summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
11 daysASoC: tlv320aic32x4: move regmap_config into i2c and spi driversDmitry Torokhov
Move regmap_config definitions to be static const structures in tlv320aic32x4-i2c.c and tlv320aic32x4-spi.c instead of dynamically modifying a shared base regmap_config at runtime during probe. Export aic32x4_regmap_pages so both bus drivers can reference page ranges. In addition, validate regmap initialization immediately upon creation in both bus probe routines and remove the redundant error check from core aic32x4_probe. Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Link: https://patch.msgid.link/20260726010519.117805-4-dmitry.torokhov@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
11 daysASoC: tlv320aic32x4: consolidate programming functionsDmitry Torokhov
Consolidate setting up of GPIO functions instead of repeating almost the same code block 5 times. Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Link: https://patch.msgid.link/20260726010519.117805-3-dmitry.torokhov@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
11 daysASoC: tlv320aic32x4: do not allocate gpio config separatelyDmitry Torokhov
Now that the driver only works with device tree we do not need to keep GPIO config separate from the driver structure. Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Link: https://patch.msgid.link/20260726010519.117805-2-dmitry.torokhov@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
11 daysASoC: tlv320aic32x4: remove global header with platform dataDmitry Torokhov
Commit 69d5b62c4bde ("ASoC: codec: tlv320aic32x4: Drop aic32x4_pdata usage") removed support for platform data, but left a global header file with #defines and platform data structure. Move the contents to the driver-private header. Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Link: https://patch.msgid.link/20260726010519.117805-1-dmitry.torokhov@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
12 daysapparmor: compressed_data not described in aa_get_data_from_compressedJohn Johansen
Warning: security/apparmor/apparmorfs.c:501 function parameter 'compressed_data' not described in 'aa_get_data_from_compressed' Warning: security/apparmor/apparmorfs.c:501 function parameter 'compressed_data' not described in 'aa_get_data_from_compressed' Warning: security/apparmor/apparmorfs.c:501 function parameter 'compressed_data' not described in 'aa_get_data_from_compressed' Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202607240144.4iqulDF1-lkp@intel.com/ Signed-off-by: John Johansen <john.johansen@canonical.com>
12 daysARM: dts: BCM5301X: EA9200: fix NVRAM sizeRosen Penev
Fixes: [ 0.182121] WARNING: CPU: 0 PID: 1 at drivers/nvmem/brcm_nvram.c:85 brcm_nvram_probe+0x400/0x480 [ 0.182159] Unexpected (big) NVRAM size: 1056112 B Fixes: 90a77291ac09 ("ARM: dts: BCM5301X: R8000 add NVRAM with MAC address for WAN port") Signed-off-by: Rosen Penev <rosenp@gmail.com> Link: https://lore.kernel.org/r/20260628231049.1248899-1-rosenp@gmail.com Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
12 daysARM: dts: BCM5301X: fix PCIe controller 2 second interruptRosen Penev
PCIe controller 2 has interrupts 0-4 mapping to GIC SPI 138-142. The mapping for interrupt 1 was incorrectly set to 138 due to a copy-paste error. Fix it to 139. Assisted-by: opencode:big-pickle Signed-off-by: Rosen Penev <rosenp@gmail.com> Link: https://lore.kernel.org/r/20260725215722.9323-1-rosenp@gmail.com Fixes: 3b3e35b279be ("ARM: dts: BCM5301X: Relicense AXI interrupts code to the GPL 2.0+ / MIT") Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
12 dayss390/configs: Increase CONFIG_LOCKDEP_CHAINS_BITSChristian Borntraeger
With btrfs and other complex code paths the message BUG_MAX_LOCKDEP_CHAIN_HLOCKS_TOO_LOW is triggered. To avoid disabling lockdep increase CONFIG_LOCKDEP_CHAINS_BITS to 18. Acked-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
12 dayss390: Add support for DCACHE_WORD_ACCESS (again)Heiko Carstens
Implement load_unaligned_zeropad() and enable DCACHE_WORD_ACCESS to speed up string operations in fs/dcache.c and fs/namei.c. With the secure storage access exception cases addressed, add support for DCACHE_WORD_ACCESS again. Tested-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Reviewed-by: Sven Schnelle <svens@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
12 dayss390/mm: Use goto statement in do_secure_storage_access()Heiko Carstens
Make do_secure_storage_access() look more like the do_exception() by using a goto statement to get rid of an extra open coded mmap_read_unlock() call. Just cosmetic, no functional change. Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
