summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2026-07-07staging: greybus: vibrator: return device_create() errorsAlfie Varghese
gb_vibrator_probe() maps any device_create() failure to -EINVAL. This loses the real errno returned by the driver core, such as -ENOMEM, and makes probe failures harder to diagnose correctly. Return PTR_ERR(dev) instead so callers receive the actual failure reason while preserving the existing cleanup path. Signed-off-by: Alfie Varghese <alfievarghese22@gmail.com> Link: https://patch.msgid.link/20260618113439.569-1-alfievarghese22@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-07staging: greybus: power_supply: remove unnecessary parentheses in returnTomasz Unger
return is not a function, so the parentheses around the returned expressions are not needed. Remove them to follow kernel coding style and silence checkpatch.pl RETURN_PARENTHESES warnings. Verified with checkpatch.pl - no errors or warnings. Compiled the power_supply object successfully. Signed-off-by: Tomasz Unger <tomasz.unger@yahoo.pl> Acked-by: Rui Miguel Silva <rui.silva@linaro.org> Link: https://patch.msgid.link/20260615-greybus-power-supply-return-parens-v1-1-dcad9dabfe79@yahoo.pl Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-07greybus: audio: bound the topology section sizes against the fetched sizeBryam Vargas
gb_audio_gb_get_topology() fetches a topology blob of a module-supplied size, and gbaudio_tplg_parse_data() then walks it by adding the module-supplied size_dais, size_controls and size_widgets fields to form the control, widget and route section offsets. Those le32 sizes are never checked against the fetched blob, so a module reporting a small topology size but large section sizes makes the offsets point past the allocation, and parsing reads out of bounds. Reject a topology whose section sizes do not fit within the fetched size before it is parsed. Fixes: 184992e305f1 ("greybus: audio: Add Greybus Audio Device Class Protocol helper routines") Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me> Link: https://patch.msgid.link/20260616-b4-disp-4352e8b0-v1-1-3e09f62e0ad5@proton.me Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-07staging: greybus: Remove unused macroMichail Tatas
Remove unused macro as indicated by the compiler when building with make W=2 Signed-off-by: Michail Tatas <michail.tatas@gmail.com> Link: https://patch.msgid.link/ahdNZlYqnTO22tQq@michalis-linux Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-07staging: greybus: audio_codec: remove redundant else-if checkAbdelnasser Hussein
In gbaudio_module_update(), the widget id is validated earlier in the function to ensure it is either snd_soc_dapm_aif_in or snd_soc_dapm_aif_out. Remove the redundant else-if check for snd_soc_dapm_aif_out. The remaining branch can only handle snd_soc_dapm_aif_out, which avoids a compiler warning about a potentially uninitialized variable. Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202606140347.gGVWDnbi-lkp@intel.com/ Signed-off-by: Abdelnasser Hussein <abdelnasserhussein11@gmail.com> Link: https://patch.msgid.link/20260614154329.5176-3-abdelnasserhussein11@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-07staging: greybus: audio_codec: fix sscanf return value checkAbdelnasser Hussein
Smatch static checker warns: drivers/staging/greybus/audio_codec.c:335 gbaudio_module_update() warn: sscanf doesn't return error codes The sscanf() function returns the number of successfully matched input items, not a negative error code. Compare the return value directly with the expected number of conversions (3) instead of storing it in 'ret' and returning it as an error code, which leads to returning a positive value on failure. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Closes: https://lore.kernel.org/all/YoOLnDkHgVltyXK7@kili/ Signed-off-by: Abdelnasser Hussein <abdelnasserhussein11@gmail.com> Link: https://patch.msgid.link/20260614154329.5176-2-abdelnasserhussein11@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-07staging: greybus: remove unused macro CAP_TIMEOUT_MSRhys Tumelty
The macro CAP_TIMEOUT_MS is defined but never used anywhere in the kernel tree. Remove it to clean up code. Signed-off-by: Rhys Tumelty <rhys@tumelty.co.uk> Reviewed-by: Alex Elder <elder@riscstar.com> Link: https://patch.msgid.link/20260610173026.1105803-1-rhys@tumelty.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-07staging: sm750fb: Add missing Kconfig dependencyRong Zhang
The sm750 frame buffer driver depends on FB_IOMEM_FOPS, but its Kconfig somehow misses it. Fix it by making FB_SM750 select FB_IOMEM_FOPS, as other frame buffer drivers do. Fixes: dc0ad215e5d8 ("staging/sm750fb: Initialize fb_ops with fbdev macros") Signed-off-by: Rong Zhang <i@rong.moe> Link: https://patch.msgid.link/20260603-sm750-fb-iomem-kconfig-v1-1-7f6a3046cce2@rong.moe Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-07staging: sm750fb: remove duplicate init_status structureHungyu Lin
