summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
9 daysclk: mediatek: reset: Fix device registration kernel-docKarl Mehltretter
The comment for mtk_register_reset_controller_with_dev() names the older helper and documents np rather than dev. The new helper takes a struct device and obtains its device node internally. Use the actual function and parameter names and clarify that failures return negative error codes. Fixes: 761bc64003e3 ("clk: mediatek: reset: Add new register reset function with device") Assisted-by: LLM Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Reviewed-by: Chen-Yu Tsai <wenst@chromium.org> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
9 daysMerge tag 'regulator-fix-v7.3-rc2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "One fix for pf1550 which checked for errors on multiple regulators but always notified via one of them regardless of which one had the problem, plus one device ID addition in the fan53555 DT bindings" * tag 'regulator-fix-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: pf1550: fix which regulator is notified regulator: dt-bindings: fan53555: add tcs,tcs4526
9 daysPCI: endpoint: pci-epf-vntb: Manage virtual NTB and PCI bus lifetimeKoichiro Den
The virtual PCI driver registers an ntb_dev but has no remove callback. Unbinding the endpoint function can therefore free BARs while the NTB device and its client still use them. It also leaves the virtual PCI devices and root bus allocated. Allocate an ntb_dev for each virtual PCI probe and unregister it from the matching remove callback. Start command processing only after registration. Publish the device for doorbell IRQs at the same point. During remove, stop the command work and drain IRQ handlers before unregistering the device. Retain the root bus returned by pci_scan_bus() so it can be removed on unbind. Unregister the virtual PCI driver before releasing endpoint resources. Stop and remove the root bus under the PCI rescan/remove lock, then release its host bridge. Fixes: e35f56bb0330 ("PCI: endpoint: Support NTB transfer between RC and EP") Signed-off-by: Koichiro Den <den@valinux.co.jp> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Cc: stable@vger.kernel.org # 6.0+ Link: https://patch.msgid.link/20260901063238.631166-3-den@valinux.co.jp
9 daysMerge tag 'drm-fixes-2026-09-12' of https://gitlab.freedesktop.org/drm/kernelLinus Torvalds
Pull drm fixes from Dave Airlie: "Weekly fixes pull, this seems relatively quiet for the new world, scattered fixes, mostly amdgpu leading the way, but lots of minor fixes in other drivers. drm_exec: - fix 0 object handling sched: - null ptr deref fix in kunit tests amdgpu: - Freesync fix - GPUVM fix - Debugfs fixes - HDMI fixes - IPS fix - GPU reset fix - RGB quantization fixes - SMU 13.0.x fixes xe: - runtime PM guard fix - cache flushing fix i915: - Fix a memleak on perf config query error path - Fix UHBR SST SDP splitting when sink doesn't support it bridge: - fix ti-sn65dsi83 error handling - tc358768: Enforce input bus flags via atomic_check ast: - fix blend mode property on cursor plane qxl: - fix blend mode property on primary/cursor planes virtio: - fix blend mode property on cursor plane vboxvideo: - fix blend mode property on planes rockchip: - fix endpoint name length - fix Kconfig issues ivpu: - limit firmware log prints to field size - validate buffer range in ivpu address translation - validate fw log buffers ethosu: - ensure SRAM sizing - ensure cmd stream formatting - drop IRQF_SHARED - fix open return value adp: - fix Kconfig logicvc: - fix Kconfig" * tag 'drm-fixes-2026-09-12' of https://gitlab.freedesktop.org/drm/kernel: (38 commits) drm/amd/pm: report energy accumulator for smu 13.0.0 drm/amd/pm: fix gpu metrics energy accumulator for smu 13.0.0/13.0.7 drm/amd/display: Rebuild InfoFrames on output color space changes drm/amd/display: Honor Broadcast RGB for BT.2020 RGB output drm/amd/display: Propagate HDMI RGB quantization selectability Revert "drm/amdgpu: debugfs: avoid extra EOLs in amdgpu_gem_info" drm/amdgpu: skip gfx switch_power_profile during GPU reset drm/amd/display: Fix HF-VSDB DSC bpc detection to be cumulative drm/amd/display: Exit IPS before connector detection on resume drm/amd/display: Shorten hdmi_frl_status_polling_workqueue dm/amdgpu: fix malformed link_settings debugfs output drm/amdgpu: skip the VMID 0 flush for VRAM drm/amd/display: Consult MCCS FreeSync cap only if requested & supported drm/i915: Fix memory leak in query_perf_config_list() drm/i915/dp: Gate UHBR SST SDP splitting on sink capability drm/xe: Flush LSC untyped L1 dataport cache after rcs/ccs batches drm/xe: Guard page-fault worker with runtime PM check drm/bridge: ti-sn65dsi83: Fix error handling in sn65dsi83_reset_work() drm/bridge: tc358768: Enforce input bus flags via atomic_check drm/drm_exec: fix up contended obj when num_objects is 0 ...