12 dayss390/mm: Use handle_fault_error() in do_secure_storage_access()Heiko Carstens
Similar to the normal exception handler use handle_fault_error() which handles accesses from user space and kernel space differently. This also addresses failing kernel accesses via e.g. copy_from_user() to user space: instead of an endless loop, the fixup handling is performed. Even though this could only happen if arch_make_folio_accessible() would permanently fail, which is not realistic. Therefore this is rather a cleanup patch. Acked-by: Vasily Gorbik <gor@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
12 dayss390/mm: Remove folio handling for kernel faults in do_secure_storage_access()Heiko Carstens
Remove folio handling for secure storage access exceptions that happen via the kernel mapping. Using folio_try_get() for exceptions via the kernel mapping is racy: for example such an exception may happen on one CPU, while a different CPU frees the corresponding page. Subsequently the page can be part of a folio of different size, before the faulting CPU executes folio_try_get(). This may lead to data corruption. As of now this scenario does not seem to be possible, however with the upcoming load_unaligned_zeropad() this is possible. As a side effect PG_arch_1 is not cleared anymore for such faults via the kernel mapping. However given that this bit is over-indicating it shouldn't matter. Tested-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Acked-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
12 dayss390/mm: Fix handling of vmalloc area in do_secure_storage_access()Heiko Carstens
Secure storage access exceptions in vmalloc area need to be handled separately since virt_to_phys() does not work on such addresses. Given that there cannot be a valid access let such exceptions fail immediately. The kernel will either fixup or crash. Tested-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>> --- Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
12 dayss390/mm: Use lock_mm_and_find_vma() in do_secure_storage_access()Heiko Carstens
do_secure_storage_access() uses find_vma() without verifying that the faulting address is within the returned vma. Add this missing check by converting to lock_mm_and_find_vma(). This is not a critical fix, since the worst that could happen is a WARN_ON_ONCE() in folio_walk_start(). Reported-by: sashiko-bot <sashiko-bot@kernel.org> Closes: https://lore.kernel.org/all/20260717093904.E4A421F00A3E@smtp.kernel.org/ Link: https://lore.kernel.org/all/20260717093904.E4A421F00A3E@smtp.kernel.org/ Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
12 dayss390/mm: Add missing mm check to do_secure_storage_access()Heiko Carstens
Similar like the normal exception handler the secure storage access exception handler needs to verify if mm is not NULL, which may happen with kernel threads. Reported-by: sashiko-bot <sashiko-bot@kernel.org> Closes: https://lore.kernel.org/all/20260717132345.539A11F00A3A@smtp.kernel.org/ Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>> --- Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
12 daysKVM: s390: pv: Use VM_SPARSE area for guest variable storage areaHeiko Carstens
The guest variable storage area is allocated with vmalloc and then donated to the ultravisor. Any kernel access to that area will result in a secure storage access exception (aka fault). This is a problem if such a memory area is read via /proc/kcore. This causes an exception via vread_iter() and results in an unexpected short read. Avoid this by allocating a custom VM_SPARSE area. If such an area is read, vread_iter() returns zeroes for the entire area. Note that the function which frees the area does not update ptes. This is intentional to allow for deferred / lazy pte updates and TLB flushing like the generic vfree() code is doing that. See vunmap_pte_range(). This assumes that s390 will gain full support for lazy_mmu_mode_enable() and lazy_mmu_mode_disable() in the future, since as of now the used ptep_get_and_clear() in vunmap_pte_range() does indeed invalidate and flush every single pte entry, but only for s390. Tested-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
12 dayss390/spinlock: Add contention tracepoints to lock slowpathCiunas Bennett
Instrument arch_spin_lock_wait() with trace_contention_begin() and trace_contention_end(). These tracepoints are used by lock contention analysis tools such as perf lock contention to identify contended locks and measure wait times. Both the generic implementation and powerpc emit the same events from their spinlock slow path. Place the tracepoints in arch_spin_lock_wait(), which is only entered when lock acquisition falls back to the contention path. Acked-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Ciunas Bennett <ciunas@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
