summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2026-06-30spi: bcm63xx-hsspi: return error from failed controller suspendJiawen Liu
spi_controller_suspend() can fail if the SPI core cannot stop the controller. bcm63xx_hsspi_suspend() ignored that error, disabled the PLL and core clocks, and returned success. Return the suspend error before disabling the clocks. Signed-off-by: Jiawen Liu <1298662399@qq.com> Acked-by: William Zhang <william.zhang@broadcom.com> Link: https://patch.msgid.link/tencent_B5A06807924A77C8690730EBF7A052AABE05@qq.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-06-30spi: bcm63xx: return error from failed controller suspendJiawen Liu
spi_controller_suspend() can fail if the SPI core cannot stop the controller. bcm63xx_spi_suspend() ignored that error, disabled the controller clock, and returned success. Return the suspend error before tearing down the clock. Signed-off-by: Jiawen Liu <1298662399@qq.com> Link: https://patch.msgid.link/tencent_0BD7D4091B90EC17A8B2BA5EBA8803725905@qq.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-06-30dmaengine: switchtec-dma: fix FIELD_GET misuse when programming SE thresholdDavid Carlier
FIELD_GET(SE_THRESH_MASK, thresh) extracts bits [31:23] from thresh and right-shifts them, which is the inverse of the intended operation. Since thresh is derived from se_buf_len / 2 (at most 255), bits [31:23] are always zero, so the SE threshold is never actually programmed into the register. Use FIELD_PREP() instead to correctly left-shift thresh into bits [31:23] of the valid_en_se register, consistent with the FIELD_PREP usage for the perf tuner config just above. Fixes: 30eba9df76ad ("dmaengine: switchtec-dma: Implement hardware initialization and cleanup") Signed-off-by: David Carlier <devnexen@gmail.com> Review-by: Logan Gunthorpe <logang@deltatee.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260317083252.13224-1-devnexen@gmail.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-06-30crypto: atmel: Use dmaengine_prep_config_sg() APIFrank Li
Using new API dmaengine_prep_config_sg() to simple code. dmaengine_prep_config_sg() does not distinguish between configuration failures and descriptor preparation failures, as both are reported through a NULL return value. Converting both cases to -ENOMEM is therefore acceptable and consistent with the helper's abstraction. In practice, most users only care whether the operation succeeds or fails, and do not depend on the exact errno value returned from this path. Tested-by: Niklas Cassel <cassel@kernel.org> Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com> Signed-off-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260521-dma_prep_config-v7-9-1f73f4899883@nxp.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-06-30PCI: epf-mhi: Use dmaengine_prep_config_single() to simplify codeFrank Li
Use dmaengine_prep_config_single() to simplify pci_epf_mhi_edma_read[_sync]() and pci_epf_mhi_edma_write[_sync](). No functional change. Tested-by: Niklas Cassel <cassel@kernel.org> Acked-by: Manivannan Sadhasivam <mani@kernel.org> Signed-off-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260521-dma_prep_config-v7-8-1f73f4899883@nxp.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-06-30nvmet: pci-epf: Use dmaengine_prep_config_single_safe() APIFrank Li
Use the new dmaengine_prep_config_single_safe() API to combine the configuration and descriptor preparation into a single call. Since dmaengine_prep_config_single_safe() performs the configuration and preparation atomically and the mutex can be removed. Tested-by: Niklas Cassel <cassel@kernel.org> Acked-by: Manivannan Sadhasivam <mani@kernel.org> Signed-off-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260521-dma_prep_config-v7-7-1f73f4899883@nxp.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-06-30nvmet: pci-epf: Remove unnecessary dmaengine_terminate_sync() on each DMA ↵Frank Li
transfer dmaengine_terminate_sync() cancels all pending requests. Calling it for every DMA transfer is unnecessary and counterproductive. This function is generally intended for cleanup paths such as module removal, device close, or unbind operations. Remove the redundant calls for success path and keep it only at error path. Tested-by: Niklas Cassel <cassel@kernel.org> Reviewed-by: Damien Le Moal <dlemoal@kernel.org> Acked-by: Manivannan Sadhasivam <mani@kernel.org> Signed-off-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260521-dma_prep_config-v7-6-1f73f4899883@nxp.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-06-30dmaengine: dw-edma: Pass dma_slave_config to dw_edma_device_transfer()Frank Li
