]> git.ipfire.org Git - thirdparty/kernel/linux.git/log
thirdparty/kernel/linux.git
8 weeks agoarm64: dts: freescale: add i.MX91 9x9 QSB basic support
Joy Zou [Thu, 26 Mar 2026 07:51:41 +0000 (15:51 +0800)] 
arm64: dts: freescale: add i.MX91 9x9 QSB basic support

Add i.MX91 9x9 Quick Start Board support.
- Enable ADC1.
- Enable lpuart1.
- Enable network eqos.
- Enable I2C bus and children nodes under I2C bus.
- Enable USB and related nodes.
- Enable uSDHC1 and uSDHC2.
- Enable Watchdog3.

The board description can refer to the following link:
https://www.nxp.com/design/design-center/development-boards-and-designs/IMX91QSB

Signed-off-by: Joy Zou <joy.zou@nxp.com>
Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
8 weeks agoarm64: dts: imx93-9x9-qsb: remove unused property clock-frequency from mdio node
Joy Zou [Thu, 26 Mar 2026 07:51:40 +0000 (15:51 +0800)] 
arm64: dts: imx93-9x9-qsb: remove unused property clock-frequency from mdio node

The clock-frequency property is not implemented. Remove it to clean up the
device tree.

Signed-off-by: Joy Zou <joy.zou@nxp.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
8 weeks agoarm64: dts: imx93-11x11-evk: remove unused property clock-frequency from mdio node
Joy Zou [Thu, 26 Mar 2026 07:51:39 +0000 (15:51 +0800)] 
arm64: dts: imx93-11x11-evk: remove unused property clock-frequency from mdio node

The clock-frequency property is not implemented. Remove it to clean up the
device tree.

Signed-off-by: Joy Zou <joy.zou@nxp.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
8 weeks agoarm64: dts: imx91-11x11-evk: remove unused property clock-frequency from mdio node
Joy Zou [Thu, 26 Mar 2026 07:51:38 +0000 (15:51 +0800)] 
arm64: dts: imx91-11x11-evk: remove unused property clock-frequency from mdio node

The clock-frequency property is not implemented. Remove it to clean up the
device tree.

Signed-off-by: Joy Zou <joy.zou@nxp.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
8 weeks agodt-bindings: arm: fsl: add i.MX91 9x9 QSB board
Joy Zou [Thu, 26 Mar 2026 07:51:37 +0000 (15:51 +0800)] 
dt-bindings: arm: fsl: add i.MX91 9x9 QSB board

Add compatible string for i.MX91 9x9 Quick Start Board.

Signed-off-by: Joy Zou <joy.zou@nxp.com>
Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
8 weeks agoMerge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma
Linus Torvalds [Tue, 5 May 2026 16:11:52 +0000 (09:11 -0700)] 
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma

Pull rdma fixes from Jason Gunthorpe:

 - Several error unwind misses on system calls in mlx5, mana, ocrdma,
   vmw_pvrdma, mlx4, and hns

 - More rxe bugs processing network packets

 - User triggerable races in mlx5 when destroying and creating the same
   same object when the FW returns the same object ID

 - Incorrect passing of an IPv6 address through netlink
   RDMA_NL_LS_OP_IP_RESOLVE

 - Add memory ordering for mlx5's lock avoidance pattenr

 - Protect mana from kernel memory overflow

 - Use safe patterns for xarray/radix_tree look up in mlx5 and hns

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (24 commits)
  RDMA/hns: Fix unlocked call to hns_roce_qp_remove()
  RDMA/hns: Fix xarray race in hns_roce_create_qp_common()
  RDMA/hns: Fix xarray race in hns_roce_create_srq()
  RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()
  RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq()
  RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path
  RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp()
  RDMA/ocrdma: Clarify the mm_head searching
  RDMA/mana: Fix error unwind in mana_ib_create_qp_rss()
  RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss()
  RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()
  RDMA/mana: Validate rx_hash_key_len
  RDMA/mlx5: Add missing store/release for lock elision pattern
  RDMA/mlx5: Restore zero-init to mlx5_ib_modify_qp() ucmd
  RDMA/ionic: Fix typo in format string
  RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation
  RDMA/core: Fix rereg_mr use-after-free race
  IB/core: Fix IPv6 netlink message size in ib_nl_ip_send_msg()
  RDMA/mlx5: Fix UAF in DCT destroy due to race with create
  RDMA/mlx5: Fix UAF in SRQ destroy due to race with create
  ...

8 weeks agoarm64: dts: socfpga: agilex3: set alias for i3c controller
Adrian Ng Ho Yin [Tue, 5 May 2026 05:15:17 +0000 (13:15 +0800)] 
arm64: dts: socfpga: agilex3: set alias for i3c controller

Agilex3 SoCFPGA have 2 i3c controllers, a main master and a secondary
master. Setting the alias for both i3c controllers to prevent bus id
contention when both controllers are enabled which results in driver
probe failures.

Signed-off-by: Adrian Ng Ho Yin <adrian.ho.yin.ng@altera.com>
Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
8 weeks agoarm64: dts: socfpga: agilex5: set alias for i3c controllers
Adrian Ng Ho Yin [Tue, 5 May 2026 05:15:16 +0000 (13:15 +0800)] 
arm64: dts: socfpga: agilex5: set alias for i3c controllers

Agilex5 SoCFPGA variants and derivatives have 2 i3c controllers, a main
master and a secondary master. Setting the alias for both i3c controllers
to prevent bus id contention when both controllers are enabled which
results in driver probe failures.

Signed-off-by: Adrian Ng Ho Yin <adrian.ho.yin.ng@altera.com>
Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
8 weeks agowifi: mac80211: use safe list iteration in radar detect work
Benjamin Berg [Tue, 5 May 2026 13:15:40 +0000 (15:15 +0200)] 
wifi: mac80211: use safe list iteration in radar detect work

The call to ieee80211_dfs_cac_cancel can cause the iterated chanctx to
be freed and removed from the list. Guard against this to avoid a
slab-use-after-free error.

Cc: stable@vger.kernel.org
Fixes: bca8bc0399ac ("wifi: mac80211: handle ieee80211_radar_detected() for MLO")
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Link: https://patch.msgid.link/20260505151539.236d63a1b736.I35dbb9e96a2d4a480be208770fdd99ba3b817b79@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
8 weeks agodt-bindings: drop tab characters from DTS examples
Daniel Golle [Wed, 29 Apr 2026 03:48:56 +0000 (04:48 +0100)] 
dt-bindings: drop tab characters from DTS examples

YAML literal block scalars cannot use tabs for indent.
Replace tab separators (mostly between values and trailing /* ... */
comments) with single spaces.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Link: https://patch.msgid.link/2044ee0cac191c7be8b6e989fc3c99b24aa4cc5e.1777434096.git.daniel@makrotopia.org
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
8 weeks agoMerge tag 'ath-current-20260505' of git://git.kernel.org/pub/scm/linux/kernel/git...
Johannes Berg [Tue, 5 May 2026 15:52:32 +0000 (17:52 +0200)] 
Merge tag 'ath-current-20260505' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath

Jeff Johnson says:
==================
ath.git update for v7.1-rc3

Fix an ath5k potential stack buffer overwrite.
Fix several issues in ath12k:
- WMI buffer leaks on error conditions
- use of uninitialized stack data when processing RSSI events
- incorrect logic for determining the peer ID in the RX path
==================

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
8 weeks agodt-bindings: misc: fsl,qoriq-mc: drop trailing whitespace
Daniel Golle [Wed, 29 Apr 2026 03:48:38 +0000 (04:48 +0100)] 
dt-bindings: misc: fsl,qoriq-mc: drop trailing whitespace

Drop trailing whitespace from example.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Link: https://patch.msgid.link/20fb6993052534958ca57b537204de6c5617215a.1777434096.git.daniel@makrotopia.org
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
8 weeks agoMerge tag 'media/v7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab...
Linus Torvalds [Tue, 5 May 2026 15:45:41 +0000 (08:45 -0700)] 
Merge tag 'media/v7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

Pull media fixes from Mauro Carvalho Chehab:

 - rc: ttusbir: fix inverted error logic

 - Venus/Iris fixes:
      - Kconfig cross compile build testing for x86
      - Use-after-free fix for internal buffers
      - dma_free_attrs size fix
      - Switch to hardware mode clocks
      - Use-after-free fix for a concurrency path
      - Fix H265D_MAX_SLICE size for sc7280 devices

 - camoss: fix some clock-related issues

* tag 'media/v7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
  media: qcom: camss: avoid format string warning
  media: qcom: camss: Add missing clocks for VFE lite on sa8775p
  media: qcom: camss: Fix csid clock configuration for sa8775p
  media: qcom: camss: Fix csid IRQ offset for sa8775p
  media: qcom: iris: increase H265D_MAX_SLICE to fix H.265 decoding on SC7280
  media: iris: fix use-after-free of fmt_src during MBPF check
  media: iris: switch to hardware mode after firmware boot
  media: iris: Fix dma_free_attrs() size in iris_hfi_queues_init()
  media: iris: Fix use-after-free in iris_release_internal_buffers()
  media: iris: fix QCOM_MDT_LOADER dependency
  media: venus: fix QCOM_MDT_LOADER dependency

8 weeks agofirmware: arm_ffa: Fix sched-recv callback partition lookup
Sudeep Holla [Tue, 28 Apr 2026 18:33:35 +0000 (19:33 +0100)] 
firmware: arm_ffa: Fix sched-recv callback partition lookup

ffa_sched_recv_cb_update() used list_for_each_entry_safe() to search for
a matching partition and then tested the iterator against NULL. That is
not a valid end-of-list check for circular lists and can fall through
with an invalid pointer. Use a normal iterator and detect the not-found
case correctly before touching the partition state.

