Commit Graph

10601 Commits

Author SHA1 Message Date
Linus Torvalds
67f1f9b38c more fbdev fixes and cleanups for 7.4-rc1:
- atmel_lcdfb: avoid issues due to empty modelist in probe
 - simplify the console-blanking interface
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQS86RI+GtKfB8BJu973ErUQojoPXwUCauPGHgAKCRD3ErUQojoP
 X4RCAQCTCxRJoIZk1ovnehNblN0rZSg698nhUMpO1pwiAIrVUAEAqj27FNzv7L2p
 EBbqEONGzDXNw3QTp0g6hm5q87N0Agk=
 =Wvpv
 -----END PGP SIGNATURE-----

Merge tag 'fbdev-for-7.4-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev

Pull more fbdev updates from Helge Deller:

 - atmel_lcdfb: avoid issues due to empty modelist in probe

 - simplify the console-blanking interface

* tag 'fbdev-for-7.4-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev:
  fbdev: atmel_lcdfb: fix list_first_entry() on possibly empty modelist in probe
  vt: Remove old-style con_blank
  vgacon: Implement struct consw.con_unblank
  sticon: Implement struct consw.con_unblank
  newport_con: Implement struct consw.con_unblank
  fbcon: Implement struct consw.con_unblank
  dummycon: Implement struct consw.con_unblank
  vt: Add con_unblank callback to struct consw
2026-10-30 06:27:35 -10:00
Linus Torvalds
8a36f53fd5 mm.git review status for linus..mm-stable
Everything:
 
 Total patches:       213
 Fixes: tags:         69
 cc:stable patches:   43
 Reviews/patch:       2.04
 Reviewed rate:       86%
 
 Excluding DAMON:
 
 Total patches:       192
 Fixes: tags:         63
 cc:stable patches:   39
 Reviews/patch:       2.18
 Reviewed rate:       89%
 
 Excluding DAMON and selftests:
 
 Total patches:       182
 Fixes: tags:         57
 cc:stable patches:   39
 Reviews/patch:       2.23
 Reviewed rate:       89%
 
 Summary of series in this merge:
 
 - "mm: make VMA flag semantics explicit, eliminate VM_SPECIAL"
   (Lorenzo Stoakes (ARM)):
 
   Replace VM_SPECIAL with helpers describing mapping ownership and
   behavior.  Enforce the mmap flag rules and convert affected drivers,
   removing ambiguous tests shared by driver mappings and ordinary memory.
 
 - "support kselftest on nommu platform" (Hajime Tazaki):
 
   Add opt-in mmap and mremap tests for NOMMU systems.  Teach the runner to
   avoid its fork-dependent timeout command and document the build and
   runtime requirements.
 
 - "mm/collapse: separate a collapse from its callers"
   (Kiryl Shutsemau (Meta)):
 
   Separate huge-page collapse from caller policy.  Replace khugepaged
   identity checks with explicit permissions, and separate scanning from
   collapse with the mmap_lock drop in one place.
 
 - "mm: implement and use vma_has_anon_rmap(), silence KCSAN"
   (Lorenzo Stoakes (ARM)):
 
   Provide a common helper for testing whether a VMA has anonymous reverse
   mappings.  Document the locking rules, annotate intentional concurrent
   reads for KCSAN, and convert the core MM callers.
 
 - "mm/sparse: remove SECTION_MARKED_PRESENT and further cleanups"
   (David Hildenbrand (Arm)):
 
   Remove SECTION_MARKED_PRESENT in favor of the early-section flag.
   Simplify sparse memory initialization, section metadata handling and
   related PFN validity checks.
 
 - "sh: remove NUMA and SPARSEMEM support" (Mike Rapoport (Microsoft)):
 
   Remove SuperH NUMA and SPARSEMEM support.  The extra memory banks have
   been unusable since the NO_BOOTMEM conversion, leaving only the code and
   data overhead.
 
 - "mm: Unify device DAX and HugeTLB vmemmap population paths"
   (Muchun Song):
 
   Unify the generic device DAX and HugeTLB vmemmap population paths and
   shared tail-page handling.  Remove the duplicate DAX machinery while
   retaining the powerpc radix implementation.
 
 - "kselftest: mm: fix some failure of split_huge_page_test" (Yeoreum Yun):
 
   Fix huge-page split tests racing with khugepaged recollapse.  Use pagemap
   and page flags instead of VMA-boundary assumptions which fail when glibc
   has already enabled THP.
 
 - "memcg: move memcgid refcount to objcg to unpin dying memcgs"
   (Bingfang Guo):
 
   Let dying memcgs be freed while swapped-out shmem still holds their IDs.
   Move ID references to reparentable objcgs, with the necessary swap
   accounting and RCU lifetime changes.
 
 - "mm/truncate: fix data loss when truncating straddling large folios"
   (Zhang Yi):
 
   Preserve out-of-range data when truncating straddling large folios.  Fix
   a lookup race and split-failure handling, and handle minimum folio orders
   for the forthcoming ext4 iomap buffered I/O path.
 
 - "mm/damon: introduce damos quota goal target metric complement flag"
   (SJ Park):
 
   Let DAMOS quota goals use a metric's complement, so utilization can also
   express free-memory goals without adding separate metrics.  Add the sysfs
   interface, documentation and tests.
 
 - "arm64/mm: Standardize printing for pgtable entries" (Anshuman Khandual):
 
   Use the generic formatter for arm64 page-table entries, ready for future
   wider entries.  Move the safe-PTE-update check out of the header to avoid
   an include cycle.
 
 - "mm: kmsan: fix iounmap metadata teardown" (Dima Koziuk):
 
   Fix KMSAN metadata leaks on iounmap and failed ioremap allocations.  Free
   backing pages before removing their mappings, and share the teardown with
   partial-allocation cleanup.
 
 - "mm/damon/core: preserve quota state when constructing schemes"
   (Karl Mehltretter):
 
   Preserve running DAMOS quota state while validating parameter updates.
   Even rejected updates could reset accounting and exceed the quota window;
   add tests for both accepted and rejected updates.
 
 - "mm/vmalloc: fix vmalloc_dump_obj VA lookup" (Ye Liu):
 
   Fix vmalloc_dump_obj() lookups for last-page addresses and allocations
   spanning vmap zones.  These allocations were being missed in diagnostic
   output.
 
 - "mm: various (urgent?) fixes" (David Hildenbrand (Arm)):
 
   Fix mmap charge leaks and hugetlb use-after-free, wrong-address
   unmapping, stuck locks and endless faults.  Also preserve reservations on
   failed mremap and handle stale userfaultfd bits.
 
 - "maple_tree: fix maple_range_64 crashes in RCU mode" (Dimitris Charisis):
 
   Fix pointer and metadata confusion during RCU destruction of
   maple_range_64 nodes, avoiding double frees and invalid accesses.  Add a
   regression test; no in-tree user currently uses this combination.
 
 - "mm: fix hugetlb NR_HUGETLB accounting on folio migration" (Hongfu Li):
 
   Fix hugetlb migration and preallocation accounting so /proc/vmstat
   retains the correct count and memory.numa_stat follows the folio to its
   new node.
 
 - "mm/damon: fix a minor bug, clean code, and add a test" (SJ Park):
 
   Fix 32-bit DAMON age overflow which made old regions look young.  Share
   hugetlb folio acquisition code and add a regression test for the
   previously fixed last-region skipping bug.
 
 - "mm/damon/core: cleanup code, reduce stack usage, and add kunit"
   (SJ Park):
 
   Reduce kdamond stack usage and remove unused enums.  Add deterministic
   PSI quota-goal tests which do not depend on the machine's current memory
   pressure.
 
 - "mm/damon: fix the temporal goal tuner's size quota conversion"
   (Donggeun Yoo):
 
   Bound the temporal tuner's quota conversion to prevent overflow and zero
   effective quotas, which could stop schemes making progress.  Add boundary
   tests.
 
 - "Don't use GFP_DMA when calling dma_alloc_coherent" (Baoquan He):
 
   Remove redundant GFP_DMA flags from coherent DMA allocation calls.  The
   DMA API already selects the zone from device limits and ignores the
   caller's flag.
 
 - "kselftest: mm: fix intermittent failure khugepaged test" (Yeoreum Yun):
 
   Propagate child-process failures in the khugepaged tests and prevent
   background collapse from racing their checks.  This removes false passes
   and intermittent failures.
 
 - "MAINTAINERS: cover all hugetlb headers under HUGETLB SUBSYSTEM"
   (Enze Li):
 
   Cover all hugetlb headers in MAINTAINERS so get_maintainer.pl finds the
   right maintainers.  Also label the closing hugetlb_cgroup.h include
   guard.
 
 Summary of the 65 singletons in this merge:
 
 The singletons include a few worthwhile performance fixes. Avoiding
 unnecessary reverse-map tree updates gave a reported 15.9% improvement
 in UnixBench's execl test on a 192-core x86 system. A reclaim retry fix
 stops defrag_mode from spinning under memory.low protection; a reported
 file-creation stress test ran 5.7 times faster, with far less memory
 pressure. Narrower hugetlb invalidations also spare KVM guests needless
 refaults: the reported Redis-in-VM P99 QPS penalty while punching holes
 fell from 7.09% to 1.45%.
 
 Several fixes prevent lost data or corrupted memory. Lazyfree huge-page
 races with mremap()/munmap() could lose data or access freed memory, and
 MADV_COLD could lose a concurrent write's dirty bit. Another fix
 prevents stale migration entries from outliving large folios. On
 filesystems with blocks smaller than a page, extending a file by 4 GiB
 or more could expose bytes written past the old EOF through mmap instead
 of zeroes. That is fixed, along with use-after-free races in
 PAGEMAP_SCAN during process exit and in memory-cgroup accounting on
 PREEMPT_RT kernels.
 
 Other fixes stop UFFDIO_MOVE spinning forever on pinned large folios,
 which could wedge other memory operations, and stop mremap() leaking
 commit charges until allocations fail under strict overcommit. A further
 fix keeps userfaultfd tracking intact on neighboring mappings. NUMA
 binding no longer prevents long-term pins when the chosen node has only
 movable memory, fixing QEMU/VFIO startup and io_uring buffer
 registration failures. MGLRU also gets a fix for early-boot crashes with
 memory cgroups disabled at boot, notably in small crash kernels.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCat66sAAKCRDdBJ7gKXxA
 jrQrAP99kgSXRdlmRZbHeRBHQ6KvI4XnLvQ78MDIzZ3zmBaOugEA5jiIsK2/snFD
 3VaV0oipVZpuwJkVJE6zFkh0tcHgTAo=
 =DHrN
 -----END PGP SIGNATURE-----

Merge tag 'mm-stable-2026-10-25-19-27' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Pull more MM updates from Andrew Morton:

 - "mm: make VMA flag semantics explicit, eliminate VM_SPECIAL" (Lorenzo
   Stoakes):

   Replace VM_SPECIAL with helpers describing mapping ownership and
   behavior. Enforce the mmap flag rules and convert affected drivers,
   removing ambiguous tests shared by driver mappings and ordinary
   memory.

 - "support kselftest on nommu platform" (Hajime Tazaki):

   Add opt-in mmap and mremap tests for NOMMU systems. Teach the runner
   to avoid its fork-dependent timeout command and document the build
   and runtime requirements.

 - "mm/collapse: separate a collapse from its callers" (Kiryl
   Shutsemau):

   Separate huge-page collapse from caller policy. Replace khugepaged
   identity checks with explicit permissions, and separate scanning from
   collapse with the mmap_lock drop in one place.

 - "mm: implement and use vma_has_anon_rmap(), silence KCSAN" (Lorenzo
   Stoakes):

   Provide a common helper for testing whether a VMA has anonymous
   reverse mappings. Document the locking rules, annotate intentional
   concurrent reads for KCSAN, and convert the core MM callers.

 - "mm/sparse: remove SECTION_MARKED_PRESENT and further cleanups"
   (David Hildenbrand):

   Remove SECTION_MARKED_PRESENT in favor of the early-section flag.
   Simplify sparse memory initialization, section metadata handling and
   related PFN validity checks.

 - "sh: remove NUMA and SPARSEMEM support" (Mike Rapoport):

   Remove SuperH NUMA and SPARSEMEM support. The extra memory banks have
   been unusable since the NO_BOOTMEM conversion, leaving only the code
   and data overhead.

 - "mm: Unify device DAX and HugeTLB vmemmap population paths" (Muchun
   Song):

   Unify the generic device DAX and HugeTLB vmemmap population paths and
   shared tail-page handling. Remove the duplicate DAX machinery while
   retaining the powerpc radix implementation.

 - "kselftest: mm: fix some failure of split_huge_page_test" (Yeoreum
   Yun):

   Fix huge-page split tests racing with khugepaged recollapse. Use
   pagemap and page flags instead of VMA-boundary assumptions which fail
   when glibc has already enabled THP.

 - "memcg: move memcgid refcount to objcg to unpin dying memcgs"
   (Bingfang Guo):

   Let dying memcgs be freed while swapped-out shmem still holds their
   IDs. Move ID references to reparentable objcgs, with the necessary
   swap accounting and RCU lifetime changes.

 - "mm/truncate: fix data loss when truncating straddling large folios"
   (Zhang Yi):

   Preserve out-of-range data when truncating straddling large folios.
   Fix a lookup race and split-failure handling, and handle minimum
   folio orders for the forthcoming ext4 iomap buffered I/O path.

 - "mm/damon: introduce damos quota goal target metric complement flag"
   (SJ Park):

   Let DAMOS quota goals use a metric's complement, so utilization can
   also express free-memory goals without adding separate metrics. Add
   the sysfs interface, documentation and tests.

 - "arm64/mm: Standardize printing for pgtable entries" (Anshuman
   Khandual):

   Use the generic formatter for arm64 page-table entries, ready for
   future wider entries. Move the safe-PTE-update check out of the
   header to avoid an include cycle.

 - "mm: kmsan: fix iounmap metadata teardown" (Dima Koziuk):

   Fix KMSAN metadata leaks on iounmap and failed ioremap allocations.
   Free backing pages before removing their mappings, and share the
   teardown with partial-allocation cleanup.

 - "mm/damon/core: preserve quota state when constructing schemes" (Karl
   Mehltretter):

   Preserve running DAMOS quota state while validating parameter
   updates. Even rejected updates could reset accounting and exceed the
   quota window; add tests for both accepted and rejected updates.

 - "mm/vmalloc: fix vmalloc_dump_obj VA lookup" (Ye Liu):

   Fix vmalloc_dump_obj() lookups for last-page addresses and
   allocations spanning vmap zones. These allocations were being missed
   in diagnostic output.

 - "mm: various (urgent?) fixes" (David Hildenbrand):

   Fix mmap charge leaks and hugetlb use-after-free, wrong-address
   unmapping, stuck locks and endless faults. Also preserve reservations
   on failed mremap and handle stale userfaultfd bits.

 - "maple_tree: fix maple_range_64 crashes in RCU mode" (Dimitris
   Charisis):

   Fix pointer and metadata confusion during RCU destruction of
   maple_range_64 nodes, avoiding double frees and invalid accesses. Add
   a regression test; no in-tree user currently uses this combination.

 - "mm: fix hugetlb NR_HUGETLB accounting on folio migration" (Hongfu
   Li):

   Fix hugetlb migration and preallocation accounting so /proc/vmstat
   retains the correct count and memory.numa_stat follows the folio to
   its new node.

 - "mm/damon: fix a minor bug, clean code, and add a test" (SJ Park):

   Fix 32-bit DAMON age overflow which made old regions look young.
   Share hugetlb folio acquisition code and add a regression test for
   the previously fixed last-region skipping bug.

