Commit graph

1,482,218 commits

Author SHA1 Message Date
Ping-Ke Shih
b7911466b6 wifi: rtw89: 8922d: set ANA CLK enter to 500KHz
To power save, change the clock of ANA hardware from 12MHz to 500KHz.

Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260707091056.42771-11-pkshih@realtek.com
2026-07-12 09:37:11 +08:00
Ping-Ke Shih
47ad03f1ec wifi: rtw89: add thermal protect by digital voltage reduction
The temperature is rising when WiFi does high throughput, and reduce
voltage is a way to ease temperature.

The existing method to do thermal protect is to reduce TX duty, which
can affect throughput obviously. Before doing reduce TX duty (with -20
thermal value offset), driver does voltage reduction first, which doesn't
affect throughput but lower power consumption.

The voltage gram of register is 0.01 voltage, and the suggested maximum
reduction is 6 grams, which driver defines 6 as maximum voltage level.
When thermal value is over threshold, driver will try to adjust level and
corresponding register value. It should be adjust grams one by one with
additional 50 ms delay to ensure hardware work properly.

A note that the voltage must reset to normal value before entering power
save mode, otherwise WiFi card might get lost. Since it takes 50 ms delay
for each gram to adjust voltage, we stop to enter power save if protect
level is not zero.

By the way, adjust thermal threshold to 0xB4 as desired.

Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260707091056.42771-10-pkshih@realtek.com
2026-07-12 09:35:23 +08:00
Ping-Ke Shih
4e199cd666 wifi: rtw89: 8922d: read default digital voltage calibration values
In order to lower temperature when WiFi is running, reduce the digital
voltage for the purpose.

The calibration values of digital voltage are programmed in efuse. One is
for normal use, which driver stores it into hal->thermal_prot_vmax. The
other is the minimum voltage, which is stored into hal->thermal_prot_vmin.
These two values define a range of supported voltage, which latter patch
uses them to adjust voltage depends on thermal value (temperature).

Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260707091056.42771-9-pkshih@realtek.com
2026-07-12 09:33:34 +08:00
Ping-Ke Shih
4260edb3b1 wifi: rtw89: efuse: read thermal calibration value for RTL8922D
The thermal calibration value programmed in efuse is the offset to adjust
thermal value read from hardware, so that output will be accurate.

Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260707091056.42771-8-pkshih@realtek.com
2026-07-12 09:31:47 +08:00
Ping-Ke Shih
d193bdc733 wifi: rtw89: efuse: no need to export rtw89_efuse_read_ecv_be()
The consumer of rtw89_efuse_read_ecv_be() is in the same ko. No need to
export it.

Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260707091056.42771-7-pkshih@realtek.com
2026-07-12 09:31:37 +08:00
Ping-Ke Shih
390f58e29d wifi: rtw89: 8922d: set TX compensation by format v2
The total number of TX compensation registers is 22, including 7 base and
15 ones according to operating channel.

The v0 is 22 ones per channel. To reduce array size, v1 treats 7 base as
common part across all conditions. However, we can fine tune the base part
to yield better performance, so divide base into two sets according to NSS.
Summarize dimensions as follows

	base (7)		vals(15)
  v0	nss * band * path	nss * band * path
  v1	1			nss * band * path
  v2	nss			nss * band * path

Currently, v1 and v2 can present in a file, but only one fw element with
a specific format will be used for specific RFE type.

Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260707091056.42771-6-pkshih@realtek.com
2026-07-12 09:31:31 +08:00
Eric Huang
852927114f wifi: rtw89: phy: fix bandedge primary channel for 2.4GHz 40MHz and 6GHz
Correct 2.4GHz bandwidth 40MHz bandedge check: pri_ch 5/9 instead of 3/11.
Remove stale 6GHz bandedge case; no restricted band borders 6GHz range.

Signed-off-by: Eric Huang <echuang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260707091056.42771-5-pkshih@realtek.com
2026-07-12 09:31:19 +08:00
Eric Huang
8da4883c81 wifi: rtw89: 8922d: fix EMLSR BB switch sequence for MLO mode transition
Assert BB reset in the intermediate "switch to 1+1" step of the EMLSR
switch sequence for all three MLO mode transitions by updating the
B_EMLSR_SWITCH_BE4 intermediate value from 0xAFFF to 0x3BAB.

Without the BB reset in this step, the baseband can be left in an
inconsistent state before settling into the final MLO configuration.

Signed-off-by: Eric Huang <echuang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260707091056.42771-4-pkshih@realtek.com
2026-07-12 09:29:43 +08:00
Eric Huang
daa3fda5ae wifi: rtw89: 8922d: dynamic adjust channel smoothing
Add support for path difference based channel smoothing for RTL8922D chip.
This feature measures the ratio of NDP frames and uses a moving average
filter to decide whether to enable beamforming channel smoothing. Tone
index selection is dynamically adjusted based on bandwidth and link mode
(HE/EHT vs VHT). The feature is only enabled for RTL8922D_CID7090 variant.