12 dayss390/ipl: Improve readabilityMete Durlu
Use explicit decleration on all shutdown_action/shutdown_trigger declerations and reformat shutdown_actions_list decleration to improve readability. No functional changes. Signed-off-by: Mete Durlu <meted@linux.ibm.com> Acked-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
12 dayss390/ipl: Use ARRAY_SIZE macroMete Durlu
Use ARRAY_SIZE macro instead of reimplementing it. Signed-off-by: Mete Durlu <meted@linux.ibm.com> Acked-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
12 dayss390/maccess: Use proper PTE accessors for copying old memoryAlexander Gordeev
Follow the pattern established by commit c33c794828f2 ("mm: ptep_get() conversion") and use proper PTE accessors instead of a direct pointer dereference in memcpy_real_iter(). Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com> Reviewed-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
12 dayss390/pkey: Rework ioctl functions error pathsHarald Freudenberger
With the pkey rework there was the suggestion to rework the error and free paths of the pkey ioctl functions. The complain was especially to rewrite the failure handling with goto instead of all repeat the nearly same code (kfree(), kfree_sensitive(), memzero_explicit()) for each path. This patch removes all this duplicated code and introduces one code block at the end of the functions which is jumped into via goto out or executed on regular exit. As some helper functions return an error pointer value (which is NOT NULL) make sure on the error path there is not by accident kfree() or similar called on such ptr values. Suggested-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Harald Freudenberger <freude@linux.ibm.com> Reviewed-by: Finn Callies <fcallies@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
12 dayss390/ap: Use mutex_lock_killable() in ap_bus_force_rescan()Harald Freudenberger
A deep dive into the AP bus code and zcrypt device driver about the usage of mutex locking showed that there is one questionable call in ap_bus.c in function ap_bus_force_rescan(). This function may be called in kernel and process context. In both contexts only one info is important: was there a AP bus scan running and did it result in some updates on the AP devices. So only true/false is returned but no info like -EINTR. But still the mutex lock call should be interruptible to be able to kill a user space program blocked forever on this. So this patch replaces mutex_lock_interruptible() with mutex_lock_killable() to be able to handle SIGKILL especially in user space process context. Suggested-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Harald Freudenberger <freude@linux.ibm.com> Reviewed-by: Finn Callies <fcallies@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
12 dayss390/vdso: Use symbolic constants for the PHDR permission flagsJens Remus
While at it explicitly specify GNU_EH_FRAME PHDR to be read-only. Inspired by x86 commit 8717b02b8c03 ("x86/entry/vdso: Include GNU_PROPERTY and GNU_STACK PHDRs"). Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com> Acked-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Jens Remus <jremus@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
12 dayss390/vdso: Pass --eh-frame-hdr to the linkerJens Remus
Commit 2b2a25845d53 ("s390/vdso: Use $(LD) instead of $(CC) to link vDSO") accidentally broke the GNU_EH_FRAME program table entry in the vDSO, causing it to be empty: $ readelf --program-headers arch/s390/kernel/vdso/vdso.so ... Program Headers: Type Offset VirtAddr PhysAddr FileSiz MemSiz Flags Align ... GNU_EH_FRAME 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x8 ... Originally, the compiler would implicitly add --eh-frame-hdr when invoking the linker, but when this Makefile was converted from invoking the linker via the compiler, to invoking it directly, the option was missed. This is the s390 variant of x86 commit cd01544a268a ("x86/vdso: Pass --eh-frame-hdr to the linker"). Fixes: 2b2a25845d53 ("s390/vdso: Use $(LD) instead of $(CC) to link vDSO") Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com> Acked-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Jens Remus <jremus@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
12 dayss390/syscalls: Use define instead of '1' to indicate PER trapSven Schnelle
