Commit graph zephyr/drivers
Author SHA1 Message Date
Owen O'Hehir
562b15529b drivers: dp: swdp_bitbang: fix nRESET polarity for GPIO_ACTIVE_LOW
The driver's runtime sw_set_pins() / sw_get_pins() handlers treat the
CMSIS-DAP DAP_SWJ_Pins nRESET bit as a Zephyr logical pin value, but
the CMSIS-DAP specification defines that bit as the raw electrical
level driven onto the line (bit=0 -> drive low / asserted, bit=1 ->
drive high / deasserted).

The mismatch only shows up when a board overlay declares
reset-gpios with GPIO_ACTIVE_LOW (the natural choice for active-low
nRESET): the polarity flag is applied a second time inside
gpio_pin_set_dt(), so the runtime assert/deassert end up inverted.
With GPIO_ACTIVE_HIGH the runtime behaviour is correct but the
GPIO_OUTPUT_INACTIVE setting in sw_port_on() leaves the line driven
low on init, holding the target permanently in reset between SWD
transactions.

Translate the raw level into the polarity-aware logical level in both
sw_set_pins() and sw_get_pins(), so boards can use the conventional
GPIO_ACTIVE_LOW for the reset-gpios property and the line ends up
electrically released when idle, asserted only while DAP_SWJ_Pins
asks for it, and deasserted again afterwards.

Bench-validated on NUCLEO-H723ZG (probe) -> NUCLEO-WL55JC (target):
without this fix, an explicit pyocd target.reset(NSRST) leaves NRST
pinned electrically low (DHCSR.S_RESET_ST stays set across reads
post-reset). With this fix and reset-gpios = <... GPIO_ACTIVE_LOW>,
connect_mode=under_reset, target.reset(NSRST) and DAP_SWJ_Pins all
operate as the CMSIS-DAP spec describes.

Signed-off-by: Owen O'Hehir <oo.hehir@gmail.com>
2026-10-20 17:16:57 +02:00
Sylvio Alves
42984ac4bb drivers: spi: esp32: do not drive mosi on half-duplex reads
In half-duplex mode the write phase runs before the read phase.
The driver enabled the write phase for every chunk that receives
data, through the zero-filled TX buffer on DMA transfers and the
MOSI enable on CPU transfers. Read-only chunks then clocked out
zeros before the read, and the input delay compensation dummy
cycles landed before that write phase instead of the read.

Enable the write phase only when there is data to send, or when
receiving in full-duplex mode.

Assisted-by: Claude:opus-5
Signed-off-by: Sylvio Alves <sylvio.alves@espressif.com>
2026-10-19 16:30:52 +02:00
Henrik Brix Andersen
8371426ffe drivers: can: mcp251xfd: add missing check for unsupported TX frame flags
Add missing check for unsupported TX frame flags.

Signed-off-by: Henrik Brix Andersen <hebad@vestas.com>
2026-10-19 16:30:12 +02:00
Henrik Brix Andersen
64553887a8 drivers: can: mcp251xfd: add missing check for CANFD_MAX_DLC
Add missing check for DLC larger than CANFD_MAX_DLC when transmitting CAN
FD frames.

Signed-off-by: Henrik Brix Andersen <hebad@vestas.com>
2026-10-19 16:30:12 +02:00
Andreas Petter
15fe9ea534 drivers: can: mcp251xfd: wait for the oscillator after reset
The reset delay was fixed empirically at 5 ms. With a 4 MHz external
clock the MCP2518FD sporadically becomes ready only after up to ~8 ms,
so the CRC read of CiCON fails and init aborts. Poll CiCON for
configuration mode instead and treat CRC errors as "not ready yet"
while polling (errata DS80000789 item 1). Let SYSCLK settle for 200 us
after PLLRDY before switching to the full SPI clock (item 4).

Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Andreas Petter <Andreas.Petter@mcnetic.de>
2026-10-19 16:29:20 +02:00
Alain Volmat
5bab0a6c07 video: stm32_dcmi: avoid timeout at set_stream disable
When stopping the stream, the DCMI driver currently stop
first the source device (ex: sensor) then afterward call
the HAL_DCMI_Stop. This leads to a timeout at HAL_DCMI_Stop
since the HW block is waiting for an EOF to frame to come
before clearing its ongoing capture bit. Avoid this
timeout by first stopping the DCMI capture and only
afterward stop the source device.

