summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2025-08-13HID: asus: fix UAF via HID_CLAIMED_INPUT validationQasim Ijaz
After hid_hw_start() is called hidinput_connect() will eventually be called to set up the device with the input layer since the HID_CONNECT_DEFAULT connect mask is used. During hidinput_connect() all input and output reports are processed and corresponding hid_inputs are allocated and configured via hidinput_configure_usages(). This process involves slot tagging report fields and configuring usages by setting relevant bits in the capability bitmaps. However it is possible that the capability bitmaps are not set at all leading to the subsequent hidinput_has_been_populated() check to fail leading to the freeing of the hid_input and the underlying input device. This becomes problematic because a malicious HID device like a ASUS ROG N-Key keyboard can trigger the above scenario via a specially crafted descriptor which then leads to a user-after-free when the name of the freed input device is written to later on after hid_hw_start(). Below, report 93 intentionally utilises the HID_UP_UNDEFINED Usage Page which is skipped during usage configuration, leading to the frees. 0x05, 0x0D, // Usage Page (Digitizer) 0x09, 0x05, // Usage (Touch Pad) 0xA1, 0x01, // Collection (Application) 0x85, 0x0D, // Report ID (13) 0x06, 0x00, 0xFF, // Usage Page (Vendor Defined 0xFF00) 0x09, 0xC5, // Usage (0xC5) 0x15, 0x00, // Logical Minimum (0) 0x26, 0xFF, 0x00, // Logical Maximum (255) 0x75, 0x08, // Report Size (8) 0x95, 0x04, // Report Count (4) 0xB1, 0x02, // Feature (Data,Var,Abs) 0x85, 0x5D, // Report ID (93) 0x06, 0x00, 0x00, // Usage Page (Undefined) 0x09, 0x01, // Usage (0x01) 0x15, 0x00, // Logical Minimum (0) 0x26, 0xFF, 0x00, // Logical Maximum (255) 0x75, 0x08, // Report Size (8) 0x95, 0x1B, // Report Count (27) 0x81, 0x02, // Input (Data,Var,Abs) 0xC0, // End Collection Below is the KASAN splat after triggering the UAF: [ 21.672709] ================================================================== [ 21.673700] BUG: KASAN: slab-use-after-free in asus_probe+0xeeb/0xf80 [ 21.673700] Write of size 8 at addr ffff88810a0ac000 by task kworker/1:2/54 [ 21.673700] [ 21.673700] CPU: 1 UID: 0 PID: 54 Comm: kworker/1:2 Not tainted 6.16.0-rc4-g9773391cf4dd-dirty #36 PREEMPT(voluntary) [ 21.673700] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 21.673700] Call Trace: [ 21.673700] <TASK> [ 21.673700] dump_stack_lvl+0x5f/0x80 [ 21.673700] print_report+0xd1/0x660 [ 21.673700] kasan_report+0xe5/0x120 [ 21.673700] __asan_report_store8_noabort+0x1b/0x30 [ 21.673700] asus_probe+0xeeb/0xf80 [ 21.673700] hid_device_probe+0x2ee/0x700 [ 21.673700] really_probe+0x1c6/0x6b0 [ 21.673700] __driver_probe_device+0x24f/0x310 [ 21.673700] driver_probe_device+0x4e/0x220 [...] [ 21.673700] [ 21.673700] Allocated by task 54: [ 21.673700] kasan_save_stack+0x3d/0x60 [ 21.673700] kasan_save_track+0x18/0x40 [ 21.673700] kasan_save_alloc_info+0x3b/0x50 [ 21.673700] __kasan_kmalloc+0x9c/0xa0 [ 21.673700] __kmalloc_cache_noprof+0x139/0x340 [ 21.673700] input_allocate_device+0x44/0x370 [ 21.673700] hidinput_connect+0xcb6/0x2630 [ 21.673700] hid_connect+0xf74/0x1d60 [ 21.673700] hid_hw_start+0x8c/0x110 [ 21.673700] asus_probe+0x5a3/0xf80 [ 21.673700] hid_device_probe+0x2ee/0x700 [ 21.673700] really_probe+0x1c6/0x6b0 [ 21.673700] __driver_probe_device+0x24f/0x310 [ 21.673700] driver_probe_device+0x4e/0x220 [...] [ 21.673700] [ 21.673700] Freed by task 54: [ 21.673700] kasan_save_stack+0x3d/0x60 [ 21.673700] kasan_save_track+0x18/0x40 [ 21.673700] kasan_save_free_info+0x3f/0x60 [ 21.673700] __kasan_slab_free+0x3c/0x50 [ 21.673700] kfree+0xcf/0x350 [ 21.673700] input_dev_release+0xab/0xd0 [ 21.673700] device_release+0x9f/0x220 [ 21.673700] kobject_put+0x12b/0x220 [ 21.673700] put_device+0x12/0x20 [ 21.673700] input_free_device+0x4c/0xb0 [ 21.673700] hidinput_connect+0x1862/0x2630 [ 21.673700] hid_connect+0xf74/0x1d60 [ 21.673700] hid_hw_start+0x8c/0x110 [ 21.673700] asus_probe+0x5a3/0xf80 [ 21.673700] hid_device_probe+0x2ee/0x700 [ 21.673700] really_probe+0x1c6/0x6b0 [ 21.673700] __driver_probe_device+0x24f/0x310 [ 21.673700] driver_probe_device+0x4e/0x220 [...] Fixes: 9ce12d8be12c ("HID: asus: Add i2c touchpad support") Cc: stable@vger.kernel.org Signed-off-by: Qasim Ijaz <qasdev00@gmail.com> Link: https://patch.msgid.link/20250810181041.44874-1-qasdev00@gmail.com Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
