summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2025-10-20drm/rockchip: Return error code for errorsDaniel Stone
Instead of silently disabling small planes, refuse to create them at all. Signed-off-by: Daniel Stone <daniels@collabora.com> Signed-off-by: Heiko Stuebner <heiko@sntech.de> Link: https://lore.kernel.org/r/20251015110042.41273-4-daniels@collabora.com
2025-10-20drm/rockchip: Declare framebuffer width/height boundsDaniel Stone
The VOP2 has limitations on its input and output sizes. The clipped display region must be at least 4px in each dimension for both framebuffer source and plane destination, and the clipped source region must be no greater than a per-version limit. It is never valid for VOP2 to have a framebuffer which is less than four pixels in either dimension, so declare that as our min width/height, enforced by AddFB failing if the user tries. It can theoretically be valid to have a single large framebuffer of which only certain clipped regions are shown, but this is a very uncommon case. Declaring to userspace that the framebuffer's maximum width and height is the maximum source clip helps it make better decisions as to which mode to use, instead of trying unsupported sizes and having to fall back. Signed-off-by: Daniel Stone <daniels@collabora.com> Signed-off-by: Heiko Stuebner <heiko@sntech.de> Link: https://lore.kernel.org/r/20251015110042.41273-3-daniels@collabora.com
2025-10-20drm/rockchip: Demote normal drm_err to debugDaniel Stone
A plane check failing is a normal and expected condition, as userspace isn't aware of the specific constraints and will try any and every combination until one succeeds. Push this down to a debug message, so users can see it if they want to, but make sure we don't spam the log during normal operation. Fixes: 604be85547ce4 ("drm/rockchip: Add VOP2 driver") Signed-off-by: Daniel Stone <daniels@collabora.com> Signed-off-by: Heiko Stuebner <heiko@sntech.de> Link: https://lore.kernel.org/r/20251015110042.41273-2-daniels@collabora.com
2025-10-20dm-verity: use 2-way interleaved SHA-256 hashing when supportedEric Biggers
When the crypto library provides an optimized implementation of sha256_finup_2x(), use it to interleave the hashing of pairs of data blocks. On some CPUs this nearly doubles hashing performance. The increase in overall throughput of cold-cache dm-verity reads that I'm seeing on arm64 and x86_64 is roughly 35% (though this metric is hard to measure as it jumps around a lot). For now this is done only on data blocks, not Merkle tree blocks. We could use sha256_finup_2x() on Merkle tree blocks too, but that is less important as there aren't as many Merkle tree blocks as data blocks, and that would require some additional code restructuring. Signed-off-by: Eric Biggers <ebiggers@kernel.org> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
2025-10-20dm-verity: reduce scope of real and wanted digestsEric Biggers
In preparation for supporting interleaved hashing where dm-verity will need to keep track of the real and wanted digests for multiple data blocks simultaneously, stop using the want_digest and real_digest fields of struct dm_verity_io from so many different places. Specifically: - Make various functions take want_digest as a parameter rather than having it be implicitly passed via the struct dm_verity_io. - Add a new tmp_digest field, and use this instead of real_digest when computing a digest solely for the purpose of immediately checking it. The result is that real_digest and want_digest are used only by verity_verify_io(). Signed-off-by: Eric Biggers <ebiggers@kernel.org> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
2025-10-20dm-verity: use SHA-256 library for SHA-256Eric Biggers
