Mark Brown [Tue, 11 Aug 2026 21:12:13 +0000 (22:12 +0100)]
ASoC: amd: enable audio on HP OmniBook X Flip 14
Ville Saarinen <wiza@saarinenkoti.fi> says:
The HP OmniBook X Flip 14-kc0xxx (board 8EA1, Strix Point, ACP 7.2) has no
usable audio on mainline at all. Its BIOS reports an ACP configuration flag
of FLAG_AMD_LEGACY_ONLY_DMIC, which binds the legacy ACP driver and
registers a PDM-only card, so the SoundWire links are never scanned. The
two TAS2783 speaker amplifiers on link 0 and the RT712-VB jack codec on
link 1 never enumerate, and the machine has no playback path whatsoever.
Patch 1 adds a DMI quirk overriding the flag so snd_pci_ps probes. Patch 2
adds the machine entry describing the link topology.
With both applied the card comes up and every path on the machine works:
internal speakers, headphone jack with detection, headset microphone and
the internal DMIC array. Two further patches are needed for the speakers
to render stereo rather than mono, and to survive a system resume; those
are in the TAS2783 codec driver and are being sent separately to the TI
maintainers, since they have no build dependency on this pair.
Related reports for the same root cause on other machines:
- kernel bugzilla #221226 (ASUS Zenbook S16)
- CachyOS linux-cachyos#820 (HP OmniBook X Flip 16, board 8EA2 -- the
sibling board, which would need its own entry; I have no access to
one and have not added it)
Tested on the affected machine only. I do not have any other ACP 7.2
board, so the gating on patch 2 is written to be conservative rather than
broad.
Testing
=======
The hardware testing was done on v7.1.6, where an equivalent version of
this pair is what makes audio work on the machine. Against the master
commit named below, both patches have been compile-tested only (gcc, W=1,
no new warnings, no new external symbol references).
Patch 2 has been reworked slightly relative to the tested build: the
RT712-VB entry now reuses the existing jack_dmic_endpoints array, which
already describes exactly the AIF1 jack + AIF3 DMIC pairing this board
needs, instead of adding a second identical copy of it. That was a
mechanical substitution, but it has not been through hardware.
Tool disclosure, per Documentation/process/generated-content.rst
================================================================
This work was done in extended interactive sessions with Claude (Anthropic,
model claude-opus-5) acting as a coding and debugging assistant, and a
substantial amount of the analysis and of the patch text originated with
it. Both patches carry an Assisted-by tag as described in
Documentation/process/coding-assistants.rst.
The division of work:
- The assistant read the DMI data and ACP configuration flag off the
running machine, identified the flag override as the fix, derived the
SoundWire topology from the enumerated peripherals, and drafted both
patches and both changelogs.
- I ran everything that needed root or physical access, rebooted into
each build, and did the listening tests. The left/right ordering in
patch 2 is set by the order of the two amplifier entries; the first
version had the sides reversed and that was caught by ear, not by the
assistant.
- No single prompt generated these patches. The session was iterative
over roughly a day: inspect state, form a hypothesis, build, reboot,
measure, discard the hypothesis if the measurement disagreed. Several
confident intermediate conclusions were wrong and were only caught by
measurement.
I have reviewed both patches, I understand what they do, and I take
responsibility for them.
Ville Saarinen [Sun, 9 Aug 2026 10:15:09 +0000 (10:15 +0000)]
ASoC: amd: acp70: add HP OmniBook X Flip 14 SoundWire machine
Describe the SoundWire topology of the HP OmniBook X Flip 14-kc0xxx
(board 8EA1): two TAS2783 smart amplifiers aggregated on link 0 (unique
IDs 0xC and 0x9, group_position 0 and 1, name prefixes tas2783-1 and
tas2783-2) driving the left and right internal speakers, and an RT712-VB
on link 1 providing the headset jack on AIF1 and the internal DMIC array
on AIF3. The RT712 amplifier path (AIF2) is left unused because the
speakers are driven by the external TAS2783 pair, so the existing
jack_dmic_endpoints array describes it exactly.
The entry is gated on snd_soc_acpi_amd_sdca_is_device_rt712_vb() so it
does not capture a board carrying a different link 1 codec.
Developed with AI assistance. The assistant derived the link topology
from the enumerated peripherals and drafted the table entry. The order
of the two amplifier entries, which is what assigns the physical sides,
was corrected after a listening test by the submitter.
All hardware measurements quoted above were run by the submitter on the
affected machine. The submitter has reviewed the change, understands it
and takes responsibility for it.
Ville Saarinen [Sun, 9 Aug 2026 10:15:04 +0000 (10:15 +0000)]
ASoC: amd: acp-config: force SoundWire probe on HP OmniBook X Flip 14
The BIOS on the HP OmniBook X Flip 14-kc0xxx (board 8EA1, Strix Point,
ACP 7.2) reports acp-audio-config-flag = FLAG_AMD_LEGACY_ONLY_DMIC. That
binds the legacy ACP driver and registers a PDM-only card, so the
SoundWire links are never scanned: the two TAS2783 speaker amplifiers on
link 0 and the RT712-VB jack codec on link 1 do not enumerate and the
machine ends up with no usable playback path at all.
Add a DMI entry for the board so the flag is overridden to 0 and
snd_pci_ps probes instead.
Developed with AI assistance. The assistant read the board's ACP
configuration flag out of the running system, identified the flag
override as the fix and drafted the DMI entry.
All hardware measurements quoted above were run by the submitter on the
affected machine. The submitter has reviewed the change, understands it
and takes responsibility for it.
LiangCheng Wang [Wed, 5 Aug 2026 07:55:43 +0000 (15:55 +0800)]
ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready
fsl_asoc_card_probe() hard-fails with -EINVAL when the CPU DAI (SAI)
platform device is not found. Like the codec, the CPU DAI may just be
probed later than the machine driver; the order is not guaranteed and
varies across kernel versions, so a permanent -EINVAL leaves the card
unregistered with no analog playback or capture.
Defer probe instead, mirroring commit e396dec46c56 ("ASoC:
fsl-asoc-card: Defer probe when fail to find codec device").
Tested on i.MX8MP with an ALC5672 on SAI3: the card that failed to
register on v6.18 now comes up during boot.
ASoC: pxa: Use devm_clk_get_optional() for extclk clock
The Device Tree binding defines the extclk clock as an optional
property, but the driver currently uses devm_clk_get() and manually
handles the absence of the clock.