Fixes: be61da938576 ("firmware: arm_ffa: Allow multiple UUIDs per partition to register SRI callback")
Link: https://patch.msgid.link/20260428-ffa_fixes-v2-11-8595ae450034@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
8 weeks agofirmware: arm_ffa: Snapshot notifier callbacks under lock
Sudeep Holla [Tue, 28 Apr 2026 18:33:34 +0000 (19:33 +0100)] 
firmware: arm_ffa: Snapshot notifier callbacks under lock

Both notification handlers currently look up a notifier callback under
notify_lock, drop the lock, and then dereference the returned
notifier entry. A concurrent unregister can delete and free that
entry in the gap, leaving the handler to dereference stale memory.

Copy the callback pointer and callback data while notify_lock is
still held and invoke the callback only after the lock is dropped.
This keeps the existing callback execution model while removing the
use-after-free window in both the framework and non-framework
notification paths.

Fixes: 285a5ea0f542 ("firmware: arm_ffa: Add support for handling framework notifications")
Link: https://patch.msgid.link/20260428-ffa_fixes-v2-10-8595ae450034@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
8 weeks agofirmware: arm_ffa: Align RxTx buffer size before mapping
Sudeep Holla [Tue, 28 Apr 2026 18:33:33 +0000 (19:33 +0100)] 
firmware: arm_ffa: Align RxTx buffer size before mapping

Commit 83210251fd70 ("firmware: arm_ffa: Use the correct buffer size during
RXTX_MAP") advertises PAGE_ALIGN(rxtx_bufsz) to firmware when mapping the
buffers but the driver continues to stores the minimum FF-A buffer size
in drv_info->rxtx_bufsz which is used elsewhere in the driver.

Align the size before storing it so that the allocation, validation and
FFA_RXTX_MAP all use the same buffer size.

Fixes: 83210251fd70 ("firmware: arm_ffa: Use the correct buffer size during RXTX_MAP")
Cc: Sebastian Ene <sebastianene@google.com>
Link: https://sashiko.dev/#/patchset/20260402113939.930221-1-sebastianene@google.com
Reviewed-by: Sebastian Ene <sebastianene@google.com>
Link: https://patch.msgid.link/20260428-ffa_fixes-v2-9-8595ae450034@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
8 weeks agofirmware: arm_ffa: Validate framework notification message layout
Sudeep Holla [Tue, 28 Apr 2026 18:33:32 +0000 (19:33 +0100)] 
firmware: arm_ffa: Validate framework notification message layout

Framework notifications carry an indirect message in the shared RX
buffer. Validate the reported offset and size before using them, reject
zero-length payloads, and ensure that any non-header payload starts at
the UUID field rather than in the middle of the message header.

Use the validated offset and size values for both kmemdup() and the UUID
parsing path so malformed firmware data cannot drive an out-of-bounds
read or an oversized allocation.

Fixes: 285a5ea0f542 ("firmware: arm_ffa: Add support for handling framework notifications")
Link: https://patch.msgid.link/20260428-ffa_fixes-v2-8-8595ae450034@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
8 weeks agofirmware: arm_ffa: Keep framework RX release under lock
Sudeep Holla [Tue, 28 Apr 2026 18:33:31 +0000 (19:33 +0100)] 
firmware: arm_ffa: Keep framework RX release under lock

The framework notification handler drops rx_lock before issuing
FFA_RX_RELEASE, leaving a window where another RX-buffer user can
start a new FF-A transaction before ownership has actually been
returned to firmware.

Move the FFA_RX_RELEASE calls so they execute while rx_lock is still
held on both the kmemdup() failure path and the normal success path.
While doing that, switch the handler to scoped_guard() to keep the
critical section explicit.

Fixes: 285a5ea0f542 ("firmware: arm_ffa: Add support for handling framework notifications")
Link: https://patch.msgid.link/20260428-ffa_fixes-v2-7-8595ae450034@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
8 weeks agofirmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies
Sudeep Holla [Tue, 28 Apr 2026 18:33:30 +0000 (19:33 +0100)] 
firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies

The register-based PARTITION_INFO_GET path trusted the firmware-provided
indices when copying partition descriptors into the caller buffer.
Reject inconsistent counts or index progressions so the copy loop cannot
write past the allocated array.

Fixes: ba85c644ac8d ("firmware: arm_ffa: Add support for FFA_PARTITION_INFO_GET_REGS")
Link: https://patch.msgid.link/20260428-ffa_fixes-v2-6-8595ae450034@kernel.org
(fixed cur_idx when exactly one descriptor in the first fragment)
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
8 weeks agodocs: dt: writing-bindings: Extend compatible fallbacks guideline
Krzysztof Kozlowski [Mon, 27 Apr 2026 16:07:40 +0000 (18:07 +0200)] 
docs: dt: writing-bindings: Extend compatible fallbacks guideline

Extend the guidelines when to use fallback compatibles to cover to
common review responses.  Devices are most likely compatible and should
use fallbacks when having:

1. Compatible programming interface, meaning one is a subset, and Linux
   device drivers can use the subset to correctly match/bind and still
   operate with the subset features.

2. Device variant discovery through some means, like registers.

Devices are incompatible and fallback is not suitable when that
fallback cannot be used by the drivers to match/bind.  In the same time
commit message should clearly explain when the code suggests devices
are compatible, but the binding does not define them as such.

Acked-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Link: https://patch.msgid.link/20260427160739.175451-2-krzysztof.kozlowski@oss.qualcomm.com
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
8 weeks agoof/fdt: remove redundant memset in __unflatten_device_tree()
Sang-Heon Jeon [Sat, 18 Apr 2026 14:04:20 +0000 (23:04 +0900)] 
of/fdt: remove redundant memset in __unflatten_device_tree()

Now that memblock and slab allocators are the only allocators and both
return zero-initialized memory, zeroing the memory ourselves is
redundant. The allocators used are:

- kernel_tree_alloc uses kzalloc()
- early_init_dt_alloc_memory_arch() and dt_alloc_memory() both use
  memblock_alloc()

Remove redundant memset after the allocation. No funtional change.

Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com>
Link: https://patch.msgid.link/20260418140420.2221736-1-ekffu200098@gmail.com
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
8 weeks agodt-bindings: Remove the redundant 'type: boolean'
bui duc phuc [Fri, 17 Apr 2026 02:18:58 +0000 (09:18 +0700)] 
dt-bindings: Remove the redundant 'type: boolean'

The 'wakeup-source' property already has its type defined in the core
schema. Remove the redundant 'type: boolean' from the binding file to
clean up the binding files.

Signed-off-by: bui duc phuc <phucduc.bui@gmail.com>
Link: https://patch.msgid.link/20260417021858.6582-1-phucduc.bui@gmail.com
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
8 weeks agodt-bindings: sram: Document qcom,eliza-imem
Alexander Koskovich [Sat, 18 Apr 2026 10:39:52 +0000 (10:39 +0000)] 
dt-bindings: sram: Document qcom,eliza-imem

Add compatible for Eliza SoC IMEM.

Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Alexander Koskovich <akoskovich@pm.me>
Link: https://patch.msgid.link/20260418-eliza-imem-v3-2-bfbd499b6e77@pm.me
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
8 weeks agodt-bindings: display: bridge: ssd2825: inherit dsi-controller properties
Svyatoslav Ryhel [Fri, 17 Apr 2026 06:46:57 +0000 (09:46 +0300)] 
dt-bindings: display: bridge: ssd2825: inherit dsi-controller properties

SSD2825 being RGB-DSI bridge should inherit dsi-controller properties same
way other DSI controllers and DSI bridges do.

Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Link: https://patch.msgid.link/20260417064657.20293-2-clamor95@gmail.com
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
8 weeks agoaccel/amdxdna: Add carveout memory support for non-IOMMU systems
Max Zhen [Mon, 27 Apr 2026 17:09:49 +0000 (10:09 -0700)] 
accel/amdxdna: Add carveout memory support for non-IOMMU systems

Add support for allocating buffers from reserved carveout memory when
IOMMU is not available. This is useful during debugging or bring-up.

In this configuration, the device uses physical addresses and does
not support scatter-gather lists, requiring physically contiguous
buffers.

Implement carveout-backed allocation and integrate it into buffer
management to support operation in physical address mode.

Signed-off-by: Max Zhen <max.zhen@amd.com>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20260427170949.2666601-1-lizhi.hou@amd.com
8 weeks agomedia: stm32: dcmi: unregister notifier on probe failure
Myeonghun Pak [Sun, 26 Apr 2026 12:43:49 +0000 (21:43 +0900)] 
media: stm32: dcmi: unregister notifier on probe failure

dcmi_graph_init() registers the async notifier before dcmi_probe() toggles
the reset line. If reset_control_assert() or reset_control_deassert()
fails afterwards, probe returns through err_cleanup and the driver core
will not call dcmi_remove().