9 daysmedia: ipu6: Fix up missing IWYU issueMark Brown
In -next: /tmp/next/build/drivers/media/pci/intel/ipu6/ipu7-fw-isys.c:229:3: error: call to undeclared function 'clflush_cache_range'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 229 | clflush_cache_range(cpu_mapped_buf, size); | ^ Signed-off-by: Mark Brown <broonie@kernel.org> Reviewed-by: Antti Laakso <antti.laakso@linux.intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
9 daysPCI/P2PDMA: Gate the host bridge whitelist warning on verboseLeon Romanovsky
calc_map_type_and_dist() prints every other diagnostic under its verbose argument, but reaches the "Host bridge not in P2PDMA whitelist" warning through host_bridge_whitelist(), which it hands acs_redirects instead. A caller that asked for a silent answer still gets the warning whenever any port on the path has an ACS redirect bit set, the CPU is not whitelisted by cpu_supports_p2pdma(), and the host bridge is not in pci_p2pdma_whitelist[]. pci_p2pmem_find_many() is such a caller. It sweeps every device with published p2pmem and asks for the distance to each client with verbose=false, and pci_p2pdma_distance_many() recomputes rather than consulting the map_types cache, so the warning repeats on every sweep. The argument was never meant to say "ACS redirects were found". When commit cf201bfe8cdc ("PCI/P2PDMA: Warn if host bridge not in whitelist") added it, acs_redirects was a bool pointer that the quiet entry point passed as NULL: if (verbose) map = calc_map_type_and_dist_warn(provider, pci_client, &distance); else map = calc_map_type_and_dist(provider, pci_client, &distance, NULL, NULL); so the argument was true on exactly the path that commit describes. Folding the two entry points into one verbose flag turned the pointer into a value and left the call site alone, silently narrowing the warning to paths that carry an ACS redirect. Pass verbose. This also restores the warning for a verbose caller that takes the host bridge route with no ACS redirect on the path, which until now was told it could not use peer-to-peer DMA without being told which vendor and device would have to be added to the whitelist. Fixes: d1b8dc09dd71 ("PCI/P2PDMA: Simplify distance calculation") Signed-off-by: Leon Romanovsky <leonro@nvidia.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Tested-by: Tushar Dave <tdave@nvidia.com> Reviewed-by: Jason Gunthorpe <jgg@nvidia.com> Reviewed-by: Logan Gunthorpe <logang@deltatee.com> Link: https://patch.msgid.link/20260830-batch-p2p-fixes-v1-5-5044e8dfbe2e@nvidia.com
9 daysPCI/P2PDMA: Safely terminate ACS redirect listsLeon Romanovsky
seq_buf marks an overflow by setting len to size + 1. The ACS diagnostic path unconditionally writes a terminator to buffer[len - 1], so a path with enough ACS ports to fill the 128-byte buffer writes one byte beyond the buffer when verbose diagnostics are requested. Use seq_buf_str() to terminate truncated output safely and remove the final semicolon only when the buffer did not overflow. Fixes: 52916982af48 ("PCI/P2PDMA: Support peer-to-peer memory") Signed-off-by: Leon Romanovsky <leonro@nvidia.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Tested-by: Tushar Dave <tdave@nvidia.com> Reviewed-by: Logan Gunthorpe <logang@deltatee.com> Reviewed-by: Jason Gunthorpe <jgg@nvidia.com> Link: https://patch.msgid.link/20260830-batch-p2p-fixes-v1-4-5044e8dfbe2e@nvidia.com
9 daysPCI/P2PDMA: Restrict the p2pmem search to pool-backed providersLeon Romanovsky
pci_p2pmem_find_many() exists to pick a provider that the caller will then allocate from with pci_alloc_p2pmem(), which goes straight to the gen_pool: ret = (void *)gen_pool_alloc_owner(p2pdma->pool, size, (void **) &ref); pci_has_p2pmem() does not ask for that pool, only for the published flag. The two used to be equivalent, because a provider could only exist by way of pci_p2pdma_add_resource(), which always creates the pool. pcim_p2pdma_init() broke that. It registers a provider for the DMABUF path and never creates a pool, so pdev->p2pdma is set while p2pdma->pool stays NULL. Nothing publishes such a provider today, so the search cannot return one yet, but the flag alone no longer says what the caller needs. Ask for the pool as well, so the search covers the providers its result is used for. A later patch documents the pdev->p2pdma lifetime and RCU rules. Signed-off-by: Leon Romanovsky <leonro@nvidia.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Tested-by: Tushar Dave <tdave@nvidia.com> Reviewed-by: Logan Gunthorpe <logang@deltatee.com> Reviewed-by: Jason Gunthorpe <jgg@nvidia.com> Link: https://patch.msgid.link/20260830-batch-p2p-fixes-v1-3-5044e8dfbe2e@nvidia.com
9 daysPCI/P2PDMA: Wait for RCU readers before freeing stateLeon Romanovsky
pci_p2pmem_find_many() scans all PCI devices without locking or protection against driver unbind, including devices with poolless P2PDMA state. pci_has_p2pmem() may observe pdev->p2pdma just before driver unbind clears it, while pci_p2pdma_release() skips the grace period when no pool is present. This allows devres to free the object while it is still in use. Clear the pointer with RCU_INIT_POINTER() and always wait for pre-existing RCU readers before returning. The same grace period continues to protect gen_pool users for pool-backed providers. Fixes: 372d6d1b8ae3 ("PCI/P2PDMA: Refactor to separate core P2P functionality from memory allocation") Signed-off-by: Leon Romanovsky <leonro@nvidia.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Tested-by: Tushar Dave <tdave@nvidia.com> Reviewed-by: Logan Gunthorpe <logang@deltatee.com> Reviewed-by: Jason Gunthorpe <jgg@nvidia.com> Cc: Alex Williamson <alex@shazbot.org> Cc: Matt Evans <matt@ozlabs.org> Link: https://patch.msgid.link/20260830-batch-p2p-fixes-v1-2-5044e8dfbe2e@nvidia.com
9 daysPCI/P2PDMA: Do not tear down the allocate attribute on registration failureLeon Romanovsky
