summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2026-07-27thunderbolt: icm: Preserve USB4 proxy data-valid bitXu Rao
The ICM USB4 switch operation request encodes two values in request.data_len_valid: bit 4 marks the data payload valid, while bits 3:0 hold the payload length in dwords. A zero length with the valid bit set represents the full 16-dword data array. icm_usb4_switch_op() sets the valid bit when a transmit payload is present. For payloads shorter than the full 16 dwords, it then assigns the length to the whole field and clears the valid bit that was just set. The payload is still copied into the request, but the descriptor sent to firmware marks that data as invalid. This affects USB4 router operations that send short payloads through the firmware connection manager. In particular, USB4 NVM writes can send a short final block when the image size is not aligned to the 64-byte proxy payload size. Firmware may then ignore or reject that final block, while full 16-dword blocks are unaffected because they are encoded as length 0 with the valid bit set. OR the short payload length into data_len_valid so the valid bit is preserved. Fixes: 9039387e166e ("thunderbolt: Add USB4 router operation proxy for firmware connection manager") Cc: stable@vger.kernel.org Signed-off-by: Xu Rao <raoxu@uniontech.com> Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
2026-07-27drm/xe/bo: optimise TT population for DONTNEED BOsMatthew Auld
When a VRAM buffer object is marked as DONTNEED, like in Mesa, the driver skips migrating its contents to system memory and instead purges the backing store during eviction (via xe_ttm_bo_purge). However, xe_evict_flags() still returns tt_placement (XE_PL_TT) for VRAM BOs even if they were marked DONTNEED. This causes ttm_bo_handle_move_mem() to always call ttm_bo_populate() to allocate destination system pages, only for those pages to be immediately freed right after when xe_bo_move() calls xe_ttm_bo_purge(). Fix this by changing xe_evict_flags() to return sys_placement (XE_PL_SYSTEM) for DONTNEED BOs. This causes TTM to skip the population step while still ensuring that TTM calls xe_bo_move(), so xe_ttm_bo_purge() still triggers. v2 (Thomas): - Add a comment to highlight why sys_placement over purge_placement. Assisted-by: Copilot:gemini-3.1-pro-preview Signed-off-by: Matthew Auld <matthew.auld@intel.com> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> Cc: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Maarten Lankhorst <dev@lankhorst.se> Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260723161542.1220276-2-matthew.auld@intel.com
2026-07-27thunderbolt: xdomain: Notify peers after enumerationMilo Chen
Service drivers may register local XDomain properties while discovery is still in progress. This can cause the properties changed notification to be sent before the peer is ready to act on it. If the peer has already read the local property block before the service was registered, it may keep using the old property generation and miss the newly registered service. With ThunderboltIP this can leave the network service half-discovered after a warm reboot and the login request eventually times out. Queue another properties changed notification after the XDomain reaches ENUMERATED so the peer can re-read the final local properties. Signed-off-by: Milo Chen <cmh79479@gmail.com> Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
2026-07-27thunderbolt: Drop comma after device id array terminatorUwe Kleine-König (The Capable Hub)
The usual style for other device id arrays doesn't have a comma after the initializer. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
2026-07-27thunderbolt: Assert that a service driver has a probe callbackUwe Kleine-König (The Capable Hub)
tb_service_probe() calls the driver's probe function unconditionally. Check at driver register time that this callback is valid to prevent a NULL pointer exception. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
2026-07-27thunderbolt: Stop passing matched device ID to .probe()Uwe Kleine-König (The Capable Hub)
No driver makes use of that parameter, so drop it and don't spend the effort to determine the matching entry. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
2026-07-27thunderbolt: Assert downstream port reset on shutdownBasavaraj Natikar