Pass dma_slave_config to dw_edma_device_transfer() to support atomic configuration and descriptor preparation when a non-NULL config is provided to device_prep_config_sg(). Tested-by: Niklas Cassel <cassel@kernel.org> Reviewed-by: Manivannan Sadhasivam <mani@kernel.org> Signed-off-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260521-dma_prep_config-v7-5-1f73f4899883@nxp.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-06-30dmaengine: dw-edma: Use new .device_prep_config_sg() callbackFrank Li
Use the new .device_prep_config_sg() callback to combine configuration and descriptor preparation. No functional changes. Tested-by: Niklas Cassel <cassel@kernel.org> Reviewed-by: Damien Le Moal <dlemoal@kernel.org> Reviewed-by: Manivannan Sadhasivam <mani@kernel.org> Signed-off-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260521-dma_prep_config-v7-4-1f73f4899883@nxp.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-06-30PCI: endpoint: pci-epf-test: Use dmaengine_prep_config_single() to simplify codeFrank Li
Use dmaengine_prep_config_single() to simplify code. No functional change. Tested-by: Niklas Cassel <cassel@kernel.org> Reviewed-by: Damien Le Moal <dlemoal@kernel.org> Acked-by: Manivannan Sadhasivam <mani@kernel.org> Signed-off-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260521-dma_prep_config-v7-3-1f73f4899883@nxp.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-06-30dmaengine: Add safe API to combine configuration and preparationFrank Li
Introduce dmaengine_prep_config_single_safe() and dmaengine_prep_config_sg_safe() to provide a reentrant-safe way to combine slave configuration and transfer preparation. Drivers may implement the new device_prep_config_sg() callback to perform both steps atomically. If the callback is not provided, the helpers fall back to calling dmaengine_slave_config() followed by dmaengine_prep_slave_sg() under per-channel spinlock protection. Tested-by: Niklas Cassel <cassel@kernel.org> Signed-off-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260521-dma_prep_config-v7-2-1f73f4899883@nxp.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-06-30net: gianfar: dispose irq mappings on probe failure and device removalRosen Penev
irq_of_parse_and_map() creates irqdomain mappings that should be balanced with irq_dispose_mapping(). The driver never called irq_dispose_mapping(), leaking mappings on probe failure and device removal. Fix by adding irq_dispose_mapping() in free_gfar_dev() and expanding its loop from priv->num_grps to MAXGROUPS so the error path also catches partially-initialized groups. All irqinfo pointers are pre-initialized to NULL in gfar_of_init(), making the NULL-guarded walk in free_gfar_dev() safe for every scenario. gfar_parse_group() itself is left as a simple parse function with no resource management; cleanup is centralized in the caller's error path. Assisted-by: opencode:big-pickle Fixes: b31a1d8b4151 ("gianfar: Convert gianfar to an of_platform_driver") Signed-off-by: Rosen Penev <rosenp@gmail.com> Link: https://patch.msgid.link/20260626225228.427392-1-rosenp@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-30net: lan743x: Initialize eth_syslock spinlock before useAndrea Righi
lan743x_hardware_init() calls pci11x1x_strap_get_status() during the PCI11x1x probe sequence. That helper acquires the Ethernet subsystem hardware lock via lan743x_hs_syslock_acquire(), which relies on adapter->eth_syslock_spinlock to serialize access. The spinlock is currently initialized only after the strap status is read. With CONFIG_DEBUG_SPINLOCK enabled, taking the zeroed initialized spinlock can trip the spinlock debug check. Fix by initializing adapter->eth_syslock_spinlock before reading the strap status so the probe path never attempts to lock an uninitialized spinlock. Fixes: 46b777ad9a8c ("net: lan743x: Add support to SGMII 1G and 2.5G") Cc: stable@vger.kernel.org # v6.0+ Signed-off-by: Andrea Righi <arighi@nvidia.com> Reviewed-by: David Thompson <davthompson@nvidia.com> Reviewed-by: Thangaraj Samynathan<Thangaraj.s@microchip.com> Link: https://patch.msgid.link/20260626163218.3591486-1-arighi@nvidia.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-30pinctrl: renesas: rza2: Embed pins in the priv structRosen Penev