Signed-off-by: Eric Huang <echuang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260707091056.42771-3-pkshih@realtek.com
2026-07-12 09:27:45 +08:00
Eric Huang
be8aedb68c wifi: rtw89: 8922d: remove CCK bandwidth compensation
Remove the 40MHz bandwidth compensation from CCK efuse gain calculation.
The design no longer requires the +3dB compensation for 40MHz channels.

Signed-off-by: Eric Huang <echuang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260707091056.42771-2-pkshih@realtek.com
2026-07-12 09:27:39 +08:00
Ching-Te Ku
d01bcd34dd wifi: rtw89: coex: Add Co-RX logic
Co-RX means Wi-Fi & Bluetooth can be able to RX in the same time. This
patch is for judging the Wi-Fi/Bluetooth condition could be Co-RX or not,
and how to set the gain and power.

Signed-off-by: Ching-Te Ku <ku920601@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260706025445.18428-10-pkshih@realtek.com
2026-07-12 09:15:26 +08:00
Ching-Te Ku
36f90091ee wifi: rtw89: coex: Update scoreboard related logic for dual Bluetooth
Update WiFi status to each Bluetooth & collect status from the two
Bluetooth adapter by non-stop power zone register. To correct the meaning
of variable, redefine the naming for the variables.

Signed-off-by: Ching-Te Ku <ku920601@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260706025445.18428-9-pkshih@realtek.com
2026-07-12 09:13:38 +08:00
Ching-Te Ku
3244261af9 wifi: rtw89: coex: Add TDMA binding for dual MAC
Because the two MAC should have their own individual using, they will
need different TDMA mechanism. This patch will bind TDMA with MAC index,
and also the corresponding antenna, hardware grant signal setting.

Signed-off-by: Ching-Te Ku <ku920601@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260706025445.18428-8-pkshih@realtek.com
2026-07-12 09:11:49 +08:00
Ching-Te Ku
564dd7a950 wifi: rtw89: coex: Add WiFi/Bluetooth adapter binding info
To bind Wi-Fi/Bluetooth with which adapter, in which band.

Signed-off-by: Ching-Te Ku <ku920601@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260706025445.18428-7-pkshih@realtek.com
2026-07-12 09:10:05 +08:00
Ching-Te Ku
fe8f6ddb90 wifi: rtw89: coex: Add Bluetooth binding for Bluetooth RX gain setting
Dual Bluetooth the each of Bluetooth may use different RX gain by their
condition.

Signed-off-by: Ching-Te Ku <ku920601@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260706025445.18428-6-pkshih@realtek.com
2026-07-12 09:09:49 +08:00
Ching-Te Ku
2b497ba92a wifi: rtw89: coex: Add Bluetooth binding for Bluetooth TX power setting
Dual Bluetooth the each of Bluetooth may use different TX power by their
condition.

Signed-off-by: Ching-Te Ku <ku920601@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260706025445.18428-5-pkshih@realtek.com
2026-07-12 09:08:03 +08:00
Ethan Nelson-Moore
1ecb29b084 x86/cpu: Remove Makefile rule for removed UMC CPU support
Support for UMC CPUs was removed in

  7d328c5de4 ("x86/cpu: Remove CPU_SUP_UMC_32 support"),

but a Makefile rule for the support code remained. Remove it.

Fixes: 7d328c5de4 ("x86/cpu: Remove CPU_SUP_UMC_32 support")
Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Ahmed S. Darwish <darwi@linutronix.de>
Link: https://patch.msgid.link/20260610033252.164571-1-enelsonmoore@gmail.com
2026-07-11 18:07:30 -07:00
Ching-Te Ku
2c5af47081 wifi: rtw89: coex: Update TDMA descriptor for dual MAC
The mechanism needs information to know which MAC is coexisting with which
Bluetooth and when to enable TDMA with which MAC. So change an variable to
describe the binding target.

Signed-off-by: Ching-Te Ku <ku920601@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260706025445.18428-4-pkshih@realtek.com
2026-07-12 09:06:22 +08:00
Ching-Te Ku
c595e0a095 wifi: rtw89: coex: add rtw89_btc_init() entry for initialization once
Separate these two type of initialize entry. Because Wi-Fi power save
leaving will also call the initializing, but don't have to reset all the
stored variables.

Signed-off-by: Ching-Te Ku <ku920601@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260706025445.18428-3-pkshih@realtek.com
2026-07-12 09:05:29 +08:00
Ching-Te Ku
0b79ae7b09 wifi: rtw89: coex: Add Init info version 10
The version 10 Init info add I/O offload type & variable Bluetooth
function (EX: Zigbee/Thread...etc) into the structure definition.
Firmware need to synchronize these information to do corresponding
setting.

Signed-off-by: Ching-Te Ku <ku920601@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260706025445.18428-2-pkshih@realtek.com
2026-07-12 09:03:43 +08:00
Radhey Shyam Pandey
e09afa69e3 MAINTAINERS: Add Radhey Shyam Pandey as Xilinx EDAC reviewer
I have volunteered to review Xilinx EDAC related changes. Add myself as
a reviewer to stay aligned with ongoing patch activity and actively contribute
to this subsystem.

Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://patch.msgid.link/20260625103749.1416083-1-radhey.shyam.pandey@amd.com
2026-07-11 17:59:02 -07:00
Dmitry Torokhov
1160c2208f firmware_loader: builtin: fail build on empty firmware
If an empty firmware file is supplied via CONFIG_EXTRA_FIRMWARE, the
build currently succeeds but creates an empty section. While the
firmware loader will not return such sections it is better to avoid
adding them in the first place.

Add a compile-time size check to the filechk_fwbin macro to abort the
build early if a 0-size firmware is encountered.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Link: https://patch.msgid.link/20260426043041.649202-2-dmitry.torokhov@gmail.com
[ Use 'exit 1' to properly fail the build. - Danilo ]
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-07-12 02:25:08 +02:00
Kumar Kartikeya Dwivedi
9a3a07d06e
Merge branch 'bpf-fix-warning-in-bpf_trampoline_multi_detach'
Leon Hwang says:

====================
bpf: Fix WARNING in bpf_trampoline_multi_detach

Since tracing_multi link does not set ftrace_managed, it would fail to
release the tracing_multi link when attaching tracing_multi link and
then attaching fentry link.

[    3.714215] WARNING: kernel/bpf/trampoline.c:1727 at bpf_trampoline_multi_detach+0x20b/0x240, CPU#1: test_progs/97
...
[    3.733170]  bpf_tracing_multi_link_release+0x14/0x30
[    3.733890]  bpf_link_free+0x58/0x130
[    3.734414]  bpf_link_release+0x23/0x30

Fix it by setting 'ftrace_managed = true' in register_fentry_multi().

Note: the reason of targeting bpf-next tree is I'm planning to add
tracing_multi link support for bpf progs, that would rely on the fix and
have code conflict with the test.

Changes:
v1 -> v2:
* Collect Acked-by from Jiri, thanks.
* Check arg using tracing_multi_arg_check() in bpf prog in test.
  (per Sashiko)
* v1: https://lore.kernel.org/bpf/20260710144734.78203-1-leon.hwang@linux.dev/
====================

Link: https://patch.msgid.link/20260711124822.29406-1-leon.hwang@linux.dev
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-12 01:56:22 +02:00
Leon Hwang
539d3edf8e
selftests/bpf: Test fentry link after tracing_multi link
Verify that there's no any issue to attach tracing_multi link, then attach
fentry link.

Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Link: https://lore.kernel.org/bpf/20260711124822.29406-3-leon.hwang@linux.dev
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-12 01:56:19 +02:00
Leon Hwang
30bdd6d138
bpf: Mark tracing_multi trampolines as ftrace managed
Since tracing_multi link does not set ftrace_managed, it would fail to
release the tracing_multi link when attaching tracing_multi link and
then attaching fentry link.

[    3.714215] WARNING: kernel/bpf/trampoline.c:1727 at bpf_trampoline_multi_detach+0x20b/0x240, CPU#1: test_progs/97
...
[    3.733170]  bpf_tracing_multi_link_release+0x14/0x30
[    3.733890]  bpf_link_free+0x58/0x130
[    3.734414]  bpf_link_release+0x23/0x30

Fix it by setting 'ftrace_managed = true' in register_fentry_multi().

Fixes: aef4dfa790 ("bpf: Add bpf_trampoline_multi_attach/detach functions")
Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Link: https://lore.kernel.org/bpf/20260711124822.29406-2-leon.hwang@linux.dev
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-12 01:56:14 +02:00
Kumar Kartikeya Dwivedi
25935519f7
Merge branch 'bpf-require-an-owned-cpumask-for-bpf_cpumask_populate'
Nicholas Dudar says:

====================
bpf: require an owned cpumask for bpf_cpumask_populate()

bpf_cpumask_populate() writes its destination with bitmap_copy() but
types it as struct cpumask *, so the verifier accepts a borrowed,
read-only cpumask (for example from scx_bpf_get_online_cpumask()) as a
writable destination. Fix it and add a selftest for coverage.

Changelog:
----------
v2 -> v3 (v1/v2 were a private report to security@kernel.org)

 * Split the fix and selftest into separate patches.
 * Target bpf-next instead of bpf.
====================

Link: https://patch.msgid.link/20260709182800.2037938-1-main.kalliope@gmail.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-12 01:52:55 +02:00
Nicholas Dudar
6267b83528
selftests/bpf: Test bpf_cpumask_populate() rejects a borrowed cpumask
bpf_cpumask_populate() now takes a struct bpf_cpumask *, so update the
kfunc declaration and drop the struct cpumask * casts in the existing
populate tests. Add test_populate_borrowed_destination, which passes a
borrowed task->cpus_ptr and asserts the verifier rejects it as a writable
destination.

