summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2026-04-27media: iris: Fix use-after-free in iris_release_internal_buffers()Dikshita Agarwal
The recent change in commit 1dabf00ee206 ("media: iris: gen1: Destroy internal buffers after FW releases") introduced a regression where session_release_buf() may free the buffer. The caller, iris_release_internal_buffers(), continued to access `buffer` after the call, leading to a potential use-after-free. Fix this by setting BUF_ATTR_PENDING_RELEASE before calling session_release_buf(), and reverting the flag if the call fails. This ensures no dereference occurs after potential freeing. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Closes: https://lore.kernel.org/lkml/aYXvKAX3Pg3sL37P@stanley.mountain/#r Signed-off-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com> Reviewed-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com> Fixes: 1dabf00ee206 ("media: iris: gen1: Destroy internal buffers after FW releases") Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue <bod@kernel.org> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-04-27media: iris: fix QCOM_MDT_LOADER dependencyArnd Bergmann
When build-testined with CONFIG_QCOM_MDT_LOADER=m and VIDEO_QCOM_IRIS=y, the kernel fails to link: x86_64-linux-ld: drivers/media/platform/qcom/iris/iris_firmware.o: in function `iris_fw_load': iris_firmware.c:(.text+0xb0): undefined reference to `qcom_mdt_get_size' iris_firmware.c:(.text+0xfd): undefined reference to `qcom_mdt_load' The problem is the conditional 'select' statement. Change this to make the driver built-in here regardless of CONFIG_ARCH_QCOM. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Reviewed-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com> Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Fixes: d19b163356b8 ("media: iris: implement video firmware load/unload") Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue <bod@kernel.org> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-04-27media: venus: fix QCOM_MDT_LOADER dependencyArnd Bergmann
When build-testined with CONFIG_QCOM_MDT_LOADER=m and VIDEO_QCOM_VENUS=y, the kernel fails to link: x86_64-linux-ld: drivers/media/platform/qcom/venus/firmware.o: in function `venus_boot': firmware.c:(.text+0x1e3): undefined reference to `qcom_mdt_get_size' firmware.c:(.text+0x25a): undefined reference to `qcom_mdt_load' firmware.c:(.text+0x272): undefined reference to `qcom_mdt_load_no_init' The problem is the conditional 'select' statement. Change this to make the driver built-in here regardless of CONFIG_ARCH_QCOM, same as for the similar IRIS driver. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Reviewed-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com> Fixes: 0399b696f7f4 ("media: venus: fix compile-test build on non-qcom ARM platform") Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue <bod@kernel.org> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-04-27thunderbolt: debugfs: Don't stop reading SB registers if just one failsKonrad Dybcio
The GEN4 TxFFE register is not part of the USB4 v1.0 specification, so understandably some pre-USB4v2 retimers (like the Parade PS8830) don't seem to implement it. The immediate idea to counter this would be to introduce a version check for that specific register, but on a second thought, the current flow only returns a quiet -EIO if there's any failures, without hinting at what the actual problem is. To take care of both of these issues, simply print an error line for each SB register read that fails and go on with attempting to read the others. Note that this is not quite in-spec behavior ("The SB Register Space registers shall have the structure and fields described in Table 4-17. Registers not listed in Table 4-20 are undefined and shall not be used."), but it's the easiest fix that shouldn't have real-world bad side effects. Fixes: 6d241fa00159 ("thunderbolt: Add sideband register access to debugfs") Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
