summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-03-25wifi: iwlwifi: ensure we don't read SAR values past the limitEmmanuel Grumbach
When we fill the SAR values, we read values from the BIOS store in the firmware runtime object and write them into the command that we send to the firmware. We assumed that the size of the firmware command is not longer than the BIOS tables. This has been true until now, but this is not really safe. We will soon have an firmware API change that will increase the size of the table in the command and we want to make sure that we don't have a buffer overrun when we read the firmware runtime object. Add this safety measure. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260319110722.99aaf2df072a.I5942590b81324b17e2a369f0c354cafee0f70ef5@changeid
2026-03-25wifi: iwlwifi: mld: add support for iwl_mcc_allowed_ap_type_cmd v2Emmanuel Grumbach
There is a new version of this command to indicate which AP type in UNII-9 is supported per country. This adds support for a new UEFI table that will include that data to be filled in the new AP type table. Rename the uats_table field in firmware_runtime structure since it includes now the UATS and the new UNEB table coming from UEFI. For the same reason, rename iwl_mld_init_uats. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Reviewed-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260319110722.b839655712c5.I3dfca54bd19d6bd5f7ca385ea63be086ece9c1d0@changeid
2026-03-25wifi: iwlwifi: mvm: replace use of system_wq with system_percpu_wqMarco Crivellari
This patch continues the effort to refactor workqueue APIs, which has begun with the changes introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The point of the refactoring is to eventually alter the default behavior of workqueues to become unbound by default so that their workload placement is optimized by the scheduler. Before that to happen after a careful review and conversion of each individual case, workqueue users must be converted to the better named new workqueues with no intended behaviour changes: system_wq -> system_percpu_wq system_unbound_wq -> system_dfl_wq This way the old obsolete workqueues (system_wq, system_unbound_wq) can be removed in the future. Suggested-by: Tejun Heo <tj@kernel.org> Signed-off-by: Marco Crivellari <marco.crivellari@suse.com> Link: https://patch.msgid.link/20260210143332.206146-4-marco.crivellari@suse.com Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-03-25wifi: iwlwifi: fw: replace use of system_unbound_wq with system_dfl_wqMarco Crivellari
This patch continues the effort to refactor workqueue APIs, which has begun with the changes introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The point of the refactoring is to eventually alter the default behavior of workqueues to become unbound by default so that their workload placement is optimized by the scheduler. Before that to happen after a careful review and conversion of each individual case, workqueue users must be converted to the better named new workqueues with no intended behaviour changes: system_wq -> system_percpu_wq system_unbound_wq -> system_dfl_wq This way the old obsolete workqueues (system_wq, system_unbound_wq) can be removed in the future. Suggested-by: Tejun Heo <tj@kernel.org> Signed-off-by: Marco Crivellari <marco.crivellari@suse.com> Link: https://patch.msgid.link/20251120100850.66192-3-marco.crivellari@suse.com Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-03-25wifi: iwlwifi: replace use of system_unbound_wq with system_dfl_wqMarco Crivellari
This patch continues the effort to refactor workqueue APIs, which has begun with the changes introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The point of the refactoring is to eventually alter the default behavior of workqueues to become unbound by default so that their workload placement is optimized by the scheduler. Before that to happen after a careful review and conversion of each individual case, workqueue users must be converted to the better named new workqueues with no intended behaviour changes: system_wq -> system_percpu_wq system_unbound_wq -> system_dfl_wq This way the old obsolete workqueues (system_wq, system_unbound_wq) can be removed in the future. Suggested-by: Tejun Heo <tj@kernel.org> Signed-off-by: Marco Crivellari <marco.crivellari@suse.com> Link: https://patch.msgid.link/20251120100850.66192-2-marco.crivellari@suse.com Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-03-25media: renesas: vsp1: Initialize format on all padsLaurent Pinchart