pci_p2pdma_add_resource() installs pci_p2pdma_unmap_mappings() as a devres action with the devres allocated p2p_pgmap as its data, and only then adds the range to the pool: error = devm_add_action_or_reset(&pdev->dev, pci_p2pdma_unmap_mappings, p2p_pgmap); if (error) goto pages_free; p2pdma = rcu_dereference_protected(pdev->p2pdma, 1); error = gen_pool_add_owner(p2pdma->pool, ...); if (error) goto pages_free; The action removes the allocate attribute for the whole device, which tears down existing userspace mappings of every BAR already registered on it. Both failures here get that wrong, in opposite ways. devm_add_action_or_reset() runs the action when it cannot allocate its devres node, so an -ENOMEM while registering a second BAR unmaps the first one. Use devm_add_action() and let the error path unwind only what this call created. gen_pool_add_owner() allocates a chunk and can also fail with -ENOMEM. There the action is registered, and the error path frees p2p_pgmap with devm_kfree() while leaving the action pointing at it. On unbind devres runs the action and pci_p2pdma_unmap_mappings() dereferences p2p_pgmap->mem->owner->kobj, which is freed memory. Give that failure its own label and drop the action with devm_remove_action(), which removes it without running it. Fixes: 7e9c7ef83d78 ("PCI/P2PDMA: Allow userspace VMA allocations through sysfs") Fixes: f58ef9d1d135 ("PCI/P2PDMA: Separate the mmap() support from the core logic") Signed-off-by: Leon Romanovsky <leonro@nvidia.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Tested-by: Tushar Dave <tdave@nvidia.com> Reviewed-by: Logan Gunthorpe <logang@deltatee.com> Reviewed-by: Jason Gunthorpe <jgg@nvidia.com> Link: https://patch.msgid.link/20260830-batch-p2p-fixes-v1-1-5044e8dfbe2e@nvidia.com
9 daysMerge tag 'riscv-for-linus-7.3-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Paul Walmsley: "From a RISC-V point of view, there's one notable fix here, reverting an earlier bogus fix to the pointer masking code. Fortunately the practical impact appears to be small. - Revert a bad fix, likely LLM-generated, in the pointer masking code that confused the RISC-V hardware pointer masking implementation with the Linux kernel tagged address feature - Fix unexpected faults caused by kprobe instruction slot writes when !CONFIG_STRICT_MODULE_RWX - Fix unexpected faults on minimal configurations during runtime code patching on !CONFIG_STRICT_MODULE_RWX systems - Fix a misplaced variable clear causing incorrect reuse of previous values in the RISC-V hardware feature probing code - Fix two bugs in the PMU SBI perf code on rv32: use BIT_ULL rather than BIT on 64-bit masks; and use a bitmap rather than an unsigned long on a quantity that can exceed 32 bits And a few miscellaneous cleanups: - Avoid a potential dereference-before-NULL-pointer-check bug in the PMU SBI perf driver - Use CONFIG_GENERIC_BUG_RELATIVE_POINTERS to simplify the rv32 bug table code (like x86 and PPC) - Report the RISC-V standard ISA extensions Z[v]fhmin when support is claimed for the superset RISC-V standard ISA extensions Z[v]fh; and simplify our FPU test code to only check for the presence of the D extension - Use an existing kernel string helper in place of some open-coded code in kernel/usercfi.c - Fix some yamllint issues in the RISC-V DT bindings for CPUs - Convert one use of __ASSEMBLY__ to __ASSEMBLER__ that snuck into the RISC-V CFI selftest code - Update the translation for the simplified Chinese translation of the RISC-V kernel patch acceptance policy" * tag 'riscv-for-linus-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: skip software algning code for HAVE_EFFICIENT_UNALIGNED_ACCESS kselftest/riscv: Replace __ASSEMBLY__ with __ASSEMBLER__ docs/zh_CN: Update arch/riscv/patch-acceptance.rst translation dt-bindings: riscv: cpus: Fix yamllint style issues riscv: hwprobe: simplify has_fpu() to check D extension only perf: RISC-V: check cpu_hw_evt before dereference in overflow IRQ riscv: report Zfhmin/Zvfhmin when Zfh/Zvfh are present perf: RISC-V: store available counter mask as bitmap perf: RISC-V: use BIT_ULL for u64 overflow masks riscv: bug: Make RV32 use GENERIC_BUG_RELATIVE_POINTERS riscv: hwprobe: initialize pair->value in hwprobe_one_pair() riscv: use string helper in setup_global_riscv_enable() Revert "riscv: Reset pmm when PR_TAGGED_ADDR_ENABLE is not set" riscv: patch: skip fixmap mapping when kernel text is already writable riscv: mm: make EXECMEM_KPROBES writable without CONFIG_STRICT_MODULE_RWX
9 daysMerge tag 'platform-drivers-x86-v7.3-2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Ilpo Järvinen: - amd/pmf: Fix build on !CONFIG_AMD_PMF_DEBUG - asus-laptop: Fix ACPI event handling - hp-wmi: Fix board_params typo for 8DD6 board - x86-android-tablets: Fix Arizona and Crystal Cove GPIO lookups * tag 'platform-drivers-x86-v7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: MAINTAINERS: fix sysfs-platform-ayaneo-ec documentation path platform/x86: x86-android-tablets: fix gpio_secondary_fwnode_init() not working platform/x86: x86-android-tablets: use shared battery swnode group on Yoga Tab 2 platform/x86: x86-android-tablets: drop redundant swnode group on YT3 platform/x86: x86-android-tablets: add Crystal Cove GPIO swnode support platform/x86: x86-android-tablets: pass node group to gpio_secondary_fwnode_init() platform/x86: x86-android-tablets: hold device reference for secondary fwnode teardown platform/x86: x86-android-tablets: fix Arizona GPIO swnode references platform/x86/amd/pmf: fix build on !CONFIG_AMD_PMF_DEBUG platform/x86: asus-laptop: Fix ACPI event handling platform/x86: hp-wmi: Fix board_params typo for 8DD6 board
9 daysMerge tag 'block-7.3-20260911' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fixes from Jens Axboe: - Fix the start and length check added to iov_iter_extract_bvecs(), which used iter_iov_addr()/iter_iov_len() helpers that aren't safe for the ITER_BVEC/FOLIOQ/etc iterator types passed - sunvdc fixes for an -EIO issue from lack of retries, and unmapping LDC cookies when the descriptor send fails - Clear force_abort in ublk_queue_reset_io_flags() - ublk selftest install fix * tag 'block-7.3-20260911' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: selftests: ublk: add batch IO cases to recover_03 ublk: clear force_abort in ublk_queue_reset_io_flags() sunvdc: fix -EIO issue due to lack of retries sunvdc: unmap LDC cookies when the descriptor send fails block: Fix start and length check added to iov_iter_extract_bvecs() selftests: ublk: install test_common.sh and trace/ scripts