struct init_status duplicates struct initchip_param and is only used within the sm750fb driver. Replace the remaining users of struct init_status with struct initchip_param, remove the duplicate structure and eliminate the unnecessary cast in hw_sm750_inithw(). No functional change intended. Signed-off-by: Hungyu Lin <dennylin0707@gmail.com> Reviewed-by: Dan Carpenter <error27@gmail.com> Link: https://patch.msgid.link/20260530222432.4303-1-dennylin0707@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-07staging: sm750fb: remove unused struct fieldsAhmet Sezgin Duran
Remove `void *priv` pointer field in following struct definitions: - `struct lynxfb_crtc` - `struct lynxfb_output` Verified that no other code references them. No functional changes. Signed-off-by: Ahmet Sezgin Duran <ahmet@sezginduran.net> Link: https://patch.msgid.link/20260525085808.171974-4-ahmet@sezginduran.net Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-07staging: sm750fb: remove unnecessary initializationsAhmet Sezgin Duran
Remove two instances of `ret = 0` initializations since the variable is overridden unconditionally before being used. Signed-off-by: Ahmet Sezgin Duran <ahmet@sezginduran.net> Link: https://patch.msgid.link/20260525085808.171974-3-ahmet@sezginduran.net Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-07staging: sm750fb: remove commented-out forward declarationsAhmet Sezgin Duran
The block at the top of sm750.c declares lynxfb_ops_write() and lynxfb_ops_read() inside a commented-out #ifdef __BIG_ENDIAN guard. Neither function is defined anywhere in the driver, so the block is dead. Remove it. Signed-off-by: Ahmet Sezgin Duran <ahmet@sezginduran.net> Link: https://patch.msgid.link/20260525085808.171974-2-ahmet@sezginduran.net Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-07staging: sm750fb: gate dualview dataflow using g_dualviewAhmet Sezgin Duran
In sm750fb_setup and sm750fb_set_drv functions, the dualview related code is guarded by `sm750_dev->fb_count > 1` condition. That value is updated only after each framebuffer is registered, while both guards are used before any increment. Current flow: lynxfb_pci_probe() sm750fb_setup() // fb_count is 0 for each fb: sm750fb_framebuffer_alloc() lynxfb_set_fbinfo() sm750fb_set_drv() // fb_count is 0 or 1 register_framebuffer() sm750_dev->fb_count++; // fb_count is incremented Thus even if `dualview=1` parameter is passed down to the driver, fb_count is never > 1 at either check, so dualview dataflows are not selected and crtc->vidmem_size is never halved. Use `g_dualview` global variable instead of fb_count > 1 to correctly enable dualview capabilities. Fixes: a3f92cc94c61 ("staging: sm750fb: replace dual member of sm750_dev with fb_count") Signed-off-by: Ahmet Sezgin Duran <ahmet@sezginduran.net> Link: https://patch.msgid.link/20260521204425.82627-1-ahmet@sezginduran.net Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-07staging: greybus: audio: correct sscanf() return value checkAlexander A. Klimov
manager_sysfs_add_store() passes 6 pointers to sscanf(), but required latter to return 7 which always failed the operation. I corrected it to 6. Fixes: 49b9137a6002 ("staging: greybus: audio: remove redundant slot field") Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de> Link: https://patch.msgid.link/20260521182331.22685-1-grandmaster@al2klimov.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-07net/liquidio: drop cached VF pci_dev LUTYuho Choi
The PF SR-IOV enable path caches VF pci_dev pointers in dpiring_to_vfpcidev_lut[] by iterating with pci_get_device(). Those entries do not own a reference, because the iterator drops the previous device reference on each step. The cached pointer is then dereferenced later when handling OCTEON_VF_FLR_REQUEST. Replace the cached VF mapping with runtime lookup on the mailbox DPI ring: derive the VF index from q_no, resolve the VF via exported PCI IOV helpers, validate it with the PF pointer and VF ID, then issue pcie_flr() and drop the reference with pci_dev_put(). Remove the unused VF lookup table initialization and cleanup. Fixes: ca6139ffc67ee ("liquidio CN23XX: sysfs VF config support") Fixes: 8c978d059224 ("liquidio CN23XX: Mailbox support") Signed-off-by: Yuho Choi <dbgh9129@gmail.com> Link: https://patch.msgid.link/20260701040847.1897845-1-dbgh9129@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-07net: rnpgbe: fix mailbox endianness and remove pointer castsDong Yibo
The rnpgbe mailbox exchanges data through 32-bit MMIO registers in little-endian wire format. The original code had two problems: 1. FW structs (with __le16/__le32 fields) were cast to (u32 *) before reaching the mailbox transport, hiding the endian annotations from sparse. 2. No cpu_to_le32()/le32_to_cpu() conversion was done between CPU-endian MMIO values and the little-endian payload, causing data corruption on big-endian systems. Fix by adding the missing byte-order conversions in the transport layer and introducing union wrappers (mbx_fw_cmd_req_u, mbx_fw_cmd_reply_u) that overlay each FW struct with a __le32 dwords[] array. Callers fill named fields using cpu_to_le16/32(), then pass dwords[] to the transport, which now takes explicit __le32 * instead of u32 *. This eliminates all pointer casts on the mailbox data path and lets sparse verify the conversions. Fixes: 4543534c3ef5 ("net: rnpgbe: Add basic mbx ops support") Signed-off-by: Dong Yibo <dong100@mucse.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260701032208.1843156-2-dong100@mucse.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-07wifi: brcmfmac: cyw: fix heap overflow on a short auth frameMaoyi Xie