Turn the separately allocated pinctrl_pin_desc array into a flexible array member of struct rza2_pinctrl_priv, annotated with __counted_by(npins). Compute the pin count before allocation so struct_size() can size the combined object, and the two allocations can be collapsed into one. Change npins to unsigned int to avoid potential overflow/underflow errors. Assisted-by: Claude:Opus-4.7 Signed-off-by: Rosen Penev <rosenp@gmail.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260527202317.5347-1-rosenp@gmail.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-06-30clk: renesas: r9a09g047: Add LVDS clocks and resetsTommaso Merciai
Add LVDS clocks and resets entries to the r9a09g047 CPG driver. Signed-off-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260623152851.478573-1-tommaso.merciai.xr@bp.renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-06-30clk: renesas: r9a09g077: Add LCDC and PLL3 clock support for RZ/T2H display ↵Lad Prabhakar
pipeline Add the clock definitions and PLL logic required to supply the LCDC (VSPD/FCPVD/DU) blocks on the RZ/T2H (R9A09G077) SoC. The RZ/T2H display subsystem depends on a dedicated PLL (PLL3) and a set of new derived clocks. Introduce a new PLL clock type and implement rate recalculation, programming and locking sequences for PLL3 using the RZ/T2H specific divider and VCO limits. Add the corresponding muxes and divider entries, expose the LCDC core clock, and register the LCDC module clock using the correct PCLK parent. This enables the RZ/T2H clock driver to generate the display pipeline clocking tree needed by the DU and VSP-based composition engines, allowing upcoming display support to be integrated without duplicating CPG logic. Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260618181949.3036280-6-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-06-30clk: renesas: rzv2h-cpg: Extract PLL calculation helpers into shared libraryLad Prabhakar
Move the RZ/V2H PLL and divider parameter calculation helpers from rzv2h-cpg.c into a new reusable library. Introduce the CLK_RZV2H_CPG_LIB Kconfig symbol and add rzv2h-cpg-lib.c to host the PLL parameter search algorithms currently implemented by rzv2h_get_pll_pars() and rzv2h_get_pll_divs_pars(). Export the helpers as rzv2h_cpg_get_pll_pars() and rzv2h_cpg_get_pll_divs_pars() for use by other drivers. Update the public clock header to expose the new interfaces and provide compatibility aliases for the existing helper names, avoiding build breakage for current users while allowing future conversions to the new API. This prepares for reuse of the PLL and divider calculation logic by other Renesas clock drivers, including upcoming RZ/T2H and RZ/N2H CPG support, without duplicating the implementation. Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260618181949.3036280-5-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-06-30clk: renesas: rzv2h-cpg: Use per-SoC PLL reference frequency for calculationsLad Prabhakar
Introduce a per-SoC PLL reference input frequency parameter to avoid relying on a hardcoded 24MHz constant during PLL configuration math. Add an input_fref member to struct rzv2h_pll_limits. In the core calculation helper rzv2h_get_pll_pars(), derive the base input clock rate from limits->input_fref, utilizing the conditional ternary operator to fall back to 24MHz if the struct field is left uninitialized (0), and drop the obsolete macro RZ_V2H_OSC_CLK_IN_MEGA. This abstraction permits the reuse of the common PLL divider logic on newer SoC platforms like the RZ/T2H, which feature a 48 MHz PLL reference clock input instead of the 24 MHz signal used by RZ/V2H(P), without disrupting existing platforms. Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260618181949.3036280-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-06-30clk: renesas: r9a08g046: Add USB2.0 clock and reset entriesBiju Das
Add module clock and reset definitions for the USB2.0 interfaces on the RZ/G3L (r9a08g046) SoC. Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260616104459.410743-4-biju.das.jz@bp.renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-06-30clk: renesas: r9a09g077: Add RTC clocksLad Prabhakar
Add the core and module clock definitions for the Real-Time Clock (RTC) peripheral on the Renesas RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs. Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260615143943.1610095-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-06-30clk: renesas: cpg-mssr: Implement dedicated MSTP delay logic for RZ/T2H LCDC ↵Lad Prabhakar
