summaryrefslogtreecommitdiff
path: root/drivers/video
AgeCommit message (Collapse)Author
2026-06-07fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe()Abdun Nihaal
In tdfxfb_probe(), the memory allocated for modelist using fb_videomode_to_modelist() when CONFIG_FB_3DFX_I2C is defined, is not freed in the subsequent error paths. Fix that by calling fb_destroy_modelist(). Fixes: 215059d2421f ("tdfxfb: make use of DDC information about connected monitor") Cc: stable@vger.kernel.org Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in> Signed-off-by: Helge Deller <deller@gmx.de>
2026-06-07fbdev: s3fb: fix potential memory leak in s3_pci_probe()Abdun Nihaal
In s3_pci_probe(), the memory allocated for modelist using fb_videomode_to_modelist() is not freed in subsequent error paths. Fix that by calling fb_destroy_modelist() Fixes: 86c0f043a737 ("s3fb: add DDC support") Cc: stable@vger.kernel.org Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in> Signed-off-by: Helge Deller <deller@gmx.de>
2026-06-07fbdev: nvidia: fix potential memory leak in nvidiafb_probe()Abdun Nihaal
In nvidiafb_probe(), the memory allocated for modelist in nvidia_set_fbinfo() is not freed in the subsequent error paths. Fix that by calling fb_destroy_modelist(). Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in> Signed-off-by: Helge Deller <deller@gmx.de>
2026-06-07fbdev: i740fb: fix potential memory leak in i740fb_probe()Abdun Nihaal
In i740fb_probe(), the memory allocated in fb_videomode_to_modelist() for modelist is not freed in the error paths. Fix that by calling fb_destroy_modelist(). Fixes: 5350c65f4f15 ("Resurrect Intel740 driver: i740fb") Cc: stable@vger.kernel.org Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in> Signed-off-by: Helge Deller <deller@gmx.de>
2026-06-07fbdev: carminefb: fix potential memory leak in alloc_carmine_fb()Abdun Nihaal
The memory allocated for modelist in fb_videomode_to_modelist() is not freed in the subsequent error path. Fix that by calling fb_destroy_modelist() Fixes: 2ece5f43b041 ("fbdev: add the carmine FB driver") Cc: stable@vger.kernel.org Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in> Signed-off-by: Helge Deller <deller@gmx.de>
2026-06-07fbdev: radeon: fix potential memory leak in radeonfb_pci_register()Abdun Nihaal
The function radeonfb_pci_register() allocates memory for modelist (by calling radeon_check_modes() which calls fb_add_videomode()). The memory is appended to info->modelist, but is not freed in subsequent error paths. Fix this by calling fb_destroy_modelist(). Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in> Signed-off-by: Helge Deller <deller@gmx.de>
2026-06-07fbdev: metronomefb: fix potential memory leak in metronomefb_probe()Abdun Nihaal
The memory allocated for pagerefs in fb_deferred_io_init() is not freed on the error path. Fix it by calling fb_deferred_io_cleanup(). Fixes: 56c134f7f1b5 ("fbdev: Track deferred-I/O pages in pageref struct") Cc: stable@vger.kernel.org Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Helge Deller <deller@gmx.de>
2026-06-07fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe()Abdun Nihaal
The memory allocated for pagerefs in fb_deferred_io_init() is not freed on the error path. Fix it by calling fb_deferred_io_cleanup(). Fixes: 56c134f7f1b5 ("fbdev: Track deferred-I/O pages in pageref struct") Cc: stable@vger.kernel.org Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Helge Deller <deller@gmx.de>
2026-06-07fbdev: hecubafb: fix potential memory leak in hecubafb_probe()Abdun Nihaal
The memory allocated for pagerefs in fb_deferred_io_init() is not freed on the error path. Fix it by calling fb_deferred_io_cleanup(). Fixes: 56c134f7f1b5 ("fbdev: Track deferred-I/O pages in pageref struct") Cc: stable@vger.kernel.org Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Helge Deller <deller@gmx.de>
2026-06-07fbdev: atmel_lcdfb: Use of_device_get_match_data()Rosen Penev
Use of_device_get_match_data() to retrieve the driver match data instead of open-coding the OF match lookup and dereferencing match->data. This also removes the deprecated of_device.h include from the driver. No need for NULL check as every compatible has a corresponding data component. Assisted-by: Codex:GPT-5.5 Signed-off-by: Rosen Penev <rosenp@gmail.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-06-07fbdev: imxfb: Use of_device_get_match_data()Rosen Penev
Use of_device_get_match_data() to fetch the platform ID entry directly instead of open-coding an of_match_device() lookup. No NULL check is needed as every compatible string has a corresponding data section. This also lets the driver drop the of_device.h include. Assisted-by: Codex:GPT-5.5 Signed-off-by: Rosen Penev <rosenp@gmail.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-06-07fbcon: Use correct type for vc_resize() return valueJiacheng Yu
The return value of vc_resize() is int, but fbcon_set_disp() stores it in an unsigned long variable. While the !ret check happens to work correctly by coincidence (negative values become large positive values), the types should match. Use int instead. Eliminates the following W=3 warning: drivers/video/fbdev/core/fbcon.c: In function 'fbcon_set_disp': drivers/video/fbdev/core/fbcon.c:1494:14: warning: implicit conversion from 'int' to 'unsigned long' [-Wconversion] Fixes: af0db3c1f898 ("fbdev: Fix vmalloc out-of-bounds write in fast_imageblit") Cc: stable@vger.kernel.org # v6.17+ Signed-off-by: Jiacheng Yu <yujiacheng3@huawei.com> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Helge Deller <deller@gmx.de>