Signed-off-by: Nicholas Dudar <main.kalliope@gmail.com>
Acked-by: Tejun Heo <tj@kernel.org>
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Link: https://lore.kernel.org/bpf/20260709182800.2037938-3-main.kalliope@gmail.com
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-12 01:52:50 +02:00
Nicholas Dudar
8740156ad3
bpf: Require a BPF cpumask for bpf_cpumask_populate()
bpf_cpumask_populate() writes to its destination with bitmap_copy(), but
the destination is typed as struct cpumask *. That allows the verifier to
accept borrowed cpumask pointers returned by read-only kfuncs, such as
scx_bpf_get_online_cpumask(), as a writable destination.

Make the destination a struct bpf_cpumask * so populate follows the same
ownership rule as the other mutating cpumask kfuncs. Query kfuncs continue
to accept const struct cpumask * inputs.

Fixes: 950ad93df2 ("bpf: add kfunc for populating cpumask bits")
Signed-off-by: Nicholas Dudar <main.kalliope@gmail.com>
Acked-by: Tejun Heo <tj@kernel.org>
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Link: https://lore.kernel.org/bpf/20260709182800.2037938-2-main.kalliope@gmail.com
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-12 01:52:36 +02:00
Dmitry Torokhov
d059966c0c firmware_loader: builtin: ignore 0-size firmware
Currently, the builtin firmware loader allows 0-size firmware to be
returned successfully to drivers. This differs from all other loading
mechanisms (filesystem, sysfs fallback) which reject 0-byte files, and
forces drivers to add boilerplate size checks.

Modify firmware_request_builtin() to reject 0-size firmware. This will
also result in firmware loader falling back to other mechanisms if an
empty built-in firmware is present.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Link: https://patch.msgid.link/20260426043041.649202-1-dmitry.torokhov@gmail.com
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-07-12 01:48:40 +02:00
Ian Bridges
79d7a453c7 Input: i8042 - replace strlcat() with seq_buf and scnprintf()
In preparation for removing the strlcat() API[1], replace its uses in
i8042-acpipnpio.h.

i8042_pnp_id_to_string() accumulates a variable number of PNP ids in
a loop, which is what seq_buf is for. The kbd and aux probe functions
build a name from at most three parts that are all known up front, so
the whole construction becomes a single scnprintf() there.

Link: https://github.com/KSPP/linux/issues/370 [1]
Signed-off-by: Ian Bridges <icb@fastmail.org>
Link: https://patch.msgid.link/akyW4xkvCCROM0SE@dev
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-07-11 15:51:48 -07:00
Laxman Acharya Padhya
a41000ba3a iio: light: gp2ap002: Disable regulators on resume failure
If enabling VIO fails after VDD has been enabled, runtime resume
returns without disabling VDD. Likewise, if device reinitialization
fails, both supplies remain enabled. The runtime PM core keeps the
device suspended when its resume callback fails, so the supplies must
be restored to the suspended state.

Disable the supplies enabled by the callback before returning an error.

Fixes: 97d642e230 ("iio: light: Add a driver for Sharp GP2AP002x00F")
Assisted-by: Codex:gpt-5
Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-07-11 23:45:35 +01:00
Linus Torvalds
44696aa3a4 Input updates for v7.2-rc2
- A fix for MELFAS MMS114 touchscreen driver to reject invalid touch IDs
   and avoid multi-touch slot corruption
 
 - A fix for a crash in Sega Dreamcast (Maple) mouse driver when opening
   the device, caused by missing driver data
 
 - Fixes for Maple drivers (keyboard, mouse, joystick) to properly order
   setting driver data and device registration to avoid races.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQST2eWILY88ieB2DOtAj56VGEWXnAUCalLC2QAKCRBAj56VGEWX
 nLLwAQDExlB/cWm2Hpmim13SIetpNbnRNDDUBXZqlx26U6tCUgD9Ek85LvbRiWOJ
 dTqs7ieSn2iPQxHFvHOAZD5ohSGj/wI=
 =g2px
 -----END PGP SIGNATURE-----

Merge tag 'input-for-v7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

Pull input fixes from Dmitry Torokhov:

 - fix MELFAS MMS114 touchscreen driver to reject invalid touch IDs and
   avoid multi-touch slot corruption

 - fix a crash in the Sega Dreamcast (Maple) mouse driver when opening
   the device, caused by missing driver data

 - fixes for Maple drivers (keyboard, mouse, joystick) to properly order
   setting driver data and device registration to avoid races

* tag 'input-for-v7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: mms114 - fix multi-touch slot corruption
  Input: maple_keyb - set driver data before registering input device
  Input: maplecontrol - set driver data before registering input device
  Input: maplemouse - set driver data before registering input device
  Input: maplemouse - fix NULL pointer dereference in open()
2026-07-11 15:42:55 -07:00
Pengpeng Hou
daf79105f9 iio: light: rpr0521: Propagate regcache_sync() errors
rpr0521_runtime_suspend() powers the device down and marks the regmap
cache dirty. rpr0521_runtime_resume() syncs the cache before restoring
enabled ALS/PXS channels, but currently ignores a regcache_sync()
failure and can still return success.

