summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-07-20drm/i915/backlight: Remove DP_EDP_BACKLIGHT_AUX_ENABLE_CAP check for DPCD ↵Suraj Kandpal
backlight Turns out some panels allow only AUX based backlight by just setting the DP_EDP_BACKLIGHT_BRIGHTNESS_AUX_SET_CAP and not setting the DP_EDP_BACKLIGHT_AUX_ENABLE_CAP. If we make DP_EDP_BACKLIGHT_AUX_ENABLE_CAP a necessity for AUX based DPCD backlight these panels loose the ability to manipulate backlight via AUX, especially ones with no PWM controller. Remove this check from function so that panels who do not advertise DP_EDP_BACKLIGHT_AUX_ENABLE_CAP but advertise DP_EDP_BACKLIGHT_BRIGHTNESS_AUX_SET_CAP are able to manipulate backlight again. Fixes: ed8be780bdbc ("drm/i915/backlight: Fix VESA backlight possible check condition") Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/work_items/16507 Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com> Reviewed-by: Michał Grzelak <michal.grzelak@intel.com> Link: https://patch.msgid.link/20260716030959.436430-1-suraj.kandpal@intel.com (cherry picked from commit 7d594b24c915afb4b0c5fb8875403253daef5b24) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-07-20xfrm: drop ESP-in-TCP packets with no ingress deviceZhiling Zou
ESP-in-TCP receives records through the TCP strparser. handle_esp() restores skb->dev from the saved skb_iif before passing the packet into the XFRM input path. Queued TCP data can be processed after the original ingress device has been removed, for example during veth or net namespace teardown. In that case dev_get_by_index_rcu() returns NULL. The XFRM IPv4 and IPv6 input paths both expect skb->dev to be valid while building the route lookup, so queued ESP-in-TCP data can dereference a NULL device. Drop the packet if the saved ingress device can no longer be resolved. Such a packet can no longer be routed through the normal XFRM receive path, and this preserves the existing behaviour for packets whose ingress device still exists. Fixes: e27cca96cd68 ("xfrm: add espintcp (RFC 8229)") Cc: stable@vger.kernel.org Reported-by: Vega <vega@nebusec.ai> Signed-off-by: Zhiling Zou <roxy520tt@gmail.com> Assisted-by: Codex:gpt-5.4 Reviewed-by: Ren Wei <enjou1224z@gmail.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
2026-07-20xfrm: espintcp: fix UAF during closeSabrina Dubroca
ZDI reported and analyzed a race condition during close for espintcp sockets: espintcp_close() frees emsg->skb via kfree_skb() without holding any socket lock. Concurrently, the xfrm_trans_reinject work queue invokes esp_output_tcp_finish() -> espintcp_push_skb() -> espintcp_push_msgs() -> skb_send_sock_locked(), which reads the same skb as a data source. Fix this by adding a synchronize_rcu() call after resetting sk_prot, since esp_output_tcp_finish() runs under RCU and won't use a socket with sk_prot == &tcp_prot. Simply taking the socket lock in espintcp_close() could lead to leaks, if esp_output_tcp_finish() re-adds an skb in the slot we just freed. After this, the existing barrier() is no longer needed. Cc: stable@vger.kernel.org Fixes: e27cca96cd68 ("xfrm: add espintcp (RFC 8229)") Reported-by: zdi-disclosures@trendmicro.com Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> Reviewed-by: Breno Leitao <leitao@debian.org> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
2026-07-20gpio: kunit: add test cases verifying swnode devlink supportBartosz Golaszewski
The software node fw_devlink support already has its own kunit suite, but that verifies the fwnode links in isolation. Add GPIO tests that prove the ordering works in a real-life use-case: a GPIO consumer that references its provider via a software node. The first suite registers the provider's software node, adds the consumer device first and checks that fw_devlink defers its probe until the provider has been added and bound. The second covers the fallback: with the provider's software node not yet registered no supplier link is created, so the consumer probes, devm_gpiod_get() returns -EPROBE_DEFER and the consumer only binds once the provider shows up. While at it: the existing gpio_unbind_with_consumers() test keeps the consumer bound while the provider goes away and then operates the orphaned descriptor. With software nodes now being covered by fw_devlink that would instead force-unbind the consumer along with the provider, so opt it out by setting FWNODE_FLAG_LINKS_ADDED. Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Tested-by: David Gow <david@davidgow.net> Link: https://patch.msgid.link/20260720-swnode-fw-devlink-v5-1-ec250ae6af91@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-07-20genirq/msi: Move misplaced EXPORT_SYMBOL_GPL for msi_domain_free_irqs_all()Li RongQing