When the hash algorithm is SHA-256 and the verity version is not 0, use the SHA-256 library instead of crypto_shash. This is a prerequisite for making dm-verity interleave the computation of SHA-256 hashes for increased performance. That optimization is available in the SHA-256 library but not in crypto_shash. Even without interleaved hashing, switching to the library also slightly improves performance by itself because it avoids the overhead of crypto_shash, including indirect calls and other API overhead. (Benchmark on x86_64, AMD Zen 5: hashing 4K blocks gets 2.1% faster.) SHA-256 is by far the most common hash algorithm used with dm-verity. It makes sense to optimize for the common case and fall back to the generic crypto layer for uncommon cases, as suggested by Linus: https://lore.kernel.org/r/CAHk-=wgp-fOSsZsYrbyzqCAfEvrt5jQs1jL-97Wc4seMNTUyng@mail.gmail.com Signed-off-by: Eric Biggers <ebiggers@kernel.org> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
2025-10-20dm-verity: remove log message with shash driver nameEric Biggers
I added this log message in commit bbf6a566920e ("dm verity: log the hash algorithm implementation"), to help people debug issues where they forgot to enable the architecture-optimized SHA-256 code in their kconfig or accidentally enabled a slow hardware offload driver (such as QCE) that overrode the faster CPU-accelerated code. However: - The crypto layer now always enables the architecture-optimized SHA-1, SHA-256, and SHA-512 code. Moreover, for simplicity the driver name is now fixed at "sha1-lib", "sha256-lib", etc. - dm-verity now uses crypto_shash instead of crypto_ahash, preventing the mistake of accidentally using a slow driver such as QCE. Therefore, this log message generally no longer provides useful information. Remove it. Signed-off-by: Eric Biggers <ebiggers@kernel.org> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
2025-10-20dm: Fix deadlock when reloading a multipath tableBenjamin Marzinski
Request-based devices (dm-multipath) queue I/O in blk-mq on noflush suspends. Any queued IO will make it impossible to freeze the queue. If a process attempts to update the queue limits while there is queued IO, it can be get stuck holding the limits lock, while unable to freeze the queue. If device-mapper then attempts to update the limits during a table swap, it will deadlock trying to grab the limits lock while making it impossible to flush the IO. Disallow updating the queue limits during a table swap, when updating an immutable request-based dm device (dm-multipath) during a noflush suspend. It is userspace's responsibility to make sure that the new table uses the same limits as the existing table if it asks for a noflush suspend. Signed-off-by: Benjamin Marzinski <bmarzins@redhat.com> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
2025-10-20dm: sysfs: use sysfs_emit() in dm-sysfs.cVivek BalachandharTN
Replace sprintf()+strlen() with sysfs_emit(), the preferred helper for sysfs show() routines. sysfs_emit() returns the number of bytes written, guarantees NUL-termination, and clamps to PAGE_SIZE-1. Reference: Documentation/filesystems/sysfs.rst. No functional change intended. Signed-off-by: Vivek BalachandharTN <vivek.balachandhar@gmail.com> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
2025-10-20dm: remove useless md->nr_zones variableBenjamin Marzinski
md->nr_zones is no longer used for anything. Remove it. Signed-off-by: Benjamin Marzinski <bmarzins@redhat.com> Reviewed-by: Damien Le Moal <dlemoal@kernel.org> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
2025-10-20dm-crypt: use folio_nr_pages() instead of shift operationPedro Demarchi Gomes
folio_nr_pages() is a faster helper function to get the number of pages when NR_PAGES_IN_LARGE_FOLIO is enabled. Signed-off-by: Pedro Demarchi Gomes <pedrodemargomes@gmail.com> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
2025-10-20dm-crypt: Use MD5 library instead of crypto_shashEric Biggers
The lmk IV mode, which dm-crypt supports for Loop-AES compatibility, involves an MD5 computation. Update its implementation to use the MD5 library API instead of crypto_shash. This has many benefits, such as: - Simpler code. Notably, much of the error-handling code is no longer needed, since the library functions can't fail. - Reduced stack usage. crypt_iv_lmk_one() now allocates only 112 bytes on the stack instead of 520 bytes. - The library functions are strongly typed, preventing bugs like https://lore.kernel.org/r/f1625ddc-e82e-4b77-80c2-dc8e45b54848@gmail.com - Slightly improved performance, as the library provides direct access to the MD5 code without unnecessary overhead such as indirect calls. To preserve the existing behavior of lmk support being disabled when the kernel is booted with "fips=1", make crypt_iv_lmk_ctr() check fips_enabled itself. Previously it relied on crypto_alloc_shash("md5") failing. (I don't know for sure that lmk *actually* needs to be disallowed in FIPS mode; this just preserves the existing behavior.) Signed-off-by: Eric Biggers <ebiggers@kernel.org> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Acked-by: Ard Biesheuvel <ardb@kernel.org>