On shutdown the connection manager tears down the router tree without signalling connected devices. A Thunderbolt 3 device directly connected to a USB4 host never receives a disconnect indication and during shutdown this can cause polling the dead link for up to 60 seconds. On some platforms this behavior leads to a warm reset instead of a shutdown due to this timeout. Fix this by asserting PORT_CS_19.DPR on each connected downstream port before tearing down the router tree. This drives SBTX low (USB4 spec section 6.9), causing the device to detect SBRX low and transition to Uninitialized Unplugged state immediately. Always do this on system shutdown/reboot by forcing host_reset in the PCI ->shutdown callback. On plain driver unload only do it when the host router was actually reset on load (host_reset=1), since in that case the tunnels are not preserved across reload anyway; with host_reset=0 the tunnels are kept alive across unload/reload so the links are left intact. Restrict the reset to Thunderbolt 3 devices. Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Co-developed-by: Sanath S <Sanath.S@amd.com> Signed-off-by: Sanath S <Sanath.S@amd.com> Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com> Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
2026-07-27thunderbolt: Bound the DROM dual link port number before indexing sw->portsBryam Vargas
tb_drom_parse_entry_port() validates the device-supplied header->index against sw->config.max_port_number before indexing sw->ports[], but the sibling field entry->dual_link_port_nr -- a 6-bit value also read from the DROM -- indexes the same array with no such check. A malicious or malformed Thunderbolt device can set dual_link_port_nr beyond the allocated sw->ports[] (max_port_number + 1 entries), producing an out-of-bounds tb_port pointer that is stored and later dereferenced. Reject a port entry whose dual_link_port_nr exceeds max_port_number, the same bound already applied to header->index. Fixes: cd22e73bdf5e ("thunderbolt: Read port configuration from eeprom.") Cc: stable@vger.kernel.org Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me> Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
2026-07-27thunderbolt: Fix bandwidth group reservation indexingXu Rao
Valid bandwidth group IDs range from 1 through MAX_GROUPS, while Group ID 0 is reserved. tb_consumed_dp_bandwidth() uses the Group ID directly to index its local group_reserved[] array. The array currently has MAX_GROUPS entries, so its valid indices are 0 through MAX_GROUPS - 1. Group ID MAX_GROUPS therefore accesses one element past the end, and the final group's reserved bandwidth is not included when the array is summed. Give group_reserved[] MAX_GROUPS + 1 entries so direct Group ID indexing covers the reserved ID 0 and valid IDs 1 through MAX_GROUPS. Fixes: 52a4490e89d7 ("thunderbolt: Reserve released DisplayPort bandwidth for a group for 10 seconds") Cc: stable@vger.kernel.org Signed-off-by: Xu Rao <raoxu@uniontech.com> Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
2026-07-27thunderbolt: stream: Unmap buffers with mapped sizeXu Rao
The size passed to dma_unmap_page() must match the size used for the corresponding dma_map_page() call. Stream RX and TX buffers are mapped with TB_MAX_FRAME_SIZE when the buffer pools are allocated. However, tbstream_ring_free() currently uses tb_ring_frame_size() as the unmap size. That helper returns the current frame payload size, not the DMA mapping size. On the TX path, tbstream_dev_alloc_tx() stores a shorter payload length in frame.size when the payload is smaller than TB_MAX_FRAME_SIZE. This happens for a short final DATA frame, and also for the CLOSE frame, which is allocated with SZ_256. In those cases the buffer was mapped with TB_MAX_FRAME_SIZE, but tb_ring_frame_size() returns the shorter frame payload length. This makes the dma_unmap_page() size differ from the original dma_map_page() size. Use TB_MAX_FRAME_SIZE when unmapping stream buffers so the unmap size matches the DMA mapping size used by the buffer allocation paths. Signed-off-by: Xu Rao <raoxu@uniontech.com> Fixes: 6db21d817b43 ("thunderbolt: Add support for USB4STREAM") Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
2026-07-27clk: imx: imx8qxp: add soft dependency on SCU power domain driverZhipeng Wang