Use devm_clk_get_optional() to match the binding and simplify the
optional clock handling. This also propagates errors other than the
absence of the optional clock, including -EPROBE_DEFER.
This changes the existing behavior for errors other than
-EPROBE_DEFER. RFC to discuss whether these errors should cause probe
to fail rather than being treated as an unavailable optional clock.
ASoC: qcom: q6apm: keep the graph start count in sync with the DSP
q6apm_graph_start() increments start_count even when APM_CMD_GRAPH_START
fails, leaving the graph counted as running while the DSP never started
it. A later start - a retried prepare, or a resume after a failed start -
then finds a non-zero count, skips the command and returns success with
no data flowing.
Count the graph only once the DSP has accepted the start. The count then
stays at zero for a graph that never started, so also stop decrementing
below zero in q6apm_graph_stop(): the compressed free path stops
unconditionally, and a negative count would make the next start skip the
command in the same way.
ASoC: ti: omap-twl4030: Check for missing card name after parsing
Return any error from snd_soc_of_parse_card_name() directly. If the
helper returns successfully but card->name remains unset, report the
missing card name explicitly before returning -ENODEV.
ASoC: Intel: KMB: Propagate -EPROBE_DEFER from IRQ lookup
Return -EPROBE_DEFER from platform_get_irq_optional() so the driver is
re-probed when the interrupt resource becomes available instead of
continuing probe without an IRQ.
Shenghao Ding [Tue, 11 Aug 2026 12:14:46 +0000 (20:14 +0800)]
ASoC: tas2781: Fix compiling warning for tasdevice_set_capture_profile_id()
Correct the mismatched function description, parameter names and return
value documentation in the comment block. No functional code change, only
comment and documentation update.
Fixes: 431c15610d01 ("ASoC: tas2781: add capture_profile_id field and update the tuning_switch function") Signed-off-by: Shenghao Ding <shenghao-ding@ti.com> Link: https://patch.msgid.link/20260811121446.1805-1-shenghao-ding@ti.com Signed-off-by: Mark Brown <broonie@kernel.org>
ASoC: dwc: Propagate -EPROBE_DEFER from IRQ lookup
platform_get_irq_optional() never returns 0. It returns a positive IRQ
number on success or a negative error code on failure.
Return -EPROBE_DEFER from platform_get_irq_optional() so the driver is
re-probed when the interrupt resource becomes available instead of
continuing probe without an IRQ.
Mark Brown [Mon, 10 Aug 2026 14:34:19 +0000 (15:34 +0100)]
ASoC: Use auto-cleanup for firmware loading
Takashi Iwai <tiwai@suse.de> says:
here is a revised series of trivial patches to use the auto-cleanup
(via __free(firmware)) for firmware management.
Now compile warnings due to the mixture with goto have been addressed
for rt1320-sdw and wm2000 drivers. Others remain identical, just took
a few review Acks.
Takashi Iwai [Thu, 6 Aug 2026 14:00:03 +0000 (16:00 +0200)]
ASoC: SOF: Use auto-cleanup for firmware loading
Simplify the code to manage the firmware loading with __free(firmware)
and __free(kfree) auto-cleanups for the firmware data and the temporary
string or array.
Only the code refactoring, no functional changes.
Cc: Liam Girdwood <lgirdwood@gmail.com> Cc: Bard Liao <yung-chuan.liao@linux.intel.com> Cc: Daniel Baluta <daniel.baluta@nxp.com> Cc: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev> Cc: Vijendar Mukunda <Vijendar.Mukunda@amd.com> Acked-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com> Tested-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260806140006.1412298-32-tiwai@suse.de Signed-off-by: Mark Brown <broonie@kernel.org>
Takashi Iwai [Thu, 6 Aug 2026 13:59:53 +0000 (15:59 +0200)]
ASoC: tlv320aic31xx: Use auto-cleanup for firmware loading
Simplify the code to manage the firmware loading with __free(firmware)
auto-cleanup.
Only the code refactoring, no functional changes.
Cc: Shenghao Ding <shenghao-ding@ti.com> Cc: Kevin Lu <kevin-lu@ti.com> Cc: Baojun Xu <baojun.xu@ti.com> Cc: Sen Wang <sen@ti.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260806140006.1412298-22-tiwai@suse.de Signed-off-by: Mark Brown <broonie@kernel.org>
Takashi Iwai [Thu, 6 Aug 2026 13:59:51 +0000 (15:59 +0200)]
ASoC: tas2781: Use auto-cleanup for firmware loading
Simplify the code to manage the firmware loading with __free(firmware)
auto-cleanup.
Only the code refactoring, no functional changes.
Cc: Shenghao Ding <shenghao-ding@ti.com> Cc: Kevin Lu <kevin-lu@ti.com> Cc: Baojun Xu <baojun.xu@ti.com> Cc: Sen Wang <sen@ti.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260806140006.1412298-20-tiwai@suse.de Signed-off-by: Mark Brown <broonie@kernel.org>
Takashi Iwai [Thu, 6 Aug 2026 13:59:48 +0000 (15:59 +0200)]
ASoC: rt722-sdca: Use auto-cleanup for firmware loading
Simplify the code to manage the firmware loading with __free(firmware)
auto-cleanup, as well as the firmware file name being released with
__free(kfree).
Le Qi [Mon, 10 Aug 2026 03:10:32 +0000 (11:10 +0800)]
ASoC: qcom: sc8280xp: configure codec sysclk for QCS615
Continuous high-amplitude noise could occur in the DA7213 microphone
capture path after a Bluetooth out-of-range/reset event followed by
reconnection. The noise was present in both the raw ALSA capture and
PipeWire input, confirming that it originated before Bluetooth
encoding.
The codec already obtains and enables MCLK through its DT clock and
bias-level handling. However, the machine driver did not explicitly
configure the codec sysclk during hw_params(). Enable
codec_sysclk_set for QCS615 so that the DA7213 clock source and rate
are configured before the codec power-up sequence.
Verified on QCS615 Talos with repeated Bluetooth disconnect and
reconnect cycles. The noise was no longer reproducible.