Unregister the notifier before cleaning it up on that error path,
matching the successful remove path and the V4L2 async notifier lifetime
rules.

Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Fixes: d079f94c9046 ("media: platform: Switch to v4l2_async_notifier_add_subdev")
Cc: stable@vger.kernel.org
[hverkuil: added Fixes tag]

8 weeks agomedia: i2c: drop unneeded dependencies on OF_GPIO
Bartosz Golaszewski [Thu, 30 Apr 2026 13:03:36 +0000 (15:03 +0200)] 
media: i2c: drop unneeded dependencies on OF_GPIO

OF_GPIO is selected automatically on all OF systems. Any symbols it
controls also provide stubs so there's really no reason to select it
explicitly. For Kconfig entries that have no other dependencies: convert
it to requiring OF to avoid new symbols popping up for everyone in make
config, for others just drop it altogether.

Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
8 weeks agostaging: media: av7110: fix typo in av7110.c
Maha Maryam Javaid [Wed, 29 Apr 2026 17:37:51 +0000 (13:37 -0400)] 
staging: media: av7110: fix typo in av7110.c

Fix spelling mistake: connectd -> connected

Signed-off-by: Maha Maryam Javaid <mahamaryamjavaid@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
8 weeks agomedia: pci: dm1105: Free allocated workqueue
Krzysztof Kozlowski [Tue, 28 Apr 2026 14:50:08 +0000 (16:50 +0200)] 
media: pci: dm1105: Free allocated workqueue

Destroy allocated workqueue in remove() callback to free its resources,
thus fixing memory leak.

Fixes: 519a4bdcf822 ("V4L/DVB (11984): Add support for yet another SDMC DM1105 based DVB-S card.")
Cc: <stable@vger.kernel.org>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
8 weeks agomedia: ti: vpe: unwind v4l2 device registration on probe error
Myeonghun Pak [Sun, 26 Apr 2026 13:16:31 +0000 (22:16 +0900)] 
media: ti: vpe: unwind v4l2 device registration on probe error

If the vpe_top resource is missing, vpe_probe() returns -ENODEV after
v4l2_device_register() has succeeded. Probe failures do not call the
driver's remove callback, so the v4l2 device remains registered on that
error path.

Route that failure through the existing v4l2_device_unregister() unwind
label, matching the other errors after v4l2_device_register().

Fixes: 4d59c7d45585 ("media: ti-vpe: vpe: Add missing null pointer checks")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Reviewed-by: Yemike Abhilash Chandra <y-abhilashchandra@ti.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
8 weeks agomedia: gspca: Fix comment in sd_init()
Philipp Matthias Hahn [Mon, 20 Apr 2026 13:54:43 +0000 (15:54 +0200)] 
media: gspca: Fix comment in sd_init()

Fix spelling mistake of{ -> f}.

Signed-off-by: Philipp Matthias Hahn <pmhahn@pmhahn.de>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
8 weeks agomedia: marvell-cam: fix missing pci_disable_device() on remove
Guangshuo Li [Fri, 17 Apr 2026 06:53:30 +0000 (14:53 +0800)] 
media: marvell-cam: fix missing pci_disable_device() on remove

During manual code audit, we found that cafe_pci_probe() enables the
PCI device with pci_enable_device(), and its probe error path properly
calls pci_disable_device() on failure.

However, cafe_pci_remove() tears down the controller and frees the
driver data without disabling the PCI device, leaving the remove path
inconsistent with probe cleanup.

Add the missing pci_disable_device() call to cafe_pci_remove().

Fixes: abfa3df36c01 ("[media] marvell-cam: Separate out the Marvell camera core")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
8 weeks agomedia: vivid: fix cleanup bugs in vivid_init()
Guangshuo Li [Wed, 15 Apr 2026 16:20:58 +0000 (00:20 +0800)] 
media: vivid: fix cleanup bugs in vivid_init()

When platform_device_register() fails in vivid_init(), the embedded
struct device in vivid_pdev has already been initialized by
device_initialize(), but the failure path jumps to free_output_strings
without dropping the device reference for the current platform device:

  vivid_init()
    -> platform_device_register(&vivid_pdev)
       -> device_initialize(&vivid_pdev.dev)
       -> setup_pdev_dma_masks(&vivid_pdev)
       -> platform_device_add(&vivid_pdev)

This leads to a reference leak when platform_device_register() fails.
Fix this by calling platform_device_put() before jumping to the common
cleanup path.

Also, the unreg_driver label incorrectly calls
platform_driver_register() instead of platform_driver_unregister(),
which breaks cleanup when workqueue creation fails after successful
driver registration. Fix that as well.

The reference leak was identified by a static analysis tool I developed
and confirmed by manual review. The incorrect cleanup call was found
during code inspection.

Fixes: f46d740fb0258 ("[media] vivid: turn this into a platform_device")
Fixes: d7c969f37515d ("media: vivid: Add 'Is Connected To' menu controls")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
8 weeks agomedia: vimc: fix reference leak on failed device registration
Guangshuo Li [Wed, 15 Apr 2026 15:45:37 +0000 (23:45 +0800)] 
media: vimc: fix reference leak on failed device registration

When platform_device_register() fails in vimc_init(), the embedded
struct device in vimc_pdev has already been initialized by
device_initialize(), but the failure path returns the error without
dropping the device reference for the current platform device:

  vimc_init()
    -> platform_device_register(&vimc_pdev)
       -> device_initialize(&vimc_pdev.dev)
       -> setup_pdev_dma_masks(&vimc_pdev)
       -> platform_device_add(&vimc_pdev)

This leads to a reference leak when platform_device_register() fails.
Fix this by calling platform_device_put() before returning the error.

The issue was identified by a static analysis tool I developed and
confirmed by manual review.

Fixes: 4babf057c143f ("media: vimc: allocate vimc_device dynamically")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
8 weeks agomedia: vidtv: fix reference leak on failed device registration
Guangshuo Li [Wed, 15 Apr 2026 15:28:26 +0000 (23:28 +0800)] 
media: vidtv: fix reference leak on failed device registration

When platform_device_register() fails in vidtv_bridge_init(), the
embedded struct device in vidtv_bridge_dev has already been initialized
by device_initialize(), but the failure path returns the error without
dropping the device reference for the current platform device:

  vidtv_bridge_init()
    -> platform_device_register(&vidtv_bridge_dev)
       -> device_initialize(&vidtv_bridge_dev.dev)
       -> setup_pdev_dma_masks(&vidtv_bridge_dev)
       -> platform_device_add(&vidtv_bridge_dev)

This leads to a reference leak when platform_device_register() fails.
Fix this by calling platform_device_put() before returning the error.

The issue was identified by a static analysis tool I developed and
confirmed by manual review.

Fixes: f90cf6079bf67 ("media: vidtv: add a bridge driver")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
8 weeks agomedia: dm1105: fix missing error check for dma_alloc_coherent
Zhaoyang Yu [Wed, 15 Apr 2026 14:49:09 +0000 (14:49 +0000)] 
media: dm1105: fix missing error check for dma_alloc_coherent

The return value of dm1105_dma_map(), which handles DMA memory allocation,
is ignored in dm1105_hw_init(). If dma_alloc_coherent() fails, the driver
will proceed using a NULL pointer for DMA transfers, leading to a kernel
oops or invalid hardware access.

Fix this by checking the return value and propagating -ENOMEM on failure.

Signed-off-by: Zhaoyang Yu <2426767509@qq.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
8 weeks agostaging: media: av7110: remove dead code from av7110_hw.c
Josh Hesketh [Fri, 10 Apr 2026 15:25:02 +0000 (16:25 +0100)] 
staging: media: av7110: remove dead code from av7110_hw.c

Remove functions av7110_reset_arm() and av7110_send_ci_cmd()
which have both been disabled behind #if 0 since the introduction
to staging. Code can be recovered from git history.

Signed-off-by: Josh Hesketh <josh.hesketh@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
8 weeks agomedia: vpif_capture: fix OF node reference imbalance
Johan Hovold [Tue, 7 Apr 2026 10:08:31 +0000 (12:08 +0200)] 
media: vpif_capture: fix OF node reference imbalance

The driver reuses the OF node of the parent device but fails to take
another reference to balance the one dropped by the platform bus code
when unbinding the parent and releasing the child devices.

Fix this by using the intended helper for reusing OF nodes.

Fixes: 4a5f8ae50b66 ("[media] davinci: vpif_capture: get subdevs from DT when available")
Cc: stable@vger.kernel.org # 4.13
Cc: Kevin Hilman <khilman@baylibre.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
8 weeks agomedia: s2255: refactor endpoint lookup
Johan Hovold [Mon, 30 Mar 2026 10:11:41 +0000 (12:11 +0200)] 
media: s2255: refactor endpoint lookup

Use the common USB helper for looking up bulk-in endpoints instead of
open coding.

Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
8 weeks agomedia: hdpvr: refactor endpoint lookup
Johan Hovold [Mon, 30 Mar 2026 10:11:40 +0000 (12:11 +0200)] 
media: hdpvr: refactor endpoint lookup

Use the common USB helper for looking up bulk-in endpoints instead of
open coding.

Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
8 weeks agomedia: gspca: refactor endpoint lookup
Johan Hovold [Mon, 30 Mar 2026 10:11:39 +0000 (12:11 +0200)] 
media: gspca: refactor endpoint lookup

Use the common USB helper for looking up interrupt-in endpoints instead
of open coding.

Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
8 weeks agomedia: si470x-usb: refactor endpoint lookup
Johan Hovold [Mon, 30 Mar 2026 10:11:36 +0000 (12:11 +0200)] 
media: si470x-usb: refactor endpoint lookup

Use the common USB helper for looking up interrupt-in endpoints instead
of open coding.

Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
8 weeks agomedia: dead code cleanup in kconfig for VIDEO_SOLO6X10
Julian Braha [Sun, 29 Mar 2026 18:39:42 +0000 (19:39 +0100)] 
media: dead code cleanup in kconfig for VIDEO_SOLO6X10

The same kconfig 'select FONT_8x16' appears twice for VIDEO_SOLO6X10.
I propose removing the second instance, as it is effectively dead code.

This dead code was found by kconfirm, a static analysis tool for Kconfig.

Signed-off-by: Julian Braha <julianbraha@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
8 weeks agomedia: nuvoton: npcm-video: fix memory leaks in probe and remove
David Carlier [Sat, 28 Mar 2026 18:18:09 +0000 (18:18 +0000)] 
media: nuvoton: npcm-video: fix memory leaks in probe and remove

npcm_video_probe() allocates the npcm_video structure with kzalloc_obj()
but never frees it on any probe error path or in npcm_video_remove(),
leaking the allocation on every failed probe and every normal unbind.

Additionally, when npcm_video_setup_video() fails, the reserved memory
association established by of_reserved_mem_device_init() in
npcm_video_init() is not released, leaking the rmem_assigned_device
entry on the global list.

Fix both by adding kfree(video) to all probe error paths and to
npcm_video_remove(), and adding the missing
of_reserved_mem_device_release() call when npcm_video_setup_video()
fails.

Fixes: 46c15a4ff1f4 ("media: nuvoton: Add driver for NPCM video capture and encoding engine")
Cc: stable@vger.kernel.org
Signed-off-by: David Carlier <devnexen@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
8 weeks agomedia: nuvoton: npcm-video: fix error handling in npcm_video_init()
David Carlier [Sat, 28 Mar 2026 18:17:49 +0000 (18:17 +0000)] 
media: nuvoton: npcm-video: fix error handling in npcm_video_init()

npcm_video_init() has two error handling issues after
of_reserved_mem_device_init() is called:

When dma_set_mask_and_coherent() fails, the function releases the
reserved memory but does not return, allowing execution to fall through
into npcm_video_ece_init() with a failed DMA configuration.

When npcm_video_ece_init() fails, the function returns an error without
calling of_reserved_mem_device_release(), leaking the reserved memory
association.

Fix both by adding the missing return after the DMA mask failure and
adding the missing of_reserved_mem_device_release() call on the ECE init
error path.

Fixes: 46c15a4ff1f4 ("media: nuvoton: Add driver for NPCM video capture and encoding engine")
Cc: stable@vger.kernel.org
Signed-off-by: David Carlier <devnexen@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
8 weeks agostaging: media: av7110: fix coding style
Chethan C [Sat, 28 Mar 2026 16:50:34 +0000 (22:20 +0530)] 
staging: media: av7110: fix coding style

Fix indentation and alignment issues reported by checkpatch.pl.

Rename enums av7110_rec_play_state, av7110_type_rec_play_format,
and av7110_encoder_command to follow kernel naming style.

Rename wssData and wssMode to wss_data and wss_mode to avoid
camelCase identifiers.

Signed-off-by: Chethan C <mail.chethanc@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
8 weeks agomedia: aspeed: fix missing of_reserved_mem_device_release() on probe failure
David Carlier [Sat, 28 Mar 2026 11:23:30 +0000 (11:23 +0000)] 
media: aspeed: fix missing of_reserved_mem_device_release() on probe failure

aspeed_video_init() calls of_reserved_mem_device_init() to associate
reserved memory regions with the device. When aspeed_video_setup_video()
subsequently fails in aspeed_video_probe(), the error path frees the
JPEG buffer and unprepares the clocks but does not release the reserved
memory association, leaking the rmem_assigned_device entry on the global
list.

The normal remove path already calls of_reserved_mem_device_release()
correctly; only the probe error path was missing it.

Add the missing of_reserved_mem_device_release() call to the
aspeed_video_setup_video() failure cleanup.

Fixes: d2b4387f3bdf ("media: platform: Add Aspeed Video Engine driver")
Cc: stable@vger.kernel.org
Signed-off-by: David Carlier <devnexen@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
8 weeks agomedia: synopsys: hdmirx: Fix HPD lane hold time
Dmitry Osipenko [Wed, 25 Mar 2026 10:57:42 +0000 (13:57 +0300)] 
media: synopsys: hdmirx: Fix HPD lane hold time

Increase time of holding HPD lane low by 50ms. This fixes EDID change not
detected by source/display side.

Fixes: 7b59b132ad43 ("media: platform: synopsys: Add support for HDMI input driver")
Cc: stable@vger.kernel.org
Reported-by: Ross Cawston <ross@r-sc.ca>
Closes: https://lore.kernel.org/linux-rockchip/20260209061654.54757-1-ross@r-sc.ca/
Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
8 weeks agostaging: media: av7110: remove print_time() dead code
Tomasz Unger [Fri, 20 Mar 2026 10:07:37 +0000 (11:07 +0100)] 
staging: media: av7110: remove print_time() dead code

The DEBUG_TIMING macro is commented out and can never be defined,
making the print_time() function body always empty. Remove the
commented-out macro, the unused function definition and all its
call sites as they serve no purpose.

Signed-off-by: Tomasz Unger <tomasz.unger@yahoo.pl>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
8 weeks agostaging: media: av7110: remove dead code in av7110.c
Tomasz Unger [Fri, 20 Mar 2026 07:31:54 +0000 (08:31 +0100)] 
staging: media: av7110: remove dead code in av7110.c

Remove commented-out line of dead code that serves no purpose.

Signed-off-by: Tomasz Unger <tomasz.unger@yahoo.pl>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
8 weeks agomedia: ti: vpe: Fix the error code of devm_kzalloc() in vip_probe_slice()
Felix Gu [Tue, 17 Mar 2026 17:21:55 +0000 (01:21 +0800)] 
media: ti: vpe: Fix the error code of devm_kzalloc() in vip_probe_slice()

In vip_probe_slice(), the error check for devm_kzalloc() incorrectly
uses PTR_ERR_OR_ZERO() which returns 0 for NULL pointer.

Return -ENOMEM for devm_kzalloc() failure.

Fixes: fc2873aa4a21 ("media: ti: vpe: Add the VIP driver")
Cc: stable@vger.kernel.org
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
8 weeks agomedia: ti: vpe: Fix the error code of devm_request_irq()
Felix Gu [Tue, 17 Mar 2026 17:21:54 +0000 (01:21 +0800)] 
media: ti: vpe: Fix the error code of devm_request_irq()

Return the actual error code from devm_request_irq() instead of
incorrectly returning -ENOMEM.

Fixes: fc2873aa4a21 ("media: ti: vpe: Add the VIP driver")
Cc: stable@vger.kernel.org
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
8 weeks agomedia: ti: vpe: Fix fwnode_handle leak in vip_probe_complete()
Felix Gu [Tue, 17 Mar 2026 17:21:53 +0000 (01:21 +0800)] 
media: ti: vpe: Fix fwnode_handle leak in vip_probe_complete()

In vip_probe_complete(), the fwnode_handle reference is not released
if the loop continues via the default switch case or if alloc_port()
fails. This results in a reference count leak.

Switch to using the __free(fwnode_handle) cleanup attribute to ensure
the reference is automatically released when the handle goes out of
scope.

Fixes: fc2873aa4a21 ("media: ti: vpe: Add the VIP driver")
Cc: stable@vger.kernel.org
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
8 weeks agomedia: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
Ruslan Valiyev [Tue, 17 Mar 2026 17:05:44 +0000 (17:05 +0000)] 
media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si

syzbot reported a general protection fault in
vidtv_psi_ts_psi_write_into [1].

vidtv_mux_get_pid_ctx() can return NULL, but vidtv_mux_push_si() does
not check for this before dereferencing the returned pointer to access
the continuity counter. This leads to a general protection fault when
accessing a near-NULL address.

The root cause is that vidtv_mux_pid_ctx_init() does not check the
return value of vidtv_mux_create_pid_ctx_once() for PMT section PIDs.
If the allocation fails, the PID context is never created, but init
returns success. The subsequent vidtv_mux_push_si() call then gets
NULL from vidtv_mux_get_pid_ctx() and crashes.

Fix both the root cause (add error check in vidtv_mux_pid_ctx_init
for PMT PIDs) and add defensive NULL checks in vidtv_mux_push_si for
all vidtv_mux_get_pid_ctx() calls.