The i.MX8QXP SCU clock driver manually attaches power domains to each clock device via of_genpd_add_device() in imx_clk_scu_attach_pd(). If the SCU power domain provider has not probed yet, the attachment fails silently with a pr_warn() and the clock device is registered without a power domain. When both drivers are built as modules, there is no implicit dependency to guarantee load order. Add MODULE_SOFTDEP("pre: scu_pd") so that modprobe loads the SCU power domain module before the clock module. Signed-off-by: Zhipeng Wang <zhipeng.wang_1@nxp.com> Reviewed-by: Peng Fan <peng.fan@nxp.com> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Ulf Hansson <ulfh@kernel.org>
2026-07-27pmdomain: imx: scu-pd: allow building as a moduleZhipeng Wang
Convert CONFIG_IMX_SCU_PD from bool to tristate to allow building as a loadable module. This is needed on Android devices using the Generic Kernel Image (GKI), where SoC-specific drivers must be built as modules rather than built into the core kernel image. For i.MX8Q devices running Android with a GKI kernel, the SCU power domain driver must be loadable. Without tristate support, power domains cannot be properly initialized, preventing these systems from functioning under GKI. Use subsys_initcall() so that when built-in the power domain provider probes before its consumers (e.g. the SCU clock driver at device_initcall level), fixing "failed to attached the power domain" warnings at boot. When built as a module, subsys_initcall() is equivalent to module_init(). No module_exit() is provided because the SCU power domain provider is a system-level resource that cannot be safely removed at runtime. Add MODULE_DEVICE_TABLE() for OF-based module autoloading. Signed-off-by: Zhipeng Wang <zhipeng.wang_1@nxp.com> Reviewed-by: Peng Fan <peng.fan@nxp.com> Signed-off-by: Ulf Hansson <ulfh@kernel.org>
2026-07-27of: export of_stdout symbolZhipeng Wang
of_stdout is declared extern in include/linux/of.h alongside of_root and of_chosen, but unlike those two it is not exported, preventing modules from referencing it. Export it with EXPORT_SYMBOL_GPL() so drivers that need the stdout device node can be built as modules. Signed-off-by: Zhipeng Wang <zhipeng.wang_1@nxp.com> Acked-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Ulf Hansson <ulfh@kernel.org>
2026-07-27pmdomain: Merge branch fixes into nextUlf Hansson
Merge the pmdomain fixes for v7.2-rc[n] into the next branch, to allow them to get tested together with the pmdomain changes that are targeted for the next release. Signed-off-by: Ulf Hansson <ulfh@kernel.org>
2026-07-27pmdomain: mediatek: fix remaining %pOF after of_node_put()Guangshuo Li
scpsys_get_bus_protection_legacy() looks up several legacy bus protection regmaps from device-tree nodes. Two error paths put the device node before checking whether the regmap lookup failed, but still pass that node to dev_err_probe() with %pOF on failure. If of_node_put() drops the last reference, the later %pOF formatting can dereference a freed device node. Keep the node reference until after the error message has been emitted in the infracfg and SMI lookup paths. Also drop the SMI node before returning when the SMI phandle is missing. Fixes: c29345fa5f66 ("pmdomain: mediatek: Refactor bus protection regmaps retrieval") Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com> Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson <ulfh@kernel.org>
2026-07-27pinctrl: mediatek: remove conditional return with no effectSang-Heon Jeon
Both branches of the check return the same value, so the check has no effect. Remove it and return the value directly. This is the result of running the Coccinelle script from scripts/coccinelle/misc/cond_return_no_effect.cocci. Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-07-27pinctrl: mediatek: enable module build support for all SoC driversJustin Yeh
Convert the Kconfig option of every MediaTek pinctrl SoC driver from bool to tristate and add MODULE_DESCRIPTION()/MODULE_LICENSE() so that they can be built as loadable kernel modules. This is required for Android GKI + vendor_dlkm deployments, where vendor-specific drivers must be kept separate from the GKI vmlinux and loaded as modules from the vendor partition. Signed-off-by: Justin Yeh <justin.yeh@mediatek.com> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> [linusw@kernel.org: Rebased and added MT6858] Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-07-27drm/panel: novatek-nt36536: Fix panel double-remove on attach failureDavid Carlier