 - "mm/damon/core: cleanup code, reduce stack usage, and add kunit" (SJ
   Park):

   Reduce kdamond stack usage and remove unused enums. Add deterministic
   PSI quota-goal tests which do not depend on the machine's current
   memory pressure.

 - "mm/damon: fix the temporal goal tuner's size quota conversion"
   (Donggeun Yoo):

   Bound the temporal tuner's quota conversion to prevent overflow and
   zero effective quotas, which could stop schemes making progress. Add
   boundary tests.

 - "Don't use GFP_DMA when calling dma_alloc_coherent" (Baoquan He):

   Remove redundant GFP_DMA flags from coherent DMA allocation calls.
   The DMA API already selects the zone from device limits and ignores
   the caller's flag.

 - "kselftest: mm: fix intermittent failure khugepaged test" (Yeoreum
   Yun):

   Propagate child-process failures in the khugepaged tests and prevent
   background collapse from racing their checks. This removes false
   passes and intermittent failures.

 - "MAINTAINERS: cover all hugetlb headers under HUGETLB SUBSYSTEM"
   (Enze Li):

   Cover all hugetlb headers in MAINTAINERS so get_maintainer.pl finds
   the right maintainers. Also label the closing hugetlb_cgroup.h
   include guard.

Summary of the 65 singletons in this merge:

  The singletons include a few worthwhile performance fixes. Avoiding
  unnecessary reverse-map tree updates gave a reported 15.9% improvement
  in UnixBench's execl test on a 192-core x86 system. A reclaim retry
  fix stops defrag_mode from spinning under memory.low protection; a
  reported file-creation stress test ran 5.7 times faster, with far less
  memory pressure. Narrower hugetlb invalidations also spare KVM guests
  needless refaults: the reported Redis-in-VM P99 QPS penalty while
  punching holes fell from 7.09% to 1.45%.

  Several fixes prevent lost data or corrupted memory. Lazyfree
  huge-page races with mremap()/munmap() could lose data or access freed
  memory, and MADV_COLD could lose a concurrent write's dirty bit.
  Another fix prevents stale migration entries from outliving large
  folios. On filesystems with blocks smaller than a page, extending a
  file by 4 GiB or more could expose bytes written past the old EOF
  through mmap instead of zeroes. That is fixed, along with
  use-after-free races in PAGEMAP_SCAN during process exit and in
  memory-cgroup accounting on PREEMPT_RT kernels.

  Other fixes stop UFFDIO_MOVE spinning forever on pinned large folios,
  which could wedge other memory operations, and stop mremap() leaking
  commit charges until allocations fail under strict overcommit. A
  further fix keeps userfaultfd tracking intact on neighboring mappings.
  NUMA binding no longer prevents long-term pins when the chosen node
  has only movable memory, fixing QEMU/VFIO startup and io_uring buffer
  registration failures. MGLRU also gets a fix for early-boot crashes
  with memory cgroups disabled at boot, notably in small crash kernels.

* tag 'mm-stable-2026-10-25-19-27' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (213 commits)
  mm: multi-gen LRU: fix NULL lruvec->pgdat deref with memcg disabled on cmdline
  mm/page_counter: use WRITE_ONCE() for emin/elow when parent is the root
  mm/memcontrol: publish null pointer before dropping css reference
  test_maple_tree: test maple_range_64 node in RCU mode
  maple_tree: fix maple_range_64 crashes in RCU mode
  mm/vma: avoid broken uffd merge on mremap
  tools/testing/shared: catch a failed posix_memalign()
  mm/damon/core: remove unreachable damos charge_{target,addr}_from
  mm/shrinker: allocate shrinker_info_unit from a dedicated kmem_cache
  riscv: mm: exclude invalid THP PMDs from page table check
  mm/damon/core: filter out damos address filter-split failed region
  fs/proc/task_mmu: pin mm_users in do_pagemap_scan()
  mm/mempolicy: apply bind policies against the scoped allocation zone
  mm/vmscan: reclaim every zone in per-node proactive reclaim
  mm/mremap: correctly uncharge accountable VMAs in error path
  mm/mremap: populate calculated fields in vrm state correctly
  MAINTAINERS: add an entry for MEMORY MANAGEMENT - MEMORY MAP
  mm: bdi: reset min_ratio after the sysfs attributes are gone
  mm/page_vma_mapped: continue past nonmatching huge PMDs
  selftests/mm: skip hugetlb cgroup v2 tests without the needed controllers
  ...
2026-10-27 12:23:17 -10:00
Linus Torvalds
d135ab453a Backlight for v7.4
- Improvements & Fixes
   - Qualcomm WLED: Fix a NULL pointer dereference in `wled_remove()` by setting platform
     driver data in `wled_probe()`
   - Qualcomm WLED: Fix the WLED3 brightness register stride to prevent consecutive string
     writes from overlapping
   - Qualcomm WLED: Read back the hardware-programmed brightness at probe, expose it via
     `get_brightness()`, and prevent unbalanced OVP IRQ enabling
   - TI LM3630A: Cancel delayed work synchronously after freeing the IRQ and before
     destroying the workqueue in `lm3630a_remove()`
 
 - Cleanups & Refactoring
   - Ilitek ILI9320 / Kinetic KTD253: Fix spelling typos in comments
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEdrbJNaO+IJqU8IdIUa+KL4f8d2EFAmrfbigACgkQUa+KL4f8
 d2FHIBAAmyjo0hEalV58soe3iEmMzJAc7O+HVa2ZX3tU1Ona2qvd3Tfdict6fN9t
 f7VbC9+Cekq6oqh4CKVNpdUo2D47zt34JCdfvwUt0Nbntr5FXdbpclyF7r5jMeAu
 ETIWtRTvHT0n4OZKo+k7H8NDrLWOBllOheEHP+UWdEv+VRSC9NbeOryamxA/lcrL
 /Y9wewxIIGdi91RnwunwPDX7KawJofN1uzwIVwbnoDKx5urz3a4P6HXm+hPM3gVV
 EmirV8B5OBIgwdeEYevc5lg0PrnnGoqJFcDfKDJTVjVqovQzXPEsK8IXSi9ED0Ob
 EU37hVJD51aq3Q4AYHj9OH/DmG2cVc4N01i4BCUYZUhoDT4Jm9W4iU8e3iX16A4h
 X3g9tpiYjKprvbPzLaspVulSUp9eAk4LLmXQ3OnoYG9PwdZe/9eKtE9epYgUEF0I
 m/fZJjwlbBGL65dyEQGWWdEI2wztMWf2MdHUMZPiaQZdqTERjovIX6wriRB8WmFz
 juc8Lux9t8CuuBTT1MruXeTweaSZPH9e7EzmTYNXgcPlX+53ky4XMJzCKgfaP/yw
 QL0iY8w5km+OU39uPxz7knA9bHYqs25cyTX7BV7XnOykXrAgrdlwPidy1WTswpPx
 8U9vXui03JdeyhMV5pR562gYaaZzCYqgaB+HyupcQxhVEFIUXvU=
 =t3tl
 -----END PGP SIGNATURE-----

Merge tag 'backlight-next-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight

Pull backlight updates from Lee Jones:
 "Improvements & Fixes:
   - Qualcomm WLED: Fix a NULL pointer dereference in `wled_remove()` by
     setting platform driver data in `wled_probe()`
   - Qualcomm WLED: Fix the WLED3 brightness register stride to prevent
     consecutive string writes from overlapping
   - Qualcomm WLED: Read back the hardware-programmed brightness at
     probe, expose it via
    `get_brightness()`, and prevent unbalanced OVP IRQ enabling
   - TI LM3630A: Cancel delayed work synchronously after freeing the IRQ
     and before destroying the workqueue in `lm3630a_remove()`

  Cleanups & Refactoring:
   - Ilitek ILI9320 / Kinetic KTD253: Fix spelling typos in comments"

* tag 'backlight-next-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight:
  backlight: qcom-wled: Read back the programmed brightness at probe
  backlight: qcom-wled: Fix unbalanced OVP IRQ enable at probe
  backlight: qcom-wled: Fix WLED3 brightness register stride
  backlight: qcom-wled: Fix NULL pointer dereference in wled_remove()
  backlight: lm3630a: Cancel delayed work before destroying workqueue
  backlight: ili9320/ktd253: Fix typos in comments
2026-10-26 09:10:43 -10:00
Linus Torvalds
5b93dc1c0c LEDs for v7.4
- New Support & Features
   - Core: Add `led_trigger_notify_hw_control_changed()` to allow drivers to notify the
     core of autonomous hardware control transitions
   - Core: Add the `hw_offloaded()` trigger callback and `trigger_may_offload_to_hw` sysfs
     attribute to expose hardware-offloaded triggers
   - Netdev Trigger: Implement the `hw_offloaded()` callback to report hardware control
     state to the LED core
   - Analog Devices LTC3208: Add support for the LTC3208 7-channel multi-display I2C LED
     driver
   - ChromeOS EC: Implement the `hw_offloaded()` callback for the `chromeos-auto` trigger
   - CZ.NIC Turris Omnia: Implement the `hw_offloaded()` callback and declare `omnia-mcu`
     as a hardware control trigger
   - STMicroelectronics ST1202: Add hardware-accelerated blink support via `blink_set()`
 
 - Improvements & Fixes
   - Class: Always hold the `led_access` mutex in `brightness_show()` to avoid exposing
     transient registration states
   - Class: Deactivate active hardware control triggers when writing to the `brightness`
     sysfs attribute
   - Core: Enforce strict validation in `led_trigger_is_hw_controlled()` and warn on legacy
     fallback paths
   - Flash Class: Initialize the fault variable in `flash_fault_show()` to prevent
     undefined behavior when callbacks perform bitwise ORs
   - Kinetic KTD2692: Pass the driver context directly to `regulator_disable_action()` to
     prevent a NULL pointer dereference during error unwinding
   - Maxim MAX77705: Use `fwnode_for_each_child_node_scoped()` in `max77705_add_led()` to
     prevent child node reference leaks on error paths
   - NXP PCA9532: Check the return value of `i2c_smbus_read_byte_data()` in
     `pca9532_getled()` to avoid integer underflow on read errors
   - Qualcomm WLED: Fix a NULL pointer dereference in `wled_remove()` by setting platform
     driver data in `wled_probe()`
   - Qualcomm WLED: Fix the WLED3 brightness register stride to prevent consecutive string
     writes from overlapping
   - Qualcomm WLED: Read back the hardware-programmed brightness at probe, expose it via
     `get_brightness()`, and prevent unbalanced OVP IRQ enabling
   - STMicroelectronics ST1202: Clear unused PWM pattern slots in `pattern_set()` and
     `blink_set()` to prevent unintended output when sharing the global sequencer
   - STMicroelectronics ST1202: Program and cap the channel current according to
     `max_brightness` across brightness, blink, and hardware pattern modes, and scale
     pattern brightness to the 12-bit PWM range
   - STMicroelectronics ST1202: Retain a reference to each child LED firmware node for the
     lifetime of the device
   - STMicroelectronics ST1202: Use only the blocking `brightness_set_blocking()` callback
     to avoid sleeping in atomic context during I2C transfers
   - TI LM3692x: Check the final register write in `lm3692x_leds_enable()` to prevent
     regulator/GPIO leaks and an inconsistent enabled state
   - TI LP8860: Fix a `device_node` reference leak in `lp8860_probe()` using
     `__free(device_node)`
 
 - Cleanups & Refactoring
   - Core: Move `led_trigger_is_hw_controlled()` and `led_trigger_group` from `led-class.c`
     into `led-triggers.c`
   - Core: Replace conditional `set_bit()`/`clear_bit()` patterns with `assign_bit()` and
     `__assign_bit()`
   - Flash Class: Simplify `flash_fault_show()` using `sysfs_emit_at()` and omit the
     trailing space
   - Maintainers: Add Griffin Kroah-Hartman as an LED subsystem reviewer
   - Intel SS4200: Fix a spelling typo in a comment
   - ISSI IS31FL32xx: Convert DT-specific parsing helpers to generic device and fwnode
     property APIs
   - NXP PCA955x: Drop redundant intermediate platform data and allocate the LED array
     using a flexible array member
   - Qualcomm LPG: Convert LED and channel parsing to fwnode APIs and avoid leaving
     `default_trigger` uninitialized
   - Skyworks AAT1290: Use `ARRAY_SIZE()` when allocating `mm_current_scale` to match the
     target pointer type for type-aware allocators
   - STMicroelectronics ST1202: Introduce a `st1202_iled_max()` helper to unify channel
     current ceiling calculations
   - STMicroelectronics ST1202: Standardize variable and macro naming, fix helper spelling,
     and use `u8` consistently instead of `uint8_t`
   - Syscon: Convert from OF-specific property helpers to the generic device property and
     fwnode APIs
 
 - Device Tree Binding Updates
   - Core: Allow PHY RX triggers (`phy[0-9]+rx`) in `linux,default-trigger`
   - Core: Standardize example indentation across multiple LED and backlight binding
     schemas
   - Analog Devices LTC3208: Document the LTC3208 multi-display LED driver
   - LaCie netxbig: Convert LED bindings to DT schema
   - Motorola CPCAP: Convert LED bindings to DT schemaLEDs for v7.4
 
 - New Support & Features
   - Core: Add `led_trigger_notify_hw_control_changed()` to allow drivers to notify the
     core of autonomous hardware control transitions
   - Core: Add the `hw_offloaded()` trigger callback and `trigger_may_offload_to_hw` sysfs
     attribute to expose hardware-offloaded triggers
   - Netdev Trigger: Implement the `hw_offloaded()` callback to report hardware control
     state to the LED core
   - Analog Devices LTC3208: Add support for the LTC3208 7-channel multi-display I2C LED
     driver
   - ChromeOS EC: Implement the `hw_offloaded()` callback for the `chromeos-auto` trigger
   - CZ.NIC Turris Omnia: Implement the `hw_offloaded()` callback and declare `omnia-mcu`
     as a hardware control trigger
   - STMicroelectronics ST1202: Add hardware-accelerated blink support via `blink_set()`
 
 - Improvements & Fixes
   - Class: Always hold the `led_access` mutex in `brightness_show()` to avoid exposing
     transient registration states
   - Class: Deactivate active hardware control triggers when writing to the `brightness`
     sysfs attribute
   - Core: Enforce strict validation in `led_trigger_is_hw_controlled()` and warn on legacy
     fallback paths
   - Flash Class: Initialize the fault variable in `flash_fault_show()` to prevent
     undefined behavior when callbacks perform bitwise ORs
   - Kinetic KTD2692: Pass the driver context directly to `regulator_disable_action()` to
     prevent a NULL pointer dereference during error unwinding
   - Maxim MAX77705: Use `fwnode_for_each_child_node_scoped()` in `max77705_add_led()` to
     prevent child node reference leaks on error paths
   - NXP PCA9532: Check the return value of `i2c_smbus_read_byte_data()` in
     `pca9532_getled()` to avoid integer underflow on read errors
   - Qualcomm WLED: Fix a NULL pointer dereference in `wled_remove()` by setting platform
     driver data in `wled_probe()`
   - Qualcomm WLED: Fix the WLED3 brightness register stride to prevent consecutive string
     writes from overlapping
   - Qualcomm WLED: Read back the hardware-programmed brightness at probe, expose it via
     `get_brightness()`, and prevent unbalanced OVP IRQ enabling
   - STMicroelectronics ST1202: Clear unused PWM pattern slots in `pattern_set()` and
     `blink_set()` to prevent unintended output when sharing the global sequencer
   - STMicroelectronics ST1202: Program and cap the channel current according to
     `max_brightness` across brightness, blink, and hardware pattern modes, and scale
     pattern brightness to the 12-bit PWM range
   - STMicroelectronics ST1202: Retain a reference to each child LED firmware node for the
     lifetime of the device
   - STMicroelectronics ST1202: Use only the blocking `brightness_set_blocking()` callback
     to avoid sleeping in atomic context during I2C transfers
   - TI LM3692x: Check the final register write in `lm3692x_leds_enable()` to prevent
     regulator/GPIO leaks and an inconsistent enabled state
   - TI LP8860: Fix a `device_node` reference leak in `lp8860_probe()` using
     `__free(device_node)`
 