9 daysdrm/msm/a6xx: Use CX AO Counter register for timestamp on a750 GPUsNeil Armstrong
The a750 uses the GMU CX AO Counters instead of the GMU_ALWAYS_ON_COUNTER register on A6xx and other A7xx GPUs, use it when running a A750 GPU. The GMU_ALWAYS_ON_COUNTER at offset 0x1f888 doesn't seem to exist on the SM8650 A750 GMU and returns 0, but the CX AO counter at offset 0x1f880 returns some proper timestamp data. Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/752235/ Message-ID: <20260909-topic-sm8650-gmu-a750-timestamp-reg-v2-2-091d74958951@linaro.org> Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
9 daysdrm/msm/a6xx: Add CX AO Counter registers used for a750 GPUsNeil Armstrong
The a750 uses the CX AO Counters instead of the GMU_ALWAYS_ON_COUNTER register on A6xx and other A7xx GPUs. Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/752234/ Message-ID: <20260909-topic-sm8650-gmu-a750-timestamp-reg-v2-1-091d74958951@linaro.org> Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
9 daysdrm/msm: remove stale perf counter XML TODOGeorge Emmanuel Thomas
The adreno_perfcntrs macro already takes the XML file stem as its second argument, allowing each perf counter JSON file to select the appropriate register XML. The a2xx and a5xx entries already pass their respective XML file stems. Remove the stale TODO comment. Signed-off-by: George Emmanuel Thomas <georgeemmanuelthomas@gmail.com> Patchwork: https://patchwork.freedesktop.org/patch/746745/ Message-ID: <20260815164335.158958-1-georgeemmanuelthomas@gmail.com> Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
9 daysdrm/pl111: drop alpha formats the hardware cannot scan outRoshan Kumar
The PL110/PL111 controller scans out a single framebuffer and never blends its alpha channel with anything. In every pixel-format table each alpha-carrying entry (ARGB/ABGR in 8888, 1555 and 4444) maps to exactly the same register configuration as its XRGB/XBGR counterpart, so the alpha byte was never used by the hardware. Commit 860e748bddcc ("drm: ensure blend mode supported if pixel format with alpha exposed") added validation that warns when a plane exposes alpha formats without a pixel blend mode property, and PL111 does exactly that. With panic_on_warn enabled the warning prevents the syzkaller vexpress-a15 manager from booting. Drivers should not report formats they do not support, so remove the alpha formats from all variant tables: the generic PL110, PL111 and Nomadik tables in pl111_drv.c and the board-specific Integrator, IM-PD1, Versatile and RealView/Versatile-Express tables in pl111_versatile.c, plus the now dead case labels in the display setup and the Versatile syscon connector switch, instead of advertising a blend mode property. Behavior is unchanged for userspace that picks an XRGB/XBGR/RGB format; alpha-picking clients fall back to the identical X variant. Link: https://github.com/google/syzkaller/issues/7805 Fixes: 860e748bddcc ("drm: ensure blend mode supported if pixel format with alpha exposed") Signed-off-by: Roshan Kumar <roshaen09@gmail.com> Changes in v2: drop the alpha formats entirely instead of advertising a DRM_MODE_BLEND_PIXEL_NONE property, per review feedback from Thomas Zimmermann. Leandro's Reviewed-by from v1 is not carried as the approach changed. Changes in v3: v2 missed the board-specific variant tables in pl111_versatile.c (Integrator, IM-PD1, Versatile, RealView and Versatile Express), which still exposed alpha formats and would fall through to the WARN_ONCE default in pl111_display_enable() on those boards. Pointed out by the sashiko AI reviewer. Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Link: https://github.com/google/syzkaller/issues/7805 Signed-off-by: Linus Walleij <linusw@kernel.org> Link: https://patch.msgid.link/20260910192526.137057-1-roshaen09@gmail.com
9 daysdrm/xe/log: Relax location ID recognitionMichal Wajdeczko
It turned out that during early probe phase, VFs use detached from the xe_device, temporary xe_gt objects, which when used as location in xe_log() macros, will be treated by the dmesg decoration code as bogus, possibly triggering a WARN, and the output will look like: [drm] *ERROR* SIGID=104 (-ETIMEDOUT) LOC3.0? GUC: MMIO request ... instead of expected: [drm] *ERROR* SIGID=104 (-ETIMEDOUT) Tile0: GT0: GUC: MMIO request ... Relax the tile/GT id validation and instead of looking for the real objects, only check if encoded id is within the range of possible tiles or GTs on the current xe device, using data from the device descriptor rather then the object list. Fixes: 1151b9f6f465 ("drm/xe/log: Add component/location decorations to dmesg") Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com> Link: https://patch.msgid.link/20260904170531.516-7-michal.wajdeczko@intel.com
9 daysdrm/xe: Drop redundant parameter from xe_probe_info and friendsMichal Wajdeczko
We can now obtain the const pointer to struct xe_device_desc directly from the xe, no need to pass it as explicit parameter. Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Reviewed-by: Gustavo Sousa <gustavo.sousa@intel.com> Link: https://patch.msgid.link/20260904170531.516-6-michal.wajdeczko@intel.com
9 daysdrm/xe: Drop redundant parameter from xe_probe_info_earlyMichal Wajdeczko
We can now obtain the const pointer to struct xe_device_desc directly from the xe, no need to pass it as explicit parameter. Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Reviewed-by: Gustavo Sousa <gustavo.sousa@intel.com> Link: https://patch.msgid.link/20260904170531.516-5-michal.wajdeczko@intel.com
9 daysdrm/xe: Drop redundant parameters from xe_info_init_earlyMichal Wajdeczko