EXPORT_SYMBOL_GPL(msi_domain_free_irqs_all) was mistakenly placed after msi_domain_free_irqs_range() instead of after its intended function msi_domain_free_irqs_all(). Signed-off-by: Li RongQing <lirongqing@baidu.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Reviewed-by: Radu Rendec <radu@rendec.net> Link: https://patch.msgid.link/20260717143157.1718-1-lirongqing@baidu.com
2026-07-20xfs: propagate errors from xfs_rtginode_loadGuanghui Yang
xfs_rtginode_ensure() treats every xfs_rtginode_load() error other than -ENOENT as success. This can leave the realtime group inode unset after an I/O, allocation, or corruption error. Growfs then continues as though the inode had been loaded. Only -ENOENT means that the inode needs to be created. Return all other errors to the growfs caller. Fixes: ae897e0bed0f ("xfs: support creating per-RTG files in growfs") Cc: stable@vger.kernel.org Signed-off-by: Guanghui Yang <3497809730@qq.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: "Darrick J. Wong" <djwong@kernel.org> Signed-off-by: Carlos Maiolino <cem@kernel.org>
2026-07-20platform/x86: thinkpad_acpi: Fix USB-C Security probe failure on unsupported ↵Vishnu Sankar
platforms On systems where the USCS ACPI method is absent, acpi_evalf() returns AE_NOT_FOUND which maps to -EIO. This caused tpacpi_usbc_security_init() to propagate the error and thinkpad_acpi failed to probe entirely on unsupported platforms. Fix this by checking for USCS method presence with acpi_has_method() before attempting to call it, returning -ENODEV immediately if absent. This follows the same pattern used by other subdrivers in thinkpad_acpi.c. Fixes: 67e8d1e9cacd ("platform/x86: thinkpad_acpi: Add USB-C Security (USCS) support") Reported-by: Oliver Lin <oliver@liuxiaozhen.dev> Closes: https://lore.kernel.org/platform-driver-x86/239c8162-e1e6-4b49-8292-35547c5a525c@liuxiaozhen.dev/ Tested-by: Oliver Lin <oliver@liuxiaozhen.dev> Signed-off-by: Vishnu Sankar <vishnuocv@gmail.com> Link: https://patch.msgid.link/20260715010205.514132-1-vishnuocv@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-07-20ALSA: timer: drain a slave's callback before its master detaches itNorbert Szetei
snd_timer_close_locked() drains the closing instance's own in-flight callback (IFLG_CALLBACK) before freeing it, but not its slaves'. When a master instance is closed, remove_slave_links() clears each slave's ->timer; the slave's own close then reads timer == NULL and takes the branch that skips the drain entirely (snd_timer_stop_slave() also no-ops on a NULL timer). So a slave whose callback is still running when the master is closed is freed underneath the live callback, leading to use-after-free. Drain the slaves too before remove_slave_links() severs them. snd_timer_stop() has already taken this instance off the active list, so no new slave callback can be queued. Take the slaves off the ack list so a pending one can't fire either, then wait for any that is already in flight. Fixes: 37745918e0e7 ("ALSA: timer: Introduce virtual userspace-driven timers") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Norbert Szetei <norbert@doyensec.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/D26598EB-DBF7-4D76-9F71-8E4BD59822D4@doyensec.com
2026-07-20ALSA: timer: don't re-enter an instance callback that is still runningNorbert Szetei
