linux.git/drivers/iio/gyro, branch master

Replace by more specific (c files)

2026-07-03T05:38:17+00:00

Replace the #include of  by the more specific
 where applicable. For most cases the include
can be dropped completely, only a few drivers need one or two headers
added.

Acked-by: Danilo Krummrich 
Acked-by: Takashi Sakamoto 
Acked-by: Bjorn Helgaas 
Link: https://patch.msgid.link/1a3f2007c5c5dcf555c09a4035ce3ae8ef1b6c49.1782808461.git.u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König (The Capable Hub)

Merge tag 'iio-fixes-for-7.1b' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-next

2026-06-14T05:56:59+00:00

IIO: 2nd set of fixes for the 7.1 cycle.

Usual mixed bag of ancient issues and the recently introduced.

Various drivers
- Ensure use of simple_write_to_buffer() in debugfs callbacks doesn't
result in reading off the end of intended data by checking the
position is always 0.
buffer/hw-consumer
- Ensure scan_mask is freed on buffer release.
acpi-als
- Check ACPI_COMPANION() against NULL to close corner case where a
driver is overridden.
adi,ad4062
- Add GPIOLIB dependency to avoid undefined ref to gpiochip_get_data()
adi.ad7768-1
- Add GPIOLIB dependency to avoid several undefined functions.
adi,ad2s1210
- Ensure possible recovery path if a read fails in the interrupt handler.
bosch,bmg160
- Increase sleep on startup to ensure device is ready.
bosch,bmp280
- Ensure buffer pushed to kfifo is zeroed to avoid leaking uninitialized
stack data to userspace.
dyna-image,al3010
- Fix refactor that stopped reading one of the two measurement registers.
dyna-image,al3320a
- Fix refactor that stopped reading one of the two measurement registers.
qcom,spmi-iadc
- Ensure disable_irq_wake() is called on remove path.
sensiron,scd30
- Fix a sign extension bug.
st,vl5310x
- Ensure possible recovery path if a read fails in the interrupt handler.
ti,adc1298
- Bounds check for pga_settings index. Hardening against device returning
unexpected values.
ti,tmp006
- Ensure trigger correctly released on remove path.
vishay,veml6030
- Fix incorrect channel type in events.
vishay,veml6074
- Bounds check for veml6075_it_ms. Hardening against device returning
unexpected values.

* tag 'iio-fixes-for-7.1b' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio: (23 commits)
iio: adc: ad_sigma_delta: fix clear_pending_event for registerless devices
iio: adc: ad_sigma_delta: fix CS held asserted and state leaks
iio: light: opt3001: fix missing state reset on timeout
iio: chemical: scd30: Cleanup initializations and fix sign-extension bug
iio: core: fix uninitialized data in debugfs
iio: backend: fix uninitialized data in debugfs
iio: dac: ad3552r-hs: fix uninitialized data ni ad3552r_hs_write_data_source()
iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind
iio: light: al3320a: read both ALS ADC registers again
iio: light: al3010: read both ALS ADC registers again
iio: temperature: tmp006: use devm_iio_trigger_register
iio: buffer: hw-consumer: free scan_mask on buffer release
iio: adc: ad7768-1: Select GPIOLIB
iio: light: veml6030: fix channel type when pushing events
iio: light: acpi-als: Check ACPI_COMPANION() against NULL
iio: resolver: ad2s1210: notify trigger and clear state on fault read error
iio: proximity: vl53l0x: notify trigger and clear IRQ on error paths
iio: gyro: bmg160: wait full startup time after mode change at probe
iio: gyro: bmg160: bail out when bandwidth/filter is not in table
iio: pressure: bmp280: zero-init bmp580 trigger handler buffer
...

Merge tag 'v7.1-rc6' into work

2026-06-02T14:24:19+00:00

Linux 7.1-rc6

iio: gyro: HID: hid-sensor-gyro-3d: Refactor channel initialization

2026-05-31T10:01:47+00:00

Replace the local gyro_3d_adjust_channel_bit_mask() function with a
compound literal for scan_type initialization to improve code
readability. Additionaly, clean up the channel initialization
loop by iterating directly over the channel scan indices.

Signed-off-by: Natália Salvino André 
Co-developed-by: Pietro Di Consolo Gregorio 
Signed-off-by: Pietro Di Consolo Gregorio 
Signed-off-by: Jonathan Cameron

iio: Initialize i2c_device_id arrays using member names

2026-05-31T10:01:46+00:00

While being less compact, using named initializers allows to more easily
see which members of the structs are assigned which value without having
to lookup the declaration of the struct. And it's also more robust
against changes to the struct definition.

The mentioned robustness is relevant for a planned change to struct
i2c_device_id that replaces .driver_data by an anonymous union.

This patch doesn't modify the compiled arrays, only their representation
in source form benefits. The former was confirmed with x86 and arm64
builds.