We can now obtain the const pointers to struct xe_device_desc and xe_subplatform_desc directly from the xe, no need to pass them as explicit parameters. Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Reviewed-by: Gustavo Sousa <gustavo.sousa@intel.com> Link: https://patch.msgid.link/20260904170531.516-4-michal.wajdeczko@intel.com
9 daysdrm/xe: Keep reference to device descriptorMichal Wajdeczko
While we already use struct intel_device_info, which has some fields copied or derived from the original struct xe_device_desc, we also want to keep the reference to the whole device descriptor, in case we would like to access more non-mutable device parameters. Similarly keep the reference to matched subplatform descriptor. Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Reviewed-by: Gustavo Sousa <gustavo.sousa@intel.com> Link: https://patch.msgid.link/20260904170531.516-3-michal.wajdeczko@intel.com
9 daysdrm/xe: Drop unused parameter from xe_info_initMichal Wajdeczko
We don't need anything from struct xe_device_desc in xe_info_init() Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com> Reviewed-by: Gustavo Sousa <gustavo.sousa@intel.com> Link: https://patch.msgid.link/20260904170531.516-2-michal.wajdeczko@intel.com
9 daysdrm/nouveau/gsp: Increase delay for magic sleep in r535_gsp_fini()Lyude Paul
As it turns out, Turing isn't the only architecture that needs this. On this Dell Precision 7780 with an AD103 GPU, along with pretty much every other laptop I tested, runtime PM is still somewhat unreliable. At first glance it seems as if it's fixed, but lowering the autosuspend delay to 500ms and then doing a stress test of suspend/resume cycles on the GPU ends up causing everything to start timing out. After quite a lot of digging, I eventually landed back on this magic timeout in r535_gsp_fini(). As it turns out, increasing the timeout ends up fixing the runtime PM issues as far as I can tell, even during intense stress testing. Unfortunately after spending quite a bit of time trying to dig through OpenRM to figure out what this magic sleep is actually doing, I've also come up short with any reasonable explanation. In lieu of that, I'm going to include the observations I did make while trying to figure this out in hopes someone eventually does figure this out: * The magic sleep has to occur after fbsr is initialized. Performing it at any time before that doesn't appear to work. * In situations where runtime PM starts getting flaky, some rather interesting visual effects end up happening on occasion before the GPU fully falls over. In particular, squares that look like the result of an incomplete blitting operation to a tiled buffer end up showing up on applications like vkcube. Interestingly enough, they remain in precisely the same place between runtime PM cycles until the GPU falls over - even when restarting vkcube multiple times, and even when vkcube is actively updating the screen. Even more interestingly, they're not limited to a specific framebuffer - you can see the squares changing as the cube rotates around. We cannot however, say that this is likely to be a incomplete fbsr operation. The magic sleep happens before fbsr is actually saved (which happens on the GSP unload), so it's something else. * During a short bit of testing with a desktop that I have, the magic sleep seemed to make no difference to whether or not suspend/resume works. It seems to generally work almost always. So we can assume this is likely exclusive to runtime PM, not S3. As well, here's a list of the things I tried before settling on the magic sleep: * Hooking up NV2080_CTRL_CMD_INTERNAL_GCX_ENTRY_PREREQUISITE and then blocking runtime PM until OpenRM signals that GC6/GCOFF is ready appears to make no difference. * Hooking up some (maybe not all, unsure about that part) bits of comptag saving including: * Fetching static memsys information from GSP * Adding the size of the comptag storage to the fbsr data * Adding a GA103+ workaround for disabling raw compression mode during fbsr (it doesn't seem like it applies for any systems I tried it on anyhow) * Setting bPreserveVideoMemoryAllocations=1 in GspSystemInfo So, until we can figure this out properly - just sleep for longer. Signed-off-by: Lyude Paul <lyude@redhat.com> Fixes: 53dac0623853 ("drm/nouveau/gsp: add support for 570.144") Cc: <stable@vger.kernel.org> # v6.16+ Reviewed-by: Dave Airlie <airlied@redhat.com> Link: https://patch.msgid.link/20260814194542.781955-5-lyude@redhat.com (cherry picked from commit 09b47186a4164f3aaa3591313f80794443117342) Signed-off-by: Lyude Paul <lyude@redhat.com>
9 daysdrm/nouveau/gsp/r570: Enable S/R Display workaround in GSPLyude Paul
There's two flags that we've never been setting when asking GSP to suspend the GPU, which OpenRM does set: GPU_STATE_FLAGS_PRESERVING GPU_STATE_FLAGS_PM_TRANSITION These flags aren't -supposed- to do much in GSP, they're mostly used by OpenRM itself for state tracking. The only thing they do from GSP's side is control whether or not a single display related workaround is applied during suspend. But as it turns out, that single workaround is actually quite crucial for getting runtime PM working with nouveau - and without it set we end up seeing a lot more failures with runtime PM resume. So, let's start setting it. Signed-off-by: Lyude Paul <lyude@redhat.com> Fixes: 53dac0623853 ("drm/nouveau/gsp: add support for 570.144") Cc: <stable@vger.kernel.org> # v6.16+ Reviewed-by: Dave Airlie <airlied@redhat.com> Link: https://patch.msgid.link/20260814194542.781955-4-lyude@redhat.com (cherry picked from commit ca57629b3eb912c77bc4357178a2130ea6c2d6df) Signed-off-by: Lyude Paul <lyude@redhat.com>
9 daysdrm/nouveau/gsp/r570: Set GcOff = 0 in fbsrLyude Paul