2025-10-20firewire: core: use cleanup function to release cached configuration ROMTakashi Sakamoto
When returning from read_config_rom() function, the allocated buffer and the previous buffer for configuration ROM should be released. The cleanup function is useful in the case. This commit uses the cleanup function to remove goto statements. Link: https://lore.kernel.org/r/20251020115810.92839-1-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
2025-10-20Merge tag 'iwlwifi-fixes-2025-10-19' of ↵Johannes Berg
https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next Miri Korenblit says: ==================== iwlwifi fix avoid use after free ==================== Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-10-20wifi: brcmfmac: fix crash while sending Action Frames in standalone AP ModeGokul Sivakumar
Currently, whenever there is a need to transmit an Action frame, the brcmfmac driver always uses the P2P vif to send the "actframe" IOVAR to firmware. The P2P interfaces were available when wpa_supplicant is managing the wlan interface. However, the P2P interfaces are not created/initialized when only hostapd is managing the wlan interface. And if hostapd receives an ANQP Query REQ Action frame even from an un-associated STA, the brcmfmac driver tries to use an uninitialized P2P vif pointer for sending the IOVAR to firmware. This NULL pointer dereferencing triggers a driver crash. [ 1417.074538] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [...] [ 1417.075188] Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT) [...] [ 1417.075653] Call trace: [ 1417.075662] brcmf_p2p_send_action_frame+0x23c/0xc58 [brcmfmac] [ 1417.075738] brcmf_cfg80211_mgmt_tx+0x304/0x5c0 [brcmfmac] [ 1417.075810] cfg80211_mlme_mgmt_tx+0x1b0/0x428 [cfg80211] [ 1417.076067] nl80211_tx_mgmt+0x238/0x388 [cfg80211] [ 1417.076281] genl_family_rcv_msg_doit+0xe0/0x158 [ 1417.076302] genl_rcv_msg+0x220/0x2a0 [ 1417.076317] netlink_rcv_skb+0x68/0x140 [ 1417.076330] genl_rcv+0x40/0x60 [ 1417.076343] netlink_unicast+0x330/0x3b8 [ 1417.076357] netlink_sendmsg+0x19c/0x3f8 [ 1417.076370] __sock_sendmsg+0x64/0xc0 [ 1417.076391] ____sys_sendmsg+0x268/0x2a0 [ 1417.076408] ___sys_sendmsg+0xb8/0x118 [ 1417.076427] __sys_sendmsg+0x90/0xf8 [ 1417.076445] __arm64_sys_sendmsg+0x2c/0x40 [ 1417.076465] invoke_syscall+0x50/0x120 [ 1417.076486] el0_svc_common.constprop.0+0x48/0xf0 [ 1417.076506] do_el0_svc+0x24/0x38 [ 1417.076525] el0_svc+0x30/0x100 [ 1417.076548] el0t_64_sync_handler+0x100/0x130 [ 1417.076569] el0t_64_sync+0x190/0x198 [ 1417.076589] Code: f9401e80 aa1603e2 f9403be1 5280e483 (f9400000) Fix this, by always using the vif corresponding to the wdev on which the Action frame Transmission request was initiated by the userspace. This way, even if P2P vif is not available, the IOVAR is sent to firmware on AP vif and the ANQP Query RESP Action frame is transmitted without crashing the driver. Move init_completion() for "send_af_done" from brcmf_p2p_create_p2pdev() to brcmf_p2p_attach(). Because the former function would not get executed when only hostapd is managing wlan interface, and it is not safe to do reinit_completion() later in brcmf_p2p_tx_action_frame(), without any prior init_completion(). And in the brcmf_p2p_tx_action_frame() function, the condition check for P2P Presence response frame is not needed, since the wpa_supplicant is properly sending the P2P Presense Response frame on the P2P-GO vif instead of the P2P-Device vif. Cc: stable@vger.kernel.org Fixes: 18e2f61db3b7 ("brcmfmac: P2P action frame tx") Signed-off-by: Gokul Sivakumar <gokulkumar.sivakumar@infineon.com> Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com> Link: https://patch.msgid.link/20251013102819.9727-1-gokulkumar.sivakumar@infineon.com [Cc stable] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-10-20Merge tag 'ath-current-20251006' of ↵Johannes Berg