[1]
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
Workqueue: events vidtv_mux_tick
RIP: 0010:vidtv_psi_ts_psi_write_into+0x54a/0xbc0 drivers/media/test-drivers/vidtv/vidtv_psi.c:197
Call Trace:
 <TASK>
 vidtv_psi_table_header_write_into drivers/media/test-drivers/vidtv/vidtv_psi.c:799 [inline]
 vidtv_psi_pmt_write_into+0x3b2/0xa70 drivers/media/test-drivers/vidtv/vidtv_psi.c:1231
 vidtv_mux_push_si+0x932/0xe80 drivers/media/test-drivers/vidtv/vidtv_mux.c:196
 vidtv_mux_tick+0xe9b/0x1480 drivers/media/test-drivers/vidtv/vidtv_mux.c:408

Fixes: f90cf6079bf67 ("media: vidtv: add a bridge driver")
Cc: stable@vger.kernel.org
Reported-by: syzbot+814c351d094f4f1a1b86@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=814c351d094f4f1a1b86
Signed-off-by: Ruslan Valiyev <linuxoid@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
8 weeks agoarm64: dts: marvell: samsung-coreprimevelte: Add missing SDIO properties
Duje Mihanović [Thu, 9 Apr 2026 21:17:27 +0000 (23:17 +0200)] 
arm64: dts: marvell: samsung-coreprimevelte: Add missing SDIO properties

According to the vendor device tree, the WiFi+BT card must not be
powered off during suspend and is capable of waking up the board. Add
the respective properties to the SDIO node to reflect this.

Signed-off-by: Duje Mihanović <duje@dujemihanovic.xyz>
8 weeks agoarm64: dts: marvell: pxa1908: Add PSCI function IDs
Duje Mihanović [Thu, 9 Apr 2026 21:17:26 +0000 (23:17 +0200)] 
arm64: dts: marvell: pxa1908: Add PSCI function IDs

Add function IDs for CPU_ON and CPU_OFF from vendor kernel source. This
is done for completeness and to allow PSCI to work on the occasion that
the DT is used with an ancient kernel.

Signed-off-by: Duje Mihanović <duje@dujemihanovic.xyz>
8 weeks agoarm64: dts: marvell: samsung,coreprimevelte: Use memory-region for framebuffer
Duje Mihanović [Thu, 9 Apr 2026 21:17:25 +0000 (23:17 +0200)] 
arm64: dts: marvell: samsung,coreprimevelte: Use memory-region for framebuffer

Since the framebuffer resides in system RAM, use the memory-region
property preferred in that case over reg.

Also, testing showed that reusing most of the region (excluding where
the actual framebuffer resides) is perfectly safe, so do that and save
~22.5 MiB of RAM in the process.

Signed-off-by: Duje Mihanović <duje@dujemihanovic.xyz>
8 weeks agoarm64: dts: marvell: samsung-coreprimevelte: Increase touchscreen voltage
Duje Mihanović [Thu, 9 Apr 2026 21:17:24 +0000 (23:17 +0200)] 
arm64: dts: marvell: samsung-coreprimevelte: Increase touchscreen voltage

The old 1.9V setting was found to be insufficient in certain
environments (in my case cold ones), causing the touchscreen to register
ghost touches and mostly ignore actual touches. Increase the voltage to
2.5V to correct the issue.

Fixes: ec958b5b18c8 ("arm64: dts: samsung,coreprimevelte: add touchscreen")
Acked-by: Karel Balej <balejk@matfyz.cz>
Signed-off-by: Duje Mihanović <duje@dujemihanovic.xyz>
8 weeks agodrm/exynos: remove bridge when component_add fails
Osama Abdelkader [Thu, 23 Apr 2026 20:06:20 +0000 (22:06 +0200)] 
drm/exynos: remove bridge when component_add fails

Use devm_drm_bridge_add() so the bridge is released if probe fails after
registration, and drop the manual drm_bridge_remove() in remove().

Check the return value of devm_drm_bridge_add().

Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com>
Fixes: 576d72fbfb45 ("drm/exynos: mic: add a bridge at probe")
Cc: stable@vger.kernel.org
Reviewed-by: Raphaël Gallais-Pou <rgallaispou@gmail.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Link: https://patch.msgid.link/20260423200622.325076-2-osama.abdelkader@gmail.com
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
8 weeks agofirmware: arm_scmi: Convert to list_for_each_entry()
Geert Uytterhoeven [Fri, 3 Apr 2026 08:41:31 +0000 (10:41 +0200)] 
firmware: arm_scmi: Convert to list_for_each_entry()

Simplify the loop in scmi_handle_get() by using list_for_each_entry().

Suggested-by: Marek Vasut <marek.vasut@mailbox.org>
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/bccbd4a64ef4619afd5454e9e533073b00aeaba6.1775205358.git.geert+renesas@glider.be
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
8 weeks agofirmware: arm_scmi: quirk: Simplify quirk table iteration
Geert Uytterhoeven [Fri, 3 Apr 2026 08:41:30 +0000 (10:41 +0200)] 
firmware: arm_scmi: quirk: Simplify quirk table iteration

The current table entry is assigned in both the init and loop
expressions of the for-statement.  Merge this into a single assignment
in the conditional expression, to simplify the code.

While at it, make the loop counter unsigned and loop-local.

Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/8577f4b103cf04420c3b67dcaad528daff867287.1775205358.git.geert+renesas@glider.be
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
8 weeks agofirmware: arm_scmi: quirk: Improve quirk range parsing
Geert Uytterhoeven [Fri, 3 Apr 2026 08:41:29 +0000 (10:41 +0200)] 
firmware: arm_scmi: quirk: Improve quirk range parsing

When a range contains only an end ("-X"), the number string is parsed
twice, as both "sep == first" and "sep != last" are true.  Fix this by
dropping the superfluous number parsing for "sep == first".

This does have a harmless functional impact for the unbounded range:
"-" is now accepted, while it was rejected before.

Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/fe257b3b7b7b5c17fd0e5727bb9746c731bd7e3c.1775205358.git.geert+renesas@glider.be
(sudeep.holla: Initialise ret to 0 as it will be uninitialise for "-" range)
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
8 weeks agofirmware: arm_scmi: Rename struct scmi_revision_info to scmi_base_info
Marek Vasut [Mon, 6 Apr 2026 15:52:54 +0000 (17:52 +0200)] 
firmware: arm_scmi: Rename struct scmi_revision_info to scmi_base_info

Rename struct scmi_revision_info to struct scmi_base_info , to
accurately represent its content. The scmi_revision_info is no
longer accurate, because the structure now contains more than
only SCMI base protocol revision, it now also contains number
of protocols, agents, vendor and subvendor strings. All those
are fetched from the base protocol, so rename the structure to
scmi_base_info, to match the other scmi_*_info structure names.
No functional change.

Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Link: https://patch.msgid.link/20260406155343.72087-1-marek.vasut+renesas@mailbox.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
8 weeks agofirmware: imx: sm-misc: Print boot/shutdown reasons
Peng Fan [Thu, 5 Mar 2026 01:56:45 +0000 (09:56 +0800)] 
firmware: imx: sm-misc: Print boot/shutdown reasons

Add reset reason string table for i.MX95 and introduce a helper
(scmi_imx_misc_get_reason) to query and print both system and LM
(Logical Machine) reset reasons via the SCMI MISC protocol.

Signed-off-by: Peng Fan <peng.fan@nxp.com>
Link: https://patch.msgid.link/20260305-scmi-imx-reset-v1-2-18de78978ba9@nxp.com
Acked-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
8 weeks agofirmware: arm_scmi: imx: Support getting reset reason of MISC protocol
Peng Fan [Thu, 5 Mar 2026 01:56:44 +0000 (09:56 +0800)] 
firmware: arm_scmi: imx: Support getting reset reason of MISC protocol

MISC protocol supports getting reset reason per Logical Machine or
System. Add the API for user to retrieve the information from System
Manager.

Signed-off-by: Peng Fan <peng.fan@nxp.com>
Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com>
Link: https://patch.msgid.link/20260305-scmi-imx-reset-v1-1-18de78978ba9@nxp.com
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
8 weeks agoclk: microchip: rename clk-core to clk-pic32
Conor Dooley [Wed, 25 Feb 2026 17:44:52 +0000 (17:44 +0000)] 
clk: microchip: rename clk-core to clk-pic32

clk-core is a confusingly generic name, since it is only used by a
single platform and it uses very similar naming to the "soft" IP cores
for use in FPGA fabric (CoreClock or similar is what that would be
called, although nothing like that exists right now) that the FPGA
business unit produces. Rename it to clk-pic32, matching the prefix
used by most functions in the driver. As far as I can tell, impact
on whatever users may (or may not...) exist for the platform is minimal
as it's built-in only and the functions are called directly from
clk-pic32mzda.c

Reviewed-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
8 weeks agoriscv: dts: microchip: fix pic64gx gpio interrupt-cells
Conor Dooley [Tue, 5 May 2026 10:22:50 +0000 (11:22 +0100)] 
riscv: dts: microchip: fix pic64gx gpio interrupt-cells

As the pic64gx devicetree files got added in parallel to the
GPIO interrupt-cells being fixed for PolarFire SoC, they didn't get
changed to the correct values. Fix them now.