brcmf_notify_auth_frame_rx() takes the frame length from the firmware event and copies the frame body with the management header offset subtracted: u32 mgmt_frame_len = e->datalen - sizeof(struct brcmf_rx_mgmt_data); ... memcpy(&mgmt_frame->u, frame, mgmt_frame_len - offsetof(struct ieee80211_mgmt, u)); The only length check is e->datalen >= sizeof(*rxframe), so mgmt_frame_len can be anything from 0 up. offsetof(struct ieee80211_mgmt, u) is 24. When mgmt_frame_len is below that, the subtraction wraps as an unsigned value to a huge length. The memcpy then runs far past the kzalloc'd buffer. A malicious or malfunctioning AP can make the frame short during the external SAE auth exchange, so this is a remotely triggered heap overflow. Reject frames shorter than the management header offset before the copy. Fixes: 66f909308a7c ("wifi: brcmfmac: cyw: support external SAE authentication in station mode") Link: https://lore.kernel.org/r/178214417708.2368577.16740907093694208834@maoyixie.com Cc: stable@vger.kernel.org Co-developed-by: Kaixuan Li <kaixuan.li@ntu.edu.sg> Signed-off-by: Kaixuan Li <kaixuan.li@ntu.edu.sg> Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com> Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com> Link: https://patch.msgid.link/20260627131313.3878893-1-maoyixie.tju@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-07wifi: mac80211_hwsim: avoid NULL skb in stop queue drainCen Zhang
mac80211_hwsim_stop() drops any frames left in data->pending. The loop currently checks skb_queue_empty() and then dequeues separately. That split is racy with TX status handling, which can remove a pending frame under the queue lock. If the last entry is removed after the empty check, skb_dequeue() returns NULL and the stop path passes that NULL skb to ieee80211_free_txskb(). Use skb_dequeue() as the loop condition instead. The dequeue result is the object that stop owns and frees, and a concurrent status completion that empties the queue simply makes the loop terminate. Fixes: bd18de517923 ("mac80211_hwsim: drop pending frames on stop") Assisted-by: Codex:gpt-5.5 Signed-off-by: Cen Zhang <zzzccc427@gmail.com> Link: https://patch.msgid.link/20260706161822.921039-1-zzzccc427@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-07wifi: mac80211_hwsim: clean up radio rhashtable on freeCen Zhang
mac80211_hwsim_free() removes each radio from hwsim_radios before calling mac80211_hwsim_del_radio(), but leaves the matching hwsim_radios_rht entry in place until the whole table is destroyed. Other radio removal paths remove both the list entry and data->rht while holding hwsim_radio_lock, before dropping the lock and deleting the radio. Do the same here so the all-radio cleanup path follows the same object visibility ordering. This helper is used while all radios are being torn down, either after callback users have already been unregistered or while module init is unwinding, so no hwsim_radios_generation update is needed. Assisted-by: Codex:gpt-5.5 Signed-off-by: Cen Zhang <zzzccc427@gmail.com> Link: https://patch.msgid.link/20260706123756.343818-1-zzzccc427@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-07wifi: brcmfmac: initialize SDIO data work before cleanupRunyu Xiao
brcmf_sdio_probe() stores the newly allocated bus in sdiodev->bus before allocating the ordered workqueue. If that allocation fails, the function jumps to fail and calls brcmf_sdio_remove(). brcmf_sdio_remove() unconditionally cancels bus->datawork. Initialize the work item before the first failure path that can reach brcmf_sdio_remove(), so the cleanup path always observes a valid work object. This issue was found by our static analysis tool and then confirmed by manual review of the probe error path and the remove-time work drain. The problem pattern is an early setup failure that reaches a cleanup helper which cancels an embedded work item before its initializer has run. A QEMU PoC forced alloc_ordered_workqueue() to fail at the same point in brcmf_sdio_probe(), before INIT_WORK(&bus->datawork) is reached. The resulting fail path calls brcmf_sdio_remove(), and DEBUG_OBJECTS reports the invalid work drain with brcmf_sdio_probe() and brcmf_sdio_remove() in the stack. Fixes: 9982464379e8 ("brcmfmac: make sdio suspend wait for threads to freeze") Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn> Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com> Link: https://patch.msgid.link/20260619064401.1048976-1-runyu.xiao@seu.edu.cn Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-07Merge tag 'amd-drm-next-7.3-2026-07-02' of ↵Dave Airlie
