summaryrefslogtreecommitdiff
path: root/drivers/iio/imu
AgeCommit message (Collapse)Author
2026-10-05Merge 7.3-rc6 into char-misc-nextGreg Kroah-Hartman
This resolves a number of merge conflicts between the branches, and we pick up the fixes in 7.3-rc6 that we need for testing. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-09-30iio: imu: inv_icm42607: restore runtime PM on system resume errorsLinmao Li
pm_runtime_force_suspend() leaves runtime PM disabled after it succeeds and expects pm_runtime_force_resume() to restore runtime PM management during system resume. The resume callback returns early if enabling the vddio regulator or synchronizing the register cache fails, skipping the matching pm_runtime_force_resume() call. Runtime PM consequently remains disabled after the system has resumed, so runtime autosuspend can no longer turn off sensors enabled afterward. Call pm_runtime_force_resume() on both error paths. Keep the first error as the return value and report a runtime PM restore failure separately. Fixes: 3007c1530f96 ("iio: imu: inv_icm42607: Add PM support for icm42607") Signed-off-by: Linmao Li <lilinmao@kylinos.cn> Tested-by: Kanak Shilledar <kanak.shilledar@axis.com> Tested-by: Chris Morgan <macromorgan@hotmail.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-09-30iio: imu: inv_icm42607: propagate runtime suspend errorsLinmao Li
The runtime suspend callback returns success when updating PWR_MGMT0 fails. The PM core then marks the device suspended even though the shutdown outcome is unknown. If the write did not reach the sensor, the sensors remain running and draw power while the device is idle. The condition need not persist. If the bus error clears, a later sensor access either reads the current PWR_MGMT0 value from hardware or retries programming the requested enabled mode, allowing normal operation to resume. Return the underlying errno to the PM core. -EAGAIN and -EBUSY retain their transient-error semantics; other errors put runtime PM into an error state and cause later PM acquires to fail until the status is explicitly reset. In the normal idle case, a successful system suspend can perform that reset. This leaves the transient-versus-fatal classification to the PM core and matches the sibling ICM-42600 driver. Keep a void wrapper for the managed teardown action, where errors can only be logged. Fixes: 3007c1530f96 ("iio: imu: inv_icm42607: Add PM support for icm42607") Signed-off-by: Linmao Li <lilinmao@kylinos.cn> Tested-by: Kanak Shilledar <kanak.shilledar@axis.com> Tested-by: Chris Morgan <macromorgan@hotmail.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-09-28iio: imu: adis16400: validate SPI match dataJiale Yao
A device bound through driver_override need not match an entry in the driver tables. In that case spi_get_device_match_data() returns NULL, but adis16400_probe() immediately dereferences the result. Validate the match data before it is used. Fixes: 2ef920e0e5c0 ("iio: imu: adis16400: Use separate structures rather than an array for chip info") Signed-off-by: Jiale Yao <yaojiale02@163.com> Cc: stable@vger.kernel.org Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-09-21iio: imu: inv_icm42600: force accel odr change when switching power modeJean-Baptiste Maneyrol
When accel must switch from low-power mode to low-noise due to a change in ODR, there is an hardware bug that sometimes prevent the ODR change flag to be set in the FIFO header. If this happens, the driver is stuck waiting for the ODR change flag that is never happening. Fix this by using accel_force_odr flag set when switching mode for forcing apply of ODR change. Do the apply after parsing FIFO data to let the flag do the job if it is here. Fixes: ec74ae9fd37c ("iio: imu: inv_icm42600: add accurate timestamping") Cc: stable@vger.kernel.org Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-09-21iio: imu: st_lsm6dsx: Allocate ext_channels with ARRAY_SIZE()Kees Cook
In preparation for making the devm_kmalloc family of allocators type aware, we need to make sure that the returned type from the allocation matches the type of the variable being assigned. (Before, the allocator would always return "void *", which can be implicitly cast to any pointer type.) This is allocating a copy of magn_channels, which is an array of struct iio_chan_spec, but the size was taken from the whole array, which would make the allocation type a pointer to the array rather than the "struct iio_chan_spec *" being assigned. Allocate ARRAY_SIZE-many entries instead. The resulting allocation size is the same. Build tested ARCH=x86_64 allmodconfig with GCC 16.2.0: drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_shub.o Assisted-by: LLM coccinelle Signed-off-by: Kees Cook <kees+treewide@kernel.org> Acked-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-09-10iio: imu: adis16400: Check return value of spi_setup()Salah Triki
