summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2026-07-07Merge tag 'drm-intel-next-2026-07-02' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/i915/kernel into drm-next drm/i915 feature pull for v7.3: Features and functionality: - Novalake (NVL, display versio 35) Common Mode Timing Generator (CMTG) enabling (Animesh) - NVL DC3CO enabling (Dibin) Refactoring and cleanups: - Refactor and document DP link recovery and capability tracking (Imre) - i915 and xe driver display probe/remove/suspend/resume/shutdown cleanup and unification (Jani) - Clean up bandwidth/SAGV code (Ville) - Streamline Pre/Post-CSC LUT loops (Jani) - Remove unused TGL DC3DO support (Dibin) - Make read-only array rates static const (Colin Ian King) - CDCLK sanitization improvements and cleanups (Ville) - Break i915 and xe panic dependency on struct intel_framebuffer (Jani) - GPIO pin renames and cleanups (Ville) - Unify generic irq handler error messages (Jonathan) Fixes: - Various color pipeline fixes (Chaitanya) - Fix step discontinuity in Pre/Post-CSC Gamma LUT (Sean Paul) - Improve refresh rate changes without full modeset on VRR capable eDP (Ville) - Display suspend/resume fixes (Imre) - Fix LPE audio irq for PREEMPT-RT (Maarten) - Fix HDMI scrambling enable (Jerome Tollet) - LNL bandwidth buddy programming update (Vinod) - Streamline display register wait timeouts (Ville) - Fix DP MSA VTotal (Mitul) - Fix LTPHY SSC enabling (Suraj) - Fix LOBF requirements with optimized guardband (Ankit) - Avoid full modeset for LRR vsync changes (Ankit) - Fix vtotal-vsync distance when adjusting vtotal for lower refresh rate (Ankit) - Extend VRR safe window wait for default VRR timing generator usage (Ankit) Merges: - Backmerge for v7.2-rc1 (Jani) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Jani Nikula <jani.nikula@intel.com> Link: https://patch.msgid.link/934cacdbf2a37856eb5cd6337d8774b449405bd8@intel.com
2026-07-06clk: qcom: gxclkctl: Remove GX/GMxC rail votes to align with IFPCTaniya Das
The GX GDSC control is handled through a dedicated clock controller, and the enable/disable sequencing depends on correct rail voting. The driver votes for the GX/GMxC rails and CX GDSC before toggling the GX GDSC. Currently, during GMU runtime PM resume, rails remain enabled due to upstream votes propagated via RPM-enabled devlinks and explicit pm_runtime votes on GX GDSC. This is not an expected behaviour of IFPC(Inter Frame Power Collapse) requirements of GPU as GMU firmware is expected to control these rails, except during the GPU/GMU recovery via the OS and that is where the GX GDSC should be voting for the rails (GX/GMxC and CX GDSC) before toggling the GX GDSC. Thus, disable runtime PM after successfully registering the clock controller. Signed-off-by: Taniya Das <taniya.das@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260427-gfx-clk-fixes-v2-4-797e54b3d464@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-06clk: qcom: common: ensure runtime PM suspend completes on probeTaniya Das
When the clock controller is probed with 'use_rpm' enabled, the runtime PM reference is currently released using pm_runtime_put(), which may return before the runtime suspend has completed. When the clock controller device is registered through this function, calling pm_runtime_disable() immediately after pm_runtime_put() prevents the runtime suspend from completing, leaving the clock controller active and the HW rails in the ON state. Use pm_runtime_put_sync() instead to ensure the runtime PM “putV completes synchronously during probe. This does not have any functional impact, but it guarantees that the device is fully runtime-suspended before returning. Signed-off-by: Taniya Das <taniya.das@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260427-gfx-clk-fixes-v2-3-797e54b3d464@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-06clk: qcom: gxclkctl: Use custom disable callback for gx_gdscTaniya Das
The GX GDSC represents a special GPU power domain that must not be disabled during normal runtime PM flows. As per the GMU architecture, GX GDSC should only be force-disabled during GMU/GPU recovery, where the OS explicitly resets the GX power domain. However, when managed by the generic GDSC runtime PM path, GX GDSC may be disabled during GMU runtime suspend, resulting in warnings such as: gx_clkctl_gx_gdsc status stuck at 'on' and failures in gdsc_toggle_logic() during rpm suspend. Use the newly added custom disable callback for gx_gdsc to ensure the GDSC is toggled only in recovery scenarios, while preventing unintended disable attempts during normal GMU runtime PM operations. Reported-by: Pengyu Luo <mitltlatltl@gmail.com> Closes: https://lore.kernel.org/all/CAH2e8h4Vp9fJYAUUbOmoHSKB25wakPBvmpwa62BTRqgRQbMWuw@mail.gmail.com/ Reported-by: Alexander Koskovich <akoskovich@pm.me> Closes: https://lore.kernel.org/all/gwVAH2mJerU4dBInw8pKmOs5aQK55Q7W6q_UQAlLFCsEgX6eyvSgXAWbNNMqAX4WmPlYCKUSMhfkr5Jry4Ps5EqnxYZqEEDd3Whwv7ZXGlc=@pm.me/ Fixes: 5af11acae660 ("clk: qcom: Add a driver for SM8750 GPU clocks") Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Taniya Das <taniya.das@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260427-gfx-clk-fixes-v2-2-797e54b3d464@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-06clk: qcom: gdsc: Add custom disable callback for GX GDSCJagadeesh Kona
