Commit graph

1,462,193 commits

Author SHA1 Message Date
Cheng Ming Lin
8ac45f4ff1 mtd: spinand: macronix: Enable randomizer support
Implement the 'set_randomizer' callback for Macronix SPI NAND chips.
The randomizer is enabled by setting bit 1 of the Configuration Register
(address 0x10).

This patch adds support for the following chips:
  - MX35LFxG24AD series
  - MX35UFxG24AD series

When the randomizer is enabled, data is scrambled internally during
program operations and automatically descrambled during read operations.
This helps reduce bit errors caused by program disturbance.

Please refer to the following link for randomizer feature:
Link: https://www.mxic.com.tw/Lists/ApplicationNote/Attachments/2151/AN1051V1-The%20Introduction%20of%20Randomizer%20Feature%20on%20MX30xFxG28AD_MX35xFxG24AD.pdf

Signed-off-by: Cheng Ming Lin <chengminglin@mxic.com.tw>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-05-27 11:07:10 +02:00
Cheng Ming Lin
54e1bc80af mtd: spinand: Add support for randomizer
This patch adds support for the randomizer feature.

It introduces a 'set_randomizer' callback in 'struct spinand_info' and
'struct spinand_device'.

If a driver implements this callback, the core will invoke it during
device initialization (spinand_init) to enable or disable the randomizer
feature based on the device tree configuration.

Signed-off-by: Cheng Ming Lin <chengminglin@mxic.com.tw>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-05-27 11:07:06 +02:00
Cheng Ming Lin
cf496ebf13 dt-bindings: mtd: nand: Add nand-randomizer property
Add the 'nand-randomizer' property to control the data randomizer
feature. This is used to improve data reliability by reducing
cell-to-cell interference.

Depending on the hardware architecture, this property is designed to be
generic and can apply to either the NAND chip's internal randomizer
or the hardware randomizer engine embedded in the NAND host controller.

This property is defined as a uint32 enum (0 or 1) instead of a simple
boolean. This design choice explicitly supports the "not present" case.
If the property is omitted, the driver will not interfere and will leave
the randomizer in its current state (e.g., as already configured by the
bootloader or hardware default).

Signed-off-by: Cheng Ming Lin <chengminglin@mxic.com.tw>
Reviewed-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-05-27 11:06:27 +02:00
Sean Young
f4aeb151b8 mtd: sc520cdp: Remove mapping since board is no longer supported
Since commit 8b793a92d8 ("x86/cpu: Remove M486/M486SX/ELAN support"),
this board is no longer supported. Remove the mtd map too.

Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-05-27 11:05:08 +02:00
Sean Young
b60e5b5738 mtd: netsc520: Remove mapping since board is no longer supported
Since commit 8b793a92d8 ("x86/cpu: Remove M486/M486SX/ELAN support"),
this board is no longer supported. Remove the mtd map too.

Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-05-27 11:05:08 +02:00
Sean Young
801f11633d mtd: ts5500_flash: Remove mapping since board is no longer supported
Since commit 8b793a92d8 ("x86/cpu: Remove M486/M486SX/ELAN support"),
this board is no longer supported. Remove the mtd map too.

Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-05-27 11:05:08 +02:00
Arseniy Krasnov
8507c2cc9e mtd: rawnand: fix condition in 'nand_select_target()'
'cs' here must be in range [0:nanddev_ntargets[.

Cc: stable@vger.kernel.org
Fixes: 32813e2884 ("mtd: rawnand: Get rid of chip->numchips")
Signed-off-by: Arseniy Krasnov <avkrasnov@rulkc.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-05-27 11:03:08 +02:00
Shyam Sunder Reddy Padira
a96fcde9fa media: staging: imx: remove unnecessary out-of-memory error message
Remove dev_err() call after dma_alloc_coherent() failure.

checkpatch.pl reports this as an unnecessary out-of-memory message because
failure is already conveyed by returning -ENOMEM, and the current message
does not provide additional useful debugging information.

Signed-off-by: Shyam Sunder Reddy Padira <shyamsunderreddypadira@gmail.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-27 10:58:27 +02:00
Michael Tretter
e33062c19b media: staging: imx-csi: use media_pad_is_streaming helper
The media_pad_is_streaming() helper is explicitly intended to check whether
a pad has been started with media_pipeline_start(). Use it instead of
relying on the implicit assumption that a pad with a pipeline is streaming.

Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-27 10:58:27 +02:00
Michael Tretter
262d2e7cfc media: staging: imx-csi: explicitly start media pipeline on pad 0
entity->pads is an array that contains all the pads of an entity.

Calling __media_pipeline_start() or __media_pipeline_stop() on the pads,
implicitly starts the pipeline with the first pad in this array as origin.

Explicitly use the first pad to start the pipeline to make this more
obvious to the reader.

Reviewed-by: Frank Li <Frank.Li@nxp.com>
Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-27 10:58:27 +02:00
Michael Tretter
e52b90b827 media: staging: imx-csi: move media_pipeline to video device
The imx-media driver has a single imx_media_device. Attaching the
media_pipeline to the imx_media_device prevents the execution of multiple
media pipelines on the device. This should be possible as long as the
media_pipelines don't use the same pads or pads that be configured while
the other media pipeline is streaming.

Move the media_pipeline to the imx_media_video_dev to be able to construct
media pipelines per imx capture device.

If different media pipelines in the media device conflict, the validation
will fail. Thus, the pipeline will fail to start and signal an error to
user space.

Reviewed-by: Frank Li <Frank.Li@nxp.com>
Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-27 10:58:27 +02:00
Bitterblue Smith
8368970b62 wifi: rtw89: usb: Support switching to USB 3 mode
The Realtek wifi 6/7 devices which support USB 3 are weird: when first
plugged in, they pretend to be USB 2. The driver needs to send some
commands to the device, which make it disappear and come back as a
USB 3 device.

Implement the required commands in rtw89.

Add a new function rtw89_usb_write32_quiet() to avoid the warnings
when writing to R_{AX,BE}_PAD_CTRL2. Even though the write succeeds,
usb_control_msg() returns -EPROTO, probably because the USB device
disappears immediately. This results in some confusing warnings in
the kernel log.

When a USB 3 device is plugged into a USB 2 port, rtw89 will try to
switch it to USB 3 mode only once. The device will disappear and come
back still in USB 2 mode, of course.

Tested with RTL8832AU, RTL8832BU, RTL8832CU, and RTL8912AU.

Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/e955451c-93a1-4d04-8024-d224a04f1d4a@gmail.com
2026-05-27 16:46:57 +08:00
Jacopo Mondi
a947fc3ba8 media: rcar-vin: Drop min_queued_buffers
The R-Car VIN driver already uses a scratch buffer to sustain capture
operations in absence of a frame buffer provided by userspace.

There is no reason to require 4 buffers queued at all times for the
driver to operate. Drop min_queued_buffers from the VIN driver to allow
single-frame capture operations.

Signed-off-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
Reviewed-by: Jai Luthra <jai.luthra+renesas@ideasonboard.com>
Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Tested-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-27 10:44:04 +02:00
Bitterblue Smith
aa7d92e838 wifi: rtw88: Add more validation for the RX descriptor
Some RTL8821CE cards can return frames with corrupted RX descriptor,
causing warnings and crashes if they are passed to the upper layers.

The PHY status size field is 4 bits wide, but in rtw88 its value should
only be 0 or 4. Checking this catches most of the corrupt frames.

If a PHY status is present, the PHY status size should not be 0.

The frame size should not be less than or equal to 4 and should not
exceed 11454.

The rate should not exceed 4SS MCS9.

Discard the frame if any of these checks fail.

Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221286
Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
Tested-by: Oleksandr Havrylov <goainwo@gmail.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/5bfecba3-8a90-4e0f-9558-af5cd8a14975@gmail.com
2026-05-27 16:43:49 +08:00
Zong-Zhe Yang
756abe2ebe wifi: rtw89: 8922d: configure TX shape settings
By default, BB enables triangular spectrum by a series of register
settings. According to band and regulation, RF parameters determine whether
TX shape needs to be restricted or not. So now, clear the corresponding
settings if it has no need to do.

Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260520123823.1792954-8-pkshih@realtek.com
2026-05-27 16:33:11 +08:00
Zong-Zhe Yang
a153f9ce94 wifi: rtw89: debug: show large MRU in txpwr_table dbgfs
Read and print the CR settings of large MRU.
For now, only RTL8922D_CID7090 support it.