and RTC Introduce a dedicated clock delay mechanism, cpg_rzt2h_mstp_delay(), to satisfy the module-stop (MSTP) state release requirements specified in the RZ/T2H hardware manual. Per the hardware manual, while a standard 10 us delay (satisfying 7 dummy reads) is sufficient for most IP blocks, the LCDC requires 100 dummy reads (142 us) and the RTC requires 300 dummy reads (428 us) to stabilize after being released from a module-stop state. Implement a conditional bitmask filter helper that switches wait intervals based on the packaged module clock index. In cpg_mstp_clock_endisable(), the clock index and individual target bits are known, allowing an exact match. In the resume path cpg_mssr_resume_noirq(), where individual bits are not tracked, pass a fallback register index base (`reg * 32`) with bit verification masked out to match on the peripheral's register group block instead. Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260615104845.4122868-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-06-30clk: renesas: r9a08g046: Add clock and reset entries for GE3DBiju Das
Add clock and reset entries for GE3D. Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260604151855.307772-2-biju.das.jz@bp.renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-06-30clk: renesas: r9a08g046: Add clock and reset entries for SDHIBiju Das
Add clock and reset entries for SDHI. Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260603065731.93243-3-biju.das.jz@bp.renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-06-30clk: renesas: r9a09g047: Add audio clock and reset supportJohn Madieu
Add clock and reset entries for audio-related modules on the RZ/G3E SoC. Target modules are: - SSIU (Serial Sound Interface Unit) with SSI ch0-ch9, - SCU (Sampling Rate Converter Unit) with SRC ch0-ch9, DVC ch0-ch1, CTU/MIX ch0-ch1, - DMACpp (Audio DMA Controller), - ADG (Audio Clock Generator) with divider input clocks and audio master clock outputs. The ADG SSI clock outputs (adg_ssi[0-9]_clk) are parented on CLK_PLLCLN_DIV8 as a deliberate simplification: the ADG dynamically muxes each output between adg_0_clk_195m and audio_clk[a,b,c] at runtime via ADG_AUDIO_CLK_SEL{0,1,2}, owned by the rsnd-adg driver. While at it, reorder plldty_div16 to group it with the other plldty fixed dividers. Signed-off-by: John Madieu <john.madieu.xa@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260525110603.4018170-3-john.madieu.xa@bp.renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-06-30firmware: arm_scmi: Grammar s/may needed/may be needed/Geert Uytterhoeven
Fix grammar in the help text for the ARM_SCMI_POWER_CONTROL symbol. Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/5180d04abfb8e3074a321e2eb73bacfdd61c30c5.1780499850.git.geert+renesas@glider.be Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
2026-06-30net: libwx: fix VMDQ mask for 1-queue modeJiawen Wu
In wx_set_vmdq_queues(), the VMDQ mask was not set for the devices not supporting WX_FLAG_MULTI_64_FUNC, i.e., NGBE devices. A mask of 0 causes __ALIGN_MASK(1, ~vmdq->mask) to return 0, which incorrectly sets q_per_pool to 0 in wx_write_qde(). Fix the VMDQ 1-queue mask to 0x7F then ensures that __ALIGN_MASK(1, ~0x7F) correctly evaluates to 1. Fixes: c52d4b898901 ("net: libwx: Redesign flow when sriov is enabled") Signed-off-by: Jiawen Wu <jiawenwu@trustnetic.com> Reviewed-by: Larysa Zaremba <larysa.zaremba@intel.com> Link: https://patch.msgid.link/161F704D2C983E2C+20260626092530.551028-1-jiawenwu@trustnetic.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-30firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get()Unnathi Chalicheemala
ffa_partition_info_get() passes uuid_str directly to uuid_parse() without a NULL check. When a caller passes NULL, uuid_parse() -> __uuid_parse() -> uuid_is_valid() dereferences the pointer, causing a kernel panic: | Unable to handle kernel NULL pointer dereference at virtual address | 0000000000000040 | pc : uuid_parse+0x40/0xac | lr : ffa_partition_info_get+0x1c/0x94 [arm_ffa] Add a NULL guard before uuid_parse() so a NULL argument returns -ENODEV instead of crashing. Callers are expected to always supply a valid partition UUID, so NULL is not a supported input. Fixes: d0c0bce83122 ("firmware: arm_ffa: Setup in-kernel users of FFA partitions") Signed-off-by: Unnathi Chalicheemala <unnathi.chalicheemala@oss.qualcomm.com> Link: https://patch.msgid.link/20260617-ffa_partition_nullptr_fix-v2-1-bc801b4ce34c@oss.qualcomm.com Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