Linus Torvalds [Sat, 8 Aug 2026 23:39:53 +0000 (16:39 -0700)]
Merge tag 'locking-urgent-2026-08-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull futex fix from Ingo Molnar:
- Fix race in futex_pivot_pending() during private hash resize
that can cause stuck tasks (Yao Kai)
* tag 'locking-urgent-2026-08-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
futex: Fix race in futex_pivot_pending() during private hash resize
Linus Torvalds [Sat, 8 Aug 2026 23:33:04 +0000 (16:33 -0700)]
Merge tag 'usb-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
Pull USB / Thunderbolt fixes from Greg KH:
"Here are some small USB and Thunderbolt driver fixes for 7.2-rc7 that
resolve some reported issues. Included in here are:
- new quirk for some broken USB devices
- thunderbolt device fixes for reported issues
- usb gadget driver fix
- usb atm driver fix
- xhci driver fixes.
- other minor USB driver fixes
All of these have been in linux-next this week with no reported
issues"
* tag 'usb-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
usb: xhci: use BIT_ULL for CRCR bits to fix incorrect 64bit mask
usb: quirks: Add ShanWan gamepad to quirk list
usb: hub: Split announce_device() to log device identity before enumeration
usb: core: Add quirk for 255-bytes initial config read
usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg
usb: gadget: f_ncm: Use unsigned int for ndp_index
usb: cdnsp: fix incorrect endian conversions for APB timeout register
thunderbolt: Initialize ->domain_released completion before it is being used
thunderbolt: icm: Preserve USB4 proxy data-valid bit
thunderbolt: Bound the DROM dual link port number before indexing sw->ports
thunderbolt: Fix bandwidth group reservation indexing
thunderbolt: stream: Unmap buffers with mapped size
Linus Torvalds [Sat, 8 Aug 2026 23:31:15 +0000 (16:31 -0700)]
Merge tag 'tty-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty
Pull tty / serial / vt driver fixes from Greg KH:
"Here are some small serial and vt tty driver fixes for 7.2-rc7 that
resolve some reported problems. Included in here are:
- two vt core fixes
- amba-pl011 serial driver fixes
- 8250_of and 8250_dma driver fixes
- qcom-geni serial driver fix
- sc16is7xx serial driver fix
All of these have been in linux-next this week with no reported
issues"
* tag 'tty-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
serial: amba-pl011: synchronize DMA teardown
serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ
serial: amba-pl011: fix indefinite RS485 post-send delay
vt: add permission check for KDSKBMETA ioctl
vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx
serial: qcom-geni: fix TX DMA buffer flush
serial: 8250_dma: Clear stale RX state on shutdown
serial: sc16is7xx: enable THRI before filling TX FIFO
Linus Torvalds [Sat, 8 Aug 2026 23:29:33 +0000 (16:29 -0700)]
Merge tag 'staging-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging
Pull staging driver fixes from Greg KH:
"Here are some more small staging driver fixes, just for the rtl8723bs
driver, for some reported problems found with it now that people are
starting to actually test the thing with "bad" networks.
Nothing major, but good to have in the -final release. All of these
have been in linux-next for over a week with no reported problems"
* tag 'staging-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
staging: rtl8723bs: validate monitor transmit frame lengths
staging: rtl8723bs: fix missing shared-key auth challenge length check
staging: rtl8723bs: fix OOB read in WMM_param_handler()
staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
Linus Torvalds [Sat, 8 Aug 2026 23:25:59 +0000 (16:25 -0700)]
Merge tag 'char-misc-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
Pull char / misc and documentation fixes from Greg KH:
"Here are some small char/misc and nvmem and documentation fixes for
7.2-rc7 to resolve some reported issues. Included in here are:
- updates to the documentation for the kernel threat model and
security bugs to get the LLMs to actually follow what we have been
asking them to do (i.e. not claim security issues for things we do
not consider security issues.)
- nvmem driver fixes which required a tiny "layout" driver to be
added.
- fastrpc driver fixes
- mei driver fix
- counter driver fix
- binder driver fix
All of these have been in linux-next this week with no reported
problems"
* tag 'char-misc-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
docs: security-bugs: clarify some mandatory steps for AI reports
docs: coding-assistant: explain important steps when looking for bugs
docs: security-bugs: clarify what counts as a valid version
docs: threat-model: move fake devices out of "non production use"
docs: threat-model: clarify "security bug" vs "vulnerability"
counter: microchip-tcb-capture: Fix DT channel validation
mei: pull kvfree out of spinlock
rust_binder: do not query current thread for all ioctls
nvmem: layouts: Add fixed-layout driver
nvmem: apple-spmi-nvmem: wrap regmap calls to satisfy CFI
misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
misc: fastrpc: fix channel ctx ref leak when session alloc fails
misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke
misc: fastrpc: Remove buffer from list prior to unmap operation
misc: fastrpc: Fix initial memory allocation for Audio PD memory pool
Linus Torvalds [Sat, 8 Aug 2026 14:47:52 +0000 (07:47 -0700)]
Merge tag 'fbdev-for-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev
Pull fbdev fixes from Helge Deller:
"A few patches for the core fbdev layer which stabilize or fix
potential issues with text font rendering after screen rotation or
after user initiated font changes and locking fixes for sysfb during
modifications of the graphics mode database"
* tag 'fbdev-for-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev:
fbdev: bitblit: bound-check glyph index in bit_cursor()
fbdev: Fix out-of-bounds access when rotating console after font resize
fbdev: core: Fix pointer desynchronization in fb_io_read()
fbdev: serialize mode sysfs access with lock_fb_info()
fbdev: clear fb_info->mode before deleting a videomode
fbdev: bound mode sysfs output to the sysfs buffer
Linus Torvalds [Sat, 8 Aug 2026 14:13:29 +0000 (07:13 -0700)]
Merge tag 'driver-core-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core
Pull driver core fixes from Danilo Krummrich:
- Fix Rust build failure on s390 by gating ioremap() / iounmap()
helpers and the io::mem module on CONFIG_HAS_IOMEM; gate affected
doctests as well.
- Add missing kernel-doc for show_const / store_const union members in
struct device_attribute.