Signed-off-by: Alain Volmat <alain.volmat@foss.st.com>
2026-10-19 16:28:52 +02:00
Benjamin Cabé
160370f46f drivers: dma: esp32: honour the burst length
A burst length only turned bursts on, and 0 did not turn them off. On
the ESP32-S3 it now also sets the block size of PSRAM accesses (16, 32
or 64 bytes), which doubles PSRAM throughput at 64, and other lengths
are rejected there.

The GDMA writes PSRAM in whole aligned blocks, so an RX buffer in PSRAM
that does not start and end on a block boundary gets the largest block
size it is aligned to, down to the 16 bytes used before.

Signed-off-by: Benjamin Cabé <benjamin@zephyrproject.org>
Assisted-by: Claude:opus-5.5
2026-10-19 16:27:15 +02:00
YunHung Hua
13e6301d42 drivers: i2s: ambiq: fix the read and write timeout handling
i2s_ambiq_write() and i2s_ambiq_read() waited for the DMA with a fixed
100 ms timeout instead of i2s_config.timeout. i2s_ambiq_write() also
ignored the result: after a timeout it still copied the block into a
DMA buffer that may still be in use, freed the block and returned
-EAGAIN. i2s_buf_write() frees the block again when i2s_write() fails,
so a timed-out write freed it twice.

Wait with SYS_TIMEOUT_MS(timeout), and when the write times out, return
before touching the DMA buffer and leave the block with the caller, as
the other I2S drivers do.

Assisted-by: Claude:claude-opus-5-5
Signed-off-by: YunHung Hua <oliverhua.us@gmail.com>
2026-10-19 16:26:49 +02:00
YunHung Hua
5601810427 drivers: i2s: renesas: use the TX timeout in the write path
i2s_renesas_ra_ssie_write() queued the block with K_NO_WAIT, so a write
to a full TX queue failed at once whatever i2s_config.timeout was set
to.

Give i2s_renesas_ra_put_stream() a timeout argument, as
i2s_renesas_ra_get_stream() already has, and wait with
SYS_TIMEOUT_MS(timeout) in the write path. The RX callbacks keep
K_NO_WAIT because they run from the SSI interrupt.

Assisted-by: Claude:claude-opus-5-5
Signed-off-by: YunHung Hua <oliverhua.us@gmail.com>
2026-10-19 16:26:49 +02:00
YunHung Hua
051b470873 drivers: i2s: convert the stream timeout with SYS_TIMEOUT_MS()
i2s_config.timeout is documented to accept SYS_FOREVER_MS, but the
esp32, max32, renesas_ra_ssie and stm32_sai drivers pass it to
K_MSEC(), which clamps negative values to 0. A stream configured to
wait forever therefore does not wait at all: i2s_write() fails as soon
as the queue is full and i2s_read() as soon as it is empty.

Convert it with SYS_TIMEOUT_MS(), as i2s_stm32.c and the other I2S
drivers already do.

Fixes #116030

Assisted-by: Claude:claude-opus-5-5
Signed-off-by: YunHung Hua <oliverhua.us@gmail.com>
2026-10-19 16:26:49 +02:00
YunHung Hua
0f4ec187db drivers: can: mcp251xfd: limit classic CAN frame DLC to 8 on reception
mcp251xfd_rxobj_to_canframe() copies the 4-bit DLC of the RX object
into struct can_frame unchanged. A classic CAN frame can be received
with a DLC of 9 to 15, which ISO 11898-1 defines as 8 data bytes.

The memcpy() below is bounded by CAN_MAX_DLEN, so the driver itself
stays in bounds, but the frame handed to the receive callback keeps the
raw DLC. With CONFIG_CAN_FD_MODE disabled, consumers that size the
payload with can_dlc_to_bytes() then read past the end of the 8 byte
data array. With CONFIG_CAN_FD_MODE enabled, up to 56 stale RX FIFO
bytes are copied into the frame instead.

Limit the DLC of frames without the FDF flag to 8, as the R-Car CAN
driver does, so that the reported DLC and the copied data agree.

Build-tested only; not run on mcp251xfd hardware.

Fixes #118547

Signed-off-by: YunHung Hua <oliverhua.us@gmail.com>
2026-10-19 16:25:33 +02:00
YunHung Hua
2d439acc7b drivers: can: mcp251xfd: throttle interrupt loop on INT read failure
When reading the INT register fails, mcp251xfd_handle_interrupts()
continued at the top of its loop, skipping the consecutive call
counter, the periodic sleep and the INT pin check. With the controller
absent, unpowered or behind a broken SPI link, the loop then never
reaches its k_sleep() throttle and never exits. The interrupt thread is
cooperative, so other threads only get the CPU time a pending SPI
transfer leaves them.

Continue with the INT pin check instead, so a failed read leaves the
loop once the INT pin is inactive, and is throttled the same way as the
other repeated interrupt handling.

