Andrey Golovko [Thu, 13 Aug 2026 16:40:00 +0000 (19:40 +0300)]
ASoC: sdw_utils: prepare the stream again when resuming
A peripheral loses its Data Port configuration when the controller is
power-gated during system suspend, so the ports have to be prepared
again before the stream can be enabled. That happens on its own when
userspace calls snd_pcm_prepare() after SNDRV_PCM_STATE_SUSPENDED, but
an application is also allowed to restart the stream with
SNDRV_PCM_IOCTL_RESUME on a card that advertises SNDRV_PCM_INFO_RESUME,
as the AMD ACP platforms do. That path only reaches the trigger
callback, sdw_enable_stream() writes the channels of ports that were
never prepared, and playback silently produces nothing: the PCM keeps
running, no error is reported anywhere, and the speakers stay quiet
until the stream is torn down and set up again.
Prepare the stream on SNDRV_PCM_TRIGGER_RESUME, before enabling it.
The SoundWire core expects exactly this: sdw_prepare_stream() accepts a
disabled stream and then reapplies the bus parameters without
recomputing them, which it documents as the resume case.
Shenghao Ding [Thu, 13 Aug 2026 08:05:40 +0000 (16:05 +0800)]
ASoC: tas2781: Refactor calibration start kcontrol creation to separate helper
Move the tas2781-specific calibration start kcontrol initialization logic
out of tasdevice_create_cali_ctrls() into a new dedicated helper function
create_tas2781_cali_start_ktrl().
This change eliminates duplicate inline code in the main calibration
control registration routine, improves code readability, and makes further
extension for custom calibration parameters much easier. No functional
behavior changes.
The DT meta-schema requires a `then` clause when an `if` condition has
an `else` clause. Invert the compatible check and move the supply
property restrictions to `then` so they remain allowed only for ES8316.
Fixes: e9966d450b46 ("ASoC: dt-bindings: es8316: Add regulator supplies") Reported-by: Rob Herring <robh@kernel.org> Closes: https://lore.kernel.org/r/20260812194234.GA693895-robh@kernel.org Signed-off-by: Hongyang Zhao <hongyang.zhao@thundersoft.com> Link: https://patch.msgid.link/20260813-b4-es8316-binding-conditional-fix-v1-1-6cd56aa1370c@thundersoft.com Signed-off-by: Mark Brown <broonie@kernel.org>
Rosen Penev [Tue, 11 Aug 2026 04:19:25 +0000 (21:19 -0700)]
ASoC: amd: acp: pass audio_drv_data to dma_irq_handler
The IRQ handler only needs the audio_drv_data, so pass it directly
as the request_irq argument instead of the device pointer and a
dev_get_drvdata() lookup.
Mark Brown [Thu, 13 Aug 2026 14:49:35 +0000 (15:49 +0100)]
ASoC: fsl-asoc-card: Restructure to support deferrable card binding
Chancel Liu <chancel.liu@nxp.com> says:
The ASoC core has evolved over several kernel releases to support
deferrable card binding: when a component is not yet available,
devm_snd_soc_register_card() no longer propagates -EPROBE_DEFER back to
the machine driver. Instead the card is placed on an internal deferred
list and rebound automatically once the missing component registers.
As a result, registering a sound card no longer guarantees that all CPU
and codec components have already probed successfully.
This exposed two regressions in fsl-asoc-card:
1. The machine driver caches codec MCLK rate during probe(). On platforms
where the MCLK is derived from the CPU DAI clock and its final rate is
applied via assigned-clocks in the CPU DAI node, probing before the CPU
DAI driver completes leaves fsl-asoc-card with a stale mclk_freq.
2. If a card defers due to a missing component, it queues the card onto
the unbind_card_list and returns 0. The driver then proceeds to call
simple_util_init_jack(). At this point, the snd_card pointer is NULL.
Patch 1 drops mclk management for nau8822 from this machine driver.
Patch 2 is a pure refactoring with no functional change. the large if/else
chain of of_device_is_compatible() calls in probe() is
replaced by a platform data table approach.
Patch 3 moves all component-dependent initialisation and jacks out of
probe() and into late_probe(), which is the correct place under the
deferrable binding model.
Chancel Liu [Mon, 10 Aug 2026 09:35:31 +0000 (18:35 +0900)]
ASoC: fsl-asoc-card: Move bound-component setup to late_probe
Move all operations that require bound codec and CPU DAI components out
of probe() and into late_probe(), which is the correct place for them
now that ASoC supports deferrable card binding. late_probe() may be
called multiple times after an unbind/rebind cycle, so every
initialization step is guarded accordingly.
Three new helpers are introduced:
- fsl_asoc_card_init_cpu()
CPU DAI-specific setup. Previously done in probe() while CPU DAI
component maybe not ready.
- fsl_asoc_card_init_codecs()
Reads codec MCLK rates from the bound component devices, invokes the
per-compatible pdata->codec_init callback if present.
- fsl_asoc_card_init_jack()
Registers headphone and microphone jacks.
The call site of codec_init callbacks moves from probe() to
fsl_asoc_card_init_codecs(), which runs in late_probe() after the bound
codec device is known. This makes sure codecs can get proper MCLK.