The userspace-driven timer (utimer) TRIGGER ioctl calls snd_timer_interrupt() directly with no serialization, so two threads triggering the same utimer can run snd_timer_interrupt() on one snd_timer concurrently. snd_timer_process_callbacks() drops timer->lock around each instance callback and marks the in-flight callback with the single SNDRV_TIMER_IFLG_CALLBACK bit; snd_timer_close_locked() waits on that bit to drain an in-flight callback before freeing the instance. The bit cannot represent two concurrent callbacks: when a second interrupt re-queues an instance whose callback is still running, both run at once, the first to finish clears the bit, and the close-path drain then frees the instance (and its callback_data) while the other callback is still live - a use-after-free reachable by any user able to open /dev/snd/timer, both via a user timer instance and via a sequencer queue timer bound to the utimer. snd_timer_interrupt() sets IFLG_CALLBACK before dropping timer->lock, so a concurrent interrupt already observes it under the lock. Skip re-queuing an instance (and its slaves) to the ack/sack list while its callback is in flight; the accumulated pticks are delivered on the next tick, so no event is lost. Fixes: 37745918e0e7 ("ALSA: timer: Introduce virtual userspace-driven timers") Cc: stable@vger.kernel.org Suggested-by: Takashi Iwai <tiwai@suse.de> Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Norbert Szetei <norbert@doyensec.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/6F9B6501-8E65-4265-B02C-7EFB240D1664@doyensec.com
2026-07-20Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netPaolo Abeni
Cross-merge networking fixes after downstream PR (net-7.2-rc4). No conflicts. Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-20Merge tag 'swnode-7.3-rc1' of ↵Bartosz Golaszewski
https://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core into gpio/for-next software node: provide support for fw_devlink This series extends software node support to use fw_devlink and adds test coverage for the new behaviour. This is a stable tag for other trees to merge.
2026-07-19sched_ext: Rename the cid-form cgroup ops to cpuctl_*Tejun Heo
Two unrelated things go by "cgroup" in the cid form. Sub-schedulers attach to cgroups, and the cgroup_*() ops deliver cpu controller events. While the ops names suggest cgroup2 hierarchy, they actually operate on the cpu controller. Rename them to cpuctl_* in struct sched_ext_ops_cid, which has no users outside scx_qmap yet. The cpu form is deployed ABI and keeps the old names. The layout is unchanged and the kernel keeps calling through the cpu-form union view. Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-07-19tools/sched_ext: Add SCX_OPS_CID_OPEN for cid-form schedulersTejun Heo
SCX_OPS_OPEN() clears compat-gated ops fields which the running kernel lacks. The clears dereference cpu-form member names and compile for cid-form skeletons only because both ops structs currently name their cgroup ops identically, which an upcoming rename will end. No load-time fix-up can apply to a cid-form scheduler anyway as the cid form postdates every compat-gated op. Factor the skeleton open path out of SCX_OPS_OPEN() and add SCX_OPS_CID_OPEN() which uses only that shared part. Switch scx_qmap, the only cid-form scheduler, over. Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-07-19tools/sched_ext: scx_qmap - Add init fault injection modesTejun Heo
Add -J init-fail which makes ops.init_task() fail with -ENOMEM for tasks whose comm starts with "qmfail", and -J cgrp-init-fail which does the same in ops.cgroup_init() for cgroups named "qmfail*". The former exercises the migration veto path: the cgroup.procs write must fail with the injected errno while the destination sched stays up and the task stays put. The latter exercises the ownership-return failure path: a parent failing to re-init a returned cgroup leaves it unowned, and moves and set_* ops against it must be skipped instead of dereferencing the missing owner. Matching on "qmfail" names keeps the injecting scheduler's own enable unaffected. Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-07-19tools/sched_ext: scx_qmap - Consume cgroup weights through set_weightTejun Heo