Build-tested only; not run on mcp251xfd hardware.

Fixes #117770

Signed-off-by: YunHung Hua <oliverhua.us@gmail.com>
2026-10-19 16:25:19 +02:00
Sergei Ovchinnikov
faf66bf92d drivers: otp: otp_npm10xx: fix the UICR reading sequence
nPM10xx PMIC OTP reading sequence description in the datasheet had some
errors which this patch addresses. The ADDR0 register needs to be written
only once and is auto-incremented on consecutive reads.

Signed-off-by: Sergei Ovchinnikov <sergei.ovchinnikov@nordicsemi.no>
2026-10-19 10:30:56 +02:00
Sergei Ovchinnikov
366e070906 drivers: sensor: npm10xx_adc: update ADC equations
In line with the latest datasheet for nPM1012 v2.0

Signed-off-by: Sergei Ovchinnikov <sergei.ovchinnikov@nordicsemi.no>
2026-10-19 10:30:56 +02:00
Arkadiusz Grzelka
dda08cc854 drivers: serial: uart_bt: rate-limit the unsubscribed drop warning
LOG_WRN_ONCE() keeps one flag per call site, so the warning in
uart_bt_fifo_fill() fires once per boot for all instances. Output
dropped in a later period without a subscriber goes unreported.

Use LOG_WRN_RATELIMIT() so the warning repeats, at most once per
CONFIG_LOG_RATELIMIT_INTERVAL_MS.

Assisted-by: Claude:claude-sonnet-5-5
Signed-off-by: Arkadiusz Grzelka <arkadiusz.grzelka@arivemb.com>
2026-10-19 10:24:44 +02:00
Eric Bradley
6cfafba540 drivers: can: mcan: ignore Tx events for completed Tx Buffers
When a Tx Event FIFO new entry (IR.TEFN) and a bus-off state change are
pending in the same pass of can_mcan_line_0_isr(), the state change
handler runs first and completes every Tx Buffer with -ENETUNREACH,
clearing its callback. The Tx event handler then reads the event of a
frame that was transmitted before bus-off and calls the cleared, NULL,
callback.

Skip Tx events whose Tx Buffer no longer has a callback. The event is
still acknowledged, and tx_sem is no longer given a second time for the
same Tx Buffer.

Reproduced on an STM32G431 by masking the FDCAN interrupts while a
transmitted frame's Tx event is pending and the controller goes bus-off.

Fixes #121845

Assisted-by: Amp:claude-opus-5.5
Signed-off-by: Eric Bradley <eric@basepowercompany.com>
2026-10-19 10:24:09 +02:00
David Jewsbury
8281a0fc6b clock_control: nrf_auxpll: Align out sel div values with DTS settings
This switchcase was comparing the DTS setting against the wrong
values. For example NRF_AUXPLL_CTRL_OUTSEL_DIV_12 is
equal to 0x7 but the dts selection would have an equivalent of
12.

Signed-off-by: David Jewsbury <david.jewsbury@nordicsemi.no>
2026-10-19 10:23:06 +02:00
YunHung Hua
55c9d4c0b9 drivers: memc: add the missing syscall handlers
memc.h declares memc_read(), memc_write(), memc_get_size() and
memc_read_id() as __syscall, but the header was never passed to
zephyr_syscall_header() and there are no z_vrfy_ handlers, so a user
thread that calls any of them is killed with "Bad system call id".

Register the header and add the handlers. Each one checks the device
object and the user buffer. memc_read() and memc_write() copy straight
from the get_mem_base() address plus addr, so their handlers also check
addr + len against memc_get_size() and fail with its error, -ENOTSUP,
when the driver cannot report a size.

Fixes #120198

Assisted-by: Claude:claude-opus-5-5
Signed-off-by: YunHung Hua <oliverhua.us@gmail.com>
2026-10-19 10:17:04 +02:00
Shawn Yang
6f28951bfd drivers: gpio: sf32lb: correct open-drain output polarity
The open-drain implementation keeps the output latch low and controls
the output enable bit. A logical high must disable the output and a
logical low must enable it.

Correct initial output state and masked, set and clear writes to match
those semantics. Push-pull output behavior is unchanged.

The OpenSiFli downstream driver already implements this polarity;
apply the equivalent fix to the mainline register-access implementation.

Link: 679c245711
Assisted-by: Codex:GPT-6
Signed-off-by: Shawn Yang <y810004@gmail.com>
2026-10-19 10:14:28 +02:00
Shawn Yang
850bdb8735 drivers: gpio: sf32lb: acknowledge IRQs before callbacks
Clearing pending bits after invoking callbacks loses an edge that
arrives during a callback on the same pin. Acknowledge the captured
pending bits first, then dispatch callbacks for enabled pins.