In adis16400_initial_setup(), the return value of spi_setup() was ignored. If SPI configuration fails, the driver would proceed with the initialization anyway, leading to undefined behavior or silent failures during device setup. Check the return value of spi_setup() and return the error code immediately if it fails. Fixes: cd888a17f95f ("staging:iio:adis16400: Use adis library") Signed-off-by: Salah Triki <salah.triki@gmail.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-09-10iio: imu: inv_icm42600: fix odr change not caught in certain casesJean-Baptiste Maneyrol
When using both accel and gyro with different frequencies, the ODR change flag in the FIFO header can be sometime in a packet with invalid data. Since we are ignoring these packets, we miss the ODR change and any further change are blocked until sensor is turned off. Fix this by moving the packet data validity check after the ODR change flag check. Fixes: ec74ae9fd37c ("iio: imu: inv_icm42600: add accurate timestamping") Cc: stable@vger.kernel.org Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-08-31iio: imu: inv_icm42600: do not read FIFO count for watermark itJean-Baptiste Maneyrol
Optimize data reading for high frequencies by not reading FIFO count in case of watermark interrupt. We cannot already read more than watermark samples because of the timestamping mechanism. It is required to not perturb the timing between the watermark interrupts. Since we also know there is at least watermark samples in the FIFO, let's just read these watermark FIFO samples directly without reading FIFO count in this case. Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-08-31iio: imu: inv_icm42600: simplify watermark computation by using GCDJean-Baptiste Maneyrol
The watermark computation was in fact resulting in computing the GCD of the latencies when both sensors are on. GCD is required because of the IIO buffer watermark. Move to use gcd() and update documentation accordingly. Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-08-31iio: imu: inv_icm42600: use 2 sensors fixed packet size of 16 bytesJean-Baptiste Maneyrol
Sometimes dynamic switch between 1 sensor frame to 2 sensors frame is not working when there are too much frames already in the FIFO. By moving accel/gyro on sleep before turning FIFO on, we are storing many FIFO frames before updating the frame format hitting the bug everytime. Fix that by always using the 2 sensors frame of 16 bytes. Also update the hwfifo max watermark reported. Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-08-31iio: imu: inv_icm42600: sleep before enabling FIFO dataJean-Baptiste Maneyrol
When turning accel or gyro on, a sleep is required for letting the mechanical part stabilize before reporting correct data. Move the sleep before enabling FIFO data to prevent push of incorrect data. We need to unlock the driver mutex while sleeping to not block data of the other sensor if it is running. There is no possible race here because we are already under IIO mode mutex locked since it is a IIO buffer callback. Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-08-31iio: imu: inv_icm42600: log whoami mismatch instead of failing probeJorijn van der Graaf
A WHOAMI value differing from the one the compatible implies aborts probe with -ENODEV, which prevents a register-compatible part described with a fallback compatible from probing at all. The devicetree compatible is authoritative for which part is fitted: log the mismatch at info level and continue. The message keeps a breadcrumb for anyone seeing an unexpected part change on their device versus the devicetree; tmp117 takes the same trade at the same level for its fallback matches. A whoami of 0x00 or 0xff still fails probe: SPI has no transfer-level ack, so those values mean nothing answered. Otherwise the probe outcome on mismatch changes for all parts the driver supports. The check sits before the mismatch comparison; it does not depend on hw->whoami, since no supported part uses either value (the WHOAMI values the driver defines span 0x40-0x5C). inv_icm45600 carries the same guard nested in its mismatch branch. Tested via a backport to a Fairphone 6 running a 7.1-based kernel: its ICM-42630 (WHOAMI 0x0C), described with an icm42631 fallback compatible and matched as icm42631, probes with the one informational line, and accelerometer, gyroscope and temperature reads work. Suggested-by: Conor Dooley <conor@kernel.org> Suggested-by: Jonathan Cameron <jic23@kernel.org> Assisted-by: Claude:claude-fable-5 Signed-off-by: Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-08-31iio: imu: adis16400: fix unprotected debugfs readsArka Mondal
adis16400_serial_number_fops is open coded and never calls debugfs_file_get(), so debugfs_remove_recursive() does not wait for a read in progress and unbind frees the iio_dev underneath it. Commit ae1d37a9bb4b ("iio: imu: adis16400: use DEFINE_DEBUGFS_ATTRIBUTE instead of DEFINE_SIMPLE_ATTRIBUTE") converted product_id and flash_count to DEFINE_DEBUGFS_ATTRIBUTE, which protects itself, but moved all three files to debugfs_create_file_unsafe(). serial_number prints three registers as "%.4x-%.4x-%.4x" and DEFINE_DEBUGFS_ATTRIBUTE() formats a single u64, so it cannot be converted without changing what the file returns. adis16475 and adis16550 already use debugfs_create_file() for their open coded files. Use it here too. Fixes: ae1d37a9bb4b ("iio: imu: adis16400: use DEFINE_DEBUGFS_ATTRIBUTE instead of DEFINE_SIMPLE_ATTRIBUTE") Signed-off-by: Arka Mondal <arkamondalofficial@gmail.com> Cc: stable@vger.kernel.org Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-08-31iio: imu: adis16480: fix unprotected debugfs readsArka Mondal