2025-08-13hid: fix I2C read buffer overflow in raw_event() for mcp2221Arnaud Lecomte
As reported by syzbot, mcp2221_raw_event lacked validation of incoming I2C read data sizes, risking buffer overflows in mcp->rxbuf during multi-part transfers. As highlighted in the DS20005565B spec, p44, we have: "The number of read-back data bytes to follow in this packet: from 0 to a maximum of 60 bytes of read-back bytes." This patch enforces we don't exceed this limit. Reported-by: syzbot+52c1a7d3e5b361ccd346@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=52c1a7d3e5b361ccd346 Tested-by: syzbot+52c1a7d3e5b361ccd346@syzkaller.appspotmail.com Signed-off-by: Arnaud Lecomte <contact@arnaud-lcm.com> Link: https://patch.msgid.link/20250726220931.7126-1-contact@arnaud-lcm.com Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
2025-08-13drm/i915/display: Optimize panel power-on wait timeDibin Moolakadan Subrahmanian
The current wait_panel_status() uses intel_de_wait(), which internally on Xe platforms calls xe_mmio_wait32(). xe_mmio_wait32() increases poll interval exponentially. This exponential poll interval increase causes unnessory delays during resume or power-on when the panel becomes ready earlier, but polling is delayed due to backoff. Replace intel_de_wait() with read_poll_timeout() + intel_de_read() to actively poll the register at a fixed 10ms interval up to a 5 second timeout. This allows poll to exit early when panel is ready. Changes in v2: Replaced two-phase intel_de_wait() with read_poll_timeout() + intel_de_read() Changes in v3: - Add poll_interval_ms argument 'wait_panel_status' function. - Modify 'wait_panel_status' callers with proper poll interval Changes in v4: - Change 'wait_panel_off' poll interval to 10ms Changes in v5: - Dropped poll_interval_ms parameter,use fixed polling interval of 10ms (Jani Nikula) Changes in v6: - Removed goto in error path Signed-off-by: Dibin Moolakadan Subrahmanian <dibin.moolakadan.subrahmanian@intel.com> Link: https://lore.kernel.org/r/20250807082402.79018-1-dibin.moolakadan.subrahmanian@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2025-08-13drm/tidss: Remove early fbTomi Valkeinen
Add a call to drm_aperture_remove_framebuffers() to drop the possible early fb (simplefb). Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Link: https://lore.kernel.org/r/20250416-tidss-splash-v1-2-4ff396eb5008@ideasonboard.com Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
2025-08-13thunderbolt: Use Linux Foundation IDs for XDomain discoveryMika Westerberg
There are other vendors now that have their own USB4 host router hardware so using the Intel donated IDs may confuse users. For this reason switch to use USB IDs provided by the Linux Foundation for XDomain discovery. Link: https://lore.kernel.org/linux-usb/20250722175026.1994846-1-Raju.Rangoju@amd.com/ Cc: Raju Rangoju <Raju.Rangoju@amd.com> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>> Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
2025-08-13drm/tidss: remove redundant assignment to variable retColin Ian King
The assignment of zero to variable is redundant as the following continue statement loops back to the start of the loop where ret is assigned a new value from the return to the call to get_parent_dss_vp. Remove assignment. Signed-off-by: Colin Ian King <colin.i.king@gmail.com> Link: https://lore.kernel.org/r/20250702084844.966199-1-colin.i.king@gmail.com Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
2025-08-13drm/tidss: Set crtc modesetting parameters with adjusted modeJayesh Choudhary
TIDSS uses crtc_* fields to propagate its registers and set the clock rates. So set the CRTC modesetting timing parameters with the adjusted mode when needed, to set correct values. Cc: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> Signed-off-by: Jayesh Choudhary <j-choudhary@ti.com> Link: https://lore.kernel.org/r/20250624080402.302526-1-j-choudhary@ti.com Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
2025-08-13memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probeZhen Ni
