aboutsummaryrefslogtreecommitdiffstats
path: root/drivers (follow)
AgeCommit message (Collapse)AuthorFilesLines
2025-05-21iio: adc: stm32: add oversampling supportOlivier Moysan2-0/+167
Add oversampling support for STM32H7, STM32MP15 & STM32MP13. STM32F4 ADC has no oversampling feature. The current support of the oversampling feature aims at increasing the data SNR, without changing the data resolution. As the oversampling by itself increases data resolution, a right shift is applied to keep the initial resolution. Only the oversampling ratio corresponding to a power of two are supported here, to get a direct link between right shift and oversampling ratio. (2^n ratio <=> n right shift) The oversampling ratio is shared by all channels, whatever channel type. (e.g. single ended or differential). Oversampling can be configured using IIO ABI: - oversampling_ratio_available - oversampling_ratio Co-developed-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com> Signed-off-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com> Signed-off-by: Olivier Moysan <olivier.moysan@foss.st.com> Reviewed-by: David Lechner <dlechner@baylibre.com> Reviewed-by: Andy Shevchenko <andy@kernel.org> Link: https://patch.msgid.link/20250424151604.626758-1-olivier.moysan@foss.st.com Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2025-05-21staging: iio: ad5933: Correct settling cycles encoding per datasheetGabriel Shahrouzi1-1/+1
The AD5933 datasheet (Table 13) lists the maximum cycles to be 0x7FC (2044). Clamp the user input to the maximum effective value of 0x7FC cycles. Fixes: f94aa354d676 ("iio: impedance-analyzer: New driver for AD5933/4 Impedance Converter, Network Analyzer") Cc: stable@vger.kernel.org Signed-off-by: Gabriel Shahrouzi <gshahrouzi@gmail.com> Reviewed-by: Marcelo Schmitt <marcelo.schmitt1@gmail.com> Link: https://patch.msgid.link/20250420013009.847851-1-gshahrouzi@gmail.com Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2025-05-21iio: orientation: hid-sensor-rotation: remove unnecessary alignmentDavid Lechner1-1/+1
Remove __aligned(16) in the scan data struct in the hid-sensor-rotation driver. There is nothing in the code that requires this alignment. Signed-off-by: David Lechner <dlechner@baylibre.com> Reviewed-by: Andy Shevchenko <andy@kernel.org> Link: https://patch.msgid.link/20250418-iio-orientation-hid-sensor-rotation-remove-alignment-v1-1-6da68eae7ecf@baylibre.com Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2025-05-21iio: adc: hx711: use struct with aligned_s64 timestampDavid Lechner1-4/+7
Use a struct with aligned s64_timestamp instead of a padded array for the buffer used for iio_push_to_buffers_with_ts(). This makes it easier to see the correctness of the size and alignment of the buffer. Signed-off-by: David Lechner <dlechner@baylibre.com> Link: https://patch.msgid.link/20250418-iio-prefer-aligned_s64-timestamp-v1-3-4c6080710516@baylibre.com Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2025-05-21iio: accel: adxl345: set the tap suppress bit permanentlyLothar Rubusch1-0/+14
Set the suppress bit feature to the double tap detection, whenever double tap is enabled. This impedes the suppress bit dangling in any state, and thus varying in sensitivity for double tap detection. Any tap event is defined by a rising signal edge above threshold, i.e. duration time starts counting; and the falling edge under threshold within duration time, i.e. then the tap event is issued. This means duration is used individually for each tap event. For double tap detection after a single tap, a latency time needs to be specified. Usually tap events, i.e. spikes above and returning below threshold will be ignored within latency. After latency, the window time starts counting for a second tap detection which has to happen within a duration time. If the suppress bit is not set, spikes within latency time are ignored. Setting the suppress bit will invalidate the double tap function. The sensor will thus be able to save the window time for double tap detection, and follow a more strict definition of what signal qualifies for a double tap. In a summary having the suppress bit set, fewer signal spikes will be considered as double taps. This is an optional add on to double tap, thus a separate patch. Signed-off-by: Lothar Rubusch <l.rubusch@gmail.com> Link: https://patch.msgid.link/20250414184245.100280-5-l.rubusch@gmail.com Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2025-05-21iio: accel: adxl345: add double tap featureLothar Rubusch1-1/+103