The state initialization function vsp1_entity_init_state() incorrectly leaves the last entity pad out when initializing formats due to an off by one error. Fix it. Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> # HiHope RZ/G2M Link: https://patch.msgid.link/20260318235907.831556-14-laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-25media: renesas: vsp1: Implement control eventsLaurent Pinchart
The V4L2 API requires drivers that expose controls to implement control notification events. This is enforced by v4l2-compliance. Add event handling to the VSP1 entities that create controls to fix the compliance failures. Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com> Tested-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> # HiHope RZ/G2M Link: https://patch.msgid.link/20260318235907.831556-13-laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-25media: renesas: vsp1: histo: Fix format settingLaurent Pinchart
The histogram .set_fmt() handler suffers from two problems: - When operating on the source pad, it returns correct information to userspace, but does not store the format in the subdev state. Subsequent calls to .get_fmt(), handled by the vsp1_subdev_get_pad_format() helper, will not return the correct information. - When operating on the sink pad, it uses the vsp1_subdev_set_pad_format(), which propagates the sink format to the source, incorrectly overwriting the fixed source format. The first issue could be fixed by implementing the set format operation with vsp1_subdev_get_pad_format() on the source pad, if it wasn't that .set_fmt() is also used to initialize the subdev state in vsp1_entity_init_state(). The histogram would need a custom .init_state() handler. As the second issue would anyway overwrite the format, and therefore requires a custom .set_fmt() implementation, fix both issues without using the helpers. Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> # HiHope RZ/G2M Link: https://patch.msgid.link/20260318235907.831556-12-laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-25media: renesas: vsp1: histo: Fix size enumerationLaurent Pinchart
The histogram supports size enumeration on the sink pad only, as the source pad outputs a metadata format. The correct error code when enumeration is not supported is -ENOTTY, not -EINVAL. Fix it. Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> # HiHope RZ/G2M Link: https://patch.msgid.link/20260318235907.831556-11-laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-25media: renesas: vsp1: histo: Fix code enumerationLaurent Pinchart
The histogram media bus code enumeration does not check the index when operating on the source pad, resulting in an infinite loop if userspace keeps enumerating code without any loop boundary. Fix it by returning an error for indices larger than 0 as the pad supports a single format. Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> # HiHope RZ/G2M Link: https://patch.msgid.link/20260318235907.831556-10-laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-25media: renesas: vsp1: hsit: Fix size enumerationLaurent Pinchart
The HSIT entity performs format conversion, which leads to incorrect results with the vsp1_subdev_enum_frame_size() helper. Implement a custom .enum_frame_size() handler that correctly validates the media bus code. Size validation is identical to the helper. Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> # HiHope RZ/G2M Link: https://patch.msgid.link/20260318235907.831556-9-laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-25media: renesas: vsp1: brx: Fix format propagationLaurent Pinchart