The old card-name fallback depended on codec_dev_name[], which required
looking up the codec device in probe(). This is no longer valid under
deferrable card binding because the codec component may not have probed
yet. Since the DT binding requires "model", remove the fallback and fail
with a clear error.
Chancel Liu [Mon, 10 Aug 2026 09:35:30 +0000 (18:35 +0900)]
ASoC: fsl-asoc-card: Move static compatible data to platform data
Replace the large if/else chain of of_device_is_compatible() calls in
probe() with a table-driven approach. Each compatible string now has
a corresponding static const struct fsl_asoc_card_pdata descriptor
stored in the of_device_id .data field.
probe() calls of_device_get_match_data() once and reads all
per-compatible configuration from the returned pointer:
- DAI format
- CPU SYSCLK direction and ratio overrides
- TDM slot width
- Codec DAI name, MCLK id, FLL/PLL ids, PLL S24 ratio
- playback_only / capture_only direction restrictions
- Default DAPM route table
- Excluded PCM format mask (for SAI + WM8960/WM8962)
- Optional probe_init callback (SPDIF multi-codec discovery)
- Optional codec_init callback (codec-specific post-probe logic)
This patch is a pure refactoring, no functional change is intended.
Chancel Liu [Mon, 10 Aug 2026 09:35:29 +0000 (18:35 +0900)]
ASoC: fsl-asoc-card: Drop mclk management for nau8822
commit 93f12a7568269 ("ASoC: nau8822: add MCLK support") added MCLK
handling directly in the nau8822 codec driver. The machine driver no
longer needs to acquire and enable the codec MCLK on its behalf.
Remove MCLK management in this machine driver that was introduced by
commit 1075df4bdeb32 ("ASoC: fsl-asoc-card: add nau8822 support"). This
avoids a potential double-enable and removes clock resource management
from the machine driver where it does not belong.
Additionally, the sound card may be unbound and rebound multiple times
during its lifetime. Managing a codec clock resource in the machine
driver would require careful cleanup in the card remove path to avoid
reference count leaks. Leaving clock management to the codec driver,
which has the same lifetime as the codec device, is the correct
ownership model.
The nau8822 compatible entry, DAI name, and PLL/FLL clock ID
configuration are kept unchanged.
Mark Brown [Thu, 13 Aug 2026 14:46:10 +0000 (15:46 +0100)]
ASoC: rockchip: Simplify probe error handling
bui duc phuc <phucduc.bui@gmail.com> says:
This series simplifies probe error handling across Rockchip ASoC drivers.
It replaces open-coded error handling with dev_err_probe() where
appropriate, removes redundant probe error messages, returns the
original error code directly, and fixes handling of -EPROBE_DEFER
returned by platform_get_irq_optional() in the Rockchip SAI driver
and devm_pinctrl_get() in the Rockchip I2S driver.
ASoC: rockchip: rockchip_sai: Propagate -EPROBE_DEFER from IRQ lookup
Return -EPROBE_DEFER from platform_get_irq_optional() so the driver is
re-probed when the interrupt resource becomes available instead of
continuing probe without an IRQ.
ASoC: rockchip: rockchip_i2s: Propagate -EPROBE_DEFER from devm_pinctrl_get()
Return -EPROBE_DEFER from devm_pinctrl_get() instead of ignoring it and
continuing probe. This allows the driver to be reprobed once the
pinctrl provider becomes available.
Jerome Brunet [Wed, 12 Aug 2026 20:50:34 +0000 (22:50 +0200)]
ASoC: meson: aiu: make aiu_formatter_i2s_drv static
aiu_formatter_i2s_drv is indeed used only in the aiu and it is not meant
to be exported. It should be static.
Cc: Valerio Setti <vsetti@baylibre.com> Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202608080634.hf6aJGPB-lkp@intel.com/ Fixes: 83b83024cdbf ("ASoC: meson: aiu: use aiu-formatter-i2s to format I2S output data") Signed-off-by: Jerome Brunet <jbrunet@baylibre.com> Reviewed-by: Valerio Setti <vsetti@baylibre.com> Link: https://patch.msgid.link/20260812-aiu-formatter-static-v1-1-67936d57ba05@baylibre.com Signed-off-by: Mark Brown <broonie@kernel.org>
ASoC: spacemit: advertise only DMA-backed DAI streams
The static DAI template initializes both playback and capture stream
capabilities before dma-names is examined. As a result,
snd_soc_dai_stream_valid() considers both directions valid even when the
device only provides a single DMA channel.
Move the playback and capture capability initialization into
spacemit_i2s_init_dai(), where it is performed only for the stream
directions backed by a corresponding DMA channel. This preserves the
existing capabilities for devices with both "tx" and "rx" DMA channels,
while preventing unsupported stream directions from being advertised.
Initialize rate_min and rate_max together with the other stream
capabilities to preserve the existing rate constraints.
Mark Brown [Wed, 12 Aug 2026 17:37:48 +0000 (18:37 +0100)]
ASoC: mxs: Improve probe error handling
bui duc phuc <phucduc.bui@gmail.com> says:
This series improves probe error handling in the MXS ASoC drivers.