https://gitlab.freedesktop.org/agd5f/linux into drm-next [airlied: had to reapply drm/amdgpu: Implement "color format" DRM property by hand to amdgpu_dm_connector.c] amd-drm-next-7.3-2026-07-02: amdgpu: - Queue reset updates - Initial compute pipe reset support - Improved boundary checking for bios parsing - Cleaned up sysfs input parsing - devcoredump fixes - RAS updates and rework - VCN secure submission fixes - 8K panel fix - Add display KUnit tests - Display CRC fixes - UserQ updates - Backlight fixes - Parse panel type info from DisplayID - Align IP discovery to pci device lifetime - IOCTL boundary check fixes - Convert amdgpu_vm_lock_by_pasid() to drm_exec - Ctx fixes and cleanup - SOC15 register macro cleanups - Memory placement fixes for UVD - Disable KQ support for MI3xx - GFX9 mode2 reset fix - BO list cleanup - Soc24 aborted suspend fix - Gfx8 soft reset rework - Enable soft reset on gfx8 - Drop unnecessary BUG() and BUG_ON() in error paths - Fix power reporting unit conversion - Improve vbios command table bounds checking - UVD bounds checking improvements - VCN bounds checking improvements - PSR and replay fixes - DCN 4.2 updates - Colorop updates - DC GPIO rework - ACP fixes - Fix aperture mapping leak - Ignore_damage_clips fix - Fixes for non-4K pages - JPEG idle check fixes - Userptr fixes - GPUVM fixes - GC 11.7 updates - SMU 13 fixes amdkfd: - Initial compute pipe reset support - Allow applications to opt out of sigbus on fatal errors - Fix doorbell/mmio BO cleanup - Improved CRIU boundary checking - MQD handling rework - SMI fixes - Reset event fixes - CRIU fixes - Sysfs teardown fixes - IOCTL boundary check fixes - SVM fixes - Soft IH ring fixes - Move TBA/TMA from system to device memory radeon: - Blit fix for large BOs - r600 dpm cleanup fix drm: - Extract EDID base section header processing into helper - Parse panel type from DisplayID 2.x Display Parameters UAPI: - KFD interface for applications to select sigbus behavior on fatal errors Proposed userspace: https://github.com/ROCm/rocm-systems/pull/6190 From: Alex Deucher <alexander.deucher@amd.com> Link: https://patch.msgid.link/20260702141515.67919-1-alexander.deucher@amd.com Signed-off-by: Dave Airlie <airlied@redhat.com>
2026-07-06accel/amdxdna: Fix VMA access raceLizhi Hou
aie2_populate_range() and amdxdna_umap_release() access a saved VMA pointer that may have already been freed, leading to a potential use-after-free. Remove the VMA accesses from these functions to avoid the race. Fixes: e486147c912f ("accel/amdxdna: Add BO import and export") Reviewed-by: Max Zhen <max.zhen@amd.com> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com> Link: https://patch.msgid.link/20260609011242.2833740-1-lizhi.hou@amd.com
2026-07-06accel/amdxdna: Use unsigned long for nr_pages in amdxdna_hmm_register()Lizhi Hou
nr_pages is declared as u32 in amdxdna_hmm_register(), which may not be large enough to represent the number of pages for large mappings. Use unsigned long for nr_pages to avoid potential overflow. Fixes: ac49797c1815 ("accel/amdxdna: Add GEM buffer object management") Reviewed-by: Max Zhen <max.zhen@amd.com> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com> Link: https://patch.msgid.link/20260616061532.3533469-1-lizhi.hou@amd.com
2026-07-06accel/amdxdna: Prevent PM resume deadlock in hwctx_sync_debug_bo()Lizhi Hou
amdxdna_hwctx_sync_debug_bo() invokes the hardware hwctx_sync_debug_bo() callback while holding xdna->dev_lock. The callback may call amdxdna_cmd_submit(), which in turn calls amdxdna_pm_resume_get(). If the device is suspended, amdxdna_pm_resume_get() may synchronously execute amdxdna_pm_resume(), which also acquires xdna->dev_lock, resulting in a deadlock. Avoid the deadlock by calling amdxdna_pm_resume_get() before holding xdna->dev_lock in both amdxdna_hwctx_sync_debug_bo() and amdxdna_drm_config_hwctx_ioctl() Fixes: 7ea046838021 ("accel/amdxdna: Support firmware debug buffer") Reviewed-by: Max Zhen <max.zhen@amd.com> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com> Link: https://patch.msgid.link/20260616212429.3620645-1-lizhi.hou@amd.com
2026-07-07PCI: qcom: Skip PERST# GPIOs provided by downstream PCIe devicesManivannan Sadhasivam
Currently, the pcie-qcom driver recursively parses the PERST# GPIO from all child nodes defined in DT and acquires them. But this creates issues with PERST# GPIO provided by one of the child devices like the PCIe switch port. In this case, the RC driver cannot acquire the PERST# GPIO since it will be provided by the child PCIe device which was not yet enumerated during RC driver probe. Fix this by checking if the GPIO provider is a child of the RC's DT node (i.e., sits behind this PCIe controller). If so, skip it, as PERST# should be controlled by the respective PCIe client driver implementation. GPIOs provided by external GPIO controllers (e.g., TLMM in Qcom SoCs) continue to be handled normally. Fixes: 2fd60a2edb83 ("PCI: qcom: Parse PERST# from all PCIe bridge nodes") Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Link: https://patch.msgid.link/20260616-pci-qcom-perst-fix-v1-1-27600d6ae357@oss.qualcomm.com