The firmware_revision and firmware_date file operations are open coded and never call debugfs_file_get(), which debugfs_create_file_unsafe() requires. debugfs_remove_recursive() therefore does not wait for a read in progress, and unbind frees the iio_dev underneath it. Use debugfs_create_file() instead. Fixes: 9bf94f836e32 ("imu:adis16480: fix debugfs_simple_attr.cocci warnings") Signed-off-by: Arka Mondal <arkamondalofficial@gmail.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Cc: stable@vger.kernel.org Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-08-31iio: imu: inv_icm42600: sort device id tables numericallyJorijn van der Graaf
The I2C, SPI and OF device id tables list the parts in the chip enum's declaration order, which is neither numeric nor alphabetical. Sort the entries numerically by part number so new entries have an unambiguous position. Suggested-by: Jonathan Cameron <jic23@kernel.org> Link: https://lore.kernel.org/all/20260724012505.02029e51@jic23-huawei/ Assisted-by: Claude:claude-fable-5 Signed-off-by: Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-08-31iio: imu: inv_mpu6050: Unshadow error codes in ->store()Andy Shevchenko
kstrtox() may return different error codes. Unshadow them in the ->store() callback to give better error report. While at it, add missing kstrtox.h inclusion. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Reviewed-by: Maxwell Doose <maxwell@maxwelld.cc> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-08-19Merge tag 'iio-for-7.3a' of ↵Greg Kroah-Hartman
ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-next Jonathan writes: IIO new device support, features, cleanup for 7.3 Includes a merge of 7.2-rc2 to pick up the changes around mod_devicetable.h and reduce resulting conflicts around includes. New device support ------------------ adi,ad3530R - Add support for the AD3532R and AD3532 16 channel DACs. adi,ad4080 - Add support for the AD4883 ADC. adi,ad5686 - Add support for AD5313R, AD5317R, AD5674, AD5687R, AD5689, AD5689R DACs over SPI - Add support for AD5316R, AD5674, AD5697R and AD5696 DACs over I2C - Significant driver refactoring prior to these additions, partly to reduce bus traffic and to add triggered buffer and gain control support. An earlier set added support for missing supplies, reset and LDAC GPIO. adi,adf41513 - New driver to support this PLL frequency synthesizer that runs up to 26.5 GHz. - Included infrastructure to handle higher precision attributes with extensive tests adi,ltc2378-20 - New driver supporting LTC2338, LTC2364, LTC2367, LTC2368, LT2369, LTC2370 LTC2376, LTC2377, LTC2378, LTC2379 and LTC23980 ADCs with both high speed capture via appropriate backend and conventional triggered buffer SPI capture. invensense,icm42607 - New driver for this IMU. mediateck,mt6323 - New driver for this PMIC ADC. microchip,mcp47a1 - New driver for this I2C 6 bit DAC. nxp,mcf54415-dac - New driver for this DAC found in NXP SoCs. qst,qmc5884l - New driver for this 3 axis magnetometer. Included dt vendor entry for qst. qst,qmc6308 - New driver for this 3 axis magnetometer. sensiron,slf3s - New driver for this liquid flow sensor. Includes adding IIO_VOLUMEFLOW channel type. st,vl53l1x - Refactors to improve readability. ti,ads112c14 - New driver supporting the ADS112C14 and ADS122C14 ADCs. These bring some new ABI for input chopping, particular useful for resistive sensors like thermocouples or Wheatstone bridges. - Support CRC8 detection of corruption on the bus. - Support buffered reads. ti,tmp117 - (trivial) Add support for the tmp119 temperature sensor. xilinx,versal-sysmon - New ADC driver for this block found on various FPGAs including various bus interfaces, threshold and oversampling support. dt binding updates ------------------ new shared bindings - excitation-channels and excitation-current-nanoamp allow per channel specification of currents used for resistive sensor measurement. - reference-sources property to allow selection of a per channel reference. rockchip,saradc - Add RV1106 which is compatible with the RV3588. Features -------- buffer-dmaengine - Allow cyclic buffers, useful for repeating sequence generation with DACs. devantech,dmard09 - Implement read back of channel scale - previously interface always returned an error. hid,sensors-als - Enable separate channel scaling for hardware that supports it. invensense,timestamp library - Various precision improvements. invensense,icm42600 - Add support for hwfifo watermark interfaces. taos,tcs3472 - Support wait time and sampling frequency control. Cleanups, minor fixes --------------------- Minor cleanups not mentioned