2026-04-26Input: xpad - fix out-of-bounds access for Share buttonDmitry Torokhov
xpadone_process_packet() receives len directly from urb->actual_length and uses it to index the share-button byte at data[len - 18] or data[len - 26]. Since both len and data[0] are under the device's control, a broken controller can send a GIP_CMD_INPUT packet with actual_length < 18 (e.g. 5 bytes) and reach this code path, causing accesses beyond the actual array. Fix this by calculating the offset and checking bounds against the packet length. Reported-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Fixes: 4ef46367073b ("Input: xpad - fix Share button on Xbox One controllers") Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-26Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer sizeGreg Kroah-Hartman
nexio_read_data() pulls data_len and x_len from a packed __be16 header in the device's interrupt packet and then walks packet->data[0..x_len) and packet->data[x_len..data_len) comparing each byte against a threshold. Both fields are 16-bit on the wire (max 65535). The existing adjustments shave at most 0x100 / 0x80 off, so the loop bound can still reach roughly 0xfeff. The URB transfer buffer for NEXIO is rept_size (1024) bytes from usb_alloc_coherent(), with the first 7 occupied by the packed header — so packet->data[] has 1017 valid bytes. read_data() callbacks are not given urb->actual_length, and nothing else bounds the walk. A device that lies about its length can get a ~64 KiB out-of-bounds read past the coherent DMA allocation. The first index whose byte exceeds NEXIO_THRESHOLD lands in begin_x / begin_y and from there into the reported touch coordinates, so adjacent kernel memory contents leak to userspace as ABS_X / ABS_Y events. Far enough out, the read can also hit an unmapped page and fault. Fix this all by clamping data_len to the buffer's data[] capacity and x_len to data_len. Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com> Fixes: 5197424cdccc ("Input: usbtouchscreen - add NEXIO (or iNexio) support") Cc: stable <stable@kernel.org> Assisted-by: gkh_clanker_t1000 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Link: https://patch.msgid.link/2026042026-chlorine-epidermis-fd6d@gregkh Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-26Merge branch '7.1/scsi-queue' into 7.1/scsi-fixesMartin K. Petersen
Pull in remaining commits from 7.1/scsi-queue. Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-04-27spi: atcspi200: two cleanupMark Brown
Link: https://patch.msgid.link/20260417-atcspi-v1-0-854831667d63@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-27spi: atcspi200: switch to devm functionsFelix Gu
Switch to use devm_spi_alloc_host and devm_mutex_init to make code clean. Signed-off-by: Felix Gu <ustc.gu@gmail.com> Link: https://patch.msgid.link/20260417-atcspi-v1-2-854831667d63@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-27spi: atcspi200: fix use-after-free when driver unbindFelix Gu
DMA resource is initialized after SPI controller registration. So when driver unbind, this can trigger a use-after-free when DMA is torn down while the controller is still alive and triggers DMA transfers. Fixes: 34e3815ea459 ("spi: atcspi200: Add ATCSPI200 SPI controller driver") Signed-off-by: Felix Gu <ustc.gu@gmail.com> Link: https://patch.msgid.link/20260417-atcspi-v1-1-854831667d63@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-27spi: cadence-quadspi: runtime PM fixesMark Brown
Johan Hovold <johan@kernel.org> says: This series fixes some runtime PM related issues in the cadence-quadspi driver. Included is also a couple of related cleanups.