The format width and height is never propagated to the BRX source pad, leaving its initial configuration invalid. Propagate the whole format from the first sink pad to the source pad instead of only propagating the media bus code. This fixes compliance with the subdev format propagation rules. Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com> Tested-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> # HiHope RZ/G2M Link: https://patch.msgid.link/20260318235907.831556-8-laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-25media: renesas: vsp1: rwpf: Fix media bus code and frame size enumerationLaurent Pinchart
The RWPF can't freely convert between all input and output formats. They support RGB <-> YUV conversion, but HSV formats can't be converted. Fix the media bus code and frame size enumeration to take this into account on the source pad. Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com> Tested-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> # HiHope RZ/G2M Link: https://patch.msgid.link/20260318235907.831556-7-laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-25media: renesas: vsp1: rpf: Fix crop width and height clampingLaurent Pinchart
The vsp1 driver doesn't enforce a minimum value on the RPF crop rectangle width and height. Empty rectangles are accepted, leading to incorrect hardware behaviour. Fix it by adding minimum width and height constraints to the value clamping. Tested-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> # HiHope RZ/G2M Link: https://patch.msgid.link/20260318235907.831556-6-laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-25media: renesas: vsp1: rpf: Fix crop left and top clampingLaurent Pinchart
The RPF doesn't enforces the alignment constraint on the sink pad format, which could have an odd size, possibly down to 1x1. In that case, the upper bounds for the left and top coordinates clamping would become negative, cast to a very large positive value. Incorrect crop rectangle coordinates would then be incorrectly accepted. A second issue can occur when the requested left and top coordinates are negative. They are cast to a large unsigned value, clamped to the maximum. While the calculation will produce valid values for the hardware, this is not compliant with the V4L2 specification that requires values to be adjusted to the closest valid value. Fix both issues by switching to signed clamping, with an explicit minimum to adjust negative values, and adjusting the clamp bounds to avoid negative upper bounds. Tested-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> # HiHope RZ/G2M Link: https://patch.msgid.link/20260318235907.831556-5-laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-25media: renesas: vsp1: Fix code checks in frame size enumerationLaurent Pinchart
The media bus code passed to the .enum_frame_size() operation for the sink pad is required to be supported by the device, but not to match the current format. All entities that use the vsp1_subdev_enum_frame_size() helper, as well as the SRU and UDS entities that implement the operation manually, perform the check incorrectly. Fix the issue by implementing the correct code check in the vsp1_subdev_enum_frame_size(). For the SRU and UDS, to avoid duplicating code, use the vsp1_subdev_enum_frame_size() as a base and override the enumerated size on the source pad with entity-specific constraints. While at it, include the missing <linux/mutex.h> as the code locks mutexes. Tested-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> # HiHope RZ/G2M Link: https://patch.msgid.link/20260318235907.831556-4-laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-25media: renesas: vsp1: Store size limits in vsp1_entityLaurent Pinchart
Most entities use the vsp1_subdev_enum_frame_size() and vsp1_subdev_set_pad_format() helper functions to implement the corresponding subdev operations. Both helpers are given the minimum and maximum sizes supported by the entity as arguments, requiring each entity to implement a wrapper. Replace the function arguments with storing the size limits in the vsp1_entity structure. This allows dropping most of the .enum_frame_size() and .set_fmt() wrappers in entities. Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com> Tested-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> # HiHope RZ/G2M Link: https://patch.msgid.link/20260318235907.831556-3-laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-25media: renesas: vsp1: Store supported media bus codes in vsp1_entityLaurent Pinchart