at all in this summary such as white space fixes or typos. Affecting various drivers - Cleanup of conditionals that had no affect. - Drop some runtime pm local wrappers as now runtime_pm does the mark_last_busy part inside the put, these provide no useful code deduplication or readability advantages over directly calling the runtime_pm functions. - Return 0 from write_raw() on success. - Use of dev_err_probe() to simplify code and sometimes provide useful info for deferred probe debugging. - Drop some redundant error prints where the called function already provides information on errors. - Make some read only arrays in functions static. - Fix up missing handling of regcache_sync() errors. - Drop some false kernel-doc markings. - Add missing MODULE_DEVICE_TABLE for some of_match_id tables. - Use local variables for things like the struct device to shorten and improve readability of code. - Drop some unused structure elements. - Reorder dds.h macro parameters to be inline with others. - Header reorders and IWYU. Often part of a more significant series. - Remove abstractions designed to allow a driver to support multiple device types, when they have been around a long time and only the original part showed up. - Initialize spi_device_id arrays using member names following dropping of driver data from drivers that didn't actually use it. - Catch up with i2c_device_id tables added since previous effort to use named initializers for all those. - Use kernel types in a few places instead of standard C ones or bare unsigned. Misc - Update Xilinx AMS maintainer. - Update email address for Maxwell Doose. - Update email address for Siratul Islam. - Update email address for Tomasz Duszynski and re-add Tomasz to various maintainer entries. Docs - Encourage use of differential channel naming even when there is no flexibility in input to differential pair mapping. Intended to provide a strong signal to userspace that a channel is differential. adi,ad_sigma_delta - Allow COMPILE_TEST without any users. adi,ad2s1201 - Refactor trigger handler to avoid mix of guard() and goto. adi,ad5686 - Avoid potential NULL dereference is user forces a driver bind. adi,ad5696 - Add a couple of missing entries to the of_match_id table and update binding to match. atmel,ad91_adc - Use const char * for DT string property allowing a cast to be dropped. avia,hx711 - Various refactors and cleanup to enable support of additional parts (to come) - Add missing supply and gpio dt-bindings. bosch,bmc150 - Harden against device reporting too large a FIFO sample count. - Use FIELD_PREP() / FIELD_GET() to improve readability. freescale,fxls8962af - Harden against device reporting too large a FIFO sample count. hid-sensors-* - Reorder probe to not expose userspace interfaces until the rest of the setup is done to avoid potentially dropping data. honeywell,abp2030pa - Drop an unreachable return. invensens,icm45600 - Harden against bad value of FIFO sample count from device. - Use i2c_match_data if firmware table sourced match data isn't available. nxp,mpl1115 - Ensure runtime_pm is balanced on error in probe. rohm,bm1390 - Make the driver slightly more likely to recover from transient errors. sensiron,sgp30 - Handle thread creation errors. st,lsm6dsx - Update the enable mask when doing sensor fusion to avoid incorrect fifo data handling. st,stm32-dfsdm - Treat dt flags as booleans. ti,ads1015 - Switch to devm helpers which simplified code and closed a resource leak. ti,opt3001 - Split complicated opt3001_get_processed() logic into irq an no irq helper functions. - Use devm to simplify code. - Use guard() to simplify code. - Reorder probe so final call exposes userspace interfaces. - Various other more minor cleanup taos,tsl2772 - Fix calibscale readback to check right channel type. taos,tsl2583 - Use sysfs_emit() and sysfs_emit_at() to replace open coded equivalents. * tag 'iio-for-7.3a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio: (232 commits) iio: dac: mcp47a1: add support for new device dt-bindings: iio: dac: add support for mcp47a1 iio: Update email for Maxwell Doose iio: imu: st_lsm6dsx: Update enable mask when using sensor fusion iio: light: cm32181: return zero after writing calibscale iio: flow: add Sensirion SLF3S liquid flow sensor driver iio: core: add IIO_VAL_DECIMAL64_FEMTO format type dt-bindings: iio: flow: add Sensirion SLF3S liquid flow sensor iio: types: add IIO_VOLUMEFLOW channel type iio: ABI: Encourage differential voltage ABI usage iio: adc: ltc2378: Add support for LTC2338-18 iio: adc: ltc2378: Enable triggered buffer data capture iio: adc: ltc2378: Enable high-speed data capture iio: adc: ltc2378: Add support for LTC2378-20 and similar ADCs dt-bindings: iio: adc: Add ltc2378 iio: magnetometer: ak8974: remove conditional return with no effect iio: light: tsl2583: remove conditional return with no effect iio: adc: rcar-gyroadc: remove rcar_gyroadc_set_power() helper iio: light: vcnl4000: remove vcnl4000_set_pm_runtime_state() helper iio: light: vcnl4035: remove vcnl4035_set_pm_runtime_state() helper ...