2026-04-27spi: cadence-quadspi: drop redundant match data lookupJohan Hovold
Use the OF match data stored at probe instead of looking it up again on driver unbind. Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260421125354.1534871-7-johan@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-27spi: cadence-quadspi: clean up disable runtime pm quirkJohan Hovold
Commit 30dbc1c8d50f ("spi: cadence-qspi: defer runtime support on socfpga if reset bit is enabled") fixed a warm reset issue on SoCFPGA by disabling runtime PM on that platform. Clean up the quirk implementation by never dropping the runtime PM usage count on probe instead of sprinkling conditionals throughout the driver which makes the code unnecessarily hard to read and maintain. Cc: Khairul Anuar Romli <khairul.anuar.romli@altera.com> Cc: Adrian Ng Ho Yin <adrianhoyin.ng@altera.com> Cc: Niravkumar L Rabara <nirav.rabara@altera.com> Cc: Matthew Gerlach <matthew.gerlach@altera.com> Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260421125354.1534871-6-johan@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-27spi: cadence-quadspi: fix runtime pm and clock imbalance on unbindJohan Hovold
Make sure to balance the runtime PM usage count before returning on probe failure (to allow the controller to suspend after a probe deferral) and to only drop the usage count on driver unbind to avoid a clock disable imbalance. Also restore the autosuspend setting. Fixes: 0578a6dbfe75 ("spi: spi-cadence-quadspi: add runtime pm support") Cc: stable@vger.kernel.org # 6.7 Cc: Dhruva Gole <d-gole@ti.com> Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260421125354.1534871-5-johan@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-27spi: cadence-quadspi: fix unclocked access on unbindJohan Hovold
Make sure that the controller is runtime resumed before disabling it during driver unbind to avoid an unclocked register access. This issue was flagged by Sashiko when reviewing a controller deregistration fix. Fixes: 0578a6dbfe75 ("spi: spi-cadence-quadspi: add runtime pm support") Cc: stable@vger.kernel.org # 6.7 Cc: Dhruva Gole <d-gole@ti.com> Link: https://sashiko.dev/#/patchset/20260414134319.978196-1-johan%40kernel.org?part=2 Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260421125354.1534871-4-johan@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-27spi: cadence-quadspi: fix clock imbalance on probe failureJohan Hovold
Drop the bogus runtime PM get on probe failures that was never needed and that leaks a usage count reference while preventing the clocks from being disabled (as runtime PM has not yet been enabled). Fixes: 1889dd208197 ("spi: cadence-quadspi: Fix clock disable on probe failure path") Cc: stable@vger.kernel.org # 6.19 Cc: Anurag Dutta <a-dutta@ti.com> Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260421125354.1534871-3-johan@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-27spi: cadence-quadspi: fix runtime pm disable imbalance on probe failureJohan Hovold
A recent attempt to fix the probe error handling introduced a runtime PM disable depth imbalance by incorrectly disabling runtime PM on early failures (e.g. probe deferral). Fixes: f18c8cfa4f1a ("spi: cadence-qspi: Fix probe error path and remove") Cc: stable@vger.kernel.org # 7.0 Cc: Miquel Raynal (Schneider Electric) <miquel.raynal@bootlin.com> Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260421125354.1534871-2-johan@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-27spi: cadence: runtime PM fixesMark Brown
Johan Hovold <johan@kernel.org> says: This series fixes some runtime PM related issues in the cadence driver. Included is also a couple of related cleanups.
2026-04-27spi: cadence: clean up probe return valueJohan Hovold
Drop the redundant initialisation and return explicit zero on successful probe to make the code more readable. Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260421123615.1533617-5-johan@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-27spi: cadence: fix clock imbalance on probe failureJohan Hovold