For example,

[TX power limit_large_mru]
RU484_242 1TX     	-  IDX_0   IDX_1   IDX_2   IDX_3 	|  17,   0,   0,   0,	dBm
RU484_242 2TX     	-  IDX_0   IDX_1   IDX_2   IDX_3 	|  16,   0,   0,   0,	dBm
RU996_484 1TX     	-  IDX_0   IDX_1 	|   0,   0,		dBm
RU996_484 2TX     	-  IDX_0   IDX_1 	|   0,   0,		dBm
RU996_484_242 1TX 	-  IDX_0   IDX_1 	|   0,   0,		dBm
RU996_484_242 2TX 	-  IDX_0   IDX_1 	|   0,   0,		dBm

Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260520123823.1792954-7-pkshih@realtek.com
2026-05-27 16:31:22 +08:00
Jani Nikula
771394b4fb drm/i915/power: drop resume parameter from intel_display_power_init_hw()
intel_power_domains_resume() calling intel_display_power_init_hw() with
the resume parameter is an internal implementation detail. Hide it
inside intel_display_power.c, and provide a clean external interface
without the parameter.

Cc: Imre Deak <imre.deak@intel.com>
Reviewed-by: Imre Deak <imre.deak@intel.com>
Link: https://patch.msgid.link/63666514d457f548c69ccd35c02f2b8200ca08a1.1779800132.git.jani.nikula@intel.com
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-05-27 11:31:14 +03:00
Jani Nikula
ad5190d6f3 drm/i915/power: rename intel_power_domains_*() to intel_display_power_*()
It's confusing that intel_display_power.[ch] exposes two groups of
interfaces, one named intel_power_domains_*() and one
intel_display_power_*().

Unify on the latter, based on the file name, but also because it's more
generic. This makes the caller side easier to follow.

Cc: Imre Deak <imre.deak@intel.com>
Reviewed-by: Imre Deak <imre.deak@intel.com>
Link: https://patch.msgid.link/8fae4b0e3476aeffb0164215b7e0f0ae1d825f72.1779800132.git.jani.nikula@intel.com
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-05-27 11:31:07 +03:00
Jani Nikula
1bef2dea0c drm/i915/power: make intel_power_domains_{suspend, resume}() static
intel_power_domains_suspend() and intel_power_domains_resume() are only
used inside intel_display_power.c. Make them static.

Cc: Imre Deak <imre.deak@intel.com>
Reviewed-by: Imre Deak <imre.deak@intel.com>
Link: https://patch.msgid.link/bfb5f09794b6b5035839d0182d22980119da2165.1779800132.git.jani.nikula@intel.com
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-05-27 11:30:50 +03:00
Zong-Zhe Yang
ed438b312d wifi: rtw89: Wi-Fi 7 configure TX power limit for large MRU
Support of Large MRU (Multiple Resource Unit) starts from RTL8922D_CID7090,
i.e. RTL8922A and RTL8922D-VS variant do not support it. There are the new
corresponding control registers. So, configure them.

Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260520123823.1792954-6-pkshih@realtek.com
2026-05-27 16:29:35 +08:00
Ping-Ke Shih
89ab7535e4 wifi: rtw89: fw: load TX compensation element by RFE type
Originally driver uses TX compensation element by AID, and now tables are
by RFE type. Add the logic accordingly.

Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260520123823.1792954-5-pkshih@realtek.com
2026-05-27 16:28:23 +08:00
Ping-Ke Shih
c77a155c96 wifi: rtw89: 8922d: support new digital power compensation format
The new format shared the base set (7 elements). As there are total 40
sets, save 7 * 39 elements.

Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260520123823.1792954-4-pkshih@realtek.com
2026-05-27 16:28:17 +08:00
Ping-Ke Shih
57efc7b096 wifi: rtw89: 8922d: refactor digital power compensation to support new format
Because base settings of digital power compensation can be shared across
all bands, the settings are divided into two parts -- base and individual
values per bands. Refactor the code to be reuse with new format.

No change logic at all.

Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260520123823.1792954-3-pkshih@realtek.com
2026-05-27 16:28:12 +08:00
Zong-Zhe Yang
f50cf5f5d6 wifi: rtw89: fw: load TX power track element according to AID
RF parameters has different TX power track table for different AID.
FW elements may include multiple TX power track tables for different
AID. So, load the corresponding one.

Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260520123823.1792954-2-pkshih@realtek.com
2026-05-27 16:26:37 +08:00
Bartosz Golaszewski
61442e46fb ARM: omap1: enable real software node lookup of GPIOs on Nokia 770
Currently the board file for Nokia 770 creates dummy software nodes not
attached in any way to the actual GPIO controller devices and uses the
fact that GPIOLIB matching swnode's name to the GPIO chip's label during
software node lookup. This behavior is wrong and we want to remove it.
To that end, we need to first convert all existing users to creating
actual fwnode links.

Create real software nodes for GPIO controllers on OMAP16xx and
reference them from the software nodes in the nokia board file.

Acked-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Janusz Krzysztofik <jmkrzyszt@gmail.com>
Acked-by: Aaro Koskinen <aaro.koskinen@iki.fi>
Link: https://patch.msgid.link/20260430-nokia770-gpio-swnodes-v7-3-c88f74c90dd6@oss.qualcomm.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-05-27 10:00:51 +02:00
Bartosz Golaszewski
2bdf432e15 ARM: omap1: use platform_device_register_full() for GPIO devices on OMAP 16xx
Ahead of changes attaching GPIO controller's software nodes referenced
from the Nokia 770 board files to their target devices, switch the
method for registering the platform devices to the
platform_device_register_full() variant. This is done to leverage the
new swnode field of struct platform_device_info which automate the
software node's registration and assignment.

Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Aaro Koskinen <aaro.koskinen@iki.fi>
Link: https://patch.msgid.link/20260430-nokia770-gpio-swnodes-v7-2-c88f74c90dd6@oss.qualcomm.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-05-27 10:00:50 +02:00
Bartosz Golaszewski
3288e99f99 ARM: omap1: drop unused variable from omap16xx_gpio_init()
The pdata variable is set but not used. Remove it.

Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Aaro Koskinen <aaro.koskinen@iki.fi>
Link: https://patch.msgid.link/20260430-nokia770-gpio-swnodes-v7-1-c88f74c90dd6@oss.qualcomm.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-05-27 10:00:50 +02:00
Chen Jung Ku
20de1f993e gpio: gpiolib: use seq_puts() for plain strings
Replace seq_printf() with seq_puts() where the format string is a
plain string literal with no format specifiers.

No functional change intended.

Signed-off-by: Chen Jung Ku <ku.loong@gapp.nthu.edu.tw>
Link: https://patch.msgid.link/20260526121905.46345-1-ku.loong@gapp.nthu.edu.tw
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-05-27 09:59:29 +02:00
Arnd Bergmann
cacb104ed9 gpio: ts5500: remove obsolete driver
The ts5500 platform is no longer functional because it is
based on the removed AMD Élan i486 SoC. Remove the now
obsolete driver.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20260526103424.3246915-1-arnd@kernel.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-05-27 09:58:21 +02:00
Dmitry Torokhov
6d96cc123c MIPS: alchemy: db1300: switch to static device properties
Convert "5way switch" gpio-keys device and smsc911x ethernet controller
to use static device properties instead of bespoke platform data
structures for configuration.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
[Bartosz: use platform_device_info::swnode]
Tested-by: Manuel Lauss <manuel.lauss@gmail.com>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
2026-05-27 09:52:35 +02:00
Dmitry Torokhov
28c4800dd5 MIPS: alchemy: gpr: switch to static device properties
Convert I2C-gpio device and GPIO-connected LEDs on GPR board to software
nodes/properties, so that support for platform data can be removed from
gpio-leds driver (which will rely purely on generic device properties
for configuration).

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
[Bartosz: use platform_device_info::swnode]
Tested-by: Manuel Lauss <manuel.lauss@gmail.com>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
2026-05-27 09:52:35 +02:00
Dmitry Torokhov
dc26a10ef9 MIPS: alchemy: db1000: use nodes attached to GPIO chips in properties
GPIO subsystem is switching the way it locates GPIO chip instances for
GPIO references in software nodes by doing identity matching instead of
matching on node names. Switch to using software nodes attached to gpio
chips instead of using freestanding software nodes.

