summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-05-20firmware: arm_scmi: Validate Powercap domains before state accessSudeep Holla
Powercap protocol v2 keeps local enable and last-cap state per domain. The v2 enable helpers and disabled-domain cap_set path indexed that state before checking that the supplied domain id was valid. Validate the domain before touching the per-domain state. Link: https://patch.msgid.link/20260517-scmi_fixes-v1-4-d86daec4defd@kernel.org Reviewed-by: Cristian Marussi <cristian.marussi@arm.com> Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
2026-05-20firmware: arm_scmi: Validate SENSOR_UPDATE payload sizeSudeep Holla
SENSOR_UPDATE carries one or more sensor readings after the fixed notification header. The parser derives the expected reading count from the sensor description, but it did not verify that the received payload contains those entries before parsing them. Reject truncated update notifications before reading the variable array. Link: https://patch.msgid.link/20260517-scmi_fixes-v1-3-d86daec4defd@kernel.org Reviewed-by: Cristian Marussi <cristian.marussi@arm.com> Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
2026-05-20firmware: arm_scmi: Validate BASE_ERROR_EVENT payload sizeSudeep Holla
BASE_ERROR_EVENT carries a variable number of message reports, with the count encoded in error_status. The notification parser used that count without checking whether the received payload contained all reported entries. Reject truncated payloads before copying the report array. Link: https://patch.msgid.link/20260517-scmi_fixes-v1-2-d86daec4defd@kernel.org Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
2026-05-20firmware: arm_scmi: Read sensor config as 32-bit valueSudeep Holla
The SENSOR_CONFIG_GET response contains a 32-bit sensor_config field, and the xfer is initialized with a 4-byte RX buffer. Reading it with get_unaligned_le64() can consume bytes past the returned payload. Use get_unaligned_le32() to match the protocol layout and the allocated response size. Fixes: 7b83c5f41088 ("firmware: arm_scmi: Add SCMI v3.0 sensor configuration support") Link: https://patch.msgid.link/20260517-scmi_fixes-v1-1-d86daec4defd@kernel.org Reviewed-by: Cristian Marussi <cristian.marussi@arm.com> Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
2026-05-20drm/imagination: Fix missing argument in pvr_power_fw_{en,dis}able()Javier Martinez Canillas
Commit 42577ba79fbf ("drm/imagination: Rename FW booted to FW initialised") dropped by mistake the last argument of the functions pvr_power_fw_enable() and pvr_power_fw_disable(), leading to the following compile error: CC [M] drivers/gpu/drm/imagination/pvr_power.o drivers/gpu/drm/imagination/pvr_power.c: In function ‘pvr_power_device_suspend’: drivers/gpu/drm/imagination/pvr_power.c:382:23: error: too few arguments to function ‘pvr_power_fw_disable’; expected 3, have 2 382 | err = pvr_power_fw_disable(pvr_dev, false); | ^~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/imagination/pvr_power.c:93:1: note: declared here 93 | pvr_power_fw_disable(struct pvr_device *pvr_dev, bool hard_reset, bool rpm_suspend) | ^~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/imagination/pvr_power.c: In function ‘pvr_power_device_resume’: drivers/gpu/drm/imagination/pvr_power.c:412:23: error: too few arguments to function ‘pvr_power_fw_enable’; expected 2, have 1 412 | err = pvr_power_fw_enable(pvr_dev); | ^~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/imagination/pvr_power.c:122:1: note: declared here 122 | pvr_power_fw_enable(struct pvr_device *pvr_dev, bool rpm_resume) | ^~~~~~~~~~~~~~~~~~~ make[6]: *** [scripts/Makefile.build:289: drivers/gpu/drm/imagination/pvr_power.o] Error 1 make[5]: *** [scripts/Makefile.build:548: drivers/gpu/drm/imagination] Error 2 make[4]: *** [scripts/Makefile.build:548: drivers/gpu/drm] Error 2 make[3]: *** [scripts/Makefile.build:548: drivers/gpu] Error 2 make[2]: *** [scripts/Makefile.build:548: drivers] Error 2 make[1]: *** [/home/javier/devel/linux/Makefile:2141: .] Error 2 make: *** [Makefile:248: __sub-make] Error 2 Fixes: 42577ba79fbf ("drm/imagination: Rename FW booted to FW initialised") Reviewed-by: Brajesh Gupta <brajesh.gupta@imgtec.com> Link: https://patch.msgid.link/20260519131239.1291732-1-javierm@redhat.com Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2026-05-20firmware: smccc: Fix Arm SMCCC SOC_ID name callAndre Przywara