Most entities use the vsp1_subdev_enum_mbus_code() and vsp1_subdev_set_pad_format() helper functions to implement the corresponding subdev operations. Both helpers are given the list of supported media bus codes as arguments, requiring each entity to implement a wrapper. Replace the function arguments with storing the supported media bus codes in the vsp1_entity structure. This allows dropping most of the .enum_mbus_code() wrappers from entities. Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com> Tested-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> # HiHope RZ/G2M Link: https://patch.msgid.link/20260318235907.831556-2-laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-25mmc: sdhci-of-aspeed: Handle optional controller resetRyan Chen
Get the optional reset line for the ASPEED SD controller during probe by using devm_reset_control_get_optional_exclusive_deasserted(). This allows platforms such as AST2700, which require the SD controller to be taken out of reset before use, to work with the existing driver. Acked-by: Adrian Hunter <adrian.hunter@intel.com> Signed-off-by: Ryan Chen <ryan_chen@aspeedtech.com> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-03-25dt-bindings: mmc: sdhci-of-aspeed: Add AST2700 compatibleRyan Chen
AST2700 SDHCI controller is fully compatible with AST2600. However, it is necessary to take the AST2700 SD controller out of reset, so require the 'resets' property. Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Ryan Chen <ryan_chen@aspeedtech.com> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-03-25media: uvcvideo: Add support for P010 pixel formatOliver Collyer
Add support for the P010 (10-bit Y/UV 4:2:0) pixel format to the uvcvideo driver. This format is exposed by USB capture devices such as the Magewell USB Capture HDMI 4K Pro when capturing HDR10 content. P010 stores 10-bit Y and interleaved UV samples in 16-bit little-endian words, with data in the upper 10 bits and zeros in the lower 6 bits. This requires 2 bytes per sample, so bytesperline is wWidth * 2. V4L2_PIX_FMT_P010 was added to the V4L2 core in commit 5374d8fb75f3 ("media: Add P010 video format"). Based on the community DKMS patch from awawa-dev/P010_for_V4L2. Link: https://github.com/awawa-dev/P010_for_V4L2 Signed-off-by: Oliver Collyer <ovcollyer@mac.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Link: https://patch.msgid.link/20251226065718.95504-1-ovcollyer@mac.com Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-25media: uvcvideo: Add D436 and D555 cameras metadata supportYogev Modlin
Add support for Intel RealSense D436 and D555 depth cameras metadata. These cameras use the D4XX metadata format for transmitting depth and sensor information. The D555 camera uses UVC protocol version 1.5, while the D436 uses an undefined protocol version. Both cameras require the D4XX metadata format flag to properly handle their metadata streams. Signed-off-by: Yogev Modlin <yogev.modlin@realsenseai.com> Reviewed-by: Ricardo Ribalda <ribalda@chromium.org> Link: https://patch.msgid.link/20251026-fix-uvc-v4-2-610eb1329600@realsenseai.com Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-25media: uvcvideo: Change comment to 'Intel RealSense'Yogev Modlin
RealSense branding is now independent of Intel. Update all driver comments referencing "Intel" to "Intel RealSense" to reflect current ownership. No code logic changes. Signed-off-by: Yogev Modlin <yogev.modlin@realsenseai.com> Reviewed-by: Ricardo Ribalda <ribalda@chromium.org> Link: https://patch.msgid.link/20251026-fix-uvc-v4-1-610eb1329600@realsenseai.com Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-25media: uvcvideo: Add a stream backpointer in uvc_video_queueRicardo Ribalda
It is less prone to errors if we add a backpointer to stream from struct uvc_video_queue. Refactor the code. Suggested-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Link: https://patch.msgid.link/20260318202352.1374443-1-ribalda@chromium.org Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-25media: uvcvideo: Allow userspace to increase the meta buffersizeRicardo Ribalda