Fixes: 7219d20f9f421 ("riscv: dts: microchip: add pic64gx and its curiosity kit")
Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
8 weeks agodrm/amdgpu: nuke amdgpu_userq_fence_slab v2
Christian König [Mon, 13 Oct 2025 13:26:02 +0000 (15:26 +0200)] 
drm/amdgpu: nuke amdgpu_userq_fence_slab v2

As preparation for independent fences remove the extra slab, kmalloc
should do just fine.

v2: use GFP_KERNEL instead of GFP_ATOMIC

Signed-off-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Prike Liang <Prike.Liang@amd.com>
Reviewed-by: Sunil Khatri <sunil.khatri@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 0d831487b5be0ae59cac865a0aa87b0acc3dc717)

8 weeks agodrm/amdgpu/userq: fix access to stale wptr mapping
Sunil Khatri [Mon, 4 May 2026 12:51:17 +0000 (18:21 +0530)] 
drm/amdgpu/userq: fix access to stale wptr mapping

Use drm_exec to take both locks i.e vm root bo and
wptr_obj bo to access the mapping data properly.

This fixes the security issue of unmap the wptr_obj while
a queue creation is in progress and passing other
bo at same address.

Signed-off-by: Sunil Khatri <sunil.khatri@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 1fc6c8ab45dbee096469c08c13f6099d57a52d6c)
Cc: stable@vger.kernel.org
8 weeks agodrm/amdkfd: Check if there are kfd porcesses using adev by kfd_processes_count
Xiaogang Chen [Fri, 24 Apr 2026 18:47:01 +0000 (13:47 -0500)] 
drm/amdkfd: Check if there are kfd porcesses using adev by kfd_processes_count

During gpu hot-unplug need check if there are kfd porcesses still using the
being removed gpu before clean resources of the device. Current driver checks
if kfd_processes_table is empty. kfd processes are not terminated after
removed from kfd_processes_table immediately. They are still alive and may
access the device until kfd_process_wq work queue got ran.

Check kfd->kfd_processes_count value that is updated after kfd process got
uninitialized when its ref becomes zero.

Fixes: 6cca686dfce7 ("drm/amdkfd: kfd driver supports hot unplug/replug amdgpu devices")
Signed-off-by: Xiaogang Chen <xiaogang.chen@amd.com>
Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit d12d05c4bc4c15585130af43e897923ff292df7b)

8 weeks agodrm/amdgpu: zero-initialize GART table on allocation
Philip Yang [Mon, 27 Apr 2026 13:30:23 +0000 (09:30 -0400)] 
drm/amdgpu: zero-initialize GART table on allocation

GART TLB is flushed after unmapping but not after mapping. Since
amdgpu_bo_create_kernel() does not zero-initialize the buffer, when a
single PTE is written the TLB may speculatively load other uninitialized
entries from the same cacheline. Those garbage entries can appear valid,
and a subsequent write to another PTE in the same cacheline may cause the
GPU to use a stale garbage PTE from the TLB.

Fix this by calling memset_io() to zero-initialize the GART table with
gart_pte_flags immediately after allocation.

Using AMDGPU_GEM_CREATE_VRAM_CLEARED, SDMA-based clear will not work
since SDMA needs GART to be initialized to work.

Suggested-by: Felix Kuehling <felix.kuehling@amd.com>
Signed-off-by: Philip Yang <Philip.Yang@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit d9af8263b82b6eaa60c5718e0c6631c5037e4b24)
Cc: stable@vger.kernel.org
8 weeks agodrm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission
John B. Moore [Mon, 27 Apr 2026 21:06:28 +0000 (16:06 -0500)] 
drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission

sdma_v4_0_ring_emit_fence() contains two BUG_ON(addr & 0x3) assertions
that verify fence writeback addresses are dword-aligned.  These
assertions can be reached from unprivileged userspace via crafted
DRM_IOCTL_AMDGPU_CS submissions, causing a fatal kernel panic in a
scheduler worker thread.

Replace both BUG_ON() calls with WARN_ON() to log the condition without
crashing the kernel.  A misaligned fence address at this point indicates
a driver bug, but crashing the kernel is never the correct response when
the assertion is reachable from userspace.

The CS IOCTL path is the correct place to filter invalid submissions;
the ring emission callback is too late to do anything about it.

Fixes: 2130f89ced2c ("drm/amdgpu: add SDMA v4.0 implementation (v2)")
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: John B. Moore <jbmoore61@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit b90250bd933afd1ba94d86d6b13821997b22b18e)
Cc: stable@vger.kernel.org
8 weeks agodrm/radeon: add missing revision check for CI
Alex Deucher [Mon, 27 Apr 2026 15:40:25 +0000 (11:40 -0400)] 
drm/radeon: add missing revision check for CI

The memory level workarounds only apply to revision 0 SKUs.

Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/1816
Fixes: 127e056e2a82 ("drm/radeon: fix mclk vddc configuration for cards for hawaii")
Fixes: 21b8a369046f ("drm/radeon: fix dram timing for certain hawaii boards")
Fixes: 90b2fee35cb9 ("drm/radeon: fix dpm mc init for certain hawaii boards")
Reviewed-by: Timur Kristóf <timur.kristof@gmail.com>
Reviewed-by: Kent Russell <kent.russell@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 4d8dcc14311515077062b5740f39f427075de5c9)
Cc: stable@vger.kernel.org
8 weeks agodrm/amdgpu/pm: align Hawaii mclk workaround with radeon
Alex Deucher [Tue, 28 Apr 2026 14:42:49 +0000 (10:42 -0400)] 
drm/amdgpu/pm: align Hawaii mclk workaround with radeon

Align the hawaii mclk workaround with radeon and windows.

Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/1816
Fixes: 9f4b35411cfe ("drm/amd/powerplay: add CI asics support to smumgr (v3)")
Reviewed-by: Timur Kristóf <timur.kristof@gmail.com>
Reviewed-by: Kent Russell <kent.russell@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 9649528b637f668c5af9f2b83ca4ad8576ae2121)
Cc: stable@vger.kernel.org
8 weeks agodrm/amdgpu/pm: add missing revision check for CI
Alex Deucher [Mon, 27 Apr 2026 15:38:58 +0000 (11:38 -0400)] 
drm/amdgpu/pm: add missing revision check for CI

The ci_populate_all_memory_levels() workaround only
applies to revision 0 SKUs.

Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/1816
Fixes: 9f4b35411cfe ("drm/amd/powerplay: add CI asics support to smumgr (v3)")
Reviewed-by: Timur Kristóf <timur.kristof@gmail.com>
Reviewed-by: Kent Russell <kent.russell@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 1db15ba8f72f400bbad8ae0ce24fafc43429d4bd)
Cc: stable@vger.kernel.org
8 weeks agodrm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ
John B. Moore [Tue, 28 Apr 2026 16:35:12 +0000 (11:35 -0500)] 
drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ

Remove the BUG_ON(flags & AMDGPU_FENCE_FLAG_64BIT) assertion from
gfx_v9_0_ring_emit_fence_kiq().  The KIQ hardware supports 64-bit
fence writes; the 32-bit writeback address constraint is an
upper-layer convention, not a hardware limitation.  The check serves
no purpose and should not be present.

Found by code inspection while investigating related BUG_ON
assertions in the GFX and compute ring emission paths.

Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: John B. Moore <jbmoore61@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 1b1101a46a426bb4328116bb5273c326a2780389)
Cc: stable@vger.kernel.org
8 weeks agodrm/amdkfd: Make all TLB-flushes heavy-weight
Felix Kuehling [Mon, 20 Apr 2026 15:55:57 +0000 (11:55 -0400)] 
drm/amdkfd: Make all TLB-flushes heavy-weight

With only one sequence number we cannot track the need for legacy vs
heavy-weight flushes reliably. Always use heavy-weight.

Signed-off-by: Felix Kuehling <felix.kuehling@amd.com>
Reviewed-by: Philip Yang <philip.yang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit c1a3ff1d327820cd9a52bc1056b98681fc088949)
Cc: stable@vger.kernel.org
8 weeks agoMAINTAINERS: Update maintainer for LT8912B DRM HDMI bridge
Francesco Dolcini [Thu, 30 Apr 2026 08:53:42 +0000 (10:53 +0200)] 
MAINTAINERS: Update maintainer for LT8912B DRM HDMI bridge

Update the maintainer from Adrien to Francesco.  Adrien is not
interested in maintaining this driver anymore, Francesco has access to
various hardware devices using this component and the vendor
documentation.

Cc: Adrien Grassein <adrien.grassein@gmail.com>
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Acked-by: Adrien Grassein <adrien.grassein@gmail.com>
Acked-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patch.msgid.link/20260430085344.34271-1-francesco@dolcini.it
8 weeks agoMAINTAINERS: add Luca Ceresoli as reviewer for DRM bridge code
Luca Ceresoli [Thu, 30 Apr 2026 10:26:53 +0000 (12:26 +0200)] 
MAINTAINERS: add Luca Ceresoli as reviewer for DRM bridge code

I am actively working on drm_bridge.c and recently also
drm_bridge_connector.c, especially for the DRM bridge hotplug work. Being
in Cc would ensure I won't miss related patches and can review them
promptly.

Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Acked-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patch.msgid.link/20260430-maintainers-add-r-drm_bridge-v1-1-3e2523faf349@bootlin.com
8 weeks agoselftests/rseq: Make registration flexible for legacy and optimized mode
Thomas Gleixner [Sun, 26 Apr 2026 16:13:54 +0000 (18:13 +0200)] 
selftests/rseq: Make registration flexible for legacy and optimized mode

rseq_register_current_thread() either uses the glibc registered RSEQ region
or registers it's own region with the legacy size of 32 bytes.