2026-08-05iio: imu: st_lsm6dsx: Update enable mask when using sensor fusionFrancesco Lavra
The enable_mask struct member keeps track of which sensors are enabled in the IMU. When enabling and disabling the sensor fusion functionality, the driver does not properly update this struct member. This prevents a correct calculation of the number of samples that should be read from the hardware FIFO; as a result, reads from the FIFO can be unnecessarily split into multiple transactions, some of which can read past the FIFO length. Fixes: cd4e1141bff8 ("iio: imu: st_lsm6dsx: Add support for rotation sensor") Signed-off-by: Francesco Lavra <flavra@baylibre.com> Acked-by: Lorenzo Bianconi <lorenzo@kernel.org> Cc: <Stable@vger.kernel.org> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-08-03iio: imu: inv_icm42607: Add Temp Support in icm42607Chris Morgan
Add functions for reading temperature sensor data. Signed-off-by: Chris Morgan <macromorgan@hotmail.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-08-03iio: imu: inv_icm42607: Add Gyroscope to icm42607Chris Morgan
Add gyroscope functions to the icm42607 driver. Signed-off-by: Chris Morgan <macromorgan@hotmail.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-08-03iio: imu: inv_icm42607: Add Accelerometer for icm42607Chris Morgan
Add icm42607 accelerometer sensor for icm42607. Signed-off-by: Chris Morgan <macromorgan@hotmail.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-08-03iio: imu: inv_icm42607: Add PM support for icm42607Chris Morgan
Add power management support for the ICM42607 device driver. Signed-off-by: Chris Morgan <macromorgan@hotmail.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-08-03iio: imu: inv_icm42607: Add SPI For icm42607Chris Morgan
Add SPI driver support for InvenSense ICM-42607 devices. Signed-off-by: Chris Morgan <macromorgan@hotmail.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-08-03iio: imu: inv_icm42607: Add inv_icm42607 Core DriverChris Morgan
Add the core component of a new inv_icm42607 driver. This includes a few setup functions and the full register definition in the header file, as well as the bits necessary to compile and probe the device when used on an i2c bus. Signed-off-by: Chris Morgan <macromorgan@hotmail.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-07-27iio: imu: Remove redundant dev_err()/dev_err_probe()Pan Chuang
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_threaded_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() and dev_err_probe() calls. Signed-off-by: Pan Chuang <panchuang@vivo.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-07-12Merge tag 'char-misc-7.2-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull Android/IIO fixes from Greg KH: "Here is a set of bugfixes for 7.2-rc3 that resolve a bunch of reported issues in just the binder and iio codebases. Included in here are: - binder driver bugfixes for both the rust and c versions for reported problems - lots and lots of iio driver bugfixes for lots of reported issues (including a hid sensor driver bugfix) Full details are in the shortlog, all of these have been in linux-next with no reported issues" * tag 'char-misc-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (36 commits) iio: event: Fix event FIFO reset race iio: imu: inv_icm42600: fix timestamp clock period by using lower value iio: light: al3010: fix incorrect scale for the highest gain range iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() iio: light: tsl2591: return actual error from probe IRQ failure iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading iio: imu: st_lsm6dsx: deselect shub page before reading whoami rust_binder: clear freeze listener on node removal rust_binder: reject context manager self-transaction rust_binder: use a u64 stride when cleaning up the offsets array binder: fix UAF in binder_free_transaction() binder: fix UAF in binder_thread_release() rust_binder: synchronize Rust Binder stats with freeze commands binder: cache secctx size before release zeroes it rust_binder: fix BINDER_GET_EXTENDED_ERROR iio: adc: ad7779: add missing 'select IIO_TRIGGERED_BUFFER' to Kconfig iio: adc: ad4130: add missing `select IIO_TRIGGERED_BUFFER` to Kconfig iio: adc: ti-ads124s08: Return reset GPIO lookup errors iio: temperature: Build mlx90635 with CONFIG_MLX90635 iio: light: al3320a: add missing REGMAP_I2C to Kconfig ...