The DSI attach error path calls drm_panel_remove() by hand even though the panel was registered with devm_drm_panel_add(), which already arranges for drm_panel_remove() to run on driver detach. When mipi_dsi_attach() fails the panel is therefore removed twice: once directly and once again while devres unwinds. drm_panel_add() takes a reference and drm_panel_remove() drops one, so the extra removal releases the last reference early and frees the panel container. The put registered by devm_drm_panel_alloc() then operates on freed memory, resulting in a use-after-free and a reference-count underflow when a DSI host rejects the requested configuration during probe. Drop the manual drm_panel_remove() and let the managed cleanup handle it, matching the other dual-DSI panel drivers. Fixes: 75a5dbd1f4f7 ("drm/panel: Add Novatek NT36536 panel driver") Signed-off-by: David Carlier <devnexen@gmail.com> Reviewed-by: Pengyu Luo <mitltlatltl@gmail.com> Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org> Link: https://patch.msgid.link/20260724041746.12887-1-devnexen@gmail.com
2026-07-27drm/panel: simple: Add Ampire AM-800480N3TZQW-00HPaul Louvel
Add support for the Ampire AM-800480N3TZQW-00H 5" WVGA TFT LCD panel. Signed-off-by: Paul Louvel <paul.louvel@bootlin.com> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org> Link: https://patch.msgid.link/20260723-support-am-800480n3tzqw-00h-v1-2-6a4ae0575a19@bootlin.com
2026-07-27drm/panel: st7703: Add AYANEO Pocket DS Lower Panel SupportAlexandre Hamamdjian
Add support for the lower (secondary) panel of the AYANEO Pocket DS, a dual-screen QCS8550 (Snapdragon 8 Gen 2) handheld. It is a 5.0" 1024x768 4:3 IPS LCD driven by a Sitronix ST7703 DDIC: every command in the vendor init sequence maps to an ST7703 manufacturer command (SETEXTC, SETMIPI, SETRGBIF, SETSCR, SETPOWER, SETGAMMA, SETGIP1/2), and the SETMIPI and SETRGBIF payloads are near-identical to the already-supported Powkiddy RGB10MAX3. The panel is mounted in portrait (768x1024) and rotated 270 degrees in the device, expressed through the panel rotation property. The SETEXTC unlock password ends in 0x87 rather than the canonical 0x83; this is the value shipped by the vendor firmware and is kept verbatim. Init sequence extracted from the AYANEO Pocket DS BSP kernel, via the ROCKNIX SM8550 port. Signed-off-by: Alexandre Hamamdjian <azkali.limited@gmail.com> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org> Link: https://patch.msgid.link/20260723-b4-st7703-pocketds-lower-v1-2-e3db246589f4@gmail.com
2026-07-27drm: panel: jd9365da: Add DCLTek 300250 9.35in displayMarc-Olivier Champagne
The DCLTek dt300250 is a LCD panel using the jd9365da controller. Add the panel to the driver. Suggested-by: Hugo Villeneuve <hvilleneuve@dimonoff.com> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Signed-off-by: Marc-Olivier Champagne <marc-olivier.champagne@savoirfairelinux.com> Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org> Link: https://patch.msgid.link/20260722173840.3576444-5-marc-olivier.champagne@savoirfairelinux.com
2026-07-27drm: panel: jd9365da: Enable LPM modeMarc-Olivier Champagne
The JD9365DA-H3 uses DSI LPM for command transmissions, make sure this is configured correctly in the DSI mode flags. Suggested-by: Hugo Villeneuve <hvilleneuve@dimonoff.com> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Signed-off-by: Marc-Olivier Champagne <marc-olivier.champagne@savoirfairelinux.com> Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org> Link: https://patch.msgid.link/20260722173840.3576444-2-marc-olivier.champagne@savoirfairelinux.com
2026-07-27Merge tag 'config-gpio-legacy-for-7.3' of ↵Bartosz Golaszewski
https://git.kernel.org/pub/scm/linux/kernel/git/arnd/playground into gpio/for-next gpio: legacy interface cleanups for 7.3 These are the remaining patches for legacy gpio interface cleanup, ensuring that files referencing them are sure to have CONFIG_GPIOLIB_LEGACY set, and use linux/gpio/legacy.h instead of the old linux/gpio.h header. There are a few more patches already merged in other branches for 7.3, including soc, led, net and media. Once everything is in, we can apply the final patches to turn off CONFIG_GPIOLIB_LEGACY by default and remove the obsolete header file. This branch is based on the immutable ib-mfd-legacy-gpio-7.3 branch from mfd.git to avoid a conflict in the rohm drivers.