Commit 5f9c23abc477 ("firmware: smccc: Support optional Arm SMCCC SOC_ID name") introduced the SOC_ID name string call, which reports a human readable string describing the SoC, as returned by firmware. The SMCCC spec v1.6 describes this feature as AArch64 only, since we rely on 8 characters to be transmitted per register. Consequently the SMCCC call must use the AArch64 calling convention, which requires bit 30 of the FID to be set. The spec is a bit confusing here, since it mentions that in the parameter description ("2: SoC name (optionally implemented for SMC64 calls, ..."), but still prints the FID explicitly as 0x80000002. But as this FID is using the SMC32 calling convention (correct for the other two calls), it will not match what any SMCCC conformant firmware is expecting, so any call would return NOT_SUPPORTED. Add a 64-bit version of the ARCH_SOC_ID FID macro, and use that for the SoC name version of the call to fix the issue. Fixes: 5f9c23abc477 ("firmware: smccc: Support optional Arm SMCCC SOC_ID name") Signed-off-by: Andre Przywara <andre.przywara@arm.com> Link: https://patch.msgid.link/20250902172053.304911-1-andre.przywara@arm.com Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
2026-05-20riscv: dts: spacemit: fix uboot partition offset on Milk-V JupiterAurelien Jarno
Correct the uboot partition node name to match its actual offset. Fixes: 2829823956f0 ("riscv: dts: spacemit: enable QSPI and add SPI NOR on Milk-V Jupiter") Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> Reviewed-by: Yixun Lan <dlan@kernel.org> Link: https://patch.msgid.link/20260519041458.3287843-6-aurelien@aurel32.net Signed-off-by: Yixun Lan <dlan@kernel.org>
2026-05-20riscv: dts: spacemit: enable SD card support on Milk-V JupiterAurelien Jarno
Add complete SD card controller support with UHS high-speed modes. - Enable sdhci0 controller with 4-bit bus width - Configure card detect GPIO with pull-up - Connect vmmc-supply to buck4 for 3.3V card power - Connect vqmmc-supply to aldo1 for 1.8V/3.3V I/O switching - Add dual pinctrl states for voltage-dependent pin configuration - Support UHS-I SDR25, SDR50, and SDR104 modes - Alias it as mmc1 Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> Reviewed-by: Yixun Lan <dlan@kernel.org> Link: https://patch.msgid.link/20260519041458.3287843-5-aurelien@aurel32.net Signed-off-by: Yixun Lan <dlan@kernel.org>
2026-05-20riscv: dts: spacemit: enable eMMC on Milk-V JupiterAurelien Jarno
The Milk-V Jupiter board has a connector for an eMMC module. Add an entry for it in the device tree and alias it mmc0. Mark the device as non-removable as eMMC modules have no CD pin and are not supposed to be inserted or removed while the system is running. On systems without an eMMC module installed, the kernel emits the following informational message during boot: mmc0: SDHCI controller on d4281000.mmc [d4281000.mmc] using ADMA mmc0: Failed to initialize a non-removable card Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> Reviewed-by: Yixun Lan <dlan@kernel.org> Link: https://patch.msgid.link/20260519041458.3287843-4-aurelien@aurel32.net Signed-off-by: Yixun Lan <dlan@kernel.org>
2026-05-20riscv: dts: spacemit: sort aliases on Milk-V JupiterAurelien Jarno
Before adding more aliases, just sort them. Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> Reviewed-by: Yixun Lan <dlan@kernel.org> Link: https://patch.msgid.link/20260519041458.3287843-3-aurelien@aurel32.net Signed-off-by: Yixun Lan <dlan@kernel.org>
2026-05-20riscv: dts: spacemit: set console baud rate on Milk-V JupiterAurelien Jarno
Because the default console's baud rate is not set, defconfig kernels do not have any serial output on this platform. Set the baud rate to 115200, matching what is used by U-Boot etc on this platform. See-also: 24c12ca43b12c ("dts: spacemit: set console baud rate on bpif3") Fixes: 5b90a3d6092d9 ("riscv: dts: spacemit: Add Milk-V Jupiter board device tree") Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> Reviewed-by: Yixun Lan <dlan@kernel.org> Link: https://patch.msgid.link/20260519041458.3287843-2-aurelien@aurel32.net Signed-off-by: Yixun Lan <dlan@kernel.org>
2026-05-20staging: media: atomisp: improve cleanup robustness in ↵Jose A. Perez de Azpillaga