Make sure that the controller is active before disabling clocks on probe failure to avoid unbalanced clock disable. Also drop the usage count before returning (so that the controller can be suspended after a probe deferral) and restore the autosuspend setting. Fixes: d36ccd9f7ea4 ("spi: cadence: Runtime pm adaptation") Cc: stable@vger.kernel.org # 4.7 Cc: Shubhrajyoti Datta <shubhrajyoti.datta@xilinx.com> Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260421123615.1533617-3-johan@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-27spi: cadence: rename probe error labelsJohan Hovold
The "clk_dis_all" error label is not used to disable clocks since commit f64b1600f92e ("spi: spi-cadence: Use helper function devm_clk_get_enabled()"). Similarly, "remove_ctlr" drops a reference rather than deregisters the controller. Rename the labels after what they do. Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260421123615.1533617-4-johan@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-27spi: cadence: fix unclocked access on unbindJohan Hovold
Make sure that the controller is runtime resumed before disabling it during driver unbind to avoid unclocked register access and unbalanced clock disable. Also restore the autosuspend setting. This issue was flagged by Sashiko when reviewing a controller deregistration fix. Fixes: d36ccd9f7ea4 ("spi: cadence: Runtime pm adaptation") Cc: stable@vger.kernel.org # 4.7 Cc: Shubhrajyoti Datta <shubhrajyoti.datta@xilinx.com> Link: https://sashiko.dev/#/patchset/20260414134319.978196-1-johan%40kernel.org?part=1 Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260421123615.1533617-2-johan@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-27spi: rockchip: Drop unused and broken CR0 macrosJohn Madieu
Two CTRLR0 macros are defined but never referenced, and both are wrong: - CR0_XFM_MASK shifts by SPI_XFM_OFFSET, which does not exist anywhere in the tree. The intended symbol is CR0_XFM_OFFSET. - CR0_MTM_OFFSET is defined as 0x21, i.e. bit 33 of a 32-bit register. The value is meaningless and the macro is unused. Drop both. They can be re-introduced correctly when an actual user appears. Signed-off-by: John Madieu <john.madieu@gmail.com> Link: https://patch.msgid.link/20260425092936.2590132-3-john.madieu@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-27spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQJohn Madieu
rockchip_spi_isr() decides whether the current interrupt was the cs-inactive event by reading IMR: if (rs->cs_inactive && readl_relaxed(rs->regs + ROCKCHIP_SPI_IMR) & INT_CS_INACTIVE) ctlr->target_abort(ctlr); IMR is the interrupt mask register: it tells which sources are enabled, not which one fired. In the PIO path, rockchip_spi_prepare_irq() enables both INT_RF_FULL and INT_CS_INACTIVE in IMR when rs->cs_inactive is true: if (rs->cs_inactive) writel_relaxed(INT_RF_FULL | INT_CS_INACTIVE, rs->regs + ROCKCHIP_SPI_IMR); so the IMR check is always true once cs_inactive is enabled, and every PIO interrupt - including normal RF_FULL completions - is dispatched to ctlr->target_abort(), aborting the transfer. The bug is reachable on ROCKCHIP_SPI_VER2_TYPE2 in target mode with a DMA-capable controller when the transfer is short enough to fall back to PIO (rockchip_spi_can_dma() returns false below fifo_len). Read ISR (which is RISR masked by IMR) so the check actually reflects which interrupt fired, and parenthesise the expression for clarity while at it. Fixes: 869f2c94db92 ("spi: rockchip: Stop spi slave dma receiver when cs inactive") Signed-off-by: John Madieu <john.madieu@gmail.com> Link: https://patch.msgid.link/20260425092936.2590132-2-john.madieu@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-26driver core: Replace dev->offline + ->offline_disabled with accessorsDouglas Anderson