* tag 'driver-core-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core:
rust: io: gate ioremap doctests on CONFIG_HAS_IOMEM
rust: io: gate ioremap/iounmap on CONFIG_HAS_IOMEM
driver core: add missing kernel-doc for union members
Linus Torvalds [Sat, 8 Aug 2026 14:09:35 +0000 (07:09 -0700)]
Merge tag 'input-for-v7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
Pull input updates from Dmitry Torokhov:
- Fixes for information leaks and OOB accesses across several drivers,
including evdev, focaltech, edt-ft5x06, iforce, and cs40l50-vibra
- Improvements to the synaptics-rmi4 driver to properly handle F54
worker errors and prevent buffer overflows
- Input validation fixes in the hynitron_cstxxx touchscreen driver to
prevent issues with invalid finger IDs and touch counts
- Fixes for use-after-free and initialization bugs in the byd mouse and
psxpad-spi drivers
- New quirks for the atkbd driver to make keyboard work on HONOR and
Xiaomi laptops
- Support for the ZENAIM LEVERLESS controller in the xpad driver.
* tag 'input-for-v7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
Input: evdev - sanitize event type index when fetching event masks
Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue
Input: synaptics-rmi4 - block s_input when F54 queue is busy
Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer
Input: synaptics-rmi4 - zero report size on F54 work error
Input: synaptics-rmi4 - fix F55 transmitter electrode count typo
Input: hynitron_cstxxx - validate touch count and finger IDs
Input: evdev - fix information leak in evdev_pass_values()
fixp-arith: convert comments to kernel-doc format
Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet
Input: atkbd - skip deactivate for HONOR ZQC-P
Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard
Input: iforce - validate input packet lengths
Input: psxpad-spi - set driver data before use
Input: cs40l50-vibra - validate custom data from user space
Input: xpad - add support for ZENAIM LEVERLESS
Input: edt-ft5x06 - ignore contacts with an out-of-range slot id
Input: byd - synchronize timer deletion before freeing private data
Rik van Riel [Sat, 8 Aug 2026 02:19:56 +0000 (22:19 -0400)]
fbdev: bitblit: bound-check glyph index in bit_cursor()
bit_cursor() fetches the glyph under the cursor with
c = scr_readw(vc_pos);
src = vc_font.data + ((c & charmask) * w * height);
where charmask is 0x1ff when vc_hi_font_mask is set. The screen buffer
value comes directly from scr_readw() and may be larger than the current
font's glyph count.
Syzkaller triggers this via vcs_write(). The Call Trace shows
vcs_write() in vc_screen.c writing an arbitrary 16-bit value with
writev() to /dev/vcsa, which vcs_write_buf() in vc_screen.c stores via
vcs_scr_writew() without checking charcount. The stored value is later
read in bit_cursor() in bitblit.c.
When the font is changed from a font with 512 glyphs to a font with
256 glyphs, the screen buffer can retain characters with the high
bit set from the previous mode, which could also produce the same
out-of-bounds access.
BUG: KASAN: global-out-of-bounds in soft_cursor+0x378/0x6bc drivers/video/fbdev/core/softcursor.c:70
Read of size 16 at addr ffff800086c57970
bit_putcs_aligned() and bit_putcs_unaligned() already clamp the glyph
index to vc_font.charcount. Apply the same clamp in bit_cursor() after
extracting the attribute and masking, before indexing fontdata.
The fix completes the bounds checking started in commit 18c4ef4e765a
("fbdev: bitblit: bound-check glyph index in bit_putcs*"), which missed
the cursor path.
This change should be safe because the clamp reuses the existing
contract from fbcon: charcount is maintained under console_lock in
con_font_set() and fbcon_font_set(), and hi_font_mask is cleared when
switching from 512 to 256 glyphs. When stale screen data with high bits
remains after a font switch, or when vcs_write() stores an arbitrary
value, clamping the index to 0 prevents the out-of-bounds read without
changing cursor semantics — the same fallback bit_putcs uses.
Reported-by: syzbot+61b1db46218109869c14@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=61b1db46218109869c14 Link: https://lore.kernel.org/all/6a75205c.01d0871a.3a0d52.0032.GAE@google.com/ Fixes: 18c4ef4e765a ("fbdev: bitblit: bound-check glyph index in bit_putcs*") Cc: stable@vger.kernel.org Assisted-by: Hermes:muse-spark-1.2 syzkaller Signed-off-by: Rik van Riel <riel@surriel.com> Signed-off-by: Helge Deller <deller@gmx.de>
Zizhi Wo [Wed, 29 Jul 2026 02:12:04 +0000 (10:12 +0800)]
fbdev: Fix out-of-bounds access when rotating console after font resize
[BUG]
Recently, we encountered a KASAN warning as follows:
BUG: KASAN: slab-out-of-bounds in ccw_putcs+0x8bd/0xa80
Read of size 1 at addr ff11000110067100 by task bash/1209
CPU: 10 UID: 0 PID: 1209 Comm: bash Not tainted 7.2.0-rc3 #69 PREEMPT(full)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014
Call Trace:
<TASK>
...
kasan_report+0xf0/0x120
? ccw_putcs+0x8bd/0xa80
ccw_putcs+0x8bd/0xa80
? __pfx_ccw_putcs+0x10/0x10
fbcon_putcs+0x338/0x410
? __pfx_ccw_putcs+0x10/0x10
do_update_region+0x21d/0x450
invert_screen+0x29d/0x5e0
? __kmalloc_noprof+0x493/0x640
? vc_do_resize+0x17c/0xe50
clear_selection+0x4c/0x60
vc_do_resize+0xaee/0xe50
fbcon_modechanged+0x2bd/0x640
rotate_all_store+0x298/0x380
...
reproduce:
1) issue two ioctls: first a KDFONTOP ioctl with op.op = KD_FONT_OP_SET,
op.width = 1 and op.height = 1, then a TIOCL_SETSEL ioctl
2) echo 2 > /sys/devices/virtual/graphics/fbcon/rotate_all
3) issue two ioctls: first a KDFONTOP ioctl with op.op = KD_FONT_OP_SET,
op.width = 8 and op.height = 1, then a TIOCL_SETSEL ioctl
4) echo 3 > /sys/devices/virtual/graphics/fbcon/rotate_all
[CAUSE]
The root cause is that fbcon_modechanged() first sets the current rotate's
corresponding ops. Subsequently, during vc_resize(), it may trigger
clear_selection(), and in fbcon_putcs->ccw_putcs[rotate=3], this can result
in an out-of-bounds access to "src". This happens because par->rotated.buf
is reallocated in fbcon_rotate_font():
1) When rotate=2, its size is (width + 7) / 8 * height
2) When rotate=3, its size is (height + 7) / 8 * width
And the call to fbcon_rotate_font() occurs after clear_selection(). In
other words, the fontbuffer is allocated using the size calculated from the
previous rotation 2, but before reallocating it with the new size,
con_putcs is already using the new rotation 3:
[FIX]
A fairly obvious approach is to follow fbcon_switch(): in
fbcon_modechanged(), call rotate_font() before vc_resize() so that a
correctly sized buffer is allocated in time, as done in [6]. This fix is
necessary, but it is not sufficient on its own.