Signed-off-by: Uwe Kleine-König (The Capable Hub) 
Reviewed-by: Siratul Islam 
Reviewed-by: Matti Vaittinen 
Signed-off-by: Jonathan Cameron

iio: common: ssp: remove SSP_CHAN_TIMESTAMP() macro

2026-05-31T10:01:46+00:00

Remove the SSP_CHAN_TIMESTAMP() macro and replace users with the
IIO_CHAN_SOFT_TIMESTAMP() macro. The SSP_CHAN_TIMESTAMP() macro is
identical to the IIO_CHAN_SOFT_TIMESTAMP() macro, so we don't need
a separate macro for it.

Signed-off-by: David Lechner 
Reviewed-by: Andy Shevchenko 
Signed-off-by: Jonathan Cameron

iio: gyro: adxrs290: Use guard(mutex) in lieu of manual lock+unlock

2026-05-31T09:59:34+00:00

Use guard(mutex)() to automatically release the lock on scope exit,
simplifying the error handling path and removing the need for
explicit unlock and goto-based cleanup.

Signed-off-by: Guilherme Dias 
Co-developed-by: João Paulo Menezes Linaris 
Signed-off-by: João Paulo Menezes Linaris 
Reviewed-by: Andy Shevchenko 
Reviewed-by: Maxwell Doose 
Signed-off-by: Jonathan Cameron

iio: gyro: bmg160: wait full startup time after mode change at probe

2026-05-16T10:48:38+00:00

bmg160_chip_init() calls bmg160_set_mode(BMG160_MODE_NORMAL) and
then waits only 500-1000 us. Per the BMG160 datasheet
(BST-BMG160-DS000-07 Rev. 1.0, May 2013), the start-up and wake-up
times (tsu, twusm) are 30 ms.

The same file already waits BMG160_MAX_STARTUP_TIME_MS (80 ms)
in bmg160_runtime_resume() after the same set_mode(NORMAL)
operation. The 500 us value at probe was likely a unit mix-up;
the old comment said "500 ms" while the code used microseconds.

Reuse the same constant via msleep() and add a code comment
explaining the datasheet basis for the wait. Without this,
register writes that follow the mode change can hit the chip
before it is ready.

Fixes: 22b46c45fb9b ("iio:gyro:bmg160 Gyro Sensor driver")
Signed-off-by: Stepan Ionichev 
Cc: 
Signed-off-by: Jonathan Cameron

iio: gyro: bmg160: bail out when bandwidth/filter is not in table

2026-05-16T10:44:51+00:00

bmg160_get_filter() walks bmg160_samp_freq_table[] looking for the entry
matching the bw_bits value read from the chip:

	for (i = 0; i < ARRAY_SIZE(bmg160_samp_freq_table); ++i) {
		if (bmg160_samp_freq_table[i].bw_bits == bw_bits)
			break;
	}
	*val = bmg160_samp_freq_table[i].filter;

If no entry matches, i ends up equal to the array size and the next line
reads one slot past the end. bmg160_set_filter() has the same shape, driven
by 'val' instead of bw_bits.

smatch flags both:

  drivers/iio/gyro/bmg160_core.c:204 bmg160_get_filter() error:
  buffer overflow 'bmg160_samp_freq_table' 7 <= 7
  drivers/iio/gyro/bmg160_core.c:222 bmg160_set_filter() error:
  buffer overflow 'bmg160_samp_freq_table' 7 <= 7

Return -EINVAL when no entry matches.

The set_filter() path is reachable from userspace via the sysfs
in_anglvel_filter_low_pass_3db_frequency interface, so userspace can
trivially trigger the out-of-bounds read with a value that is not in
bmg160_samp_freq_table[].filter.

Fixes: 22b46c45fb9b ("iio:gyro:bmg160 Gyro Sensor driver")
Signed-off-by: Stepan Ionichev 
Reviewed-by: Andy Shevchenko 
Cc: 
Signed-off-by: Jonathan Cameron

iio: gyro: itg3200: fix i2c read into the wrong stack location

2026-05-15T11:05:35+00:00

itg3200_read_all_channels() takes `__be16 *buf' as a parameter and
fills the i2c_msg destination as `(char *)&buf'. Since `buf' is the
parameter (a pointer), `&buf' is the address of the local pointer
slot on the stack of itg3200_read_all_channels(), not the address
of the caller's scan buffer. The (char *) cast hides the type
mismatch.

i2c_transfer() therefore writes ITG3200_SCAN_ELEMENTS * sizeof(s16)
= 8 bytes into the parameter's stack slot, which is discarded when
the function returns. The caller's scan buffer in
itg3200_trigger_handler() is never written to, so
iio_push_to_buffers_with_timestamp() pushes uninitialised stack
contents to userspace via /dev/iio:deviceX every scan -- both a
functional bug (no actual gyroscope or temperature data is
delivered through the triggered buffer) and an information leak.

The non-buffered read_raw() path is unaffected: it goes through
itg3200_read_reg_s16() which uses `&out' on a local s16 value,
where that is correct.

Drop the spurious `&' so the i2c read writes into the caller's
buffer.

Fixes: 9dbf091da080 ("iio: gyro: Add itg3200")
Cc: stable@vger.kernel.org
Signed-off-by: David Carlier 
Reviewed-by: Andy Shevchenko 
Signed-off-by: Jonathan Cameron