Limit the acknowledged snapshot to this port so that another port
sharing the bank keeps its pending events.

Assisted-by: Codex:GPT-6
Signed-off-by: Shawn Yang <y810004@gmail.com>
2026-10-19 10:14:08 +02:00
Sylvio Alves
a915b2f126 drivers: wifi: esp32: keep a driver copy of the key password
The supplicant stores the private key password pointer and reads
it with strlen() at every later TLS handshake, but the pointer
belongs to the caller's connect request, whose memory can be
reused once the connect call returns. Keep a NUL-terminated copy
owned by the driver, and wipe it whenever enterprise mode is
disabled.

Assisted-by: Claude:opus-5
Signed-off-by: Sylvio Alves <sylvio.alves@espressif.com>
2026-10-16 15:53:07 -05:00
Sylvio Alves
d6a6881d86 drivers: wifi: esp32: refuse enterprise creds while in use
The supplicant keeps pointers to the driver's certificate and key
buffers from the moment an enterprise connect configures them,
and parses them again on every reconnect or re-authentication.
Replacing the credentials during an enterprise connection frees
memory it still uses.

Track when the supplicant may reference the buffers. Return
-EBUSY while such a connection is connecting, connected or
roaming, and disable enterprise mode before replacing the
credentials otherwise. All paths now disable enterprise mode
through one helper that keeps this state in sync, and a mutex
serializes the credential update against the enterprise setup
of a connect.

Assisted-by: Claude:opus-5
Signed-off-by: Sylvio Alves <sylvio.alves@espressif.com>
2026-10-16 15:53:07 -05:00
Muhammad Waleed Badar
dbec18adc7 drivers: i2s: esp32: keep the next block linked behind the one in flight
On GDMA SoCs the TX callback freed the finished block, took the next one
from the queue and reloaded and restarted the channel for it. Until the
restart the output ran on the I2S TX FIFO alone, about 1.5 ms of 16-bit
stereo at 44.1 kHz on the ESP32-S3, and any interrupt latency beyond
that, which Wi-Fi traffic causes regularly, left a gap at the block
boundary. With 4 KB blocks a boundary comes every 23 ms, and the gaps
are heard as a continuous crackle.

Keep a second block linked behind the one in flight: the GDMA driver
now queues a reload behind a running transfer, so the START trigger
links two blocks, each EOF callback promotes the linked block and links
the next queued one, and a write that finds nothing linked and the
queue empty links its block at once. The callback's deadline becomes a
whole block rather than the FIFO depth, and the restart path only runs
when the chain really ended. STOP lets the block in flight and the one
linked behind it play out and links no further one, so no block is
lost. If one callback arrives after two blocks ended, because a flash
write masked the interrupt for longer than a block, the DMA status
shows the chain parked and both blocks are released, instead of the
driver staying a block behind the hardware for good. Blocks that do not
fit in half the descriptors stay queued and are started as before. RX
and the legacy DMA path are unchanged.

Tested on a VIEWE UEDX32480035E-WB-A (ESP32-S3) driving a MAX98357
from i2s0 with 4 KB blocks: a 1 kHz tone played through the sink while
a TCP client pulled a copy of the PCM over Wi-Fi at 1.6 Mbit/s, recorded
with a microphone. Without this change: 218 clicks in 29 s, 69 of them
one, two or three blocks apart, and the tone's SNR fell to 11 dB. With
it: 2 clicks in 29 s, none at the block period, SNR 19 dB, the same as
without load. 20 START/STOP cycles with six blocks queued ended the
output 41 to 42 ms after STOP and released every block; DRAIN, a
continuous stream and 57600-byte blocks followed by a 4 KB one, with
15 DMA descriptors, played out completely. Also built for
esp32s3_devkitc/esp32s3/procpu with samples/drivers/i2s/echo.

Assisted-by: Claude:claude-fable-5-1
Signed-off-by: Muhammad Waleed Badar <walid.badar@gmail.com>
2026-10-16 15:52:21 -05:00
Muhammad Waleed Badar
ba4f2e7c0b drivers: dma: esp32: queue a TX reload behind the running transfer
dma_reload() always reset the channel and rebuilt the descriptor list
from scratch, so a driver feeding a peripheral from a queue of buffers
had to let each transfer end, then reload and restart from its callback.
Between the last descriptor of one transfer and the first of the next
the peripheral is fed by its own FIFO alone, and the gap depends on the
interrupt latency. For the I2S TX FIFO of the ESP32-S3 that is about
1.5 ms of 16-bit stereo at 44.1 kHz, which Wi-Fi activity exceeds, so
every buffer boundary can glitch.