Also stop supplying platform data for the spi-gpio controller since
spi-gpio driver can derive number of chipselect lines from device
properties.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Tested-by: Manuel Lauss <manuel.lauss@gmail.com>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
2026-05-27 09:52:35 +02:00
Dmitry Torokhov
054f568e05 MIPS: alchemy: mtx1: attach software nodes to GPIO chips
GPIO subsystem is switching the way it locates GPIO chip instances for
GPIO references in software nodes from matching on node names to
identity matching, which necessitates assigning firmware nodes
(software nodes) to GPIO chips.

Move the node definitions for alchemy-gpio1 and alchemy-gpio2 to
arch/misp/alchemy/common/gpiolib.c, register them there, and attach
them to gpio_chip instances. Adjust MTX1 board file to use these nodes.

Note that because nodes need to be registered before they can be used in
PROPERTY_ENTRY_GPIO() we have to do the registration at
postcore_initcall level, otherwise (due to the link order) MTX1 board
initialization code will run first.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
[Bartosz: use platform_device_info::swnode]
Tested-by: Manuel Lauss <manuel.lauss@gmail.com>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
2026-05-27 09:52:35 +02:00
Bartosz Golaszewski
d9a316fd99 MIPS: alchemy: provide visible function prototypes to board files
Board files under arch/mips/alchemy/ define functions called from
db1xxx.c but their prototypes are only in that .c file instead of being
declared in a common header. This causes several build warnings about
missing prototypes. Provide these prototypes in a new header and include
it where necessary.

Tested-by: Manuel Lauss <manuel.lauss@gmail.com>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
2026-05-27 09:52:34 +02:00
Bartosz Golaszewski
e2f4871045 MIPS: alchemy: platform: add missing include
Pull in the platform.h header into platform.c to fix the following
warning:

arch/mips/alchemy/devboards/platform.c:68:12: warning: no previous prototype for ‘db1x_register_pcmcia_socket’ [-Wmissing-prototypes]
   68 | int __init db1x_register_pcmcia_socket(phys_addr_t pcmcia_attr_start,
      |            ^~~~~~~~~~~~~~~~~~~~~~~~~~~
arch/mips/alchemy/devboards/platform.c:152:12: warning: no previous prototype for ‘db1x_register_norflash’ [-Wmissing-prototypes]
  152 | int __init db1x_register_norflash(unsigned long size, int width,
      |            ^~~~~~~~~~~~~~~~~~~~~~

Tested-by: Manuel Lauss <manuel.lauss@gmail.com>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
2026-05-27 09:52:34 +02:00
Johan Hovold
4d9dd68708 MIPS: ip22-gio: do not export device release function
There is no need to export the gio device release function as the
devices are reference counted.

Drop the export along with the unused inline wrapper.

Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
2026-05-27 09:50:34 +02:00
Johan Hovold
b8f0962b3f MIPS: ip22-gio: switch to dynamic root device
Driver core expects devices to be dynamically allocated and will, for
example, complain loudly when no release function has been provided.

Use root_device_register() to allocate and register the root device
instead of open coding using a static device.

Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
2026-05-27 09:50:29 +02:00
Johan Hovold
b82930a4c5 MIPS: ip22-gio: fix device reference leak in probe
The gio probe function needlessly takes a device reference which is
never released and therefore prevents unbound gio devices from being
freed.

Fixes: e84de0c619 ("MIPS: GIO bus support for SGI IP22/28")
Cc: stable@vger.kernel.org	# 3.3
Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
2026-05-27 09:50:23 +02:00
Johan Hovold
7de9a1b45f MIPS: ip22-gio: fix gio device memory leak
The gio device release callback was never wired up so gio devices are
not freed when the last reference is dropped.

Fixes: e84de0c619 ("MIPS: GIO bus support for SGI IP22/28")
Cc: stable@vger.kernel.org	# 3.3
Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
2026-05-27 09:50:17 +02:00
Johan Hovold
c62cdd3e91 MIPS: ip22-gio: fix kfree() of static object
The gio bus root device is a statically allocated object which must not
be freed by kfree() on failure to register the device or bus.