In [1] it causes an image.dy overflow (ccw_putcs: vyres = 768,
image.dy = 4294967040), because vc_cols has not been updated in time at
this point (it is likewise only updated after clear_selection()). This
allows (xx + count) * width to exceed vyres, causing image.dy to overflow.
Subsequently, address in [3] is incremented by an even larger amount, which
triggers a page fault at [4].
Therefore, a second fix is required in combination with the first: move
clear_selection() earlier, before set_blitting_type() in
fbcon_set_all_vcs(), to prevent the out-of-bounds access. fbcon_rotate()
has a similar problem, so add the same clear there. Since vc_is_sel() is
not exported, the fbdev side is currently forced to call clear_selection()
unconditionally, causing the global selection to be cleared prematurely.
And this will not cause any other significant impact.
Signed-off-by: Zizhi Wo <wozizhi@huawei.com> Signed-off-by: Helge Deller <deller@gmx.de>
Mingyu Wang [Tue, 21 Jul 2026 08:19:42 +0000 (16:19 +0800)]
fbdev: core: Fix pointer desynchronization in fb_io_read()
In fb_io_read(), if copy_to_user() performs a partial copy (e.g., due to
a faulty user buffer), the loop adjusts the chunk size 'c' and updates
the remaining 'count'. However, the hardware 'src' pointer has already
been eagerly advanced by the original chunk size.
If the loop is allowed to continue, the read will resume from an
incorrect, over-advanced offset. Since the remaining 'count' was only
decremented by the successful bytes, this desynchronization causes the
next iterations to execute more hardware reads than originally bounded,
eventually leading to out-of-bounds I/O reads.
Fix this by breaking out of the loop immediately upon a partial
copy_to_user(). A partial copy indicates a faulty user buffer, making
subsequent read attempts futile. Breaking out ensures we return the
number of successfully read bytes without risking out-of-bounds hardware
accesses in subsequent mismatched iterations.
Fixes: 6121cd9ef911 ("fbdev: Move I/O read and write code into helper functions") Cc: stable@vger.kernel.org Signed-off-by: Mingyu Wang <25181214217@stu.xidian.edu.cn> Signed-off-by: Helge Deller <deller@gmx.de>
fbdev: serialize mode sysfs access with lock_fb_info()
show_mode(), show_modes(), and store_mode() access fb_info->modelist
and fb_info->mode without holding lock_fb_info(). store_modes() takes
lock_fb_info() while replacing the modelist and freeing the old one.
A concurrent reader or writer can load a pointer to an old modelist
entry before store_modes() frees it, then dereference freed memory or
store a stale freed pointer in fb_info->mode.
Take lock_fb_info() in show_mode(), show_modes(), and store_mode() to
serialize with store_modes(). In show_mode(), copy the mode to the
stack and format after dropping the lock. In store_mode(), split
activate() into a _locked variant to avoid double-locking, and hold
the locks for the modelist walk, mode conversion, activation, and
fb_info->mode assignment together.
fbdev: clear fb_info->mode before deleting a videomode
fb_set_var() can delete a mode from info->modelist when userspace
passes FB_ACTIVATE_INV_MODE through FBIOPUT_VSCREENINFO. The code
checks that the mode being deleted is not the current info->var and
that fbcon is not using it, but it does not check fb_info->mode.
fb_info->mode may still point into the modelist entry being deleted.
If the entry is freed, later mode sysfs reads through show_mode() can
dereference a stale pointer.
Clear fb_info->mode before calling fb_delete_videomode() when it
matches the mode being removed.
fbdev: bound mode sysfs output to the sysfs buffer
mode_string() uses snprintf() which can return a value larger than the
remaining buffer space. show_modes() accumulates the return value into i
without checking whether i has reached PAGE_SIZE, causing the offset to
advance past the sysfs buffer if the modelist is long enough.
Add a size parameter to mode_string() and use scnprintf() to return
only the bytes actually written. Add an early return when offset
already exceeds the buffer. In show_modes(), stop accumulating once
the buffer is full.
George Wilson [Fri, 7 Aug 2026 16:59:00 +0000 (11:59 -0500)]
powerpc/pseries: lparcfg - fix kbuf[] underflow
In lparcfg_write(), a count of 0 results in kbuf[] being indexed at -1.
Check for count == 0 in the existing check for count > sizeof(kbuf) and
return -EINVAL if true.
Fixes: 74422e2b1939 ("powerpc/pseries: Remove VLA from lparcfg_write()") Acked-by: Nayna Jain <nayna@linux.ibm.com> Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com> Cc: stable@vger.kernel.org # 4.20 Signed-off-by: George Wilson <gcwilson@linux.ibm.com> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
George Wilson [Fri, 7 Aug 2026 16:56:21 +0000 (11:56 -0500)]
powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak
In papr_phy_attest_create_handle(), the params->cmd.length is not
validated before use, which can result in a buffer overlow. Check it and
return -EINVAL if it is either 0 or exceeds sizeof(params->cmd).
Also, params is freed on the success path but not error. Free it on
errors after memory allocation. And free it on negative fd.