2026-06-07fbdev: Consistently define pci_device_ids using named initializersUwe Kleine-König
... and PCI device helpers. The various struct pci_device_id arrays were initialized mostly by list expressions. This isn't easily readable if you're not into PCI. Using named initializers is more explicit and thus easier to parse. Also use PCI_DEVICE* helper macros to assign .vendor, .device, .subvendor and .subdevice where appropriate and skip explicit assignments of 0 (which the compiler takes care of). The secret plan is to make struct pci_device_id::driver_data an anonymous union (similar to https://lore.kernel.org/all/cover.1776579304.git.u.kleine-koenig@baylibre.com/) and that requires named initializers. But it's also a nice cleanup on its own. While touching all these arrays, unify usage of whitespace and comma in a few drivers. This change doesn't introduce changes to the compiled pci_device_id array. Tested on x86 and arm64. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-06-07fbdev: matroxfb/ssd1307fb: Use named initializers for struct i2c_device_idUwe Kleine-König
While being less compact, using named initializers allows to more easily see which members of the structs are assigned which value without having to lookup the declaration of the struct. And it's also more robust against changes to the struct definition. While touching all these arrays, unify usage of whitespace in the list terminator. This patch doesn't modify the compiled arrays, only their representation in source form benefits. The former was confirmed with x86 and arm64 builds. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-05-20console: mdacon: remove this obsolete driverEthan Nelson-Moore
The mdacon driver supports using ISA MDA or Hercules-compatible display adapters as a secondary text console. This was commonly used in the 1990s and earlier for debugging software which took over the primary display. It is highly unlikely anyone is doing so nowadays because serial consoles and much better methods of debugging exist. The driver is not enabled by any defconfig, nor any of the dozens of distro configs collected at [1]. It has been relegated to VTs 13-16 since commit 0b9cf3aa6b1e ("mdacon messing up default vc's - set default to vc13-16 again") in Linux 2.6.27 (and before Linux 2.5.53 - see the link in the message of the above commit). The change in 2.6.27 was done because it was incorrectly detecting non-MDA adapters as MDA and taking over all VTs, rendering them unusable. Furthermore, vgacon supports using MDA/Hercules-compatible adapters as the primary text console, so any systems with only one of these adapters were already using vgacon and will not experience any loss in functionality from the removal of this driver. Given all of these factors, the mdacon driver is likely entirely unused. Remove it. [1] https://github.com/nyrahul/linux-kernel-configs/tree/f0bee86a135a0406ea427855f52702dd00d770f9 Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-05-20fbdev: remove Hercules monochrome ISA graphics adapter driverEthan Nelson-Moore
The hgafb driver supports graphics adapters compatible with the Hercules adapter from 1984. These were ISA cards or onboard devices that supported monochrome 720x348 graphics. This driver was created in 1999 by Ferenc Bakonyi. In the entire Git history (since Linux 2.6.12-rc2), there has only been one commit in 2010 which indicated that the driver was in use, commit 529ed806d454 ("video: Fix the HGA framebuffer driver"). The commit message states: Only tested with fbcon, since most fbdev-based software appears to only support 12bpp and up. It does not appear that this driver has worked for at least the entire 2.6.x series, perhaps since 2002. Given the age and limited capabilities of the hardware and the lack of users, remove this driver and move the former maintainer to CREDITS. Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com> Acked-by: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Helge Deller <deller@gmx.de>
2026-05-07backlight: cgbc: Remove redundant X86 dependencyThomas Richard
The backlight driver depends on the MFD cgbc-core driver, which already depends on X86. The explicit X86 dependency for the backlight driver is redundant and can be safely removed. Signed-off-by: Thomas Richard <thomas.richard@bootlin.com> Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org> Link: https://patch.msgid.link/20260427-backlight-cgbc-remove-x86-dependency-v2-1-da9f2375a34a@bootlin.com Signed-off-by: Lee Jones <lee@kernel.org>
2026-05-04fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-freeRajat Gupta