The of_platform_populate() call at the end of the function has a possible failure path, causing a resource leak. Replace of_iomap() with devm_platform_ioremap_resource() to ensure automatic cleanup of srom->reg_base. This issue was detected by smatch static analysis: drivers/memory/samsung/exynos-srom.c:155 exynos_srom_probe()warn: 'srom->reg_base' from of_iomap() not released on lines: 155. Fixes: 8ac2266d8831 ("memory: samsung: exynos-srom: Add support for bank configuration") Cc: stable@vger.kernel.org Signed-off-by: Zhen Ni <zhen.ni@easystack.cn> Link: https://lore.kernel.org/r/20250806025538.306593-1-zhen.ni@easystack.cn Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
2025-08-13gpio: aggregator: Fix off by one in gpiochip_fwd_desc_add()Dan Carpenter
The "> chip->ngpio" comparison here needs to be ">= chip->ngpio", otherwise it leads to an out of bounds access. The fwd->valid_mask bitmap only has chip->ngpio bits and the fwd->descs[] array has that same number of elements. These values are set in devm_gpiochip_fwd_alloc(). Fixes: c44ce91b8ada ("gpio: aggregator: refactor the code to add GPIO desc in the forwarder") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://lore.kernel.org/r/aJwk0yBSCccGCjX3@stanley.mountain Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
2025-08-13drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURSTTomi Valkeinen
While the cdns-dsi does not support DSI burst mode, the burst mode is essentially DSI event mode with more versatile clocking and timings. Thus cdns-dsi doesn't need to fail if the DSI peripheral driver requests MIPI_DSI_MODE_VIDEO_BURST. In my particular use case, this allows the use of ti-sn65dsi83 driver. Tested-by: Parth Pancholi <parth.pancholi@toradex.com> Tested-by: Jayesh Choudhary <j-choudhary@ti.com> Reviewed-by: Devarsh Thakkar <devarsht@ti.com> Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-15-e61cc06074c2@ideasonboard.com Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
2025-08-13drm/bridge: cdns-dsi: Tune adjusted_mode->clock according to dsi needsTomi Valkeinen
The driver currently expects the pixel clock and the HS clock to be compatible, but the DPHY PLL doesn't give very finely grained rates. This often leads to the situation where the pipeline just fails, as the resulting HS clock is just too off. We could change the driver to do a better job on adjusting the DSI blanking values, hopefully getting a working pipeline even if the pclk and HS clocks are not exactly compatible. But that is a bigger work. What we can do easily is to see in .atomic_check() what HS clock rate we can get, based on the pixel clock rate, and then convert the HS clock rate back to pixel clock rate and ask that rate from the crtc. If the crtc has a good PLL (which is the case for TI K3 SoCs), this will fix any issues wrt. the clock rates. If the crtc cannot provide the requested clock, well, we're no worse off with this patch than what we have at the moment. Tested-by: Parth Pancholi <parth.pancholi@toradex.com> Tested-by: Jayesh Choudhary <j-choudhary@ti.com> Reviewed-by: Devarsh Thakkar <devarsht@ti.com> Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-14-e61cc06074c2@ideasonboard.com Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
2025-08-13drm/bridge: cdns-dsi: Fix event modeTomi Valkeinen
The timings calculation gets it wrong for DSI event mode, resulting in too large hbp value. Fix the issue by taking into account the pulse/event mode difference. Tested-by: Parth Pancholi <parth.pancholi@toradex.com> Reviewed-by: Jayesh Choudhary <j-choudhary@ti.com> Tested-by: Jayesh Choudhary <j-choudhary@ti.com> Reviewed-by: Devarsh Thakkar <devarsht@ti.com> Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-13-e61cc06074c2@ideasonboard.com Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
2025-08-13drm/bridge: cdns-dsi: Use video mode and clean up cdns_dsi_mode2cfg()Tomi Valkeinen
The driver does all the calculations and programming with video timings (hftp, hbp, etc.) instead of the modeline values (hsync_start, ...). Thus it makes sense to use struct videomode instead of struct drm_display_mode internally. Switch to videomode and do some cleanups in cdns_dsi_mode2cfg() along the way. Tested-by: Parth Pancholi <parth.pancholi@toradex.com> Reviewed-by: Aradhya Bhatia <aradhya.bhatia@linux.dev> Tested-by: Jayesh Choudhary <j-choudhary@ti.com> Reviewed-by: Devarsh Thakkar <devarsht@ti.com> Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-12-e61cc06074c2@ideasonboard.com Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