Add the double tap feature of the sensor. The interrupt handler needs to catch and forward the event to the IIO channel. The single tap implementation now is extended to deal with double tap as well. Doubletap introduces window and latency times, both in us. Since both times are scaled, the 8-bit register value is stored in hardware, where the scaled value in [us] is stored as member variable. Signed-off-by: Lothar Rubusch <l.rubusch@gmail.com> Link: https://patch.msgid.link/20250414184245.100280-4-l.rubusch@gmail.com Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2025-05-21iio: accel: adxl345: add single tap featureLothar Rubusch1-3/+369
Add the single tap feature with a threshold in 62.5mg/LSB points and a scaled duration in us. Keep singletap threshold in regmap cache but the scaled value of duration in us as member variable. Both use IIO channels for individual enable of the x/y/z axis. Initializes threshold and duration with reasonable content. When an interrupt is caught it will be pushed to the according IIO channel. Signed-off-by: Lothar Rubusch <l.rubusch@gmail.com> Link: https://patch.msgid.link/20250414184245.100280-3-l.rubusch@gmail.com Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2025-05-21iio: accel: adxl345: introduce adxl345_push_event functionLothar Rubusch1-9/+19
Move the fifo handling into a separate function. This is a preparation for a generic handling of the interrupt status register results. The function is supposed to handle particular sensor events, and later to forward them to the iio channel. This is needed to read out the interrupt status register. The function shall return occurring errors, if any, or 0 in case of handled events or read fifo content. Thus migrate fifo read-out and push fifo content to iio channels into this function to be built up with additional event handling. Signed-off-by: Lothar Rubusch <l.rubusch@gmail.com> Link: https://patch.msgid.link/20250414184245.100280-2-l.rubusch@gmail.com Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2025-05-21iio: dac: ad5592r: Delete stray unlock in ad5592r_write_raw()Dan Carpenter1-3/+1
This code was converted to use guard locks but one of the unlocks was accidentally overlooked. Delete it. Fixes: 135e101f4dd6 ("iio: dac: ad5592r: use lock guards") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Andy Shevchenko <andy@kernel.org> Reviewed-by: Nuno Sá <nuno.sa@analog.com> Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Link: https://patch.msgid.link/Z_-P7bsD3KL5K25R@stanley.mountain Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2025-05-21iio: frequency: ad9832: Remove unused parameter from data documentationGabriel Shahrouzi1-1/+0
This is a leftover from the patch: commit 566564e80b0e ("staging: iio: ad9832: use clock framework for clock reference"). The AD9832 driver uses the Common Clock Framework (CCF) to obtain the master clock (MCLK) frequency rather than relying on a frequency value passed from platform data. Signed-off-by: Gabriel Shahrouzi <gshahrouzi@gmail.com> Link: https://patch.msgid.link/20250417173333.607844-1-gshahrouzi@gmail.com Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2025-05-21iio: frequency: ad9832: Use FIELD_PREP macro to set bit fieldsSiddharth Menon1-44/+48
Use bitfield and bitmask macros to clearly specify AD9832 SPI command fields to make register write code more readable. Suggested-by: Marcelo Schmitt <marcelo.schmitt1@gmail.com> Reviewed-by: Marcelo Schmitt <marcelo.schmitt1@gmail.com> Signed-off-by: Siddharth Menon <simeddon@gmail.com> Link: https://patch.msgid.link/20250416140259.13431-1-simeddon@gmail.com Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2025-05-21iio: addac: ad74413r: use aligned_s64 for timestampDavid Lechner1-2/+3