2026-07-07PCI: qcom: Add support for HawiMatthew Leung
Add support for the Hawi platform which has two PCIe controllers: one capable of Gen3 x2 operation and one capable of Gen4 x1 operation. Signed-off-by: Matthew Leung <matthew.leung@oss.qualcomm.com> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Link: https://patch.msgid.link/20260625-hawi-pcie-v4-2-1a578603cd86@oss.qualcomm.com
2026-07-07Merge tag 'drm-xe-next-2026-07-03' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/xe/kernel into drm-next UAPI Changes: - Add additional error components to xe drm_ras (Riana) - Drop 'force_execlist' module parameter (Roper) Cross-subsystem Changes: - Perf events: Export perf_allow_{cpu,tracepoint} to be used by Xe (John) Display Changes: - Skip FORCE_WC and vm_bound check for external dma-bufs (Auld) Driver Changes: - Gate observation streams with perf_allow_cpu (John Hubbard) - Documentation updates and fixes (Michal, Zhan) - Remove unreleased NVL-S GuC (Daniele) - Fix pcode init path (Michal) - RTP fixes and improvements (Gustavo, Violet, Thomas, Roper) - TLB invalidation fixes and improvements (Tilak) - PXP detachment from HuC for newer platforms (Daniele) - Multi-queue fix (Niranjana) - Improve Kconfig.profile help (Rodrigo) - Xe_drm_ras and hw_error updates and fixes (Raag, Riana) - NVL-S updated PCI-IDs and W/a (Gustavo, Nitin) - Fix dma_fence refcound (Wentao) - Madvise: optimize invalidation path (Arvind) - Fix a infinite gt-reset loop in the timeout recovery (Rodrigo) - Fix wa_oob codegen recipe for external module builds (Thomas) - Avoid global forcewake in cycle query path (Xin) - Update TTM device benefical_order (Brost) - Fix buffer overflow in guc capture (Tejas) - Page-table fixes and improvements (Brian, Francois, Auld, Brost) - Removing redundant check (Lu) - General MCR and MMIO clean-up and improvements (Michal) - Don't whitelist OA registers unconditionally (Ashutosh) - SVM error return fix (Brost) - Userptr fix and small related clean-ups (Shuicheng) - Don't attempt to process FAST_REQ or EVENT relays on PF (Michal) - Couple fdinfo improvements (Auld) - Drop manual VF check on i2c (Raag) - Probe info outside of xe_info_init functions (Gustavo) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Rodrigo Vivi <rodrigo.vivi@intel.com> Link: https://patch.msgid.link/akf7xr96MI4Rd6Qj@intel.com
2026-07-06x86/cpu: Hide and rename static_cpu_has()Borislav Petkov (AMD)
cpu_feature_enabled() is the one to use to test feature flags so hide the static thing which doesn't pay attention to disabled mask bits anyway. Use the following command to do the replacement: $ git grep --files-with-matches -w static_cpu_has -- ':(exclude)*cpufeature.h' \ | xargs sed -i 's/static_cpu_has(/cpu_feature_enabled\(/g' There should be no functional changes resulting from this. Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Reviewed-by: Nikolay Borisov <nik.borisov@suse.com> Link: https://patch.msgid.link/20260620015041.336288-1-bp@kernel.org
2026-07-07fpga: dfl: fme: add error handlingGriffin Kroah-Hartman
Add error handling to devm_kasprint in fme_perf_pmu_register(). Assisted-by: gkh_clanker_2000 Fixes: 724142f8c42a ("fpga: dfl: fme: add performance reporting support") Cc: stable@kernel.org Cc: Xu Yilun <yilun.xu@intel.com> Cc: Tom Rix <trix@redhat.com> Cc: Moritz Fischer <mdf@kernel.org> Signed-off-by: Griffin Kroah-Hartman <griffin@kroah.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> [ Yilun: Fix stable tag, add Fixes tag ] Reviewed-by: Xu Yilun <yilun.xu@intel.com> Link: https://lore.kernel.org/r/2026070620-unwired-clay-f6cc@gregkh Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
2026-07-06bus: qcom-ebi2: Fix clock leak on probe failureRuoyu Wang
qcom_ebi2_probe() enables the EBI2X and EBI2 clocks before it walks child nodes and populates child devices. If reading a child node's reg property fails, or if of_platform_default_populate() fails, probe returns without disabling either clock. Route those failure paths through the existing clock cleanup labels so a failed probe does not leave the clocks prepared and enabled. Fixes: 335a12754808 ("bus: qcom: add EBI2 driver") Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com> Link: https://lore.kernel.org/r/20260620080406.1970447-1-ruoyuw560@gmail.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-06Revert "clk: qcom: regmap-phy-mux: Rework the implementation"Konrad Dybcio
This reverts commit e108373c54fbc844b7f541c6fd7ecb31772afd3c. This has been reported to break PCIe on at least SM8350 and Eliza platforms. I had originally tested this on Hamoa (X1E) where there were no adverse effects. It's highly likely that this stems from a difference in how the bootloader configures the clocks. Revert the offending change to fix the issue in the immediate, with the intent to revisit it in the upcoming cycle. Reported-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reported-by: Abel Vesa <abel.vesa@oss.qualcomm.com> Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Fixes: e108373c54fb ("clk: qcom: regmap-phy-mux: Rework the implementation") Closes: https://lore.kernel.org/all/c675lcfptr4xgg4hcjp66unmuozgsvgwvtymh7on6jcipjrdw7@jy4h7fkwqwjg/ Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260622-topic-phymux_revert-v1-1-f6ec85523840@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-06soc: qcom: qcom_stats: Add SoCCP and DCP subsystems statsSneh Mankad