When a TX channel still has a transfer in flight, build the reloaded
buffer in the half of the descriptor list that transfer does not reach
into, link it behind the last descriptor and set the restart bit, so
that the GDMA goes on with it without stopping. At most two transfers
are in flight, and a third reload returns -EBUSY until one completes;
each one still ends with its own EOF callback. A buffer that does not
fit in half of the descriptors returns -ENOSPC, so that the caller can
fall back to a plain reload once the channel is idle. The chain state
is updated under the driver's lock, in the reload as in the EOF
interrupt. dma_start() on a channel that is already running leaves it
alone, so the usual reload-then-start pairing works in both cases. A
parked or stopped channel is reloaded as before. This is how
dma_mcux_edma.c queues a reload behind a running transfer, which
i2s_mcux_sai.c relies on.

Built for esp32s3_devkitc/esp32s3/procpu with samples/drivers/i2s/echo.

Assisted-by: Claude:claude-fable-5-1
Signed-off-by: Muhammad Waleed Badar <walid.badar@gmail.com>
2026-10-16 15:52:21 -05:00
Fin Maaß
a034509e4a drivers: ethernet: smsc91x: fix the set_config prototype
commit db984ee196 ("net: l2: ethernet: add struct net_if to
arguments") added the iface parameter to eth_smsc_set_config() without
the trailing comma, so the driver no longer compiles. Add it.

Found by building samples/net/zperf for fvp_base_revc_2xaem/v8a, no
board in CI builds this driver.

Assisted-by: Claude:claude-opus-5.5
Signed-off-by: Fin Maaß <f.maass@vogl-electronic.com>
2026-10-16 15:51:15 -05:00
Fabio Baltieri
fa69ae8006 sensor: rts5912: configure interrupt per instance
Interrupt connection and enabling were previously hardcoded to instance 0
inside tach_rts5912_init(), which caused any additional tach instances
enabled in devicetree to fail to register their interrupts.

Add an irq_config_func callback to struct tach_rts5912_config, define an
instance-specific IRQ configuration function in REALTEK_TACH_INIT(), and
call it during device initialization.

Tested by building for rts5912_evb with single-, dual-, and quad-instance
devicetree configurations and verifying the generated ISR table entries.

Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Fabio Baltieri <fabiobaltieri@google.com>
2026-10-16 15:50:47 -05:00
Fabrice DJIATSA
1ff1904138 drivers: counter: stm32: fix late alarm check when compare wraps to 0
When a custom top value that is not 2^n-1 is set, a relative alarm can
wrap to a compare value of 0. The late detection computed val - 1U,
which underflowed to 0xFFFFFFFF, so the alarm was wrongly treated as
late and its callback was dropped.

Perform the decrement modulo the top value instead.

Tested with drivers.counter.basic_api on stm32h573i_dk.

Assisted-by: GitHub Copilot:claude-opus-4.7
Signed-off-by: Fabrice DJIATSA <fabrice.djiatsa-ext@st.com>
2026-10-16 15:21:14 -05:00
Jamel Arbi
9da8a9dca3 drivers: ieee802154: fix mcxw sed issue
restart rx when switch channel is requested for sed

Signed-off-by: Jamel Arbi <jamel.arbi@nxp.com>
2026-10-16 15:19:59 -05:00
Eric Mechin
d5b06ac92b drivers: bluetooth: hci: hci_stm32wba.c: fix flash access without BLE
FLASH synchronization must be bypassed when the BLE is disabled
(on Zephyr bt_disable() function call).
The FD_FLASHACCESS_RFTS_BYPASS flag must be set to ENABLE to avoid
a deadlock in the flash manager when waiting for a LL response that
do not exist.

Signed-off-by: Eric Mechin <eric.mechin@st.com>
2026-10-16 15:19:18 -05:00
Benjamin Cabé
c0281a5869 drivers: rtc: harden the rtc_time syscall verifiers
rtc_alarm_set_time() documents timeptr as NULL when mask is 0, which is
how an alarm is disabled. The verifier checked timeptr unconditionally
with K_SYSCALL_MEMORY_READ(), which has no NULL exemption, so the
documented way to cancel an alarm did not work from user mode. Check
timeptr only when non-NULL, and require mask == 0 when it is NULL, which
is the other half of the documented contract.