The GX GDSC is a special power domain that should only be disabled by OS during GMU recovery. In all other scenarios, the GMU firmware is responsible for handling its disable sequence, and OS must not interfere. During the resume_noirq() phase of system resume, the GenPD framework enables all power domains and later disables them in the complete() phase if there are no active votes from OS. This behavior can incorrectly disable the GX GDSC while the GMU firmware is still using it. To prevent this, implement a custom disable callback for GX GDSC that relies on GenPD’s synced_poweroff flag. The GMU driver sets this flag only during recovery, allowing OS to explicitly disable GX GDSC in hardware in that case. In all other situations, the disable callback will avoid touching GX GDSC hardware. Signed-off-by: Jagadeesh Kona <jagadeesh.kona@oss.qualcomm.com> Signed-off-by: Taniya Das <taniya.das@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260427-gfx-clk-fixes-v2-1-797e54b3d464@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-07Merge tag 'drm-misc-next-2026-07-02' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/misc/kernel into drm-next drm-misc-next for 7.3: UAPI Changes: Cross-subsystem Changes: Core Changes: - bridge: Add atomic_create_state callback and helpers, drop atomic_reset - dp: Add support for DSC max delta BPP - edid: Parse panel type from DisplayID 2.x Display Parameters - sysfb: Improve panel, stride and framebuffer size validation Driver Changes: - hibmc: Improvements to the plane formats handling, switch to gem-shmem - nouveau: race fixes, misc improvements - bridges: - Convert all bridges to atomic_create_state - panels: - panel-edp: New quirks for BOE NE160QDM-NY1, MB116AS01 Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maxime Ripard <mripard@redhat.com> Link: https://patch.msgid.link/20260702-powerful-successful-raptor-eded34@houat
2026-07-06firmware: stratix10-svc: fix memory leaks and list corruption bugsTze Yee Ng
Fix a memory leak when gen_pool_alloc() fails by freeing pmem on the error path. Switch pmem allocation from devm_kzalloc() to kzalloc() with explicit kfree() in the free path to match its list-managed lifetime. Remove the erroneous list_del(&svc_data_mem) which corrupted the list head on failed lookups. Fixes: 7ca5ce896524 ("firmware: add Intel Stratix10 service layer driver") Cc: stable@vger.kernel.org # 5.0+ Signed-off-by: Tze Yee Ng <tze.yee.ng@altera.com> Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
2026-07-06regulator: qcom_usb_vbus: add pm4125 VBUS regulator supportMark Brown
Rakesh Kota <rakesh.kota@oss.qualcomm.com> says: Add support for PM4125 USB VBUS regulator. Unlike PM8150B which uses a current-limit selector, PM4125 uses a 2-bit VBOOST voltage selector supporting 4.25 V, 4.5 V, 4.75 V and 5.0 V output. Link: https://patch.msgid.link/20260706-add_pm4125-vbus-reg-v3-0-999d78a87b81@oss.qualcomm.com
2026-07-06regulator: qcom_usb_vbus: add support for qcom,pm4125-vbus-regRakesh Kota
The PM4125 PMIC uses a different register layout for USB VBUS control compared to PM8150B. On PM4125, CMD_OTG is at offset 0x50, OTG_CFG is at 0x56, and offset 0x52 is a 2-bit VBOOST voltage selector rather than a current-limit selector. Add pm4125_data using the abstraction introduced for PM8150B, along with dedicated voltage-selector ops and the pm4125_vboost_table covering the four supported boost voltages: 4.25 V, 4.5 V, 4.75 V, and 5.0 V. Signed-off-by: Rakesh Kota <rakesh.kota@oss.qualcomm.com> Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://patch.msgid.link/20260706-add_pm4125-vbus-reg-v3-3-999d78a87b81@oss.qualcomm.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-06regulator: qcom_usb_vbus: add register abstraction and PM8150B supportRakesh Kota
Introduce per-compatible regulator descriptor data via struct qcom_usb_vbus_reg_data to abstract register layout differences between PMICs. This allows the probe function to dynamically populate the regulator_desc fields rather than relying on compile-time constants. Refactor the existing PM8150B support to use this abstraction, wiring in its CMD_OTG, OTG_CFG, and current-limit registers through pm8150b_data. No functional change is intended for PM8150B. Signed-off-by: Rakesh Kota <rakesh.kota@oss.qualcomm.com> Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Link: https://patch.msgid.link/20260706-add_pm4125-vbus-reg-v3-2-999d78a87b81@oss.qualcomm.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-06irqchip/irq-imgpdc: Remove unused driverBen Hutchings
The irq-imgpdc driver is controlled by CONFIG_IMGPDC_IRQ, which cannot be enabled. It used to be selected by CONFIG_SOC_TZ1090, but that was removed along with the metag architecture in Linux 4.17. Signed-off-by: Ben Hutchings <benh@debian.org> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/akvddtMQTDKLo2PH@decadent.org.uk
2026-07-06drm/panel-edp: Support MNE001BS6-2 and MNF601BS4-1 edp panelHaikun Zhou