2025-08-13drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME valueTomi Valkeinen
The driver tries to calculate the value for REG_WAKEUP_TIME. However, the calculation itself is not correct, and to add on it, the resulting value is almost always larger than the field's size, so the actual result is more or less random. According to the docs, figuring out the value for REG_WAKEUP_TIME requires HW characterization and there's no way to have a generic algorithm to come up with the value. That doesn't help at all... However, we know that the value must be smaller than the line time, and, at least in my understanding, the proper value for it is quite small. Testing shows that setting it to 1/10 of the line time seems to work well. All video modes from my HDMI monitor work with this algorithm. Hopefully we'll get more information on how to calculate the value, and we can then update this. Tested-by: Parth Pancholi <parth.pancholi@toradex.com> Tested-by: Jayesh Choudhary <j-choudhary@ti.com> Reviewed-by: Devarsh Thakkar <devarsht@ti.com> Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-11-e61cc06074c2@ideasonboard.com Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
2025-08-13drm/bridge: cdns-dsi: Adjust mode to negative syncsTomi Valkeinen
The Cadence DSI requires negative syncs from the incoming video signal, but at the moment that requirement is not expressed in any way. If the crtc decides to use positive syncs, things break down. Use the adjusted_mode in atomic_check to set the sync flags to negative ones. Reviewed-by: Aradhya Bhatia <aradhya.bhatia@linux.dev> Tested-by: Parth Pancholi <parth.pancholi@toradex.com> Tested-by: Jayesh Choudhary <j-choudhary@ti.com> Reviewed-by: Devarsh Thakkar <devarsht@ti.com> Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-10-e61cc06074c2@ideasonboard.com Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
2025-08-13drm/bridge: cdns-dsi: Drop cdns_dsi_adjust_phy_config()Tomi Valkeinen
cdns_dsi_adjust_phy_config() is called from cdns_dsi_check_conf(), which is called from .atomic_check(). It checks the DSI htotal and adjusts it to align on the DSI lane boundary by changing hfp and then recalculating htotal and HS clock rate. This has a few problems. First is the fact that the whole thing is not needed: we do not need to align on the lane boundary. The whole frame is sent in HS mode, and it is fine if the line's last byte clock tick fills, say, only 2 of the 4 lanes. The next line will just continue from there. Assuming the DSI timing values have been calculated to match the incoming DPI stream, and the HS clock is compatible with the DPI pixel clock, the "uneven" DSI lines will even out when multiple lines are being sent. But we could do the align, aligning is not a problem as such. However, adding more bytes to the hfp, as the function currently does, makes the DSI line time longer, so the function then adjusts the HS clock rate. This is where things fail: we don't know what rates we can get from the HS clock, and at least in TI K3 SoC case the rates are quite coarsely grained. Thus small adjustment to hfp will lead to a big change in HS clock rate, and things break down. We could do a loop here, adjusting hfp, adjusting clock, checking clock rate, adjusting hfp again, etc., but considering that the whole adjustment shouldn't be needed at all, it's easier to just remove the function. Something like this function should be added back later, when adding burst mode support, but that's a bigger change and I don't think this function would help that work in any way. Tested-by: Parth Pancholi <parth.pancholi@toradex.com> Tested-by: Jayesh Choudhary <j-choudhary@ti.com> Reviewed-by: Devarsh Thakkar <devarsht@ti.com> Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-9-e61cc06074c2@ideasonboard.com Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
2025-08-13drm/bridge: cdns-dsi: Update htotal in cdns_dsi_mode2cfg()Tomi Valkeinen
cdns_dsi_mode2cfg() calculates the dsi timings, but for some reason doesn't set the htotal based on those timings. It is set only later, in cdns_dsi_adjust_phy_config(). As cdns_dsi_mode2cfg() is the logical place to calculate it, let's move it there. Especially as the following patch will remove cdns_dsi_adjust_phy_config(). Reviewed-by: Aradhya Bhatia <aradhya.bhatia@linux.dev> Tested-by: Parth Pancholi <parth.pancholi@toradex.com> Tested-by: Jayesh Choudhary <j-choudhary@ti.com> Reviewed-by: Devarsh Thakkar <devarsht@ti.com> Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-8-e61cc06074c2@ideasonboard.com Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