 - Cleanups & Refactoring
   - Core: Move `led_trigger_is_hw_controlled()` and `led_trigger_group` from `led-class.c`
     into `led-triggers.c`
   - Core: Replace conditional `set_bit()`/`clear_bit()` patterns with `assign_bit()` and
     `__assign_bit()`
   - Flash Class: Simplify `flash_fault_show()` using `sysfs_emit_at()` and omit the
     trailing space
   - Maintainers: Add Griffin Kroah-Hartman as an LED subsystem reviewer
   - Intel SS4200: Fix a spelling typo in a comment
   - ISSI IS31FL32xx: Convert DT-specific parsing helpers to generic device and fwnode
     property APIs
   - NXP PCA955x: Drop redundant intermediate platform data and allocate the LED array
     using a flexible array member
   - Qualcomm LPG: Convert LED and channel parsing to fwnode APIs and avoid leaving
     `default_trigger` uninitialized
   - Skyworks AAT1290: Use `ARRAY_SIZE()` when allocating `mm_current_scale` to match the
     target pointer type for type-aware allocators
   - STMicroelectronics ST1202: Introduce a `st1202_iled_max()` helper to unify channel
     current ceiling calculations
   - STMicroelectronics ST1202: Standardize variable and macro naming, fix helper spelling,
     and use `u8` consistently instead of `uint8_t`
   - Syscon: Convert from OF-specific property helpers to the generic device property and
     fwnode APIs
 
 - Device Tree Binding Updates
   - Core: Allow PHY RX triggers (`phy[0-9]+rx`) in `linux,default-trigger`
   - Core: Standardize example indentation across multiple LED and backlight binding
     schemas
   - Analog Devices LTC3208: Document the LTC3208 multi-display LED driver
   - LaCie netxbig: Convert LED bindings to DT schema
   - Motorola CPCAP: Convert LED bindings to DT schema
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEdrbJNaO+IJqU8IdIUa+KL4f8d2EFAmrfbg4ACgkQUa+KL4f8
 d2EYqg/+IH3k8Jm0Et7WGte+Ej4cmQJ3/xJNNu+ezGeaZu1WcxT4xXLCGhE89GyC
 4hqlyHM7mSDFBwVoiEqznu/rMQ9gCxQZbDPZkBJFrnAIvWYd2veMAuzC5l3vnvUD
 DuOyN+i++KzoX5F5dNd802CElKmhhB03V+FbU4QUyHT6I6zjUtR/6WXYv6Wyvca4
 gQSYKcyHem7VQaVmk85kvvH9Z8wIvAlzaMHOz7vyfZNarb5K+RXgvCjZfncR/c6P
 FYGh4RRl0zJV/x+8FZ7Ehwck4YjOJf0hySmRQ9DeABV2CFDYFrSEck5UfMPDO+c0
 tpdHHQp66lrLjM1MZns1zP7SnucXt1G6y9b5DmMd/bneMlDa5enBLIFbS106hdIh
 NDu9rKQz/AW1V/fPV+db+AgjL7Sr7oKTNbRuclLj57Zj7TEbtgeUOXh/FKRxPKfu
 mzLPpjdggiuXbTCSNxyW+jKm9a7wthlk2dSsNOWgVea6d3Et/Y1oYOpbOX+s+CqF
 WShv55jkpyqpazorpzdNdv8mdsXRItf13UZy8izmwufve0JrnAlbqTt5TEzs7zgj
 cuDYreg90RNckLWNv/Tdgjxw1aIIWAC3Z3gVVJt0sbdPGS56r6aHu3Rt4Usurxx5
 GHcgIOZcmK5bPk/2gH/chvQj3MOsxrr38Q1Gazv55yVTOnp/39Q=
 =x9D5
 -----END PGP SIGNATURE-----

Merge tag 'leds-next-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds

Pull LED updates from Lee Jones:
 "New Support & Features:
   - Core: Add `led_trigger_notify_hw_control_changed()` to allow
     drivers to notify the core of autonomous hardware control
     transitions
   - Core: Add the `hw_offloaded()` trigger callback and
     `trigger_may_offload_to_hw` sysfs attribute to expose
     hardware-offloaded triggers
   - Netdev Trigger: Implement the `hw_offloaded()` callback to report
     hardware control state to the LED core
   - Analog Devices LTC3208: Add support for the LTC3208 7-channel
     multi-display I2C LED driver
   - ChromeOS EC: Implement the `hw_offloaded()` callback for the
     `chromeos-auto` trigger
   - CZ.NIC Turris Omnia: Implement the `hw_offloaded()` callback and
     declare `omnia-mcu` as a hardware control trigger
   - STMicroelectronics ST1202: Add hardware-accelerated blink support
     via `blink_set()`

  Improvements & Fixes:
   - Class: Always hold the `led_access` mutex in `brightness_show()` to
     avoid exposing transient registration states
   - Class: Deactivate active hardware control triggers when writing to
     the `brightness` sysfs attribute
   - Core: Enforce strict validation in `led_trigger_is_hw_controlled()`
     and warn on legacy fallback paths
   - Flash Class: Initialize the fault variable in `flash_fault_show()`
     to prevent undefined behavior when callbacks perform bitwise ORs
   - Kinetic KTD2692: Pass the driver context directly to
     `regulator_disable_action()` to prevent a NULL pointer dereference
     during error unwinding
   - Maxim MAX77705: Use `fwnode_for_each_child_node_scoped()` in
     `max77705_add_led()` to prevent child node reference leaks on error
     paths
   - NXP PCA9532: Check the return value of `i2c_smbus_read_byte_data()`
     in `pca9532_getled()` to avoid integer underflow on read errors
   - Qualcomm WLED: Fix a NULL pointer dereference in `wled_remove()` by
     setting platform driver data in `wled_probe()`
   - Qualcomm WLED: Fix the WLED3 brightness register stride to prevent
     consecutive string writes from overlapping
   - Qualcomm WLED: Read back the hardware-programmed brightness at
     probe, expose it via `get_brightness()`, and prevent unbalanced OVP
     IRQ enabling
   - STMicroelectronics ST1202: Clear unused PWM pattern slots in
     `pattern_set()` and `blink_set()` to prevent unintended output when
     sharing the global sequencer
   - STMicroelectronics ST1202: Program and cap the channel current
     according to `max_brightness` across brightness, blink, and
     hardware pattern modes, and scale pattern brightness to the 12-bit
     PWM range
   - STMicroelectronics ST1202: Retain a reference to each child LED
     firmware node for the lifetime of the device
   - STMicroelectronics ST1202: Use only the blocking
     `brightness_set_blocking()` callback to avoid sleeping in atomic
     context during I2C transfers
   - TI LM3692x: Check the final register write in
     `lm3692x_leds_enable()` to prevent regulator/GPIO leaks and an
     inconsistent enabled state
   - TI LP8860: Fix a `device_node` reference leak in `lp8860_probe()`
     using `__free(device_node)`

  Cleanups & Refactoring:
   - Core: Move `led_trigger_is_hw_controlled()` and `led_trigger_group`
     from `led-class.c` into `led-triggers.c`
   - Core: Replace conditional `set_bit()`/`clear_bit()` patterns with
     `assign_bit()` and `__assign_bit()`
   - Flash Class: Simplify `flash_fault_show()` using `sysfs_emit_at()`
     and omit the trailing space
   - Maintainers: Add Griffin Kroah-Hartman as an LED subsystem reviewer
   - Intel SS4200: Fix a spelling typo in a comment
   - ISSI IS31FL32xx: Convert DT-specific parsing helpers to generic
     device and fwnode property APIs
   - NXP PCA955x: Drop redundant intermediate platform data and allocate
     the LED array using a flexible array member
   - Qualcomm LPG: Convert LED and channel parsing to fwnode APIs and
     avoid leaving `default_trigger` uninitialized
   - Skyworks AAT1290: Use `ARRAY_SIZE()` when allocating
     `mm_current_scale` to match the target pointer type for type-aware
     allocators
   - STMicroelectronics ST1202: Introduce a `st1202_iled_max()` helper
     to unify channel current ceiling calculations
   - STMicroelectronics ST1202: Standardize variable and macro naming,
     fix helper spelling, and use `u8` consistently instead of `uint8_t`
   - Syscon: Convert from OF-specific property helpers to the generic
     device property and fwnode APIs

  Device Tree Binding Updates:
   - Core: Allow PHY RX triggers (`phy[0-9]+rx`) in
     `linux,default-trigger`
   - Core: Standardize example indentation across multiple LED and
     backlight binding schemas
   - Analog Devices LTC3208: Document the LTC3208 multi-display LED
     driver
   - LaCie netxbig: Convert LED bindings to DT schema
   - Motorola CPCAP: Convert LED bindings to DT schemaLEDs for v7.4"

* tag 'leds-next-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds: (49 commits)
  dt-bindings: leds: lacie,netxbig-leds: Convert to DT schema
  leds: pca955x: Drop platform data and allocate LEDs with the device
  dt-bindings: leds: Use consistent indentation in the example
  backlight: qcom-wled: Read back the programmed brightness at probe
  backlight: qcom-wled: Fix unbalanced OVP IRQ enable at probe
  backlight: qcom-wled: Fix WLED3 brightness register stride
  backlight: qcom-wled: Fix NULL pointer dereference in wled_remove()
  dt-bindings: leds: Allow PHY RX triggers
  MAINTAINERS: Add myself as a LED SUBSYSTEM reviewer
  leds: trigger: Add led_trigger_notify_hw_control_changed() interface
  leds: trigger: Enforce strict checks in led_trigger_is_hw_controlled()
  leds: trigger: netdev: Implement hw_offloaded() callback
  leds: turris-omnia: Implement hw_offloaded() trigger callback and declare hw_control_trigger
  leds: cros_ec: Implement hw_offloaded() trigger callback
  leds: trigger: Add hw_offloaded() callback and provide trigger_may_offload_to_hw attribute
  leds: trigger: Move led_trigger_group to the right place
  leds: class: Remove hardware control trigger when writing brightness
  leds: trigger: Move led_trigger_is_hw_controlled() to the right place
  leds: class: Always protect brightness_show() with led_access
  dt-bindings: leds: leds-cpcap: Convert to DT schema
  ...
2026-10-26 08:55:14 -10:00
Linus Torvalds
d857e1f3fa MFD for v7.4
- New Support & Features
   - Cirrus Logic CS42L43: Add support for the CS42L44 variant
   - Khadas MCU: Add support for the VIM4 MCU variant along with per-variant fan duty-cycle
     levels and optional fan supply regulator support
   - Maxim MAX77705: Add support for the PASS2 hardware revision
   - MediaTek MT6397: Add AUXADC sub-device support for MT6397
   - Motorola CPCAP: Support per-board sub-device compositions and add the Tegra20 Mot
     composition
   - ROHM BD73800: Add support for the BD73800 PMIC core, regulator, RTC, clock gate, and
     GPIO sub-devices
   - TI LM3533: Add VIN regulator supply support, configure initial backlight mapping mode
     from Device Tree, and implement the `backlight_scale` property
   - X-Powers AC200: Add support for the AC200 I2C mixed-signal companion IC
 
 - Improvements & Fixes
   - Cirrus Logic CS42L43: Synchronize SoundWire enumeration work in `remove()` before
     devres cleanup begins
   - Dialog DA903x: Manage IRQ work cancellation and sub-device removal via devres to
     prevent use-after-free during teardown
   - Dialog DA9150: Balance `enable_irq_wake()` with `disable_irq_wake()` during probe
     failure and driver removal
   - Intel LPSS: Add DMI quirks for Dell Latitude 5285 and 7275 to ignore ACPI resource
     conflicts on the I2C4 controller
   - Intel Quark I2C/GPIO: Manage the fixed-rate clock and its clkdev lookup with devres to
     fix a resource leak on unbind
   - Maxim MAX77705: Select `REGMAP_I2C` and `REGMAP_IRQ` in Kconfig to fix build errors
   - Qualcomm WCD934x: Initialize the parent DMA mask to suppress "DMA mask not set"
     warnings on child devices
   - Qualcomm WCD934x: Pass the valid device pointer to `dev_err_probe()` on IRQ lookup
     failure to avoid a NULL pointer dereference
   - Rockchip RK8xx: Register the poweroff handler in the atomic `SYS_OFF_MODE_POWER_OFF`
     phase so polling I2C transfers complete during shutdown
   - ST-Ericsson AB8500: Use `devm_mfd_add_devices()` to prevent leaking child devices on
     probe failure
   - TI BQ257xx: Mark self-modifying BQ25792 configuration registers as volatile
   - TI LM3533: Set `coherent_dma_mask` to zero to suppress "DMA mask not set" warnings
   - TI TPS65217: Check for errors during IRQ initialization and masking, and manage IRQ
     domain and wake teardown with devres
   - TI TWL: Unregister the auxiliary platform device via a devres action on probe failure
     and driver unbind
 
 - Cleanups & Refactoring
   - Core: Convert drivers from deprecated `SIMPLE_DEV_PM_OPS()` to
     `DEFINE_SIMPLE_DEV_PM_OPS()` and `pm_sleep_ptr()`
   - Core: Fix spelling mistakes in comments across various MFD drivers and headers
   - Maintainers: Add ROHM BD73800 PMIC files under the ROHM PMIC entry
   - Maintainers: Specify the `for-mfd-next` branch for the MFD and Syscon git trees
   - Dialog DA9062: Use `DEFINE_RES_IRQ_NAMED()` for IRQ resource definitions
   - Intel LPSS: Simplify DebugFS handling by dropping redundant error checks and
     intermediate dentry variables, using octal permissions, and switching to
     `debugfs_remove()`
   - Khadas MCU: Convert MFD cell arrays to `const` and use `MFD_CELL_NAME()`
   - ST-Ericsson AB8500: Fix a spelling typo in a comment
   - TI LM3533: Convert from platform data to Device Tree bindings and pass only regmap and
     light sensor presence to child devices
   - TI LM3533: Remove driver-specific regmap wrappers, redundant pdata helpers, and
     unnecessary `extern` qualifiers, and use `dev_groups` for sysfs attributes
   - Wolfson WM831x: Fix a spelling typo in a comment
 