In C, bitfields are not necessarily safe to modify from multiple threads without locking. Switch "offline" and "offline_disabled" over to the "flags" field so modifications are safe. Cc: Rafael J. Wysocki <rafael@kernel.org> Acked-by: Mark Brown <broonie@kernel.org> Reviewed-by: Rafael J. Wysocki (Intel) <rafael@kernel.org> Reviewed-by: Danilo Krummrich <dakr@kernel.org> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Acked-by: Marek Szyprowski <m.szyprowski@samsung.com> Signed-off-by: Douglas Anderson <dianders@chromium.org> Link: https://patch.msgid.link/20260406162231.v5.9.I897d478b4a9361d79cd5073207c1062fd4d0d0e4@changeid Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-04-27spi: mpc52xx: clean up interrupt handlingJohan Hovold
The driver is relying on the assumption that the invalid interrupt 0 can be freed without any side effects, but that is not the case on architectures like x86 where it would trigger a warning about freeing an already free interrupt. This should not cause any trouble on powerpc where this driver is used, but make the code more portable (and obviously correct) by making sure that the interrupts have been requested before freeing them. Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260423075801.2252318-1-johan@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-26driver core: Replace dev->of_node_reused with dev_of_node_reused()Douglas Anderson
In C, bitfields are not necessarily safe to modify from multiple threads without locking. Switch "of_node_reused" over to the "flags" field so modifications are safe. Cc: Johan Hovold <johan@kernel.org> Acked-by: Mark Brown <broonie@kernel.org> Reviewed-by: Rafael J. Wysocki (Intel) <rafael@kernel.org> Reviewed-by: Danilo Krummrich <dakr@kernel.org> Signed-off-by: Douglas Anderson <dianders@chromium.org> Reviewed-by: Johan Hovold <johan@kernel.org> Acked-by: Manivannan Sadhasivam <mani@kernel.org> # PCI_PWRCTRL Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Acked-by: Marek Szyprowski <m.szyprowski@samsung.com> Link: https://patch.msgid.link/20260406162231.v5.8.I806b8636cd3724f6cd1f5e199318ab8694472d90@changeid Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-04-27regmap: sdw-mbq: Fix spelling mistake "undeferable" -> "undeferrable"Colin Ian King
There is a spelling mistake in a dev_warn message. Fix it. Signed-off-by: Colin Ian King <colin.i.king@gmail.com> Link: https://patch.msgid.link/20260424112425.32129-1-colin.i.king@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-27spi: rzv2h-rspi: Fix silent failure in clock setup error pathJohn Madieu
rzv2h_rspi_setup_clock() is declared to return u32 but returns -EINVAL when no valid clock parameters are found. Cast to u32, -EINVAL becomes 0xffffffea, which is a non-zero value. The caller in rzv2h_rspi_prepare_message() guards against failure with: rspi->freq = rzv2h_rspi_setup_clock(rspi, speed_hz); if (!rspi->freq) return -EINVAL; Because 0xffffffea is non-zero, the check is bypassed and the controller proceeds to program SPBR/SPCMD with stale values, leading to an unknown bit rate. Return 0 on the failed-search path, consistent with the existing clk_set_rate() failure path which already returns 0. Fixes: 77d931584dd3 ("spi: rzv2h-rspi: make transfer clock rate finding chip-specific") Signed-off-by: John Madieu <john.madieu.xa@bp.renesas.com> Reviewed-by: Biju Das <biju.das.jz@bp.renesas.com> Reviewed-by: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com> Link: https://patch.msgid.link/20260425024725.2393632-1-john.madieu.xa@bp.renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-26driver core: Replace dev->dma_coherent with dev_dma_coherent()Douglas Anderson
In C, bitfields are not necessarily safe to modify from multiple threads without locking. Switch "dma_coherent" over to the "flags" field so modifications are safe. Cc: Christoph Hellwig <hch@lst.de> Reviewed-by: Rafael J. Wysocki (Intel) <rafael@kernel.org> Reviewed-by: Danilo Krummrich <dakr@kernel.org> Acked-by: Vinod Koul <vkoul@kernel.org> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Acked-by: Marek Szyprowski <m.szyprowski@samsung.com> Signed-off-by: Douglas Anderson <dianders@chromium.org> Link: https://patch.msgid.link/20260406162231.v5.7.If839f6dde98979fce177f70c6c74689a1904ee76@changeid [ Since all DEV_FLAG_DMA_COHERENT accessors are exposed unconditionally, also drop the CONFIG guards around dev_assign_dma_coherent() in device_initialize() to ensure a correct default value. - Danilo ] Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-04-26driver core: Replace dev->state_synced with dev_state_synced()Douglas Anderson