2025-08-13drm/bridge: cdns-dsi: Drop checks that shouldn't be in .mode_valid()Tomi Valkeinen
The docs say about mode_valid(): "it is not allowed to look at anything else but the passed-in mode, and validate it against configuration-invariant hardware constraints" We're doing a lot more than just looking at the mode. The main issue here is that we're doing checks based on the pixel clock, before we know what the pixel clock from the crtc actually is. So, drop the cdns_dsi_check_conf() call from .mode_valid(). Reviewed-by: Aradhya Bhatia <aradhya.bhatia@linux.dev> Tested-by: Parth Pancholi <parth.pancholi@toradex.com> Tested-by: Jayesh Choudhary <j-choudhary@ti.com> Reviewed-by: Devarsh Thakkar <devarsht@ti.com> Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-7-e61cc06074c2@ideasonboard.com Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
2025-08-13drm/bridge: cdns-dsi: Remove broken fifo emptying checkTomi Valkeinen
The driver checks if "DPI(HFP) > DSI(HSS+HSA+HSE+HBP)", and rejects the mode if not. However, testing shows that this doesn't hold at all. I can set the hfp to very small values, with no errors. The feedback from the HW team also was that the check is not right, although it's not clear if there's a way to validate the FIFO emptying. The check rejects quite a lot of modes, apparently for no good reason, so drop the check. Tested-by: Parth Pancholi <parth.pancholi@toradex.com> Tested-by: Jayesh Choudhary <j-choudhary@ti.com> Reviewed-by: Devarsh Thakkar <devarsht@ti.com> Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-6-e61cc06074c2@ideasonboard.com Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
2025-08-13drm/bridge: cdns-dsi: Drop crtc_* codeTomi Valkeinen
With recent change the cdns_dsi_check_conf() is always called with mode_valid_check = true. We can thus remove all the code related to the "false" paths. Tested-by: Parth Pancholi <parth.pancholi@toradex.com> Tested-by: Jayesh Choudhary <j-choudhary@ti.com> Reviewed-by: Devarsh Thakkar <devarsht@ti.com> Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-5-e61cc06074c2@ideasonboard.com Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
2025-08-13drm/bridge: cdns-dsi: Remove extra line at the end of the fileTomi Valkeinen
Remove extra line at the end of the file. Reviewed-by: Aradhya Bhatia <aradhya.bhatia@linux.dev> Tested-by: Parth Pancholi <parth.pancholi@toradex.com> Tested-by: Jayesh Choudhary <j-choudhary@ti.com> Reviewed-by: Devarsh Thakkar <devarsht@ti.com> Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-4-e61cc06074c2@ideasonboard.com Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
2025-08-13drm/tidss: Use the crtc_* timings when programming the HWTomi Valkeinen
Use the crtc_* fields from drm_display_mode, instead of the "logical" fields. This shouldn't change anything in practice, but afaiu the crtc_* fields are the correct ones to use here. Reviewed-by: Aradhya Bhatia <aradhya.bhatia@linux.dev> Tested-by: Parth Pancholi <parth.pancholi@toradex.com> Tested-by: Jayesh Choudhary <j-choudhary@ti.com> Reviewed-by: Devarsh Thakkar <devarsht@ti.com> Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-3-e61cc06074c2@ideasonboard.com Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
2025-08-13drm/tidss: Fix missing includes and struct declsTomi Valkeinen
Fix missing includes and struct declarations. Even if these don't cause any compile issues at the moment, it's good to have them correct. Reviewed-by: Aradhya Bhatia <aradhya.bhatia@linux.dev> Tested-by: Parth Pancholi <parth.pancholi@toradex.com> Tested-by: Jayesh Choudhary <j-choudhary@ti.com> Reviewed-by: Devarsh Thakkar <devarsht@ti.com> Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-2-e61cc06074c2@ideasonboard.com Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
2025-08-13drm/bridge: cdns-dsi: Fix the _atomic_check()Aradhya Bhatia