Fixes: 82242d28ff ("MIPS: IP22: Add missing put_device call")
Cc: stable@vger.kernel.org	# 3.17
Cc: Levente Kurusa <levex@linux.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
2026-05-27 09:50:11 +02:00
Rong Zhang
06363f96e3 ALSA: doc: usb-audio: Add doc for QUIRK_FLAG_IFB_SILENCE_ON_EMPTY
QUIRK_FLAG_IFB_SILENCE_ON_EMPTY was introduced into usb-audio before
without appropriate documentation, so add it.

Fixes: a238120042 ("ALSA: usb-audio: add IFB_SILENCE_ON_EMPTY quirk for Behringer Flow 8")
Signed-off-by: Rong Zhang <i@rong.moe>
Link: https://patch.msgid.link/20260527-uac-quirk-get-cur-vol-v1-1-e9362b712e5e@rong.moe
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-05-27 07:36:37 +02:00
Uwe Küchler
b2e9d2cbbb ALSA: usb-audio: Add quirk for Novation Mininova
Add a device-specific quirk for the Novation Mininova synthesizer
(USB ID 1235:001e) to enable proper recognition and functionality
as a MIDI device.

Signed-off-by: Uwe Küchler <uwe@kuechler.org>
Link: https://patch.msgid.link/20260526162033.7513-1-uwe@kuechler.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-05-27 07:34:54 +02:00
Takashi Iwai
7c349b4f2a ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data
The OSS sequencer processes the input MIDI bytes into a sequencer
event to be dispatched later (in snd_seq_oss_midi_putc() called from
snd_seq_oss_process_event()).  When it's a SysEx data, the event
record contains data.ext.ptr pointer to the original SysEx bytes, and
the referred data is copied into the pool afterwards at dispatching.
The problem is that, if the sequencer port gets closed concurrently
before the dispatch, the OSS sequencer core also releases the
resources (in snd_seq_oss_midi_check_exit_port()), while the pending
event may hold a stale pointer, eventually leading to a UAF at a later
dispatch.

Fortunately, there is already a refcounting mechanism (snd_use_lock_t)
for the OSS MIDI device access, and for addressing the issue above, we
just need to extend the refcount until the event gets dispatched.

This patch extends snd_seq_oss_process_event() to give back the
refcount object, which is in turn released after calling the sequencer
dispatcher with the given event in the caller side.

According to the original report, KASAN report as below:

KASAN slab-use-after-free in snd_seq_event_dup+0x40c/0x470
RIP: 0033:0x7f2cb66a6340
Read of size 6
Call trace:
  dump_stack_lvl+0x73/0xb0 (?:?)
  print_report+0xd1/0x650 (?:?)
  srso_alias_return_thunk+0x5/0xfbef5 (?:?)
  __virt_addr_valid+0x1a7/0x340 (?:?)
  kasan_complete_mode_report_info+0x64/0x200 (?:?)
  kasan_report+0xf7/0x130 (?:?)
  snd_seq_event_dup+0x40c/0x470 (?:?)
  kasan_check_range+0x10c/0x1c0 (?:?)
  __asan_memcpy+0x27/0x70 (?:?)
  snd_seq_event_dup+0x9/0x470 (?:?)
  snd_seq_client_enqueue_event+0x139/0x240 (?:?)
  _raw_spin_unlock_irqrestore+0x4b/0x60 (?:?)
  snd_seq_kernel_client_enqueue+0x102/0x120 (?:?)
  snd_seq_oss_write+0x416/0x4e0 (?:?)
  apparmor_file_permission+0x20/0x30 (?:?)
  odev_write+0x3b/0x60 (?:?)
  vfs_write+0x1ce/0x850 (?:?)
  lock_release+0xc8/0x2a0 (?:?)
  __kasan_check_write+0x18/0x20 (?:?)
  __mutex_unlock_slowpath+0x129/0x510 (?:?)
  ksys_write+0xe1/0x180 (?:?)
  mutex_unlock+0x16/0x20 (?:?)
  odev_ioctl+0x65/0xc0 (?:?)
  __x64_sys_write+0x46/0x60 (?:?)
  x64_sys_call+0x7d/0x20d0 (?:?)
  do_syscall_64+0xc1/0x360 (arch/x86/entry/syscall_64.c:87)
  entry_SYSCALL_64_after_hwframe+0x77/0x7f (?:?)