git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath Jeff Johnson says: ================== ath.git update for v6.18-rc1 Fix memory leaks in both ath10k and ath12k. Fix a sparse issue in ath11k. Allow ath11k suspend/resume to work on more Lenovo laptops. ================== Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-10-20bcma: don't register devices disabled in OFRafał Miłecki
Some bus devices can be marked as disabled for specific SoCs or models. Those should not be registered to avoid probing them. Signed-off-by: Rafał Miłecki <rafal@milecki.pl> Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com> Link: https://patch.msgid.link/20251003125126.27950-1-zajec5@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-10-20Merge tag 'v6.18-rc2' into 'drm-rust-next'Alice Ryhl
When pushing commits to drm-rust-next, we need to verify that the patches pass rustfmt. Thus, pull in v6.18-rc2 for its rustfmt fix. Signed-off-by: Alice Ryhl <aliceryhl@google.com>
2025-10-20panthor: use drm_gpuva_unlink_defer()Alice Ryhl
Instead of manually deferring cleanup of vm_bos, use the new GPUVM infrastructure for doing so. To avoid manual management of vm_bo refcounts, the panthor_vma_link() and panthor_vma_unlink() methods are changed to get and put a vm_bo refcount on the vm_bo. This simplifies the code a lot. I preserved the behavior where panthor_gpuva_sm_step_map() drops the refcount right away rather than letting panthor_vm_cleanup_op_ctx() do it later. Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com> Link: https://lore.kernel.org/r/20251006-vmbo-defer-v4-2-30cbd2c05adb@google.com Signed-off-by: Alice Ryhl <aliceryhl@google.com>
2025-10-20drm/gpuvm: add deferred vm_bo cleanupAlice Ryhl
When using GPUVM in immediate mode, it is necessary to call drm_gpuvm_unlink() from the fence signalling critical path. However, unlink may call drm_gpuvm_bo_put(), which causes some challenges: 1. drm_gpuvm_bo_put() often requires you to take resv locks, which you can't do from the fence signalling critical path. 2. drm_gpuvm_bo_put() calls drm_gem_object_put(), which is often going to be unsafe to call from the fence signalling critical path. To solve these issues, add a deferred version of drm_gpuvm_unlink() that adds the vm_bo to a deferred cleanup list, and then clean it up later. The new methods take the GEMs GPUVA lock internally rather than letting the caller do it because it also needs to perform an operation after releasing the mutex again. This is to prevent freeing the GEM while holding the mutex (more info as comments in the patch). This means that the new methods can only be used with DRM_GPUVM_IMMEDIATE_MODE. Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com> Acked-by: Danilo Krummrich <dakr@kernel.org> Link: https://lore.kernel.org/r/20251006-vmbo-defer-v4-1-30cbd2c05adb@google.com [aliceryhl: fix formatting of vm_bo = llist_entry(...) line] Signed-off-by: Alice Ryhl <aliceryhl@google.com>
2025-10-20gpio: mvebu: Slightly optimize mvebu_gpio_irq_handler()Christophe JAILLET
In the main loop of mvebu_gpio_irq_handler() some calls to irq_find_mapping() can be saved. There is no point to find an irq number before checking if this something has to be done. By testing first, some calls can be saved. Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Link: https://lore.kernel.org/r/7190f5def0489ed3f40435449c86cd7c710e6dd4.1760862679.git.christophe.jaillet@wanadoo.fr Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
2025-10-20clk: renesas: cpg-mssr: Add module reset support for RZ/T2HLad Prabhakar