dlfb_ops_mmap() uses remap_pfn_range() to map vmalloc framebuffer pages to userspace but sets no vm_ops on the VMA. This means the kernel cannot track active mmaps. When dlfb_realloc_framebuffer() replaces the backing buffer via FBIOPUT_VSCREENINFO, existing mmap PTEs are not invalidated. On USB disconnect, dlfb_ops_destroy() calls vfree() on the old pages while userspace PTEs still reference them, resulting in a use-after-free: the process retains read/write access to freed kernel pages. Add vm_operations_struct with open/close callbacks that maintain an atomic mmap_count on struct dlfb_data. In dlfb_realloc_framebuffer(), check mmap_count and return -EBUSY if the buffer is currently mapped, preventing buffer replacement while userspace holds stale PTEs. Tested with PoC using dummy_hcd + raw_gadget USB device emulation. Signed-off-by: Rajat Gupta <rajgupt@qti.qualcomm.com> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: stable@vger.kernel.org Signed-off-by: Helge Deller <deller@gmx.de>
2026-04-30backlight: Add max25014atg backlightMaud Spierings
The Maxim MAX25014 is a 4-channel automotive grade backlight driver IC with integrated boost controller. Signed-off-by: Maud Spierings <maudspierings@gocontroll.com> Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org> Link: https://patch.msgid.link/20260407-max25014-v8-2-14eac7ed673a@gocontroll.com Signed-off-by: Lee Jones <lee@kernel.org>
2026-04-30backlight: ktd2801: Enable BL_CORE_SUSPENDRESUMEDuje Mihanović
Boards using this backlight chip do not power the backlight off on suspend. Enable BL_CORE_SUSPENDRESUME so the chip gets powered off by the backlight core on suspend. Tested on samsung,coreprimevelte. Cc: stable@vger.kernel.org # v6.19 Signed-off-by: Duje Mihanović <duje@dujemihanovic.xyz> Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org> Link: https://patch.msgid.link/20260328-ktd2801-pm-fix-v1-1-007cb103faeb@dujemihanovic.xyz Signed-off-by: Lee Jones <lee@kernel.org>
2026-04-28fbdev: defio: Remove duplicate include of linux/module.hChen Ni
Remove duplicate inclusion of linux/module.h in fb_defio.c to clean up redundant code. Signed-off-by: Chen Ni <nichen@iscas.ac.cn> Signed-off-by: Helge Deller <deller@gmx.de>
2026-04-22fbdev: hgafb: Request memory region before ioremapHardik Phalet
The driver calls ioremap() on the HGA video memory at 0xb0000 without first reserving the physical address range. This leaves the kernel resource tree incomplete and can cause silent conflicts with other drivers claiming the same range. Add a devm_request_mem_region() call before ioremap() in hga_card_detect() to reserve the memory region. Signed-off-by: Hardik Phalet <hardik.phalet@pm.me> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Helge Deller <deller@gmx.de>
2026-04-22fbdev: clps711x-fb: Request memory region for MMIOAmit Barzilai
Use devm_platform_get_and_ioremap_resource() for resource 0 (the MMIO control register range) instead of open-coding platform_get_resource() and devm_ioremap() separately. The helper requests the memory region before mapping it, which registers the range in /proc/iomem and prevents another driver from mapping the same registers. This makes resource 0 consistent with resource 1 (the framebuffer), which already uses devm_platform_get_and_ioremap_resource(). Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Amit Barzilai <amit.barzilai22@gmail.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-04-22fbdev: cobalt_lcdfb: Request memory regionAmit Barzilai
Use devm_platform_get_and_ioremap_resource() instead of open-coding platform_get_resource() and devm_ioremap() separately. The helper requests the memory region before mapping it, which registers the range in /proc/iomem and prevents another driver from mapping the same registers. Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Amit Barzilai <amit.barzilai22@gmail.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-04-22fbdev: atyfb: Fix spelling mistake "enfore" -> "enforce"Ethan Carter Edwards
Signed-off-by: Ethan Carter Edwards <ethan@ethancedwards.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-04-22fbdev: savage: fix probe-path EDID cleanup leaksYuho Choi
When CONFIG_FB_SAVAGE_I2C is enabled, savagefb_probe() can build both an EDID-derived monspecs.modedb and a modelist from it before later failing. The normal success path frees monspecs.modedb after the initial mode selection, but the probe error path only deletes the I2C busses and misses the EDID-derived allocations. Free both the modelist and monspecs.modedb on the failed: unwind path. Co-developed-by: Myeonghun Pak <mhun512@gmail.com> Signed-off-by: Myeonghun Pak <mhun512@gmail.com> Co-developed-by: Ijae Kim <ae878000@gmail.com> Signed-off-by: Ijae Kim <ae878000@gmail.com> Co-developed-by: Taegyu Kim <tmk5904@psu.edu> Signed-off-by: Taegyu Kim <tmk5904@psu.edu> Signed-off-by: Yuho Choi <dbgh9129@gmail.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-04-22fbdev: offb: fix PCI device reference leak on probe failureYuho Choi
offb_init_nodriver() gets a referenced PCI device with pci_get_device(). If pci_enable_device() fails, the function returns without dropping that reference. Release the PCI device reference before returning from the pci_enable_device() failure path. Fixes: 5bda8f7b5468 ("video: fbdev: offb: Call pci_enable_device() before using the PCI VGA device") Co-developed-by: Myeonghun Pak <mhun512@gmail.com> Signed-off-by: Myeonghun Pak <mhun512@gmail.com> Co-developed-by: Ijae Kim <ae878000@gmail.com> Signed-off-by: Ijae Kim <ae878000@gmail.com> Co-developed-by: Taegyu Kim <tmk5904@psu.edu> Signed-off-by: Taegyu Kim <tmk5904@psu.edu> Signed-off-by: Yuho Choi <dbgh9129@gmail.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-04-20Merge tag 'backlight-next-7.1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight Pull backlight updates from Lee Jones: "Apple Backlight: - Convert the Apple Backlight ACPI driver to a proper platform driver, aligning with current ACPI binding practices Skyworks SKY81452: - Check the return value of `devm_gpiod_get_optional()` to properly handle GPIO acquisition errors" * tag 'backlight-next-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight: backlight: apple_bl: Convert to a platform driver backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt()