Previously, it looked as if we were able to fix suspend/resume on some desktops by setting Gcoff based on whether or not we were entering runtime PM. This was a mistake though - the only time suspend/resume would end up actually working was if Gcoff = 0. It seems like it's likely the main reason for this is the FBSR GcOff argument actually controls GSP's behavior with regards to which buffers it decides to save across suspend/resume. When GcOff = 1, RM reserved regions are saved unless they are marked as LOST_ON_SUSPEND, and RM channel-context and kernel-client buffers are also saved -including- when they are LOST_ON_SUSPEND. This means with GcOff = 1, we end up having GSP save and restore buffers that actually need to be reinitialized on resume - causing the failures we're setting. Thanks to John Hubbard from Nvidia for providing some background on what these options do in the GSP firmware do! Signed-off-by: Lyude Paul <lyude@redhat.com> Fixes: 53dac0623853 ("drm/nouveau/gsp: add support for 570.144") Cc: <stable@vger.kernel.org> # v6.16+ Reviewed-by: Dave Airlie <airlied@redhat.com> Link: https://patch.msgid.link/20260814194542.781955-3-lyude@redhat.com (cherry picked from commit c7abe771e013848970421e5ca29c6b2f05c31965) Signed-off-by: Lyude Paul <lyude@redhat.com>
9 daysRevert "nouveau/gsp: fix suspend/resume regression on r570 firmware"Lyude Paul
This reverts commit 8302d0afeaec0bc57d951dd085e0cffe997d4d18. It turns out this looked like the right fix on some systems, but it's not - as this causes runtime PM to actually fail on many a laptop. Fixes: 8302d0afeaec ("nouveau/gsp: fix suspend/resume regression on r570 firmware") Cc: <stable@vger.kernel.org> # v6.19+ Signed-off-by: Lyude Paul <lyude@redhat.com> Reviewed-by: Dave Airlie <airlied@redhat.com> Link: https://patch.msgid.link/20260814194542.781955-2-lyude@redhat.com (cherry picked from commit 94097122bfd701976bc1a62ccd434c13f3f67cde) Signed-off-by: Lyude Paul <lyude@redhat.com>
9 daysmedia: cadence: csi2rx: Support RAW12 bayer formatsJai Luthra
Add support for RAW12 bayer formats in the cadence csi2rx driver. Signed-off-by: Jai Luthra <j-luthra@ti.com> Signed-off-by: Yemike Abhilash Chandra <y-abhilashchandra@ti.com> Reviewed-by: Rishikesh Donadkar <r-donadkar@ti.com> Reviewed-by: Jai Luthra <jai.luthra@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
9 daysmedia: ti: j721e-csi2rx: Support RAW12 bayer formatsJai Luthra
Add support for RAW12 bayer formats in the j721e-csi2rx driver. Signed-off-by: Jai Luthra <j-luthra@ti.com> Signed-off-by: Yemike Abhilash Chandra <y-abhilashchandra@ti.com> Reviewed-by: Rishikesh Donadkar <r-donadkar@ti.com> Reviewed-by: Jai Luthra <jai.luthra@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
9 daysmedia: i2c: imx471: Set max analog gain to 960Kate Hsuan
The maximum analog gain was previously restricted to resolve image flickering and overexposure issues. With recent developments in libcamera, this limit can now be restored to its original value of 960 to ensure image brightness is properly evaluated and adjusted. Link: https://raw.githubusercontent.com/intel/ipu6-drivers/refs/heads/master/drivers/media/i2c/imx471.c Signed-off-by: Kate Hsuan <hpa@redhat.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
9 daysmedia: ipu-bridge: Add OV01A1B sensor configSteve Kaznak
Add the Omnivision OV01A1B (ACPI HID OVTI01AB) to the ipu_supported_sensors[] table, with the same single 400 MHz link frequency as the OV01A10 and OV01A1S entries it shares a comment with. The sensor is the IR camera in the Dell XPS 13 Plus 9320, behind an Intel Vision Sensing Controller (IVSC). Commit 36eab90d3f4f ("media: i2c: ov01a10: Add ov01a1b support") added driver support for it, but without a bridge entry no fwnode graph endpoint is created, so the driver never binds and the camera is not enumerated. Tested on an XPS 13 Plus 9320: the sensor binds and streams 1296x816 Y10 at 30 fps. Signed-off-by: Steve Kaznak <skaznak@protonmail.com> Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com> Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
9 daysmedia: ipu-bridge: Add upside-down sensor DMI quirk for Samsung Galaxy Book3 ↵Felipe Calliari
Ultra On the Samsung Galaxy Book3 Ultra (960XFH) the OV02C10 sensor is mounted upside-down. The 180 degree rotation is not described in the sensor's ACPI data: both the SSDB and the _PLD report a rotation of 0 degrees, so ipu_bridge_parse_rotation() assigns a "rotation" property of 0 to the sensor fwnode and the image is rendered upside-down in userspace. Because the SSDB degree field holds the valid value 0, the flipped mounting goes unnoticed: the driver logs no warning and userspace (e.g. libcamera) has no way to correct the image. Add a DMI quirk entry for this laptop so that the sensor fwnode gets a "rotation" property of 180 and userspace (e.g. libcamera) can compensate. Tested on the Galaxy Book3 Ultra: with the sensor reporting V4L2_CID_CAMERA_SENSOR_ROTATION = 180 (verified with an equivalent local sensor-driver quirk), libcamera renders the image upright. Signed-off-by: Felipe Calliari <calliarifelipe@gmail.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
9 daysmedia: ipu-bridge: Fix use-after-free in IVSC error pathYibo Tan
ipu_bridge_get_ivsc_acpi_dev() returns an ACPI device with a reference held. If no matching CSI device is found, ipu_bridge_check_ivsc_dev() drops that reference before passing the device to dev_err(). Concurrent CSI device and ACPI namespace removal can drop the other references, making this the final put. dev_err() then reads the freed struct acpi_device and its kobject name. This was reproduced without kprobes by racing normal CSI platform-device unregistration and ACPI configfs table removal against the production ipu_bridge_init() entry. KASAN reported the final free through device_release(), followed by invalid reads through _dev_err(). Emit the error message while the lookup reference is still held, then drop the reference as before. Source reproducers and vulnerable/fixed serial logs, with only the build hostname redacted, are available at: https://github.com/kimaiden1984-boop/linux-ipu-bridge-acpi-uaf-reproducer The fixed target builds with W=1 on x86-64. This was not tested on physical IPU hardware. The tests establish runtime reachability but do not measure occurrence frequency on shipping systems or establish exploitability. Fixes: c66821f381ae ("media: pci: intel: Add IVSC support for IPU bridge driver") Cc: stable@vger.kernel.org Assisted-by: Codex:GPT-5 Signed-off-by: Yibo Tan <lhfff@tju.edu.cn> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