2026-07-06Merge tag 'v7.2-rc2' into togregJonathan Cameron
Linux 7.2-rc2 Done to resolve conflicts with header reorg around mod_devicetable.h and provide a base for other inflight series that touch the includes.
2026-07-06iio: imu: inv_icm42600: fix timestamp clock period by using lower valueJean-Baptiste Maneyrol
Clock period value is used for computing periods of sampling. There is no need for it to be higher than the maximum odr, otherwise we are losing precision in the computation for nothing. Switch clock period value to maximum odr period (8kHz). Fixes: 0ecc363ccea7 ("iio: make invensense timestamp module generic") Cc: stable@vger.kernel.org Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2026-07-05iio: imu: bmi270: add missing MODULE_DEVICE_TABLE()Pengpeng Hou
The driver has an OF match table wired to .of_match_table, but does not export the table with MODULE_DEVICE_TABLE(). Add the missing MODULE_DEVICE_TABLE(of, ...) entry so module alias information is generated for OF based module autoloading. This is a source-level fix. It does not claim dynamic hardware reproduction; the evidence is the driver-owned match table, its use by the platform driver, and the missing module alias publication. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2026-07-05iio: imu: inv_icm42600: fix timestamping by limiting FIFO readingJean-Baptiste Maneyrol
Timestamps are made by measuring the chip clock using the watermark interrupts. If we read more than watermark samples as done today, we are reducing the period between interrupts and distort the time measurement. Fix that by reading only watermark samples in the interrupt case. Fixes: 7f85e42a6c54 ("iio: imu: inv_icm42600: add buffer support in iio devices") Cc: stable@vger.kernel.org Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2026-07-03iio: imu: st_lsm6dsx: deselect shub page before reading whoamiAndreas Kempe
As part of driver initialization, e.g. st_lsm6dsx_init_shub() selects the shub register page using st_lsm6dsx_set_page(). Selecting the shub register page shadows the regular register space so whoami, among other registers, is no longer accessible. In applications where the IMU is permanently powered separately from the processor, there is a window where a reset of the CPU leaves the IMU in the shub register page. Once this occurs, any subsequent probe attempt fails because of the register shadowing. Using the ism330dlc, the error typically looks like st_lsm6dsx_i2c 3-006a: unsupported whoami [10] with the unknown whoami read from a reserved register in the shub page. The reset register is also shadowed by the page select, preventing a reset from recovering the chip. Unconditionally clear the shub page before the whoami readout to ensure normal register access and allow the initialization to proceed. Place the fix in st_lsm6dsx_check_whoami() before the whoami check because hw->settings, which st_lsm6dsx_set_page() relies on, is first assigned in that function. Placing the fix in a more logical place than the whoami check would require a bigger restructuring of the code. Fixes: c91c1c844ebd ("iio: imu: st_lsm6dsx: add i2c embedded controller support") Signed-off-by: Andreas Kempe <andreas.kempe@actia.se> Acked-by: Lorenzo Bianconi <lorenzo@kernel.org> Cc: <Stable@vger.kernel.org> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2026-07-03Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c ↵Uwe Kleine-König (The Capable Hub)
files) Replace the #include of <linux/mod_devicetable.h> by the more specific <linux/device-id/*.h> where applicable. For most cases the include can be dropped completely, only a few drivers need one or two headers added. Acked-by: Danilo Krummrich <dakr@kernel.org> Acked-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Acked-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://patch.msgid.link/1a3f2007c5c5dcf555c09a4035ce3ae8ef1b6c49.1782808461.git.u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
2026-07-02iio: imu: inv_icm45600: clamp the device-reported FIFO sample countBryam Vargas
inv_icm45600_buffer_fifo_read() uses the FIFO_COUNT the device reports, unclamped, as the length of a regmap_noinc_read() into the fixed INV_ICM45600_FIFO_SIZE_MAX (8 KiB) st->fifo.data buffer. The only bound is the caller's "max", which the interrupt path skips (it passes 0). A device, or an attacker on the bus, reporting up to 65535 makes the read as large as ~1 MiB: a heap out-of-bounds write of device-controlled data. Clamp st->fifo.count to the buffer capacity before the read, and allocate the buffer with the same INV_ICM45600_FIFO_SIZE_MAX define, so the bound and the allocation reference one constant. The clamp is a no-op for conforming hardware. Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2026-07-02iio: imu: fix typos in commentsAnas Khan