Add support for module reset handling on the RZ/T2H SoC. Unlike earlier CPG/MSSR variants, RZ/T2H uses a unified set of Module Reset Control Registers (MRCR) where both reset and deassert actions are done via read-modify-write (RMW) to the same register. Introduce a new MRCR offset table (mrcr_for_rzt2h) for RZ/T2H and assign it to reset_regs. For this SoC, the number of resets is based on the number of MRCR registers rather than the number of module clocks. Also add cpg_mrcr_reset_ops to implement reset, assert, and deassert using RMW while holding the spinlock. This follows the RZ/T2H requirements, where processing after releasing a module reset must be secured by performing seven dummy reads of the same register, and where a module that is reset and released again must ensure the target bit in the Module Reset Control Register is set to 1. Update the reset controller registration to select cpg_mrcr_reset_ops for RZ/T2H, while keeping the existing cpg_mssr_reset_ops for other SoCs. Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de> Link: https://patch.msgid.link/20250929112324.3622148-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2025-10-20media: renesas: fdp1: Use %pe format specifierRicardo Ribalda
The %pe format specifier is designed to print error pointers. It prints a symbolic error name (eg. -EINVAL) and it makes the code simpler by omitting PTR_ERR() This patch fixes this cocci report: ./platform/renesas/rcar_fdp1.c:2303:4-11: WARNING: Consider using %pe to print PTR_ERR() Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-10-20gpio: pca953x: clarify log messages about auto increment featureMichael Roth
The probe messages currently print "using AI" and "using no AI", which can be confusing to users unfamiliar with the datasheet term. Clarify these by spelling out "auto increment", which is the meaning of the AI bit described in the register map. No functional change, only clearer log wording and matching comment update. Signed-off-by: Michael Roth <mail@mroth.net> Link: https://lore.kernel.org/r/20251018101404.3630905-1-mail@mroth.net Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
2025-10-20media: allegro: fix race conditions in channel handlingMatthias Fend
Since the channel list is used in different contexts, it must be ensured that it is always consistent. Also, the channels contained in the list may only be released when they are no longer needed in any context. Add a lock to protect the list and reference handling for the channels. Signed-off-by: Matthias Fend <matthias.fend@emfend.at> Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-10-20media: allegro: process all pending status mbox messagesMatthias Fend
Under certain circumstances, not every message written by the MCU to the status mailbox may trigger a corresponding interrupt. This is likely when multiple messages are generated in a very short period of time. Since the current implementation only processes one message per interrupt, even if multiple messages are already available in the mailbox, expected messages are either not received or are processed late. This leads to various subsequent problems and causes the driver to no longer function properly. The behavior has been adjusted so that after an interrupt, all messages available in the mailbox are processed. Signed-off-by: Matthias Fend <matthias.fend@emfend.at> Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-10-20media: allegro: print warning if channel creation timeout occursMatthias Fend
This message can be helpful for troubleshooting and there is already a corresponding message in case of a channel destroy timeout. Add a similar message for channel creation. Signed-off-by: Matthias Fend <matthias.fend@emfend.at> Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-10-20media: v4l2-ctrls: add full AV1 profile validation in validate_av1_sequence()Pavan Bobba
Complete the "TODO: PROFILES" by enforcing profile-specific and monochrome constraints as defined by the AV1 specification (Section 5.5.2, "Color config syntax"). The validator now checks: - Flags: reject any unknown bits set in sequence->flags - Profile range: only profiles 0..2 are valid - Profile 0: 8/10-bit only, subsampling must be 4:2:0 (sx=1, sy=1), monochrome allowed - Profile 1: 8/10-bit only, subsampling must be 4:4:4 (sx=0, sy=0), monochrome forbidden - Profile 2: * 8/10-bit: only 4:2:2 allowed (sx=1, sy=0) * 12-bit: 4:4:4 (sx=0, sy=0), 4:2:2 (sx=1, sy=0), or 4:2:0 (sx=1, sy=1) allowed - Monochrome path (all profiles except 1): forces subsampling_x=1, subsampling_y=1, separate_uv_delta_q=0 These checks prevent userspace from providing invalid AV1 sequence headers that would otherwise be accepted, leading to undefined driver or hardware behavior. Signed-off-by: Pavan Bobba <opensource206@gmail.com> Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-10-20media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init()Haoxiang Li