In C, bitfields are not necessarily safe to modify from multiple threads without locking. Switch "state_synced" over to the "flags" field so modifications are safe. Cc: Saravana Kannan <saravanak@kernel.org> Reviewed-by: Rafael J. Wysocki (Intel) <rafael@kernel.org> Reviewed-by: Danilo Krummrich <dakr@kernel.org> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Acked-by: Marek Szyprowski <m.szyprowski@samsung.com> Signed-off-by: Douglas Anderson <dianders@chromium.org> Link: https://patch.msgid.link/20260406162231.v5.6.Idb4818e1159fef104c7756bfd6e7ba8f374bebcd@changeid Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-04-26driver core: Replace dev->dma_iommu with dev_dma_iommu()Douglas Anderson
In C, bitfields are not necessarily safe to modify from multiple threads without locking. Switch "dma_iommu" over to the "flags" field so modifications are safe. Cc: Leon Romanovsky <leon@kernel.org> Cc: Robin Murphy <robin.murphy@arm.com> Cc: Christoph Hellwig <hch@lst.de> Reviewed-by: Rafael J. Wysocki (Intel) <rafael@kernel.org> Reviewed-by: Danilo Krummrich <dakr@kernel.org> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Acked-by: Marek Szyprowski <m.szyprowski@samsung.com> Signed-off-by: Douglas Anderson <dianders@chromium.org> Link: https://patch.msgid.link/20260406162231.v5.3.Id20d5973cbff542fea290e13177e9423f5d81342@changeid Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-04-26driver core: Replace dev->can_match with dev_can_match()Douglas Anderson
In C, bitfields are not necessarily safe to modify from multiple threads without locking. Switch "can_match" over to the "flags" field so modifications are safe. Cc: Saravana Kannan <saravanak@kernel.org> Reviewed-by: Rafael J. Wysocki (Intel) <rafael@kernel.org> Reviewed-by: Danilo Krummrich <dakr@kernel.org> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Acked-by: Marek Szyprowski <m.szyprowski@samsung.com> Signed-off-by: Douglas Anderson <dianders@chromium.org> Link: https://patch.msgid.link/20260406162231.v5.2.I54b3ae6311ff34ad30227659d91bb109911a4aea@changeid Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-04-26Input: stmfts - fix formatting issuesDmitry Torokhov
Fix a few formatting issues reported by checkpatch. Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-26Input: stmfts - add optional reset GPIO supportPetr Hodina
Add support for an optional "reset-gpios" property. If present, the driver drives the reset line high at probe time and releases it during power-on, after the regulators have been enabled. Signed-off-by: Petr Hodina <petr.hodina@protonmail.com> Co-developed-by: David Heidelberg <david@ixit.cz> Signed-off-by: David Heidelberg <david@ixit.cz> Link: https://patch.msgid.link/20260409-stmfts5-v4-8-64fe62027db5@ixit.cz Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-26Input: stmfts - use client to make future code cleanerPetr Hodina
Make code cleaner, compiler will optimize it away anyway. Preparation for FTM5 support, where more steps are needed. Signed-off-by: Petr Hodina <petr.hodina@protonmail.com> Signed-off-by: David Heidelberg <david@ixit.cz> Link: https://patch.msgid.link/20260409-stmfts5-v4-6-64fe62027db5@ixit.cz Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-26Input: stmfts - disable regulators and disable irq when power on failsDavid Heidelberg
We must power off regulators and ensure that IRQ is disabled when failing at power on phase. Create stmfts_configure function to limit use of goto. Signed-off-by: David Heidelberg <david@ixit.cz> Link: https://patch.msgid.link/20260409-stmfts5-v4-5-64fe62027db5@ixit.cz Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-26Input: stmfts - abstract reading information from the firmwareDavid Heidelberg