Use the "adjusted_mode" for the dsi configuration check, as that is the more appropriate display_mode for validation, and later bridge enable. Also, fix the mode_valid_check parameter from false to true, as the dsi configuration check is taking place during the check-phase, and the crtc_* mode values are not expected to be populated yet. Fixes: a53d987756ea ("drm/bridge: cdns-dsi: Move DSI mode check to _atomic_check()") Signed-off-by: Aradhya Bhatia <aradhya.bhatia@linux.dev> Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> Tested-by: Jayesh Choudhary <j-choudhary@ti.com> Reviewed-by: Devarsh Thakkar <devarsht@ti.com> Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-1-e61cc06074c2@ideasonboard.com Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
2025-08-13block: switch ->getgeo() to struct gendiskAl Viro
Instances are happier that way and it makes more sense anyway - the only part of the result that is related to partition we are given is the start sector, and that has been filled in by the caller. Everything else is a function of the disk. Only one instance (DASD) is ever looking at anything other than bdev->bd_disk and that one is trivial to adjust. Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Acked-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2025-08-13scsi: switch ->bios_param() to passing gendiskAl Viro
Instances are passed struct block_device *bdev argument; the only thing it is used for (if it's used in the first place) is bdev->bd_disk. Might as well pass that in the first place... Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Acked-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2025-08-13scsi: switch scsi_bios_ptable() and scsi_partsize() to gendiskAl Viro
Both helpers are reading the partition table of the disk specified by block_device of some partition on it; result depends only upon the disk in question, so we might as well pass the struct gendisk instead. Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Acked-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2025-08-13phy: qualcomm: phy-qcom-eusb2-repeater: Add support for PMIV0104Luca Weiss
Add support for the eUSB2 repeater found on the PMIV0104. There is no default init table for this PMIC, just the board-specific tuning parameters are used on top of the default tuning values. Reviewed-by: Abel Vesa <abel.vesa@linaro.org> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Signed-off-by: Luca Weiss <luca.weiss@fairphone.com> Link: https://lore.kernel.org/r/20250709-sm7635-eusb-repeater-v2-4-b6eff075c097@fairphone.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-08-13phy: qualcomm: phy-qcom-eusb2-repeater: Support tune-res-fsdif propLuca Weiss
Support reading the FS Differential TX Output Resistance Tuning from devicetree and writing the register, as required on some boards. Reviewed-by: Abel Vesa <abel.vesa@linaro.org> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Signed-off-by: Luca Weiss <luca.weiss@fairphone.com> Link: https://lore.kernel.org/r/20250709-sm7635-eusb-repeater-v2-2-b6eff075c097@fairphone.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-08-13phy: ti: omap-control: drop unused module aliasJohan Hovold
Since commit 4fd06af96b93 ("usb: phy: omap-control: Get rid of platform data") the driver only supports OF probe so drop the unused platform module alias. Signed-off-by: Johan Hovold <johan@kernel.org> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Link: https://lore.kernel.org/r/20250724154823.15998-12-johan@kernel.org Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-08-13phy: ti: dm816x-usb: drop unused module aliasJohan Hovold
The driver has never supported anything but OF probe so drop the unused platform module alias. Signed-off-by: Johan Hovold <johan@kernel.org> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Link: https://lore.kernel.org/r/20250724154823.15998-11-johan@kernel.org Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-08-13phy: ti: ti-pipe3: drop unused module aliasJohan Hovold
Since commit 918ee0d21ba4 ("usb: phy: omap-usb3: Don't use omap_get_control_dev()") the driver only supports OF probe so drop the unused platform module alias. Signed-off-by: Johan Hovold <johan@kernel.org> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Link: https://lore.kernel.org/r/20250724154823.15998-10-johan@kernel.org Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-08-13phy: ti: omap-usb2: drop unused module aliasJohan Hovold