vpu_get_plat_device() increases the reference count of the returned platform device. However, when devm_kzalloc() fails, the reference is not released, causing a reference leak. Fix this by calling put_device() on fw_pdev->dev before returning on the error path. Fixes: e25a89f743b1 ("media: mtk-vcodec: potential dereference of null pointer") Cc: stable@vger.kernel.org Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Reviewed-by: Tzung-Bi Shih <tzungbi@kernel.org> Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-10-20media: amphion: Cancel message work before releasing the VPU coreMing Qian
To avoid accessing the VPU register after release of the VPU core, cancel the message work and destroy the workqueue that handles the VPU message before release of the VPU core. Fixes: 3cd084519c6f ("media: amphion: add vpu v4l2 m2m support") Cc: stable@vger.kernel.org Signed-off-by: Ming Qian <ming.qian@oss.nxp.com> Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-10-20media: amphion: Remove vpu_vb_is_codecconfigMing Qian
Currently the function vpu_vb_is_codecconfig() always returns 0. Delete it and its related code. Fixes: 3cd084519c6f ("media: amphion: add vpu v4l2 m2m support") Cc: stable@vger.kernel.org Signed-off-by: Ming Qian <ming.qian@oss.nxp.com> Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-10-20media: verisilicon: Protect G2 HEVC decoder against invalid DPB indexNicolas Dufresne
Fix the Hantro G2 HEVC decoder so that we use DPB index 0 whenever a ninvalid index is received from user space. This protects the hardware from doing faulty memory access which then leads to bus errors. To be noted that when a reference is missing, userspace such as GStreamer passes an invalid DPB index of 255. This issue was found by seeking to a CRA picture using GStreamer. The framework is currently missing the code to skip over RASL pictures placed after the CRA. This situation can also occur while doing live streaming over lossy transport. Fixes: cb5dd5a0fa518 ("media: hantro: Introduce G2/HEVC decoder") Cc: stable@vger.kernel.org Reviewed-by: Benjamin Gaignard <benjamin.gaignard@collabora.com> Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-10-20media: verisilicon: Fix CPU stalls on G2 bus errorNicolas Dufresne
In some seek stress tests, we are getting IRQ from the G2 decoder where the dec_bus_int and the dec_e bits are high, meaning the decoder is still running despite the error. Fix this by reworking the IRQ handler to only finish the job once we have reached completion and move the software reset to when our software watchdog triggers. This way, we let the hardware continue on errors when it did not self reset and in worse case scenario the hardware timeout will automatically stop it. The actual error will be fixed in a follow up patch. Fixes: 3385c514ecc5a ("media: hantro: Convert imx8m_vpu_g2_irq to helper") Cc: stable@vger.kernel.org Reviewed-by: Benjamin Gaignard <benjamin.gaignard@collabora.com> Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-10-20media: platform: mtk-mdp3: fix device leaks at probeJohan Hovold
Make sure to drop the references taken when looking up the subsys devices during probe on probe failure (e.g. probe deferral) and on driver unbind. Similarly, drop the SCP device reference after retrieving its platform data during probe to avoid leaking it. Note that holding a reference to a device does not prevent its driver data from going away. Fixes: 61890ccaefaf ("media: platform: mtk-mdp3: add MediaTek MDP3 driver") Cc: stable@vger.kernel.org # 6.1 Cc: Moudy Ho <moudy.ho@mediatek.com> Signed-off-by: Johan Hovold <johan@kernel.org> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-10-20media: mediatek: vcodec: Use spinlock for context list protection lockChen-Yu Tsai