 - Device Tree Binding Updates
   - HiSilicon Hi6421 SPMI: Fix the compatible string to match `hisilicon,hi6421-spmi`
   - MediaTek MT6357: Allow an `adc` child node
   - MediaTek MT6360: Allow two-cell interrupt specifiers with trigger flags
   - MediaTek MT6397: Document the `#sound-dai-cells` property
   - MediaTek MT6397: Document the battery-backed NVMEM layout under the RTC child node
   - MediaTek MT6397: Document the MT6323 PMIC EFUSE child node
   - Motorola CPCAP: Convert MFD and power button bindings to DT schema and document the
     Mapphone and Mot compositions
   - Qualcomm SPMI PMIC: Document the PM4125 audio codec compatible
   - Qualcomm SPMI PMIC: Document the PMAU0102 PMIC compatible
   - Qualcomm TCSR: Document the MSM8952 TCSR compatible
   - Rockchip RK805: Fold the pin controller binding into the RK805 PMIC DT schema
   - ROHM BD73800: Document the BD73800 PMIC and its regulators
   - ROHM PMIC: Factor out common pin properties into `rohm,pmic-pins.yaml` and reference
     them across BD71815, BD71828, and BD72720 bindings
   - ST-Ericsson AB8500: Document AB8500 and AB8505 buck converter regulators
   - ST-Ericsson AB8500: Document codec audio graph ports, sound DAI cells, and analog
     microphone wiring properties
   - ST-Ericsson DB8500 PRCMU: Deprecate the `db8500-prcmu-regulators` child node and make
     it optional
   - Syscon: Document the Ambarella CV75 secure scratchpad compatible
   - TI BQ25703A: Add the BQ25798 compatible with fallback to BQ25792
   - TI Keystone: Convert Device State Control bindings to DT schema
   - TI LM3533: Document the LM3533 LED controller, backlight, and indicator LED bindings
   - TI LP3943: Convert MFD and PWM bindings to DT schema
   - TI TPS61050: Convert bindings to DT schema
   - TI TPS65086: Make the `regulators` child node optional
   - TI TPS65910: Document `wakeup-source` and GPIO hog child nodes
   - TI TWL6040: Convert bindings to DT schema and align property names with the driver
   - X-Powers AC200: Document the AC200 mixed-signal companion IC
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEdrbJNaO+IJqU8IdIUa+KL4f8d2EFAmrfbfQACgkQUa+KL4f8
 d2FqyxAAsju3PmhlmAdSaHEYXu3PQwzV4j9ZJ4jynWeMyVcKGPePiWfaaSqpyQ36
 gn95B6ZoFlVl9aRAKu0kaLCSx2oGTtD9BoQ6jjfvVW6yU4LzmhvdCw+Zr7Img61H
 rv+kYmZiqzwt1LGaGBbbDNtP1q+B+QFKvgdDGvaiRKGEvOtuKuASLnD4t8jtWuLT
 5VIMFcCFqySeYUwLMnLQk8C2Fqysx1dPvOe0doe90vPF5tpKI8ZNIrbk0OruQzlN
 tfQahrfUnmkZGdjO+lalbkwSvlSrs+6KTckr53fyrIYHILPJcbfnFPimLhDzBVG4
 Ko/WnjGWwt2XkfIkGJJALUZptyz5YpfKfwxl+Xi3NAyWkpVcKfI0nASLd6T8QO4h
 mJQsg2SQer3/HCY2z8Hs8IW1XBhzLPtZN+e5qPOIPBNW3D11y92KodvjMxfSRmdz
 lCeIJohs5md75f3aFUqFSi0iDv4tgTZ2BCUSz9BzqYgkA7cQYlmQrYEqFrhHQFjo
 sYAAFBlg4SLJ5J5N1cEp8DFrjompbqDCenm2csntvJhWQ6hmxHbm5zEKMKeXUYLw
 le+E+jpvg7EXoEsoy+3dVY89gdMpnVN68A7wRCH8EVIrIzq1pRpFpX2V9kd85sro
 SV1LOuEnnnyjEdJ3wSQGEKkPXdy/YZguMBDqoFKw3ODV0cez/cE=
 =Is2H
 -----END PGP SIGNATURE-----

Merge tag 'mfd-next-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd

Pull MFD updates from Lee Jones:
 "New Support & Features:
   - Cirrus Logic CS42L43: Add support for the CS42L44 variant
   - Khadas MCU: Add support for the VIM4 MCU variant along with
     per-variant fan duty-cycle levels and optional fan supply regulator
     support
   - Maxim MAX77705: Add support for the PASS2 hardware revision
   - MediaTek MT6397: Add AUXADC sub-device support for MT6397
   - Motorola CPCAP: Support per-board sub-device compositions and add
     the Tegra20 Mot composition
   - ROHM BD73800: Add support for the BD73800 PMIC core, regulator,
     RTC, clock gate, and GPIO sub-devices
   - TI LM3533: Add VIN regulator supply support, configure initial
     backlight mapping mode from Device Tree, and implement the
     `backlight_scale` property
   - X-Powers AC200: Add support for the AC200 I2C mixed-signal companion IC

  Improvements & Fixes:
   - Cirrus Logic CS42L43: Synchronize SoundWire enumeration work in
     `remove()` before devres cleanup begins
   - Dialog DA903x: Manage IRQ work cancellation and sub-device removal
     via devres to prevent use-after-free during teardown
   - Dialog DA9150: Balance `enable_irq_wake()` with
     `disable_irq_wake()` during probe failure and driver removal
   - Intel LPSS: Add DMI quirks for Dell Latitude 5285 and 7275 to
     ignore ACPI resource conflicts on the I2C4 controller
   - Intel Quark I2C/GPIO: Manage the fixed-rate clock and its clkdev
     lookup with devres to fix a resource leak on unbind
   - Maxim MAX77705: Select `REGMAP_I2C` and `REGMAP_IRQ` in Kconfig to
     fix build errors
   - Qualcomm WCD934x: Initialize the parent DMA mask to suppress "DMA
     mask not set" warnings on child devices
   - Qualcomm WCD934x: Pass the valid device pointer to
     `dev_err_probe()` on IRQ lookup failure to avoid a NULL pointer
     dereference
   - Rockchip RK8xx: Register the poweroff handler in the atomic
     `SYS_OFF_MODE_POWER_OFF` phase so polling I2C transfers complete
     during shutdown
   - ST-Ericsson AB8500: Use `devm_mfd_add_devices()` to prevent leaking
     child devices on probe failure
   - TI BQ257xx: Mark self-modifying BQ25792 configuration registers as
     volatile
   - TI LM3533: Set `coherent_dma_mask` to zero to suppress "DMA mask
     not set" warnings
   - TI TPS65217: Check for errors during IRQ initialization and
     masking, and manage IRQ domain and wake teardown with devres
   - TI TWL: Unregister the auxiliary platform device via a devres
     action on probe failure and driver unbind

  Cleanups & Refactoring
   - Core: Convert drivers from deprecated `SIMPLE_DEV_PM_OPS()` to
     `DEFINE_SIMPLE_DEV_PM_OPS()` and `pm_sleep_ptr()`
   - Core: Fix spelling mistakes in comments across various MFD drivers
     and headers
   - Maintainers: Add ROHM BD73800 PMIC files under the ROHM PMIC entry
   - Maintainers: Specify the `for-mfd-next` branch for the MFD and
     Syscon git trees
   - Dialog DA9062: Use `DEFINE_RES_IRQ_NAMED()` for IRQ resource
     definitions
   - Intel LPSS: Simplify DebugFS handling by dropping redundant error
     checks and intermediate dentry variables, using octal permissions,
     and switching to
    `debugfs_remove()`
   - Khadas MCU: Convert MFD cell arrays to `const` and use
     `MFD_CELL_NAME()`
   - ST-Ericsson AB8500: Fix a spelling typo in a comment
   - TI LM3533: Convert from platform data to Device Tree bindings and
     pass only regmap and light sensor presence to child devices
   - TI LM3533: Remove driver-specific regmap wrappers, redundant pdata
     helpers, and unnecessary `extern` qualifiers, and use `dev_groups`
     for sysfs attributes
   - Wolfson WM831x: Fix a spelling typo in a comment

  Device Tree Binding Updates
   - HiSilicon Hi6421 SPMI: Fix the compatible string to match
     `hisilicon,hi6421-spmi`
   - MediaTek MT6357: Allow an `adc` child node
   - MediaTek MT6360: Allow two-cell interrupt specifiers with trigger
     flags
   - MediaTek MT6397: Document the `#sound-dai-cells` property
   - MediaTek MT6397: Document the battery-backed NVMEM layout under the
     RTC child node
   - MediaTek MT6397: Document the MT6323 PMIC EFUSE child node
   - Motorola CPCAP: Convert MFD and power button bindings to DT schema
     and document the Mapphone and Mot compositions
   - Qualcomm SPMI PMIC: Document the PM4125 audio codec compatible
   - Qualcomm SPMI PMIC: Document the PMAU0102 PMIC compatible
   - Qualcomm TCSR: Document the MSM8952 TCSR compatible
   - Rockchip RK805: Fold the pin controller binding into the RK805 PMIC
     DT schema
   - ROHM BD73800: Document the BD73800 PMIC and its regulators
   - ROHM PMIC: Factor out common pin properties into
     `rohm,pmic-pins.yaml` and reference them across BD71815, BD71828,
     and BD72720 bindings
   - ST-Ericsson AB8500: Document AB8500 and AB8505 buck converter
     regulators
   - ST-Ericsson AB8500: Document codec audio graph ports, sound DAI
     cells, and analog microphone wiring properties
   - ST-Ericsson DB8500 PRCMU: Deprecate the `db8500-prcmu-regulators`
     child node and make it optional
   - Syscon: Document the Ambarella CV75 secure scratchpad compatible
   - TI BQ25703A: Add the BQ25798 compatible with fallback to BQ25792
   - TI Keystone: Convert Device State Control bindings to DT schema
   - TI LM3533: Document the LM3533 LED controller, backlight, and
     indicator LED bindings
   - TI LP3943: Convert MFD and PWM bindings to DT schema
   - TI TPS61050: Convert bindings to DT schema
   - TI TPS65086: Make the `regulators` child node optional
   - TI TPS65910: Document `wakeup-source` and GPIO hog child nodes
   - TI TWL6040: Convert bindings to DT schema and align property names
     with the driver
   - X-Powers AC200: Document the AC200 mixed-signal companion IC"

* tag 'mfd-next-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (74 commits)
  dt-bindings: mfd: db8500-prcmu: Deprecate EPOD regulators
  dt-bindings: mfd: syscon: Add Ambarella CV75 secure scratchpad
  dt-bindings: mfd: rockchip,rk805: Convert pinctrl to DT schema
  mfd: intel-lpss: Add Dell Latitude 7275 to the resource conflict quirk
  mfd: intel-lpss: Add resource conflict quirk for Dell Latitude 5285
  mfd: tps65217: Use devres for IRQ domain and wake teardown
  mfd: tps65217: Check return value when masking interrupt sources
  mfd: tps65217: Fix NULL pointer dereference on IRQ init failure
  dt-bindings: mfd: qcom,spmi-pmic: Add compatibles for pm4125-codec
  mfd: bq257xx: Mark self-modifying BQ25792 registers volatile
  dt-bindings: mfd: mediatek: mt6397: describe the RTC's nvmem layout
  mfd: mt6397-core: Add mt6397 AUXADC support
  mfd: max77705: Mark PASS2 revision as supported
  mfd: ab8500: Fix child device leaks on probe failure
  dt-bindings: mfd: Add MT6397 sound DAI cells
  dt-bindings: mfd: mediatek: mt6397: Add mt6323 PMIC EFUSE
  dt-bindings: mfd: hisilicon: Fix Hi6421 SPMI compatible
  dt-bindings: mfd: ti,bq25703a: Expand to include BQ25798
  dt-bindings: mfd: Allow MT6360 interrupt flags
  dt-bindings: mfd: mediatek: Allow MT6357 ADC
  ...
2026-10-26 08:38:17 -10:00
Wang Haoran
01d1204582 fbdev: atmel_lcdfb: fix list_first_entry() on possibly empty modelist in probe
list_first_entry() does not return NULL on an empty list; it returns a
bogus pointer computed by container_of() from the list head.
atmel_lcdfb_probe() initializes info->modelist with INIT_LIST_HEAD()
and later takes its first entry with list_first_entry(), assuming
atmel_lcdfb_of_init() populated it. However, atmel_lcdfb_of_init()
drops the return value of fb_add_videomode() — unlike every other
fallible call in the same function — so if fb_add_videomode() fails
(its internal kmalloc can return -ENOMEM under memory pressure or
fault injection), the list stays empty while of_init() reports
success. The probe path then dereferences the bogus pointer in
fb_videomode_to_var(&info->var, &modelist->mode). Because the bogus
pointer lands inside the contiguous fb_info allocation, this may not
fault immediately; instead it silently reads adjacent memory as a
struct fb_videomode and programs garbage timing parameters into the
LCD controller. This was found by code audit; we do not have Atmel
hardware to reproduce it.

Fix this on two levels: check the return value of fb_add_videomode()
in atmel_lcdfb_of_init() so the failure is propagated (root cause),
and use list_first_entry_or_null() in atmel_lcdfb_probe() with a NULL
check that fails probe gracefully with -EINVAL (defense in depth),
consistent with the surrounding error handling which bails out to
stop_clk.

Reported-by: Wang Haoran <haoranwangsec@gmail.com>
Reported-by: Li Ximo <lixicaicai@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Wang Haoran <haoranwangsec@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-10-25 08:57:27 +01:00
Thomas Zimmermann
d98fbdba7d vgacon: Implement struct consw.con_unblank
Implement con_unblank from struct consw with the VESA_NO_BLANKING
case from vgacon_blank(). The new function is called vgacon_unblank().
Remove the duplicated code from vgacon_blank().

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-10-25 08:36:08 +01:00
Thomas Zimmermann
aa121c4be2 sticon: Implement struct consw.con_unblank
Implement con_unblank from struct consw. The new function is called
sticon_unblank(). Remove the related code from sticon_blank().

There is no display unblanking in sticon: only return true to redraw
the console.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-10-25 08:36:08 +01:00
Thomas Zimmermann
5d1df7fae0 newport_con: Implement struct consw.con_unblank
Implement con_unblank from struct consw with the VESA_NO_BLANKING
branch from newport_blank(). Remove that code from the blank helper.

Both helpers, newport_blank() and newport_unbank(), clear or set
a single flag in a hardware register. No further VESA DPMS blanking
is supported.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-10-25 08:36:08 +01:00
Thomas Zimmermann
0cfbdd6e43 fbcon: Implement struct consw.con_unblank
Implement con_unblank from struct consw with the !blank branches from
fbcon_blank(). The new function is called fbcon_unblank(). Remove the
duplicated code from fbcon_blank().

Fbcon tracks fbdev blank state in par->blank_state using fbdev's FB_BLANK
constants. In fbcon_unblank() the stored value is always FB_BLANK_UNBLANK.
In fbcon_blank(), the new blank state is 1 + plus the VESA blank mode
given in the parameter blank.

fbcon_blank() now disables the cursor worker unconditionally.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-10-25 08:36:07 +01:00
Thomas Zimmermann
4b04dbc869 dummycon: Implement struct consw.con_unblank
Implement con_unblank from struct consw as a duplicate of con_blank.
As dummycon does not do anything, the implementation only returns
true or false to trigger a redraw (or not).

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-10-25 08:36:07 +01:00
Linus Torvalds
0dfc0090b9 fbdev fixes and cleanups for 7.4-rc1:
Fixes:
 - core: initialize modelist in framebuffer_alloc()
 - core: bitblit: fix glyph clipping when fbcon pans
 - fbcon: restore font geometry if font rotation fails
 - sh_mobile_lcdcfb: restore the per-overlay sysfs attributes
 - udlfb: don't rebuild the mode list while the framebuffer is in use
 - atmel_lcdfb: prevent FIFO work after removal
 
 Cleanups:
 - vt, fbcon, vgacon: cursor code rework & cleanups
 - MAINTAINERS: name the deller/linux-fbdev for-next branch
 - drop unused FB_IOMEM_HELPERS_DEFERRED Kconfig option
 - acornfb: remove unused code
 - atafb: fix sparse warnings and avoid casts
 - sstfb: use managed PCI device enable
 - gxt4500, kyro, nvidia: release write-combining handle on probe failure
 - various drivers: typo fixes in comments
 - various drivers: fix error path on fb_deferred_io_init() failure
 - various drivers: use FB blanking constants instead of VESA constants
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQS86RI+GtKfB8BJu973ErUQojoPXwUCatp6agAKCRD3ErUQojoP
 XxeEAQCwaTwk3BQIuOi+UAGANLrLKTPkgEoTluPAhgfBYRoObgD/QJPzhRMFts1h
 Lxyrap4AJqTy3webD3PhYCqN8m2sYAE=
 =qS61
 -----END PGP SIGNATURE-----

Merge tag 'fbdev-for-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev

Pull fbdev updates from Helge Deller:
 "A whole lot of small fixes all over many drivers, but the majority of
  changes are related to code cleanups regarding the cursor handling in
  vt and fbcon.