MNE001BS6-2 raw edid: 00 ff ff ff ff ff ff 00 0e 77 86 14 00 00 00 00 0f 24 01 04 a5 1f 11 78 03 2c c5 94 5c 59 95 29 1e 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 af 2b 80 a0 70 38 28 40 30 20 66 00 36 ad 10 00 00 1a 00 00 00 fd 00 28 3c 43 43 0e 01 0a 20 20 20 20 20 20 00 00 00 fe 00 3d 4c 20 20 20 20 20 20 20 20 20 20 ff 00 00 00 fc 00 4d 4e 45 30 30 31 42 53 36 2d 32 0a 20 01 80 70 20 79 02 00 21 00 1d 15 0c cc 06 80 07 38 04 80 3f 79 5c 9e 05 95 9c f2 1d 02 45 54 b0 5c b0 5c 00 42 12 78 22 00 14 03 22 02 84 7f 07 9f 00 2f 80 1f 00 37 04 27 00 05 00 05 00 2b 00 0c 27 00 28 3b 00 00 27 00 28 3b 00 00 2e 00 06 00 42 b0 5c b0 5c 81 00 1e 72 1a 00 00 03 01 28 3c 00 00 53 ff 53 ff 3c 00 00 00 00 e3 05 04 00 e6 06 01 01 53 53 ff 00 00 00 00 00 00 00 00 00 70 90 MNF601BS4-1 raw edid: 00 ff ff ff ff ff ff 00 0e 77 3f 15 00 00 00 00 0f 24 01 04 a5 22 13 78 03 2c c5 94 5c 59 95 29 1e 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 ae 2b 80 a0 70 38 28 40 30 20 36 00 58 c1 10 00 00 1a 00 00 00 fd 00 28 3c 44 44 0e 01 0a 20 20 20 20 20 20 00 00 00 fe 00 3d 4c 20 20 20 20 20 20 20 20 20 20 ff 00 00 00 fc 00 4d 4e 46 36 30 31 42 53 34 2d 31 0a 20 01 b6 70 20 79 00 00 21 00 1d 72 0d 90 07 80 07 38 04 80 3f 79 5c 9e 05 95 9c f2 1d 02 45 54 b0 5c b0 5c 00 42 12 78 22 00 14 04 22 02 84 7f 07 9f 00 2f 00 1f 00 37 04 27 00 02 00 05 00 2b 00 0c 27 00 28 3b 00 00 27 00 28 3b 00 00 2e 00 06 00 42 b0 5c b0 5c 81 00 1e 72 1a 00 00 03 01 28 3c 00 00 4b ff 4b ff 3c 00 00 00 00 e3 05 04 00 e6 06 01 01 53 53 ff 00 00 00 00 00 00 00 00 00 e1 90 Signed-off-by: Haikun Zhou <zhouhaikun5@huaqin.corp-partner.google.com> Reviewed-by: Douglas Anderson <dianders@chromium.org> Signed-off-by: Douglas Anderson <dianders@chromium.org> Link: https://patch.msgid.link/20260706080333.41426-1-zhouhaikun5@huaqin.corp-partner.google.com
2026-07-06clk: spacemit: k3: set hdma clock as criticalYixun Lan
HDMA clock is responsible for the internal TCM access path of X100 RISC-V core, so set the clock flag as critical to prevent it from being shut off, otherwise the Linux system will hang, for example in the case of a vector instruction access generates a page fault. Fixes: e371a77255b8 ("clk: spacemit: k3: add the clock tree") Reported-by: Han Gao <gaohan@iscas.ac.cn> Tested-by: Aurelien Jarno <aurelien@aurel32.net> Link: https://patch.msgid.link/20260630-06-clk-hdma-critial-v1-1-443c0ac88c5f@kernel.org Signed-off-by: Yixun Lan <dlan@kernel.org>
2026-07-06bus: ti-sysc: Fix /chosen node reference leakYuho Choi
sysc_init_stdout_path() gets the /chosen node with of_find_node_by_path() to read stdout-path. The function then overwrites the local node pointer with the stdout-path lookup result, or exits on error, without dropping the /chosen reference. Keep the /chosen node in a separate variable and put it after the stdout-path value has been used for the lookup. The successful stdout node lookup remains referenced by the cached stdout_path pointer. Fixes: 3bb37c8e6e6a ("bus: ti-sysc: Handle stdout-path for debug console") Signed-off-by: Yuho Choi <dbgh9129@gmail.com> Reviewed-by: Andreas Kemnade <andreas@kemnade.info> Link: https://patch.msgid.link/20260615200540.770205-1-dbgh9129@gmail.com Signed-off-by: Kevin Hilman (TI) <khilman@baylibre.com>
2026-07-06cpufreq: intel_pstate: Rearrange checks in hybrid_get_cost()Rafael J. Wysocki
Make the checks in hybrid_get_cost() more straightforward. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/2832945.mvXUDI8C0e@rafael.j.wysocki
2026-07-06drm/rockchip: Remove dependency on DRM simple helpersDiogo Silva
Simple KMS helper are deprecated since they only add an intermediate layer between drivers and the atomic modesetting. This patch removes the drm_simple_encoder_init() helper usage in the rockchip drivers by open coding it and using the encoder atomic helpers directly. This is a step to eventually get rid of this simple KMS helper, once all drivers that use it have been converted. Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Signed-off-by: Diogo Silva <diogompaissilva@gmail.com> Signed-off-by: Heiko Stuebner <heiko@sntech.de> Link: https://patch.msgid.link/20260704-rockchip-drm-simple-v5-1-a333f527a4f9@gmail.com
2026-07-06cxl/features: bound fwctl command payload to the input bufferZhenhao Wan
fwctl_cmd_rpc() copies cmd->in_len bytes into inbuf = kvzalloc(cmd->in_len) and passes inbuf and in_len to ->fw_rpc(). The CXL callback cxlctl_fw_rpc() ignores in_len and never checks the user-controlled op_size against it. cxlctl_set_feature() bounds op_size only from below (op_size <= sizeof(feat_in->hdr)) and then reads op_size - sizeof(hdr) bytes from feat_in->feat_data via cxl_set_feature(). With a small in_len and a large op_size the first memcpy() already reads past the kvzalloc(in_len) buffer; the out-of-bounds bytes are placed in the mailbox payload and sent to the device, and a large enough op_size can walk into unmapped memory and oops the kernel. The Get paths pin op_size to a fixed size but likewise read the input struct without checking in_len. Reject, at the single dispatch point, any request whose fixed header plus op_size does not fit in the copied-in buffer. The lower-bound test guards the subtraction and ensures op_size was copied in before it is read. Fixes: eb5dfcb9e36d ("cxl: Add support to handle user feature commands for set feature") Reported-by: Yuhao Jiang <danisjiang@gmail.com> Signed-off-by: Zhenhao Wan <whi4ed0g@gmail.com> Cc: stable@vger.kernel.org Reviewed-by: Jason Gunthorpe <jgg@nvidia.com> Link: https://patch.msgid.link/20260620-cxl-fwctl-oob-v1-1-5758e34d784a@gmail.com Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-07-06ACPI: APEI: GHES: Mark ghes_in_nmi_spool_from_list() as maybe unusedRui Qi