2026-04-15Merge tag 'drm-next-2026-04-15' of https://gitlab.freedesktop.org/drm/kernelLinus Torvalds
Pull drm updates from Dave Airlie: "Highlights: - new DRM RAS infrastructure using netlink - amdgpu: enable DC on CIK APUs, and more IP enablement, and more user queue work - xe: purgeable BO support, and new hw enablement - dma-buf : add revocable operations Full summary: mm: - two-pass MMU interval notifiers - add gpu active/reclaim per-node stat counters math: - provide __KERNEL_DIV_ROUND_CLOSEST() in UAPI - implement DIV_ROUND_CLOSEST() with __KERNEL_DIV_ROUND_CLOSEST() rust: - shared tag with driver-core: register macro and io infra - core: rework DMA coherent API - core: add interop::list to interop with C linked lists - core: add more num::Bounded operations - core: enable generic_arg_infer and add EMSGSIZE - workqueue: add ARef<T> support for work and delayed work - add GPU buddy allocator abstraction - add DRM shmem GEM helper abstraction - allow drm:::Device to dispatch work and delayed work items to driver private data - add dma_resv_lock helper and raw accessors core: - introduce DRM RAS infrastructure over netlink - add connector panel_type property - fourcc: add ARM interleaved 64k modifier - colorop: add destroy helper - suballoc: split into alloc and init helpers - mode: provide DRM_ARGB_GET*() macros for reading color components edid: - provide drm_output_color_Format dma-buf: - provide revoke mechanism for shared buffers - rename move_notify to invalidate_mappings - always enable move_notify - protect dma_fence_ops with RCU and improve locking - clean pages with helpers atomic: - allocate drm_private_state via callback - helper: use system_percpu_wq buddy: - make buddy allocator available to gpu level - add kernel-doc for buddy allocator - improve aligned allocation ttm: - fix fence signalling - improve tests and docs - improve handling of gfp_retry_mayfail - use per-node stat counters to track memory allocations - port pool to use list_lru - drop NUMA specific pools - make pool shrinker numa aware - track allocated pages per numa node coreboot: - cleanup coreboot framebuffer support sched: - fix race condition in drm_sched_fini pagemap: - enable THP support - pass pagemap_addr by reference gem-shmem: - Track page accessed/dirty status across mmap/vmap gpusvm: - reenable device to device migration - fix unbalanced unclock bridge: - anx7625: Support USB-C plus DT bindings - connector: Fix EDID detection - dw-hdmi-qp: Support Vendor-Specfic and SDP Infoframes; improve others - fsl-ldb: Fix visual artifacts plus related DT property 'enable-termination-resistor' - imx8qxp-pixel-link: Improve bridge reference handling - lt9611: Support Port-B-only input plus DT bindings - tda998x: Support DRM_BRIDGE_ATTACH_NO_CONNECTOR; Clean up - Support TH1520 HDMI plus DT bindings - waveshare-dsi: Fix register and attach; Support 1..4 DSI lanes plus DT bindings - anx7625: Fix USB Type-C handling - cdns-mhdp8546-core: Handle HDCP state in bridge atomic_check - Support Lontium LT8713SX DP MST bridge plus DT bindings - analogix_dp: Use DP helpers for link training panel: - panel-jdi-lt070me05000: Use mipi-dsi multi functions - panel-edp: Support Add AUO B116XAT04.1 (HW: 1A); Support CMN N116BCL-EAK (C2); Support FriendlyELEC plus DT changes - panel-edp: Fix timings for BOE NV140WUM-N64 - ilitek-ili9882t: Allow GPIO calls to sleep - jadard: Support TAIGUAN XTI05101-01A - lxd: Support LXD M9189A plus DT bindings - mantix: Fix pixel clock; Clean up - motorola: Support Motorola Atrix 4G and Droid X2 plus DT bindings - novatek: Support Novatek/Tianma NT37700F plus DT bindings - simple: Support EDT ET057023UDBA plus DT bindings; Support Powertip PH800480T032-ZHC19 plus DT bindings; Support Waveshare 13.3" - novatek-nt36672a: Use mipi_dsi_*_multi() functions - panel-edp: Support BOE NV153WUM-N42, CMN N153JCA-ELK, CSW MNF307QS3-2 - support Himax HX83121A plus DT bindings - support JuTouch JT070TM041 plus DT bindings - support Samsung S6E8FC0 plus DT bindings - himax-hx83102c: support Samsung S6E8FC0 plus DT bindings; support backlight - ili9806e: support Rocktech RK050HR345-CT106A plus DT bindings - simple: support Tianma TM050RDH03 plus DT bindings amdgpu: - enable DC by default on CIK APUs - userq fence ioctl param size fixes - set panel_type to OLED for eDP - refactor DC i2c code - FAMS2 update - rework ttm handling to allow multiple engines - DC DCE 6.x cleanup - DC support for NUTMEG/TRAVIS DP bridge - DCN 4.2 support - GC12 idle power fix for compute - use struct drm_edid in non-DC code - enable NV12/P010 support on primary planes - support newer IP discovery tables - VCN/JPEG 5.0.2 support - GC/MES 12.1 updates - USERQ fixes - add DC idle state manager - eDP DSC seamless boot amdkfd: - GC 12.1 updates - non 4K page fixes xe: - basic Xe3p_LPG and