With the set_* ops delivered to the parent's sched, a parent qmap instance now receives cgroup_set_weight for its child subs' attach points. Update the matching sub_sched_ctx weight and redistribute() in-kernel, and drop the userspace feed_weights() polling. This exercises the knob routing end to end. The self weight is fixed at 100: a cgroup's weight is its parent's knob and not the scheduler's own business. This drops the self-weight polling and the repartition PROG_RUN poke with it. sub_attach seeds the slot with the cgroup's current weight, read through bpf_cgroup_from_id(), so a weight set before the sub attaches is picked up. A write racing the attach can still be lost until the next value-changing cpu.weight write. Acceptable for a demo. While at it, add a traced ops.cgroup_move() so tests can observe move delivery. Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-07-19sched_ext: Hand over cgroups at sub-scheduler enable/disableTejun Heo
Sub-schedulers don't get cgroups yet: every task_group is inited on the root sched and the routing added by the previous patches always resolves to it. Add the handover: an enabling sub-scheduler takes over the cgroups in its subtree and a disabling one returns them to its parent. scx_cgroup_claim_subtree() runs while the sub enables, after the subtree's cgrp->scx_sched's are set and before any task is claimed. It inits each subtree task_group on the sub, exits it from the parent and updates tg->scx.sched. A failed ops.cgroup_init() unwinds the sub-side inits and aborts the enable with the parent untouched. Disabling reverses it with scx_cgroup_return_subtree(): exit each cgroup from the sub, then re-init it on the parent with the current tg->scx.* values, resyncing weight and bandwidth changes made while the sub had it. When a re-init fails, the parent is failed and the remaining task_groups still transfer uninited and get no cgroup ops - the same punting done for tasks. The dying parent's own disable moves them onward. The handover walks include dying but not yet offlined task_groups, the same as root's bulk walks: a removed cgroup keeps hosting scheduling events until its dying tasks finish their final context switches, and its ops.cgroup_exit() must follow the last of them. tg on/offlining is excluded through cgroup_lock(), so either ordering against an rmdir of a subtree cgroup delivers balanced init/exit pairs. Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-07-19sched_ext: Deliver cgroup ops to each task_group's schedTejun Heo
With sub-schedulers claiming cgroup subtrees, cgroup ops must be delivered to each task_group's sched rather than always to root. Add tg->scx.sched to track which sched initialized the task_group. It is set and cleared together with SCX_TG_INITED. Deliver the ops accordingly: - ops.cgroup_exit() goes to the sched whose ops.cgroup_init() it pairs with. - ops.cgroup_prep_move/move/cancel_move() go to the task's sched, and only for moves that don't re-home the task. A re-homing move is reported through the ops.exit_task/init_task() pair instead. The cgroups passed to the move ops can be outside the sched's inited set as the cpu controller can be coarser than the sub-scheduler topology. - Knobs of a cgroup belong to the parent, so ops.set_weight/idle/bandwidth() go to the parent task_group's sched. All task_groups currently resolve to the root sched, so no behavior changes until sub-schedulers start claiming cgroups. While at it, scx_cgroup_init() is restructured so both paths share the recording. Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-07-19sched_ext: Re-home tasks on cgroup migrationTejun Heo
A task's sched (p->scx.sched) must match its cgroup's owner (cgrp->scx_sched). cgroup migration breaks the invariant: scx_cgroup_move_task() only fires root's ops.cgroup_move() and never re-homes the task, leading to wrong-sched scheduling and, once the stale sched is freed, a use-after-free. Hook into the new cgroup task migration events and re-home each task whose destination cgroup is owned by a different sched. The events map naturally to the transfer: MIGRATING runs the fallible init for the destination sched, letting it reject the migration the same way ops.cgroup_prep_move() can, MIGRATED does the re-home, which can't fail, and CANCELED undoes the init when the migration falls through. Pre-commit, the task's task_group still reflects the source, so __scx_init_task() grows an explicit cgroup argument for the migration path to hand ops.init_task() the destination cgroup. Signed-off-by: Tejun Heo <tj@kernel.org> Closes: https://lore.kernel.org/r/alnxrsexEe_nQwqL@gpd4 Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-07-19sched_ext: Relocate scx_cgroup_enabledTejun Heo
