching the request_irq cookie), but mtk_poll_controller incorrectly passed the net_device *. Calling ndo_poll_controller with CONFIG_NET_POLL_CONTROLLER enabled would then crash. Fixes: 8186f6e382d8 ("net-next: mediatek: fix compile error inside mtk_poll_controller()") Signed-off-by: Chenguang Zhao <zhaochenguang@kylinos.cn> Link: https://patch.msgid.link/20260723055735.885112-1-chenguang.zhao@linux.dev Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-28wifi: iwlegacy: replace BUG_ON() with WARN_ON() on num_stations checkStanislaw Gruszka2-4/+5
BUG_ON() for il->num_stations < 0 can happen in real word, see https://bugzilla.kernel.org/show_bug.cgi?id=221733 Replace BUG_ON() with WARN_ON() (and reset the counter to 0) to do not put whole system to inconsistent state on the condition. Also allocate debugfs buffer for all stations (32 or 25) to do not use num_stations since it might not be right. Signed-off-by: Stanislaw Gruszka <stf_xl@wp.pl> Link: https://patch.msgid.link/20260724095545.33647-1-stf_xl@wp.pl [clarify commit message wrt. debugfs buffer] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-28gve: add XDP metadata support for DQ RDAJoshua Washington1-1/+1
Commit 1b42e07af1ee ("gve: Add Rx HWTS metadata to AF_XDP ZC mode") exposes support for the XDP RX timestamping metadata operation in the DQ RDA mode. While the operation works on its own, the intent was to enable XDP metadata support for the queue format as a whole along with it. Currently bpf_xdp_adjust_meta fails because meta_valid is set to false. This change updates xdp_buff preparation to set meta_valid to true, so metadata can be fully used by XDP programs. Reviewed-by: Harshitha Ramamurthy <hramamurthy@google.com> Reviewed-by: Jordan Rhee <jordanrhee@google.com> Signed-off-by: Joshua Washington <joshwash@google.com> Link: https://patch.msgid.link/20260722221634.186886-3-joshwash@google.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-28gve: use xdp_build_skb methods for XDP_PASS caseJoshua Washington1-4/+9
Newer common methods have been introduced to construct SKBs in the event of XDP_PASS because many drivers replicated very similar functionality. Update GVE to use these common methods for copy mode and zero-copy mode. Reviewed-by: Harshitha Ramamurthy <hramamurthy@google.com> Reviewed-by: Jordan Rhee <jordanrhee@google.com> Signed-off-by: Joshua Washington <joshwash@google.com> Reviewed-by: Larysa Zaremba <larysa.zaremba@intel.com> Link: https://patch.msgid.link/20260722221634.186886-2-joshwash@google.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-28media: cx88: fix memory leak in cx8802_register_driver() error pathChen Changcheng1-0/+1
In cx8802_register_driver(), when drv->probe(driver) fails (non-zero), the allocated cx8802_driver struct is freed neither in the else branch nor later in cx8802_unregister_driver() (which only frees entries that were added to dev->drvlist on success). Each failed probe leaks the driver struct. Add kfree(driver) in the else branch to fix the leak. Signed-off-by: Chen Changcheng <chenchangcheng@kylinos.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-28media: remove conditional return with no effectSang-Heon Jeon8-49/+9
Both branches of the check return the same value, so the check has no effect. Remove it and return the value directly. This is the result of running the Coccinelle script from scripts/coccinelle/misc/cond_return_no_effect.cocci. Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com> Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-28media: cec: tegra: Remove redundant dev_err()Pan Chuang1-4/+1
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_threaded_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() calls. Signed-off-by: Pan Chuang <panchuang@vivo.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-28media: cec: seco: Remove redundant dev_err()Pan Chuang1-1/+0
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_threaded_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() calls. Signed-off-by: Pan Chuang <panchuang@vivo.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-28media: cec: ao-cec: Remove redundant dev_err()Pan Chuang2-6/+2
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_threaded_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() calls. Signed-off-by: Pan Chuang <panchuang@vivo.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-28media: tegra-video: Fix length warnings in tegra20.cFaisal Mukhtar1-2/+4