When CONFIG_ACPI_APEI_SEA and CONFIG_HAVE_ACPI_APEI_NMI are both disabled, ghes_in_nmi_spool_from_list() becomes an unused static function and triggers -Werror=unused-function in some configs, for example riscv defconfig with APEI disabled. Mark it as __maybe_unused to silence the warning while keeping the code available for configurations that use SEA or APEI NMI. Reviewed-by: Breno Leitao <leitao@debian.org> Reviewed-by: Hanjun Guo <guohanjun@huawei.com> Reviewed-by: Shuai Xue <xueshuai@linux.alibaba.com> Signed-off-by: Rui Qi <qirui.001@bytedance.com> Link: https://patch.msgid.link/20260630061445.2191731-1-qirui.001@bytedance.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-07-06PNP: Fix card device cleanup on registration failureYuho Choi
pnp_add_card() ignores __pnp_add_device() failures. If device_register() fails there, the device is removed from the global and protocol lists, but remains on the card list and its device reference is not dropped. Remove the failed device from the card list and call put_device() before continuing with the remaining card devices. Signed-off-by: Yuho Choi <dbgh9129@gmail.com> Link: https://patch.msgid.link/20260703033603.114931-1-dbgh9129@gmail.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-07-06PCI/sysfs: Fix read byte order in pci_read_legacy_io()Krzysztof Wilczyński
pci_read_legacy_io() passes the sysfs buffer directly to pci_legacy_read(): return pci_legacy_read(bus, off, (u32 *)buf, count); The PowerPC implementation stores the result as a native-endian integer: *((u16 *)val) = in_le16(addr); On big-endian PowerPC this stores the bytes in the wrong order, so a 2-byte read of a device register returns different bytes than two 1-byte reads at the same addresses. The same applies to 4-byte reads. On little-endian the native byte order already matches PCI I/O port byte order, so the conversion is a no-op. Thus, let pci_legacy_read() store into a local u32 variable, then copy the I/O port value to the sysfs buffer using put_unaligned_le16() and put_unaligned_le32() for the 2 and 4 byte cases, converting from the native integer to little-endian byte order matching PCI I/O port space. No changes are needed for the Alpha platform. The legacy_io file is root-only and exists only on Alpha and PowerPC, the two architectures that define HAVE_PCI_LEGACY. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260616163131.2763281-2-kwilczynski@kernel.org Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
2026-07-06PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io()Krzysztof Wilczyński
pci_write_legacy_io() loads 4 bytes from the kernfs write buffer regardless of how many bytes userspace wrote: if (count != 1 && count != 2 && count != 4) return -EINVAL; return pci_legacy_write(bus, off, *(u32 *)buf, count); kernfs_fop_write_iter() allocates the buffer with kmalloc(len + 1), so a 1-byte write to the legacy_io sysfs file allocates 2 bytes and the unconditional u32 load reads up to 2 bytes past the end of the allocation, which KASAN reports as a slab-out-of-bounds read. Similarly, a 2-byte write overreads by 1 byte. Thus, read only the number of bytes requested using get_unaligned_le16() and get_unaligned_le32() for the 2 and 4 byte cases, interpreting the buffer as little-endian to match the byte ordering of PCI I/O port space. The PowerPC implementation previously compensated for the generic code's native-endian 32-bit load by shifting the value into place for the 1 and 2 byte cases. The shifts were only correct on big-endian kernels. On little-endian PowerPC (POWER8 and later), they extracted the wrong bytes, so a 1-byte write wrote an out-of-bounds byte instead of the requested value. On big-endian, the native load also caused out_le16() and out_le32() to reverse the user's bytes on the wire for 2 and 4 byte writes. The little-endian helpers resolve both issues, so the shifts are removed. No changes are needed for the Alpha platform. The legacy_io file is root-only and exists only on Alpha and PowerPC, the two architectures that define HAVE_PCI_LEGACY. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260616163131.2763281-1-kwilczynski@kernel.org Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
2026-07-06ACPI: NUMA: remove redundant node_set() callSang-Heon Jeon
numa_add_memblk() now sets the node in numa_nodes_parsed itself, so the caller's own node_set() is redundant. Remove it. No functional change. Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com> [ rjw: Subject adjustment ] Link: https://patch.msgid.link/20260703041329.2797584-3-ekffu200098@gmail.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-07-06remoteproc: xlnx: Add crash detection mechanismTanmay Shah
Remote processor will report the crash reason via the resource table and notify the host via mailbox notification. The host checks this crash reason on every mailbox notification from the remote and report to the rproc core framework. Then the rproc core framework will start the recovery process. Signed-off-by: Tanmay Shah <tanmay.shah@amd.com> Link: https://lore.kernel.org/r/20260630004806.3835488-3-tanmay.shah@amd.com Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