2026-06-30drm/sysfb: simpledrm: Validate mmap size against framebuffer sizeThomas Zimmermann
The size of the mmap'ed framebuffer could be smaller than the minimum required framebuffer size. Validate the resource size against the framebuffer size. Buggy firmware that triggers this check should be fixed up with a quirk on a case-by-case base. v3: - fix size checks (Sashiko) - improve error message for alignment check (Thierry) - do not store aligned size value Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Suggested-by: Sashiko <sashiko-bot@kernel.org> Reviewed-by: Thierry Reding <treding@nvidia.com> Reviewed-by: Maxime Ripard <mripard@kernel.org> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Link: https://patch.msgid.link/20260625094509.157581-6-tzimmermann@suse.de
2026-06-30drm/sysfb: simpledrm: Improve stride validationThomas Zimmermann
Validate the computed stride against the maximum value INT_MAX. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Thierry Reding <treding@nvidia.com> Reviewed-by: Maxime Ripard <mripard@kernel.org> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Fixes: 7bfa5c7b28d6 ("drm/simpledrm: Compute linestride with drm_format_info_min_pitch()") Cc: <stable@vger.kernel.org> # v6.1+ Link: https://patch.msgid.link/20260625094509.157581-5-tzimmermann@suse.de
2026-06-30drm/sysfb: simpledrm: Inline simplefb_get_validated_int()Thomas Zimmermann
The helper simplefb_get_validated_int() is only a wrapper around drm_sysfb_get_validated_int(). Inline the function into its callers. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Thierry Reding <treding@nvidia.com> Reviewed-by: Maxime Ripard <mripard@kernel.org> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Link: https://patch.msgid.link/20260625094509.157581-4-tzimmermann@suse.de
2026-06-30drm/sysfb: simpledrm: Improve panel-size validationThomas Zimmermann
Validate the panel size from the device-tree node against the limitations of struct drm_display_mode. The type only stores sizes in 16-bit fields. Fail transparently on errors; do not warn. v3: - move comments to a more prominent place (Thierry) v2: - only use initialized values in debugging output (Sashiko) Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Thierry Reding <treding@nvidia.com> Reviewed-by: Maxime Ripard <mripard@kernel.org> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Fixes: 2a6d731a8f16 ("drm/simpledrm: Allow physical width and height configuration via panel node") Cc: Rayyan Ansari <rayyan@ansari.sh> Cc: <stable@vger.kernel.org> # v6.4+ Link: https://patch.msgid.link/20260625094509.157581-3-tzimmermann@suse.de
2026-06-30drm/sysfb: simpledrm: Improve framebuffer-size validationThomas Zimmermann
Validate the framebuffer size from the firmware against the limitations of struct drm_display_mode. The type only stores sizes in 16-bit fields. Fail probing on errors. v2: - remove unused function simplefb_get_validated_int0() (Sashiko) Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Thierry Reding <treding@nvidia.com> Reviewed-by: Maxime Ripard <mripard@kernel.org> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Fixes: 11e8f5fd223b ("drm: Add simpledrm driver") Cc: <stable@vger.kernel.org> # v5.14+ Fixes: 11e8f5fd223b ("drm: Add simpledrm driver") Link: https://patch.msgid.link/20260625094509.157581-2-tzimmermann@suse.de
2026-06-30firmware: sysfb: Mark CONFIG_SYSFB_SIMPLEFB as deprecatedThomas Zimmermann
Mark CONFIG_SYSFB_SIMPLEFB as deprecated. Enabling it allows to run simpledrm and simplefb on EFI/VESA framebuffers. Doing this is discouraged in favor of using efidrm and vesadrm. v2: - resolve conflicting help texts (Sashiko) Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Link: https://patch.msgid.link/20260625065724.15794-1-tzimmermann@suse.de
2026-06-30net: airoha: fix max receive size configurationLorenzo Bianconi
Set the GDM maximum receive size to AIROHA_MAX_RX_SIZE unconditionally during hardware initialization instead of updating it according to the configured MTU. This avoids dropping incoming frames that exceed the current MTU but could still be processed by the networking stack, which is able to fragment the reply on the TX side (e.g. ICMP echo requests). Move the per-port MTU configuration to the PPE egress path where it belongs, and set the tx frame size running airoha_ppe_set_xmit_frame_size() to dynamically track the maximum MTU across running interfaces sharing the same PPE instance. Fix the PPE MTU register addressing to pack two port entries per register word and add WAN_MTU0 configuration for non-LAN GDM devices. Fixes: 54d989d58d2a ("net: airoha: Move min/max packet len configuration in airoha_dev_open()") Tested-by: Madhur Agrawal <madhur.agrawal@airoha.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260625-airoha-fix-rx-max-len-v1-1-45b9b827358d@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-30drm/i915/bios: range check LFP Data Block panel_type2Jani Nikula