Use dev_err_probe() where appropriate and remove redundant dev_err() calls
when the corresponding errors are already reported by the called functions
or further down the call chain.
ASoC: mxs-saif: Drop redundant probe error messages
The functions called here don't log the error themselves, but the
error is already reported deeper in the call chain, so the dev_err()
calls are redundant and can be removed.
devm_platform_ioremap_resource() does not report the error itself,
but the error is already reported deeper in the call chain,
so the dev_err() calls are redundant and can be removed.
Marek Szyprowski [Wed, 12 Aug 2026 07:44:37 +0000 (09:44 +0200)]
ASoC: samsung: i2s: drop secondary DAI for i2sv7 hardware variant
Commit 9167f260477b ("ASoC: soc-generic-dmaengine: Handle DMA channel
request failures correctly") started reporting DMA channel request
failures during probe instead of silently ignoring them. This exposed a
bug in the Samsung I2S driver: it always registered a second DAI and its
associated "tx-sec" DMA channel, even for hardware variants that don't
actually support it, such as i2sv7 used on Exynos5433. As a result,
sound card probing on Exynos5433-based boards started failing, whereas
previously it worked only because the channel request failure was
ignored.
Drop the QUIRK_SEC_DAI flag from i2sv7, since this variant does not have
a secondary DAI and register "Secondary Playback" DAPM route only for
variants with such interface.
Rosen Penev [Tue, 11 Aug 2026 04:24:24 +0000 (21:24 -0700)]
ASoC: mediatek: mt8365: use devm_platform_ioremap_resource helpers
Simplify the probe function by using devm_platform_ioremap_resource()
for the base address and devm_platform_get_and_ioremap_resource() for
the SRAM, dropping the manual platform_get_resource() calls.
Add regulator support for the four ES8316 power domains so board
descriptions can model and control the codec supplies.
The binding patch documents AVDD, CPVDD, DVDD and PVDD as optional
supplies for ES8316, preserving compatibility with existing device-tree
descriptions. The driver patch enables the supplies before initializing
the regmap and keeps them enabled for the lifetime of the I2C device.
The missing supply model was identified while reviewing the RubikPi 3
audio support:
https://lore.kernel.org/linux-arm-msm/c293d9c7-bdb7-4303-80c8-404228c434d7@oss.qualcomm.com/
Hongyang Zhao [Wed, 12 Aug 2026 09:35:44 +0000 (17:35 +0800)]
ASoC: codecs: es8316: Add regulator support
ES8316 has separate AVDD, CPVDD, DVDD and PVDD supply inputs.
Request and enable the supplies during I2C probe, before initializing
the regmap. Keep them enabled for the lifetime of the I2C device so the
regmap cannot access an unpowered device and its cache remains
synchronized if the ASoC component is unbound and rebound.
Hongyang Zhao [Wed, 12 Aug 2026 09:35:43 +0000 (17:35 +0800)]
ASoC: dt-bindings: es8316: Add regulator supplies
The ES8316 has separate AVDD, CPVDD, DVDD and PVDD supply inputs for
its analog, charge pump, digital core and digital I/O domains. Describe
all four inputs so boards can model the codec power topology.
The binding also covers ES8311 and ES8323, whose supply inputs differ,
so restrict these properties to the ES8316 compatible. Keep them
optional for compatibility with existing descriptions.
Rosen Penev [Tue, 11 Aug 2026 18:51:40 +0000 (11:51 -0700)]
ASoC: xilinx: formatter_pcm: fix stream_data leak on open error
In xlnx_formatter_pcm_open(), stream_data is allocated and
adata->play_stream or adata->capture_stream is assigned early. If a
later step, such as snd_pcm_hw_constraint_step() or
snd_pcm_hw_constraint_integer(), fails, the function returns the error
immediately. ALSA does not call the close callback when open fails, so
stream_data is leaked and the stream pointer is left dangling, pointing
to a substream that ALSA frees. A later interrupt would then call
snd_pcm_period_elapsed() on the freed substream.
Free stream_data and clear the stream pointer on the error paths.
Fixes: 6f6c3c36f091 ("ASoC: xlnx: add pcm formatter platform driver") Assisted-by: opencode:deepseek-v4-flash-free Signed-off-by: Rosen Penev <rosenp@gmail.com> Reviewed-by: Michal Simek <michal.simek@amd.com> Link: https://patch.msgid.link/20260811185140.27149-1-rosenp@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
Mark Brown [Tue, 11 Aug 2026 21:12:13 +0000 (22:12 +0100)]
ASoC: amd: enable audio on HP OmniBook X Flip 14
Ville Saarinen <wiza@saarinenkoti.fi> says:
The HP OmniBook X Flip 14-kc0xxx (board 8EA1, Strix Point, ACP 7.2) has no
usable audio on mainline at all. Its BIOS reports an ACP configuration flag
of FLAG_AMD_LEGACY_ONLY_DMIC, which binds the legacy ACP driver and
registers a PDM-only card, so the SoundWire links are never scanned. The
two TAS2783 speaker amplifiers on link 0 and the RT712-VB jack codec on
link 1 never enumerate, and the machine has no playback path whatsoever.