Make the code a bit easier to read by defining SYSCALL_PER_TRAP instead of passing '1' to __do_syscall(). Suggested-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Sven Schnelle <svens@linux.ibm.com> Reviewed-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
12 dayss390/traps: Remove PIF_GUEST_FAULTSven Schnelle
PIF_GUEST_FAULT is only used to pass information whether a fault was caused when executing SIE or when executing host code. Instead of using ptregs for this, just pass the flag directly as argument to __do_pgm_check(). This also saves the time required to read the flag from ptregs, although this likely isn't much as it is already in the data cache. Signed-off-by: Sven Schnelle <svens@linux.ibm.com> Reviewed-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
12 dayss390/uapi: Remove obsolete unistd_32.h from Kbuild fileThomas Huth
unistd_32.h is not build anymore since commit 4ac286c4a8d90 ("s390/syscalls: Switch to generic system call table generation"). Thus drop the superfluous line from the Kbuild file now, too. Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
12 dayss390: Select SWIOTLB_DYNAMIC and DMA_COHERENT_POOLJaehoon Kim
SWIOTLB_DYNAMIC allows the SWIOTLB to grow on demand when the initial bounce-buffer area is exhausted, instead of relying only on the pool reserved at boot. This improves behavior under sustained I/O pressure. In testing, exhaustion of the initial SWIOTLB area was observed under real workloads such as large file transfers and package installation workloads, where continued availability of bounce buffering was needed to avoid guest-visible I/O stalls or failures. When the current SWIOTLB capacity is exhausted, the dynamic expansion path schedules asynchronous pool growth and then attempts immediate non-blocking allocation of transient bounce-buffer memory. In that path, the current implementation uses the generic DMA coherent atomic pool for transient bounce-buffer allocations. Selecting DMA_COHERENT_POOL together with SWIOTLB_DYNAMIC on s390 makes that atomic fallback path available. The coherent atomic pool is a generic DMA facility. By default, its size is 128 KiB per 1 GiB of memory, with a minimum default size of 128 KiB, and it can be adjusted with the coherent_pool= kernel parameter. The pool itself can be exhausted, so this improves behavior under pressure, but does not guarantee that DMA mappings will always succeed. Select both options from s390 Kconfig so this support is available by default on s390 systems. Signed-off-by: Jaehoon Kim <jhkim@linux.ibm.com> Acked-by: Niklas Schnelle <schnelle@linux.ibm.com> Reviewed-by: Halil Pasic <pasic@linux.ibm.com> Tested-by: Joshua Daley <jdaley@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
12 dayss390/pv: Enable SWIOTLB_ANY for s390 PVJaehoon Kim
In s390 protected virtualization (PV) environments, guests use SWIOTLB for virtio DMA. Because SWIOTLB_ANY is currently not passed to swiotlb_init(), the SWIOTLB buffer is allocated from low memory, i.e. from the first 2G of the physical address space on s390. This restriction is unnecessary for s390 PV guests and limits the available address range for the SWIOTLB buffer. In turn, that can limit the maximum practical SWIOTLB size and make larger allocations more likely to fail at boot, especially under memory fragmentation. Pass SWIOTLB_ANY in pv_init() so the SWIOTLB buffer can be allocated from any suitable memory instead of being restricted to low memory. Signed-off-by: Jaehoon Kim <jhkim@linux.ibm.com> Acked-by: Christian Borntraeger <borntraeger@linux.ibm.com> Reviewed-by: Halil Pasic <pasic@linux.ibm.com> Tested-by: Joshua Daley <jdaley@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
12 daysASoC: rt722: reset codec to fix abnormal soundShuming Fan
The audio output may become abnormal after a warm reboot from Windows. Reset the codec once during hardware initialization to restore it to a known state and prevent the issue. BugLink: https://github.com/thesofproject/linux/issues/5845 Signed-off-by: Shuming Fan <shumingf@realtek.com> Link: https://patch.msgid.link/20260728090111.3676617-1-shumingf@realtek.com Signed-off-by: Mark Brown <broonie@kernel.org>
12 daysdrm/amd/display: Exit idle optimizations before programmingLeo Li