  Fixes:
   - core: initialize modelist in framebuffer_alloc()
   - core: bitblit: fix glyph clipping when fbcon pans
   - fbcon: restore font geometry if font rotation fails
   - sh_mobile_lcdcfb: restore the per-overlay sysfs attributes
   - udlfb: don't rebuild the mode list while the framebuffer is in use
   - atmel_lcdfb: prevent FIFO work after removal

  Cleanups:
   - vt, fbcon, vgacon: cursor code rework & cleanups
   - MAINTAINERS: name the deller/linux-fbdev for-next branch
   - drop unused FB_IOMEM_HELPERS_DEFERRED Kconfig option
   - acornfb: remove unused code
   - atafb: fix sparse warnings and avoid casts
   - sstfb: use managed PCI device enable
   - gxt4500, kyro, nvidia: release write-combining handle on probe failure
   - various drivers: typo fixes in comments
   - various drivers: fix error path on fb_deferred_io_init() failure
   - various drivers: use FB blanking constants instead of VESA constants"

* tag 'fbdev-for-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: (53 commits)
  fbdev: xilinxfb: Use FB blanking constants
  fbdev: platinumfb: Use FB blanking constants
  fbdev: sa1100fb: Remove comment on VESA DPMS modes
  fbdev: i810fb: Use FB blanking constants
  fbdev: au1100fb: Use FB blanking constants
  fbcon: Retry rotated font allocation after failure
  fbcon: Rebuild rotated font buffer on font change
  fbcon: Include font geometry in the rotated font cache
  fbdev: bitblit: Fix glyph clipping when fbcon pans
  fbcon: Replace fbcon_fill_cursor_mask() with fbcon_cursor_glyph()
  lib/fonts: Add font_glyph_cursor() helper
  vgacon: Use vt_cursor_{start,end}()
  vgacon: Remove trailing whitespaces
  vt: Add cursor-size helpers
  MAINTAINERS: name the deller/linux-fbdev for-next branch
  fbdev: atafb: avoid cast when assigning buffer address pointer
  fbdev: atafb: fix sparse warnings
  fbdev: atyfb_base: fix typos in comments
  fbdev: aty128fb: fix typos in comments
  fbdev: mach64: fix typos in comments
  ...
2026-10-24 19:11:27 -10:00
Lorenzo Stoakes (ARM)
19458d015f fbdev: defio: assert FBINFO_VIRTFB, drop VM_IO, add VM_MIXEDMAP
Currently all drivers which use defio allocate system memory. All of them
also set FBINFO_VIRTFB, other than ssd1307fb, however this driver allocates
system RAM, so simply failed to set this flag when it ought to.

This patch sets FBINFO_VIRTFB on ssd1307fb probe, then drops setting VM_IO
in fb_deferred_io_mmap() and instead requires FBINFO_VIRTFB to be set,
erroring out with a kernel warning if not.

The logic requires a page from the driver and since commit 1ecbc7dd29
("fbdev/deferred-io: Always call get_page() for framebuffer pages") has
always required it to be refcounted, so this was implicitly already the
case.

Finally this patch sets VM_MIXEDMAP, as the logic is mapping
kernel-allocated memory so this is appropriate.

Link: https://lore.kernel.org/20261013-b4-mmap-prepare-vma-flag-sanify-v6-19-1aa3c9b139f9@kernel.org
Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Suren Baghdasaryan <surenb@google.com>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: Pedro Falcato <pfalcato@suse.de>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Leon Romanovsky <leon@kernel.org>
Cc: Paul Moore <paul@paul-moore.com>
Cc: Stephen Smalley <stephen.smalley.work@gmail.com>
Cc: Jaroslav Kysela <perex@perex.cz>
Cc: Takashi Iwai <tiwai@suse.com>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Andrii Nakryiko <andrii@kernel.org>
Cc: Eduard Zingerman <eddyz87@gmail.com>
Cc: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Cc: Zi Yan <ziy@nvidia.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Nico Pache <nico.pache@linux.dev>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Barry Song <baohua@kernel.org>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Usama Arif <usama.arif@linux.dev>
Cc: Kiryl Shutsemau <kas@kernel.org>
Cc: Doug Gilbert <dgilbert@interlog.com>
Cc: James Bottomley <james.bottomley@hansenpartnership.com>
Cc: Martin K. Petersen <mkp@kernel.org>
Cc: Simona Vetter <simona@ffwll.ch>
Cc: Helge Deller <deller@gmx.de>
Cc: Sebastian Reichel <sre@kernel.org>
Cc: John Hubbard <jhubbard@nvidia.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@kernel.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Rik van Riel <riel@surriel.com>
Cc: Harry Yoo <harry@kernel.org>
Cc: Juri Lelli <juri.lelli@redhat.com>
Cc: Vincent Guittot <vincent.guittot@linaro.org>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Maxime Ripard <mripard@kernel.org>
Cc: David Airlie <airlied@gmail.com>
Cc: Will Deacon <will@kernel.org>
Cc: Aneesh Kumar K.V <aneesh.kumar@kernel.org>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Jan Kara <jack@suse.cz>
Cc: Marc Zyngier <maz@kernel.org>
Cc: Oliver Upton <oupton@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Madhavan Srinivasan <maddy@linux.ibm.com>
Cc: Anup Patel <anup@brainfault.org>
Cc: Paul Walmsley <pjw@kernel.org>
Cc: Palmer Dabbelt <palmer@dabbelt.com>
Cc: Albert Ou <aou@eecs.berkeley.edu>
Cc: Christian Borntraeger <borntraeger@linux.ibm.com>
Cc: Janosch Frank <frankja@linux.ibm.com>
Cc: Claudio Imbrenda <imbrenda@linux.ibm.com>
Cc: Alexander Gordeev <agordeev@linux.ibm.com>
Cc: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
Cc: Heiko Carstens <hca@linux.ibm.com>
Cc: Vasily Gorbik <gor@linux.ibm.com>
Cc: David S. Miller <davem@davemloft.net>
Cc: Andreas Larsson <andreas@gaisler.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Joshua Hahn <joshua.hahnjy@gmail.com>
Cc: Rakie Kim <rakie.kim@sk.com>
Cc: Byungchul Park <byungchul@sk.com>
Cc: Gregory Price <gourry@gourry.net>
Cc: Ying Huang <ying.huang@linux.alibaba.com>
Cc: Alistair Popple <apopple@nvidia.com>
Cc: Chris Li <chrisl@kernel.org>
Cc: Kairui Song <kasong@tencent.com>
Cc: Kemeng Shi <shikemeng@huaweicloud.com>
Cc: Nhat Pham <nphamcs@gmail.com>
Cc: Baoquan He <baoquan.he@linux.dev>
Cc: Youngjun Park <youngjun.park@lge.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Qi Zheng <qi.zheng@linux.dev>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Yuanchu Xie <yuanchu@google.com>
Cc: Wei Xu <weixugc@google.com>
Cc: Chengming Zhou <chengming.zhou@linux.dev>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Miklos Szeredi <miklos@szeredi.hu>
Cc: Xu Xin <xu.xin@linux.dev>
Cc: Ihor Solodrai <ihor.solodrai@linux.dev>
Cc: Bert Karwatzki <spasswolf@web.de>
2026-10-24 01:56:15 -07:00
Baoquan He
5f0f758d36 fbdev: fsl-diu-fb: don't use GFP_DMA when calling dmam_alloc_coherent()
dmam_alloc_coherent() allocates the DMA buffer with the device's
addressing limitation in mind; the DMA core picks the zone from the
device's coherent DMA mask and ignores GFP_DMA passed by the caller. 
Remove the redundant GFP_DMA flag.

Link: https://lore.kernel.org/20260903111836.1777265-6-hebaoquan@kylinos.cn
Signed-off-by: Baoquan He <hebaoquan@kylinos.cn>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Harry Yoo <harry@kernel.org>
2026-10-24 01:55:59 -07:00
Linus Torvalds
5b0764a532 drm next for 7.4-rc1
rust:
 - I/O tree shared with driver-core
 - DMA tree shared with driver-core
 - allow aux registration data closures to return covariant
   sub-fields
 - Implement Send and Sync for MapleTree
 - add pci resource flags and IORESOURCE_MEM_64
 
 drm/rust:
 - add dma_fence abstraction
 - init DRM registrations and their data in place
 - drop unused flags argument to registration
 
 vgaarb:
 - rework API to pass a private ptr instead of pci device
 sound:
 - adapt to omapdrm changes
 
 gem:
 - add callback for handle count going to 0
 
 gpusvm:
 - share one HMM fault and keep single mappings inline
 
 pagemap:
 - Prevent CPU stalls during unbounded pagemap teardown
 
 dma-fence:
 - fix docs
 
 vga_switcheroo:
 - disconnect from fbcon
 - update fbcon from within fbdev emulation
 
 atomic:
 - move DRM from state reset callbacks to atomic_create_state
 - remove drm_simple_encoder_init
 
 panic:
 - split into core and helpers
 
 buddy:
 - improve dirty tracking
 
 clients:
 - improve vmap handling
 - fbdev: Move helpers from drm_kms_helper.ko to drm_client_lib.ko
 
 display:
 - export HDMI SCDC status data via debugfs
 - rework SCDC for better HDMI 2.0 support
 - dp/mst: improve DPCD compliance
 
 edid:
 - parse AMD VSDB
 - parse ALLM/VRR capabilities
 - support detecting panel size
 
 log:
 - add drm_warn_ratelimited
 
 sched:
 - cleanup interface
 - add missing locking
 - fix run-queue cleanup
 - fix locking
 
 sysfb:
 - remove obsolete quirk for Lenovo D330
 - fix panel orientation for non-native display modes
 - drop drm_class_device_register
 
 colorop:
 - provide DRM_COLOR_OP_FIXED_MATRIX
 
 bridge:
 - analogix: Support eDP lane mapping
 - ti-sn65dsi83: Support LVDS Channel B on SN65DSI84
 - Select DRM_PANEL_BRIDGE for various drivers that require it
 - add chrontel ch7218a support
 
 panel:
 - panel-edp: Support MNE007QS3-F, TM140VDXP15, and KD116N36-30NB-A001
 - samsung-s6d16d0: Use mipi_dsi_*_multi() functions
 - support Ilitek ILI7836A OLED plus DT bindings
 - support Novatek NT36532 plus DT bindings
 - convert several drivers to managed cleanup
 - fix Kconfig selections
 - edp: Add support for BOE NV140FHM-T0A
 - samsung: Share test-key helpers
 - edp: Support CSOT MNE007QB1-1
 - ebbg-ft8719: Fix MODULE_LICENSE() string; Improve initialization
 - edp: NV140WU2-M70
 - ilitek-ili9882t: Support Ilitek IL79600A plus DT bindings
 - simple: Support Truly TFT320240-229-E plus DT bindings; Support BOE
   DV215FHM-R01 plus DT bindings
 - Refactor struct drm_panel to contain struct drm_bridge plus fallout in
   various panel drivers
 - Add support for BOE Novatek NT51021, Retroid Pocket 6,
   Raydium RM69220 DDIC panels, Sharp LQ138P1JX61 eDP,
   BOE NV140FHD-N43, AUO B140HAN04.0, AUO 0x0db3,
   panels.
 
 amdgpu:
 - use AMD VSDB for freesync
 - implement YUV-to-RGB with fixed-matrix colorop
 - enable FRL for HDMI
 - HDMI 2.1 freesync support
 - HDMI 2.1 ALLM support
 - HDMI 2.1 VRR support
 - UALoE (UALink over Ethernet) support
 - add syncobj_points to userq signal ioctl
 - drop unused kunit tests
 - NBIO/GC/MMHUB/SMU updates/fixes
 - GPU spatial partitioning updates
 - display kunit fixes
 - userq fixes
 - RGB quantization fixes
 - DC RMCM refactor
 - DP MST fixes
 - USB4 fixes
 - add new trace events
 - Rework display instance handling
 - stack frame size fixes for various compilers/configs
 - VCN 4/5 reset fixes
 - freesync updates
 - cursor refactor
 - Fix direct scanout alpha on some DRM_FORMATs
 - Expand Mac reserved memory workaround
 - Make runtime pm more fine grained
 
 amdkfd:
 - updates and fixes
 - GC 10 CU occupancy support
 
 radeon:
 - eDP fix for DCE3.2 iMacs
 
 xe:
 - add drm_ras netlink error event support
 - add memory page offlining support
 - introduce error threshold to drm_ras
 - fix stale GTT mappings on unmap
 - reject page faults for non-page fault mode scratch VM
 - enable CRI package and VRAM temperatures
 - introduce cold reset recovery
 - handle CRI+ power interval encoding
 - VF migration for multi-queue
 - handle exec queue teardown after hot unplug
 - alerts and controller enabling modifications
 - use IBCv3 on PTL
 - VRAM health check
 - report GT TDR and VM rebind faults using SIGID
 - add multi_queue_active_lrca debugfs
 - shrinker: Runtime PM reference for non-system memory
 - guc: Add simple KLV decoder helpers
 - debugfs: Expose per-engine idle status
 - Keep walking on SVM eviction failure
 - Nuke PTs only after unlinking contested VMAs
 - limit sg segment size to PAGE_SIZE on Xen PV
 - keep VF LMEM bar size low if no VFs
 - CPU binds and ULLS on migration queue
 - New PTL PCI ID
 - Enable PXP for NVL-S
 - Do not dma_fence_put zero fences in err_out path
 - Refresh TTM LRU on SVM prefetch
 - export device UID in sysfs
 
 i915:
 - rename GEN6_PCODE_DATA to match spec
 - fix incorrect RCU teardown order
 - fix potential UAF in command parsing
 - avoid WARN splat during RPS boosting race
 - use simpler min functions
 - Fixes to make i915 work well with PREEMPT_RT
 
 i915/display:
 - Enable CMRR (Content Match Refresh Rate) in fixed-RR VRR path
 - Switch DG2 MPLL to DPLL framework
 - DP-HDMI PCON DSC fixes
 - limit invalid joiner combinations
 - CDCLK related fixes and refactor around PCODE integration
 - Gate UHBR SST SDP splitting on sink caps
 - add HDMI TMDS audio bandwidth check
 - vswing/preemph override
 - enable AS SDP Skip frames
 - Handle negative configuration index on DP link caps for robustness
 - Preparation for enabling SDR plane color pipeline
 - An eDP quirk for HP Pavilion Plus
 - Introduce PME (Power Management Event) support on display hotplug
 - Handle VSC SDP revision 7 in unpack
 
 msm:
 - CI:
   - Dropped sc7180 trogdor lazor from the CI
 - Core:
   - Fixed msm_ioremap for resources without a name
   - Changed msm.separate_gpu_kms to default to auto selection
 - GPU:
   - Enable CLX (Current Limit eXtension) for gen8 to avoid
     exceeding limits on CX/GX rails
   - New GPUs: a830 (Pakala), a845 (Maili), a850 (Hawi),
     x2-85 (Mahua)
   - Fix VBIF halt mask on a306, which was preventing runpm
     suspend
   - Enable THP support for GEM buffers
   - Add modparam to disable waiting on fences in shrinker
   - Drop use of drm_prime_sg_to_page_array()
   - a5xx: don't read the GPMU registers on GPUs without a GPMU
   - a2xx/a3xx/a5xx: hangcheck progress detection
   - a6xx: gmuwrapper runpm fix
   - Calculate reported GMEM size based on active slices
   - Split a6xx/a7xx/a8xx catalog
 - DP:
   - Picked up some preparation patches for the MST support
   - Fixed reported status of the link training
 - DPU:
   - Fixed CRTC bandwidth computation
   - Fixed DSC programming
   - Fixed encoder disablement path
 - DSI:
   - Fixed VM leak in error path
   - Indention fix
 - MDP5:
   - Added MSM8952 configuration
   - Dropped incorrect cursor pipe on MSM8976/56
 - HDMI:
   - Small fixes
 
 nouveau:
 - improve runtime PM on R570 GSP firmware
 - various fixes throughout the driver
 - dispnv50: support 2.147 GHz pixel clock in GB20x
 
 nova:
 - add initial uapi concept
 - add initial PRAMIN access support
 - add GpuMm centralized memory manager
 - add GPU VM and BAR1 support
 - add GPU interrupts and GSP events support
 - GSP messaging fixes
 
 tyr:
 - use bitfield!
 - zero unsupported and newly added GPU info fields
 - limit doorbell array to 17 entries
 
 exynos:
 - FIMD fixes
   - Fix clock leak on resume error path.
   - Fix Sparse warnings by adding missing __iomem annotation.
 - VIDI cleanup
   - Replace kmalloc() and copy_from_user() with memdup_user().
 