Return the regcache_sync() error so resume does not hide a failed
register restore.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-07-11 23:38:55 +01:00
Pengpeng Hou
7a2ccd0a17 iio: light: vcnl4035: Propagate regcache_sync() errors
vcnl4035_runtime_suspend() marks the regmap cache dirty before runtime
suspend. vcnl4035_runtime_resume() then syncs the cache before re-
enabling ALS, but currently ignores a regcache_sync() failure and can
still report resume success.

Return the regcache_sync() error so the PM core sees the failed register
restore.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-07-11 23:36:34 +01:00
Erick Henrique
a130404ce0 iio: dac: m62332: Fix regulator reference count imbalance
m62332_set_value() enables the Vcc regulator on every write of a
non-zero value and disables it on every write of zero, without tracking
the channel's current state. Because the regulator is reference counted,
changing a channel directly from one non-zero value to another enables
it more than once, while a later write of zero disables it only once.
The reference count never returns to zero and the regulator is left
enabled indefinitely.

Only enable the regulator on the transition from zero to non-zero, and
only disable it on the transition from non-zero to zero, using the
previously stored channel value to detect the edge. Balance the
regulator on the I2C error path so the reference count stays consistent
if the write fails.

Fixes: b87b0c0f81 ("iio: add m62332 DAC driver")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260418130322.106769-1-erick.henrique.rodrigues%40usp.br
Cc: stable@vger.kernel.org
Signed-off-by: Erick Henrique <erick.henrique.rodrigues@usp.br>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-07-11 23:33:52 +01:00
Sanjay Chitroda
967d066f53 iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register()
Avoid using devm_iio_device_register(), as this driver requires explicit
error handling and teardown ordering.

With devm_iio_device_register(), IIO device remains registered until the
devres cleanup phase. However, driver's remove() callback removes the
sensor hub callback and trigger support. This can create a race window
where IIO device is still visible and read_raw() requests are issued.
These requests might call sensor_hub_input_attr_get_raw_value(), which
waits up to 5 seconds for a response from the sensor hub callback that
has already been removed.

Add an explicit iio_device_unregister() call in the teardown path to
ensure deterministic cleanup, so that userspace can no longer access the
device once backend resources begin to be dismantled.

Fixes: 59d0f2da35 ("iio: hid: Add temperature sensor support")
Cc: stable@vger.kernel.org
Reviewed-by: Maxwell Doose <m32285159@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Sanjay Chitroda <sanjayembeddedse@gmail.com>
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-07-11 23:28:04 +01:00
Manuel Ebner
72870cd641 dt-bindings: input: gpio-charlieplex-keypad: add missing parenthesis
Add missing '('.

Signed-off-by: Manuel Ebner <manuelebner@mailbox.org>
Acked-by: Hugo Villeneuve <hvilleneuve@dimonoff.com>
Link: https://patch.msgid.link/20260710090153.431170-2-manuelebner@mailbox.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-07-11 15:17:30 -07:00
Linus Torvalds
59dee6d287 - dm-log: fix overflow on 32-bit machines
- dm-era: fix out of bounds memory access; fix crashes on invalid args
 
 - dm-verity: fix buffer overflow in forward error correction
 
 - dm-thin: fix misbehavior on I/O failures
 
 - dm-pcache: fix NULL pointer dereference on invalid arguments
 
 - dm-inlinecrypt: fix memory leak on error handling
 
 - dm-integrity: fix ignoring the 'fix_hmac' option on device open
 
 - dm: don't store the keyring in memory for a long term
 
 - 12 miscellaneous fixes for bugs found by Claude Opus 4.6
 -----BEGIN PGP SIGNATURE-----
 
 iIoEABYIADIWIQRnH8MwLyZDhyYfesYTAyx9YGnhbQUCalKUaxQcbXBhdG9ja2FA
 cmVkaGF0LmNvbQAKCRATAyx9YGnhbbQwAP9pHgNUinD95o9vnu3d3QNmjnEDmrgZ
 +kxNFRpWXvbzKQEArYWPLS/2dwf4nG0Fa8PtJTwkjI/6UeublAy5MrdTqA0=
 =pkBx
 -----END PGP SIGNATURE-----

Merge tag 'for-7.2/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm

Pull device mapper fixes from Mikulas Patocka:

 - dm-log: fix overflow on 32-bit machines

 - dm-era: fix out of bounds memory access; fix crashes on invalid args

 - dm-verity: fix buffer overflow in forward error correction

 - dm-thin: fix misbehavior on I/O failures

 - dm-pcache: fix NULL pointer dereference on invalid arguments

 - dm-inlinecrypt: fix memory leak on error handling

 - dm-integrity: fix ignoring the 'fix_hmac' option on device open

 - dm: don't store the keyring in memory for a long term

 - 12 miscellaneous fixes for bugs found by Claude Opus 4.6

* tag 'for-7.2/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: (23 commits)
  dm thin metadata: fix superblock refcount leak on snapshot shadow failure
  dm-stats: fix dm_jiffies_to_msec64
  dm-stats: fix merge accounting
  dm-bufio: fix wrong count calculation in dm_bufio_issue_discard
  dm-verity: make error counter atomic
  dm-verity: increase sprintf buffer size
  dm-verity: fix a possible NULL pointer dereference
  dm-verity: avoid double increment of &use_bh_wq_enabled
  dm-ioctl: fix a possible overflow in list_version_get_info
  dm_early_create: fix freeing used table on dm_resume failure
  dm-integrity: fix a bug if the bio is out of limits
  dm-integrity: don't increment hash_offset twice
  dm-integrity: fix leaking uninitialized kernel memory
  dm-integrity: fix the 'fix_hmac' option
  dm era: fix error code propagation in era_ctr()
  dm era: fix NULL pointer dereference in metadata_open()
  dm: avoid leaking the caller's thread keyring via the table device file
  dm-inlinecrypt: Fix an error handling path in inlinecrypt_ctr()
  dm-pcache: reject option groups without values
  dm thin metadata: fix metadata snapshot consistency on commit failure
  ...
2026-07-11 13:06:05 -07:00
Thomas Weißschuh
584afc86a1 samples/kobject: Constify kobject attributes
Demonstrate that 'const struct kobj_attribute' is now supported by the
kobject core.

Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
Link: https://patch.msgid.link/20260707-sysfs-const-attr-kobj-attr-prep-v2-4-35ae1bc0f9ef@weissschuh.net
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-07-11 20:38:01 +02:00
Thomas Weißschuh
ed96337a5b kobject: Allow the constification of kobject attributes
Allow kobject attribute to reside in read-only memory.
Both const and non-const attributes are handled by the utility macros
and attributes can be migrated one-by-one.

Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
Link: https://patch.msgid.link/20260707-sysfs-const-attr-kobj-attr-prep-v2-3-35ae1bc0f9ef@weissschuh.net
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-07-11 20:38:01 +02:00
Thomas Weißschuh
a3a9c7453f samples/kobject: Switch to the new __KOBJ_ATTR() macro
To demonstrate and test the upcoming 'const struct kobj_attribute'
handling, convert the sample to the new macro.

Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
Link: https://patch.msgid.link/20260707-sysfs-const-attr-kobj-attr-prep-v2-2-35ae1bc0f9ef@weissschuh.net
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-07-11 20:38:01 +02:00
Thomas Weißschuh
418a74d106 kobject: Provide macros to initialize 'struct kobj_attribute'
Currently the generic __ATTR*() macros are used to initialize kobject
attributes. These are not able to handle the upcoming piece-by-piece
constification of the attribute callback handlers.

Add dedicated macros of kobject attributes. For now these are the same
as the generic macros, but they will change soon. Users will be
converted to these macros as part of the constification, but it is
expected that they will be used generally in the future.

Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
Link: https://patch.msgid.link/20260707-sysfs-const-attr-kobj-attr-prep-v2-1-35ae1bc0f9ef@weissschuh.net
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-07-11 20:38:01 +02:00
Erikas Bitovtas
1c436bca83 ARM: dts: qcom: msm8926-sony-xperia-yukon-eagle: add initial device tree
Add device tree for Sony Xperia M2 (sony-eagle) smartphone
based on the Qualcomm MSM8926 SoC.

Initial features:
- Framebuffer
- GPIO buttons (Volume Down and Camera)
- Regulators
- Internal storage
- SD card
- Accelerometer
- Ambient Light/Proximity sensor
- NFC
- pm8226_resin (Volume Up)
- Vibrator
- USB/Charger

Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Erikas Bitovtas <xerikasxx@gmail.com>
Link: https://lore.kernel.org/r/20260610-yukon-eagle-v4-2-763d5698bd2c@gmail.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-11 13:11:35 -05:00
Kathiravan Thirumoorthy
e27e02fff4 clk: qcom: ipq9650: Add clocks for the REFGEN block
Add the clocks required to enable the REFGEN block which provides the
reference current to the PHYs in the SoC.

Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260707-b4-ipq9650_refgen_clocks-v1-2-e070624d03d2@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-11 12:57:39 -05:00
Bjorn Andersson
b14992f796 Merge branch '20260707-b4-ipq9650_refgen_clocks-v1-1-e070624d03d2@oss.qualcomm.com' into clk-for-7.3
Merge the IPQ9650 refgen clock ids through a topic branch, in case they
need to be referenced from DeviceTree branches as well before next
release.
2026-07-11 12:57:01 -05:00
Kathiravan Thirumoorthy
dd7ddd057f dt-bindings: clock: qcom: Add IPQ9650 REFGEN clock IDs
Add the REFGEN clock IDs for the IPQ9650 SoC. These clocks are used
to enable the REFGEN block, which provides the reference current to
the PHYs in the SoC.