[Why] We need to exit PSR/IPS before programming. Before calling DC for programming in amdgpu_dm_commit_planes(), there's a vblank_control_workqueue flush. This waits for IPS and PSR exit. (See drm_vblank_on/off() > amdgpu_dm_crtc_set_vblank() --queue_work()-> amdgpu_dm_crtc_vblank_control_worker()) Prior to the tagged "Fixes:" change, drm_vblank_get() was called before the workqueue flush. This ordering ensures that PSR exit occurred before programming. After the "Fixes:" change, drm_vblank_get() is called after the workqueue flush, leading to programming while idle optimizations are still active. This can lead to incorrect flip_pending detection used by vblank event delivery. [How] Split the vblank_get() component of `dm_arm_vblank_event()` into `dm_arm_vblank_event_pre_programming()`, which is called before programming. Call it before the vblank_control_workqueue flush. Includes a drive-by cleanup of prepare_flip_isr(): the only caller is dm_arm_vblank_event() and it's simple enough to roll-in. v2: Fix checkpatch formatting warning on drm_arm_vblank_event_pre_programming() arg alignment. Fixes: 48ab86360af1 ("drm/amd/display: check GRPH_FLIP status before sending event") Cc: stable@vger.kernel.org Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/4141#note_3583205 Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/5527 Assisted-by: Codex:gpt-5.6-sol Assisted-by: Claude:opus-5 Suggested-by: David Weber <weber.aulendorf@gmail.com> Signed-off-by: Leo Li <sunpeng.li@amd.com> Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 05984e29520a28c27f5a2388742c957a6a87ee7a)
12 daysdrm/amd/pm: hide pp_table sysfs on APUsYang Wang
APUs use firmware-owned DPM tables and do not support replacement through pp_table. Generic callbacks can nevertheless expose the sysfs file and accept an upload before resetting the power management stack. Treat pp_table as unsupported on APUs. Use the same platform check in the get and set paths to hide the file and reject uploads. Fixes: 289921b03fe5 ("drm/amd/powerplay: implement sysfs of pp_table for smu11 (v2)") Signed-off-by: Yang Wang <kevinyang.wang@amd.com> Reviewed-by: Kenneth Feng <kenneth.feng@amd.com> Reviewed-by: Asad Kamal <asad.kamal@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 74f28db2db69777cd2f059d50fe34e365ddd5add) Cc: stable@vger.kernel.org
12 daysmedia: stm32: dcmi: fix some error handling bugs in probe()Dan Carpenter
There are a few issues here: 1) After we assign: chan = dma_request_chan(&pdev->dev, "tx"); Then the error paths need to clean up before returning. The first error path does a direct return. 2) The error paths check "dcmi->mdma_chan" but that is not assigned until later so it results in memory leaks. Test "mdma_chan" instead. 3) The error handling calls dma_release_channel(dcmi->dma_chan) before "dcmi->dma_chan" has been assigned which leads to a NULL pointer dereference. Use the "chan" variable instead. I also moved the call to dma_release_channel() after the call to dma_release_channel() so it mirrors the allocation code better. Fixes: bc901885fae0 ("media: stm32: dcmi: perform dmaengine_slave_config at probe") Signed-off-by: Dan Carpenter <error27@gmail.com> Acked-by: Alain Volmat <alain.volmat@foss.st.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
12 daysmedia: i2c: imx471: Fix uninitialized error value in imx471_set_ctrl()David Carlier
The exposure and vertical blanking writes pass the address of the local ret variable to cci_write() as its error pointer, but there is no earlier error to propagate: each case is a single standalone write, like the other controls in the same switch that already pass NULL. In the exposure case ret is still uninitialized, so a non-zero stack value makes cci_write() return early without programming the register, and the control write reports a bogus status. The vertical blanking case is benign today because ret is zero there, but the construct is equally wrong. Pass NULL as the error pointer in both cases. Fixes: be1589e567ae ("media: i2c: imx471: Add Sony IMX471 image sensor driver") Suggested-by: Kate Hsuan <hpa@redhat.com> Signed-off-by: David Carlier <devnexen@gmail.com> Reviewed-by: Kate Hsuan <hpa@redhat.com> Reviewed-by: Tarang Raval <tarang.raval@siliconsignals.io> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
11 daysmedia: qcom: camss: Rename unused macro parameterHungyu Lin
The ISPIF_VFE_m_RDI_INTF_n_PACK_CFG_0_CID_c_PLAIN() macro declares a parameter named 'c' but uses 'cid' in the macro body instead. Rename the parameter to match the identifier used in the macro body and silence the checkpatch warning: WARNING: Argument 'c' is not used in function-like macro No functional change intended. Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Reviewed-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org> Signed-off-by: Hungyu Lin <dennylin0707@gmail.com> Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
11 daysdt-bindings: media: qcom: Add Shikra CAMSS compatibleNihal Kumar Gupta