Fixes: 86900ab620a4 ("powerpc/pseries: Add a char driver for physical-attestation RTAS") Acked-by: Haren Myneni <haren@linux.ibm.com> Acked-by: Nayna Jain <nayna@linux.ibm.com> Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com> Cc: stable@vger.kernel.org # 6.16 Signed-off-by: George Wilson <gcwilson@linux.ibm.com> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Linus Torvalds [Sat, 8 Aug 2026 00:29:59 +0000 (17:29 -0700)]
Merge tag 'watchdog-for-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging
Pull watchdog fixes from Guenter Roeck:
- at91sam9_wdt: prevent timer rearm during teardown
- bd96801_wdt: Fix timeout for enabled WDG
- atcwdt200: Fix return value when watchdog is enabled
* tag 'watchdog-for-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
watchdog: at91sam9_wdt: prevent timer rearm during teardown
watchdog: bd96801_wdt: Fix timeout for enabled WDG
watchdog: atcwdt200: fix return value when watchdog is enabled
Linus Torvalds [Fri, 7 Aug 2026 22:45:51 +0000 (15:45 -0700)]
Merge tag 'drm-fixes-2026-08-08' of https://gitlab.freedesktop.org/drm/kernel
Pull drm fixes from Dave Airlie:
"Weekly fixes for drm, feels relatively quiet for the post-AI world,
mostly amdgpu and xe with a few fixes across the board:
shmem:
- check VMA boundaries for PMD mappings
xe:
- Fix memory leak in exec_queue_set_hang_replay_state
- Apply RCS/CCS yield policy to SR-IOV VFs
Shengjiu Wang [Fri, 7 Aug 2026 07:22:02 +0000 (15:22 +0800)]
ASoC: fsl_easrc: fix missing return on success in runtime_resume
Commit 48d84310be60 ("ASoC: fsl_easrc: Use guard() for spin locks")
refactored fsl_easrc_runtime_resume() but accidentally dropped the
early return on the success path. The original code had a skip_load
label followed by "return 0"; that label was removed during cleanup
but the corresponding success return was lost too.
As a result, every successful resume falls through into the
disable_mem_clk error path and calls clk_disable_unprepare() on a
clock that is still in use, leading to an unbalanced clock disable.
Restore the missing "return 0" before the disable_mem_clk error label.
Linus Torvalds [Fri, 7 Aug 2026 19:18:33 +0000 (12:18 -0700)]
Merge tag 'pinctrl-v7.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl
Pull pin control fixes from Linus Walleij:
"Qualcomm fixes: some incorrectly defined groups in IPQ9650, two pins
needing to be marked as GPIO in IPQ806X"
* tag 'pinctrl-v7.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
pinctrl: qcom: ipq806x: mark pci reset as a GPIO pin function
pinctrl: qcom: ipq806x: mark gpio as a GPIO pin function
pinctrl: qcom: ipq9650: fix audio_sec_mclk_in1/out1 group pins
Kernel panic - not syncing: hung_task: blocked tasks
futex_pivot_pending() allows the resize request to continue when
either no replacement hash is pending (hash_new == NULL) or the current
hash reference count has reached zero.
After the final-reference wake, another futex task can complete the
pivot between the two observations:
The pivot changes the state from hash_new != NULL with a dead current
hash to hash_new == NULL with a live current hash. Because
futex_pivot_pending() reads hash_new and hash without serialization,
the resize task can observe hash_new in the pre-pivot state and hash in
the post-pivot state, causing futex_pivot_pending() to return false even
though the pivot has completed. The task then goes to sleep after the
wakeup has already been consumed.
Serialize state reads in futex_pivot_pending() using futex_mm_phash::lock.
This guarantees that futex_pivot_pending() observes hash_new and hash
atomically, eliminating the race condition.
Fixes: bd54df5ea7ca ("futex: Allow to resize the private local hash") Suggested-by: Peter Zijlstra <peterz@infradead.org> Signed-off-by: Yao Kai <yaokai34@huawei.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260804125530.3933754-1-yaokai34@huawei.com
Mark Brown [Fri, 7 Aug 2026 14:57:50 +0000 (15:57 +0100)]
ASoC: codec drivers: sort the reg_defaults tables
Peter Ujfalusi <peter.ujfalusi@linux.intel.com> says:
reg_defaults must be sorted by ascending register address, since
regcache_lookup_reg() locates entries in it with bsearch(). When a table is
not sorted, bsearch() cannot find the entries which follow a descending step,
so regcache_reg_needs_sync() falls back to reporting that a sync is needed for
them. Those registers are then written to the device on every regcache_sync()
even when they were never touched.
See commit fd80df352ba1 ("regcache: Add support for sorting defaults arrays")
for the same problem in a different context.
Affected tables:
ml26124_reg 1 of 79 entries unreachable
cx2072x_reg_defaults 75 of 132 entries unreachable
max9860_reg_defaults 1 of 14 entries unreachable
stih407_sas_reg_defaults 1 of 2 entries unreachable
Peter Ujfalusi [Wed, 5 Aug 2026 12:28:11 +0000 (15:28 +0300)]
ASoC: sti-sas: sort the register default table
reg_defaults must be sorted by ascending register address, as
regcache_lookup_reg() locates entries in it with bsearch(). See commit fd80df352ba1 ("regcache: Add support for sorting defaults arrays").
STIH407_AUDIO_DAC_CTRL (0xa8) is listed before
STIH407_AUDIO_GLUE_CTRL (0xa4), which makes the latter unreachable.
regcache_reg_needs_sync() then cannot compare it against its default and
reports that a sync is needed, so it is written to the device on every
regcache_sync() even when it was never touched.
Peter Ujfalusi [Wed, 5 Aug 2026 12:28:10 +0000 (15:28 +0300)]
ASoC: max9860: sort the register default table
reg_defaults must be sorted by ascending register address, as
regcache_lookup_reg() locates entries in it with bsearch(). See commit fd80df352ba1 ("regcache: Add support for sorting defaults arrays").
MAX9860_PWRMAN (0x10) is listed as the first entry, before
MAX9860_INTEN (0x02), which makes MAX9860_INTEN unreachable.
regcache_reg_needs_sync() then cannot compare it against its default and
reports that a sync is needed, so it is written to the device on every
regcache_sync() even when it was never touched.
Peter Ujfalusi [Wed, 5 Aug 2026 12:28:09 +0000 (15:28 +0300)]
ASoC: cx2072x: sort the register default table
reg_defaults must be sorted by ascending register address, as
regcache_lookup_reg() locates entries in it with bsearch(). See commit fd80df352ba1 ("regcache: Add support for sorting defaults arrays").
The table is grouped by function rather than by address: for every node
the amplifier gain registers (0x41c0, 0x45c0, ...) are listed before the
power state and stream format registers of the same node (0x4014,
0x4414, ...). This leaves 75 of the 132 entries unreachable.
regcache_reg_needs_sync() then cannot compare them against their default
and reports that a sync is needed, so they are written to the device on
every regcache_sync() even when they were never touched.
Peter Ujfalusi [Wed, 5 Aug 2026 12:28:08 +0000 (15:28 +0300)]
ASoC: ml26124: sort the register default table
reg_defaults must be sorted by ascending register address, as
regcache_lookup_reg() locates entries in it with bsearch(). See commit fd80df352ba1 ("regcache: Add support for sorting defaults arrays").