scx_cgroup_enabled is in the CONFIG_EXT_GROUP_SCHED block. The upcoming cgroup migration re-homing needs the gate outside the block. Move the definition and flag flips outside CONFIG_EXT_GROUP_SCHED. No functional changes. Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-07-19sched_ext: Factor out scx_rehome_task() and scx_punt_task()Tejun Heo
Factor out scx_rehome_task() and scx_punt_task() from the sub-disable re-home loop and scx_fail_parent(). The upcoming cgroup migration re-homing also needs scx_rehome_task(). No functional changes. Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-07-19cgroup: Add cgroup_task_notifier and task migration eventsTejun Heo
A subsystem can attach to the cgroup hierarchy itself, independent of which controllers are enabled where - BPF hooks already behave this way and sched_ext sub-schedulers do too. Controller callbacks can't track task migrations for them: sched_ext must re-home a task whose migration crosses a sub-scheduler boundary, but the cpu controller's attach callbacks fire only when the task_group changes and miss moves whenever the controller topology is coarser than the sub-scheduler topology. Add cgroup_task_notifier with per-task migration events mirroring the can_attach/attach/cancel_attach phases so that a consumer which prepares per-task state can also veto a migration: CGROUP_TASK_MIGRATING fires pre-commit, CGROUP_TASK_MIGRATED post-commit and CGROUP_TASK_MIGRATE_CANCELED unwinds a failed migration. Only migrations that change a task's dfl cgroup are reported. Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-07-20ALSA: sis7019: Use pcim_iomap_region() for MMIO BARRosen Penev
Replace the open-coded pcim_request_all_regions() + devm_ioremap() pair with per-BAR pcim helpers: reserve BAR0 (the I/O port region, used via inl/outl) with pcim_request_region(), and reserve + iomap BAR1 (MMIO) with a single pcim_iomap_region() call. This folds the BAR1 reserve and iomap into one managed call. The error check moves from a NULL test to IS_ERR(), since pcim_iomap_region() returns an IOMEM_ERR_PTR on failure. Assisted-by: opencode:hy3-free Signed-off-by: Rosen Penev <rosenp@gmail.com> Link: https://patch.msgid.link/20260720000929.1432533-1-rosenp@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-07-20media: i2c: saa7115: Add missing media_entity_cleanup()Biren Pandya
The remove function is missing a call to media_entity_cleanup(). Add it. Signed-off-by: Biren Pandya <birenpandya@gmail.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-20media: i2c: mt9v011: Add missing media_entity_cleanup()Biren Pandya
The remove function is missing a call to media_entity_cleanup(). Add it. Signed-off-by: Biren Pandya <birenpandya@gmail.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-20media: i2c: msp3400-driver: Add missing media_entity_cleanup()Biren Pandya
The remove function and the probe error path are missing calls to media_entity_cleanup(). Add them. Signed-off-by: Biren Pandya <birenpandya@gmail.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-20media: i2c: max9286: Add missing media_entity_cleanup()Biren Pandya
The remove function is missing a call to media_entity_cleanup(). Add it. Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Signed-off-by: Biren Pandya <birenpandya@gmail.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-20media: i2c: cx25840-core: Add missing media_entity_cleanup()Biren Pandya
The remove function is missing a call to media_entity_cleanup(). Add it. Signed-off-by: Biren Pandya <birenpandya@gmail.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-27media: dvb-core: fix feed leak on failed DMX_ADD_PIDRituparna Warwatkar