NVL-P enabling patches - allow VM_BIND decompress support - add purgeable buffer object support - add xe_vm_get_property_ioctl - restrict multi-lrc to VCS/VECS engines - allow disabling VM overcommit in fault mode - dGPU memory optimizations - Workaround cleanups and simplification - Allow VFs VRAM quote changes using sysfs - convert GT stats to per-cpu counters - pagefault refactors - enable multi-queue on xe3p_xpc - disable DCC on PTL - make MMIO communication more robust - disable D3Cold for BMG on specific platforms - vfio: improve FLR sync for Xe VFIO i915/display: - C10/C20/LT PHY PLL divider verification - use trans push mechanism to generate PSR frame change on LNL+ - refactor DP DSC slice config - VGA decode refactoring - refactor DPT, gen2-4 overlay, masked field register macro helpers - refactor stolen memory allocation decisions - prepare for UHBR DP tunnels - refactor LT PHY PLL to use DPLL framework - implement register polling/waiting in display code - add shared stepping header between i915 and display i915: - fix potential overflow of shmem scatterlist length nouveau: - provide Z cull info to userspace - initial GA100 support - shutdown on PCI device shutdown nova-core: - harden GSP command queue - add support for large RPCs - simplify GSP sequencer and message handling - refactor falcon firmware handling - convert to new register macro - conver to new DMA coherent API - use checked arithmetic - add debugfs support for gsp-rm log buffers - fix aux device registration for multi-GPU msm: - CI: - Uprev mesa - Restore CI jobs for Qualcomm APQ8016 and APQ8096 devices - Core: - Switched to of_get_available_child_by_name() - DPU: - Fixes for DSC panels - Fixed brownout because of the frequency / OPP mismatch - Quad pipe preparation (not enabled yet) - Switched to virtual planes by default - Dropped VBIF_NRT support - Added support for Eliza platform - Reworked alpha handling - Switched to correct CWB definitions on Eliza - Dropped dummy INTF_0 on MSM8953 - Corrected INTFs related to DP-MST - DP: - Removed debug prints looking into PHY internals - DSI: - Fixes for DSC panels - RGB101010 support - Support for SC8280XP - Moved PHY bindings from display/ to phy/ - GPU: - Preemption support for x2-85 and a840 - IFPC support for a840 - SKU detection support for x2-85 and a840 - Expose AQE support (VK ray-pipeline) - Avoid locking in VM_BIND fence signaling path - Fix to avoid reclaim in GPU snapshot path - Disallow foreign mapping of _NO_SHARE BOs - HDMI: - Fixed infoframes programming - MDP5: - Dropped support for MSM8974v1 - Dropped now unused code for MSM8974 v1 and SDM660 / MSM8998 panthor: - add tracepoints for power and IRQs - fix fence handling - extend timestamp query with flags - support various sources for timestamp queries tyr: - fix names and model/versions rockchip: - vop2: use drm logging function - rk3576 displayport support - support CRTC background color atmel-hlcdc: - support sana5d65 LCD controller tilcdc: - use DT bindings schema - use managed DRM interfaces - support DRM_BRIDGE_ATTACH_NO_CONNECTOR verisilicon: - support DC8200 + DT bindings virtgpu: - support PRIME import with 3D enabled komeda: - fix integer overflow in AFBC checks mcde: - improve bridge handling gma500: - use drm client buffer for fbdev framebuffer amdxdna: - add sensors ioctls - provide NPU power estimate - support column utilization sensor - allow forcing DMA through IOMMU IOVA - support per-BO mem usage queries - refactor GEM implementation ivpu: - update boot API to v3.29.4 - limit per-user number of doorbells/contexts - perform engine reset on TDR error loongson: - replace custom code with drm_gem_ttm_dumb_map_offset() imx: - support planes behind the primary plane - fix bus-format selection vkms: - support CRTC background color v3d: - improve handling of struct v3d_stats komeda: - support Arm China Linlon D6 plus DT bindings imagination: - improve power-off sequence - support context-reset notification from firmware mediatek: - mtk_dsi: enable hs clock during pre-enable - Remove all conflicting aperture devices during probe - Add support for mt8167 display blocks" * tag 'drm-next-2026-04-15' of https://gitlab.freedesktop.org/drm/kernel: (1735 commits) drm/ttm/tests: Remove checks from ttm_pool_free_no_dma_alloc drm/ttm/tests: fix lru_count ASSERT drm/vram: remove DRM_VRAM_MM_FILE_OPERATIONS from docs drm/fb-helper: Fix a locking bug in an error path dma-fence: correct kernel-doc function parameter @flags ttm/pool: track allocated_pages per numa node. ttm/pool: make pool shrinker NUMA aware (v2) ttm/pool: drop numa specific pools ttm/pool: port to list_lru. (v2) drm/ttm: use gpu mm stats to track gpu memory allocations. (v4) mm: add gpu active/reclaim per-node stat counters (v2) gpu: nova-core: fix missing colon in SEC2 boot debug message gpu: nova-core: vbios: use from_le_bytes() for PCI ROM header parsing gpu: nova-core: bitfield: fix broken Default implementation gpu: nova-core: falcon: pad firmware DMA object size to required block alignment gpu: nova-core: gsp: fix undefined behavior in command queue code drm/shmem_helper: Make sure PMD entries get the writeable upgrade accel/ivpu: Trigger recovery on TDR with OS scheduling drm/msm: Use of_get_available_child_by_name() dt-bindings: display/msm: move DSI PHY bindings to phy/ subdir ...