9 daysmedia: ipu-bridge: Request non-continuous clock for ov5693 on IPU6Fernando Rimoli
The ov5693 (INT33BE / OVTI5693) needs its MIPI clock lane gated while idle for the IPU6 CSI-2 receiver to lock onto the link, which the sensor driver does when the endpoint requests a non-continuous clock. The same sensor works with a free-running clock on the IPU3, so request it only for the IPU6 variants where it has been confirmed on hardware: Tiger Lake, Alder Lake-P and Alder Lake-N. Signed-off-by: Fernando Rimoli <fernandorimoli11@gmail.com> Tested-by: Jakob Berg Jespersen <dev@berg.pm> # Surface Pro 7+, IPU6 Tiger Lake Tested-by: Fil Dunsky <filipp.dunsky@gmail.com> # Surface Pro 8, IPU6 Tiger Lake (8086:9a19) Tested-by: Lucas Lis <lucaseze.lis@gmail.com> # Surface Pro 7+, IPU6 Tiger Lake (0x9a19) Tested-by: Kengo Oki <dev.kengo.fugu0141@gmail.com> # Surface Go 4, IPU6 Alder Lake-N 8086:462e Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
9 daysmedia: ipu-bridge: Match sensor configs per IPU and add config flagsFernando Rimoli
Some sensors need different treatment depending on which IPU they are connected to, so the ACPI HID alone is not enough. Match on an optional list of IPU PCI product IDs. Entries for one HID must be adjacent, IPU-specific ones first, so the generic entry is skipped once a specific one has matched. Signed-off-by: Fernando Rimoli <fernandorimoli11@gmail.com> Tested-by: Jakob Berg Jespersen <dev@berg.pm> # Surface Pro 7+, IPU6 Tiger Lake Tested-by: Fil Dunsky <filipp.dunsky@gmail.com> # Surface Pro 8, IPU6 Tiger Lake (8086:9a19) Tested-by: Lucas Lis <lucaseze.lis@gmail.com> # Surface Pro 7+, IPU6 Tiger Lake (0x9a19) Tested-by: Kengo Oki <dev.kengo.fugu0141@gmail.com> # Surface Go 4, IPU6 Alder Lake-N 8086:462e Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
9 daysmedia: ipu-bridge: Assign endpoint property indices dynamicallyFernando Rimoli
Index the ep_properties array dynamically instead of plain numerical values as is done in mipi-disco-img.c. Signed-off-by: Fernando Rimoli <fernandorimoli11@gmail.com> Tested-by: Jakob Berg Jespersen <dev@berg.pm> # Surface Pro 7+, IPU6 Tiger Lake Tested-by: Fil Dunsky <filipp.dunsky@gmail.com> # Surface Pro 8, IPU6 Tiger Lake (8086:9a19) Tested-by: Lucas Lis <lucaseze.lis@gmail.com> # Surface Pro 7+, IPU6 Tiger Lake (0x9a19) Tested-by: Kengo Oki <dev.kengo.fugu0141@gmail.com> # Surface Go 4, IPU6 Alder Lake-N 8086:462e Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
9 daysmedia: i2c: ov5693: Gate the MIPI clock lane for non-continuous clockFernando Rimoli
The ov5693 never programs MIPI_CTRL00 (0x4800), leaving it at its 0x00 power-on default, which lets the MIPI clock run freely. The IPU3 CSI-2 receiver tolerates this, but the IPU6 receiver (e.g. on Microsoft Surface Pro 7+, Pro 8, Pro 9 and Surface Go 4) fails to lock onto the link, so the sensor streams but capture times out with "stream stop time out". On most affected machines no frames arrive at all; on some the failure is intermittent. Gate the clock lane while idle at stream on when the endpoint requests a non-continuous clock. Only the gate bit is touched, so platforms that do not request it are unaffected. No counterpart is needed at stream off, as the link is down by then and the register returns to its default when the sensor is powered off. The property is supplied by the ipu-bridge in a subsequent patch. Link: https://github.com/linux-surface/linux-surface/pull/2171 Co-developed-by: Arsalan Naeem <naeemarsalan@gmail.com> Signed-off-by: Arsalan Naeem <naeemarsalan@gmail.com> Signed-off-by: Fernando Rimoli <fernandorimoli11@gmail.com> Tested-by: Jakob Berg Jespersen <dev@berg.pm> # Surface Pro 7+, IPU6 Tiger Lake Tested-by: Fil Dunsky <filipp.dunsky@gmail.com> # Surface Pro 8, IPU6 Tiger Lake (8086:9a19) Tested-by: Lucas Lis <lucaseze.lis@gmail.com> # Surface Pro 7+, IPU6 Tiger Lake (0x9a19) Tested-by: Kengo Oki <dev.kengo.fugu0141@gmail.com> # Surface Go 4, IPU6 Alder Lake-N 8086:462e Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
9 daysmedia: ipu-bridge: Add OVTI5693 to the list of supported sensorsFernando Rimoli
The IPU bridge builds the firmware node graph only for sensors listed in ipu_supported_sensors[]. The OV5693 is currently listed only under its legacy "INT33BE" HID, so on Intel IPU6 Surface devices that enumerate it as "OVTI5693" (e.g. Microsoft Surface Pro 9) the bridge never wires up the sensor and the front camera is unusable. Add an "OVTI5693" entry. The link frequency (419200000) matches the existing INT33BE entry, as it is the same sensor. Tested on Surface Pro 9 (IPU6). Link: https://github.com/linux-surface/linux-surface/pull/2171 Signed-off-by: Fernando Rimoli <fernandorimoli11@gmail.com> Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
9 daysmedia: i2c: ov5693: Add OVTI5693 ACPI HIDFernando Rimoli
The ov5693 driver only matches the "INT33BE" ACPI HID. Some Intel IPU6 Surface devices (e.g. Microsoft Surface Pro 9) enumerate the OV5693 front camera with the ACPI HID "OVTI5693" instead, so the i2c core never binds the driver. Add "OVTI5693" to the ACPI match table. Devices that use "INT33BE" (e.g. Surface Go 4) are unaffected. Tested on Surface Pro 9 (IPU6): the sensor enumerates as OVTI5693:00 (ACPI path \_SB_.PC00.I2C3.CAMF) and binds with this change. Link: https://github.com/linux-surface/linux-surface/pull/2171 Signed-off-by: Fernando Rimoli <fernandorimoli11@gmail.com> Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
9 daysmedia: ipu-bridge: Add upside-down quirk for Dell Pro 14 Premium PA14260Pierre Pinon