dvb_dmxdev_add_pid() allocates a new dmxdev_feed, links it into filter->feed.ts and, when the filter is already running, immediately starts the feed. If starting the feed fails, the newly allocated feed remains on the list. Subsequent restart and rollback paths may then operate on this stale entry, leaving feed resources allocated and causing leaks in drivers that allocate resources from ->start_feed() and release them from ->stop_feed(). Remove the feed from the list and free it when dvb_dmxdev_start_feed() fails. Reported-by: syzbot+e9a1f5e196de6663631b@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=e9a1f5e196de6663631b Signed-off-by: Rituparna Warwatkar <rwarwatkar@gmail.com> Link: https://patch.msgid.link/20260714141059.63582-1-rwarwatkar@gmail.com Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Message-ID: <20260714141059.63582-1-rwarwatkar@gmail.com>
2026-07-27media: s2255: bound JPEG frame size before copying into the bufferHyeongJun An
s2255_fillbuff() memcpy()s vc->jpg_size bytes of a captured JPEG/MJPEG frame into the vb2 plane. vc->jpg_size is taken verbatim from the S2255_MARKER_FRAME header the device sends (pdword[4] in save_frame()) and, unlike the frame payload length just above it, is never bounded: payload = le32_to_cpu(pdword[3]); if (payload > vc->req_image_size) /* payload is checked ... */ return -EINVAL; vc->pkt_size = payload; vc->jpg_size = le32_to_cpu(pdword[4]); /* ... jpg_size is not */ A malicious or malfunctioning device can therefore report a jpg_size larger than the destination vb2 plane, and the memcpy() writes past it. jpg_size is a signed int, so a value with the top bit set also turns into a huge length. Reject a frame whose jpg_size is negative or exceeds the plane size before copying it. Fixes: 38f993ad8b1f ("V4L/DVB (8125): This driver adds support for the Sensoray 2255 devices.") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: HyeongJun An <sammiee5311@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-27media: go7007: s2250: propagate control I/O failuresYousef Alhouseen
The brightness and contrast paths use oldvalue after read_reg_fp() without checking whether the read succeeded. A failed read leaves oldvalue uninitialized and can write arbitrary reserved register bits. Return read and write errors from every control path so failed hardware access cannot be reported as a successful control update. Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-27media: s2255: Replace bare 'unsigned' with 'unsigned int'Lei Huang
Fix 'WARNING: Prefer 'unsigned int' to bare use of 'unsigned'' reported by checkpatch.pl in s2255drv.c. Signed-off-by: Lei Huang <huanglei@kylinos.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-27media: s2255: Remove unnecessary braces from single-statement blocksLei Huang
Fix all 4 'WARNING: braces {} are not necessary for single statement blocks' issues reported by checkpatch.pl in s2255drv.c. Remove braces from single-statement if blocks where they are not needed. Signed-off-by: Lei Huang <huanglei@kylinos.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-27media: s2255: Remove unnecessary debug logging and out-of-memory messagesLei Huang
Fix all 5 'WARNING: Unnecessary ftrace-like logging - prefer using ftrace' issues reported by checkpatch.pl in s2255drv.c. Remove dprintk/dev_info calls that only print the function name, as ftrace can provide the same function tracing information. Fix all 3 'WARNING: Possible unnecessary 'out of memory' message' issues reported by checkpatch.pl in s2255drv.c. The kernel's memory allocator already prints a warning on allocation failure, making these messages redundant. Signed-off-by: Lei Huang <huanglei@kylinos.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-27media: s2255: Remove unnecessary return statements from void functionsLei Huang
Fix all 7 'WARNING: void function return statements are not generally useful' issues reported by checkpatch.pl in s2255drv.c. Remove trailing 'return;' statements that immediately precede the closing brace in void functions. Signed-off-by: Lei Huang <huanglei@kylinos.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-27media: s2255: Fix block comment style to kernel formatLei Huang