Now we have the metadata size hardcoded to 10 KiB, this is a value that works fine for bulk cameras or frames with no extra metadata. But not for all usecases. We have seen some cameras that produce more metadata per frame. Eg: Frame 1 captured (Bytes: 11154) Frame 2 captured (Bytes: 11616) Frame 3 captured (Bytes: 11374) Frame 4 captured (Bytes: 11132) Frame 5 captured (Bytes: 11594) Frame 6 captured (Bytes: 11352) Frame 7 captured (Bytes: 11110) Frame 8 captured (Bytes: 11572) Frame 9 captured (Bytes: 11308) When this happens, the driver (correctly) marks the metadata as ERROR. This patch let userspace set bigger buffersize via S_FMT. Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Link: https://patch.msgid.link/20260309-uvc-metadata-dmabuf-v1-3-fc8b87bd29c5@chromium.org Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-25media: uvcvideo: uvc_queue_to_stream(): Support meta queuesRicardo Ribalda
The stream data structure has two queues: the metadata and the data queues, but uvc_queue_to_stream() only supports the data queue. If we pass the metadata queue the function will return an invalid pointer. This patch add a parameter to the function to explicitly tell the function which queue are we using. Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Link: https://patch.msgid.link/20260309-uvc-metadata-dmabuf-v1-2-fc8b87bd29c5@chromium.org Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-25media: uvcvideo: Enable VB2_DMABUF for metadata streamRicardo Ribalda
The UVC driver has two video streams, one for the frames and another one for the metadata. Both streams share most of the codebase, but only the data stream declares support for DMABUF transfer mode. I have tried the DMABUF transfer mode with CONFIG_DMABUF_HEAPS_SYSTEM and the frames looked correct. This patch announces the support for DMABUF for the metadata stream. This is useful for apps/HALs that only want to support DMABUF. Cc: stable@vger.kernel.org Fixes: 088ead2552458 ("media: uvcvideo: Add a metadata device node") Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Link: https://patch.msgid.link/20260309-uvc-metadata-dmabuf-v1-1-fc8b87bd29c5@chromium.org Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-25slab,rcu: disable KVFREE_RCU_BATCHED for strict grace periodJann Horn
Disable CONFIG_KVFREE_RCU_BATCHED in CONFIG_RCU_STRICT_GRACE_PERIOD builds so that kernel fuzzers have an easier time finding use-after-free involving kfree_rcu(). The intent behind CONFIG_RCU_STRICT_GRACE_PERIOD is that RCU should invoke callbacks and free objects as soon as possible (at a large performance cost) so that kernel fuzzers and such have an easier time detecting use-after-free bugs in objects with RCU lifetime. CONFIG_KVFREE_RCU_BATCHED is a performance optimization that queues RCU-freed objects in ways that CONFIG_RCU_STRICT_GRACE_PERIOD can't expedite; for example, the following testcase doesn't trigger a KASAN splat when CONFIG_KVFREE_RCU_BATCHED is enabled: ``` struct foo_struct { struct rcu_head rcu; int a; }; struct foo_struct *foo = kmalloc(sizeof(*foo), GFP_KERNEL | __GFP_NOFAIL | __GFP_ZERO); pr_info("%s: calling kfree_rcu()\n", __func__); kfree_rcu(foo, rcu); msleep(10); pr_info("%s: start UAF access\n", __func__); READ_ONCE(foo->a); pr_info("%s: end UAF access\n", __func__); ``` Signed-off-by: Jann Horn <jannh@google.com> Acked-by: David Rientjes <rientjes@google.com> Reviewed-by: Joel Fernandes <joelagnelf@nvidia.com> Acked-by: Harry Yoo (Oracle) <harry@kernel.org> Link: https://patch.msgid.link/20260324-kasan-kfree-rcu-v1-1-ac58a7a13d03@google.com Signed-off-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
2026-03-25drm/gem: Improve drm_gem_objects_lookup() kerneldocTvrtko Ursulin
Make clear that the returned array has to be free using kvfree(). While at it, fix broken reference to non-existant @objs and allow for more error codes on failure. Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Cc: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> Cc: Sunil Khatri <sunil.khatri@amd.com> Reviewed-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net> Link: https://lore.kernel.org/r/20260316093809.97267-1-tvrtko.ursulin@igalia.com [tursulin: fixup spelling]
2026-03-25drm/msm/dpu: support plane splitting in quad-pipe caseJun Nie