2026-07-07drm/sun4i: fix refcount leak in sun4i_backend_init_sat()Wentao Liang
When sun4i_backend_init_sat() calls reset_control_deassert() it increments the deassert_count of the reset controller, and must pair that with a reset_control_assert() call to decrement it. In the error path where clk_prepare_enable() fails, the function returns immediately without calling reset_control_assert(), leaking the reference count. Other error paths, like the devm_clk_get() failure, correctly jump to the err_assert_reset label which performs the missing assert. Fix the leak by using the existing err_assert_reset label in the clk_prepare_enable error path instead of returning directly. Cc: stable@vger.kernel.org Fixes: 440d2c7b127a ("drm/sun4i: backend: Handle the SAT") Signed-off-by: Wentao Liang <vulab@iscas.ac.cn> Reviewed-by: Jernej Skrabec <jernej.skrabec@gmail.com> Link: https://patch.msgid.link/20260607030950.83636-1-vulab@iscas.ac.cn Signed-off-by: Chen-Yu Tsai <wens@kernel.org>
2026-07-06remoteproc: core: Full attach detach during recoveryTanmay Shah
Current attach on recovery mechanism loads the clean resource table during recovery, but doesn't re-allocate the resources. RPMsg communication will fail after recovery due to this. Fix this incorrect behavior by doing the full detach and attach of remote processor during the recovery. This will load the clean resource table and re-allocate all the resources, which will set up correct vring information in the resource table. Signed-off-by: Tanmay Shah <tanmay.shah@amd.com> Link: https://lore.kernel.org/r/20260630004806.3835488-2-tanmay.shah@amd.com Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
2026-07-07drm/sun4i: Remove dependency on DRM simple helpersDiogo Silva
Simple KMS helper are deprecated since they only add an intermediate layer between drivers and the atomic modesetting. This patch removes the dependency on drm simple helpers from sun4i DRM drivers. Signed-off-by: Diogo Silva <diogompaissilva@gmail.com> Reviewed-by: Jernej Skrabec <jernej.skrabec@gmail.com> Link: https://patch.msgid.link/20260623-sun4i_simple-v1-1-fa6696df1fad@gmail.com Signed-off-by: Chen-Yu Tsai <wens@kernel.org>
2026-07-06Merge tag 'v7.2-rc2' into togregJonathan Cameron
Linux 7.2-rc2 Done to resolve conflicts with header reorg around mod_devicetable.h and provide a base for other inflight series that touch the includes.
2026-07-06drm/xe/debugfs: Add debugfs for pcode informationKarthik Poosa
Introduce a pcode_info debugfs entry to report pcode details. This initial implementation exposes the pcode version. This can aid debugging when the pcode version is needed. Signed-off-by: Karthik Poosa <karthik.poosa@intel.com> Reviewed-by: Michael J. Ruhl <michael.j.ruhl@intel.com> Link: https://patch.msgid.link/20260702092540.1005095-3-karthik.poosa@intel.com Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
2026-07-06drm/xe/pcode: Add support to get pcode version from PMTKarthik Poosa
Add api get_pcode_version() to read pcode version from PMT telemetry. Add PUNIT_VERSION telemetry offset in xe_pmt.h. Signed-off-by: Karthik Poosa <karthik.poosa@intel.com> Reviewed-by: Michael J. Ruhl <michael.j.ruhl@intel.com> Link: https://patch.msgid.link/20260702092540.1005095-2-karthik.poosa@intel.com Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
2026-07-06iio: imu: inv_icm42600: fix timestamp clock period by using lower valueJean-Baptiste Maneyrol
Clock period value is used for computing periods of sampling. There is no need for it to be higher than the maximum odr, otherwise we are losing precision in the computation for nothing. Switch clock period value to maximum odr period (8kHz). Fixes: 0ecc363ccea7 ("iio: make invensense timestamp module generic") Cc: stable@vger.kernel.org Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org>
2026-07-06mmc: Merge branch fixes into nextUlf Hansson
Merge the mmc fixes for v7.2-rc[n] into the next branch, to allow them to get tested together with the mmc changes that are targeted for the next release. Signed-off-by: Ulf Hansson <ulfh@kernel.org>
2026-07-06mmc: block: fix RPMB device unregister orderingAo Sun
Since commit 7852028a35f0 ("mmc: block: register RPMB partition with the RPMB subsystem"), each mmc RPMB partition is represented by two device objects: - the mmc-owned device (`rpmb->dev`, backing the legacy /dev/mmcblkXrpmb char device) and - the rpmb-core device (`rdev`, backing /dev/rpmbN). The child RPMB device holds a reference to its parent, so the parent's release callback cannot be invoked if the child device is still registered. Remove rpmb_dev_unregister() from the parent release handler and unregister the child RPMB device in the remove path before tearing down the parent device. Also delete the extra blank line between mmc_blk_remove_rpmb_part() and {. Fixes: 7852028a35f0 ("mmc: block: register RPMB partition with the RPMB subsystem") Cc: stable@vger.kernel.org Signed-off-by: Jiazi Li <jiazi.li@transsion.com> Signed-off-by: Ao Sun <ao.sun@transsion.com> Reviewed-by: Avri Altman <avri.altman@sandisk.com> Signed-off-by: Ulf Hansson <ulfh@kernel.org>