Follow the pattern of other drivers and use aligned_s64 for the timestamp. Technically there was no issue here since AD74413R_FRAME_SIZE * AD74413R_CHANNEL_MAX == 16 and IIO_DMA_MINALIGN is always a multiple of 8. But best to conform in case someone copies this to new code and then tweaks something. Also move the unaligned.h header while touching this since it was the only one not in alphabetical order. Signed-off-by: David Lechner <dlechner@baylibre.com> Reviewed-by: Nuno Sá <nuno.sa@analog.com> Link: https://patch.msgid.link/20250417-iio-more-timestamp-alignment-v1-3-eafac1e22318@baylibre.com Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2025-05-21iio: adc: mt6360-adc: use aligned_s64 for timestampDavid Lechner1-2/+2
Follow the pattern of other drivers and use aligned_s64 for the timestamp. This will ensure that the timestamp is correctly aligned on all architectures. It also ensures that the struct itself it also 8-byte aligned so we can drop the explicit __aligned(8) attribute. Signed-off-by: David Lechner <dlechner@baylibre.com> Reviewed-by: Nuno Sá <nuno.sa@analog.com> Link: https://patch.msgid.link/20250417-iio-more-timestamp-alignment-v1-2-eafac1e22318@baylibre.com Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2025-05-21iio: magnetometer: Use iio_push_to_buffers_with_ts() to provide length for runtime checks.Jonathan Cameron10-18/+18
This new function allows us to perform debug checks in the helper to ensure that the overrun does not occur. Use it in all the simple cases where either a static buffer or a structure is used in the drivers. Reviewed-by: David Lechner <dlechner@baylibre.com> Link: https://patch.msgid.link/20250413103443.2420727-21-jic23@kernel.org Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2025-05-21iio: pressure: Use iio_push_to_buffers_with_ts() to provide length for runtime checks.Jonathan Cameron6-19/+26
This new function allows us to perform debug checks in the helper to ensure that the overrun does not occur. Use it in all the simple cases where either a static buffer or a structure is used in the drivers. Reviewed-by: Matti Vaittinen <mazziesaccount@gmail.com> # ROHM BM1390 Reviewed-by: David Lechner <dlechner@baylibre.com> Link: https://patch.msgid.link/20250413103443.2420727-20-jic23@kernel.org Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2025-05-21iio: pressure: zpa2326: Use aligned_s64 for the timestampJonathan Cameron1-1/+1
On x86_32 s64 fields are only 32-bit aligned. Hence force the alignment of the field and padding in the structure by using aligned_s64 instead. Reviewed-by: David Lechner <dlechner@baylibre.com> Link: https://patch.msgid.link/20250413103443.2420727-19-jic23@kernel.org Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2025-05-21iio: proximity: Use iio_push_to_buffers_with_ts() to provide length for runtime checks.Jonathan Cameron7-14/+15
This new function allows us to perform debug checks in the helper to ensure that the overrun does not occur. Use it in all the simple cases where either a static buffer or a structure is used in the drivers. Reviewed-by: David Lechner <dlechner@baylibre.com> Link: https://patch.msgid.link/20250413103443.2420727-18-jic23@kernel.org Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2025-05-21iio: proximity: irsd200: Use a struct for scan and iio_push_to_buffers_with_ts()Jonathan Cameron1-4/+8
The driver previously used an array of two s64, then type cast the pointer to write an s16 to the start. The code is made more readable using a structure. At the same time switch to the new iio_push_to_buffers_with_ts() helper to enable runtime checking of the size of the source buffer. Note that this approach uses a structure with holes, so use memset() to ensure those do not contain old kernel data as this data is passed to userspace. Reviewed-by: David Lechner <dlechner@baylibre.com> Link: https://patch.msgid.link/20250413103443.2420727-17-jic23@kernel.org Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2025-05-21iio: resolver: Use iio_push_to_buffers_with_ts() to provide length for runtime checks.Jonathan Cameron1-1/+2
This new function allows us to perform debug checks in the helper to ensure that the overrun does not occur. Use it in all the simple cases where either a static buffer or a structure is used in the drivers. Reviewed-by: David Lechner <dlechner@baylibre.com> Link: https://patch.msgid.link/20250413103443.2420727-16-jic23@kernel.org Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2025-05-21iio: temperature: Use iio_push_to_buffers_with_ts() to provide length for runtime checks.Jonathan Cameron3-6/+8