2026-07-27RDMA/mlx5: Deprecate latency-sensitive QPs featureMichael Guralnik
New HW no longer implements a separate class for latency-sensitive QPs and advertises this by a new cap bit. REG_UMR is the only QP that used this feature, so gate its usage of the feature on this cap. Signed-off-by: Michael Guralnik <michaelgur@nvidia.com> Reviewed-by: Patrisious Haddad <phaddad@nvidia.com> Signed-off-by: Edward Srouji <edwards@nvidia.com> Link: https://patch.msgid.link/20260726-deprecate-lat-qps-v2-2-5e0c2ee55046@nvidia.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-27Merge 7.2-rc5 into staging-nextGreg Kroah-Hartman
We need the staging driver fixes in here as well. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-27Merge 7.2-rc5 into tty-nextGreg Kroah-Hartman
We need the serial driver fixes in here as well. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-27Merge 7.2-rc5 into usb-nextGreg Kroah-Hartman
We need the USB fixes in here as well. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-27mlx5: Deprecate latency-sensitive QPs featureLeon Romanovsky
New HW no longer implements a separate class for latency-sensitive QPs and advertises this by a new cap bit. Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-27RDMA/mlx5: Fix integer overflow of user QP buffer sizeMaher Sanalla
set_user_buf_size() computes the QP buffer size by left-shifting the user-supplied rq.wqe_cnt and rq.wqe_shift values as signed integers. A sufficiently large rq.wqe_cnt causes signed integer overflow, which is undefined behavior, and yields a small or negative buf_size, causing ib_umem_get() to map a buffer smaller than the hardware will actually write into. Replace the shifts and addition with check_shl_overflow() and check_add_overflow(), rejecting invalid user inputs. Moreover, guard the identical shift computing qp->sq.offset in _create_user_qp() before set_user_buf_size() is reached. Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters") Signed-off-by: Maher Sanalla <msanalla@nvidia.com> Signed-off-by: Edward Srouji <edwards@nvidia.com> Link: https://patch.msgid.link/20260723-fix-qp-buf-size-overflow-v1-1-ccb05ee43a7b@nvidia.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-27RDMA/mlx5: Expose RoCE acceleration counters on all functionsMichael Gur
Decouple RoCE acceleration counters exposure from the roce_accl device cap. The device cap is intended to protect the access to the roce_accl register and was disabled on VFs for that purpose. Reading the acceleration counters, however, does not involve that register, the counters are read-only statistics that carry no configuration risk. Gating their exposure on the capability therefore needlessly hides useful diagnostic data on VFs. Expose the counters on all functions regardless of the capability. Signed-off-by: Michael Gur <michaelgur@nvidia.com> Reviewed-by: Chiara Meiohas <cmeiohas@nvidia.com> Signed-off-by: Edward Srouji <edwards@nvidia.com> Link: https://patch.msgid.link/20260723-expose-roce-accl-counters-v1-1-967618b550cd@nvidia.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-27RDMA/mlx5: Make sure that UMR page is aligned to PAGE_SIZELeon Romanovsky
The UMR XLT buffer needs to be aligned to PAGE_SIZE. Fixes: b2022068dea0 ("RDMA/mlx5: use kmalloc() for UMR translation buffers") Link: https://patch.msgid.link/20260722-fix-get-order-alignment-v1-1-ece212ddb5dc@nvidia.com Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
2026-07-27drm/nouveau: allow allocating NVDEC channels via abi16Dave Airlie
Add NOUVEAU_FIFO_ENGINE_NVDEC to the abi16 uAPI and accept it in channel allocation, mapping it to the NVDEC engine runlist. Skip the Turing copy-engine workaround object for NVDEC channels: the copy engines are not part of the NVDEC runlist, so the workaround object cannot be instantiated on such channels (and is not needed there). This is required for NVK to implement Vulkan Video H.264 decode on top of the NVDEC engine: https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/31867 Reviewed-by: Daniel Almeida <daniel.almeida@collabora.com> Signed-off-by: Dave Airlie <airlied@redhat.com> Link: https://patch.msgid.link/20260725035912.1016464-1-daniel.almeida@collabora.com
2026-07-27firewire: core: validate sub-block lengths in fw_core_add_descriptor()Sreeraj S Kurup
When traversing internal block structures of a descriptor in fw_core_add_descriptor(), each sub-block header specifies its own length in the upper 16 bits of its header quadlet. If a malformed or corrupted descriptor provides a sub-block length that exceeds the remaining total length of the descriptor buffer, the parsing loop advances past the allocated boundary of desc->data, leading to an out-of-bounds read access. Validate each sub-block's length against the remaining descriptor size before advancing the offset pointer to ensure loop bounds safety. Signed-off-by: Sreeraj S Kurup <sreekuttan2156239@gmail.com> Link: https://lore.kernel.org/r/20260725155255.3054-3-sreekuttan2156239@gmail.com Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
2026-07-27firewire: core: validate overall descriptor length in fw_core_add_descriptor()Sreeraj S Kurup
In fw_core_add_descriptor(), incoming descriptor structures are processed without checking whether the descriptor's specified length falls within valid boundaries. An empty descriptor (length 0) or an oversized descriptor exceeding the IEEE 1394 Config ROM capacity can lead to invalid processing. Add bounds checking at the start of fw_core_add_descriptor() using the in_range() helper macro to reject descriptors with length 0 or length exceeding 256 quadlets (the standard maximum Configuration ROM size). Signed-off-by: Sreeraj S Kurup <sreekuttan2156239@gmail.com> Link: https://lore.kernel.org/r/20260725155255.3054-2-sreekuttan2156239@gmail.com Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