2026-07-06mmc: sdhci-of-ma35d1: add missing MODULE_DEVICE_TABLE()Pengpeng Hou
The driver has an OF match table wired to .of_match_table, but does not export the table with MODULE_DEVICE_TABLE(). Add the missing MODULE_DEVICE_TABLE(of, ...) entry so module alias information is generated for OF based module autoloading. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Signed-off-by: Ulf Hansson <ulfh@kernel.org>
2026-07-06memstick: ms_block: reject a card that reports too many blocksMaoyi Xie
msb_ftl_initialize() computes the zone count from the card block count with no bound: msb->zone_count = msb->block_count / MS_BLOCKS_IN_ZONE; ... for (i = 0; i < msb->zone_count; i++) msb->free_block_count[i] = MS_BLOCKS_IN_ZONE; msb->block_count is a card value. msb_read_boot_blocks() reads number_of_blocks from the card boot page and byte swaps it. free_block_count is a fixed int[MS_MAX_ZONES]. MS_MAX_ZONES is 16, so the valid indices are 0 to 15. The init loop above indexes it by zone_count. msb_mark_block_used() and msb_mark_block_unused() index it by pba / MS_BLOCKS_IN_ZONE, for pba up to block_count - 1. A card may report up to 65535 blocks. A block_count above 8192 (MS_MAX_ZONES * MS_BLOCKS_IN_ZONE) lets the pba index reach 16. That writes past free_block_count[] and corrupts struct msb_data. A larger count runs the init loop past the end too. A real Memory Stick has at most 16 zones. So it has at most 8192 blocks. msb_ftl_initialize() now rejects a card that reports more than MS_MAX_ZONES * MS_BLOCKS_IN_ZONE blocks. Fixes: 0ab30494bc4f ("memstick: add support for legacy memorysticks") Cc: stable@vger.kernel.org Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com> Signed-off-by: Ulf Hansson <ulfh@kernel.org>
2026-07-06mmc: litex_mmc: Remove unused logic for the fixed bus widthInochi Amaoto
As the set_ios() function in litex_mmc driver does support setting bus width, it is not necessary to leave the logic for fixed bus width. Clean up these unneeded code. Signed-off-by: Inochi Amaoto <inochiama@gmail.com> Signed-off-by: Ulf Hansson <ulfh@kernel.org>
2026-07-06mmc: litex_mmc: Set width from linux requestInochi Amaoto
Previously, the litex_mmc driver force the 4 bits bus width. This means that the gateware with 1 bit bus width is not fit. However, litesdcard does support setting bus width, which make the 1 bit bus width gateware possible to be used. Add logic for setting bus width in the set_ios() function. Signed-off-by: Inochi Amaoto <inochiama@gmail.com> Signed-off-by: Ulf Hansson <ulfh@kernel.org>
2026-07-06Revert "drm/i915/psr: Allow SCL=0 on platforms with always-on VRR TG"Ankit Nautiyal
This reverts commit 4f1cab2e4863d96ce13b8d94151f4848e38c3d5b. Allowing SCL=0 on platforms with always-on VRR timing generator is causing underruns and other issues on PTL in some cases. SCL still needs to be non-zero in certain scenarios. Revert for now until this is better understood. Fixes: 4f1cab2e4863 ("drm/i915/psr: Allow SCL=0 on platforms with always-on VRR TG") Signed-off-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com> Link: https://patch.msgid.link/20260622101736.2389991-1-ankit.k.nautiyal@intel.com (cherry picked from commit 4dfcc789a144a21aa9be94f19f928aaa9fdc834d) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-07-06Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()Weiming Shi
bpa10x_setup() sends the vendor command 0xfc0e and passes the response to bt_dev_info() and hci_set_fw_info() as a "%s" string starting at skb->data + 1, without checking the length: bt_dev_info(hdev, "%s", (char *)(skb->data + 1)); hci_set_fw_info(hdev, "%s", skb->data + 1); A device that returns a one-byte response (status only) leaves skb->data + 1 past the end of the data, and the %s walk reads adjacent slab memory until it meets a NUL. The same happens when the payload is not NUL-terminated within skb->len. The out-of-bounds bytes end up in the kernel log and the firmware-info debugfs file. Print the revision string with a bounded "%.*s" limited to skb->len - 1 instead. This keeps the string readable for well-behaved devices while never reading past the received data, and does not fail setup, so a device returning a short or unterminated response keeps working. Fixes: ddd68ec8f484 ("Bluetooth: bpa10x: Read revision information in setup stage") Reported-by: Xiang Mei <xmei5@asu.edu> Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Weiming Shi <bestswngs@gmail.com> Reported-by: Xiang Mei <xmei5@asu.edu> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-07-06Bluetooth: btintel_pcie: Refactor FLR to use device_reprobe()Kiran K