This new function allows us to perform debug checks in the helper to ensure that the overrun does not occur. Use it in all the simple cases where either a static buffer or a structure is used in the drivers. Reviewed-by: David Lechner <dlechner@baylibre.com> Link: https://patch.msgid.link/20250413103443.2420727-15-jic23@kernel.org Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2025-05-21iio: chemical: Use iio_push_to_buffers_with_ts() to provide length for runtime checks.Jonathan Cameron8-14/+17
This new function allows us to perform debug checks in the helper to ensure that the overrun does not occur. Use it in all the simple cases where either a static buffer or a structure is used in the drivers. Reviewed-by: David Lechner <dlechner@baylibre.com> Link: https://patch.msgid.link/20250413103443.2420727-13-jic23@kernel.org Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2025-05-21iio: accel: hid: Use iio_push_to_buffers_with_ts() to provide length for runtime checks.Jonathan Cameron1-1/+1
This new function allows us to perform debug checks in the helper to ensure that the overrun does not occur. For this case, the length being provided is already passed into the caller function so reuse that. Reviewed-by: David Lechner <dlechner@baylibre.com> Link: https://patch.msgid.link/20250413103443.2420727-12-jic23@kernel.org Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2025-05-21iio: accel: Use iio_push_to_buffers_with_ts() to provide length for runtime checks.Jonathan Cameron14-28/+31
This new function allows us to perform debug checks in the helper to ensure that the overrun does not occur. Use it in all the simple cases where either a static buffer or a structure is used in the drivers. Reviewed-by: David Lechner <dlechner@baylibre.com> Link: https://patch.msgid.link/20250413103443.2420727-11-jic23@kernel.org Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2025-05-21iio: adc: Use iio_push_to_buffers_with_ts() to provide length for runtime checks.Jonathan Cameron34-63/+71
This new function allows us to perform debug checks in the helper to ensure that the overrun does not occur. Use it in all the simple cases where either a static buffer or a structure is used in the drivers. Reviewed-by: David Lechner <dlechner@baylibre.com> Link: https://patch.msgid.link/20250413103443.2420727-10-jic23@kernel.org Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2025-05-21iio: adc: ti-ads131e08: Use new iio_push_to_buffers_with_ts() to provide length sanity check.Jonathan Cameron1-2/+2
By providing the size of the buffer used, runtime checks can be performed to ensure not overrun. Also change the pushed data pointer to be that of the structure that also contains the timestamp. Not an actual bug but semantically incorrect to push the channel data when we want the storage with the timestamp as well. Reviewed-by: David Lechner <dlechner@baylibre.com> Link: https://patch.msgid.link/20250413103443.2420727-9-jic23@kernel.org Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2025-05-21iio: dummy: Switch to iio_push_to_buffers_with_ts() and provide size of storageJonathan Cameron1-2/+2
Provide the storage size so that the helper can sanity check that it is large enough for the configured channels. Reviewed-by: Nuno Sá <nuno.sa@analog.com> Reviewed-by: David Lechner <dlechner@baylibre.com> Link: https://patch.msgid.link/20250413103443.2420727-8-jic23@kernel.org Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2025-05-21iio: dummy: Use a fixed structure to build up scan to push to buffers.Jonathan Cameron1-7/+18
It has long been discouraged for drivers to make use of iio_dev->scan_bytes directly as that is an implementation detail of the core. As such our example driver should definitely not be doing so. In order to illustrate the more complex case, where a DMA safe buffer is needed, continue to kzalloc() the storage (but with a structure definition to provide an explicit data layout). Also add comments on when a DMA safe buffer is necessary and the two common ways of obtaining one. Whilst we have a mixture of signed and unsigned channels, the unsigned channels have ranges that can be stored in a signed value - hence use signed storage for all channels, simplifying the structure definition. Reviewed-by: David Lechner <dlechner@baylibre.com> Link: https://patch.msgid.link/20250413103443.2420727-7-jic23@kernel.org Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2025-05-21usb: usbtmc: Fix timeout value in get_stbDave Penkler1-1/+3