Add SMEM items for SoC Control Processor and Display Co-Processor subsystem stats which are present in Hawi SoC. Signed-off-by: Sneh Mankad <sneh.mankad@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260615-add_subsystem_lpm_stats-v1-1-d40fc7c755da@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-07fpga: stratix10-soc: Fix SVC mailbox handling during reconfigurationTien Sung Ang
Fix incorrect stratix10_svc_done() usage during FPGA reconfiguration. Do not call stratix10_svc_done() at the end of write_init() on success, so the SVC session remains active through write() and write_complete(). Call stratix10_svc_done() on failure in write_init() and write() so the shared SVC mailbox is released when reconfiguration aborts, allowing coexistence with other SVC clients such as soc64-hwmon. Fixes: e7eef1d7633a ("fpga: add intel stratix10 soc fpga manager driver") Cc: stable@vger.kernel.org # 5.1+ Signed-off-by: Tien Sung Ang <tien.sung.ang@altera.com> Signed-off-by: Tze Yee Ng <tze.yee.ng@altera.com> Reviewed-by: Xu Yilun <yilun.xu@intel.com> Link: https://lore.kernel.org/r/8768ce3260489c9febdfce08e27d03f5f5ed9c33.1782801986.git.tze.yee.ng@altera.com Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
2026-07-07fpga: xilinx-pr-decoupler: Use devm_clk_get_prepared()Michal Simek
The driver keeps the "aclk" clock prepared but disabled in its idle state, toggling only the atomic clk_enable()/clk_disable() around register accesses in the bridge enable_set/enable_show callbacks. At probe time this was open-coded as clk_prepare_enable() immediately followed by clk_disable(), leaving the clock prepared, with a matching clk_unprepare() in the error path and in remove(). devm_clk_get_prepared() expresses exactly this: it gets and prepares the clock and unprepares it automatically on driver detach. Use it to drop the manual prepare/disable dance, the error-path unprepare, and the now-empty clock teardown in remove(). Signed-off-by: Michal Simek <michal.simek@amd.com> Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com> Reviewed-by: Xu Yilun <yilun.xu@intel.com> Link: https://lore.kernel.org/r/8ca8ee5ba720b608a41f842d2b743302e5500ad0.1782205286.git.michal.simek@amd.com Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
2026-07-06clk: qcom: Add support for VideoCC driver for HawiLin Li
Enable Hawi video clock driver for video SW to be able to control the clocks from the Video SW driver. Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Lin Li <zhuolin.li@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260702-hawi-videocc-v1-2-6c1e640b0954@oss.qualcomm.com [bjorn: Added default m, per request from Krzysztof] Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-06clk: qcom: Add EVA clock controller driver for Glymur SoCTaniya Das
Add the Enhanced Video Analytics (EVA) clock controller driver for the Glymur SoC. The EVACC manages the PLL, RCGs, branch clocks, GDSCs and resets for the EVA subsystem which handles vision processing workloads. Signed-off-by: Taniya Das <taniya.das@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260617-evacc_glymur-v2-3-905108dacaaa@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-06clk: qcom: gcc-glymur: Move EVA clocks to critical clock listTaniya Das
The gcc_eva_ahb_clk and gcc_eva_xo_clk branch clocks should not be registered as standalone GCC branch clocks. Drop these clocks from the GCC clock list and instead add their CBCR registers to the GCC critical clocks list to ensure they remain enabled during early boot. If these clocks are registered as normal branch clocks, they may be gated, which breaks access to the EVA clock controller during clock controller probe, thus leave them as critical clocks similar to other subsystem AHB and XO clocks. Fixes: efe504300a17 ("clk: qcom: gcc: Add support for Global Clock Controller") Signed-off-by: Taniya Das <taniya.das@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260617-evacc_glymur-v2-1-905108dacaaa@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-06clk: qcom: Don't use all caps for Glymur GPUCCLuca Weiss
All other Glymur driver use "Glymur" and not all caps "GLYMUR". Align the prompt and help text. Signed-off-by: Luca Weiss <luca.weiss@fairphone.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260701-glymur-uncaps-v1-1-5f7065348eb2@fairphone.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-06soc: qcom: ice: Support IP version beyond v3Manivannan Sadhasivam