Signed-off-by: Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com>
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260707-b4-ipq9650_refgen_clocks-v1-1-e070624d03d2@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-11 12:56:53 -05:00
Krzysztof Kozlowski
ecb42d97c8 dt-bindings: clock: qcom,sm8450-video: Require required-opps on X1E80100
Reverse the logic within "if:then:" when expecting "required-opps"
property to have negative list of only variants which do not require
these.  VIDEOCC on SM8650 does not need "required-opps" as explained in
the commit 6720e8dbcb ("dt-bindings: clock: qcom: Drop required-opps
in required on sm8650 videocc").  Requirement on VIDEOCC on SM8475 is
not known.

Reverting the logic in "if:" part has two impacts:

1. Adds requirement of "required-opps" on VIDEOCC on Hamoa (X1E80100),
   to match hardware expectation, similarly to existing its variant
   X1P42100 (already expressed in DTS).

2. Reduces the chances of forgetting to update constraints when adding
   new compatibles (like for X1E80100).

Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260708-dt-bindings-camcc-required-opps-v1-3-ae0871774210@oss.qualcomm.com
[bjorn: Rebased, assuming the newly added hawi compatible also requires opps]
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-11 12:55:25 -05:00
Krzysztof Kozlowski
9b9139d88c dt-bindings: clock: qcom,sm8450-camcc: Require required-opps on SM8750
Reverse the logic within "if:then:" when expecting "required-opps"
property to have negative list of only variants which do not require
these.  CAMCC on SM8650 does not need "required-opps" as explained in
the commit db30c1160c ("dt-bindings: clock: qcom: Drop required-opps
in required on SM8650 camcc").  Requirement on CAMCC on SM8475 is not
known.

Reverting the logic in "if:" part has two impacts:

1. Adds requirement of "required-opps" on CAMCC on SM8750 to match
   hardware expectation, because it needs minimum voltage levels of MMCX
   rail (already expressed in DTS).

2. Reduces the chances of forgetting to update constraints when adding
   new compatibles (like for SM8750).

Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260708-dt-bindings-camcc-required-opps-v1-2-ae0871774210@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-11 12:53:51 -05:00
Krzysztof Kozlowski
f54ac9a709 dt-bindings: clock: qcom,sm8450-camcc: Drop qcom,sc8280xp-camcc from "if" block
qcom,sc8280xp-camcc compatible was moved to own binding file in
commit 842fa74829 ("dt-bindings: clock: qcom,sm8450-camcc: Move
sc8280xp camcc to sa8775p camcc"), so cleanup redundant entry in
"if:then:" block.

Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260708-dt-bindings-camcc-required-opps-v1-1-ae0871774210@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-11 12:53:51 -05:00
Brian Masney
499b4cb671 clk: qcom: camcc-sc8280xp: unregister CAMCC_GDSC_CLK
With the introduction of sync_state support in the clk and pmdomain
subsystems, the following warning happens when the unused clocks are
shutdown in camcc-sc8280xp:

    [   15.408367] titan_top_gdsc status stuck at 'on'
    [   15.408429] WARNING: drivers/clk/qcom/gdsc.c:178 at gdsc_toggle_logic+0x14c/0x160, CPU#2: kworker/u32:1/14
    [   15.408462] Modules linked in: bnep vfat fat ath11k_pci(+) ath11k mac80211 cfg80211 mhi libarc4 snd_soc_wcd938x snd_soc_wcd938x_sdw snd_soc_wcd_classh hci_uart snd_soc_wcd_common
    snd_soc_sc8280xp soundwire_qcom snd_soc_wcd_mbhc snd_soc_qcom_sdw slimbus snd_soc_qcom_common regmap_sdw btqca btrtl qcom_camss soundwire_bus btbcm btintel snd_soc_sdca snd_soc_lpass_wsa_macro
    bluetooth snd_soc_lpass_tx_macro snd_soc_lpass_va_macro snd_soc_lpass_rx_macro snd_soc_hdmi_codec snd_soc_lpass_macro_common videobuf2_dma_sg ov5675 v4l2_fwnode videobuf2_memops
    qcom_spmi_adc5 snd_soc_core qcom_spmi_adc_tm5 videobuf2_v4l2 snd_seq snd_seq_device videobuf2_common v4l2_async qcom_vadc_common qcom_spmi_temp_alarm pm8941_pwrkey industrialio videodev
    snd_compress rfkill ac97_bus snd_pcm_dmaengine qcom_tsens mc qcom_edac snd_pcm pci_pwrctrl_pwrseq qcom_cpufreq_hw snd_timer snd qcomtee soundcore tee leds_gpio joydev binfmt_misc zram
    lz4hc_compress governor_simpleondemand panel_edp msm xhci_plat_hcd nvme nvme_core dwc3 qcom_pm8008_regulator
    [   15.408688]  ucsi_glink nvme_keyring nvme_auth pmic_glink_altmode udc_core typec_ucsi aux_hpd_bridge qcom_battmgr ulpi ubwc_config socinfo ocmem drm_gpuvm qcom_q6v5_pas drm_exec
    qcom_pil_info leds_qcom_lpg gpu_sched led_class_multicolor rtc_pm8xxx qcom_pbs qcom_common drm_display_helper qcom_pon qcom_glink_smem qcom_glink ghash_ce pwrseq_qcom_wcn gpio_sbu_mux
    qcom_stats phy_qcom_qmp_combo qcom_q6v5 gf128mul cec dispcc_sc8280xp phy_qcom_edp camcc_sc8280xp i2c_qcom_cci qcom_sysmon drm_dp_aux_bus mdt_loader aux_bridge qcom_pm8008 i2c_hid_of_elan
    dwc3_qcom_legacy llcc_qcom icc_bwmon gpi typec qcom_refgen_regulator phy_qcom_qmp_usb nvmem_qfprom qcom_ipcc phy_qcom_snps_femto_v2 gpucc_sc8280xp pinctrl_sc8280xp_lpass_lpi qcom_hwspinlock
    pinctrl_lpass_lpi lpasscc_sc8280xp qrtr qcom_aoss pmic_glink pdr_interface phy_qcom_qmp_pcie qcom_smd qcom_pdr_msg icc_osm_l3 qcom_wdt qmi_helpers qcom_rng smp2p rpmsg_core gpio_keys pwm_bl
    smem hid_multitouch fuse i2c_dev
    [   15.408928] CPU: 2 UID: 0 PID: 14 Comm: kworker/u32:1 Not tainted 7.1.0+ #2 PREEMPT(lazy)
    [   15.408937] Hardware name: LENOVO 21BX0016US/21BX0016US, BIOS N3HET88W (1.60 ) 03/14/2024
    [   15.408942] Workqueue: pm pm_runtime_work
    [   15.408959] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
    [   15.408967] pc : gdsc_toggle_logic+0x14c/0x160
    [   15.408978] lr : gdsc_toggle_logic+0x14c/0x160
    [   15.408987] sp : ffff8000800f3b40
    [   15.408991] x29: ffff8000800f3b40 x28: 0000000000000000 x27: 0000000000000000
    [   15.409003] x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000
    [   15.409014] x23: 0000000000000000 x22: 0000000000000001 x21: ffffa33f298fca88
    [   15.409024] x20: 0000000000000000 x19: ffffa33f298fc5b0 x18: 00cd15db75dacefd
    [   15.409035] x17: 000000040044ffff x16: ffffa33f3b1a3d88 x15: 726f776b80000002
    [   15.409045] x14: ffffffffffffffff x13: 0000000000000028 x12: 0101010101010101
    [   15.409056] x11: 7f7f7f7f7f7f7f7f x10: fefeff3039313274 x9 : ffffa33f3a5edafc
    [   15.409067] x8 : ffff8000800f3780 x7 : 0000000000000001 x6 : 0000000000000001
    [   15.409078] x5 : ffff000bf3ca1288 x4 : 0000000000000000 x3 : ffff5cccb6a3f000
    [   15.409088] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000080ae0000
    [   15.409098] Call trace:
    [   15.409103]  gdsc_toggle_logic+0x14c/0x160 (P)
    [   15.409115]  gdsc_disable+0x4c/0x190
    [   15.409126]  _genpd_power_off+0xa0/0x1a8
    [   15.409137]  genpd_power_off.part.0+0x180/0x2a0
    [   15.409149]  genpd_runtime_suspend+0x218/0x310
    [   15.409155]  __rpm_callback+0x50/0x1f8
    [   15.409166]  rpm_callback+0x7c/0x90
    [   15.409175]  rpm_suspend+0xe8/0x690
    [   15.409185]  pm_runtime_work+0xd0/0xe0
    [   15.409195]  process_one_work+0x18c/0x518
    [   15.409208]  worker_thread+0x190/0x320
    [   15.409218]  kthread+0x110/0x130
    [   15.409227]  ret_from_fork+0x10/0x20

This clock is force enabled to be on in the probe, and registered with
the Common Clk Framework, resulting in them being toggled off after
unused clocks are shutdown. This clock is required for the GDSC
transitions.

Similar to the fix in commit b60521eff2 ("clk: qcom: gcc-x1e80100:
Unregister GCC_GPU_CFG_AHB_CLK/GCC_DISP_XO_CLK"), let's just unregister
this clock.

Link: https://lore.kernel.org/linux-clk/20260626-camcc-sc8280xp-titan-top-v1-1-2ca246886493@redhat.com/
Fixes: ff93872a9c ("clk: qcom: camcc-sc8280xp: Add sc8280xp CAMCC")
Suggested-by: Jagadeesh Kona <jagadeesh.kona@oss.qualcomm.com>
Signed-off-by: Brian Masney <bmasney@redhat.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Link: https://lore.kernel.org/r/20260708-camcc-sc8280xp-remove-gdsc-v1-1-dfaab98a3bf5@redhat.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-11 12:51:30 -05:00