The FLR branch in btintel_pcie_reset_work() open-coded the entire re-init sequence: btintel_pcie_release_hdev() (hci_unregister_dev + hci_free_dev), pci_try_reset_function(), enable_interrupts / config_msix / enable_bt / reset_ia / start_rx, then btintel_pcie_setup_hdev() (hci_alloc_dev_priv + hci_register_dev). Every probe() init step had to be kept in sync with this second copy in the reset path, and any failure mid-sequence left state to unwind by hand. The PLDR path already delegates teardown and re-init to the PCI core via device_reprobe(): .remove() destroys data through devres and unregisters hdev, then .probe() rebuilds everything from scratch. Apply the same model to FLR. Introduce btintel_pcie_perform_flr() mirroring perform_pldr(). It runs pci_try_reset_function() (required to avoid the device_lock ABBA against btintel_pcie_remove(), which calls disable_work_sync(&reset_work) while holding device_lock) followed by device_reprobe(). On success, data is destroyed and a fresh probe re-INIT_WORKs coredump_work with disable count 0, so enable_work() must not be called; on failure, data is still alive and the caller balances the earlier disable_work_sync(). The contract is documented on the helper and reiterated at the reset_work() call site. reset_work() shrinks to interrupt/worker drain, dispatch on reset_type, and the single asymmetry between the two paths. The out_enable label, the manual unregister/register pair, and the forward declaration of btintel_pcie_setup_hdev() are dropped. No intended functional change; FLR and PLDR now share one teardown contract. Fixes: 256ab9520d15 ("Bluetooth: btintel_pcie: Support Function level reset") Assisted-by: GitHub-Copilot:claude-4.7-opus Signed-off-by: Kiran K <kiran.k@intel.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-07-06Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()Maoyi Xie
During the v3 firmware download the controller sends a v3_data_req with a 32 bit offset and a 16 bit len. nxp_recv_fw_req_v3() checks only the lower bound of the offset and then sends firmware from that offset. nxpdev->fw_dnld_v3_offset = offset - nxpdev->fw_v3_offset_correction; serdev_device_write_buf(nxpdev->serdev, nxpdev->fw->data + nxpdev->fw_dnld_v3_offset, len); Nothing checks that fw_dnld_v3_offset + len stays within nxpdev->fw->size, so a controller that asks for an offset or length past the firmware image makes the driver read past the end of nxpdev->fw->data and send that memory back over UART. nxp_recv_fw_req_v1() already bounds the same write. Add the equivalent check to the v3 path, reject the request when it falls outside the firmware image, and zero len on the error path so the fw_v3_prev_sent bookkeeping at free_skb stays consistent. Fixes: 689ca16e5232 ("Bluetooth: NXP: Add protocol support for NXP Bluetooth chipsets") Suggested-by: Neeraj Sanjay Kale <neeraj.sanjaykale@nxp.com> Reviewed-by: Neeraj Sanjay Kale <neeraj.sanjaykale@nxp.com> Cc: stable@vger.kernel.org Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-07-06clk: sunxi-ng: mux: remove unneeded exportJerome Brunet
The export ccu_mux_helper_apply_prediv() symbol is actually not necessary. No module other than sunxi-ccu would use it at the moment so just remove the export. Signed-off-by: Jerome Brunet <jbrunet@baylibre.com> Link: https://patch.msgid.link/20260706-a733-rtc-v4-7-f330728db3d3@baylibre.com Signed-off-by: Chen-Yu Tsai <wens@kernel.org>
2026-07-06clk: sunxi-ng: sun6i-rtc: Add feature bit for IOSC calibrationJunhui Liu
The sun6i-rtc CCU driver currently uses a global static variable to denote whether calibration is supported, which makes IOSC operations tightly coupled to this file. Convert this into a feature bit to decouple the logic. This allows the IOSC clock code to be moved into a shared module for reuse by other SoCs. Signed-off-by: Junhui Liu <junhui.liu@pigmoral.tech> Reviewed-by: Chen-Yu Tsai <wens@kernel.org> Signed-off-by: Jerome Brunet <jbrunet@baylibre.com> Link: https://patch.msgid.link/20260706-a733-rtc-v4-5-f330728db3d3@baylibre.com Signed-off-by: Chen-Yu Tsai <wens@kernel.org>
2026-07-06clk: sunxi-ng: sun6i-rtc: clean up DT usageJerome Brunet
With sun6i-rtc compatible devices, the "ext-osc32k" clock input is optional for the devices that support this input (r329 and onward). Probably preparing for older SoC support, the driver does something funny when parsing DT. It check if "ext-osc32k" is present in the clock-names and if it is not, it uses the first clock as "ext-osc32k". This clock will actually be the rtc bus clock so what the driver does is wrong. At the moment, the driver does not support the older SoCs that would have an external 32k clock provided on index #0 so just remove this quirk. Reviewed-by: Chen-Yu Tsai <wens@kernel.org> Signed-off-by: Jerome Brunet <jbrunet@baylibre.com> Link: https://patch.msgid.link/20260706-a733-rtc-v4-4-f330728db3d3@baylibre.com Signed-off-by: Chen-Yu Tsai <wens@kernel.org>
2026-07-06clk: sunxi-ng: fix ccu probe clock unregister on errorJerome Brunet
When registering clocks with sunxi_ccu_probe(), the number of ccu_clocks and the number of hw clocks might be different, eventhough they usually are the same. If they are different, it could lead to out-of-bound access or registered clock left behind on error. Use a different variable when iterating on hw clocks so every registered clock, and only those, gets unregistered on error. Reported-by: Sashiko <sashiko-bot@kernel.org> Closes: https://lore.kernel.org/r/20260629131254.7E34C1F00A3A@smtp.kernel.org Reviewed-by: Chen-Yu Tsai <wens@kernel.org> Signed-off-by: Jerome Brunet <jbrunet@baylibre.com> Link: https://patch.msgid.link/20260706-a733-rtc-v4-3-f330728db3d3@baylibre.com Signed-off-by: Chen-Yu Tsai <wens@kernel.org>
2026-07-06mmc: cqhci: fix to missed endian conversionsBen Dooks