ia_css_stream_destroy_isp2401() Remove the 'assert(entry)' call. In the atomisp driver, assert() is a wrapper around BUG(), which intentionally crashes the entire kernel. This is dangerous and inappropriate for a simple null pointer check during stream teardown. Replace it with a safe 'if (!entry) continue;' check. Change the early 'return' to a 'continue'. In a destruction path, it is better to proceed with cleaning up as many resources as possible rather than aborting early, which would result in memory leaks for the remaining pipes. Signed-off-by: Jose A. Perez de Azpillaga <azpijr@gmail.com> Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20staging: media: atomisp: extract ISP2401 cleanup into helper functionJose A. Perez de Azpillaga
To reduce indentation and improve the readability of ia_css_stream_destroy(), extract the ISP2401-specific cleanup block into a new static helper function, ia_css_stream_destroy_isp2401(). Signed-off-by: Jose A. Perez de Azpillaga <azpijr@gmail.com> Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20staging: media: atomisp: fix loop shadowing in ia_css_stream_destroy()Jose A. Perez de Azpillaga
The nested loop inside the IS_ISP2401 block incorrectly uses the same variable 'i' as the outer loop. This shadows the outer loop variable and causes premature termination or skipped array elements. Change the inner loop to use a new variable 'j' to prevent this. Fixes: 113401c67386 ("media: atomisp: sh_css: Removed #ifdef ISP2401 to make code generic") Signed-off-by: Jose A. Perez de Azpillaga <azpijr@gmail.com> Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20staging: media: atomisp: use umin() for strscpy size argumentsMichael Ugrin
Replace open-coded ternary min expressions with umin() in strscpy() calls, as suggested by Dan Carpenter. Signed-off-by: Michael Ugrin <mugrinphoto@gmail.com> Reviewed-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20media: atomisp: avoid ACPI package count underflow in gmin_cfg_get_dsmMohamad El Harake
gmin_cfg_get_dsm() iterates over ACPI _DSM package elements as key/value pairs using obj->package.count - 1 as the loop bound. If package.count is 0, the subtraction underflows and may lead to out-of-bounds access. Use i + 1 < obj->package.count instead. Signed-off-by: Mohamad El Harake <mohamedharake2006@gmail.com> Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20media: atomisp: remove redundant call to ia_css_output0_configure()Jose A. Perez de Azpillaga
The function configure_isp_from_args() contained a duplicate call to ia_css_output0_configure() using the same output frame index. Remove the redundant call to simplify the configuration path. The ia_css_output0_configure() function acts as a configuration setter. It populates a struct ia_css_output0_configuration from the frame info and caches it in the binary parameters. Calling it twice with the same out_frame[0] pointer merely overwrites the exact same state with identical values. It has no cumulative state, neither does its order matter relative to ia_css_copy_output_configure(). ia_css_configure_output0() writes into binary->mem_params.params[], a software-side DMEM parameter buffer in kernel memory. The ISP firmware receives these parameters later as a batch, not at the time of the call. Calling a pure memory write twice with the same pointer and same value simply overwrites the same location with identical data, there is no hardware interaction that could require repetition. Signed-off-by: Jose A. Perez de Azpillaga <azpijr@gmail.com> Reviewed-by: Andy Shevchenko <andy@kernel.org> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20media: atomisp: gate ref and tnr frame config behind ISP enable flagsJose A. Perez de Azpillaga
The FIXME comment noted that delay_frames can be NULL for certain pipeline configurations, without knowing why. The reason is that when a binary does not enable ref_frame, delay frame allocation is intentionally skipped to save memory, leaving the pointers NULL by design. The ISP feature flags in binary->info->sp.enable accurately reflect which features are active for a given binary. Using enable.ref_frame and enable.tnr as the predicate for their respective configuration steps ensures the configuration path stays in sync with what was actually built into the pipeline Signed-off-by: Jose A. Perez de Azpillaga <azpijr@gmail.com> Reviewed-by: Andy Shevchenko <andy@kernel.org> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20staging: media: atomisp: pci: fix split GP_TIMER_BASE declarationAnushka Badhe