Improves readability and makes splitting power on function in following commit easier. Signed-off-by: David Heidelberg <david@ixit.cz> Link: https://patch.msgid.link/20260409-stmfts5-v4-4-64fe62027db5@ixit.cz Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-26Input: stmfts - switch to devm_regulator_bulk_get_constDavid Heidelberg
Switch to devm_regulator_bulk_get_const() to stop setting the supplies list in probe(), and move the regulator_bulk_data struct in static const. Signed-off-by: David Heidelberg <david@ixit.cz> Link: https://patch.msgid.link/20260409-stmfts5-v4-3-64fe62027db5@ixit.cz Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-26Input: stmfts - use dev struct directlyDavid Heidelberg
Makes the code better readable and noticably shorter. Signed-off-by: David Heidelberg <david@ixit.cz> Link: https://patch.msgid.link/20260409-stmfts5-v4-2-64fe62027db5@ixit.cz Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-26Input: stmfts - fix the MODULE_LICENSE() stringDavid Heidelberg
Replace the bogus "GPL v2" with "GPL" as MODULE_LICNSE() string. The value does not declare the module's exact license, but only lets the module loader test whether the module is Free Software or not. See commit bf7fbeeae6db ("module: Cure the MODULE_LICENSE "GPL" vs. "GPL v2" bogosity") in the details of the issue. The fix is to use "GPL" for all modules under any variant of the GPL. Signed-off-by: David Heidelberg <david@ixit.cz> Link: https://patch.msgid.link/20260409-stmfts5-v4-1-64fe62027db5@ixit.cz Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-26Merge tag 'clk-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fix from Stephen Boyd: "One more fix for the merge window to avoid a boot hang on Raspberry Pi 3B by marking the VEC clk critical so that it doesn't get turned off and hang the bus" * tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: bcm: rpi: Mark VEC clock as CLK_IGNORE_UNUSED
2026-04-26Merge tag 'tsm-for-7.1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/devsec/tsm Pull PCIe TSP update from Dan Williams: "A small update for the TSM core. It is arguably a fix and coming in late as I have been offline the past few weeks: - Drop class_create() for the 'tsm' class" * tag 'tsm-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/devsec/tsm: virt: coco: change tsm_class to a const struct
2026-04-26drm/hyperv: use VMBUS_RING_SIZE()Hamza Mahfooz
VMBUS ring buffers must be page aligned. So, use VMBUS_RING_SIZE() to ensure they are always aligned and large enough to hold all of the relevant data. Cc: stable@kernel.vger.org Fixes: 76c56a5affeb ("drm/hyperv: Add DRM driver for hyperv synthetic video device") Signed-off-by: Hamza Mahfooz <hamzamahfooz@linux.microsoft.com> Reviewed-by: Saurabh Sengar <ssengar@linux.microsoft.com> Link: https://patch.msgid.link/20260425181719.1538483-2-hamzamahfooz@linux.microsoft.com
2026-04-26drm/edid: add CTA Video Format Data Block supportHamza Mahfooz
Video Format Data Blocks (VFDBs) contain the necessary information that needs to be fed to the Optimized Video Timings (OVT) Algorithm. Also, we require OVT support to cover modes that aren't supported by earlier standards (e.g. CVT). So, parse all of the relevant VFDB data and feed it to the OVT Algorithm, to extract all of the missing OVT modes. Suggested-by: Karol Herbst <kherbst@redhat.com> Signed-off-by: Hamza Mahfooz <someguy@effective-light.com> Link: https://patch.msgid.link/20260225175709.408010-1-someguy@effective-light.com