The content of every half of screen is sent out via one interface in dual-DSI case. The content for every interface is blended by a LM pair in quad-pipe case, thus a LM pair should not blend any content that cross the half of screen in this case. Clip plane into pipes per left and right half screen ROI if topology is quad pipe case. The clipped rectangle on every half of screen is futher handled by two pipes if its width exceeds a limit for a single pipe. For non-virtual-plane case, there is always one stage config to serve a LM or LM pair. So the clipping does not occur when interating stages in this case. The plane is mapped to 2 pipes only when width or clock rate exceeds hardware constrain within stage check. Signed-off-by: Jun Nie <jun.nie@linaro.org> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Reviewed-by: Jessica Zhang <jessica.zhang@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/711324/ Link: https://lore.kernel.org/r/20260312-msm-next-quad-pipe-split-v19-3-4ffa2b06c996@linaro.org Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
2026-03-25drm/syncobj: Fix xa_alloc allocation flagsTvrtko Ursulin
The xarray conversion blindly and wrongly replaced idr_alloc with xa_alloc and kept the GFP_NOWAIT. It should have been GFP_KERNEL to account for idr_preload it removed. Fix it. Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Fixes: fec2c3c01f1c ("drm/syncobj: Convert syncobj idr to xarray") Reported-by: Himanshu Girotra <himanshu.girotra@intel.com> Cc: Matthew Brost <matthew.brost@intel.com> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Reviewed-by: Himanshu Girotra <himanshu.girotra@intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net> Link: https://lore.kernel.org/r/20260324111019.22467-1-tvrtko.ursulin@igalia.com
2026-03-25drm/msm/dpu: Defer SSPP allocation until CRTC checkJun Nie
Currently, mapping plane to SSPP occurs during the plane check phase for non-virtual plane case. The SSPP allocation and plane mapping occurs during CRTC check phase for virtual plane case. Defer these SSPP operations until CRTC check stage to unify the 2 cases, and ease later revisement for quad-pipe change. Signed-off-by: Jun Nie <jun.nie@linaro.org> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/711322/ Link: https://lore.kernel.org/r/20260312-msm-next-quad-pipe-split-v19-2-4ffa2b06c996@linaro.org Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
2026-03-25drm/msm/dpu: Extract plane splitting into a dedicated functionJun Nie
dpu_plane_atomic_check_nosspp() currently handles both plane validation and plane splitting. For better simplicity and to facilitate future refactoring, move the splitting logic into its own dedicated function. Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Jun Nie <jun.nie@linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/711319/ Link: https://lore.kernel.org/r/20260312-msm-next-quad-pipe-split-v19-1-4ffa2b06c996@linaro.org Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
2026-03-25drm/msm/dpu: calculate data_width like downstreamAlexander Koskovich
Derive INTF data_width from dce_bytes_per_line rather than timing->width when DSC is enabled. Use DIV_ROUND_UP to avoid rounding errors. Signed-off-by: Alexander Koskovich <akoskovich@pm.me> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Tested-by: Pengyu Luo <mitltlatltl@gmail.com> # Lenovo Legion Y700 Gen4 (SM8750) Patchwork: https://patchwork.freedesktop.org/patch/713333/ Link: https://lore.kernel.org/r/20260322-fix-data-width-calc-v2-1-d5f28136bc4e@pm.me Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
2026-03-25Merge tag 'perf-tools-fixes-for-v7.0-2-2026-03-23' into perf-tools-nextNamhyung Kim
To get the various fixes for v7.0. Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-03-25dma-mapping: add missing `inline` for `dma_free_attrs`Miguel Ojeda