The Mic Select Control register (0xe8) is listed in the analog path
control group, between 0x5a and 0x60, which makes it unreachable.
regcache_reg_needs_sync() then cannot compare it against its default and
reports that a sync is needed, so it is written to the device on every
regcache_sync() even when it was never touched.
Move the entry to the end of the table, where it belongs by address.
Mark Brown [Fri, 7 Aug 2026 14:56:06 +0000 (15:56 +0100)]
ASoC: tegra: sort the reg_defaults tables
Peter Ujfalusi <peter.ujfalusi@linux.intel.com> says:
reg_defaults must be sorted by ascending register address, since
regcache_lookup_reg() locates entries in it with bsearch(). When a table is
not sorted, bsearch() cannot find the entries which follow a descending step,
so regcache_reg_needs_sync() falls back to reporting that a sync is needed for
them. Those registers are then written to the device on every regcache_sync()
even when they were never touched.
See commit fd80df352ba1 ("regcache: Add support for sorting defaults arrays")
for the same problem in a different context.
The series is based on broonie/for-linus (05eebef3c7b2).
Affected tables:
tegra210_i2s_reg_defaults 2 of 8 entries unreachable
tegra264_i2s_reg_defaults 4 of 9 entries unreachable
tegra210_mixer_reg_defaults 1 entry unreachable
Peter Ujfalusi [Wed, 5 Aug 2026 12:27:48 +0000 (15:27 +0300)]
ASoC: tegra210_mixer: sort the register default table
reg_defaults must be sorted by ascending register address, as
regcache_lookup_reg() locates entries in it with bsearch(). See commit fd80df352ba1 ("regcache: Add support for sorting defaults arrays").
TEGRA210_MIXER_ENABLE (0x400) is the last entry of the table, after
TEGRA210_MIXER_PEAKM_RAM_CTRL (0x434), which makes it unreachable.
regcache_reg_needs_sync() then cannot compare it against its default and
reports that a sync is needed, so it is written to the device on every
regcache_sync() even when it was never touched.
Peter Ujfalusi [Wed, 5 Aug 2026 12:27:47 +0000 (15:27 +0300)]
ASoC: tegra210_i2s: sort the Tegra264 register default table
reg_defaults must be sorted by ascending register address, as
regcache_lookup_reg() locates entries in it with bsearch(). See commit fd80df352ba1 ("regcache: Add support for sorting defaults arrays").
TEGRA264_I2S_ENABLE (0x100), TEGRA264_I2S_RX_FIFO_WR_ACCESS_MODE (0x30)
and TEGRA264_I2S_TX_FIFO_RD_ACCESS_MODE (0xb0) are listed at the end of
the table, after TEGRA264_I2S_TIMING (0x130), which leaves 4 of the 9
entries unreachable. regcache_reg_needs_sync() then cannot compare them
against their default and reports that a sync is needed, so they are
written to the device on every regcache_sync() even when they were never
touched.
Peter Ujfalusi [Wed, 5 Aug 2026 12:27:46 +0000 (15:27 +0300)]
ASoC: tegra210_i2s: sort the register default table
reg_defaults must be sorted by ascending register address, as
regcache_lookup_reg() locates entries in it with bsearch(). See commit fd80df352ba1 ("regcache: Add support for sorting defaults arrays").
TEGRA210_I2S_ENABLE (0x80) is listed after TEGRA210_I2S_CG (0x88) and
TEGRA210_I2S_TIMING (0xa4), so both it and TEGRA210_I2S_TIMING are
unreachable. regcache_reg_needs_sync() then cannot compare them against
their default and reports that a sync is needed, so they are written to
the device on every regcache_sync() even when they were never touched.
Mark Brown [Fri, 7 Aug 2026 14:53:42 +0000 (15:53 +0100)]
ASoC: NXP/Freescale: sort the reg_defaults tables
Peter Ujfalusi <peter.ujfalusi@linux.intel.com> says:
reg_defaults must be sorted by ascending register address, since
regcache_lookup_reg() locates entries in it with bsearch(). When a table is
not sorted, bsearch() cannot find the entries which follow a descending step,
so regcache_reg_needs_sync() falls back to reporting that a sync is needed for
them. Those registers are then written to the device on every regcache_sync()
even when they were never touched.
See commit fd80df352ba1 ("regcache: Add support for sorting defaults arrays")
for the same problem in a different context.
The series is based on broonie/for-linus (05eebef3c7b2).
Affected tables:
sgtl5000_reg_defaults 1 of 35 entries unreachable
fsl_easrc_reg_defaults 3 of 120 entries unreachable
Peter Ujfalusi [Wed, 5 Aug 2026 12:27:28 +0000 (15:27 +0300)]
ASoC: fsl_easrc: sort the register default table
reg_defaults must be sorted by ascending register address, as
regcache_lookup_reg() locates entries in it with bsearch(). See commit fd80df352ba1 ("regcache: Add support for sorting defaults arrays").
The four REG_EASRC_RRL() entries are listed as a block before the four
REG_EASRC_RRH() ones, but the two registers of a context alternate in
the address map (RRL(n) at 0x110 + 8 * n, RRH(n) at 0x114 + 8 * n).
This leaves REG_EASRC_RRL(1), REG_EASRC_RRL(2) and REG_EASRC_RRL(3)
unreachable. regcache_reg_needs_sync() then cannot compare them against
their default and reports that a sync is needed, so they are written to
the device on every regcache_sync() even when they were never touched.
Peter Ujfalusi [Wed, 5 Aug 2026 12:27:27 +0000 (15:27 +0300)]
ASoC: sgtl5000: sort the register default table
reg_defaults must be sorted by ascending register address, as
regcache_lookup_reg() locates entries in it with bsearch(). See commit fd80df352ba1 ("regcache: Add support for sorting defaults arrays").
SGTL5000_CHIP_SHORT_CTRL (0x003c) is listed before
SGTL5000_CHIP_ANA_TEST2 (0x003a), which makes the former unreachable.
regcache_reg_needs_sync() then cannot compare it against its default and
reports that a sync is needed, so it is written to the device on every
regcache_sync() even when it was never touched.