Merge declaration of const GP_TIMER_BASE split across 2 lines to improve readability. Signed-off-by: Anushka Badhe <anushkabadhe@gmail.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20staging: media: atomisp: replace uint32_t with u32Abinash Singh
Replace usage of uint32_t with u32 to comply with kernel coding style guidelines. Reported by checkpatch.pl. CHECK: Prefer kernel type 'u32' over 'uint32_t' Signed-off-by: Abinash Singh <abinashsinghlalotra@gmail.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20media: atomisp: gc2235: fix UAF and memory leakYuho Choi
gc2235_probe() handles its error paths incorrectly. If media_entity_pads_init() fails, gc2235_remove() is called, which tears down the subdev and frees dev, but then still falls through to atomisp_register_i2c_module(). This results in use-after-free. If atomisp_register_i2c_module() fails, the media entity and control handler are left initialized and dev is leaked. gc2235_remove() unconditionally calls media_entity_cleanup() and v4l2_ctrl_handler_free(), but these are not initialized at every error path in gc2235_probe(). Replace gc2235_remove() calls in the probe error paths with explicit unwind labels that free only the resources initialized at each point of failure, in reverse order of initialization. Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2") Signed-off-by: Yuho Choi <dbgh9129@gmail.com> Reviewed-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20media: atomisp: replace ia_css_region with v4l2_rectKarthikey Kadati
The struct ia_css_region definition is redundant as struct v4l2_rect provides the same functionality (left, top, width, height) and is the standard V4L2 type. Replace usage of ia_css_region with v4l2_rect in ia_css_dz_config and remove the definition of ia_css_region from ia_css_types.h. Also remove historical comments referencing the addition of zoom_region and include <linux/videodev2.h> to support the v4l2_rect type. Signed-off-by: Karthikey Kadati <karthikey3608@gmail.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20media: atomisp: Fix block comment coding style in sh_css_param_shading.cMahad Ibrahim
Fix checkpatch.pl warnings in sh_css_param_shading.c regarding block comment formatting. The warning was: - Block comments use a trailing */ on a separate line This change also moves text from the first line of block comments to subsequent lines to adhere to the standard Linux kernel coding style. Signed-off-by: Mahad Ibrahim <mahad.ibrahim.dev@gmail.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20media: atomisp: Convert comments to kernel-docMahad Ibrahim
Existing comments in mmu_public.h used Doxygen syntax and had inconsistent formatting. Convert the function documentation to the standard kernel-doc format to adhere to the Linux kernel coding style. Signed-off-by: Mahad Ibrahim <mahad.ibrahim.dev@gmail.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20media: atomisp: Fix erroneous parameter descriptionsMahad Ibrahim
The function mmu_get_page_table_base_index() accepts only one argument mmu_ID_t, the block comment for it shows an erroneous additional argument base_index[in]. Similarly, mmu_reg_load() only accepts two arguments, however the block comment explaining it shows an erroneous argument 'value[in]'. Remove incorrect documentation lines. Signed-off-by: Mahad Ibrahim <mahad.ibrahim.dev@gmail.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20media: atomisp: Fix block comment coding styleMahad Ibrahim
Fix checkpatch.pl warnings regarding block comments. Add missing asterisks to block comments to adhere to the kernel coding style. Signed-off-by: Mahad Ibrahim <mahad.ibrahim.dev@gmail.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20media: atomisp: Fix function signature alignmentMahad Ibrahim
Fix checkpatch.pl warnings regarding lines ending with "(" and improper spacing for indentation. This change fixes the function signatures for both function prototypes and static inline function definations in mmu_public.h. The kernel coding style prefers arguments to start immediately after the open parenthesis. Signed-off-by: Mahad Ibrahim <mahad.ibrahim.dev@gmail.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20media: atomisp: Remove redundant return statementMahad Ibrahim