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-and-tested-by: Zhang Cen <rollkingzzc@gmail.com>
Closes: https://lore.kernel.org/20260521233900.478153-1-rollkingzzc@gmail.com
Link: https://patch.msgid.link/20260526152843.617503-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-05-27 07:29:43 +02:00
Cássio Gabriel
3624f0bd4a ALSA: xen-front: Connect event channel after stream prepare
The request channel must be connected from ALSA .open(), because hw-rule
queries and the stream open request use it. The event channel is
different: XENSND_EVT_CUR_POS handling uses ALSA runtime buffer and
period geometry, and the corresponding Xen stream parameters are not
submitted to the backend until .prepare() sends XENSND_OP_OPEN.

Currently .open() connects both channels. A backend current-position
event, or a stale event queued for an earlier stream instance, can
therefore reach xen_snd_front_alsa_handle_cur_pos() before
runtime->buffer_size and runtime->period_size are valid.

Add a per-channel connection helper, connect only the request channel in
.open(), connect the event channel after a successful stream prepare,
and disconnect it before stream close/free. Re-check the event-channel
state after taking ring_io_lock so disconnecting the event channel
synchronizes against a threaded IRQ that passed the initial lockless
state test. Keep defensive runtime geometry checks in the position
handler.

Fixes: 1cee559351 ("ALSA: xen-front: Implement ALSA virtual sound driver")
Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
Link: https://patch.msgid.link/20260526-alsa-xen-event-channel-fixes-v1-2-91d3a6a50778@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-05-27 07:25:53 +02:00
Cássio Gabriel
9cd8115237 ALSA: xen-front: Reset event channel state on stream clear
xen_snd_front_evtchnl_pair_clear() resets evt_next_id for both
channels. That is correct for the request channel, where evt_next_id is
used to allocate the next request id. It is wrong for the event channel:
incoming events are validated against evt_id, and evt_id is incremented
by evtchnl_interrupt_evt().

This leaves the expected event id from the previous stream instance. A
backend that restarts event ids for a reopened stream can then have valid
current-position events dropped until the stale frontend id catches up.

Reset evt_id for the event channel. Also advance the event-page consumer
to the current producer while clearing the stream, so obsolete events
queued for the previous stream instance are not delivered to the next
ALSA runtime.

Fixes: 1cee559351 ("ALSA: xen-front: Implement ALSA virtual sound driver")
Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
Link: https://patch.msgid.link/20260526-alsa-xen-event-channel-fixes-v1-1-91d3a6a50778@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-05-27 07:25:41 +02:00
Lianqin Hu
14912d4971 ALSA: usb-audio: Add iface reset and delay quirk for TAE1160 USB Audio
Setting up the interface when suspended/resumeing fail on this card.
Adding a reset and delay quirk will eliminate this problem.

usb 1-1: new full-speed USB device number 2 using xhci-hcd
usb 1-1: New USB device found, idVendor=25aa, idProduct=600b
usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 1-1: Product: TAE1159
usb 1-1: Manufacturer: Generic
usb 1-1: SerialNumber: 20210726905926

Signed-off-by: Lianqin Hu <hulianqin@vivo.com>
Link: https://patch.msgid.link/TYUPR06MB621736D7C85D43200E54E740D2082@TYUPR06MB6217.apcprd06.prod.outlook.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-05-27 07:24:15 +02:00
Jakub Pisarczyk
4db42e5fb9 ALSA: hda/cs420x: Add CS4208 fixup for iMac16,1
The 21.5" Retina 4K iMac (Late 2015, DMI product name "iMac16,1") ships
with a Cirrus Logic CS4208 codec wired to an external speaker amplifier
enabled through codec GPIO0 -- the same arrangement as the late-2013
MacBookPro 11,x. Without a matching entry in cs4208_mac_fixup_tbl[] the
fixup picker logs:

    snd_hda_codec_cs420x hdaudioC1D0: CS4208: picked fixup  for codec SSID 106b:0000

i.e. an empty fixup name, GPIO0 stays low, the external amp is never
powered up, and the internal speakers are silent on a stock kernel.