Patch 1 adds a DMI quirk overriding the flag so snd_pci_ps probes. Patch 2
adds the machine entry describing the link topology.
With both applied the card comes up and every path on the machine works:
internal speakers, headphone jack with detection, headset microphone and
the internal DMIC array. Two further patches are needed for the speakers
to render stereo rather than mono, and to survive a system resume; those
are in the TAS2783 codec driver and are being sent separately to the TI
maintainers, since they have no build dependency on this pair.
Related reports for the same root cause on other machines:
- kernel bugzilla #221226 (ASUS Zenbook S16)
- CachyOS linux-cachyos#820 (HP OmniBook X Flip 16, board 8EA2 -- the
sibling board, which would need its own entry; I have no access to
one and have not added it)
Tested on the affected machine only. I do not have any other ACP 7.2
board, so the gating on patch 2 is written to be conservative rather than
broad.
Testing
=======
The hardware testing was done on v7.1.6, where an equivalent version of
this pair is what makes audio work on the machine. Against the master
commit named below, both patches have been compile-tested only (gcc, W=1,
no new warnings, no new external symbol references).
Patch 2 has been reworked slightly relative to the tested build: the
RT712-VB entry now reuses the existing jack_dmic_endpoints array, which
already describes exactly the AIF1 jack + AIF3 DMIC pairing this board
needs, instead of adding a second identical copy of it. That was a
mechanical substitution, but it has not been through hardware.
Tool disclosure, per Documentation/process/generated-content.rst
================================================================
This work was done in extended interactive sessions with Claude (Anthropic,
model claude-opus-5) acting as a coding and debugging assistant, and a
substantial amount of the analysis and of the patch text originated with
it. Both patches carry an Assisted-by tag as described in
Documentation/process/coding-assistants.rst.
The division of work:
- The assistant read the DMI data and ACP configuration flag off the
running machine, identified the flag override as the fix, derived the
SoundWire topology from the enumerated peripherals, and drafted both
patches and both changelogs.
- I ran everything that needed root or physical access, rebooted into
each build, and did the listening tests. The left/right ordering in
patch 2 is set by the order of the two amplifier entries; the first
version had the sides reversed and that was caught by ear, not by the
assistant.
- No single prompt generated these patches. The session was iterative
over roughly a day: inspect state, form a hypothesis, build, reboot,
measure, discard the hypothesis if the measurement disagreed. Several
confident intermediate conclusions were wrong and were only caught by
measurement.
I have reviewed both patches, I understand what they do, and I take
responsibility for them.
Ville Saarinen [Sun, 9 Aug 2026 10:15:09 +0000 (10:15 +0000)]
ASoC: amd: acp70: add HP OmniBook X Flip 14 SoundWire machine
Describe the SoundWire topology of the HP OmniBook X Flip 14-kc0xxx
(board 8EA1): two TAS2783 smart amplifiers aggregated on link 0 (unique
IDs 0xC and 0x9, group_position 0 and 1, name prefixes tas2783-1 and
tas2783-2) driving the left and right internal speakers, and an RT712-VB
on link 1 providing the headset jack on AIF1 and the internal DMIC array
on AIF3. The RT712 amplifier path (AIF2) is left unused because the
speakers are driven by the external TAS2783 pair, so the existing
jack_dmic_endpoints array describes it exactly.
The entry is gated on snd_soc_acpi_amd_sdca_is_device_rt712_vb() so it
does not capture a board carrying a different link 1 codec.
Developed with AI assistance. The assistant derived the link topology
from the enumerated peripherals and drafted the table entry. The order
of the two amplifier entries, which is what assigns the physical sides,
was corrected after a listening test by the submitter.
All hardware measurements quoted above were run by the submitter on the
affected machine. The submitter has reviewed the change, understands it
and takes responsibility for it.
Ville Saarinen [Sun, 9 Aug 2026 10:15:04 +0000 (10:15 +0000)]
ASoC: amd: acp-config: force SoundWire probe on HP OmniBook X Flip 14
The BIOS on the HP OmniBook X Flip 14-kc0xxx (board 8EA1, Strix Point,
ACP 7.2) reports acp-audio-config-flag = FLAG_AMD_LEGACY_ONLY_DMIC. That
binds the legacy ACP driver and registers a PDM-only card, so the
SoundWire links are never scanned: the two TAS2783 speaker amplifiers on
link 0 and the RT712-VB jack codec on link 1 do not enumerate and the
machine ends up with no usable playback path at all.
Add a DMI entry for the board so the flag is overridden to 0 and
snd_pci_ps probes instead.
Developed with AI assistance. The assistant read the board's ACP
configuration flag out of the running system, identified the flag
override as the fix and drafted the DMI entry.
All hardware measurements quoted above were run by the submitter on the
affected machine. The submitter has reviewed the change, understands it
and takes responsibility for it.
LiangCheng Wang [Wed, 5 Aug 2026 07:55:43 +0000 (15:55 +0800)]
ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready
fsl_asoc_card_probe() hard-fails with -EINVAL when the CPU DAI (SAI)
platform device is not found. Like the codec, the CPU DAI may just be
probed later than the machine driver; the order is not guaranteed and
varies across kernel versions, so a permanent -EINVAL leaves the card
unregistered with no analog playback or capture.