Wrap long function arguments under the starting parentheses because of line length style warning reported by checkpatch.pl Signed-off-by: Faisal Mukhtar <mukhtarfaisal03@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-28media: vimc: fix pixel format lookup in enum_framesizesArash Golgol1-2/+2
vimc_capture_enum_framesizes() looks up the requested format using vimc_pix_map_by_code(), which searches the pix map table by media bus code (MEDIA_BUS_FMT_*). However, v4l2_frmsizeenum::pixel_format holds a V4L2 pixel format (V4L2_PIX_FMT_*), not a media bus code, so valid pixel formats end up being rejected with -EINVAL. Fix this by using vimc_pix_map_by_pixelformat() instead, which performs the lookup by pixel format as the ioctl expects. Fixes: 09c41a23a2e2 ("media: Revert "media: vimc: propagate pixel format in the stream"") Cc: stable@vger.kernel.org Signed-off-by: Arash Golgol <arash.golgol@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-28media: cx23885: cancel NetUP CI work before teardownFan Wu1-0/+1
netup_ci_exit() frees a netup_ci_state while its work item, netup_read_ci_status(), may still be pending or running on the system workqueue. The worker obtains the state with container_of() and dereferences it, so it must not outlive the state. netup_ci_init() queues the initial status read, and CI GPIO interrupts subsequently queue the same work from netup_ci_slot_status(). During remove, cx23885_finidev() calls free_irq() before the CI device is unregistered. free_irq() prevents further IRQ handlers from running, but does not drain work queued previously, so the worker can run after netup_ci_exit() frees the state. Call cancel_work_sync() before dvb_ca_en50221_release() and kfree(). This issue was found by an in-house static analysis tool. Fixes: c184dcd28233 ("V4L/DVB (10798): Add CIMax(R) SP2 Common Interface code for NetUP Dual DVB-S2 CI card") Cc: stable@vger.kernel.org Assisted-by: Codex:gpt-5.6 Signed-off-by: Fan Wu <fanwu01@zju.edu.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-28media: v4l2-ctrls: Allow unknown HDR10 white point and luminanceMing Qian1-16/+33
SMPTE ST 2086 defines the nominal ranges for mastering display chromaticity and luminance values. Its Annex A also documents that CTA 861-G uses zero maximum and minimum luminance values to signal that the corresponding values are unknown, and the xy chromaticity coordinate (0, 0) to signal that the white point chromaticity is unknown. The V4L2 HDR10 mastering display compound control currently rejects these values. Consequently, an unknown white point or luminance value prevents the entire compound control from being updated, making the other valid mastering display metadata unavailable to userspace. Accept (0, 0) as an unknown white point and zero as an unknown maximum or minimum mastering luminance. Continue to reject partially zero white point coordinates and non-zero values outside the nominal ranges. Display primary validation remains unchanged. Document the newly accepted unknown values in the V4L2 userspace API. Fixes: 1ad0de78e794 ("media: v4l: Add HDR10 static metadata controls") Cc: stable@vger.kernel.org Signed-off-by: Ming Qian <ming.qian@oss.nxp.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-28media: tda18250: fix possible integer overflowIlya Krutskih1-2/+2
Integer overflow may occur, when variable exp equals to zero. Result of shift 1 << (exp - 1) may then leads to undefined behavior. Fixes: 148abd3b5b14 ("media: tda18250: support for new silicon tuner") Cc: stable@vger.kernel.org Signed-off-by: Ilya Krutskih <devsec@tpz.ru> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-28media: saa7164: fix cleanup on resource allocation failureGuangshuo Li1-3/+5
saa7164_dev_setup() adds the device to the global saa7164_devlist before requesting the PCI BAR memory regions. If get_resources() fails, saa7164_dev_setup() decrements the device count and returns an error, but leaves the device on saa7164_devlist. The probe error path then frees the device, leaving a dangling entry on the global list. Reuse the existing MMIO mapping error path to remove the device from saa7164_devlist and decrement the device count before returning. Also release BAR0 if it was successfully requested but the BAR2 request fails. Fixes: 443c1228d505 ("V4L/DVB (12923): SAA7164: Add support for the NXP SAA7164 silicon") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
generated by cgit (git 2.54.0.dirty) at 2026-09-29 23:09:24 +0000