 amdxdna:
 - fix BO handling
 - Support AIE2 rev 9
 - Fix UAF access in scheduler fences
 - Update workqueue interface
 - expose busy time via fdinfo
 
 ast:
 - support 256-byte EDID
 
 hyperv_drm:
 - remove support for pre win10 hosts
 
 komeda:
 - fix GLB_CORE_ID usage
 
 omap:
 - report HDMI hotplug events to ASoC HDMI codec
 
 panthor:
 - provide gpu_cache_flush tracepoint
 - improve dma_fence signalling latency
 - improve locking
 - export scheduling information via debugfs
 - Validate user-space input against firmware limits
 
 qaic:
 - reject BOs that exceed maximum page count
 - add missing include statements
 
 verisilicon:
 - fix hardware cursor offsets
 
 vkms:
 - implement YUV-to-RGB with fixed-matrix colorop
 
 gma500:
 - avoid unsupported ARGB formats in primary plane
 
 hibmc:
 - handle vblank interrupts correctly
 
 ivpu:
 - add DRM_IVPU_CAP_CMDQ_SET_PRIORITY
 - support command-queue priority ioctl
 - Simplify NULL-pointer handling in cleanup code
 
 arcpgu:
 - replace simple-display pipeline with regular atomic helpers
 
 aspeed:
 - replace simple-display pipeline with regular atomic helpers
 
 gm12u320:
 - replace simple-display pipeline with regular atomic helpers
 
 imagination:
 - various improvement to firmware interaction
 - add job to pvr_job_submit_fw trace event
 
 mali-dp:
 - fix runtime PM leak
 
 mcde:
 - replace simple-display pipeline with regular atomic helpers
 
 p111:
 - replace simple-display pipeline with regular atomic helpers
 - drop unsupported alpha formats from primary plane
 
 rcar-du:
 - support Renesas R-Car V4H DSC
 - dsi: Support larger transfers with AXI memory
 - Support RZ/G3L SoC
 
 repaper:
 - replace simple-display pipeline with regular atomic helpers
 
 rockchip:
 - dsi: improve PHY timings
 
 ssd130x:
 - support Solomon SSD1351 OLED plus DT bindings
 - ssd133x: upgrade color format to RGB565
 - ssd132x: Set correct hardware window when clearing screen
 
 tve200:
 - replace simple-display pipeline with regular atomic helpers
 
 xen:
 - replace simple-display pipeline with regular atomic helpers
 
 v3d:
 - improve job handling under perfmon
 
 vc4:
 - reliably reset V3D
 - drop brcm,vc4-v3d compatible
 
 virtio:
 - fix damage handling
 - Support ARGB8888 for virtio primary planes.
 
 host1x:
 - Support partitioning
 
 imx:
 - Replace simple-display with regular atomic helpers
 
 mxsfb:
 - Support bus formats plus DT bindings
 
 tegra:
 - improve syncobj handling on submit
 
 panfrost:
 - add Mali-G68 support
 - improve GPU reset handling
 
 rockchip:
 - add HDMI 2.0 support to dw-hdmi-qp
 - improve HPD handling
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmrYXp8ACgkQDHTzWXnE
 hr4FZQ//TTxnbkFAcyHBhLHLfGrUk2tyDdBR3RL+89PVR+K/XB4thjxQnS0IuF9I
 NM9KB+Fa1PYOlnvKOAbKBqB8m4E+ATBmkzZ1nbY4DDvIPPZMTIF27yD5OJI/GoP7
 zvDTgGLK3oeXCydjUM7R3jXD7gjJ4KOe82Um1TWxCmpwMU4P8/5u3/lzfz8Lxael
 XLwnp1t/tjCWtxlrok1t3XjNkUv0PiGuA9YQvbXEV2wArguhNUcMtwFfBcuOCCf/
 eo9k29l0/lJgg8oFAOiLXxQbjcDqbF2NzHZbrBAWaZ50Wkzx2xv/WRLog6NT/ziN
 ScrdzVVgiAvhERaSmFT3eZxqy7g1pvHpej9KGsbqVqpxWdZeGMO9zSa52SqN62P6
 YeqDr5IGyi6HAstcSSwtE/UByEftTGJfUDytASugzOZOFFvj4M0ITBT9ElYtdL2c
 aSn/M30JFmV4i1C+jKFxteBJOqurF+p/CqdqxmHSz6sLcsgzHThMknGMoZYlIvUR
 0xewU7BFjUz4dT1r2UI+5GGV8Yibt4keyi00CitL+KWhTGcsGz8eLYXwtzbAU3Lb
 DlbV/gU77dHAI7yKz00BNLoVnRBRpzZRoPQmS0kRWpxHDu3WMksCLYNMQ1VL/DiC
 PyYIFK77SC8k+CnzKYLwP27zzEIS4pNrncBlp41g/Fj4tyzf4gc=
 =PWSa
 -----END PGP SIGNATURE-----

Merge tag 'drm-next-2026-10-21' of https://gitlab.freedesktop.org/drm/kernel

Pull drm updates from Dave Airlie:
 "Highlights:

   - core: a lot of atomic refactoring in progress, panic got split into
     a core/helpers model

   - amdgpu: enables HDMI 2.1 FRL and other good things finally, UAlink
     over Ethernet support

   - xe: has a bunch of CRI support, ras error for bad vram, memory
     offlining support.

   - msm: enables a bunch more GPUs.

  Otherwise it's a the usual mountain of stuff all over the place.
  Details:

  rust:
   - I/O tree shared with driver-core
   - DMA tree shared with driver-core
   - allow aux registration data closures to return covariant sub-fields
   - Implement Send and Sync for MapleTree
   - add pci resource flags and IORESOURCE_MEM_64

  drm/rust:
   - add dma_fence abstraction
   - init DRM registrations and their data in place
   - drop unused flags argument to registration

  vgaarb:
   - rework API to pass a private ptr instead of pci device

  sound:
   - adapt to omapdrm changes

  gem:
   - add callback for handle count going to 0

  gpusvm:
   - share one HMM fault and keep single mappings inline

  pagemap:
   - Prevent CPU stalls during unbounded pagemap teardown

  dma-fence:
   - fix docs

  vga_switcheroo:
   - disconnect from fbcon
   - update fbcon from within fbdev emulation

  atomic:
   - move DRM from state reset callbacks to atomic_create_state
   - remove drm_simple_encoder_init

  panic:
   - split into core and helpers

  buddy:
   - improve dirty tracking

  clients:
   - improve vmap handling
   - fbdev: Move helpers from drm_kms_helper.ko to drm_client_lib.ko

  display:
   - export HDMI SCDC status data via debugfs
   - rework SCDC for better HDMI 2.0 support
   - dp/mst: improve DPCD compliance

  edid:
   - parse AMD VSDB
   - parse ALLM/VRR capabilities
   - support detecting panel size

  log:
   - add drm_warn_ratelimited

  sched:
   - cleanup interface
   - add missing locking
   - fix run-queue cleanup
   - fix locking

  sysfb:
   - remove obsolete quirk for Lenovo D330
   - fix panel orientation for non-native display modes
   - drop drm_class_device_register

  colorop:
   - provide DRM_COLOR_OP_FIXED_MATRIX

  bridge:
   - analogix: Support eDP lane mapping
   - ti-sn65dsi83: Support LVDS Channel B on SN65DSI84
   - Select DRM_PANEL_BRIDGE for various drivers that require it
   - add chrontel ch7218a support

  panel:
   - panel-edp: Support MNE007QS3-F, TM140VDXP15, and KD116N36-30NB-A001
   - samsung-s6d16d0: Use mipi_dsi_*_multi() functions
   - support Ilitek ILI7836A OLED plus DT bindings
   - support Novatek NT36532 plus DT bindings
   - convert several drivers to managed cleanup
   - fix Kconfig selections
   - edp:
      - Add support for BOE NV140FHM-T0A
      - Support CSOT MNE007QB1-1
      - NV140WU2-M70
   - ebbg-ft8719: Fix MODULE_LICENSE() string; Improve initialization
   - samsung: Share test-key helpers
   - ilitek-ili9882t: Support Ilitek IL79600A plus DT bindings
   - simple: Support Truly TFT320240-229-E plus DT bindings; Support BOE
     DV215FHM-R01 plus DT bindings
   - Refactor struct drm_panel to contain struct drm_bridge plus fallout
     in various panel drivers
   - Add support for BOE Novatek NT51021, Retroid Pocket 6, Raydium
     RM69220 DDIC panels, Sharp LQ138P1JX61 eDP, BOE NV140FHD-N43, AUO
     B140HAN04.0, AUO 0x0db3, panels.

  amdgpu:
   - use AMD VSDB for freesync
   - implement YUV-to-RGB with fixed-matrix colorop
   - enable FRL for HDMI
   - HDMI 2.1 freesync support
   - HDMI 2.1 ALLM support
   - HDMI 2.1 VRR support
   - UALoE (UALink over Ethernet) support
   - add syncobj_points to userq signal ioctl
   - drop unused kunit tests
   - NBIO/GC/MMHUB/SMU updates/fixes
   - GPU spatial partitioning updates
   - display kunit fixes
   - userq fixes
   - RGB quantization fixes
   - DC RMCM refactor
   - DP MST fixes
   - USB4 fixes
   - add new trace events
   - Rework display instance handling
   - stack frame size fixes for various compilers/configs
   - VCN 4/5 reset fixes
   - freesync updates
   - cursor refactor
   - Fix direct scanout alpha on some DRM_FORMATs
   - Expand Mac reserved memory workaround
   - Make runtime pm more fine grained

  amdkfd:
   - updates and fixes
   - GC 10 CU occupancy support

  radeon:
   - eDP fix for DCE3.2 iMacs

  xe:
   - add drm_ras netlink error event support
   - add memory page offlining support
   - introduce error threshold to drm_ras
   - fix stale GTT mappings on unmap
   - reject page faults for non-page fault mode scratch VM
   - enable CRI package and VRAM temperatures
   - introduce cold reset recovery
   - handle CRI+ power interval encoding
   - VF migration for multi-queue
   - handle exec queue teardown after hot unplug
   - alerts and controller enabling modifications
   - use IBCv3 on PTL
   - VRAM health check
   - report GT TDR and VM rebind faults using SIGID
   - add multi_queue_active_lrca debugfs
   - shrinker: Runtime PM reference for non-system memory
   - guc: Add simple KLV decoder helpers
   - debugfs: Expose per-engine idle status
   - Keep walking on SVM eviction failure
   - Nuke PTs only after unlinking contested VMAs
   - limit sg segment size to PAGE_SIZE on Xen PV
   - keep VF LMEM bar size low if no VFs
   - CPU binds and ULLS on migration queue
   - New PTL PCI ID
   - Enable PXP for NVL-S
   - Do not dma_fence_put zero fences in err_out path
   - Refresh TTM LRU on SVM prefetch
   - export device UID in sysfs

  i915:
   - rename GEN6_PCODE_DATA to match spec
   - fix incorrect RCU teardown order
   - fix potential UAF in command parsing
   - avoid WARN splat during RPS boosting race
   - use simpler min functions
   - Fixes to make i915 work well with PREEMPT_RT

  i915/display:
   - Enable CMRR (Content Match Refresh Rate) in fixed-RR VRR path
   - Switch DG2 MPLL to DPLL framework
   - DP-HDMI PCON DSC fixes
   - limit invalid joiner combinations
   - CDCLK related fixes and refactor around PCODE integration
   - Gate UHBR SST SDP splitting on sink caps
   - add HDMI TMDS audio bandwidth check
   - vswing/preemph override
   - enable AS SDP Skip frames
   - Handle negative configuration index on DP link caps for robustness
   - Preparation for enabling SDR plane color pipeline
   - An eDP quirk for HP Pavilion Plus
   - Introduce PME (Power Management Event) support on display hotplug
   - Handle VSC SDP revision 7 in unpack

  msm:
   - CI:
      - Dropped sc7180 trogdor lazor from the CI
   - Core:
      - Fixed msm_ioremap for resources without a name
      - Changed msm.separate_gpu_kms to default to auto selection
   - GPU:
      - Enable CLX (Current Limit eXtension) for gen8 to avoid exceeding
        limits on CX/GX rails
      - New GPUs: a830 (Pakala), a845 (Maili), a850 (Hawi), x2-85
        (Mahua)
      - Fix VBIF halt mask on a306, which was preventing runpm suspend
      - Enable THP support for GEM buffers
      - Add modparam to disable waiting on fences in shrinker
      - Drop use of drm_prime_sg_to_page_array()
      - a5xx: don't read the GPMU registers on GPUs without a GPMU
      - a2xx/a3xx/a5xx: hangcheck progress detection
      - a6xx: gmuwrapper runpm fix
      - Calculate reported GMEM size based on active slices
      - Split a6xx/a7xx/a8xx catalog
   - DP:
      - Picked up some preparation patches for the MST support
      - Fixed reported status of the link training
   - DPU:
      - Fixed CRTC bandwidth computation
      - Fixed DSC programming
      - Fixed encoder disablement path
   - DSI:
      - Fixed VM leak in error path
      - Indention fix
   - MDP5:
      - Added MSM8952 configuration
      - Dropped incorrect cursor pipe on MSM8976/56
   - HDMI:
      - Small fixes

  nouveau:
   - improve runtime PM on R570 GSP firmware
   - various fixes throughout the driver
   - dispnv50: support 2.147 GHz pixel clock in GB20x

  nova:
   - add initial uapi concept
   - add initial PRAMIN access support
   - add GpuMm centralized memory manager
   - add GPU VM and BAR1 support
   - add GPU interrupts and GSP events support
   - GSP messaging fixes