Defer probe instead, mirroring commit e396dec46c56 ("ASoC:
fsl-asoc-card: Defer probe when fail to find codec device").
Tested on i.MX8MP with an ALC5672 on SAI3: the card that failed to
register on v6.18 now comes up during boot.
ASoC: pxa: Use devm_clk_get_optional() for extclk clock
The Device Tree binding defines the extclk clock as an optional
property, but the driver currently uses devm_clk_get() and manually
handles the absence of the clock.
Use devm_clk_get_optional() to match the binding and simplify the
optional clock handling. This also propagates errors other than the
absence of the optional clock, including -EPROBE_DEFER.
This changes the existing behavior for errors other than
-EPROBE_DEFER. RFC to discuss whether these errors should cause probe
to fail rather than being treated as an unavailable optional clock.
ASoC: qcom: q6apm: keep the graph start count in sync with the DSP
q6apm_graph_start() increments start_count even when APM_CMD_GRAPH_START
fails, leaving the graph counted as running while the DSP never started
it. A later start - a retried prepare, or a resume after a failed start -
then finds a non-zero count, skips the command and returns success with
no data flowing.
Count the graph only once the DSP has accepted the start. The count then
stays at zero for a graph that never started, so also stop decrementing
below zero in q6apm_graph_stop(): the compressed free path stops
unconditionally, and a negative count would make the next start skip the
command in the same way.
ASoC: ti: omap-twl4030: Check for missing card name after parsing
Return any error from snd_soc_of_parse_card_name() directly. If the
helper returns successfully but card->name remains unset, report the
missing card name explicitly before returning -ENODEV.
ASoC: Intel: KMB: Propagate -EPROBE_DEFER from IRQ lookup
Return -EPROBE_DEFER from platform_get_irq_optional() so the driver is
re-probed when the interrupt resource becomes available instead of
continuing probe without an IRQ.
Shenghao Ding [Tue, 11 Aug 2026 12:14:46 +0000 (20:14 +0800)]
ASoC: tas2781: Fix compiling warning for tasdevice_set_capture_profile_id()
Correct the mismatched function description, parameter names and return
value documentation in the comment block. No functional code change, only
comment and documentation update.
Fixes: 431c15610d01 ("ASoC: tas2781: add capture_profile_id field and update the tuning_switch function") Signed-off-by: Shenghao Ding <shenghao-ding@ti.com> Link: https://patch.msgid.link/20260811121446.1805-1-shenghao-ding@ti.com Signed-off-by: Mark Brown <broonie@kernel.org>
ASoC: dwc: Propagate -EPROBE_DEFER from IRQ lookup
platform_get_irq_optional() never returns 0. It returns a positive IRQ
number on success or a negative error code on failure.
Return -EPROBE_DEFER from platform_get_irq_optional() so the driver is
re-probed when the interrupt resource becomes available instead of
continuing probe without an IRQ.
Mark Brown [Mon, 10 Aug 2026 14:34:19 +0000 (15:34 +0100)]
ASoC: Use auto-cleanup for firmware loading
Takashi Iwai <tiwai@suse.de> says:
here is a revised series of trivial patches to use the auto-cleanup
(via __free(firmware)) for firmware management.
Now compile warnings due to the mixture with goto have been addressed
for rt1320-sdw and wm2000 drivers. Others remain identical, just took
a few review Acks.
Takashi Iwai [Thu, 6 Aug 2026 14:00:03 +0000 (16:00 +0200)]
ASoC: SOF: Use auto-cleanup for firmware loading
Simplify the code to manage the firmware loading with __free(firmware)
and __free(kfree) auto-cleanups for the firmware data and the temporary
string or array.
Only the code refactoring, no functional changes.
Cc: Liam Girdwood <lgirdwood@gmail.com> Cc: Bard Liao <yung-chuan.liao@linux.intel.com> Cc: Daniel Baluta <daniel.baluta@nxp.com> Cc: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev> Cc: Vijendar Mukunda <Vijendar.Mukunda@amd.com> Acked-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com> Tested-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260806140006.1412298-32-tiwai@suse.de Signed-off-by: Mark Brown <broonie@kernel.org>
Takashi Iwai [Thu, 6 Aug 2026 13:59:53 +0000 (15:59 +0200)]
ASoC: tlv320aic31xx: Use auto-cleanup for firmware loading
Simplify the code to manage the firmware loading with __free(firmware)
auto-cleanup.
Only the code refactoring, no functional changes.
Cc: Shenghao Ding <shenghao-ding@ti.com> Cc: Kevin Lu <kevin-lu@ti.com> Cc: Baojun Xu <baojun.xu@ti.com> Cc: Sen Wang <sen@ti.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260806140006.1412298-22-tiwai@suse.de Signed-off-by: Mark Brown <broonie@kernel.org>
Takashi Iwai [Thu, 6 Aug 2026 13:59:51 +0000 (15:59 +0200)]
ASoC: tas2781: Use auto-cleanup for firmware loading
Simplify the code to manage the firmware loading with __free(firmware)
auto-cleanup.
Only the code refactoring, no functional changes.