Fix all 'WARNING: Block comments use * on subsequent lines' and 'WARNING: Block comments use a trailing */ on a separate line' issues reported by checkpatch.pl in s2255drv.c. Convert block comments to kernel-style format with leading '*' on continuation lines and '*/' on its own line. Convert banner-style separator comments to single-line format. Signed-off-by: Lei Huang <huanglei@kylinos.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-27media: s2255: Add blank lines after variable declarationsLei Huang
Fix all 22 'WARNING: Missing a blank line after declarations' issues reported by checkpatch.pl in s2255drv.c. Insert a blank line between local variable declarations and the first statement in each function. Signed-off-by: Lei Huang <huanglei@kylinos.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-27media: s2255: Parenthesize macro argument to avoid precedence issuesLei Huang
Fix 'CHECK: Macro argument 'dev' may be better as '(dev)' to avoid precedence issues' reported by checkpatch.pl in s2255drv.c. Wrap the 'dev' macro argument in parentheses in the dprintk macro. Signed-off-by: Lei Huang <huanglei@kylinos.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-27media: s2255: Remove unnecessary parentheses around conditionsLei Huang
Fix all 11 'CHECK: Unnecessary parentheses around' issues reported by checkpatch.pl in s2255drv.c. Remove redundant inner parentheses from if-condition expressions where operator precedence already guarantees the correct evaluation order. Signed-off-by: Lei Huang <huanglei@kylinos.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-27media: s2255: Add spaces around multiplication operatorsLei Huang
Fix all 3 'CHECK: spaces preferred around that '*' (ctx:VxV)' issues reported by checkpatch.pl in s2255drv.c. Add spaces around the multiplication operators in the SYS_FRAMES_MAXSIZE macro. Signed-off-by: Lei Huang <huanglei@kylinos.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-27media: s2255: Add blank lines after function/struct/enum declarationsLei Huang
Fix all 2 'CHECK: Please use a blank line after function/struct/union/enum declarations' issues reported by checkpatch.pl in s2255drv.c. Signed-off-by: Lei Huang <huanglei@kylinos.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-27media: s2255: Remove multiple blank lines and before close bracesLei Huang
Remove all 9 instances of double blank lines: 'CHECK: Please don't use multiple blank lines' reported by checkpatch.pl in s2255drv.c. Fix all 3 'CHECK: Blank lines aren't necessary before a close brace' issues reported by checkpatch.pl in s2255drv.c. Signed-off-by: Lei Huang <huanglei@kylinos.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-27media: s2255: Fix alignment to match open parenthesisLei Huang
Fix all 16 'CHECK: Alignment should match open parenthesis' issues reported by checkpatch.pl in s2255drv.c. Adjust continuation line indentation in function declarations, if-conditions, function calls, and block comments to properly align with the opening parenthesis. Signed-off-by: Lei Huang <huanglei@kylinos.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-27media: s2255: Replace NULL comparisons with ! notationLei Huang
Fix all 15 'CHECK: Comparison to NULL could be written' issues reported by checkpatch.pl in s2255drv.c. Replace 'x == NULL' with '!x' for pointer NULL checks. Signed-off-by: Lei Huang <huanglei@kylinos.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-27media: s2255: Use consistent braces on all arms of if/else statementsLei Huang
Fix all 5 'CHECK: braces {} should be used on all arms of this statement' issues reported by checkpatch.pl in s2255drv.c. Add braces to else and else-if branches that were missing them for consistency with other branches. Signed-off-by: Lei Huang <huanglei@kylinos.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-27media: s2255: Remove unnecessary spaces after castsLei Huang
Fix all 8 'CHECK: No space is necessary after a cast' issues reported by checkpatch.pl in s2255drv.c. Remove the space between the cast type and the value being cast. Signed-off-by: Lei Huang <huanglei@kylinos.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-27media: s2255: Rename remaining CamelCase identifiers to snake_caseLei Huang