Mark Brown [Fri, 7 Aug 2026 14:51:43 +0000 (15:51 +0100)]
ASoC: TI codecs: sort the reg_defaults tables
Peter Ujfalusi <peter.ujfalusi@linux.intel.com> says:
The reg_defaults array of a regmap_config must be sorted by ascending
register address: regcache_lookup_reg() finds entries in it with
bsearch(), and regcache_init() only kmemdup_array()s the array, it never
sorts it. See commit fd80df352ba1 ("regcache: Add support for sorting
defaults arrays").
When the array is not sorted, bsearch() descends into the wrong half and
a number of entries can never be found. regcache_reg_needs_sync() then
cannot compare the cached value against the default and always reports
that a sync is needed, so those registers are written to the device on
every regcache_sync() even if they were never touched.
I found this while chasing a SoundWire NAK on an unimplemented register
and audited the reg_defaults tables in sound/ by replaying lib/bsearch.c
over each of them. These are the affected TI/Burr-Brown codecs:
The patches only reorder the existing entries. The text of every entry
is kept verbatim, no default value is changed, and each resulting table
was verified to be fully reachable.
tas2783-sdw was fixed separately, it had already been posted.
Peter Ujfalusi [Wed, 5 Aug 2026 10:41:49 +0000 (13:41 +0300)]
ASoC: tas675x: sort the register default table
reg_defaults must be sorted by ascending register address, as
regcache_lookup_reg() locates entries in it with bsearch(). See commit fd80df352ba1 ("regcache: Add support for sorting defaults arrays").
TAS675X_AC_LDG_CTRL_REG (0xb5), TAS675X_TWEETER_DETECT_CTRL_REG (0xb6),
TAS675X_TWEETER_DETECT_THRESH_REG (0xb7) and TAS675X_AC_LDG_FREQ_CTRL_REG
(0xb8) are listed before the 0x7c - 0xa0 block, which leaves 14 of the
69 entries unreachable. regcache_reg_needs_sync() then cannot compare
them against their default and reports that a sync is needed, so they
are written to the device on every regcache_sync() even when they were
never touched.
Peter Ujfalusi [Wed, 5 Aug 2026 10:41:48 +0000 (13:41 +0300)]
ASoC: tas2780: sort the register default table
reg_defaults must be sorted by ascending register address, as
regcache_lookup_reg() locates entries in it with bsearch(). See commit fd80df352ba1 ("regcache: Add support for sorting defaults arrays").
TAS2780_DVC (0x1a) is listed before TAS2780_CHNL_0 (0x03), which makes
it unreachable. regcache_reg_needs_sync() then cannot compare it
against its default and reports that a sync is needed, so it is written
to the device on every regcache_sync() even when it was never touched.
Peter Ujfalusi [Wed, 5 Aug 2026 10:41:47 +0000 (13:41 +0300)]
ASoC: tas2764: sort the register default table
reg_defaults must be sorted by ascending register address, as
regcache_lookup_reg() locates entries in it with bsearch(). See commit fd80df352ba1 ("regcache: Add support for sorting defaults arrays").
TAS2764_DVC (0x1a) is listed before TAS2764_CHNL_0 (0x03), which makes
it unreachable. regcache_reg_needs_sync() then cannot compare it
against its default and reports that a sync is needed, so it is written
to the device on every regcache_sync() even when it was never touched.
Peter Ujfalusi [Wed, 5 Aug 2026 10:41:46 +0000 (13:41 +0300)]
ASoC: tas2552: sort the register default table
reg_defaults must be sorted by ascending register address, as
regcache_lookup_reg() locates entries in it with bsearch(). See commit fd80df352ba1 ("regcache: Add support for sorting defaults arrays").
TAS2552_OUTPUT_DATA (0x07), TAS2552_PDM_CFG (0x11), TAS2552_PGA_GAIN
(0x12) and TAS2552_BOOST_APT_CTRL (0x14) are listed before
TAS2552_RESERVED_0D (0x0d), TAS2552_LIMIT_RATE_HYS (0x0e) and
TAS2552_CFG_2 (0x02), which leaves 7 of the 21 entries unreachable.
regcache_reg_needs_sync() then cannot compare them against their
default and reports that a sync is needed, so they are written to the
device on every regcache_sync() even when they were never touched.
Peter Ujfalusi [Wed, 5 Aug 2026 10:41:45 +0000 (13:41 +0300)]
ASoC: pcm512x: sort the register default table
reg_defaults must be sorted by ascending register address, as
regcache_lookup_reg() locates entries in it with bsearch(). See commit fd80df352ba1 ("regcache: Add support for sorting defaults arrays").
PCM512x_AUTO_MUTE (page 0, register 59) is listed before
PCM512x_ERROR_DETECT (page 0, register 37) and PCM512x_VCOM_CTRL_2
(page 1, register 9) is listed before the page 0 clocking block, so the
bsearch() descends into the wrong half of the table. 24 of the 45
entries are unreachable, among them every PLL coefficient and clock
divider default. regcache_reg_needs_sync() then cannot compare them
against their default and reports that a sync is needed, so they are
written to the device on every regcache_sync() even when they were
never touched.
Peter Ujfalusi [Wed, 5 Aug 2026 09:13:27 +0000 (12:13 +0300)]
ASoC: tas2783-sdw: sort the register default table
reg_defaults must be sorted by ascending register address, as
regcache_lookup_reg() locates entries in it with bsearch(). See commit fd80df352ba1 ("regcache: Add support for sorting defaults arrays").
tas2783_reg_default[] is grouped by SDCA entity name instead, so the
binary search does not find 120 of its 196 entries.
regcache_reg_needs_sync() then cannot compare those against their default
and reports that a sync is needed, so they are written to the device on
every regcache_sync() even when they were never touched.
Peter Ujfalusi [Wed, 5 Aug 2026 11:39:11 +0000 (14:39 +0300)]
ASoC: pm4125-sdw: sort the register default table
reg_defaults must be sorted by ascending register address, as
regcache_lookup_reg() locates entries in it with bsearch(). See commit fd80df352ba1 ("regcache: Add support for sorting defaults arrays").
PM4125_SWR_HPHPA_HD2 (0x3090) is listed before
PM4125_ANA_HPHPA_SPARE_CTL (0x308e), which makes the latter unreachable.
regcache_reg_needs_sync() then cannot compare it against its default and
reports that a sync is needed, so it is written to the device on every
regcache_sync() even when it was never touched.
projects / linux / log