Cc: Shenghao Ding <shenghao-ding@ti.com> Cc: Kevin Lu <kevin-lu@ti.com> Cc: Baojun Xu <baojun.xu@ti.com> Cc: Sen Wang <sen@ti.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260806140006.1412298-20-tiwai@suse.de Signed-off-by: Mark Brown <broonie@kernel.org>
Takashi Iwai [Thu, 6 Aug 2026 13:59:48 +0000 (15:59 +0200)]
ASoC: rt722-sdca: Use auto-cleanup for firmware loading
Simplify the code to manage the firmware loading with __free(firmware)
auto-cleanup, as well as the firmware file name being released with
__free(kfree).
Le Qi [Mon, 10 Aug 2026 03:10:32 +0000 (11:10 +0800)]
ASoC: qcom: sc8280xp: configure codec sysclk for QCS615
Continuous high-amplitude noise could occur in the DA7213 microphone
capture path after a Bluetooth out-of-range/reset event followed by
reconnection. The noise was present in both the raw ALSA capture and
PipeWire input, confirming that it originated before Bluetooth
encoding.
The codec already obtains and enables MCLK through its DT clock and
bias-level handling. However, the machine driver did not explicitly
configure the codec sysclk during hw_params(). Enable
codec_sysclk_set for QCS615 so that the DA7213 clock source and rate
are configured before the codec power-up sequence.
Verified on QCS615 Talos with repeated Bluetooth disconnect and
reconnect cycles. The noise was no longer reproducible.
Linus Torvalds [Sun, 9 Aug 2026 15:47:31 +0000 (08:47 -0700)]
Merge tag 'trace-v7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull tracing fixes from Steven Rostedt:
- Fix use-after-free in eventfs_remove_rec()
The freeing of the eventfs_inode children used list_for_each_entry()
where the child is freed via srcu, but there's still a chance that it
gets freed. It should be using list_for_each_entry_safe().
- Fix eventfs_inode SRCU use of list in freeing
The iterator uses an SRCU protected list walk on the eventfs inodes.
The eventfs inode uses its "list" field in a union with the RCU list
head. When the inode gets added to the SRCU list it immediately
corrupts the list pointer and can cause an issue with the iterator.
Move the RCU list head to be shared with the children list head which
allows the iterator to check the parent inode if is freed before
referencing the child. Have the iterator check the parent "is_freed"
field and break out if it is set. Also add memory barriers to make
sure the ordering is correct.
- Fix various RCU synchronization issues with direct_functions
Updates to direct_functions have some missing RCU protection and
synchronization. Restructure the code a bit to make sure updates to
the direct_functions are protected.
- Remove an unneeded comma from a scope_guard()
There's a spurious comma in a scope_guard(). Remove it.
- Fix race in per CPU buffer swap in the ring buffer
When a per CPU buffer swap happens, it must make sure that it doesn't
occur while a writer is active. Instead it returns an -EBUSY. But
there's a small race window when a writer moves from one sub-buffer
to the next that it resets the "committing" counter. If a swap
happens at that moment, the buffer used for the commit of an event
will not match the buffer the event is actually on. Instead of using
the "committing" counter, use the recursive detection counter that
does not get reset when the writer crosses sub-buffers.
- Fix off-by-one in ftrace_free_mem()
The function ftrace_free_mem() gets an "end_ptr" as a parameter that
is exclusive to the rang to be freed. But its value is used to search
for the records that expects an inclusive value. Subtract one from
the parameter to convert it to an inclusive range.
- Disable resizing of the ring buffer for persistent buffers
Resizing the persistent buffer has undefined behavior. Prevent it
from being resized.
- Disable changing ring buffer subbuf order when resizing is disabled
The ring buffer subbuffer order can not be changed during resizing.
Use that instead of just checking if the buffer is mapped as mapped
buffers also have resizing disabled.
- Initialize subbuf_order of reader pages when they are created
In rb_allocate_cpu_buffer() the bpage->order is not updated to the
current subbuf_order leaving it as zero. This value is used when the
page is freed.
- Fix test_ringbuffer() to test for ERR_PTR before calling
kthread_stop()
The rb_threads[] array is assigned the output of kthread_run_on_cpu()
which could return an ERR_PTR. At the end of the test, all threads in
the array are cleaned up by kthread_stop() passing in the value in
the array if it isn't zero. But if the array contains an ERR_PTR,
kthread_stop() will not be able to handle it properly.