Shikra contains the same Camera Subsystem IP as QCM2290. Document the platform-specific compatible string, using qcom,qcm2290-camss as fallback. Unlike QCM2290, Shikra omits the CDM and OPE blocks, requiring only a single IOMMU context bank instead of four. Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Reviewed-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org> Signed-off-by: Nihal Kumar Gupta <nihal.gupta@oss.qualcomm.com> Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
11 daysmedia: iris: disable time-delta-based rate control for VBRGourav Kumar
The iris encoder driver was not sending HFI_PROP_TIME_DELTA_BASED_RATE_CONTROL to the firmware during encoder initialization. Without this property, the firmware defaults to time-delta-based rate control (enabled), which calculates the output bitrate from actual frame timing rather than following the configured bitrate target. This caused variable bitrate (VBR) encoding to produce ~5x configured bitrate. For example, with video_bitrate=896000 (896 Kbps), the output is ~4.4 Mbps instead of the expected ~896 Kbps. Time-delta-based rate control is designed for variable frame rate (VFR) scenarios where the encoder adapts to actual frame timing. However, when an application explicitly configures a bitrate target, the firmware must follow that target regardless of frame timing. Fix this by adding the TIME_DELTA_BASED_RC capability with a default value of 0 (disabled) and sending HFI_PROP_TIME_DELTA_BASED_RATE_CONTROL = 0 to the firmware during stream-on, allowing the firmware to use the configured bitrate as the target. Signed-off-by: Gourav Kumar <gouravk@qti.qualcomm.com> Signed-off-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com> Reviewed-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com> Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
11 daysmedia: iris: Add support for Milos (VPU v2.0)Alexander Koskovich
Add support for the Milos Iris codec. This only supports the variant found on the SM7635-AB that has half of it's pipes disabled via efuse. Signed-off-by: Alexander Koskovich <akoskovich@pm.me> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
11 daysdt-bindings: media: qcom,milos-iris: Add Milos video codecAlexander Koskovich
Add binding for Qualcomm Milos Iris video codec. Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Alexander Koskovich <akoskovich@pm.me> Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
11 daysmedia: qcom: iris: Add request key frame support for encoderWangao Wang
Add request key frame support for both gen1 and gen2 encoders by enabling V4L2_CID_MPEG_VIDEO_FORCE_KEY_FRAME. Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Reviewed-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com> Signed-off-by: Wangao Wang <wangao.wang@oss.qualcomm.com> Reviewed-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com> Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
11 daysmedia: iris: Add Gen2 firmware autodetect and fallbackDikshita Agarwal
Some Iris platforms support both Gen1 and Gen2 HFI firmware images. Update the firmware loading logic to handle this generically by preferring Gen2 when available, while safely falling back to Gen1 when required. The firmware loading logic is updated with the following priority: 1. Device Tree (`firmware-name`): If specified, load unconditionally. 2. Gen2 default : If no DT override exists, select the Gen2 firmware descriptor when present and attempt to load the corresponding firmware image. 3. Gen1 Fallback: If loading the Gen2 firmware fails and a Gen1 descriptor is available, retry with the Gen1 firmware image. When a platform provides both Gen1 and Gen2 firmware descriptors and the firmware is loaded via a DT override, the driver detects the firmware generation at runtime before authentication by inspecting the firmware data. The firmware is classified as Gen2 if the QC_IMAGE_VERSION_STRING starts with "vfw" or matches the "video-firmware.N.M" format with N >= 2. If a Gen1 firmware image is detected in this case, the driver switches to the Gen1 firmware descriptor and associated platform data so that the correct HFI implementation is used. This change makes firmware generation detection platform‑agnostic, preserves DT overrides, prefers newer Gen2 firmware when available, and maintains compatibility with platforms that only support Gen1. Signed-off-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com> Reviewed-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com> Co-developed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
11 daysmedia: venus: Annotate flex arrays with __counted_by()Mohammed EL Kadiri