While the panel_type from LFP Data Block is range checked, panel_type2 is not. Add a few helpers for range checking, and use them to not only check panel_type2, but also improve clarity and correctness in the panel type selection. Discovered using AI-assisted static analysis confirmed by Intel Product Security. v2: - Fix commit message typo (Michał) - Add is_panel_type_pnp() (Ville) Reported-by: Martin Hodo <martin.hodo@intel.com> Fixes: 6434cf630086 ("drm/i915/bios: calculate panel type as per child device index in VBT") Cc: stable@vger.kernel.org # v6.0+ Cc: Animesh Manna <animesh.manna@intel.com> Cc: Ville Syrjälä <ville.syrjala@intel.com> Reviewed-by: Michał Grzelak <michal.grzelak@intel.com> # v1 Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/20260626140155.1389655-1-jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-06-30pinctrl: imx1: fix device_node leak in dt_is_flat_functions()Felix Gu
for_each_child_of_node() holds a reference on the iterator node that must be released on early return. imx1_pinctrl_dt_is_flat_functions() has two early return paths inside the loop that skip this cleanup. Replace both loops with the scoped variant so that the reference is automatically dropped when the iterator goes out of scope. Fixes: 63d2059cd665 ("pinctrl: imx1: Allow parsing DT without function nodes") Signed-off-by: Felix Gu <ustc.gu@gmail.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-06-30fsl/fman: Free init resources on KeyGen failure in fman_init()Haoxiang Li
fman_muram_alloc() allocates initialization resources before initializing the KeyGen block. If keygen_init() fails, the function returns -EINVAL directly and leaves those resources allocated. Free the initialization resources before returning from the KeyGen failure path. Fixes: 7472f4f281d0 ("fsl/fman: enable FMan Keygen") Cc: stable@kernel.org Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com> Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com> Reviewed-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260625004834.3394389-1-haoxiang_li2024@163.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-30USB: serial: keyspan_pda: fix information leakJohan Hovold
The write() callback is supposed to return the number of characters accepted or a negative errno. Since the addition of write fifo support the keyspan_pda implementation will however return the number characters submitted to the device if the write urb is not already in use. If this number is larger than the number of characters passed to write(), the line discipline continues writing data from beyond the tty write buffer. Fix the information leak by making sure that keyspan_pda_write_start() returns zero on success as intended. Fixes: 034e38e8f687 ("USB: serial: keyspan_pda: add write-fifo support") Cc: stable@vger.kernel.org # 5.11 Signed-off-by: Johan Hovold <johan@kernel.org>
2026-06-30Merge drm/drm-next into drm-misc-nextThomas Zimmermann
Backmerging to get drm-misc-next to v7.2-rc1. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
2026-06-30gpio-f7188x: Add support for NCT6126D version BPaul Louvel
The Nuvoton NCT6126D Super-I/O is available in two hardware revisions. According to the manufacturer datasheet revision 2.4, version A reports chip ID 0xD283, while version B reports chip ID 0xD284. The driver currently only recognizes only the version A ID. Version B only contains hardware fixes unrelated to the GPIO functionality, so it can be supported by simply adding its chip ID without any other driver changes. Fixes: 3002b8642f01 ("gpio-f7188x: fix chip name and pin count on Nuvoton chip") Cc: stable@vger.kernel.org Signed-off-by: Paul Louvel <paul.louvel@bootlin.com> Link: https://patch.msgid.link/20260629-gpio-f7188x-nct6126d-version-b-v1-1-a06226c02a2d@bootlin.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-06-30drm/i915/vrr: require valid min/max vfreq for VRRJani Nikula