2026-04-25Merge tag 'rtc-7.1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux Pull RTC updates from Alexandre Belloni: "Subsystem: - add data_race() in rtc_dev_poll() Drivers: - remove i2c_match_id usage - abx80x: Disable alarm feature if no interrupt attached - ti-k3: support resuming from IO DDR low power mode" * tag 'rtc-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: rtc: abx80x: Disable alarm feature if no interrupt attached rtc: ntxec: fix OF node reference imbalance rtc: pic32: allow driver to be compiled with COMPILE_TEST rtc: ti-k3: Add support to resume from IO DDR low power mode rtc: cmos: Use platform_get_irq_optional() in cmos_platform_probe() dt-bindings: rtc: add olpc,xo1-rtc to trivial-rtc dt-bindings: rtc: sc2731: Add compatible for SC2730 rtc: add data_race() in rtc_dev_poll() rtc: armada38x: zalloc + calloc to single allocation dt-bindings: rtc: isl12026: convert to YAML schema dt-bindings: rtc: microcrystal,rv3028: Allow to specify vdd-supply rtc: max77686: convert to i2c_new_ancillary_device dt-bindings: rtc: mpfs-rtc: permit resets rtc: rx8025: Remove use of i2c_match_id() rtc: rv8803: Remove use of i2c_match_id() rtc: rs5c372: Remove use of i2c_match_id() rtc: pcf2127: Remove use of i2c_match_id() rtc: m41t80: Remove use of i2c_match_id() rtc: abx80x: Remove use of i2c_match_id()
2026-04-25Merge tag 'for-next-tpm-7.1-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull tpm updates from Jarkko Sakkinen: "Here are the accumulated fixes for 7.1-rc1 and a single structural change worth mentioning separately: Rafael's commit converting tpm_crb from ACPI driver to a platform driver" * tag 'for-next-tpm-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: tpm: tpm_tis: stop transmit if retries are exhausted tpm: tpm_tis: add error logging for data transfer tpm: avoid -Wunused-but-set-variable tpm: Use kfree_sensitive() to free auth session in tpm_dev_release() tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public() tpm: Fix auth session leak in tpm2_get_random() error path tpm: i2c: atmel: fix block comment formatting tpm_crb: Convert ACPI driver to a platform one tpm: Make tcpci_pm_ops variable static const
2026-04-25clk: bcm: rpi: Mark VEC clock as CLK_IGNORE_UNUSEDMaíra Canal
On Raspberry Pi 3B, the VEC clock is used by the VideoCore firmware display driver, which remains active until the vc4 driver loads and sends NOTIFY_DISPLAY_DONE. If this clock is disabled during boot, a bus lockup happens and the firmware becomes unresponsive, causing a complete system lockup. Mark the VEC clock with CLK_IGNORE_UNUSED so it survives the unused clock disablement and remains available until the vc4 driver takes over display management. Fixes: 672299736af6 ("clk: bcm: rpi: Manage clock rate in prepare/unprepare callbacks") Reported-by: Mark Brown <broonie@kernel.org> Closes: https://lore.kernel.org/r/5f0bec08-f458-4fba-8bf3-06817a100c4c@sirena.org.uk Signed-off-by: Maíra Canal <mcanal@igalia.com> Link: https://patch.msgid.link/20260401111416.562279-2-mcanal@igalia.com Tested-by: Mark Brown <broonie@kernel.org> Signed-off-by: Mark Brown <broonie@kernel.org> Acked-by: Brian Masney <bmasney@redhat.com> # Active contributor to clk Reviewed-by: Stefan Wahren <wahrenst@gmx.net> Signed-off-by: Stephen Boyd <sboyd@kernel.org>
2026-04-25Merge tag 'fbdev-for-7.1-rc1-2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev Pull fbdev fixes from Helge Deller: - request memory region before use (cobalt_lcdfb, clps711x-fb, hgafb) - reference cleanups in failure path (offb, savage) - a spelling fix (atyfb) * tag 'fbdev-for-7.1-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: fbdev: hgafb: Request memory region before ioremap fbdev: clps711x-fb: Request memory region for MMIO fbdev: cobalt_lcdfb: Request memory region fbdev: atyfb: Fix spelling mistake "enfore" -> "enforce" fbdev: savage: fix probe-path EDID cleanup leaks fbdev: offb: fix PCI device reference leak on probe failure
2026-04-24bpf: use accessor functions for bpf_reg_state min/max fieldsEduard Zingerman
Replace direct access to bpf_reg_state->{smin,smax,umin,umax, s32_min,s32_max,u32_min,u32_max}_value with getter/setter inline functions, preparing for future switch to cnum-based internal representation. Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/r/20260424-cnums-everywhere-rfc-v1-v3-2-ca434b39a486@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>