Fix several comment misspellings across drivers/iio/imu/, found with codespell and manual review. The corrected words are coefficient, temperature, sensitivity, access, chosen, and buses. Signed-off-by: Anas Khan <anxkhn28@gmail.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2026-07-02iio: imu: inv_icm45600: Use I2C match dataPengpeng Hou
The I2C driver provides chip_info through both the OF match table and the I2C id table, but probe reads it with device_get_match_data(). That misses id-table driver_data for non-firmware I2C matches and can reject a supported device with -ENODEV. Use i2c_get_match_data() so the id-table chip_info is used when firmware match data is not present. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Reviewed-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com> Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2026-07-02iio: imu: inv_icm42600: add buffer hwfifo watermark attributesJean-Baptiste Maneyrol
Add hwfifo_watermark/min/max/enabled buffer attributes. Hardware FIFO is always enabled and used. Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2026-07-02iio: imu: inv_icm42600: reorder all driver headersJean-Baptiste Maneyrol
Reorder headers includes following IIO subsystem preferences. Suggested-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2026-07-01iio: imu: adis16550: Simplify device abstractionUwe Kleine-König (The Capable Hub)
The driver supports a single chip variant only. Simplify the driver by hard-coding the device properties instead of using the id_table's abstraction for a single chip type and a lookup in a table with only one entry. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Reviewed-by: Nuno Sá <nuno.sa@analog.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2026-06-30iio: Initialize spi_device_id arrays using member namesUwe Kleine-König (The Capable Hub)
While being less compact, using named initializers allows to more easily see which members of the structs are assigned which value without having to lookup the declaration of the struct. And it's also more robust against changes to the struct definition. The mentioned robustness is relevant for a planned change to struct spi_device_id that replaces .driver_data by an anonymous union. This patch doesn't modify the compiled arrays, only their representation in source form benefits. The former was confirmed with x86 and arm64 builds. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Acked-by: Linus Walleij <linusw@kernel.org> Reviewed-by: Nuno Sá <nuno.sa@analog.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2026-06-30iio: Drop unused assignment of spi_device_id driver dataUwe Kleine-König (The Capable Hub)
The drivers explicitly set the .driver_data member of struct spi_device_id to zero without relying on that value. Drop these unused assignments. While touching these arrays unify spacing and use named initializers for .name. This patch doesn't modify the compiled arrays, only their representation in source form benefits. The former was confirmed with x86 and arm64 builds. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Reviewed-by: Nuno Sá <nuno.sa@analog.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2026-06-29iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQRunyu Xiao
bmi160_probe_trigger() registers iio_trigger_generic_data_rdy_poll() through devm_request_irq(), but it passes only irq_type and does not add IRQF_NO_THREAD. When the kernel is booted with forced IRQ threading, the parent IRQ can otherwise be threaded by the IRQ core and the subsequent IIO trigger child IRQ is dispatched from irq/... thread context instead of hardirq context. Because the handler immediately pushes the event into iio_trigger_poll(), this violates the hardirq-only IIO trigger helper contract and can drive downstream trigger consumers through the wrong execution context. Add IRQF_NO_THREAD on top of irq_type when registering the BMI160 data- ready trigger handler. Fixes: 895bf81e6bbf ("iio:bmi160: add drdy interrupt support") Cc: stable@vger.kernel.org Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2026-06-29iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQRunyu Xiao
devm_adis_probe_trigger() registers iio_trigger_generic_data_rdy_poll() through devm_request_irq() on the non-FIFO path, but it does not add IRQF_NO_THREAD to the IRQ flags. When the kernel is booted with forced IRQ threading, the parent IRQ can otherwise be threaded by the IRQ core and the subsequent IIO trigger child IRQ is then dispatched from irq/... thread context instead of hardirq context. Because iio_trigger_generic_data_rdy_poll() immediately drives iio_trigger_poll(), this violates the hardirq-only IIO trigger helper contract and can push downstream trigger consumers through the wrong execution context. Add IRQF_NO_THREAD on top of the existing adis->irq_flag value for the non-FIFO request_irq() path, while preserving the current trigger polarity and IRQF_NO_AUTOEN behavior. Fixes: fec86c6b8369 ("iio: imu: adis: Add Managed device functions") Cc: stable@vger.kernel.org Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2026-06-29iio: imu: bmi323: remove unnecessary cast in watermark limitHungyu Lin