Fix two places where the wrong type or conversion of little-endian types to fix the following sparse warnings: drivers/mmc/host/cqhci-core.c:487:15: warning: incorrect type in assignment (different base types) drivers/mmc/host/cqhci-core.c:487:15: expected restricted __le32 [usertype] drivers/mmc/host/cqhci-core.c:487:15: got int drivers/mmc/host/cqhci-core.c:566:19: warning: incorrect type in assignment (different base types) drivers/mmc/host/cqhci-core.c:566:19: expected unsigned long long [usertype] *task_desc drivers/mmc/host/cqhci-core.c:566:19: got restricted __le64 [usertype] * Signed-off-by: Ben Dooks <ben.dooks@codethink.co.uk> Acked-by: Adrian Hunter <adrian.hunter@intel.com> Signed-off-by: Ulf Hansson <ulfh@kernel.org>
2026-07-06drm/i915/gem: Do not leak siblings[] on proto context errorJoonas Lahtinen
After a successful BALANCE/PARALLEL_SUBMIT extension on context creation, error during processing of next user extension leaks the siblings[] array. Fix that. Discovered using AI-assisted static analysis confirmed by Intel Product Security. Reported-by: Martin Hodo <martin.hodo@intel.com> Fixes: d4433c7600f7 ("drm/i915/gem: Use the proto-context to handle create parameters (v5)") Cc: Faith Ekstrand <faith.ekstrand@collabora.com> Cc: Simona Vetter <simona.vetter@ffwll.ch> Cc: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Cc: <stable@vger.kernel.org> # v5.15+ Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net> Link: https://lore.kernel.org/r/20260701073030.44850-1-joonas.lahtinen@linux.intel.com (cherry picked from commit aa65e0a4b51b3b54b53e4142aaa2d997aa1061ff) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-07-06drm/i915/gt: Fix NULL deref on sched_engine alloc failureJoonas Lahtinen
Avoid using intel_context_put() before intel_context_init() in execlists_create_virtual() as the kref_put() inside would lead to NULL deref on the IOCTL path when sched_engine allocation fails. Discovered using AI-assisted static analysis confirmed by Intel Product Security. Reported-by: Martin Hodo <martin.hodo@intel.com> Fixes: 3e28d37146db ("drm/i915: Move priolist to new i915_sched_engine object") Cc: Matthew Brost <matthew.brost@intel.com> Cc: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com> Cc: Tvrtko Ursulin <tursulin@ursulin.net> Cc: <stable@vger.kernel.org> # v5.15+ Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com> Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net> Link: https://lore.kernel.org/r/20260701114513.221254-1-joonas.lahtinen@linux.intel.com (cherry picked from commit 4f2a12f2d50e9f48227656e4dcbd6423506be31d) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-07-06drm/i915/mst: limit DP MST ESI service loopJani Nikula
The loop in intel_dp_check_mst_status() keeps servicing interrupts originating from the sink without bound. Add an upper bound to the new interrupts occurring during interrupt processing to not get stuck on potentially stuck sink devices. Use arbitrary 32 tries to clear incoming interrupts in one go. Discovered using AI-assisted static analysis confirmed by Intel Product Security. Note: The condition likely pre-dates the commit in the Fixes: tag, but this is about as far back as a backport has any chance of succeeding. Before that, the retry had a goto. Reported-by: Martin Hodo <martin.hodo@intel.com> Fixes: 3c0ec2c2d594 ("drm/i915: Flatten intel_dp_check_mst_status() a bit") Cc: stable@vger.kernel.org # v5.8+ Cc: Ville Syrjälä <ville.syrjala@linux.intel.com> Cc: Imre Deak <imre.deak@intel.com> Reviewed-by: Imre Deak <imre.deak@intel.com> Link: https://patch.msgid.link/20260625142204.1078287-1-jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com> (cherry picked from commit b4ea5272133059acb493cc36599071a9e852ec2e) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-07-06drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEUJoonas Lahtinen
Setting context engine slot N into I915_ENGINE_CLASS_INVALID / I915_ENGINE_CLASS_INVALID_NONE and attempting to apply I915_CONTEXT_PARAM_SSEU to the same slot N will deref NULL. Fix that. Discovered using AI-assisted static analysis confirmed by Intel Product Security. Reported-by: Martin Hodo <martin.hodo@intel.com> Fixes: d4433c7600f7 ("drm/i915/gem: Use the proto-context to handle create parameters (v5)") Cc: Faith Ekstrand <faith.ekstrand@collabora.com> Cc: Simona Vetter <simona.vetter@ffwll.ch> Cc: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Cc: <stable@vger.kernel.org> # v5.15+ Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com> Link: https://patch.msgid.link/20260701075555.52142-1-joonas.lahtinen@linux.intel.com (cherry picked from commit 36eda5b5c2d40da41cc0a5403c26986237cf9e87) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-07-06drm/i915/ltphy: Fix SSC Enablement bit in PORT_CLOCK_CTLSuraj Kandpal
According to Bspec we only need to write SSC Enable PLL A bit and leave PLL B bit alone in PORT_CLOCK_CTL register. Bspec: 74667, 74492 Fixes: 3383ba2479f7 ("drm/i915/ltphy: Enable SSC during port clock programming") Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com> Reviewed-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Link: https://patch.msgid.link/20260701091503.1302226-3-suraj.kandpal@intel.com (cherry picked from commit 8e27f752037e72ccee9c4a7c4a6202ecf3daf603) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
generated by cgit v1.2.3 (git 2.39.1) at 2026-08-12 11:29:32 +0000