wait_event_interruptible_timeout requires a timeout argument in units of jiffies. It was being called in usbtmc_get_stb with the usb timeout value which is in units of milliseconds. Pass the timeout argument converted to jiffies. Fixes: 048c6d88a021 ("usb: usbtmc: Add ioctls to set/get usb timeout") Cc: stable@vger.kernel.org Signed-off-by: Dave Penkler <dpenkler@gmail.com> Link: https://lore.kernel.org/r/20250521121656.18174-4-dpenkler@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-05-21usb: usbtmc: Fix read_stb function and get_stb ioctlDave Penkler1-8/+9
The usbtmc488_ioctl_read_stb function relied on a positive return from usbtmc_get_stb to reset the srq condition in the driver. The USBTMC_IOCTL_GET_STB case tested for a positive return to return the stb to the user. Commit: <cac01bd178d6> ("usb: usbtmc: Fix erroneous get_stb ioctl error returns") changed the return value of usbtmc_get_stb to 0 on success instead of returning the value of usb_control_msg which is positive in the normal case. This change caused the function usbtmc488_ioctl_read_stb and the USBTMC_IOCTL_GET_STB ioctl to no longer function correctly. Change the test in usbtmc488_ioctl_read_stb to test for failure first and return the failure code immediately. Change the test for the USBTMC_IOCTL_GET_STB ioctl to test for 0 instead of a positive value. Fixes: cac01bd178d6 ("usb: usbtmc: Fix erroneous get_stb ioctl error returns") Cc: stable@vger.kernel.org Signed-off-by: Dave Penkler <dpenkler@gmail.com> Link: https://lore.kernel.org/r/20250521121656.18174-3-dpenkler@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-05-21nvme: avoid creating multipath sysfs group under namespace path devicesNilay Shroff1-0/+28
Commit 4dbd2b2ebe4c ("nvme-multipath: Add visibility for round-robin io-policy") introduced the creation of the multipath sysfs group under the NVMe head gendisk device node. However, it also inadvertently added the same sysfs group under each namespace path device which head node refers to and that is incorrect. The multipath sysfs group should only be exposed through the namespace head gendisk node. This is sufficient, as the head device already provides symbolic links to the individual namespace paths it manages. This patch fixes the issue by preventing the creation of the multipath sysfs group under namespace path devices, ensuring it only appears under the head disk node. Fixes: 4dbd2b2ebe4c ("nvme-multipath: Add visibility for round-robin io-policy") Signed-off-by: Nilay Shroff <nilay@linux.ibm.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
2025-05-21irqdomain: spmi: Switch to irq_domain_create_tree()Jiri Slaby (SUSE)1-1/+1
irq_domain_add_tree() is going away as being obsolete now. Switch to the preferred irq_domain_create_tree(). That differs in the first parameter: It takes more generic struct fwnode_handle instead of struct device_node. Therefore, of_fwnode_handle() is added around the parameter. Note some of the users can likely use dev->fwnode directly instead of indirect of_fwnode_handle(dev->of_node). But dev->fwnode is not guaranteed to be set for all, so this has to be investigated on case to case basis (by people who can actually test with the HW). Signed-off-by: "Jiri Slaby (SUSE)" <jirislaby@kernel.org> Cc: Stephen Boyd <sboyd@kernel.org> Link: https://lore.kernel.org/r/20250319092951.37667-37-jirislaby@kernel.org Signed-off-by: Stephen Boyd <sboyd@kernel.org> Link: https://lore.kernel.org/r/20250518032330.2959766-5-sboyd@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-05-21spmi: add a spmi driver for Apple SoCJean-Francois Bortolotti3-0/+177
The connected PMU contains several useful nvmem cells such as RTC offset, boot failure counters, reboot/shutdown selector, and a few others. In addition M3+ machines have their USB-PD controller connected via SPMI. Signed-off-by: Jean-Francois Bortolotti <jeff@borto.fr> Reviewed-by: Sven Peter <sven@svenpeter.dev> Reviewed-by: Alyssa Rosenzweig <alyssa@rosenzweig.io> Co-developed-by: Sasha Finkelstein <fnkl.kernel@gmail.com> Signed-off-by: Sasha Finkelstein <fnkl.kernel@gmail.com> Link: https://lore.kernel.org/r/20250409-spmi-v4-2-eb81ecfd1f64@gmail.com Reviewed-by: Neal Gompa <neal@gompa.dev> Signed-off-by: Stephen Boyd <sboyd@kernel.org> Link: https://lore.kernel.org/r/20250518032330.2959766-4-sboyd@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-05-21spmi: Only use Hikey 970 SPMI controller driver when ARM64WangYuli1-0/+1