The function mmu_reg_store() returns void. The final return statement is redundant as it is followed by the closing brace. Remove the redundant return statement to simplify code and adhere to kernel coding style. Signed-off-by: Mahad Ibrahim <mahad.ibrahim.dev@gmail.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20media: atomisp: Fix alloc_pages_bulk() failed errorsHans de Goede
Systems with the atomisp ISP do not have a lot of memory for modern standards, so these are often under memory pressure and alloc_pages_bulk() does not try very hard to free pages before returning an amount of pages which is less then requested. This leads to streaming from the camera often failing with a "alloc_pages_bulk() failed" error. vmalloc() also uses alloc_pages_bulk(), but falls back to allocating one page at a time when that fails. Do the same in alloc_private_pages() to avoid these errors. While at it also drop the weird custom GFP flags and just use GFP_KERNEL and drop the dev_err() as alloc_pages() already complaints loudly if it fails itself. Closes: https://github.com/jfwells/linux-asus-t100ta/issues/4 Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20media: atomisp: Fix memory leak in atomisp_fixed_pattern_table()Zilin Guan
atomisp_v4l2_framebuffer_to_css_frame() allocates memory for temporary variable raw_black_frame, which must be released via ia_css_frame_free() before the function returns. However, if sh_css_set_black_frame() fails, the function returns immediately without performing this cleanup, leading to a memory leak. Fix this by assigning the return value of sh_css_set_black_frame() to ret. This ensures that the error code is propagated while allowing the execution to fall through to the ia_css_frame_free() cleanup call. The bug was originally detected on v6.13-rc1 using an experimental static analysis tool we are developing, and we have verified that the issue persists in the latest mainline kernel. The tool is based on the LLVM framework and is specifically designed to detect memory management issues. It is currently under active development and not yet publicly available. We performed build testing on x86_64 with allyesconfig. Since triggering this error path in atomisp requires specific Intel Atom ISP hardware and firmware, we were unable to perform runtime testing and instead verified the fix according to the code logic. Fixes: 85b606e02ad7 ("media: atomisp: get rid of a bunch of other wrappers") Signed-off-by: Zilin Guan <zilin@seu.edu.cn> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20staging: media: atomisp: fix block comment style in atomisp_cmd.cEthan Lam
Fix block comment style warnings reported by checkpatch.pl in atomisp_cmd.c. Signed-off-by: Ethan Lam <ethanlxkernel@gmail.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20media: staging: atomisp: Remove unnecessary return statement in void functionTomasz Unger
Remove redundant 'return;' at the end of void function ia_css_dvs_statistics_get(). Void functions do not need an explicit return statement at the end. No other occurrences in this file. Found with checkpatch.pl --strict. Signed-off-by: Tomasz Unger <tomasz.unger@yahoo.pl> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20staging: media: atomisp: Kill OP_std_modadd() macroAndy Shevchenko
The OP_std_modadd() adds no value, kill it and update the users to perform the necessary operations themselves. No intended functional changes. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Reviewed-by: Ethan Tidmore <ethantidmore06@gmail.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20staging: media: atomisp: Fix typos and formatting in headersHamdan Khan
Update block and inline comments to follow kernel commenting conventions, fix typos and wording, remove redundant comments and reformat long comments for clarity and line length consistency. Although some comments used the /** ... */ style, they are not kernel-doc comments and are converted to normal comment style. No functional changes are intended. Signed-off-by: Hamdan Khan <hamdankhan212@gmail.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20staging: media: atomisp: Fix braces on incorrect linesMatt Wardle