The codec SSID reported by hardware is 0x106b:0x7f00. Reusing CS4208_MBP11
(GPIO0 + SPDIF switch fixup) makes the internal speakers and S/PDIF
output work out of the box, removing the need for users to set
`options snd_hda_intel model=mbp11` via /etc/modprobe.d/.

Tested on iMac16,1 (kernel 6.17.0): four internal drivers
(Left tweeter, Left woofer, Right tweeter, Right woofer, exposed as the
4 channels of the analog-surround-40 ALSA profile) produce audio after
the fixup is applied.

Signed-off-by: Jakub Pisarczyk <pisarz77@gmail.com>
Link: https://patch.msgid.link/20260526201830.34097-1-pisarz77@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-05-27 07:24:15 +02:00
Fabian Lippold
0a10faad5c ALSA: hda/realtek: add quirk for HP Dragonfly Folio G3 2-in-1
Add PCI quirk for HP Dragonfly Folio G3 (PCI ID 103c:8a06) to select the
CS35L41 SPI4 & GPIO LED fixup variant.

Signed-off-by: Fabian Lippold <fabianlippold1184@gmail.com>
Link: https://patch.msgid.link/20260526154418.1850568-3-fabianlippold1184@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-05-27 07:24:15 +02:00
Potin Lai
1249ee157d ARM: dts: aspeed: sanmiguel: Fix the CPU_CHIPTHROT linename
Fix the GPIO linenames for CPU_CHIPTHROT signals.

The signals were incorrectly marked as output ("-O") while they are
actually input signals ("-I").

[arj: Drop list of changed names]

Signed-off-by: Potin Lai <potin.lai@quantatw.com>
Link: https://patch.msgid.link/20260523-potin-update-sanmiguel-dts-20260522-v1-2-169f5fceb5f9@quantatw.com
Signed-off-by: Andrew Jeffery <andrew@codeconstruct.com.au>
2026-05-27 12:44:26 +09:30
Potin Lai
136fdfdad2 ARM: dts: aspeed: sanmiguel: Add IOEXP interrupt pin settings
Kernel dmesg reports IRQ #44 being disabled due to unhandled
interrupts from multiple PCA953x IO expanders:

    [ 447.047861] irq 44: nobody cared (try booting with the "irqpoll" option)
    [ 447.063124] handlers:
    [ 447.068176] [<2ab869ad>] irq_default_primary_handler threaded [<b8adc310>] pca953x_irq_handler
    [ 447.087268] [<2ab869ad>] irq_default_primary_handler threaded [<b8adc310>] pca953x_irq_handler
    [ 447.106344] [<2ab869ad>] irq_default_primary_handler threaded [<b8adc310>] pca953x_irq_handler
    [ 447.125421] [<2ab869ad>] irq_default_primary_handler threaded [<b8adc310>] pca953x_irq_handler
    [ 447.144513] [<2ab869ad>] irq_default_primary_handler threaded [<b8adc310>] pca953x_irq_handler
    [ 447.163587] [<2ab869ad>] irq_default_primary_handler threaded [<b8adc310>] pca953x_irq_handler
    [ 447.182663] [<2ab869ad>] irq_default_primary_handler threaded [<b8adc310>] pca953x_irq_handler
    [ 447.201756] [<2ab869ad>] irq_default_primary_handler threaded [<b8adc310>] pca953x_irq_handler
    [ 447.220837] Disabling IRQ #44

The affected IOEXP nodes are missing interrupt pin configuration in
the device tree, causing the interrupt line to remain asserted and
resulting in repeated unhandled IRQ events.

Add the required interrupt-related properties for the affected IOEXP
devices to ensure proper interrupt handling and prevent the IRQ from
being disabled.

[arj: Drop markdown code-block fence, favour indentation]

Signed-off-by: Potin Lai <potin.lai@quantatw.com>
Link: https://patch.msgid.link/20260523-potin-update-sanmiguel-dts-20260522-v1-1-169f5fceb5f9@quantatw.com
Signed-off-by: Andrew Jeffery <andrew@codeconstruct.com.au>
2026-05-27 12:42:12 +09:30