  tyr:
   - use bitfield!
   - zero unsupported and newly added GPU info fields
   - limit doorbell array to 17 entries

  exynos:
   - FIMD fixes
      - Fix clock leak on resume error path
      - Fix Sparse warnings by adding missing __iomem annotation
   - VIDI cleanup
      - Replace kmalloc() and copy_from_user() with memdup_user()

  amdxdna:
   - fix BO handling
   - Support AIE2 rev 9
   - Fix UAF access in scheduler fences
   - Update workqueue interface
   - expose busy time via fdinfo

  ast:
   - support 256-byte EDID

  hyperv_drm:
   - remove support for pre win10 hosts

  komeda:
   - fix GLB_CORE_ID usage

  omap:
   - report HDMI hotplug events to ASoC HDMI codec

  panthor:
   - provide gpu_cache_flush tracepoint
   - improve dma_fence signalling latency
   - improve locking
   - export scheduling information via debugfs
   - Validate user-space input against firmware limits

  qaic:
   - reject BOs that exceed maximum page count
   - add missing include statements

  verisilicon:
   - fix hardware cursor offsets

  vkms:
   - implement YUV-to-RGB with fixed-matrix colorop

  gma500:
   - avoid unsupported ARGB formats in primary plane

  hibmc:
   - handle vblank interrupts correctly

  ivpu:
   - add DRM_IVPU_CAP_CMDQ_SET_PRIORITY
   - support command-queue priority ioctl
   - Simplify NULL-pointer handling in cleanup code

  arcpgu:
   - replace simple-display pipeline with regular atomic helpers

  aspeed:
   - replace simple-display pipeline with regular atomic helpers

  gm12u320:
   - replace simple-display pipeline with regular atomic helpers

  imagination:
   - various improvement to firmware interaction
   - add job to pvr_job_submit_fw trace event

  mali-dp:
   - fix runtime PM leak

  mcde:
   - replace simple-display pipeline with regular atomic helpers

  p111:
   - replace simple-display pipeline with regular atomic helpers
   - drop unsupported alpha formats from primary plane

  rcar-du:
   - support Renesas R-Car V4H DSC
   - dsi: Support larger transfers with AXI memory
   - Support RZ/G3L SoC

  repaper:
   - replace simple-display pipeline with regular atomic helpers

  rockchip:
   - dsi: improve PHY timings

  ssd130x:
   - support Solomon SSD1351 OLED plus DT bindings
   - ssd133x: upgrade color format to RGB565
   - ssd132x: Set correct hardware window when clearing screen

  tve200:
   - replace simple-display pipeline with regular atomic helpers

  xen:
   - replace simple-display pipeline with regular atomic helpers

  v3d:
   - improve job handling under perfmon

  vc4:
   - reliably reset V3D
   - drop brcm,vc4-v3d compatible

  virtio:
   - fix damage handling
   - Support ARGB8888 for virtio primary planes.

  host1x:
   - Support partitioning

  imx:
   - Replace simple-display with regular atomic helpers

  mxsfb:
   - Support bus formats plus DT bindings

  tegra:
   - improve syncobj handling on submit

  panfrost:
   - add Mali-G68 support
   - improve GPU reset handling

  rockchip:
   - add HDMI 2.0 support to dw-hdmi-qp
   - improve HPD handling"

* tag 'drm-next-2026-10-21' of https://gitlab.freedesktop.org/drm/kernel: (2324 commits)
  drm/adp: Switch to drm_atomic_helper_connector_create_state
  drm/malidp: Convert to atomic_create_state
  drm/vc4: Switch to drm_atomic_helper_connector_create_state
  drm/sysfb: Switch to drm_atomic_helper_connector_create_state
  drm/solomon: ssd130x: Switch to drm_atomic_helper_connector_create_state
  drm/imx: ipuv3: Switch to drm_atomic_helper_connector_create_state
  drm/hyperv: Switch to drm_atomic_helper_connector_create_state
  drm/bridge: megachips: Switch to drm_atomic_helper_connector_create_state
  drm/bridge: lontium-lt8912b: Switch to drm_atomic_helper_connector_create_state
  drm/arm: komeda: Switch to drm_atomic_helper_connector_create_state
  drm/appletbdrm: Fix incorrect error message on encoder attach failure
  drm/sun4i: hdmi: Convert to drmm_connector_hdmi_init()
  drm/rockchip: rk3066_hdmi: Advertise HDMI 1.4 capabilities
  drm/bridge: lontium-lt9611: Advertise HDMI 1.4 capabilities
  drm/bridge: ite-it66121: Advertise HDMI 1.2 capabilities
  drm/bridge: ite-it6263: Advertise HDMI 1.3 capabilities
  drm/bridge: ite-it6263: Drop redundant .mode_valid hook
  drm/bridge: inno-hdmi: Advertise HDMI 1.2 capabilities
  drm/bridge: adv7511: Advertise HDMI 1.2 capabilities
  drm/sched: Document entity->stopped is protected by entity->lock
  ...
2026-10-23 18:29:02 -10:00
Linus Torvalds
c0e8d30137 Modules changes for 7.4-rc1
- Ignore local labels and mapping symbols during module load
 
   These symbols were already ignored during kallsyms address-to-symbol
   lookups. Filter them out earlier during module loading to reduce lookup
   overhead and prevent them from appearing in /proc/kallsyms.
 
 - Fix potentially incorrect access of SetOnce<T> when setting Rust module
   parameters.
 
 - Fix a potential read of an uninitialized count when printing taint
   information for unloaded modules.
 
 - Allocate the kmod argument array using kmalloc_array() in preparation
   for conversion to type-aware allocators.
 
 - Clean up includes in linux/kmod.h
 
   Add explicit includes of linux/umh.h to files that use usermode helpers.
   Then clean up the #include list in linux/kmod.h, notably removing the
   compatibility linux/umh.h include.
 
 - Remove the error-injection.h include from linux/module.h
 
   Add explicit includes of linux/error-injection.h to files that use the
   ALLOW_ERROR_INJECTION() macro and currently rely on it being provided
   indirectly via linux/module.h. Then remove the unnecessary
   linux/error-injection.h include from linux/module.h.
 
 - Replace __MODULE_STRING() with __stringify() in various drivers in
   preparation for removing the former macro.
 
 The changes to several #include lists have been reported to cause trivial
 conflicts in linux-next with the drm, drm-xe, and usb trees.
 -----BEGIN PGP SIGNATURE-----
 
 iQFkBAABCABOFiEEIduBR9MnFA82q/jtumpXJwqY6poFAmrWJvAbFIAAAAAABAAO
 bWFudTIsMi41KzEuMTIsMiwyFBxwZXRyLnBhdmx1QHN1c2UuY29tAAoJELpqVycK
 mOqalOYH/RpwszqX+OuRhf3G9IDokSZFZyiAJLZan3H7jZNb9VBVLYmTTRYF/UE4
 uXKeGAUXZOaUdhVjQi/1LqX3NbDO1NfUCM9sbk3EPal0L6ILbcmkBecXu9JXHxvB
 6sfEAdTMdAn28613wcnbjmdGfEkgHuDZqZeld4dIAtZ+GvLzFz0D+o0zkigCnT4I
 faKU9GLIHJe2Cn5FB40b1+M+IGY9t6bl2+WxVc1rd9oSZXfr8ptE7NPllhiOmOhD
 /aMVpeSlXzo8DYxIhvtZGwDh5NrJglPFdFRXYuHUDLxkWCCFtXRt//LtWv3EpKqp
 dgQUH5QAO5E/+OuycHFLaXOUiKVS0P4=
 =bCLk
 -----END PGP SIGNATURE-----

Merge tag 'modules-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux

Pull module updates from Petr Pavlu:

 - Ignore local labels and mapping symbols during module load

   These symbols were already ignored during kallsyms address-to-symbol
   lookups. Filter them out earlier during module loading to reduce
   lookup overhead and prevent them from appearing in /proc/kallsyms.

 - Fix potentially incorrect access of SetOnce<T> when setting Rust
   module parameters.

 - Fix a potential read of an uninitialized count when printing taint
   information for unloaded modules.

 - Allocate the kmod argument array using kmalloc_array() in preparation
   for conversion to type-aware allocators.

 - Clean up includes in linux/kmod.h

   Add explicit includes of linux/umh.h to files that use usermode
   helpers. Then clean up the #include list in linux/kmod.h, notably
   removing the compatibility linux/umh.h include.

 - Remove the error-injection.h include from linux/module.h

   Add explicit includes of linux/error-injection.h to files that use
   the ALLOW_ERROR_INJECTION() macro and currently rely on it being
   provided indirectly via linux/module.h. Then remove the unnecessary
   linux/error-injection.h include from linux/module.h.

 - Replace __MODULE_STRING() with __stringify() in various drivers in
   preparation for removing the former macro.

* tag 'modules-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux:
  drivers: Replace __MODULE_STRING() with __stringify()
  module: Fix uninitialized count read of unloaded taint tracking record
  rust: module_param: Fix potentially incorrect access of `SetOnce<T>`
  module: Remove the error-injection.h include from linux/module.h
  drm/xe: Include error-injection.h for ALLOW_ERROR_INJECTION()
  drm/i915: Include error-injection.h for ALLOW_ERROR_INJECTION()
  syscalls: Include error-injection.h for ALLOW_ERROR_INJECTION()
  net: Include error-injection.h for ALLOW_ERROR_INJECTION()
  block: Include error-injection.h for ALLOW_ERROR_INJECTION()
  module: Bring includes in linux/kmod.h up to date
  time/jiffies: Include linux/sysctl.h for proc_int_u2k_conv_uop(), ...
  umh, treewide: Explicitly include linux/umh.h where needed
  modules/kmod: Allocate argv with kmalloc_array()
  module/kallsyms: Ignore local labels and mapping symbols during module load
  module/kallsyms: Refactor current symbol filtering into is_core_symbol()
  module/kallsyms: Rename is_mapping_symbol() to is_ignored_kernel_symbol()
2026-10-23 09:32:44 -10:00
Thomas Zimmermann
61e1a43ca5 fbdev: xilinxfb: Use FB blanking constants
Fbdev and its drivers use FB_BLANK constants for controlling the
display's blanking state. Semantics differ to similar VESA blanking
constants.

Replace the VESA constant in xilinxfb with FB_BLANK.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-10-20 22:36:14 +02:00
Thomas Zimmermann
2439733aa5 fbdev: platinumfb: Use FB blanking constants
Fbdev and its drivers use FB_BLANK constants for controlling the
display's blanking state. Semantics differ to similar VESA blanking
constants.

Replace the VESA constants with FB_BLANK in platinumfb. The VESA
constants can be interpreted bitwise, while the FB_BLANK constants
can not. Therefore turn the bit tests in an if-else sequence that
handles the individual cases. By default, the display is unblanked.

The modified code is within a comment block, so it will not run. I
still changed it to keep the driver up to standard. This might also
resolve the nearby TODO comment on incorrect hardware blanking.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-10-20 22:36:14 +02:00
Thomas Zimmermann
a1d236fee3 fbdev: sa1100fb: Remove comment on VESA DPMS modes
Fbdev and its drivers use FB_BLANK constants for controlling the
display's blanking state. Semantics differ to similar VESA blanking
constants.

Remove the comment on VESA constants from sa1100fb. It's misleading at
best, as the driver should never use the VESA constants for blanking.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-10-20 22:36:14 +02:00
Thomas Zimmermann
baedbacdc8 fbdev: i810fb: Use FB blanking constants
Fbdev and its drivers use FB_BLANK constants for controlling the
display's blanking state. Semantics differ to similar VESA blanking
constants.

Replace the VESA constant in i810fb with FB_BLANK.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-10-20 22:36:14 +02:00
Thomas Zimmermann
8f6dd8f15e fbdev: au1100fb: Use FB blanking constants
Fbdev and its drivers use FB_BLANK constants for controlling the
display's blanking state. Semantics differ to similar VESA blanking
constants.

Replace the VESA constants in au1100fb with FB_BLANK.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-10-20 22:36:13 +02:00
Yao Yiqi
7935db1a4a fbcon: Retry rotated font allocation after failure
fbcon_rotate_font() records the font, its geometry and the rotation in
par->rotated before calling font_data_rotate(). If the allocation
fails, the error path clears par->rotated.buf, but the recorded key
already looks up to date, so the next call takes the early-out and
never retries. The rotated putcs/cursor ops keep returning early on
the NULL buffer, and the console stays blank even after memory is
available again.

Also test par->rotated.buf in the early-out, so a failed allocation
is retried on the next call: at the next fbcon_switch(),
fbcon_modechanged() or font change.

Fixes: e4ef723d89 ("fbcon: Avoid OOB font access if console rotation fails")
Cc: stable@vger.kernel.org
Signed-off-by: Yao Yiqi <yaoyiqi3@huawei.com>
Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-10-20 22:29:20 +02:00
Yao Yiqi
e4b6b865d4 fbcon: Rebuild rotated font buffer on font change
fbcon_rotate_font() caches a rotated copy of the console font in
par->rotated.buf. The buffer is sized from the font's width, height
and charcount, and is rebuilt in fbcon_init(), fbcon_switch() and
fbcon_modechanged(), but not in fbcon_do_set_font().

When the font is changed through KDFONTOP, the new geometry is
installed and vc_resize() redraws before the buffer is rebuilt. The
rotated putcs/cursor ops then index the old buffer with the new cell
size; KASAN reports a slab-out-of-bounds read in soft_cursor().

Rebuild the buffer for the visible console before the redraw, as the
other callers do: select the console's blitting state with
set_blitting_type() (which also uploads the new font's map on
tile-blitting hardware), then rebuild. Background consoles keep
their rebuild at fbcon_switch() time, as the buffer is shared per
framebuffer and must not be updated for a console that is not being
displayed.

To ensure a correct rollback when the rebuild or the following
vc_resize() fails, save the rotated font state, clear it before
rebuilding, and restore it in the error path of
fbcon_do_set_font().

Fixes: 6cc50e1c5b ("[PATCH] fbcon: Console Rotation - Add support to rotate font bitmap")
Cc: stable@vger.kernel.org
Signed-off-by: Yao Yiqi <yaoyiqi3@huawei.com>
Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-10-20 22:29:20 +02:00
Yao Yiqi
10463bcd43 fbcon: Include font geometry in the rotated font cache
fbcon_rotate_font() caches a rotated copy of the console font and
skips the rebuild when the fontdata pointer and the rotation match.
Raw font data carries no geometry, though: width, height and
charcount live in vc->vc_font. fbcon_set_font() deduplicates uploads
by byte equality, so the same bytes re-uploaded with different
dimensions keep the fontdata pointer while the geometry changes, and
the early-out skips the rebuild.

The rotated cell size depends on the geometry (rotation swaps width
and height), so the stale buffer is indexed with the new cell size.
Re-uploading a 4x16 font as 16x8 on a CW-rotated console, for
example, doubles the rotated cell size and reads past the end of the
old buffer.

Record the geometry the buffer was built from and compare it in the
early-out. The pointer-only key used to be backed by an explicit
width check in the deduplication, which commit 1e3c49aa03
("lib/fonts: Compare font data for equality with font_data_is_equal()")
dropped.

Fixes: 6cc50e1c5b ("[PATCH] fbcon: Console Rotation - Add support to rotate font bitmap")
Cc: stable@vger.kernel.org
Signed-off-by: Yao Yiqi <yaoyiqi3@huawei.com>
Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-10-20 22:29:20 +02:00
Tingjie Zhong
06fccf8406 fbdev: bitblit: Fix glyph clipping when fbcon pans
Commit 3637d34b35 ("fbdev: Add bounds checking in bit_putcs to fix
vmalloc-out-of-bounds") made bit_putcs() clip glyphs to var.yres. When
fbcon scrolls by panning, it draws text rows up to var.yres_virtual,
so after the first pan most new text is not drawn until the next full
redraw. This affects fbdev drivers that set FBINFO_HWACCEL_YPAN or
FBINFO_HWACCEL_YWRAP, such as vesafb with the ypan option, when
CONFIG_FRAMEBUFFER_CONSOLE_LEGACY_ACCELERATION=y.