Both set_time verifiers also passed the userspace pointer straight to
the driver, which then reads the fields out of memory another user
thread can still write. Copy the struct onto the kernel stack with
k_usermode_from_copy() instead, so the driver acts on a stable snapshot.

Signed-off-by: Benjamin Cabé <benjamin@zephyrproject.org>
Assisted-by: Claude:claude-opus-5
2026-10-16 15:12:59 -05:00
Jason Yu
b94f991283 drivers: flash: mcux: fix ambiguous SOC_NV_FLASH_NODE lookup
The previous DT_CHILD(DT_DRV_INST(0), flash_0) requires every
flash controller to have its soc-nv-flash child at unit address 0.
Controllers whose flash child uses a different unit address (e.g.
flash@10000000 on kv5x) need DTS changes to satisfy this constraint.

Use COND_CODE_1 with DT_NODE_EXISTS to try DT_CHILD first; when
flash@0 does not exist, fall back to SOC_NV_FLASH_CHILD_NODE which
iterates status-okay children filtered by the soc-nv-flash
compatible.  This handles both multi-child controllers such as
mcxw70 (where flash@0 exists alongside flw@800000) and single-child
controllers with a non-zero unit address.

Fixes: #121282

Signed-off-by: Jason Yu <zejiang.yu@nxp.com>
2026-10-16 13:17:27 +02:00
Benjamin Cabé
f93698d20c drivers: serial: mcux_lpuart: RX timeout from a kernel timer
Run the RX timeout from a k_timer, in interrupt context like the idle
line and DMA events that also flush received data, instead of a
delayable work item on the system work queue. This avoids a work queue
thread wakeup for each burst of received data.

Assisted-by: Claude:opus-5.5
Signed-off-by: Benjamin Cabé <benjamin@zephyrproject.org>
2026-10-16 13:17:16 +02:00
Flavio Ceolin
787d1ad9e5 drivers: led: reject wrapping channel range in write_channels handler
z_vrfy_led_write_channels() checked the device object and that buf is
readable for num_channels bytes, but passed start_channel through
unchecked. Reject such requests with u32_add_overflow() before
calling into the driver. Driver-side bounds checks still need fixing so
that kernel callers are covered and the checks that do not involve
wrapping are correct.

Signed-off-by: Flavio Ceolin <flavio@hubble.com>
2026-10-16 13:15:28 +02:00
Zayne Stites
57a10e82d0 drivers: i3c: gate the descriptor slab count on I3C_CONTROLLER
I3C_NUM_OF_DESC_MEM_SLABS was inside "if I3C_CONTROLLER && I3C_TARGET",
so a controller-only build never defined it. This caused
i3c_device_desc_alloc to resolve the header stub that always returns
NULL, leaving every device discovered through ENTDAA that was not
described in devicetree untracked.

ENTDAA is a controller operation, so move the symbol to the I3C_CONTROLLER
block

Assisted-by: Claude:claude-opus-5
Signed-off-by: Zayne Stites <Zayne.Stites@infineon.com>
2026-10-16 09:21:11 +02:00
Fin Maaß
4b1f9a6a97 drivers: rtc: rtc_emul: make the init function static
rtc_emul_init() is only used by DEVICE_DT_INST_DEFINE() in this file,
nothing outside the file references it.

Assisted-by: Claude:claude-fable-5-1
Signed-off-by: Fin Maaß <f.maass@vogl-electronic.com>
2026-10-16 09:20:59 +02:00
Fin Maaß
6e9afb46a1 drivers: rtc: stm32: make the interrupt handler static
rtc_stm32_isr() is only connected with IRQ_CONNECT() in this file,
nothing outside the file references it.

Assisted-by: Claude:claude-fable-5-1
Signed-off-by: Fin Maaß <f.maass@vogl-electronic.com>
2026-10-16 09:20:59 +02:00
Fin Maaß
df3e2e8836 drivers: watchdog: stm32_iwdg: make the interrupt handler static
iwdg_stm32_isr() is only connected with IRQ_CONNECT() in this file,
nothing outside the file references it.

Assisted-by: Claude:claude-fable-5-1
Signed-off-by: Fin Maaß <f.maass@vogl-electronic.com>
2026-10-16 09:20:59 +02:00
Maochen Wang
ed10e8d30a drivers: wifi: nxp: disable WLS default on AArch64 targets
The NXP_WIFI_WLS Kconfig option defaults to y when NXP_IW61X
and WIFI_NM_WPA_SUPPLICANT are both enabled. This causes a
link failure on AArch64 targets (e.g. i.MX93 Cortex-A55 with
IW612) because the WLS feature pulls in libcsi.a, which is
only available as a Cortex-M7/M33 pre-compiled archive.