Ensure the EDID provided min/max vfreq are valid. Most scenarios are already covered (by coincidence) through the checks in intel_vrr_is_capable() and intel_vrr_is_in_range(), but be more explicit about it. At worst, a zero min_vfreq could lead to a division by zero in intel_vrr_compute_vmax(). Discovered using AI-assisted static analysis confirmed by Intel Product Security. Reported-by: Martin Hodo <martin.hodo@intel.com> Fixes: 117cd09ba528 ("drm/i915/display/dp: Compute VRR state in atomic_check") Cc: stable@vger.kernel.org # v5.12+ Cc: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Reviewed-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Link: https://patch.msgid.link/20260625131040.1051272-1-jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-06-30drm/i915/hdcp: require monotonically increasing seq_num_vJani Nikula
The HDCP 2.2 specification requires the seq_num_v to be monotonically increasing, and repeated seq_num_v needs to be treated as an integrity failure. Make it so. For the first message, seq_num_v must be zero, and is already checked. We can only check for less-than-or-equal for the subsequent messages, where hdcp2_encrypted is true. Discovered using AI-assisted static analysis confirmed by Intel Product Security. Reported-by: Martin Hodo <martin.hodo@intel.com> Fixes: d849178e2c9e ("drm/i915: Implement HDCP2.2 repeater authentication") Cc: stable@vger.kernel.org # v5.2+ Cc: Suraj Kandpal <suraj.kandpal@intel.com> Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com> Link: https://patch.msgid.link/20260625104407.1025614-1-jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com> (cherry picked from commit 58a224375c81179b52558c53d8857b93196d2687) Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
2026-06-30drm/i915/hdcp: check streams[] bounds before overflowJani Nikula
The data->streams[] overflow check is done after the buffer overflow has already happened. Move the overflow check before the write. Side note, emitting a warning splat with a backtrace might be overkill here, but prefer not changing the behaviour other than not doing the overrun. Discovered using AI-assisted static analysis confirmed by Intel Product Security. Reported-by: Martin Hodo <martin.hodo@intel.com> Fixes: e03187e12cae ("drm/i915/hdcp: MST streams support in hdcp port_data") Cc: stable@vger.kernel.org # v5.12+ Cc: Anshuman Gupta <anshuman.gupta@intel.com> Cc: Suraj Kandpal <suraj.kandpal@intel.com> Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com> Link: https://patch.msgid.link/20260625170304.1104723-1-jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com> (cherry picked from commit 9284ab3b6e776c315883ac2611283d263c9460fd) Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
2026-06-30drm/i915: Return NULL on error in active_instanceJoonas Lahtinen
Avoid returning &node->base when node is NULL due to OOM during GFP_ATOMIC allocation. Discovered using AI-assisted static analysis confirmed by Intel Product Security. Reported-by: Martin Hodo <martin.hodo@intel.com> Fixes: bfaae47db3c0 ("drm/i915: make lockdep slightly happier about execbuf.") Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> Cc: Simona Vetter <simona.vetter@ffwll.ch> Cc: <stable@vger.kernel.org> # v5.13+ Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> Reviewed-by: Sebastian Brzezinka <sebastian.brzezinka@intel.com> Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Link: https://patch.msgid.link/20260624090940.74840-1-joonas.lahtinen@linux.intel.com (cherry picked from commit 6029bc064f0b1bac184203a50fbaaf070fa18832) Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
2026-06-30drm/lima: call drm_mm_init() with a valid allocation rangeHenrik Grimler
lima_vm_create() is currently run before va_start and va_end are set up, meaning they are both 0. lima_vm_create() runs drm_mm_init() with them as arguments for the allocator, and if DRM_DEBUG_MM is enabled the DRM_MM_BUG_ON check in drm_mm_init then fires, as seen here on exynos4412-odroid-u2: [ 1.736297] ------------[ cut here ]------------ [ 1.740370] kernel BUG at drivers/gpu/drm/drm_mm.c:931! [ 1.745574] Internal error: Oops - BUG: 0 [#1] SMP ARM [ 1.750697] Modules linked in: [ 1.753734] CPU: 0 UID: 0 PID: 41 Comm: kworker/u16:1 Not tainted 7.0.10-postmarketos-exynos4 #11 PREEMPT [ 1.763372] Hardware name: Samsung Exynos (Flattened Device Tree) [ 1.769446] Workqueue: events_unbound deferred_probe_work_func [ 1.775261] PC is at drm_mm_init+0x9c/0xa4 [ 1.779339] LR is at lima_vm_create+0x144/0x17c [ ... ] Fix the issue by moving the lima_vm_create() call after va_start and va_end are set up. Fixes: a1d2a6339961 ("drm/lima: driver for ARM Mali4xx GPUs") Signed-off-by: Henrik Grimler <henrik.grimler@axis.com> Signed-off-by: Qiang Yu <yuq825@gmail.com> Link: https://patch.msgid.link/20260601-lima-alloc-fix-v1-1-16d3f3b7b780@axis.com