Since commit 478b6c7436c2 ("usb: phy: omap-usb2: Don't use omap_get_control_dev()") the driver only supports OF probe so drop the unused platform module alias. Signed-off-by: Johan Hovold <johan@kernel.org> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Link: https://lore.kernel.org/r/20250724154823.15998-9-johan@kernel.org Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-08-13phy: samsung: usb2: drop unused module aliasJohan Hovold
The driver has never supported anything but OF probe so drop the unused platform module alias. Signed-off-by: Johan Hovold <johan@kernel.org> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Link: https://lore.kernel.org/r/20250724154823.15998-8-johan@kernel.org Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-08-13phy: samsung: exynos5-usbdrd: drop unused module aliasJohan Hovold
The driver has never supported anything but OF probe so drop the unused platform module alias. Signed-off-by: Johan Hovold <johan@kernel.org> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Link: https://lore.kernel.org/r/20250724154823.15998-7-johan@kernel.org Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-08-13phy: qualcomm: ipq806x-usb: drop unused module aliasJohan Hovold
The driver has never supported anything but OF probe so drop the unused platform module alias. Signed-off-by: Johan Hovold <johan@kernel.org> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Link: https://lore.kernel.org/r/20250724154823.15998-6-johan@kernel.org Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-08-13phy: hisilicon: hi6220-usb: drop unused module aliasJohan Hovold
The driver has never supported anything but OF probe so drop the unused platform module alias. Signed-off-by: Johan Hovold <johan@kernel.org> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Link: https://lore.kernel.org/r/20250724154823.15998-5-johan@kernel.org Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-08-13phy: cadence: Sierra: drop unused module aliasJohan Hovold
The driver has never supported anything but OF probe so drop the unused platform module alias. Signed-off-by: Johan Hovold <johan@kernel.org> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Link: https://lore.kernel.org/r/20250724154823.15998-4-johan@kernel.org Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-08-13phy: broadcom: brcm-usb: drop unused module aliasJohan Hovold
Since commit 9d5f51dcdb64 ("phy: usb: Add support for new Synopsys USB controller on the 7211b0") the driver only supports OF probe so drop the unused platform module alias. Signed-off-by: Johan Hovold <johan@kernel.org> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Link: https://lore.kernel.org/r/20250724154823.15998-3-johan@kernel.org Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-08-13phy: broadcom: brcm-sata: drop unused module aliasJohan Hovold
The driver has never supported anything but OF probe so drop the unused platform module alias. Signed-off-by: Johan Hovold <johan@kernel.org> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Link: https://lore.kernel.org/r/20250724154823.15998-2-johan@kernel.org Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-08-13phy: rockchip: naneng-combphy: Add RK3528 supportYao Zi
Rockchip RK3528 integrates one naneng-combphy that is able to operate in PCIe and USB3 mode. The control logic is similar to previous variants of naneng-combphy but the register layout is apparently different from the RK3568 one. Signed-off-by: Yao Zi <ziyao@disroot.org> Reviewed-by: Heiko Stuebner <heiko@sntech.de> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Link: https://lore.kernel.org/r/20250728102947.38984-7-ziyao@disroot.org Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-08-13phy: rockchip: naneng-combphy: Add SoC prefix to register definitionsYao Zi
All supported variants of naneng-combphy follow a register layout similar to the RK3568 variant with some exceptions of SoC-specific registers. Add RK3568 prefix for the common set of registers and the corresponding SoC prefix for SoC-specific registers, making usage of definitions clear and preparing for future COMBPHY variants with a different register layout. Signed-off-by: Yao Zi <ziyao@disroot.org> Reviewed-by: Heiko Stuebner <heiko@sntech.de> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Link: https://lore.kernel.org/r/20250728102947.38984-6-ziyao@disroot.org Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-08-13phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568Jonas Karlman