Previously a mutex was added to protect the encoder and decoder context lists from unexpected changes originating from the SCP IP block, causing the context pointer to go invalid, resulting in a NULL pointer dereference in the IPI handler. Turns out on the MT8173, the VPU IPI handler is called from hard IRQ context. This causes a big warning from the scheduler. This was first reported downstream on the ChromeOS kernels, but is also reproducible on mainline using Fluster with the FFmpeg v4l2m2m decoders. Even though the actual capture format is not supported, the affected code paths are triggered. Since this lock just protects the context list and operations on it are very fast, it should be OK to switch to a spinlock. Fixes: 6467cda18c9f ("media: mediatek: vcodec: adding lock to protect decoder context list") Fixes: afaaf3a0f647 ("media: mediatek: vcodec: adding lock to protect encoder context list") Cc: Yunfei Dong <yunfei.dong@mediatek.com> Cc: stable@vger.kernel.org Signed-off-by: Chen-Yu Tsai <wenst@chromium.org> Reviewed-by: Fei Shao <fshao@chromium.org> Reviewed-by: Tomasz Figa <tfiga@chromium.org> Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-10-20clk: samsung: add Exynos ACPM clock driverTudor Ambarus
Add the Exynos ACPM clock driver. It provides support for clocks that are controlled by firmware that implements the ACPM interface. Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org> Reviewed-by: Peter Griffin <peter.griffin@linaro.org> Tested-by: Peter Griffin <peter.griffin@linaro.org> # on gs101-oriole Link: https://patch.msgid.link/20251010-acpm-clk-v6-4-321ee8826fd4@linaro.org Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
2025-10-20firmware: exynos-acpm: register ACPM clocks pdevTudor Ambarus
Register by hand a platform device for the ACPM clocks. The ACPM clocks are not modeled as a DT child of ACPM because: 1/ they don't have their own resources. 2/ they are not a block that can be reused. The clock identifying data is reduced (clock ID, clock name and mailbox channel ID) and may differ from a SoC to another. Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org> Reviewed-by: Peter Griffin <peter.griffin@linaro.org> Tested-by: Peter Griffin <peter.griffin@linaro.org> # on gs101-oriole Link: https://patch.msgid.link/20251010-acpm-clk-v6-3-321ee8826fd4@linaro.org Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
2025-10-20firmware: exynos-acpm: add DVFS protocolTudor Ambarus
Add ACPM DVFS protocol handler. It constructs DVFS messages that the APM firmware can understand. Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org> Reviewed-by: Peter Griffin <peter.griffin@linaro.org> Tested-by: Peter Griffin <peter.griffin@linaro.org> # on gs101-oriole Link: https://patch.msgid.link/20251010-acpm-clk-v6-2-321ee8826fd4@linaro.org Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
2025-10-20thunderbolt: Add support for Intel Wildcat LakeAlan Borzeszkowski
Intel Wildcat Lake derives its Thunderbolt/USB4 controller from Lunar Lake platform. Add Wildcat Lake PCI ID to the driver list of supported devices. Signed-off-by: Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com> Cc: stable@vger.kernel.org Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
2025-10-20thunderbolt: Fix typo in tb_eeprom_ctl_read documentationDominik Karol Piątkowski
Fix presumed copy-paste typo of tb_eeprom_ctl_read documentation referring to tb_eeprom_ctl_write. Signed-off-by: Dominik Karol Piątkowski <dominik.karol.piatkowski@protonmail.com> Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
2025-10-20PCI: sg2042: Fix a reference count issue in sg2042_pcie_remove()Christophe JAILLET
devm_pm_runtime_enable() is used in the probe, so pm_runtime_disable() should not be called explicitly in the remove function. Fixes: 1c72774df028 ("PCI: sg2042: Add Sophgo SG2042 PCIe driver") Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Tested-by: Chen Wang <unicorn_wang@outlook.com> # on Pioneerbox. Acked-by: Chen Wang <unicorn_wang@outlook.com> Link: https://patch.msgid.link/242eca0ff6601de7966a53706e9950fbcb10aac8.1759169586.git.christophe.jaillet@wanadoo.fr
2025-10-20crypto: caam - Add support of paes algorithmMeenakshi Aggarwal
PAES algorithm uses protected key for encryption/decryption operations. Signed-off-by: Gaurav Jain <gaurav.jain@nxp.com> Signed-off-by: Meenakshi Aggarwal <meenakshi.aggarwal@nxp.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-10-20KEYS: trusted: caam based protected keyMeenakshi Aggarwal