SPMI_HISI3670, the Hikey 970 SPMI controller driver, is only required to use the Kirin 970 SPMI bus. And the Kirin 970 is an ARM64-based SoC, it cannot be used on platforms of other architectures. Link: https://lore.kernel.org/all/b4810f476e41e7de4efdf28b42472ae4ffe7defe.1597647359.git.mchehab+huawei@kernel.org/ Reported-by: Wentao Guan <guanwentao@uniontech.com> Closes: https://github.com/deepin-community/kernel/pull/604 Signed-off-by: WangYuli <wangyuli@uniontech.com> Link: https://lore.kernel.org/r/23BAA675A75EF4F5+20250218050552.57711-1-wangyuli@uniontech.com Signed-off-by: Stephen Boyd <sboyd@kernel.org> Link: https://lore.kernel.org/r/20250518032330.2959766-2-sboyd@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-05-21hpet: Remove unnecessary NULL check before unregister_sysctl_table()Chen Ni1-2/+1
unregister_sysctl_table() checks for NULL pointers internally. Remove unneeded NULL check here. Signed-off-by: Chen Ni <nichen@iscas.ac.cn> Acked-by: Clemens Ladisch <clemens@ladisch.de> Link: https://lore.kernel.org/r/20250514032637.2317639-1-nichen@iscas.ac.cn Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-05-21VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notifyWupeng Ma1-6/+5
During our test, it is found that a warning can be trigger in try_grab_folio as follow: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 1678 at mm/gup.c:147 try_grab_folio+0x106/0x130 Modules linked in: CPU: 0 UID: 0 PID: 1678 Comm: syz.3.31 Not tainted 6.15.0-rc5 #163 PREEMPT(undef) RIP: 0010:try_grab_folio+0x106/0x130 Call Trace: <TASK> follow_huge_pmd+0x240/0x8e0 follow_pmd_mask.constprop.0.isra.0+0x40b/0x5c0 follow_pud_mask.constprop.0.isra.0+0x14a/0x170 follow_page_mask+0x1c2/0x1f0 __get_user_pages+0x176/0x950 __gup_longterm_locked+0x15b/0x1060 ? gup_fast+0x120/0x1f0 gup_fast_fallback+0x17e/0x230 get_user_pages_fast+0x5f/0x80 vmci_host_unlocked_ioctl+0x21c/0xf80 RIP: 0033:0x54d2cd ---[ end trace 0000000000000000 ]--- Digging into the source, context->notify_page may init by get_user_pages_fast and can be seen in vmci_ctx_unset_notify which will try to put_page. However get_user_pages_fast is not finished here and lead to following try_grab_folio warning. The race condition is shown as follow: cpu0 cpu1 vmci_host_do_set_notify vmci_host_setup_notify get_user_pages_fast(uva, 1, FOLL_WRITE, &context->notify_page); lockless_pages_from_mm gup_pgd_range gup_huge_pmd // update &context->notify_page vmci_host_do_set_notify vmci_ctx_unset_notify notify_page = context->notify_page; if (notify_page) put_page(notify_page); // page is freed __gup_longterm_locked __get_user_pages follow_trans_huge_pmd try_grab_folio // warn here To slove this, use local variable page to make notify_page can be seen after finish get_user_pages_fast. Fixes: a1d88436d53a ("VMCI: Fix two UVA mapping bugs") Cc: stable <stable@kernel.org> Closes: https://lore.kernel.org/all/e91da589-ad57-3969-d979-879bbd10dddd@huawei.com/ Signed-off-by: Wupeng Ma <mawupeng1@huawei.com> Link: https://lore.kernel.org/r/20250510033040.901582-1-mawupeng1@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-05-21mei: vsc: Cast tx_buf to (__be32 *) when passed to cpu_to_be32_array()Hans de Goede1-2/+2
Commit f88c0c72ffb0 ("mei: vsc: Use struct vsc_tp_packet as vsc-tp tx_buf and rx_buf type") changed the type of tx_buf from "void *" to "struct vsc_tp_packet *" and added a cast to (u32 *) when passing it to cpu_to_be32_array() and the same change was made for rx_buf. This triggers the type-check warning in sparse: vsc-tp.c:327:28: sparse: expected restricted __be32 [usertype] *dst vsc-tp.c:327:28: sparse: got unsigned int [usertype] * vsc-tp.c:343:42: sparse: expected restricted __be32 const [usertype] *src vsc-tp.c:343:42: sparse: got unsigned int [usertype] * Fix this by casting to (__be32 *) instead. Note actually changing the type of the buffers to "be32 *" is not an option this buffer does actually contain a "struct vsc_tp_packet" and is used as such most of the time. vsc_tp_rom_xfer() re-uses the buffers as just dumb arrays of 32 bit words to talk to the device before the firmware has booted, to avoid needing to allocate a separate buffer. Fixes: f88c0c72ffb0 ("mei: vsc: Use struct vsc_tp_packet as vsc-tp tx_buf and rx_buf type") Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202505071634.kZ0I7Va6-lkp@intel.com/ Signed-off-by: Hans de Goede <hdegoede@redhat.com> Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com> Link: https://lore.kernel.org/r/20250507090728.115910-1-hdegoede@redhat.