The Dell Pro 14 Premium PA14260 (Panther Lake, IPU7 + Intel CVS) has its OV08X40 front sensor mounted upside down, but reports a rotation of 0 in its SSDB, so without a DMI quirk the image is presented upside down. Add a DMI quirk entry for this model so that a rotation of 180 degrees is reported for its OVTI08F4 sensor. Tested on the affected machine: with the quirk applied, camera_sensor_rotation reads 180 and the captured image is the right way up. Signed-off-by: Pierre Pinon <pierre@pinon1.fr> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
9 daysmedia: ivsc: Use ipu_bridge_get_ipu6()Sakari Ailus
Instead of going through the PCI device ID table, use ipu_bridge_get_ipu6() to obtain a pointer to the IPU PCI device. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Reviewed-by: Antti Laakso <antti.laakso@linux.intel.com> Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com>
9 daysmedia: cvs: Use ipu_bridge_get_ipu6()Sakari Ailus
Instead of going through the PCI device ID table, use ipu_bridge_get_ipu6() to obtain a pointer to the IPU PCI device. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Reviewed-by: Antti Laakso <antti.laakso@linux.intel.com> Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com>
9 daysmedia: ipu-bridge: Add ipu_bridge_get_ipu6()Sakari Ailus
Add ipu_bridge_get_ipu6() for obtaining the IPU 6 (or soon later) PCI device. This isn't technically a job of the IPU bridge, but the functionality is required in conjunction with the firmware definitions that necessitate the use of the IPU bridge on many systems. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Reviewed-by: Antti Laakso <antti.laakso@linux.intel.com> Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com>
9 daysMerge branch 'for-7.4/asus' into for-nextJiri Kosina
9 daysHID: asus: do not send keyboard init reports to touchpadsPanz Dev
Commit 0919db9f3583 ("HID: asus: always fully initialize devices") added a loop during asus_probe() to send keyboard feature report initializations (asus_kbd_init) to all ASUS HID devices. On ASUS laptops with I2C/HID touchpads (such as the ASUS E200HA), sending keyboard feature reports (FEATURE_KBD_REPORT_ID) to touchpad endpoints sends invalid feature requests to touchpad hardware, corrupting probe state and causing the touchpad to become unresponsive. Wrap the asus_report_id_init loop in an `if (!drvdata->tp)` check so keyboard feature initialization only runs for actual keyboards. Tested on ASUS E200HA (where touchpad functionality is fully restored) and ASUS VivoBook Flip 14 TP401MA (confirming zero regressions). Fixes: 0919db9f3583 ("HID: asus: always fully initialize devices") Cc: stable@vger.kernel.org Signed-off-by: Panz Dev <panz.development@gmail.com> Reviewed-by: Denis Benato <denis.benato@linux.dev> Signed-off-by: Jiri Kosina <jkosina@suse.com>
9 daysMerge branch 'for-7.3/upstream-fixes' into for-nextJiri Kosina
9 daysHID: elecom: fix bus type for M-XGL20DLBKOscar Priego Verdugo
The M-XGL20DLBK is matched as a USB device by hid-elecom, but its entry in hid_have_special_driver[] uses HID_BLUETOOTH_DEVICE. This prevents the special-driver quirk entry from matching the USB device handled by hid-elecom. Use HID_USB_DEVICE there as well. Fixes: 55633e681afb ("HID: elecom: add support for EX-G M-XGL20DLBK wireless mouse") Signed-off-by: Oscar Priego Verdugo <oscar.priegov@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
9 daysMerge tag 'media/v7.3-2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: "Core: - add bounded tile-count helpers for HEVC stateless decoders - validate AV1 tile counts fits in array size - validate HEVC tile counts fits in array size - fix memcmp() size in B1 reference list comparison mediatek: - bound AV1 tile-start copy to fit in array size rockchip: - reject AV1 frames exceeding the tile size - guard VPU981 AV1 divisor and tile buffer hantro and rkvdec: - bound G2 HEVC tile loops and PPS id to the buffer size rppx1: - read the raw pattern from the PRE2 acquisition module - describe the MAIN_POST white balance gains block" * tag 'media/v7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity media: rkvdec: bound HEVC tile loops and PPS id to the array capacity media: hevc: add bounded tile-count helpers media: v4l2-ctrls: validate AV1 tile counts media: v4l2-ctrls: validate HEVC tile counts media: v4l2-h264: Fix memcmp() size in B1 reference list comparison media: rppx1: bls: read the raw pattern from the PRE2 acquisition module media: rppx1: describe the MAIN_POST white balance gains block
9 daysMerge branch 'for-7.3/upstream-fixes' into for-nextJiri Kosina
9 daysHID: elecom: Add support for ELECOM M-XT4DRBK (018E)Berke Durak
The 2025 revision of the left-handed EX-G wireless trackball (M-XT4DRBK-G) reports USB ID 056e:018e instead of 056e:00fd. Its report descriptor declares an 8-bit button field (Report Count 8) but only five usages (Usage Maximum 5), so the sixth (Fn) button ends up as a duplicate of button 5 and is unusable. The report descriptor has the same layout as the M-XT3DRBK 018C (button usage maximum at offset 16, button report count at 22, button report size at 24, padding report size at 30), so reuse that fixup. Rename the existing M_XT4DRBK define to M_XT4DRBK_00FD to match the convention used for the other EX-G revisions. Tested on a Raspberry Pi 5 with the same fixup in an out-of-tree module on 6.12 (6.12.96+rpt-rpi-2712); all six buttons are reported after the fix, and they work (tested with xev as well). Report descriptor as sent by the device, pre-fix (056e:018e, 215 bytes): 05 01 09 02 A1 01 09 01 A1 00 85 01 05 09 19 01 29 05 15 00 25 01 95 08 75 01 81 02 95 01 75 00 81 01 05 01 09 30 09 31 16 00 80 26 FF 7F 75 10 95 02 81 06 C0 A1 00 05 01 09 38 15 81 25 7F 75 08 95 01 81 06 C0 A1 00 05 0C 0A 38 02 95 01 75 08 15 81 25 7F 81 06 C0 C0 06 01 FF 09 00 A1 01 85 02 09 00 15 00 26 FF 00 75 08 95 07 81 02 C0 05 0C 09 01 A1 01 85 05 15 00 26 3C 02 19 00 2A 3C 02 75 10 95 01 81 00 C0 05 01 09 80 A1 01 85 03 19 81 29 83 15 00 25 01 95 03 75 01 81 02 95 01 75 05 81 01 C0 06 BC FF 09 88 A1 01 85 04 95 01 75 08 15 00 26 FF 00 19 00 2A FF 00 81 00 C0 06 02 FF 09 02 A1 01 85 06 09 02 15 00 26 FF 00 75 08 95 07 B1 02 C0 Assisted-by: LLM Signed-off-by: Berke Durak <berke.durak@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>