The linker reports 'file in wrong format' when it tries to
link the elf32-littlearm libcsi.a into an AArch64 image.

Add !ARM64 to the default condition so that WLS is not
auto-enabled on AArch64 platforms where no compatible
libcsi archive exists.

Fixes: #122076

Assisted-by: WChat:Claude
Signed-off-by: Maochen Wang <maochen.wang@nxp.com>
2026-10-16 09:19:07 +02:00
Syed Syed
cb6bfc0989 drivers: intc: plic: fix off-by-one in tracked IRQ count
The RISC-V PLIC reserves interrupt ID 0, so valid device interrupt IDs
range 1..riscv,ndev inclusive. The driver set nr_irqs = riscv,ndev and
used ">= nr_irqs" range checks, which incorrectly rejected the highest
interrupt source (ID == riscv,ndev) as spurious, skipped its priority
initialization, and undersized the per-IRQ stats and affinity buffers.

Set nr_irqs = riscv,ndev + 1 (capped by CONFIG_MAX_IRQ_PER_AGGREGATOR).

Fixes #122042

Signed-off-by: Syed Syed <syeds@amd.com>
2026-10-16 09:18:18 +02:00
Robert Robinson
25fa44a660 dts: bindings: sensor: nordic: Add voltage divider to nrf-vbat.
VBAT raw values are divided down to lie within input range of PADC.
This must therefore be reapplied when reading the raw value. For the
case of nRF7120 this value is 5.5.

Signed-off-by: Robert Robinson <robert.robinson@nordicsemi.no>
2026-10-16 09:16:14 +02:00
Benjamin Cabé
4700b51bba drivers: input: crsf: derive the async RX timeout from the baud rate
A fixed 1 ms idle timeout adds 1 ms to every frame and never expires at
1 kHz packet rates, where frame gaps are ~380 us, so frames are only
delivered in bursts when the RX buffer fills. Flush after 4 idle
character times (~96 us at 420 kbaud) instead.

Assisted-by: Claude:opus-5.5
Signed-off-by: Benjamin Cabé <benjamin@zephyrproject.org>
2026-10-16 09:16:00 +02:00
Benjamin Cabé
6f240640cd drivers: input: crsf: send telemetry with uart_tx()
Telemetry used uart_poll_out(), blocking the caller for a whole frame
although the driver otherwise uses the async UART API, and silently
dropped the frame when a send was in progress. Send it with uart_tx()
from a per-instance buffer released on UART_TX_DONE or UART_TX_ABORTED,
and return -EBUSY while a frame is in flight.

Assisted-by: Claude:opus-5.5
Signed-off-by: Benjamin Cabé <benjamin@zephyrproject.org>
2026-10-16 09:15:48 +02:00
Benjamin Cabé
d16decd3da drivers: input: crsf: depend on UART_ASYNC_API
The driver only uses the asynchronous UART API (uart_callback_set(),
uart_rx_enable()), not the interrupt-driven one, so with only
UART_INTERRUPT_DRIVEN enabled it built but failed to initialize.

Assisted-by: Claude:opus-5.5
Signed-off-by: Benjamin Cabé <benjamin@zephyrproject.org>
2026-10-16 09:15:48 +02:00
Tom Burdick
f2ba448d1d rtio: Update usage of rtio_sqe_cancel
Updates callers of rtio_sqe_cancel to use the newer opaque handle
version which takes into account the generational allocation of SQEs.
The validation of cancel is now safe in that each SQE being cancelled
must belong to the pool in struct rtio the caller has access to and
knows about. It must also be the correct generation of the SQE so that
recycled or freed SQEs are not incorrectly dereferenced with undefined
behavior.

Adds a coccinelle semantic patch to update callers both in and outside
the tree.

A migration guide was updated to include information about the API
change and the usage of the spatch to help out of tree applications
update to the new call semantics. The spatch likely won't fix all
callers but could save some time.

Assisted-by: claude:claude-opus-5 coccinelle
Signed-off-by: Tom Burdick <thomas.burdick@infineon.com>
2026-10-16 09:14:58 +02:00
Tom Burdick
76309bc679 rtio: Make rtio_sqe const friendly
Move several members of the struct out to the containing struct
(iodev_sqe) such that the internal rtio_sqe can be viewed as const data.

In making the containing struct const a few usages of this needed
updating to access the receive buffer through the helper
(rtio_sqe_rx_buf) rather than directly through struct members.