That worked so far, but becomes a problem when the kernel implements a
distinction between legacy and performance optimized behavior based on the
registration size as that does not allow to test both modes with the self
test suite.

Add two arguments to the function. One to enforce that the registration is
not using libc provided mode and one to tell the registration to use the
legacy size and not the kernel advertised size.

Rename it and make the original one a inline wrapper which preserves the
existing behavior.

Fixes: 566d8015f7ee ("rseq: Avoid CPU/MM CID updates when no event pending")
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Link: https://patch.msgid.link/20260428224427.677889423%40kernel.org
Cc: stable@vger.kernel.org
8 weeks agoselftests/rseq: Skip tests if time slice extensions are not available
Thomas Gleixner [Sat, 25 Apr 2026 13:46:06 +0000 (15:46 +0200)] 
selftests/rseq: Skip tests if time slice extensions are not available

Don't fail, skip the test if the extensions are not enabled at compile or
runtime.

Fixes: 830969e7821a ("selftests/rseq: Implement time slice extension test")
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Link: https://patch.msgid.link/20260428224427.597838491%40kernel.org
Cc: stable@vger.kernel.org
8 weeks agorseq: Revert to historical performance killing behaviour
Thomas Gleixner [Fri, 24 Apr 2026 22:47:54 +0000 (00:47 +0200)] 
rseq: Revert to historical performance killing behaviour

The recent RSEQ optimization work broke the TCMalloc abuse of the RSEQ ABI
as it not longer unconditionally updates the CPU, node, mm_cid fields,
which are documented as read only for user space. Due to the observed
behavior of the kernel it was possible for TCMalloc to overwrite the
cpu_id_start field for their own purposes and rely on the kernel to update
it unconditionally after each context switch and before signal delivery.

The RSEQ ABI only guarantees that these fields are updated when the data
changes, i.e. the task is migrated or the MMCID of the task changes due to
switching from or to per CPU ownership mode.

The optimization work eliminated the unconditional updates and reduced them
to the documented ABI guarantees, which results in a massive performance
win for syscall, scheduling heavy work loads, which in turn breaks the
TCMalloc expectations.

There have been several options discussed to restore the TCMalloc
functionality while preserving the optimization benefits. They all end up
in a series of hard to maintain workarounds, which in the worst case
introduce overhead for everyone, e.g. in the scheduler.

The requirements of TCMalloc and the optimization work are diametral and
the required work arounds are a maintainence burden. They end up as fragile
constructs, which are blocking further optimization work and are pretty
much guaranteed to cause more subtle issues down the road.

The optimization work heavily depends on the generic entry code, which is
not used by all architectures yet. So the rework preserved the original
mechanism moslty unmodified to keep the support for architectures, which
handle rseq in their own exit to user space loop. That code is currently
optimized out by the compiler on architectures which use the generic entry
code.

This allows to revert back to the original behaviour by replacing the
compile time constant conditions with a runtime condition where required,
which disables the optimization and the dependend time slice extension
feature until the run-time condition can be enabled in the RSEQ
registration code on a per task basis again.

The following changes are required to restore the original behavior, which
makes TCMalloc work again:

  1) Replace the compile time constant conditionals with runtime
     conditionals where appropriate to prevent the compiler from optimizing
     the legacy mode out

  2) Enforce unconditional update of IDs on context switch for the
     non-optimized v1 mode

  3) Enforce update of IDs in the pre signal delivery path for the
     non-optimized v1 mode

  4) Enforce update of IDs in the membarrier(RSEQ) IPI for the
     non-optimized v1 mode

  5) Make time slice and future extensions depend on optimized v2 mode

This brings back the full performance problems, but preserves the v2
optimization code and for generic entry code using architectures also the
TIF_RSEQ optimization which avoids a full evaluation of the exit to user
mode loop in many cases.

Fixes: 566d8015f7ee ("rseq: Avoid CPU/MM CID updates when no event pending")
Reported-by: Mathias Stearn <mathias@mongodb.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Closes: https://lore.kernel.org/CAHnCjA25b+nO2n5CeifknSKHssJpPrjnf+dtr7UgzRw4Zgu=oA@mail.gmail.com
Link: https://patch.msgid.link/20260428224427.517051752%40kernel.org
Cc: stable@vger.kernel.org
8 weeks agodrm/panel: Enable GPIOLIB for panels which uses functions from it
David Heidelberg [Tue, 5 May 2026 13:53:43 +0000 (15:53 +0200)] 
drm/panel: Enable GPIOLIB for panels which uses functions from it

These panels used on sdm845 devices are using GPIOLIB functions,
ensure it's enabled.

Signed-off-by: David Heidelberg <david@ixit.cz>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patch.msgid.link/20260505-panel-clean-up-kconfig-dep-v2-4-9cc31d6e6919@ixit.cz
8 weeks agodrm/panel: Clean up S6E3HA2 config dependencies and fill help text
David Heidelberg [Tue, 5 May 2026 13:53:42 +0000 (15:53 +0200)] 
drm/panel: Clean up S6E3HA2 config dependencies and fill help text

As per the config name this Display IC features a DSI command-mode
interface (or the command to switch to video mode is not
known/documented) and does not use any of the video-mode helper
utilities, hence should not select VIDEOMODE_HELPERS. In addition it
uses devm_gpiod_get() and related functions from GPIOLIB.

Fixes: 779679d3c164 ("drm/panel: Add support for S6E3HA8 panel driver")
Signed-off-by: David Heidelberg <david@ixit.cz>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patch.msgid.link/20260505-panel-clean-up-kconfig-dep-v2-3-9cc31d6e6919@ixit.cz
8 weeks agodrm/panel: Clean up S6E3FC2X01 config dependencies
David Heidelberg [Tue, 5 May 2026 13:53:41 +0000 (15:53 +0200)] 
drm/panel: Clean up S6E3FC2X01 config dependencies

As per the config name this Display IC features a DSI command-mode
interface (or the command to switch to video mode is not
known/documented) and does not use any of the video-mode helper
utilities, hence should not select VIDEOMODE_HELPERS.  In addition it
uses devm_gpiod_get() and related functions from GPIOLIB.

Fixes: 88148c30ef26 ("drm/panel: Add Samsung S6E3FC2X01 DDIC with AMS641RW panel")
Signed-off-by: David Heidelberg <david@ixit.cz>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patch.msgid.link/20260505-panel-clean-up-kconfig-dep-v2-2-9cc31d6e6919@ixit.cz
8 weeks agodrm/panel: Clean up SOFEF00 config dependencies
Marijn Suijten [Tue, 5 May 2026 13:53:40 +0000 (15:53 +0200)] 
drm/panel: Clean up SOFEF00 config dependencies

As per the config name this Display IC features a DSI command-mode
interface (or the command to switch to video mode is not
known/documented) and does not use any of the video-mode helper
utilities, hence should not select VIDEOMODE_HELPERS.  In addition it
uses devm_gpiod_get() and related functions from GPIOLIB.

Fixes: 5933baa36e26 ("drm/panel/samsung-sofef00: Add panel for OnePlus 6/T devices")
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Reviewed-by: Casey Connolly <casey.connolly@linaro.org>
Reviewed-by: David Heidelberg <david@ixit.cz>
Signed-off-by: Marijn Suijten <marijn.suijten@somainline.org>
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patch.msgid.link/20260505-panel-clean-up-kconfig-dep-v2-1-9cc31d6e6919@ixit.cz
8 weeks agodrm/amdgpu: nuke amdgpu_userq_fence_slab v2
Christian König [Mon, 13 Oct 2025 13:26:02 +0000 (15:26 +0200)] 
drm/amdgpu: nuke amdgpu_userq_fence_slab v2

As preparation for independent fences remove the extra slab, kmalloc
should do just fine.

v2: use GFP_KERNEL instead of GFP_ATOMIC

Signed-off-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Prike Liang <Prike.Liang@amd.com>
Reviewed-by: Sunil Khatri <sunil.khatri@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
8 weeks agodrm/amdgpu/userq: fix access to stale wptr mapping
Sunil Khatri [Mon, 4 May 2026 12:51:17 +0000 (18:21 +0530)] 
drm/amdgpu/userq: fix access to stale wptr mapping

Use drm_exec to take both locks i.e vm root bo and
wptr_obj bo to access the mapping data properly.

This fixes the security issue of unmap the wptr_obj while
a queue creation is in progress and passing other
bo at same address.