The boot firmware may disable the U3 port early during boot and leave it up to the controller or PHY driver to re-enable U3 when needed. The Rockchip USBDP PHY driver currently does this for RK3576 and RK3588, something the Rockchip Naneng Combo PHY driver never does for RK3568. This may result in USB 3.0 ports being limited to only using USB 2.0 or in special cases not working at all on RK3568. Write to PIPE_GRF USB3OTGx_CON1 reg to ensure the U3 port is enabled when a PHY with PHY_TYPE_USB3 mode is used. Fixes: 7160820d742a ("phy: rockchip: add naneng combo phy for RK3568") Signed-off-by: Jonas Karlman <jonas@kwiboo.se> Link: https://lore.kernel.org/r/20250723072324.2246498-1-jonas@kwiboo.se Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-08-13phy: ti: omap-usb2: enable compile testingJohan Hovold
Nothing seems to prevent the driver from being built on non-TI platforms so enable compile testing for wider build coverage. Signed-off-by: Johan Hovold <johan@kernel.org> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Link: https://lore.kernel.org/r/20250724131623.2662-1-johan@kernel.org Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-08-13phy: cadence: cdns-dphy-rx: Add runtime PM supportJai Luthra
Enable runtime power management for the device. The PHY framework handles calling pm_runtime_(get|put)_sync when powering on/off this device. Signed-off-by: Jai Luthra <jai.luthra@ideasonboard.com> Link: https://lore.kernel.org/r/20250224-cdns_phy_pm-v1-1-0fe2c544cc87@ideasonboard.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-08-13phy: cdns-dphy: Remove leftover codeTomi Valkeinen
The code in cdns-dphy has probably been part of a DSI driver in the past. Remove DSI defines and variables which are not used or do not actually do anything. Also rename cdns_dsi_get_dphy_pll_cfg() to cdns_dphy_get_pll_cfg(), i.e. drop the "dsi", as it's not relevant here. Reviewed-by: Aradhya Bhatia <aradhya.bhatia@linux.dev> Tested-by: Parth Pancholi <parth.pancholi@toradex.com> Acked-by: Vinod Koul <vkoul@kernel.org> Tested-by: Jayesh Choudhary <j-choudhary@ti.com> Reviewed-by: Devarsh Thakkar <devarsht@ti.com> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> Link: https://lore.kernel.org/r/20250723-cdns-dphy-hs-clk-rate-fix-v1-2-d4539d44cbe7@ideasonboard.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-08-13phy: cdns-dphy: Store hs_clk_rate and return itTomi Valkeinen
The DPHY driver does not return the actual hs_clk_rate, so the DSI driver has no idea what clock was actually achieved. Set the realized hs_clk_rate to the opts struct, so that the DSI driver gets it back. Reviewed-by: Aradhya Bhatia <aradhya.bhatia@linux.dev> Tested-by: Parth Pancholi <parth.pancholi@toradex.com> Tested-by: Jayesh Choudhary <j-choudhary@ti.com> Acked-by: Vinod Koul <vkoul@kernel.org> Reviewed-by: Devarsh Thakkar <devarsht@ti.com> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> Link: https://lore.kernel.org/r/20250723-cdns-dphy-hs-clk-rate-fix-v1-1-d4539d44cbe7@ideasonboard.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2025-08-13media: staging: Rename second ioctl handlers argument to 'void *priv'Laurent Pinchart
The second argument to the ioctl handlers is not a file handle any more. The standard practice is to name it 'void *priv' in drivers. Many drivers still name it 'void *fh', and a few use more exotic names. Replace those more exotic names with 'void *priv' in all media staging drivers. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-08-13media: v4l2: Rename second ioctl handlers argument to 'void *priv'Laurent Pinchart
The second argument to the ioctl handlers is not a file handle any more. The standard practice is to name it 'void *priv' in drivers. Many drivers still name it 'void *fh', and a few use more exotic names. Replace those more exotic names with 'void *priv' in all media drivers. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Acked-by: Jai Luthra <jai.luthra@linux.dev> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-08-13media: v4l2-core: Rename second ioctl handlers argument to 'void *priv'Laurent Pinchart
The second argument to the ioctl handlers is not a file handle any more. Rename it from 'void *fh' to 'void *priv' in the V4L2 core, to avoid misconceptions. While at it, align function arguments in include/media/v4l2-mem2mem.h. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>