- CAAM supports two types of protected keys: -- Plain key encrypted with ECB -- Plain key encrypted with CCM Due to robustness, default encryption used for protected key is CCM. - Generate protected key blob and add it to trusted key payload. This is done as part of sealing operation, which is triggered when below two operations are requested: -- new key generation -- load key, Signed-off-by: Pankaj Gupta <pankaj.gupta@nxp.com> Signed-off-by: Meenakshi Aggarwal <meenakshi.aggarwal@nxp.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-10-20rnull: use `kernel::fmt`Tamir Duberstein
Reduce coupling to implementation details of the formatting machinery by avoiding direct use for `core`'s formatting traits and macros. This backslid in commit d969d504bc13 ("rnull: enable configuration via `configfs`") and commit 34585dc649fb ("rnull: add soft-irq completion support"). Acked-by: Andreas Hindborg <a.hindborg@kernel.org> Signed-off-by: Tamir Duberstein <tamird@gmail.com> Link: https://patch.msgid.link/20251018-cstr-core-v18-5-9378a54385f8@gmail.com Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2025-10-20rust_binder: use `core::ffi::CStr` method namesTamir Duberstein
Prepare for `core::ffi::CStr` taking the place of `kernel::str::CStr` by avoiding methods that only exist on the latter. This backslid in commit eafedbc7c050 ("rust_binder: add Rust Binder driver"). Reviewed-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Tamir Duberstein <tamird@gmail.com> Link: https://patch.msgid.link/20251018-cstr-core-v18-4-9378a54385f8@gmail.com Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2025-10-20rust_binder: use `kernel::fmt`Tamir Duberstein
Reduce coupling to implementation details of the formatting machinery by avoiding direct use for `core`'s formatting traits and macros. This backslid in commit eafedbc7c050 ("rust_binder: add Rust Binder driver"). Reviewed-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Tamir Duberstein <tamird@gmail.com> Link: https://patch.msgid.link/20251018-cstr-core-v18-3-9378a54385f8@gmail.com Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2025-10-20rust_binder: remove trailing commaTamir Duberstein
This prepares for a later commit in which we introduce a custom formatting macro; that macro doesn't handle trailing commas so just remove this one. Reviewed-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Tamir Duberstein <tamird@gmail.com> Link: https://patch.msgid.link/20251018-cstr-core-v18-2-9378a54385f8@gmail.com Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2025-10-19hwmon: (sht3x) Fix error handlingGuenter Roeck
Handling of errors when reading status, temperature, and humidity returns the error number as negative attribute value. Fix it up by returning the error as return value. Fixes: a0ac418c6007c ("hwmon: (sht3x) convert some of sysfs interface to hwmon") Cc: JuenKit Yip <JuenKit_Yip@hotmail.com> Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2025-10-19hwmon: (cgbc-hwmon) Add missing NULL check after devm_kzalloc()Li Qiang
The driver allocates memory for sensor data using devm_kzalloc(), but did not check if the allocation succeeded. In case of memory allocation failure, dereferencing the NULL pointer would lead to a kernel crash. Add a NULL pointer check and return -ENOMEM to handle allocation failure properly. Signed-off-by: Li Qiang <liqiang01@kylinos.cn> Fixes: 08ebc9def79fc ("hwmon: Add Congatec Board Controller monitoring driver") Reviewed-by: Thomas Richard <thomas.richard@bootlin.com> Link: https://lore.kernel.org/r/20251017063414.1557447-1-liqiang01@kylinos.cn Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2025-10-19hwmon: (pmbus/isl68137) Fix child node reference leak on early returnErick Karanja
In the case of an early return, the reference to the child node needs to be released. Use for_each_child_of_node_scoped to fix the issue. Fixes: 3996187f80a0e ("hwmon: (pmbus/isl68137) add support for voltage divider on Vout") Signed-off-by: Erick Karanja <karanja99erick@gmail.com> Link: https://lore.kernel.org/r/20251012181249.359401-1-karanja99erick@gmail.com [groeck: Updated subject/description] Signed-off-by: Guenter Roeck <linux@roeck-us.net>