Signed-off-by: Sunil Khatri <sunil.khatri@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
8 weeks agodrm/amd/display: Promote DC to 3.2.381
Taimur Hassan [Sat, 25 Apr 2026 01:56:30 +0000 (20:56 -0500)] 
drm/amd/display: Promote DC to 3.2.381

This version brings along following update:
-add max bandwidth budget to QoS interface
-Update tmz field for LSDMA
-fix buffer overruns warnings
-add memory bandwidth override debug interface
-Find link encoder for flexible DIG mapping cases
-Fix type mismatches using guards and explicit casts
-Fix type mismatches in DC and DMUB modules
-Skip HDR metadata update when Smart Power OLED enabled
-Rename backlight_properties to pwr_backlight_properties
-remove watermark range notify
-Clean Up Legacy DML Content
-Implement block sequencing infrastructure for modular hardware operations.
-Do DML float narrowing explicit
-Fix type mismatches in DML and normalize loop bounds
-Remove unused state param from enable_link_analog
-Fix Color Manager (3DLUT, Shaper, Blend)

Acked-by: Tom Chung <chiahsuan.chung@amd.com>
Signed-off-by: Taimur Hassan <Syed.Hassan@amd.com>
Signed-off-by: James Lin <pinglei.lin@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
8 weeks agodrm/amd/display: add max bandwidth budget to QoS interface
Wenjing Liu [Thu, 23 Apr 2026 20:59:01 +0000 (16:59 -0400)] 
drm/amd/display: add max bandwidth budget to QoS interface

[Why]
The QoS reporting interface lacked a field to expose the maximum
active memory bandwidth budget. Adding this field allows callers to
observe the effective bandwidth ceiling.

[How]
Rename struct memory_qos to dc_measured_memory_qos and introduce
a new struct dc_requested_memory_qos holding bandwidth lower bound,
calculated average bandwidth, latency upper bounds, and max bandwidth
budget. Add a get_requested_memory_qos function pointer to
clk_mgr_funcs. Update dc_get_qos_info to call through the new
function pointer and populate all requested QoS fields including
qos_max_bw_budget_in_mbps in dc_qos_info.

Reviewed-by: Dillon Varone <dillon.varone@amd.com>
Signed-off-by: Wenjing Liu <wenjing.liu@amd.com>
Signed-off-by: James Lin <pinglei.lin@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
8 weeks agodrm/amd/display: Update tmz field for LSDMA
Alvin Lee [Tue, 21 Apr 2026 19:04:44 +0000 (15:04 -0400)] 
drm/amd/display: Update tmz field for LSDMA

[Why & How]
TMZ field should be 4-bits wide instead of 1.
Also add missing src/dst_cache_policy fields to
tiled copy struct.

Reviewed-by: Rafal Ostrowski <rafal.ostrowski@amd.com>
Signed-off-by: Alvin Lee <Alvin.Lee2@amd.com>
Signed-off-by: James Lin <pinglei.lin@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
8 weeks agodrm/amd/display: fix buffer overruns warnings
Gaghik Khachatrian [Thu, 23 Apr 2026 02:12:25 +0000 (22:12 -0400)] 
drm/amd/display: fix buffer overruns warnings

[Why & How]
Fixes a warning by adding bounds checks and index validation in dml2_0
sources to address static analysis warnings. Ensures safe array access and
prevents out-of-bounds reads by validating indices before use, improving
robustness and reliability in the affected files.

Reviewed-by: Austin Zheng <austin.zheng@amd.com>
Signed-off-by: Gaghik Khachatrian <gaghik.khachatrian@amd.com>
Signed-off-by: James Lin <pinglei.lin@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
8 weeks agodrm/amd/display: add memory bandwidth override debug interface
Wenjing Liu [Fri, 17 Apr 2026 19:46:02 +0000 (15:46 -0400)] 
drm/amd/display: add memory bandwidth override debug interface

[Why & How]
Add override_memory_bandwidth_request to clk_mgr_funcs and get_utm_qos_model callback
 to soc_and_ip_translator_funcs for future test use.

Reviewed-by: Dillon Varone <dillon.varone@amd.com>
Signed-off-by: Wenjing Liu <wenjing.liu@amd.com>
Signed-off-by: James Lin <pinglei.lin@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
8 weeks agodrm/amd/display: Find link encoder for flexible DIG mapping cases
Ovidiu Bunea [Fri, 17 Apr 2026 19:11:12 +0000 (15:11 -0400)] 
drm/amd/display: Find link encoder for flexible DIG mapping cases

[why & how]
link->link_enc can only be used to identify the link's link encoder
when the link is not permitted to use flexible link encoder
assignments.

Use the correct function for identifying link encoder and add
function pointer guards before calling them.

Reviewed-by: Wenjing Liu <wenjing.liu@amd.com>
Signed-off-by: Ovidiu Bunea <ovidiu.bunea@amd.com>
Signed-off-by: James Lin <pinglei.lin@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
8 weeks agodrm/amd/display: Fix type mismatches using guards and explicit casts
Gaghik Khachatrian [Tue, 21 Apr 2026 16:24:09 +0000 (12:24 -0400)] 
drm/amd/display: Fix type mismatches using guards and explicit casts

[Why]
Address signed/unsigned comparison warnings across dc paths to keep
builds warning-clean and improve type safety at comparison boundaries.
Most warnings came from signed loop/index temporaries compared against
unsigned counters and table sizes, plus a smaller number of mixed
signed/unsigned clock, bandwidth, and geometry comparisons.

[How]
Aligned iterator and temporary variable types with the semantic type
of the compared bounds. Used unsigned indices for loops bounded by unsigned
counters and table sizes, while retaining signed types where values are
semantically signed or participate in arithmetic that may legitimately go
negative. Where mixed signed/unsigned comparisons are intentional, applied
explicit boundary casts or guarded comparisons instead of broad type
changes.

No functional behavior changes are intended; this is a warning-resolution
and type-alignment cleanup.

Reviewed-by: Dillon Varone <dillon.varone@amd.com>
Signed-off-by: Gaghik Khachatrian <gaghik.khachatrian@amd.com>
Signed-off-by: James Lin <pinglei.lin@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
8 weeks agodrm/amd/display: Fix type mismatches in DC and DMUB modules
Gaghik Khachatrian [Tue, 21 Apr 2026 18:58:16 +0000 (14:58 -0400)] 
drm/amd/display: Fix type mismatches in DC and DMUB modules

[Why]
Address signed/unsigned comparison warnings across dc paths to keep
builds warning-clean and improve type safety at comparison boundaries.
Most warnings came from signed loop/index temporaries compared against
unsigned counters and table sizes, plus a smaller number of mixed
signed/unsigned clock, bandwidth, and geometry comparisons.

[How]
Aligned loop/index and bound types in the affected modules and DMUB
sources, including color, freesync, power, stats, and vmid paths.
Used unsigned iterators where bounds/counters are unsigned, preserved
signed types where negative values are meaningful, and updated related
format specifiers where type changes required it. Changes are limited to
warning resolution and type alignment.

No functional behavior change is intended.

Reviewed-by: Dillon Varone <dillon.varone@amd.com>
Signed-off-by: Gaghik Khachatrian <gaghik.khachatrian@amd.com>
Signed-off-by: James Lin <pinglei.lin@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
8 weeks agodrm/amd/display: Skip HDR metadata update when Smart Power OLED enabled
Ian Chen [Wed, 15 Apr 2026 03:25:22 +0000 (11:25 +0800)] 
drm/amd/display: Skip HDR metadata update when Smart Power OLED enabled

[Why & How]
While smart power oled is enabled,
the infopacket contents are tied to the frame histogram,
so it does not need driver side to update the hdr metadata.

Reviewed-by: Aric Cyr <aric.cyr@amd.com>
Reviewed-by: Anthony Koo <anthony.koo@amd.com>
Signed-off-by: Ian Chen <ian.chen@amd.com>
Signed-off-by: James Lin <pinglei.lin@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
8 weeks agodrm/amd/display: Rename backlight_properties to pwr_backlight_properties
Ray Wu [Mon, 20 Apr 2026 07:16:12 +0000 (15:16 +0800)] 
drm/amd/display: Rename backlight_properties to pwr_backlight_properties

[Why]
'struct backlight_properties' in power.c has the same name as the kernel's
struct defined in <linux/backlight.h>. In out-of-tree backport build
environments, the header is forcefully injected via command-line includes,
causing a redefinition error.

[How]
Rename the file-local 'struct backlight_properties' to
'pwr_backlight_properties' to avoid the name collision. No functional
change.

Reviewed-by: Tom Chung <chiahsuan.chung@amd.com>
Signed-off-by: Ray Wu <ray.wu@amd.com>
Signed-off-by: James Lin <pinglei.lin@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
8 weeks agodrm/amd/display: remove watermark range notify
Charlene Liu [Tue, 21 Apr 2026 00:30:55 +0000 (20:30 -0400)] 
drm/amd/display: remove watermark range notify

[Why & How]
dcn42 only use one set of watermark A,
driver always update set A runtime.
no need to notify pmfw the clock range.

Reviewed-by: Dmytro Laktyushkin <dmytro.laktyushkin@amd.com>
Signed-off-by: Charlene Liu <Charlene.Liu@amd.com>
Signed-off-by: James Lin <pinglei.lin@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
8 weeks agodrm/amd/display: Clean Up Legacy DML Content
Zheng, Austin [Fri, 20 Feb 2026 22:41:28 +0000 (17:41 -0500)] 
drm/amd/display: Clean Up Legacy DML Content

[Why & How]
Legacy files were used for the transition period between DML1 and DML2.
Fully transitioned away from DML1 so these legacy files can be removed
since they are not actively being used.

Reviewed-by: Dillon Varone <dillon.varone@amd.com>
Signed-off-by: Zheng Austin <Austin.Zheng@amd.com>
Signed-off-by: James Lin <pinglei.lin@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>