Add __counted_by() annotations to flexible array members: - hfi_capabilities::data, counted by num_capabilities - hfi_profile_level_supported::profile_level, counted by profile_count - hfi_resource_ocmem_requirement_info::requirements, counted by num_entries This improves run-time bounds checking via CONFIG_UBSAN_BOUNDS and compile-time object size resolution via __builtin_dynamic_object_size(). Assisted-by: Claude:claude-opus-4 Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Mohammed EL Kadiri <med08elkadiri@gmail.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
11 daysmedia: qcom: iris: use disable_irq() during power-offHungyu Lin
The IRQ is registered as a threaded IRQ. Using disable_irq_nosync() in iris_vpu_power_off() does not wait for an already queued threaded IRQ handler to complete before returning. As a result, a threaded IRQ handler may still run after the VPU has been powered down and access hardware registers after power-off. Replace disable_irq_nosync() with disable_irq() so the power-off path waits for any in-flight threaded IRQ handler to complete before returning. Fixes: bb8a95aa038e ("media: iris: implement power management") Cc: stable@vger.kernel.org Suggested-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Hungyu Lin <dennylin0707@gmail.com> Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
11 daysmedia: qcom: iris: initialize OPP pointer at declarationHungyu Lin
Initialize the managed OPP pointer at declaration rather than assigning it in a separate statement. This avoids a checkpatch warning about a potentially uninitialized managed pointer. Signed-off-by: Hungyu Lin <dennylin0707@gmail.com> Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
11 daysmedia: qcom: iris: handle runtime PM resume failure in core deinitHungyu Lin
Check the return value of pm_runtime_resume_and_get() in iris_core_deinit(). If runtime PM resume fails, skip hardware power-off operations but still perform software teardown and state transition. Also skip the corresponding pm_runtime_put_sync() call to avoid unbalanced runtime PM references. Fixes: bb8a95aa038e ("media: iris: implement power management") Signed-off-by: Hungyu Lin <dennylin0707@gmail.com> Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
11 daysmedia: qcom: venus: add callback parameter namesHungyu Lin
Naming the callback parameters improves readability and resolves checkpatch warnings about unnamed function pointer arguments. No functional change intended. Signed-off-by: Hungyu Lin <dennylin0707@gmail.com> Reviewed-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
11 daysmedia: iris: Enumerate cap->bus_info to differentiate between encoder and ↵Bryan O'Donoghue
decoder commit 66c744e28b69 ("media: venus: assign unique bus_info strings for encoder and decoder") introduced the naming convention plat:node-addr:video-codec{enc|dec}. Right now Iris does not replicate this naming convention. When we do v4l2-ctrl --list -devices we see: Iris Decoder (platform:aa00000.video-codec): /dev/video0 /dev/video1 Enumerate the bus_info field of the capabilities structure for namespace parity and appropriate differentiation: Iris Decoder (plat:aa00000.video-codec:dec): /dev/video0 Iris Encoder (plat:aa00000.video-codec:enc): /dev/video1 Fixes: 5ad964ad5656 ("media: iris: Initialize and deinitialize encoder instance structure") Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
11 daysmedia: qcom: iris: Make iris_destroy_internal_buffer() return voidDikshita Agarwal
iris_destroy_internal_buffer() is guaranteed to succeed and never reports an error. Returning an int is misleading and forces callers to handle a meaningless status value. Convert it to return void to match its behavior and simplify callers. Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com> Signed-off-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com> Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
11 daysmedia: qcom: iris: Add missing break in iris_hfi_gen2_session_set_codec()Dikshita Agarwal
Without the break the AV1 case falls through, risking unintended behaviour if new cases are added after it. Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com> Signed-off-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com> Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
11 daysmedia: qcom: iris: Remove duplicate HFI_PROP_OPB_ENABLE entryDikshita Agarwal
HFI_PROP_OPB_ENABLE/iris_hfi_gen2_set_opb_enable appeared twice in the dispatch table, causing the property to be sent to firmware twice on every config-params call. Fixes: 2af481a459a4 ("media: iris: Define AV1-specific platform capabilities and properties") Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com> Signed-off-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com> Signed-off-by: Bryan O'Donoghue <bod@kernel.org>