Rename CamelCase identifiers throughout s2255drv.c to comply with the Linux kernel coding style. All identifiers are local to this file (no header file or cross-file references). Struct members: ulState -> state dwFrames -> num_frames Function parameters (s2255_vendor_req, also updating the forward declaration to match): Request -> req Index -> index Value -> value TransferBuffer -> xfer_buf TransferBufferLength -> xfer_buf_len bOut -> is_out Local variables: pY/pCb/pCr -> p_y/p_cb/p_cr linesPerFrame -> lines_per_frame pixelsPerLine -> pixels_per_line outImageSize -> out_image_size usbInSize -> usb_in_size transBuffer -> trans_buf pRel -> p_rel No functional changes. Signed-off-by: Lei Huang <huanglei@kylinos.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-27media: s2255: Rename CamelCase goto labels to snake_caseLei Huang
Rename the error-path goto labels in s2255_probe() from CamelCase to snake_case to comply with the Linux kernel coding style: errorBOARDINIT -> err_boardinit errorFWMARKER -> err_fwmarker errorREQFW -> err_reqfw errorFWDATA2 -> err_fwdata2 errorFWURB -> err_fwurb errorEP -> err_ep errorUDEV -> err_udev errorFWDATA1 -> err_fwdata1 No functional changes; all label definitions and goto references are updated consistently. Signed-off-by: Lei Huang <huanglei@kylinos.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-20drm/i915/backlight: Remove DP_EDP_BACKLIGHT_AUX_ENABLE_CAP check for DPCD ↵Suraj Kandpal
backlight Turns out some panels allow only AUX based backlight by just setting the DP_EDP_BACKLIGHT_BRIGHTNESS_AUX_SET_CAP and not setting the DP_EDP_BACKLIGHT_AUX_ENABLE_CAP. If we make DP_EDP_BACKLIGHT_AUX_ENABLE_CAP a necessity for AUX based DPCD backlight these panels loose the ability to manipulate backlight via AUX, especially ones with no PWM controller. Remove this check from function so that panels who do not advertise DP_EDP_BACKLIGHT_AUX_ENABLE_CAP but advertise DP_EDP_BACKLIGHT_BRIGHTNESS_AUX_SET_CAP are able to manipulate backlight again. Fixes: ed8be780bdbc ("drm/i915/backlight: Fix VESA backlight possible check condition") Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/work_items/16507 Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com> Reviewed-by: Michał Grzelak <michal.grzelak@intel.com> Link: https://patch.msgid.link/20260716030959.436430-1-suraj.kandpal@intel.com
2026-07-19perf stat: Add --hide-zero-events option to suppress zero-count eventsAaron Tomlin
When monitoring a large number of events (e.g., with wildcards such as --event 'syscalls:sys_enter_*'), many matched events will return a count of zero. This clutters the output, making it difficult to spot the active events. Add a new option --hide-zero-events to suppress printing events that have a count of zero. To prevent formatting and diagnostic issues, the zero-skipping logic implements the following rules: 1. In metric-only mode (i.e., --metric-only), columns must remain aligned in the output grid. We evaluate config->metric_only first to avoid skipping zero-valued columns, preventing values from shifting left and aligning under incorrect headers 2. For explicitly requested events, we ensure they are not silently hidden if they are unsupported. We only hide a zero-count event if counter->supported is true, ensuring that unsupported explicit events still report "<not supported>" Signed-off-by: Aaron Tomlin <atomlin@atomlin.com> Reviewed-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-20drm/xe/xe_ras: Add support to query device memory errorsRiana Tauro
Add initial support to query uncorrectable device memory errors from system controller. The recovery action for memory errors depends on the error category. Firmware will set only one error category per response. Double bit ECC (Error Correcting Code) errors will be handled using Page offlining in a later patch. Poison and data parity errors are only logged. Rest of the errors require SBR (Secondary Bus Reset) to recover. Cc: Tejas Upadhyay <tejas.upadhyay@intel.com> Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com> Reviewed-by: Mallesh Koujalagi <mallesh.koujalagi@intel.com> Link: https://patch.msgid.link/20260717141650.2487761-8-riana.tauro@intel.com Signed-off-by: Riana Tauro <riana.tauro@intel.com>