Remove the explicit u32 cast in the watermark limit calculation. The BMI323_FIFO_FULL_IN_FRAMES macro can be used directly with min() without triggering type issues. Signed-off-by: Hungyu Lin <dennylin0707@gmail.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Reviewed-by: Nuno Sá <nuno.sa@analog.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2026-06-02Merge tag 'v7.1-rc6' into workJonathan Cameron
Linux 7.1-rc6
2026-05-31iio: imu: bno055: terminate dev_err() strings with a newlineStepan Ionichev
Two dev_err() calls in bno055_ser_write_reg() and bno055_ser_read_reg() are missing the trailing newline, so the kernel log buffer continues the next message on the same line. Add the missing \n. Signed-off-by: Stepan Ionichev <sozdayvek@gmail.com> Reviewed-by: Maxwell Doose <m32285159@gmail.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2026-05-31iio: imu: kmx61: Use guard(mutex)() over manual lockingMaxwell Doose
Include linux/cleanup.h to take advantage of new macros. Replace manual mutex_lock() and mutex_unlock() calls across the file with guard(mutex)() and scoped_guard() where appropriate to simplify error paths and eliminate manual locking calls. Add new helper function kmx61_read_for_each_active_channel() to mitigate certain style issues and to prevent notifying that the IRQ is finished whilst holding the lock. Update certain returns, and add default case to return -EINVAL in kmx61_read_raw(). Remove now-redundant gotos and ret variables, as the new RAII macros make them unneeded. Signed-off-by: Maxwell Doose <m32285159@gmail.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2026-05-31iio: Initialize i2c_device_id arrays using member namesUwe Kleine-König (The Capable Hub)
While being less compact, using named initializers allows to more easily see which members of the structs are assigned which value without having to lookup the declaration of the struct. And it's also more robust against changes to the struct definition. The mentioned robustness is relevant for a planned change to struct i2c_device_id that replaces .driver_data by an anonymous union. This patch doesn't modify the compiled arrays, only their representation in source form benefits. The former was confirmed with x86 and arm64 builds. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Reviewed-by: Siratul Islam <email@sirat.me> Reviewed-by: Matti Vaittinen <mazziesaccount@gmail.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2026-05-15iio: imu: adis16550: fix stack leak in trigger handlerGreg Kroah-Hartman
adis16550_trigger_handler() declares the scan data array on the stack without initializing it. The memcpy() at the bottom fills only the first 28 bytes (TEMP + 6 channels of GYRO/ACCEL data), and iio_push_to_buffers_with_timestamp() writes the s64 timestamp at the 8-byte-aligned offset 32. Bytes 28-31 remain uninitialized stack data which leaks to userspace on ever trigger. Fix this all by just zero-initializing the structure on the stack. Cc: Lars-Peter Clausen <lars@metafoo.de> Cc: Michael Hennerich <Michael.Hennerich@analog.com> Cc: Jonathan Cameron <jic23@kernel.org> Cc: David Lechner <dlechner@baylibre.com> Cc: "Nuno Sá" <nuno.sa@analog.com> Cc: Andy Shevchenko <andy@kernel.org> Fixes: e4570f4bb231 ("iio: imu: adis16550: align buffers for timestamp") Cc: stable <stable@kernel.org> Assisted-by: gregkh_clanker_t1000 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Reviewed-by: David Lechner <dlechner@baylibre.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2026-05-15iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO bufferGreg Kroah-Hartman
The tagged FIFO path declares iio_buff on the stack with __aligned(8) but no initializer, but there is a hole in the structure, which will then leak to userspace as ST_LSM6DSX_SAMPLE_SIZE bytes (6) will be copied, but the space between that and the timestamp are not initialized. Commit c14edb4d0bdc ("iio:imu:st_lsm6dsx Fix alignment and data leak issues") moved the untagged FIFO path to a kzalloc'd buffer in hw->scan, but for the tagged path it only added the alignment qualifier and not the initializer :( Fix this by just zero-initializing the structure on the stack. Cc: Lorenzo Bianconi <lorenzo@kernel.org> Cc: Jonathan Cameron <jic23@kernel.org> Cc: David Lechner <dlechner@baylibre.com> Cc: "Nuno Sá" <nuno.sa@analog.com> Cc: Andy Shevchenko <andy@kernel.org> Fixes: c14edb4d0bdc ("iio:imu:st_lsm6dsx Fix alignment and data leak issues") Cc: stable <stable@kernel.org> Assisted-by: gregkh_clanker_t1000 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Reviewed-by: David Lechner <dlechner@baylibre.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>