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-05-21char: tlclk: Fix correct sysfs directory path for tlclkRoxana Nicolescu1-1/+1
The tlckl driver does not create a platform device anymore. It was recently changed to use a faux device instead. Therefore the sysfs path has changed from /sys/devices/platform/telco_clock to /sys/devices/faux/telco_clock. Fixes: 72239a78f9f5 ("tlclk: convert to use faux_device") Signed-off-by: Roxana Nicolescu <nicolescu.roxana@protonmail.com> Link: https://lore.kernel.org/r/20250501200457.18506-1-nicolescu.roxana@protonmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-05-21wifi: mt76: mt7996: remove duplicate check in mt7996_mcu_sta_mld_setup_tlv()Dan Carpenter1-3/+0
The "msta_link" pointer has two NULL checks. Delete the second check. Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Acked-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/fde7246b-08a2-4c2f-b2dc-c3fd0e6b300b@stanley.mountain Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-05-21Revert "wifi: mt76: Check link_conf pointer in mt76_connac_mcu_sta_basic_tlv()"Lorenzo Bianconi1-1/+1
In mt76_connac_mcu_sta_basic_tlv() link_conf is always not NULL. Revert the commit '9890624c1b39 ("wifi: mt76: Check link_conf pointer in mt76_connac_mcu_sta_basic_tlv()")' in order to fix the following warning: drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c:394 mt76_connac_mcu_sta_basic_tlv() warn: variable dereferenced before check 'link_conf' This reverts commit 9890624c1b3948c1c7f1d0e19ef0bb7680b8c80d. Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20250325-mt76_connac_mcu_sta_basic_tlv-link_conf-revert-v1-1-b84efefb74ee@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-05-21wifi: mt76: mt7996: fix uninitialized symbol warningsunliming1-2/+2
Fix below smatch warnings: drivers/net/wireless/mediatek/mt76/mt7996/main.c:952 mt7996_mac_sta_add_links() error: uninitialized symbol 'err'. drivers/net/wireless/mediatek/mt76/mt7996/main.c:1133 mt7996_set_rts_threshold() error: uninitialized symbol 'ret'. Reported-by: kernel test robot <lkp@intel.com> Reported-by: Dan Carpenter <error27@gmail.com> Closes: https://lore.kernel.org/r/202504101051.1ya4Z4va-lkp@intel.com/ Signed-off-by: sunliming <sunliming@kylinos.cn> Link: https://patch.msgid.link/20250419031528.2073892-1-sunliming@linux.dev Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-05-21wifi: mt76: mt7996: avoid null deref in mt7996_stop_phy()Qasim Ijaz1-1/+3
In mt7996_stop_phy() the mt7996_phy structure is dereferenced before the null sanity check which could lead to a null deref. Fix by moving the dereference operation after the sanity check. Fixes: 69d54ce7491d ("wifi: mt76: mt7996: switch to single multi-radio wiphy") Signed-off-by: Qasim Ijaz <qasdev00@gmail.com> Link: https://patch.msgid.link/20250421111344.11484-1-qasdev00@gmail.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-05-21wifi: mt76: mt7996: avoid NULL pointer dereference in mt7996_set_monitor()Qasim Ijaz1-1/+3
The function mt7996_set_monitor() dereferences phy before the NULL sanity check. Fix this to avoid NULL pointer dereference by moving the dereference after the check. Fixes: 69d54ce7491d ("wifi: mt76: mt7996: switch to single multi-radio wiphy") Signed-off-by: Qasim Ijaz <qasdev00@gmail.com> Link: https://patch.msgid.link/20250421112544.13430-1-qasdev00@gmail.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-05-21wifi: mt76: mt7921: add 160 MHz AP for mt7922 deviceSamuel Williams1-0/+5
This allows mt7922 in hostapd mode to transmit up to 1.4 Gbps. Signed-off-by: Samuel Williams <sam8641@gmail.com> Link: https://patch.msgid.link/20250511005316.1118961-1-sam8641@gmail.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-05-21wifi: mt76: mt7925: fix host interrupt register initializationMichael Lo2-4/+1