This driver currently supports Inline Crypto Engine (ICE) IP version 3 and 4. But this driver fully supports v5 and should support upcoming versions as well. So extend the version check to support versions 3 and beyond. Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260521131229.11199-1-mani@kernel.org Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-07iio: hid-sensors: Use implicit NULL pointer checksSanjay Chitroda
Replace explicit NULL pointer comparisons with implicit checks across HID sensor IIO drivers to fix kernel coding style. CHECK: Comparison to NULL could be written ... No functional change. Signed-off-by: Sanjay Chitroda <sanjayembeddedse@gmail.com> Reviewed-by: Maxwell Doose <m32285159@gmail.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2026-07-07iio: hid-sensors: align function parenthesis for readabilitySanjay Chitroda
Adjust alignment of parentheses across HID sensor IIO drivers to improve readability and maintain consistency with kernel coding style. While updating the formatting, group related arguments consistently in multi-line function signatures where appropriate. No functional change intended. Signed-off-by: Sanjay Chitroda <sanjayembeddedse@gmail.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2026-07-07Merge tag 'drm-intel-next-2026-07-02' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/i915/kernel into drm-next drm/i915 feature pull for v7.3: Features and functionality: - Novalake (NVL, display versio 35) Common Mode Timing Generator (CMTG) enabling (Animesh) - NVL DC3CO enabling (Dibin) Refactoring and cleanups: - Refactor and document DP link recovery and capability tracking (Imre) - i915 and xe driver display probe/remove/suspend/resume/shutdown cleanup and unification (Jani) - Clean up bandwidth/SAGV code (Ville) - Streamline Pre/Post-CSC LUT loops (Jani) - Remove unused TGL DC3DO support (Dibin) - Make read-only array rates static const (Colin Ian King) - CDCLK sanitization improvements and cleanups (Ville) - Break i915 and xe panic dependency on struct intel_framebuffer (Jani) - GPIO pin renames and cleanups (Ville) - Unify generic irq handler error messages (Jonathan) Fixes: - Various color pipeline fixes (Chaitanya) - Fix step discontinuity in Pre/Post-CSC Gamma LUT (Sean Paul) - Improve refresh rate changes without full modeset on VRR capable eDP (Ville) - Display suspend/resume fixes (Imre) - Fix LPE audio irq for PREEMPT-RT (Maarten) - Fix HDMI scrambling enable (Jerome Tollet) - LNL bandwidth buddy programming update (Vinod) - Streamline display register wait timeouts (Ville) - Fix DP MSA VTotal (Mitul) - Fix LTPHY SSC enabling (Suraj) - Fix LOBF requirements with optimized guardband (Ankit) - Avoid full modeset for LRR vsync changes (Ankit) - Fix vtotal-vsync distance when adjusting vtotal for lower refresh rate (Ankit) - Extend VRR safe window wait for default VRR timing generator usage (Ankit) Merges: - Backmerge for v7.2-rc1 (Jani) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Jani Nikula <jani.nikula@intel.com> Link: https://patch.msgid.link/934cacdbf2a37856eb5cd6337d8774b449405bd8@intel.com
2026-07-06clk: qcom: gxclkctl: Remove GX/GMxC rail votes to align with IFPCTaniya Das
The GX GDSC control is handled through a dedicated clock controller, and the enable/disable sequencing depends on correct rail voting. The driver votes for the GX/GMxC rails and CX GDSC before toggling the GX GDSC. Currently, during GMU runtime PM resume, rails remain enabled due to upstream votes propagated via RPM-enabled devlinks and explicit pm_runtime votes on GX GDSC. This is not an expected behaviour of IFPC(Inter Frame Power Collapse) requirements of GPU as GMU firmware is expected to control these rails, except during the GPU/GMU recovery via the OS and that is where the GX GDSC should be voting for the rails (GX/GMxC and CX GDSC) before toggling the GX GDSC. Thus, disable runtime PM after successfully registering the clock controller. Signed-off-by: Taniya Das <taniya.das@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260427-gfx-clk-fixes-v2-4-797e54b3d464@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-06clk: qcom: common: ensure runtime PM suspend completes on probeTaniya Das
When the clock controller is probed with 'use_rpm' enabled, the runtime PM reference is currently released using pm_runtime_put(), which may return before the runtime suspend has completed. When the clock controller device is registered through this function, calling pm_runtime_disable() immediately after pm_runtime_put() prevents the runtime suspend from completing, leaving the clock controller active and the HW rails in the ON state. Use pm_runtime_put_sync() instead to ensure the runtime PM “putV completes synchronously during probe. This does not have any functional impact, but it guarantees that the device is fully runtime-suspended before returning. Signed-off-by: Taniya Das <taniya.das@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260427-gfx-clk-fixes-v2-3-797e54b3d464@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-06clk: qcom: gxclkctl: Use custom disable callback for gx_gdscTaniya Das