* tag 'trace-v7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
ring-buffer: Fix crash passing ERR_PTR to kthread_stop()
ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer()
ring-buffer: Prevent subbuf order change when resizing is disabled
ring-buffer: Prevent resizing of persistent ring buffer
ftrace: Fix off-by-one fentry site disable in ftrace_free_mem()
ring-buffer: Use current_context for safe per-CPU buffer swap
ftrace: Drop extra comma in trace_buffered_event_enable
ftrace: Protect direct_functions in update_ftrace_direct_mod
ftrace: Protect direct_functions in update_ftrace_direct_del
ftrace: Protect direct_functions in ftrace_find_rec_direct
eventfs: Use children field for rcu head and add memory barriers
eventfs: Fix use-after-free in eventfs_remove_rec()
Linus Torvalds [Sun, 9 Aug 2026 13:31:16 +0000 (06:31 -0700)]
Merge tag 's390-7.2-7' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux
Pull s390 fixes from Vasily Gorbik:
- Fix potential uninitialized memory reads and buffer overflows from
malformed zcrypt CCA and EP11 requests by properly validating lengths
and payloads
- Fix possible out of bounds accesses in zcrypt EP11 domain handling by
replacing fixed payload layout assumptions with parsing ASN.1 fields
with bounds checks
- Fix zcrypt CCA and EP11 request and reply buffer allocations missing
required 4-byte padding, and scrub the full allocation on release
- Fix zcrypt CCA and EP11 messages leaking up to 3 uninitialized bytes
of memory by zeroing trailing alignment padding
* tag 's390-7.2-7' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
s390/zcrypt: Pad trailing CCA or EP11 message with zeros
s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing
s390/zcrypt: Improve EP11 CPRB length and overflow checks
s390/zcrypt: Improve CCA CPRB length and overflow checks
s390/zcrypt: Fix CPRB memory allocation in zcrypt misc code
Hui Su [Fri, 7 Aug 2026 15:41:46 +0000 (23:41 +0800)]
ring-buffer: Fix crash passing ERR_PTR to kthread_stop()
In test_ringbuffer()'s out_free cleanup loop, the check
`!rb_threads[cpu]` only catches NULL entries and misses entries that
hold an ERR_PTR.
rb_threads[] is static, so unassigned slots are NULL. But when
kthread_run_on_cpu() fails for a cpu, it stores ERR_PTR(-ENOMEM) (or
-EINTR) in rb_threads[cpu] before the creation loop jumps to out_free.
That entry is non-NULL, so the old `!ptr` check does not break, and the
cleanup proceeds to call kthread_stop() on the ERR_PTR. kthread_stop()
then dereferences the bogus pointer, crashing the kernel during the
late_initcall self-test.
Cc: stable@vger.kernel.org Fixes: 64ed3a049e3e ("ring-buffer: make use of the helper function kthread_run_on_cpu()") Link: https://patch.msgid.link/20260807154145.2846521-2-sh_def@163.com Signed-off-by: Hui Su <sh_def@163.com> Reviewed-by: Vincent Donnefort <vdonnefort@google.com> Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer()
In rb_allocate_cpu_buffer(), bpage->order was omitted, leaving it as 0.
This is an issue for a ring-buffer with subbufs bigger than PAGE_SIZE if
when freed: free_buffer_page() relies on this value. Align the value
with the actual allocation size (buffer::subbuf_order).
Cc: stable@vger.kernel.org Fixes: f9b94daa542a ("ring-buffer: Set new size of the ring buffer sub page") Link: https://patch.msgid.link/20260806211306.3704194-4-vdonnefort@google.com Signed-off-by: Vincent Donnefort <vdonnefort@google.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
ring-buffer: Prevent subbuf order change when resizing is disabled
Because ring_buffer_subbuf_order_set() frees buffer pages, we can't
allow it when resizing is disabled. A non-consuming reader is at risk of
use-after-free (rb_advance_iter()).
Return -EBUSY on resize_disabled, matching ring_buffer_resize()
behaviour.
Cc: stable@vger.kernel.org Fixes: f9b94daa542a ("ring-buffer: Set new size of the ring buffer sub page") Link: https://patch.msgid.link/20260806211306.3704194-3-vdonnefort@google.com Reported-by: syzbot+e0cc44465d6bae735679@syzkaller.appspotmail.com Signed-off-by: Vincent Donnefort <vdonnefort@google.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Josh Poimboeuf [Thu, 6 Aug 2026 04:56:46 +0000 (21:56 -0700)]
ftrace: Fix off-by-one fentry site disable in ftrace_free_mem()
When a module's init text is freed, do_init_module() calls
ftrace_free_mem() with a half-open [start, end) range. However the
ftrace_cmp_recs() comparator treats the upper bound as inclusive, as all
its other users do, passing 'ip + size - 1'. So ftrace_free_mem() can
delete a record sitting exactly at 'end', which is outside the freed
range.
For a kernel without CFI or IBT, the first record of a function is at
the function start, which for the first function in a module is also the
base of its text allocation. As the module allocator packs its regions,
that address is often the 'end' passed by a neighboring module's
do_init_module(), causing the first function's ftrace location to get
disabled, preventing an attempt to livepatch it:
livepatch: failed to find location for function 'pcspkr_probe'
Convert the exclusive end to the inclusive 'end - 1' the comparator
expects, and return early for an empty range to avoid the subtraction
from underflowing when the init text size is zero.
Tengda Wu [Mon, 3 Aug 2026 00:56:39 +0000 (00:56 +0000)]
ring-buffer: Use current_context for safe per-CPU buffer swap
The ring_buffer_swap_cpu() function currently checks the per-CPU
committing counter to determine if a buffer is actively being written to
before performing the swap. However, there exists a race window where
this check can be bypassed:
The committing counter can temporarily drop to 0 during a single write
operation (within rb_move_tail), creating a window where swap can
succeed even though the write is still in progress. This leads to
inconsistent buffer state and triggers the RB_WARN_ON in rb_commit().