2026-07-27hwrng: stm32 - Fix runtime PM cleanup on registration failureCan Peng
stm32_rng_probe() enables autosuspend and runtime PM before registering the hwrng. If devm_hwrng_register() fails, probe returns with runtime PM left enabled and autosuspend still selected. The remove callback also only disables runtime PM and does not undo pm_runtime_use_autosuspend(). Use devm_pm_runtime_enable() so runtime PM is unwound automatically on probe failure and driver detach. Since the managed cleanup also disables runtime PM,drop the remove callback. Fixes: c6a97c42e399 ("hwrng: stm32 - add support for STM32 HW RNG") Cc: stable@vger.kernel.org Signed-off-by: Can Peng <pengcan@kylinos.cn> Reviewed-by: Linus Walleij <linusw@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-27crypto: hisilicon/sec2 - remove unused sec_ctx.hlf_q_numChenghai Huang
hlf_q_num is set but never read; drop the field and its assignment. Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-27crypto: hisilicon/sec2 - fix uninitialized type_supported in sec_create_qp_ctxChenghai Huang
sec_create_qp_ctx() reads ctx->type_supported to pick its callback, but sec_skcipher_init() and sec_aead_init() set it after sec_ctx_base_init() has already walked the qp_ctx loop, so the value is uninitialized when first consumed. Set type_supported in sec_ctx_base_init() before the loop; the alg init paths now just select req_op from it. Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-27crypto: stm32 - Remove redundant dev_err()Pan Chuang
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_threaded_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() calls. Signed-off-by: Pan Chuang <panchuang@vivo.com> Acked-by: Maxime Méré <maxime.mere@foss.st.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-27crypto: rockchip - Remove redundant dev_err()Pan Chuang
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() calls. Signed-off-by: Pan Chuang <panchuang@vivo.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-27crypto: octeontx2 - Remove redundant dev_err()Pan Chuang
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() calls. Signed-off-by: Pan Chuang <panchuang@vivo.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-27crypto: keembay - Remove redundant dev_err()Pan Chuang
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_threaded_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() calls. Signed-off-by: Pan Chuang <panchuang@vivo.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-27crypto: safexcel - Remove redundant dev_err()Pan Chuang
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_threaded_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() calls. Signed-off-by: Pan Chuang <panchuang@vivo.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-27crypto: sl3516 - Remove redundant dev_err()Pan Chuang
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() calls. Signed-off-by: Pan Chuang <panchuang@vivo.com> Reviewed-by: Linus Walleij <linusw@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-27crypto: ccree - Remove redundant dev_err()Pan Chuang
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() calls. Signed-off-by: Pan Chuang <panchuang@vivo.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-27crypto: drivers - Remove redundant dev_err()/dev_err_probe()Pan Chuang
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() and dev_err_probe() calls. Signed-off-by: Pan Chuang <panchuang@vivo.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-27crypto: aspeed - Remove redundant dev_err()Pan Chuang
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() calls. Signed-off-by: Pan Chuang <panchuang@vivo.com> Reviewed-by: Andrew Jeffery <andrew@codeconstruct.com.au> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-27crypto: amlogic - Remove redundant dev_err()Pan Chuang
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() calls. Signed-off-by: Pan Chuang <panchuang@vivo.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-27crypto: allwinner - Remove redundant dev_err()Pan Chuang
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() calls. Signed-off-by: Pan Chuang <panchuang@vivo.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-27crypto: omap-sham - use devm_platform_get_and_ioremap_resourceRosen Penev
Replace the open-coded omap_sham_get_res_of()/omap_sham_get_res_pdev() helpers and the #ifdef CONFIG_OF machinery with the managed devm_platform_get_and_ioremap_resource(), platform_get_irq() and device_get_match_data() helpers. The omap_sham_pdata_omap2 fallback is kept for the non-DT (legacy platform_device) case. This removes the manual resource copy and ioremap, simplifying probe. Assisted-by: opencode:hy3-free Signed-off-by: Rosen Penev <rosenp@gmail.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-27crypto: omap-aes - use devm_platform_get_and_ioremap_resourceRosen Penev
Replace the open-coded omap_aes_get_res_of()/omap_aes_get_res_pdev() helpers and the #ifdef CONFIG_OF machinery with the managed devm_platform_get_and_ioremap_resource(), platform_get_irq() and device_get_match_data() helpers. The omap_aes_pdata_omap2 fallback is kept for the non-DT (legacy platform_device) case, and the now-unused err_res label is removed. Assisted-by: opencode:hy3-free Signed-off-by: Rosen Penev <rosenp@gmail.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>