Assisted-by: claude:claude-opus-5 coccinelle
Signed-off-by: Tom Burdick <thomas.burdick@infineon.com>
2026-10-16 09:14:58 +02:00
Fin Maaß
5a507328ab drivers: timer: bound the arm reach under QEMU icount without sleep
QEMU's icount mode without sleep advances the virtual clock straight to
the next armed deadline whenever the guest idles, and its timer models
have no unarmed state: any comparator value is a deadline. With nothing
pending the kernel asks for SYS_CLOCK_MAX_WAIT ticks, 248 days at
100 Hz, and the comparator is armed that far out. A few hundred idle
periods then saturate QEMU's signed 64-bit nanosecond clock:
k_uptime_get() reports 9223372036850 ms and no timer fires again, so any
later timeout hangs the guest. A device model with a periodic timer,
such as the OHCI frame timer, spins inside QEMU trying to catch up and
the emulator stops responding altogether.

Before commit 742f7c3d22 ("drivers: timer: riscv_machine: use the
generic timer core") the 32-bit build clamped the reach to 2^32 cycles,
429 s at 10 MHz, which hid this on qemu_riscv32. The 64-bit build never
did, and qemu_riscv64 saturates its clock within seconds of idling with
either driver.

The condition is not specific to that driver. Every 64-bit compare
backend on the generic core is exposed the same way, and the others only
avoid it by board configuration: qemu_cortex_a53 enables
QEMU_ICOUNT_SLEEP, qemu_x86_64 disables icount, and qemu_x86 disables it
only when the shell is built in.

Fold a cap into the core's TIMER_CORE_MAX_ARM_CYCLES instead: one second
of the counter's own rate, applied when CONFIG_QEMU_ICOUNT is set
without CONFIG_QEMU_ICOUNT_SLEEP, which is the pair that actually
triggers the jump. An idle guest then costs one wakeup per virtual
second, which is nothing under emulation, and the clock needs days of
wall time to saturate. With icount off or sleeping, virtual time
advances on its own and the extra wakeup buys nothing, so the hardware
reach stands. TIMER_CORE_ALARM_MAX_CYCLES stays a pure hardware
statement, a driver's smaller arming range still wins through the
existing MIN, and every driver on the core gets the bound.

Reproduced with samples/subsys/shell/shell_module on qemu_riscv32 and
qemu_riscv64: `kernel uptime` reads 9223372036850 ms after a few seconds
of idle. With this change it keeps counting, and the USB host shell
sample on qemu_riscv32 enumerates its devices again instead of hanging
after `usbh enable`.

Assisted-by: Claude:claude-fable-5-1
Signed-off-by: Fin Maaß <f.maass@vogl-electronic.com>
2026-10-15 20:34:35 +02:00
Jordan Yates
bb0f4534b5 lora: native: fake LoRa driver
Implement a fake LoRa driver using FFF to enable validation of the LoRa
shell functionality.

Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Jordan Yates <jordan@embeint.com>
2026-10-15 16:45:49 +02:00
Raphaël Gallais-Pou
9e76d6be04 drivers: dma: dma_stm32: small change in comment
Default DMA_InitTypeDef structure is different according to the DMA
version used.  Reflect this in the comment of
dma_stm32_zcfg_to_halcfg().

While at it, fixes a field value.

Signed-off-by: Raphaël Gallais-Pou <raphael.gallais-pou@foss.st.com>
2026-10-15 16:43:00 +02:00
Sylvio Alves
c9822285b4 drivers: wifi: esp32: select psa pbkdf2 for mbedtls crypto
With ESP32_WIFI_MBEDTLS_CRYPTO the supplicant derives the WPA2
PMK through PSA PBKDF2-HMAC-SHA1, but the algorithm is never
enabled. The derivation fails and every WPA2-PSK connection is
rejected as a wrong password once enterprise or WPA3 support is
enabled. Select PSA_WANT_ALG_PBKDF2_HMAC.

Assisted-by: Claude:opus-5
Signed-off-by: Sylvio Alves <sylvio.alves@espressif.com>
2026-10-15 16:40:59 +02:00
Lezhi CHEN
b47ad0a1c4 fix: negative sensor value computing for rv3032 temperature sensor
The temperature register is a 12-bit two's complement value in
1/16 degC. The MSB was read as unsigned, so negative temperatures
were reported as 256 + T, and the fractional part was scaled by 625
instead of 62500.

Sign-extend the MSB via int8_t, combine both registers into a single
raw value and split it into val1/val2. Also print the thresholds as
signed in the trigger debug log and fix the negative low-temp value
in the MFD binding example.

Signed-off-by: Lezhi CHEN <lezhi.chen1998@outlook.com>
2026-10-15 16:39:54 +02:00