Replace the committing counter check with current_context checks, which
are set at the entry of ring_buffer_lock_reserve() and remain valid
throughout the entire write operation, providing a reliable indicator of
buffer busy state during swap.
Linus Torvalds [Sat, 8 Aug 2026 23:39:53 +0000 (16:39 -0700)]
Merge tag 'locking-urgent-2026-08-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull futex fix from Ingo Molnar:
- Fix race in futex_pivot_pending() during private hash resize
that can cause stuck tasks (Yao Kai)
* tag 'locking-urgent-2026-08-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
futex: Fix race in futex_pivot_pending() during private hash resize
Linus Torvalds [Sat, 8 Aug 2026 23:33:04 +0000 (16:33 -0700)]
Merge tag 'usb-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
Pull USB / Thunderbolt fixes from Greg KH:
"Here are some small USB and Thunderbolt driver fixes for 7.2-rc7 that
resolve some reported issues. Included in here are:
- new quirk for some broken USB devices
- thunderbolt device fixes for reported issues
- usb gadget driver fix
- usb atm driver fix
- xhci driver fixes.
- other minor USB driver fixes
All of these have been in linux-next this week with no reported
issues"
* tag 'usb-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
usb: xhci: use BIT_ULL for CRCR bits to fix incorrect 64bit mask
usb: quirks: Add ShanWan gamepad to quirk list
usb: hub: Split announce_device() to log device identity before enumeration
usb: core: Add quirk for 255-bytes initial config read
usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg
usb: gadget: f_ncm: Use unsigned int for ndp_index
usb: cdnsp: fix incorrect endian conversions for APB timeout register
thunderbolt: Initialize ->domain_released completion before it is being used
thunderbolt: icm: Preserve USB4 proxy data-valid bit
thunderbolt: Bound the DROM dual link port number before indexing sw->ports
thunderbolt: Fix bandwidth group reservation indexing
thunderbolt: stream: Unmap buffers with mapped size
Linus Torvalds [Sat, 8 Aug 2026 23:31:15 +0000 (16:31 -0700)]
Merge tag 'tty-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty
Pull tty / serial / vt driver fixes from Greg KH:
"Here are some small serial and vt tty driver fixes for 7.2-rc7 that
resolve some reported problems. Included in here are:
- two vt core fixes
- amba-pl011 serial driver fixes
- 8250_of and 8250_dma driver fixes
- qcom-geni serial driver fix
- sc16is7xx serial driver fix
All of these have been in linux-next this week with no reported
issues"
* tag 'tty-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
serial: amba-pl011: synchronize DMA teardown
serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ
serial: amba-pl011: fix indefinite RS485 post-send delay
vt: add permission check for KDSKBMETA ioctl
vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx
serial: qcom-geni: fix TX DMA buffer flush
serial: 8250_dma: Clear stale RX state on shutdown
serial: sc16is7xx: enable THRI before filling TX FIFO
Linus Torvalds [Sat, 8 Aug 2026 23:29:33 +0000 (16:29 -0700)]
Merge tag 'staging-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging
Pull staging driver fixes from Greg KH:
"Here are some more small staging driver fixes, just for the rtl8723bs
driver, for some reported problems found with it now that people are
starting to actually test the thing with "bad" networks.
Nothing major, but good to have in the -final release. All of these
have been in linux-next for over a week with no reported problems"
* tag 'staging-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
staging: rtl8723bs: validate monitor transmit frame lengths
staging: rtl8723bs: fix missing shared-key auth challenge length check
staging: rtl8723bs: fix OOB read in WMM_param_handler()
staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
Linus Torvalds [Sat, 8 Aug 2026 23:25:59 +0000 (16:25 -0700)]
Merge tag 'char-misc-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
Pull char / misc and documentation fixes from Greg KH:
"Here are some small char/misc and nvmem and documentation fixes for
7.2-rc7 to resolve some reported issues. Included in here are:
- updates to the documentation for the kernel threat model and
security bugs to get the LLMs to actually follow what we have been
asking them to do (i.e. not claim security issues for things we do
not consider security issues.)
- nvmem driver fixes which required a tiny "layout" driver to be
added.
- fastrpc driver fixes
- mei driver fix
- counter driver fix
- binder driver fix
All of these have been in linux-next this week with no reported
problems"
* tag 'char-misc-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
docs: security-bugs: clarify some mandatory steps for AI reports
docs: coding-assistant: explain important steps when looking for bugs
docs: security-bugs: clarify what counts as a valid version
docs: threat-model: move fake devices out of "non production use"
docs: threat-model: clarify "security bug" vs "vulnerability"
counter: microchip-tcb-capture: Fix DT channel validation
mei: pull kvfree out of spinlock
rust_binder: do not query current thread for all ioctls
nvmem: layouts: Add fixed-layout driver
nvmem: apple-spmi-nvmem: wrap regmap calls to satisfy CFI
misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
misc: fastrpc: fix channel ctx ref leak when session alloc fails
misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke
misc: fastrpc: Remove buffer from list prior to unmap operation
misc: fastrpc: Fix initial memory allocation for Audio PD memory pool
projects / linux / log