Under an UML build for an upcoming series [1], I got `-Wstatic-in-inline` for `dma_free_attrs`: BINDGEN rust/bindings/bindings_generated.rs - due to target missing In file included from rust/helpers/helpers.c:59: rust/helpers/dma.c:17:2: warning: static function 'dma_free_attrs' is used in an inline function with external linkage [-Wstatic-in-inline] 17 | dma_free_attrs(dev, size, cpu_addr, dma_handle, attrs); | ^ rust/helpers/dma.c:12:1: note: use 'static' to give inline function 'rust_helper_dma_free_attrs' internal linkage 12 | __rust_helper void rust_helper_dma_free_attrs(struct device *dev, size_t size, | ^ | static The issue is that `dma_free_attrs` was not marked `inline` when it was introduced alongside the rest of the stubs. Thus mark it. Fixes: ed6ccf10f24b ("dma-mapping: properly stub out the DMA API for !CONFIG_HAS_DMA") Closes: https://lore.kernel.org/rust-for-linux/20260322194616.89847-1-ojeda@kernel.org/ [1] Signed-off-by: Miguel Ojeda <ojeda@kernel.org> Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com> Link: https://lore.kernel.org/r/20260325015548.70912-1-ojeda@kernel.org
2026-03-25fpga: m10bmc-sec: switch show_canceled_csk() to using sysfs_emit()Yury Norov
Switch show_canceled_csk() to use the proper sysfs_emit("%*pbl"). Reviewed-by: Russ Weight <russ.weight@linux.dev> Suggested-by: Thomas Weißschuh <linux@weissschuh.net> Signed-off-by: Yury Norov <ynorov@nvidia.com> [ Yilun: Remove unnecessary header file ] Reviewed-by: Xu Yilun <yilun.xu@intel.com> Link: https://lore.kernel.org/r/20260303200842.124996-6-ynorov@nvidia.com Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
2026-03-25drm/msm/dpu: drop VBIF index from the struct dpu_hw_vbifDmitry Baryshkov
Since we don't support and don't use VBIF_NRT, VBIF_RT is the only possible VBIF type. To simplify the driver, drop vbif_idx from the VBIF instance structure. As the last users of VBIF_RT and enum dpu_vbif are gone, drop them too. Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/707779/ Link: https://lore.kernel.org/r/20260227-drop-vbif-nrt-v1-7-2b97d0438182@oss.qualcomm.com
2026-03-25drm/msm/dpu: drop VBIF index from the VBIF paramsDmitry Baryshkov
Since we don't support and don't use VBIF_NRT, VBIF_RT is the only possible VBIF type. To simplify the driver, drop vbif_idx from the VBIF parameter structures. Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/707783/ Link: https://lore.kernel.org/r/20260227-drop-vbif-nrt-v1-6-2b97d0438182@oss.qualcomm.com
2026-03-25drm/msm/dpu: drop vbif_idx from WB configurationDmitry Baryshkov
All MDP / DPU implementations except for MSM8996 use VBIF_RT (or the only VBIF) for WB2. Writeback on MSM8996 is not supported (nor planned to be supported). In order to simplify the driver, drop the field form the struct dpu_wb_cfg. Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/707778/ Link: https://lore.kernel.org/r/20260227-drop-vbif-nrt-v1-5-2b97d0438182@oss.qualcomm.com [DB: also handled Eliza platform] Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
2026-03-25drm/msm/dpu: drop VBIF id, base and name from the catalogDmitry Baryshkov
For all the platforms VBIF id is VBIF_RT, the name and base are also fixed. Drop those fields from the catalog. Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/707777/ Link: https://lore.kernel.org/r/20260227-drop-vbif-nrt-v1-4-2b97d0438182@oss.qualcomm.com
2026-03-25drm/msm/dpu: replace VBIF-related array with bare pointersDmitry Baryshkov
As we no longer have multiple VBIF instances, it doesn't make sense to keep VBIF data as arrays. Drop the extra wrapping and keep only a single instance of each of the structures. Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/707776/ Link: https://lore.kernel.org/r/20260227-drop-vbif-nrt-v1-3-2b97d0438182@oss.qualcomm.com
2026-03-25drm/msm/dpu: stop declaring VBIFs as an array in catalogDmitry Baryshkov
The driver handles a single VBIF instance, VBIF_RT. Stop declaring VBIFs as an array in the DPU hardware catalog. Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/707774/ Link: https://lore.kernel.org/r/20260227-drop-vbif-nrt-v1-2-2b97d0438182@oss.qualcomm.com [DB: handled Eliza platform] Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
2026-03-25drm/msm/dpu: drop VBIF_NRT handlingDmitry Baryshkov
The second VBIF instance, VBIF_NRT, is only used for the separate inline rotator block. It is unsupported by the DPU driver and will require a separate driver (or separate instance of the DPU device). The only possible user of VBIF_NRT is writeback on MSM8996, however writeback on that platform is currently unsupported and it's not worth keeping extra complexity for the sake of that single legacy platform. None of the hardware catalogs entries actually declare VBIF_NRT, so it is left in its default state. Stop pretending that DPU driver cares about VBIF_NRT and drop it. Reported-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/707773/ Link: https://lore.kernel.org/r/20260227-drop-vbif-nrt-v1-1-2b97d0438182@oss.qualcomm.com