2026-04-10fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFOGreg Kroah-Hartman
Much like commit 19f953e74356 ("fbdev: fb_pm2fb: Avoid potential divide by zero error"), we also need to prevent that same crash from happening in the udlfb driver as it uses pixclock directly when dividing, which will crash. Cc: Bernie Thompson <bernie@plugable.com> Cc: Helge Deller <deller@gmx.de> Fixes: 59277b679f8b ("Staging: udlfb: add dynamic modeset support") Assisted-by: gregkh_clanker_t1000 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Helge Deller <deller@gmx.de>
2026-04-10fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFOGreg Kroah-Hartman
Much like commit 19f953e74356 ("fbdev: fb_pm2fb: Avoid potential divide by zero error"), we also need to prevent that same crash from happening in the udlfb driver as it uses pixclock directly when dividing, which will crash. Cc: Helge Deller <deller@gmx.de> Assisted-by: gregkh_clanker_t1000 Cc: stable <stable@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Helge Deller <deller@gmx.de>
2026-04-09fbdev: omap2: fix inconsistent lock returns in omapfb_mmapHongling Zeng
Fix the warning about inconsistent returns for '&rg->lock' in omapfb_mmap() function. The warning arises because the error path uses 'ofbi->region' while the normal path uses 'rg'. smatch warnings: drivers/video/fbdev/omap2/omapfb/omapfb-main.c:1126 omapfb_mmap() warn: inconsistent returns '&rg->lock'. Reported-by: kernel test robot <lkp@intel.com> Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn> Signed-off-by: Helge Deller <deller@gmx.de>
2026-04-07fbcon: Put font-rotation state into separate structThomas Zimmermann
Move all temporary state of the font-rotation code into the struct rotated in struct fbcon_par. Protect it with the Kconfig symbol CONFIG_FRAMEBUFFER_CONSOLE_ROTATION. Avoids mixing it up with fbcon's regular state. v2: - fix typos Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Helge Deller <deller@gmx.de>
2026-04-07fbcon: Fill cursor mask in helper functionThomas Zimmermann
Fbcon creates a cursor shape on the fly from the user-configured settings. The logic to create a glyph with the cursor's bitmap mask is duplicated in four places. In the cases that involve console rotation, the implementation further rotates the cursor glyph for displaying. Consolidate all cursor-mask creation in a single helper. Update the callers accordingly. For console rotation, use the glyph helpers to rotate the created cursor glyph to the correct orientation. v2: - fix sparse truncated-bits warning Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Helge Deller <deller@gmx.de>
2026-04-07lib/fonts: Implement font rotationThomas Zimmermann
Move the core of fbcon's font-rotation code to the font library as the new helper font_data_rotate(). The code can rotate in steps of 90°. For completeness, it also copies the glyph data for multiples of 360°. Bring back the memset optimization. A memset to 0 again clears the whole glyph output buffer. Then use the internal rotation helpers on the cleared output. Fbcon's original implementation worked like this, but lost it during refactoring. Replace fbcon's font-rotation code with the new implementations. All that's left to do for fbcon is to maintain its internal fbcon state. v2: - fix typos Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Helge Deller <deller@gmx.de>
2026-04-07lib/fonts: Implement glyph rotationThomas Zimmermann
Move the glyph rotation helpers from fbcon to the font library. Wrap them behind clean interfaces. Also clear the output memory to zero. Previously, the implementation relied on the caller to do that. Go through the fbcon code and callers of the glyph-rotation helpers. In addition to the font rotation, there's also the cursor code, which uses the rotation helpers. The font-rotation relied on a single memset to zero for the whole font. This is now multiple memsets on each glyph. This will be sorted out when the font library also implements font rotation. Building glyph rotation in the font library still depends on CONFIG_FRAMEBUFFER_CONSOLE_ROTATION=y. If we get more users of the code, we can still add a dedicated Kconfig symbol to the font library. No changes have been made to the actual implementation of the rotate_*() and pattern_*() functions. These will be refactored as separate changes. v2: - fix typos Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Helge Deller <deller@gmx.de>
2026-04-07lib/fonts: Provide helpers for calculating glyph pitch and sizeThomas Zimmermann
Implement pitch and size calculation for a single font glyph in the new helpers font_glyph_pitch() and font_glyph_size(). Replace the instances where the calculations are open-coded. Note that in the case of fbcon console rotation, the parameters for a glyph's width and height might be reversed. This is intentional. v2: - fix typos in commit message Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Helge Deller <deller@gmx.de>
2026-04-07fbcon: Avoid OOB font access if console rotation failsThomas Zimmermann