Fix checkpatch.pl errors: ERROR: that open brace { should be on the previous line Signed-off-by: Matt Wardle <matt@mattwardle.net> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20staging: media: atomisp: Fix function indentation and bracesMatt Wardle
Fix parameter indentation for functions and move opening braces onto new line. Fix checkpatch.pl errors: ERROR: open brace '{' following function definitions go on the next line Signed-off-by: Matt Wardle <matt@mattwardle.net> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20staging: media: atomisp: Remove braces for single statement blocksMatt Wardle
Fix checkpatch.pl warnings: WARNING: braces {} are not necessary for single statement blocks WARNING: braces {} are not necessary for any arm of this statement Signed-off-by: Matt Wardle <matt@mattwardle.net> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20staging: media: atomisp: replace sprintf() with strscpy()Tomasz Unger
Auditing calls to sprintf(). This code is fine because we are copying 9 characters into a 52 character buffer. But it would be cleaner to use strscpy() instead. Additionally, the 2-argument version of strscpy() checks at compile time that dst is an array, not just a pointer. This is the only sprintf() call in the whole driver. Signed-off-by: Tomasz Unger <tomasz.unger@yahoo.pl> Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20staging: media: atomisp: Fix spelling mistakes in commentsTomasz Unger
Fix various spelling mistakes found by codespell: - aviod => avoid - corrent => correct - stablization => stabilization - addtional => additional - facor => factor - steams => streams Signed-off-by: Tomasz Unger <tomasz.unger@yahoo.pl> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20Revert "drm/i915/backlight: Remove try_vesa_interface"Suraj Kandpal
This reverts commit 40d2f5820951dee818d05c14677277048bd85f9f. Removing the try_vesa_interface gate caused a backlight regression on panels whose VBT correctly reports INTEL_BACKLIGHT_DISPLAY_DDI and whose PWM path is the actual backlight control, but whose DPCD optimistically advertises DP_EDP_BACKLIGHT_AUX_ENABLE_CAP / _BRIGHTNESS_AUX_SET_CAP. After the commit such panels silently bind to the VESA AUX backlight funcs; AUX writes complete but the panel ignores them, leaving brightness stuck (no-op backlight). Observed on at least KBL and TGL eDP setups. Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com> Reviewed-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Link: https://patch.msgid.link/20260517024709.1016121-1-suraj.kandpal@intel.com
2026-05-20riscv: dts: spacemit: enable USB3 on OrangePi R2SChukun Pan
Enable the DWC3 USB3.0 controller and its associated PHY on the OrangePi R2S. The USB regulator provides VBUS for USB2 and USB3 ports, but the USB2 ports are handled by a separate controller. Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn> Reviewed-by: Yixun Lan <dlan@kernel.org> Link: https://patch.msgid.link/20260518100030.2354606-1-amadeus@jmu.edu.cn Signed-off-by: Yixun Lan <dlan@kernel.org>
2026-05-20cpufreq: cppc: mask Desired_Excursion when autonomous selection is enabledXueqin Luo
According to the ACPI 6.6 specification, the Desired_Excursion field is not utilized when autonomous selection is enabled. In this mode, the bit is architecturally ignored and does not carry meaningful information. Currently, the kernel exposes the raw Performance Limited register value to userspace through the cpufreq sysfs interface. This may lead to misinterpretation, as userspace may assume Desired_Excursion is valid even when autonomous selection is active. To provide a stable and semantically correct ABI, mask out the Desired_Excursion bit when autonomous selection is enabled, so that userspace does not observe undefined or misleading values. Writes are left unchanged, as the field is architecturally ignored in this mode and write attempts are harmless. Signed-off-by: Xueqin Luo <luoxueqin@kylinos.cn> Reviewed-by: Pierre Gondois <pierre.gondois@arm.com> Reviewed-by: Sumit Gupta <sumitg@nvidia.com> Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
2026-05-20riscv: dts: spacemit: Add thermal sensor for K1 SoCShuwei Wu