2026-03-25drm/msm/dsi: fix hdisplay calculation for CMD mode panelPengyu Luo
Commit ac47870fd795 ("drm/msm/dsi: fix hdisplay calculation when programming dsi registers") incorrecly broke hdisplay calculation for CMD mode by specifying incorrect number of bytes per transfer, fix it. Fixes: ac47870fd795 ("drm/msm/dsi: fix hdisplay calculation when programming dsi registers") Signed-off-by: Pengyu Luo <mitltlatltl@gmail.com> Patchwork: https://patchwork.freedesktop.org/patch/709917/ Link: https://lore.kernel.org/r/20260307111250.105772-2-mitltlatltl@gmail.com [DB: fixed commit message] Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
2026-03-25drm/msm/dsi: fix bits_per_pclkPengyu Luo
mipi_dsi_pixel_format_to_bpp return dst bpp not src bpp, dst bpp may not be the uncompressed data size. use src bpc * 3 to get src bpp, this aligns with pclk rate calculation. Fixes: ac47870fd795 ("drm/msm/dsi: fix hdisplay calculation when programming dsi registers") Signed-off-by: Pengyu Luo <mitltlatltl@gmail.com> Patchwork: https://patchwork.freedesktop.org/patch/709916/ Link: https://lore.kernel.org/r/20260307111250.105772-1-mitltlatltl@gmail.com Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
2026-03-25drm/msm/dpu: fix vblank IRQ registration before atomic_mode_setCédric Bellegarde
dpu_encoder_toggle_vblank_for_crtc() can call control_vblank_irq() at any time in response to a userspace vblank request, independently of the atomic commit sequence. If this happens before the encoder's first atomic_mode_set(), irq[INTR_IDX_RDPTR] is still zero. Passing irq_idx=0 to dpu_core_irq_register_callback() is treated as invalid, and DPU_IRQ_REG(0) and DPU_IRQ_BIT(0) produce misleading values of 134217727 and 31 respectively due to unsigned wraparound in the (irq_idx - 1) macros, resulting in the confusing error: [dpu error]invalid IRQ=[134217727, 31] Since irq[INTR_IDX_RDPTR] will be properly populated by atomic_mode_set() and registered by irq_enable() as part of the normal modeset sequence, silently skip the vblank IRQ registration when the index has not yet been initialized. This matches the existing pattern of the master encoder check above it. Signed-off-by: Cédric Bellegarde <cedric.bellegarde@adishatz.org> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/712752/ Link: https://lore.kernel.org/r/20260318171700.394945-1-cedric.bellegarde@adishatz.org Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
2026-03-25drm/msm/dpu: don't try using 2 LMs if only one DSC is availableDmitry Baryshkov
Current topology code will try using 2 LMs with just one DSC, which breaks cases like SC7280 / Fairphone5. Forbid using 2 LMs split in such a case. Fixes: 1ce69c265a53 ("drm/msm/dpu: move resource allocation to CRTC") Reported-by: Luca Weiss <luca.weiss@fairphone.com> Closes: https://lore.kernel.org/r/DH1IKLU0YZYU.2SW4WYO7H3H4R@fairphone.com/ Tested-by: Luca Weiss <luca.weiss@fairphone.com> # qcm6490-fairphone-fp5 Patchwork: https://patchwork.freedesktop.org/patch/712386/ Link: https://lore.kernel.org/r/20260317-fix-3d-dsc-v1-1-88b54f62f659@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
2026-03-25drm/msm/hdmi: Drop redundant 'int' for longsKrzysztof Kozlowski
'long' type is already an integer, so 'int' is redundant. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/711175/ Link: https://lore.kernel.org/r/20260311-drm-msm-hdmi-cleanup-v1-5-c5535245f6de@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
2026-03-25drm/msm/hdmi: Consistently use u32 instead of uint32_tKrzysztof Kozlowski
Linux coding style asks to use kernel types like u32 instead of uint32_t and code already has it in other places, so unify the remaining pieces. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/711172/ Link: https://lore.kernel.org/r/20260311-drm-msm-hdmi-cleanup-v1-4-c5535245f6de@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>