Clear the font buffer if the reallocation during console rotation fails in fbcon_rotate_font(). The putcs implementations for the rotated buffer will return early in this case. See [1] for an example. Currently, fbcon_rotate_font() keeps the old buffer, which is too small for the rotated font. Printing to the rotated console with a high-enough character code will overflow the font buffer. v2: - fix typos in commit message Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Fixes: 6cc50e1c5b57 ("[PATCH] fbcon: Console Rotation - Add support to rotate font bitmap") Cc: stable@vger.kernel.org # v2.6.15+ Link: https://elixir.bootlin.com/linux/v6.19/source/drivers/video/fbdev/core/fbcon_ccw.c#L144 # [1] Signed-off-by: Helge Deller <deller@gmx.de>
2026-03-31fbdev: atyfb: Remove unused fb_listGeert Uytterhoeven
With clang and W=1: drivers/video/fbdev/aty/atyfb_base.c:2327:24: warning: variable 'fb_list' set but not used [-Wunused-but-set-global] 2327 | static struct fb_info *fb_list = NULL; Indeed, the last user of fb_list was removed in 2004, while the actual linked list was removed in 2002. Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202603300931.osMYxYZ7-lkp@intel.com/ Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org> Signed-off-by: Helge Deller <deller@gmx.de>
2026-03-31backlight: apple_bl: Convert to a platform driverRafael J. Wysocki
In all cases in which a struct acpi_driver is used for binding a driver to an ACPI device object, a corresponding platform device is created by the ACPI core and that device is regarded as a proper representation of underlying hardware. Accordingly, a struct platform_driver should be used by driver code to bind to that device. There are multiple reasons why drivers should not bind directly to ACPI device objects [1]. Overall, it is better to bind drivers to platform devices than to their ACPI companions, so convert the Apple Backlight ACPI driver to a platform one. While this is not expected to alter functionality, it changes sysfs layout and so it will be visible to user space. Link: https://lore.kernel.org/all/2396510.ElGaqSPkdT@rafael.j.wysocki/ [1] Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org> Link: https://patch.msgid.link/5084777.GXAFRqVoOG@rafael.j.wysocki Signed-off-by: Lee Jones <lee@kernel.org>
2026-03-21fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build breakAndy Shevchenko
Clang is not happy about set but unused variable: drivers/video/fbdev/matrox/g450_pll.c:412:18: error: variable 'mnp' set but not used 412 | unsigned int mnp; | ^ 1 error generated. Since the commit 7b987887f97b ("video: fbdev: matroxfb: remove dead code and set but not used variable") the 'mnp' became unused, but eliminating that code might have side-effects. The question here is what should we do with 'mnp'? The easiest way out is just mark it with __maybe_unused which will shut the compiler up and won't change any possible IO flow. So does this change. A dive into the history of the driver: The problem was revealed when the #if 0 guarded code along with unused pixel_vco variable was removed. That code was introduced in the original commit 213d22146d1f ("[PATCH] (1/3) matroxfb for 2.5.3"). And then guarded in the commit 705e41f82988 ("matroxfb DVI updates: Handle DVI output on G450/G550. Powerdown unused portions of G450/G550 DAC. Split G450/G550 DAC from older DAC1064 handling. Modify PLL setting when both CRTCs use same pixel clocks."). NOTE: The two commits mentioned above pre-date Git era and available in history.git repository for archaeological purposes. Even without that guard the modern compilers may see that the pixel_vco wasn't ever used and seems a leftover after some debug or review made 25 years ago. The g450_mnp2vco() doesn't have any IO and as Jason said doesn't seem to have any side effects either than some unneeded CPU processing during runtime. I agree that's unlikely that timeout (or heating up the CPU) has any effect on the HW (GPU/display) functionality. Fixes: 7b987887f97b ("video: fbdev: matroxfb: remove dead code and set but not used variable") Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Reviewed-by: Jason Yan <yanaijie@huawei.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-03-21fbdev: update help text for CONFIG_FB_NVIDIArobgithub
The help text for CONFIG_FB_NVIDIA refers to obsolete hardware and incorrect default behaviour. This patch updates the description to reflect the current state of the driver and supported devices. Signed-off-by: robgithub <rob.github@jumpstation.co.uk> Signed-off-by: Helge Deller <deller@gmx.de>
2026-03-11Merge v7.0-rc3 into drm-nextSimona Vetter
Requested by Maxime Ripard for drm-misc-next because renesas people need fb797a70108f ("drm: renesas: rz-du: mipi_dsi: Set DSI divider"). Signed-off-by: Simona Vetter <simona.vetter@ffwll.ch>
2026-03-10fbdev: omapfb: Add missing error check for clk_get()Chen Ni
The hwa742_init() function did not check the return value of clk_get(). This could lead to dereferencing an error pointer in subsequent clock operations, potentially causing a kernel crash. Fix this by adding a missing error check and ensuring proper clock resource cleanup on failure and driver removal. Signed-off-by: Chen Ni <nichen@iscas.ac.cn> Signed-off-by: Helge Deller <deller@gmx.de>