2026-06-29Input: maplemouse - fix NULL pointer dereference in open()Florian Fuchs
Commit 555c765b0cc2 ("Input: mouse - drop unnecessary calls to input_set_drvdata") dropped the input_set_drvdata() call in probe because the data appeared to be unused. However, dc_mouse_open() and dc_mouse_close() were using maple_get_drvdata(to_maple_dev(&dev->dev)). This appears to be accessing the data attached to an instance of maple_device structure, while in reality this actually retrieves driver data from the input device's embedded struct device (doing invalid conversion of input device structure to maple device). After input_set_drvdata() was removed, that lookup started returning NULL and opening the input device dereferences mse->mdev. Restore input_set_drvdata() and convert open() and close() to use input_get_drvdata() so the dependency is no longer hidden. Fixes: 6b3480855aad ("maple: input: fix up maple mouse driver") Fixes: 555c765b0cc2 ("Input: mouse - drop unnecessary calls to input_set_drvdata") Signed-off-by: Florian Fuchs <fuchsfl@gmail.com> Link: https://patch.msgid.link/20260628230715.2982552-1-fuchsfl@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-06-30ttm/pool: Use sentinels in debugfsMario Limonciello
The values in the `page_pool_shrink` debugfs file should recognize the sentinels rather than causing an underflow. Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5218 Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Link: https://patch.msgid.link/20260427162253.682415-1-mario.limonciello@amd.com Signed-off-by: Mario Limonciello <superm1@kernel.org>
2026-06-29drm/amd/display: use DisplayID panel type in dm_set_panel_typeChenyu Chen
Wire up the newly parsed panel_type from drm_display_info into amdgpu_dm's panel type detection path. When neither the AMD VSDB nor DPCD determines the panel type, fall back to the DisplayID Display Device Technology field to set PANEL_TYPE_LCD or PANEL_TYPE_OLED accordingly. Also expose LCD to userspace via the panel_type connector property. Assisted-by: Copilot:Claude-Opus-4.6 Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com> Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Link: https://patch.msgid.link/20260526030254.1460480-4-chen-yu.chen@amd.com Signed-off-by: Mario Limonciello <superm1@kernel.org>
2026-06-29drm/edid: parse panel type from DisplayID 2.x Display ParametersChenyu Chen
Parse the Display Parameters Data Block (tag 0x21) defined in DisplayID v2.1a Section 4.2.6. Extract the Display Device Technology field from the color depth and device technology byte, which indicates whether the panel uses LCD or OLED technology. Add a panel_type field to struct drm_display_info and populate it during DisplayID iteration so downstream drivers can use it for panel-type-dependent behavior. Add DRM_MODE_PANEL_TYPE_LCD to the UAPI panel type property alongside the existing OLED value. Assisted-by: Copilot:Claude-Opus-4.6 Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com> Reviewed-by: Jani Nikula <jani.nikula@intel.com> Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Link: https://patch.msgid.link/20260526030254.1460480-3-chen-yu.chen@amd.com Signed-off-by: Mario Limonciello <superm1@kernel.org>
2026-06-29drm/edid: extract base section header processing into helperChenyu Chen
Extract the DisplayID base section header logging and non_desktop detection from update_displayid_info() into a dedicated helper, drm_displayid_process_base_section_header(). Remove the break so the iterator walks through all data blocks, preparing for future patches that will parse additional block types within the loop. The helper is called only once for the base section via a base_section_header_processed flag. Since version and primary_use are only captured from the base section, and extension sections carry a primary use of zero per spec, the non_desktop logic is unaffected. No functional change. Assisted-by: Copilot:Claude-Opus-4.6 Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com> Reviewed-by: Jani Nikula <jani.nikula@intel.com> Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Link: https://patch.msgid.link/20260526030254.1460480-2-chen-yu.chen@amd.com Signed-off-by: Mario Limonciello <superm1@kernel.org>
generated by cgit v1.2.3 (git 2.39.1) at 2026-08-16 17:33:24 +0000