The GX GDSC represents a special GPU power domain that must not be disabled during normal runtime PM flows. As per the GMU architecture, GX GDSC should only be force-disabled during GMU/GPU recovery, where the OS explicitly resets the GX power domain. However, when managed by the generic GDSC runtime PM path, GX GDSC may be disabled during GMU runtime suspend, resulting in warnings such as: gx_clkctl_gx_gdsc status stuck at 'on' and failures in gdsc_toggle_logic() during rpm suspend. Use the newly added custom disable callback for gx_gdsc to ensure the GDSC is toggled only in recovery scenarios, while preventing unintended disable attempts during normal GMU runtime PM operations. Reported-by: Pengyu Luo <mitltlatltl@gmail.com> Closes: https://lore.kernel.org/all/CAH2e8h4Vp9fJYAUUbOmoHSKB25wakPBvmpwa62BTRqgRQbMWuw@mail.gmail.com/ Reported-by: Alexander Koskovich <akoskovich@pm.me> Closes: https://lore.kernel.org/all/gwVAH2mJerU4dBInw8pKmOs5aQK55Q7W6q_UQAlLFCsEgX6eyvSgXAWbNNMqAX4WmPlYCKUSMhfkr5Jry4Ps5EqnxYZqEEDd3Whwv7ZXGlc=@pm.me/ Fixes: 5af11acae660 ("clk: qcom: Add a driver for SM8750 GPU clocks") Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Taniya Das <taniya.das@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260427-gfx-clk-fixes-v2-2-797e54b3d464@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-06clk: qcom: gdsc: Add custom disable callback for GX GDSCJagadeesh Kona
The GX GDSC is a special power domain that should only be disabled by OS during GMU recovery. In all other scenarios, the GMU firmware is responsible for handling its disable sequence, and OS must not interfere. During the resume_noirq() phase of system resume, the GenPD framework enables all power domains and later disables them in the complete() phase if there are no active votes from OS. This behavior can incorrectly disable the GX GDSC while the GMU firmware is still using it. To prevent this, implement a custom disable callback for GX GDSC that relies on GenPD’s synced_poweroff flag. The GMU driver sets this flag only during recovery, allowing OS to explicitly disable GX GDSC in hardware in that case. In all other situations, the disable callback will avoid touching GX GDSC hardware. Signed-off-by: Jagadeesh Kona <jagadeesh.kona@oss.qualcomm.com> Signed-off-by: Taniya Das <taniya.das@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260427-gfx-clk-fixes-v2-1-797e54b3d464@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-07Merge tag 'drm-misc-next-2026-07-02' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/misc/kernel into drm-next drm-misc-next for 7.3: UAPI Changes: Cross-subsystem Changes: Core Changes: - bridge: Add atomic_create_state callback and helpers, drop atomic_reset - dp: Add support for DSC max delta BPP - edid: Parse panel type from DisplayID 2.x Display Parameters - sysfb: Improve panel, stride and framebuffer size validation Driver Changes: - hibmc: Improvements to the plane formats handling, switch to gem-shmem - nouveau: race fixes, misc improvements - bridges: - Convert all bridges to atomic_create_state - panels: - panel-edp: New quirks for BOE NE160QDM-NY1, MB116AS01 Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maxime Ripard <mripard@redhat.com> Link: https://patch.msgid.link/20260702-powerful-successful-raptor-eded34@houat
2026-07-06firmware: stratix10-svc: fix memory leaks and list corruption bugsTze Yee Ng
Fix a memory leak when gen_pool_alloc() fails by freeing pmem on the error path. Switch pmem allocation from devm_kzalloc() to kzalloc() with explicit kfree() in the free path to match its list-managed lifetime. Remove the erroneous list_del(&svc_data_mem) which corrupted the list head on failed lookups. Fixes: 7ca5ce896524 ("firmware: add Intel Stratix10 service layer driver") Cc: stable@vger.kernel.org # 5.0+ Signed-off-by: Tze Yee Ng <tze.yee.ng@altera.com> Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
2026-07-06regulator: qcom_usb_vbus: add pm4125 VBUS regulator supportMark Brown
Rakesh Kota <rakesh.kota@oss.qualcomm.com> says: Add support for PM4125 USB VBUS regulator. Unlike PM8150B which uses a current-limit selector, PM4125 uses a 2-bit VBOOST voltage selector supporting 4.25 V, 4.5 V, 4.75 V and 5.0 V output. Link: https://patch.msgid.link/20260706-add_pm4125-vbus-reg-v3-0-999d78a87b81@oss.qualcomm.com
2026-07-06regulator: qcom_usb_vbus: add support for qcom,pm4125-vbus-regRakesh Kota
The PM4125 PMIC uses a different register layout for USB VBUS control compared to PM8150B. On PM4125, CMD_OTG is at offset 0x50, OTG_CFG is at 0x56, and offset 0x52 is a 2-bit VBOOST voltage selector rather than a current-limit selector. Add pm4125_data using the abstraction introduced for PM8150B, along with dedicated voltage-selector ops and the pm4125_vboost_table covering the four supported boost voltages: 4.25 V, 4.5 V, 4.75 V, and 5.0 V. Signed-off-by: Rakesh Kota <rakesh.kota@oss.qualcomm.com> Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://patch.msgid.link/20260706-add_pm4125-vbus-reg-v3-3-999d78a87b81@oss.qualcomm.com Signed-off-by: Mark Brown <broonie@kernel.org>
generated by cgit v1.2.3 (git 2.39.1) at 2026-08-10 10:22:22 +0000