2026-03-10fbdev: viafb: check ioremap return value in viafb_lcd_get_mobile_stateWang Jun
The function viafb_lcd_get_mobile_state() calls ioremap() without checking the return value. If ioremap() fails (returns NULL), the subsequent readw() will cause a NULL pointer dereference. Signed-off-by: Wang Jun <1742789905@qq.com> Signed-off-by: Helge Deller <deller@gmx.de>
2026-03-09lib/fonts: Store font data for user space with font_data_export()Thomas Zimmermann
Add font_data_export() and update consoles to use it. The helper font_data_export() is based on code in fbcon_get_font(). It extends the size of a single glyph to match the requested vpitch, which us usually 32 bytes for fonts from user space. Internal fonts have a pitch according to the glyph's height. The implementation of font_data_export() differs in several ways from the original code. The original implementation distinguished between different pitches of the font data. This is not necessary as the pitch is a parameter in the copying. There was also special handling for a font pitch of 3 bytes, which got expanded to 4 bytes (with trailing bits on each scanline). The logic originated from long before git history exists even in the historical tree. So it is not clear why this was implemented. It is not what user space expects. The setfont utitlity loads font with 3-bytes pitches and expects to read such fonts with a 3-byte pitch. For any font width, the font pitch is always the width extended to the next multiple of 8. See [1] for the user-space font-reading code. With the changes to handling the font pitches, font_data_export() replaces the original code's various special cases with a single copying logic. v3: - fix typos (Helge) Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Link: https://github.com/legionus/kbd/blob/v2.9.0/src/libkfont/kdfontop.c#L73 # [1] Signed-off-by: Helge Deller <deller@gmx.de>
2026-03-09lib/fonts: Create font_data_t from struct console_font with font_data_import()Thomas Zimmermann
Add font_data_import() and update consoles to use it. The implementation of font_data_import() is based on code from fbcon, which supports overflow checks and crc32 checksums. Fbcon uses the crc32 checksum. Newport_con now implements the same overflow checks as fbcon. As before, this console does not support checksums, which are optional. Newport_con can now also handle input font data with a vertical pitch other than 32 bytes. (The vertical pitch is the offset between two glyphs in the font data.) As an internal change, remove the const qualifier from the data field if struct font_data. This allows font_data_import() to write the data without type casting. For all users of the font data via font_data_t, the stored data is still read only. v3: - fix typos Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Helge Deller <deller@gmx.de>
2026-03-09lib/fonts: Compare font data for equality with font_data_is_equal()Thomas Zimmermann
Add font_data_is_equal() and update consoles to use it. Font data is equal if it has the same size and contains the same values on all bytes. Only fbcon uses a crc32 checksum. If set in both operands the checksums have to be equal. The new helper also guarantees to not compare internal fonts against fonts from user space. Internal fonts cannot be ref-counted, so making them equal to user-space fonts with the same byte sequence results in undefined behavior. The test only compares data buffers. Their interpretation is up each console. Therefore remove a width test in fbcon_set_font(). v3: - rebase onto font_data_{get,put}() Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Helge Deller <deller@gmx.de>
2026-03-09lib/fonts: Manage font-data lifetime with font_data_get/_put()Thomas Zimmermann
Add font_data_get() and font_data_put(). Update consoles to use them over REFCOUNT() and plain kfree(). Newly allocated font data starts with a reference count of 1. Loading the font puts the previously loaded font. If the reference count reaches zero, font_data_put() frees the font data. The kernel stores a refcount of zero for internal font data. Invoking font_data_get() and font_data_put() tests this internally and returns success without further operation. From the caller's perspective, getting and putting works the same for all font data. Fbcon used the userfont flag distinguish between internal fonts and fonts loaded by user space. Only the latter where refcounted. With the new helper's automatic handling of internal font data, remove the userfont flag from fbcon. Newport_con uses a default font, FONT_DATA, until user space loads custom font data. Remove all special cases for FONT_DATA, as the get and put calls' read-only handling also covers this case. v3: - fix module linker error wrt font symbols (Nathan, Arnd) - fix typos Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Helge Deller <deller@gmx.de>
2026-03-09lib/fonts: Read font size with font_data_size()Thomas Zimmermann
Add font_data_size() and update consoles to use it. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Helge Deller <deller@gmx.de>