ensure proper interrupt handling and aligns with the hardware spec by updating the register offset for MT_WFDMA0_HOST_INT_ENA. Cc: stable@vger.kernel.org Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips") Signed-off-by: Michael Lo <michael.lo@mediatek.com> Signed-off-by: Ming Yen Hsieh <mingyen.hsieh@mediatek.com> Link: https://patch.msgid.link/20250509083512.455095-1-mingyen.hsieh@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-05-21wifi: mt76: mt7925: introduce thermal protectionLeon Yen3-1/+26
Add thermal protection to prevent the chip from possible overheating due to prolonged high traffic and adverse operating conditions. Signed-off-by: Leon Yen <leon.yen@mediatek.com> Signed-off-by: Ming Yen Hsieh <mingyen.hsieh@mediatek.com> Link: https://patch.msgid.link/20250509082117.453819-1-mingyen.hsieh@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-05-21wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519RHenk Vergonet2-1/+14
Adds support for: - LiteOn WN4516R - LiteOn WN4519R Both use: - A nonstandard USB connector - Mediatek chipset MT7600U - ASIC revision: 76320044 Disabled VHT support on ASIC revision 76320044: This fixes the 5G connectibity issue on LiteOn WN4519R module see https://github.com/openwrt/mt76/issues/971 And may also fix the 5G issues on the XBox One Wireless Adapter see https://github.com/openwrt/mt76/issues/200 I have looked at the FCC info related to the MT7632U chip as mentioned in here: https://github.com/openwrt/mt76/issues/459 These confirm the chipset does not support 'ac' mode and hence VHT should be turned of. Signed-off-by: Henk Vergonet <henk.vergonet@gmail.com> Acked-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20250418143914.31384-1-henk.vergonet@gmail.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-05-21wifi: mt76: Remove an unneeded local variable in mt76x02_dma_init()Christophe JAILLET1-1/+0
Remove 't' which is unneeded since commit f3950a414143 ("mt76: set txwi_size according to the driver value") This slightly simplifies the code. Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Link: https://patch.msgid.link/e86d5602bdd8b6bd22258ee69536992f39470bf5.1744928865.git.christophe.jaillet@wanadoo.fr Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-05-21wifi: mt76: mt7996: prevent uninit return in mt7996_mac_sta_add_linksQasim Ijaz1-3/+9
If link_conf_dereference_protected() or mt7996_vif_link() or link_sta_dereference_protected() fail the code jumps to the error_unlink label and returns ret which is uninitialised. Fix this by setting err before jumping to error_unlink. Fixes: c7e4fc362443 ("wifi: mt76: mt7996: Update mt7996_mcu_add_sta to MLO support") Fixes: dd82a9e02c05 ("wifi: mt76: mt7996: Rely on mt7996_sta_link in sta_add/sta_remove callbacks") Signed-off-by: Qasim Ijaz <qasdev00@gmail.com> Link: https://patch.msgid.link/20250421110550.9839-1-qasdev00@gmail.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-05-21Revert "wifi: mt76: mt7996: fill txd by host driver"Shayne Chen1-4/+9
This reverts commit 3b522cadedfe6e9e0e8193d7d4ab5aa8d0c73209. The MTK connac3 has introduced new hardware, SDO (Software Defined Offload), to offload the process of filling the TX descriptor. Initially, there were some issues, but after several fixes, it should now be stable, allowing us to revert this commit. Additionally, activating SDO is essential for the proper functioning of features like TX checksum offload. Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Link: https://patch.msgid.link/20250328022847.1612082-1-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-05-21wifi: mt76: mt7996: Add NULL check in mt7996_thermal_initCharles Han1-0/+3
devm_kasprintf() can return a NULL pointer on failure,but this returned value in mt7996_thermal_init() is not checked. Add NULL check in mt7996_thermal_init(), to handle kernel NULL pointer dereference error. Fixes: 69d54ce7491d ("wifi: mt76: mt7996: switch to single multi-radio wiphy") Signed-off-by: Charles Han <hanchunchao@inspur.com> Link: https://patch.msgid.link/20250407095551.32127-1-hanchunchao@inspur.com Signed-off-by: Felix Fietkau <nbd@nbd.name>