Include the Thermal Sensor node in the SpacemiT K1 dtsi with definitions for registers, clocks, and interrupts. Additionally, configure thermal zones for the soc, package, gpu, and clusters to enable temperature monitoring via the thermal framework. Tested-by: Vincent Legoll <legoll@online.fr> # OrangePi-RV2 Tested-by: Gong Shuai <gsh517025@gmail.com> Signed-off-by: Shuwei Wu <shuwei.wu@mailbox.org> Reviewed-by: Yixun Lan <dlan@kernel.org> Link: https://patch.msgid.link/20260427-k1-thermal-v5-3-df39187480ed@mailbox.org Signed-off-by: Yixun Lan <dlan@kernel.org>
2026-05-20riscv: dts: spacemit: Add PDMA controller node for K3 SoCTroy Mitchell
Add the Peripheral DMA (PDMA) controller node for the SpacemiT K3 SoC. The PDMA controller provides general-purpose DMA capabilities for various peripheral devices across the system to offload CPU data transfers. Unlike the previous K1 SoC, where some DMA masters had memory addressing limitations (e.g. restricted to the 0-4GB space) requiring a dedicated dma-bus with dma-ranges to restrict memory allocations, the K3 DMA masters have full memory addressing capabilities. Therefore, the PDMA node is now instantiated directly under the main soc bus. Signed-off-by: Troy Mitchell <troy.mitchell@linux.spacemit.com> Link: https://patch.msgid.link/20260518-k3-pdma-v6-4-67fdf319a8f8@linux.spacemit.com Signed-off-by: Yixun Lan <dlan@kernel.org>
2026-05-20OPP: of: Fix potential memory leak in opp_parse_supplies()Abdun Nihaal
The memory allocated for microvolt, microamp and microwatt is not freed in one of the paths in opp_parse_supplies() which returns directly. Fix that by adding a goto to the error unwind ladder. Fixes: 2eedf62e66c2 ("OPP: decouple dt properties in opp_parse_supplies()") Cc: stable@vger.kernel.org Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in> Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
2026-05-20s390/processor: Implement cpu_relax() with cpu serializationHeiko Carstens
There are many loops in the form of while (READ_ONCE(*somelocation)) cpu_relax(); Strictly speaking the architecture requires serialization instead of only a compiler barrier in the loop so the READ_ONCE() will see an updated value. However real hardware does not require this (see IBM z Systems Processor Optimization Primer - FAQ [1]), but it is still recommended to add serialization. Given that cpu_relax() is doing nothing useful, it does not hurt to add the single and fast instruction which makes sure that serialization happens, and such loops may be left a bit faster. [1] https://community.ibm.com/community/user/viewdocument/microprocessor-optimization-primer Reviewed-by: Alexander Gordeev <agordeev@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
2026-05-20s390/processor: Remove duplicated cpu_relax() defineHeiko Carstens
cpu_relax() is defined identically at two different locations. Just like most other architectures remove the implementation at asm/processor.h and only use the one at asm/vdso/processor.h, avoiding code duplication. Reviewed-by: Alexander Gordeev <agordeev@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
2026-05-20s390/barrier: Use alternative instead of ifdef for bcr_serialize()Heiko Carstens
Use an alternative to implement bcr_serialize() and use alternative patching to select between serialization and fast-serialization depending on the corresponding facility bit. Reviewed-by: Jan Polensky <japo@linux.ibm.com> Reviewed-by: Alexander Gordeev <agordeev@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
2026-05-20s390/mm: Map empty zero pages read-onlyHeiko Carstens
On arm64 the empty zero page is going to be mapped read-only [1]. Do the same for s390 with an explicit set_memory_ro() call. [1] https://lore.kernel.org/all/20260427153416.2103979-19-ardb+git@google.com/ Suggested-by: Christian Borntraeger <borntraeger@linux.ibm.com> Acked-by: Alexander Gordeev <agordeev@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
2026-05-20Revert "i915: don't use a vma that didn't match the context VM"Joonas Lahtinen
This reverts commit 5401b9adebc9e5f68df58226f51493ef0e6ceb4d. Superseded by a13edf9b92fc ("drm/i915/gem: Drop check for changed VM in EXECBUF"). Else block is now no-op. Link: https://lore.kernel.org/intel-gfx/CAHk-=whfUM8y3PoFfT21+guKWK-mJmAE=8uLzOT+7HGv5NtqSw@mail.gmail.com/ Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Ville Syrjälä <ville.syrjala@linux.intel.com> Cc: Tvrtko Ursulin <tursulin@ursulin.net> Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Link: https://patch.msgid.link/20260518092941.47247-1-joonas.lahtinen@linux.intel.com