Clip to GETVYRES() instead, which fbcon_ud.c and fbcon_ccw.c already
use as the drawing area height. When fbcon does not pan, GETVYRES()
returns var.yres, keeping the existing bound. When fbcon pans, it
returns var.yres_virtual, which the framebuffer memory must cover
anyway for panning to work.

Fixes: 3637d34b35 ("fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds")
Reported-by: Thomas Zimmermann <tzimmermann@suse.de>
Closes: https://lore.kernel.org/linux-fbdev/b8b52ffd-ecec-4fba-b432-ba32135c2f99@suse.de/
Tested-by: Thomas Zimmermann <tzimmermann@suse.de>
Cc: stable@vger.kernel.org
Signed-off-by: Tingjie Zhong <catme0w@live.cn>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-10-20 22:27:07 +02:00
Thomas Zimmermann
54ddfe9a7e fbcon: Replace fbcon_fill_cursor_mask() with fbcon_cursor_glyph()
The kernel's font library provides font_glyph_cursor() to create cursor
glyphs. Replace fbcon's fbcon_fill_cursor_mask() with a new helper that
uses font_glyph_cursor().

The cursor shapes remain mostly unchanged. The only exception is in
underline cursors for fonts with a size larger than 10. The underlining
dash is now one pixel closer to the font-glyph data, so that the cursor
looks less detached. This follows the style used by vgacon.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-10-19 13:56:01 +02:00
Thomas Zimmermann
5c02696d15 vgacon: Use vt_cursor_{start,end}()
Replace vgacon's custom cursor metrics with the shared helpers
vc_cursor_start() and vc_font_cursor_end(). Note that the _end()
function returns the index of the scanline below the cursor, while
VGA hardware expects the cursor's final scanline. Hence vgacon
subtracts 1 from the end value.

The cursor shapes remain mostly unchanged, except that non-underline
cursors now also use the glyph's top-most and bottom-most scanline.
This follows the style used by fbcon.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-10-19 13:56:01 +02:00
Thomas Zimmermann
64527782d4 vgacon: Remove trailing whitespaces
Fix coding style.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-10-19 13:56:01 +02:00
David Heidelberg
eacfbe6f97 backlight: qcom-wled: Read back the programmed brightness at probe
Since the previous change wled_probe() seeds wled->brightness from
MOD_EN, but with default-brightness rather than the level the hardware
is actually driving, so a backlight left lit by the bootloader still
visibly steps on the first update, and actual_brightness reports the
last value written rather than what the panel shows.

Add wled_read_brightness(), which returns 0 when MOD_EN is clear and
otherwise reads the brightness register the matching
wledN_set_brightness() writes: the first enabled string on WLED3 and
WLED4, the selected modulator on WLED5. Use it to seed both
wled->brightness and the initial backlight property, and expose it as
backlight_ops.get_brightness so that actual_brightness reflects the
hardware too.

A module that is enabled with the brightness registers at zero, which
wled4_setup() and wled_auto_string_detection() can leave behind on a
cold boot, now reads back as off. The OVP interrupt is then armed by the
first brightness update rather than from probe, which is what happens
on every other board where the module starts out disabled.

Suggested-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Assisted-by: LLM
Signed-off-by: David Heidelberg <david@ixit.cz>
Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org>
Link: https://patch.msgid.link/20260921-qcom-wled-backlight-v4-4-bab8c7ef73cb@ixit.cz
Signed-off-by: Lee Jones <lee@kernel.org>
2026-10-14 13:30:50 +01:00
David Heidelberg
5eda6b5146 backlight: qcom-wled: Fix unbalanced OVP IRQ enable at probe
wled_configure_ovp_irq() derives the initial state of the OVP interrupt
from the hardware:

        /* Keep OVP irq disabled until module is enabled */
        if (!(val & WLED3_CTRL_REG_MOD_EN_MASK))
                disable_irq(wled->ovp_irq);

but wled->brightness, which is what the rest of the driver uses to tell
whether the module is on, is left at zero.

On boards where the bootloader hands the kernel a lit backlight the two
disagree. MOD_EN is already set, so the interrupt is left enabled, while
wled_update_status() still believes the backlight is off and takes

        if (!!brightness != !!wled->brightness)
                rc = wled_module_enable(wled, !!brightness);

on the first backlight update. wled_module_enable() then schedules
wled_ovp_work(), which calls enable_irq() on the already enabled
interrupt:

  Unbalanced enable for IRQ 176
  WARNING: CPU: 0 PID: 160 at kernel/irq/manage.c:774 __enable_irq+0x50/0x80
  Hardware name: Xiaomi Pocophone F1 (DT)
  Workqueue: events wled_ovp_work
  Call trace:
   __enable_irq+0x50/0x80
   enable_irq+0x48/0xa0
   wled_ovp_work+0x18/0x24
   process_one_work+0x1d0/0x350
   worker_thread+0x13c/0x460
   kthread+0x110/0x114
   ret_from_fork+0x10/0x20

The bootloader is not the only way to get there. The readback runs after
wledN_setup(), and wled4_setup() sets MOD_EN itself on the path where the
sink configuration does not already match, as does the tail of
wled_auto_string_detection(), which all three setup paths can reach
through wled_auto_detection_at_init(). A cold-booted board with a dark
panel can therefore reach the same disagreement.

Move the MOD_EN readback into wled_probe() and use it to seed
wled->brightness, so the driver starts out agreeing with the hardware,
and key the OVP interrupt off wled->brightness instead. The first
backlight update then only reprograms the brightness registers and
leaves both the module and the interrupt alone. The OVP interrupt also
stays armed from probe whenever the module is already enabled, rather
than being disabled at probe and only enabled once something writes
brightness.

Note that a backlight update requesting brightness 0 before any non-zero
one now really does turn the module off wherever MOD_EN was already set,
where before it was silently ignored.

wled->brightness is seeded with default-brightness rather than the level
the bootloader actually programmed, so the first update can still step
the brightness. Reading that level back is version specific and is done
in a follow-up, to keep this fix small enough to backport.

Assisted-by: LLM
Fixes: 8663c188be ("backlight: qcom-wled: Add auto string detection logic")
Cc: stable@vger.kernel.org
Signed-off-by: David Heidelberg <david@ixit.cz>
Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org>
Link: https://patch.msgid.link/20260921-qcom-wled-backlight-v4-3-bab8c7ef73cb@ixit.cz
Signed-off-by: Lee Jones <lee@kernel.org>
2026-10-14 13:30:43 +01:00
David Heidelberg
22672f81f0 backlight: qcom-wled: Fix WLED3 brightness register stride
WLED3 has a 16-bit brightness register pair per string, at 0x40 + 2*n,
which is what the pm8941-wled driver wrote to:

	rc = regmap_bulk_write(wled->regmap,
			wled->addr + WLED3_CTRL_REG_VAL_BASE + 2 * i,
			v, 2);

The restructuring for WLED3 turned that into WLED3_SINK_REG_BRIGHT(n),
defined as 0x40 + n, so the two byte writes for consecutive strings
overlap: string 1 overwrites the MSB of string 0 with its own LSB, and
with the default three strings only string 1 ends up with the requested
value.

Use the 2 byte stride.

Fixes: 775d2ffb4a ("backlight: qcom-wled: Restructure the driver for WLED3")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: David Heidelberg <david@ixit.cz>
Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://patch.msgid.link/20260921-qcom-wled-backlight-v4-2-bab8c7ef73cb@ixit.cz
Signed-off-by: Lee Jones <lee@kernel.org>
2026-10-14 13:30:37 +01:00
David Heidelberg
1dbd46d4b2 backlight: qcom-wled: Fix NULL pointer dereference in wled_remove()
wled_probe() doesn't set the driver data for the platform device.
As a result, platform_get_drvdata() in wled_remove() will return NULL,
and the first dereference of it crashes on unbind.

Set the platform device driver data in wled_probe().

Cc: stable@vger.kernel.org
Fixes: feeab87b30 ("backlight: qcom-wled: Add support for short circuit handling")
Signed-off-by: David Heidelberg <david@ixit.cz>
Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://patch.msgid.link/20260921-qcom-wled-backlight-v4-1-bab8c7ef73cb@ixit.cz
Signed-off-by: Lee Jones <lee@kernel.org>
2026-10-14 13:30:26 +01:00
David Heidelberg
2ffcac9165 backlight: qcom-wled: Read back the programmed brightness at probe
Since the previous change wled_probe() seeds wled->brightness from
MOD_EN, but with default-brightness rather than the level the hardware
is actually driving, so a backlight left lit by the bootloader still
visibly steps on the first update, and actual_brightness reports the
last value written rather than what the panel shows.

Add wled_read_brightness(), which returns 0 when MOD_EN is clear and
otherwise reads the brightness register the matching
wledN_set_brightness() writes: the first enabled string on WLED3 and
WLED4, the selected modulator on WLED5. Use it to seed both
wled->brightness and the initial backlight property, and expose it as
backlight_ops.get_brightness so that actual_brightness reflects the
hardware too.

A module that is enabled with the brightness registers at zero, which
wled4_setup() and wled_auto_string_detection() can leave behind on a
cold boot, now reads back as off. The OVP interrupt is then armed by the
first brightness update rather than from probe, which is what happens
on every other board where the module starts out disabled.

Suggested-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Assisted-by: LLM
Signed-off-by: David Heidelberg <david@ixit.cz>
Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org>
Link: https://patch.msgid.link/20260921-qcom-wled-backlight-v4-4-bab8c7ef73cb@ixit.cz
Signed-off-by: Lee Jones <lee@kernel.org>
2026-10-14 13:29:55 +01:00
David Heidelberg
b32a8c32fe backlight: qcom-wled: Fix unbalanced OVP IRQ enable at probe
wled_configure_ovp_irq() derives the initial state of the OVP interrupt
from the hardware:

        /* Keep OVP irq disabled until module is enabled */
        if (!(val & WLED3_CTRL_REG_MOD_EN_MASK))
                disable_irq(wled->ovp_irq);

but wled->brightness, which is what the rest of the driver uses to tell
whether the module is on, is left at zero.

On boards where the bootloader hands the kernel a lit backlight the two
disagree. MOD_EN is already set, so the interrupt is left enabled, while
wled_update_status() still believes the backlight is off and takes

        if (!!brightness != !!wled->brightness)
                rc = wled_module_enable(wled, !!brightness);

on the first backlight update. wled_module_enable() then schedules
wled_ovp_work(), which calls enable_irq() on the already enabled
interrupt:

  Unbalanced enable for IRQ 176
  WARNING: CPU: 0 PID: 160 at kernel/irq/manage.c:774 __enable_irq+0x50/0x80
  Hardware name: Xiaomi Pocophone F1 (DT)
  Workqueue: events wled_ovp_work
  Call trace:
   __enable_irq+0x50/0x80
   enable_irq+0x48/0xa0
   wled_ovp_work+0x18/0x24
   process_one_work+0x1d0/0x350
   worker_thread+0x13c/0x460
   kthread+0x110/0x114
   ret_from_fork+0x10/0x20

The bootloader is not the only way to get there. The readback runs after
wledN_setup(), and wled4_setup() sets MOD_EN itself on the path where the
sink configuration does not already match, as does the tail of
wled_auto_string_detection(), which all three setup paths can reach
through wled_auto_detection_at_init(). A cold-booted board with a dark
panel can therefore reach the same disagreement.

Move the MOD_EN readback into wled_probe() and use it to seed
wled->brightness, so the driver starts out agreeing with the hardware,
and key the OVP interrupt off wled->brightness instead. The first
backlight update then only reprograms the brightness registers and
leaves both the module and the interrupt alone. The OVP interrupt also
stays armed from probe whenever the module is already enabled, rather
than being disabled at probe and only enabled once something writes
brightness.

Note that a backlight update requesting brightness 0 before any non-zero
one now really does turn the module off wherever MOD_EN was already set,
where before it was silently ignored.

wled->brightness is seeded with default-brightness rather than the level
the bootloader actually programmed, so the first update can still step
the brightness. Reading that level back is version specific and is done
in a follow-up, to keep this fix small enough to backport.

Assisted-by: LLM
Fixes: 8663c188be ("backlight: qcom-wled: Add auto string detection logic")
Cc: stable@vger.kernel.org
Signed-off-by: David Heidelberg <david@ixit.cz>
Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org>
Link: https://patch.msgid.link/20260921-qcom-wled-backlight-v4-3-bab8c7ef73cb@ixit.cz
Signed-off-by: Lee Jones <lee@kernel.org>
2026-10-14 13:29:55 +01:00
David Heidelberg
e60dc9c05e backlight: qcom-wled: Fix WLED3 brightness register stride
WLED3 has a 16-bit brightness register pair per string, at 0x40 + 2*n,
which is what the pm8941-wled driver wrote to:

	rc = regmap_bulk_write(wled->regmap,
			wled->addr + WLED3_CTRL_REG_VAL_BASE + 2 * i,
			v, 2);

The restructuring for WLED3 turned that into WLED3_SINK_REG_BRIGHT(n),
defined as 0x40 + n, so the two byte writes for consecutive strings
overlap: string 1 overwrites the MSB of string 0 with its own LSB, and
with the default three strings only string 1 ends up with the requested
value.

Use the 2 byte stride.

Fixes: 775d2ffb4a ("backlight: qcom-wled: Restructure the driver for WLED3")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: David Heidelberg <david@ixit.cz>
Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://patch.msgid.link/20260921-qcom-wled-backlight-v4-2-bab8c7ef73cb@ixit.cz
Signed-off-by: Lee Jones <lee@kernel.org>
2026-10-14 13:29:55 +01:00
David Heidelberg
186fc521f2 backlight: qcom-wled: Fix NULL pointer dereference in wled_remove()
wled_probe() doesn't set the driver data for the platform device.
As a result, platform_get_drvdata() in wled_remove() will return NULL,
and the first dereference of it crashes on unbind.

Set the platform device driver data in wled_probe().

Cc: stable@vger.kernel.org
Fixes: feeab87b30 ("backlight: qcom-wled: Add support for short circuit handling")
Signed-off-by: David Heidelberg <david@ixit.cz>
Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://patch.msgid.link/20260921-qcom-wled-backlight-v4-1-bab8c7ef73cb@ixit.cz
Signed-off-by: Lee Jones <lee@kernel.org>
2026-10-14 13:29:55 +01:00
Myeonghun Pak
2cf184caab backlight: lm3630a: Cancel delayed work before destroying workqueue
The interrupt handler queues delayed work to read the interrupt status.
After free_irq() stops the producer, this work can still be waiting on its
timer. destroy_workqueue() cannot drain delayed work that has not yet been
queued by its timer, so the timer can outlive both the workqueue and the
devm-allocated chip containing the work.

Cancel the delayed work synchronously after freeing the IRQ and before
destroying the workqueue. This also waits for any running status read to
finish before the chip's resources are released.

This issue was identified during our ongoing static-analysis research
while reviewing kernel code.

Fixes: 0c2a665a64 ("backlight: add Backlight driver for lm3630 chip")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org>
Link: https://patch.msgid.link/20261003030439.599330-1-mhun512@gmail.com
Signed-off-by: Lee Jones <lee@kernel.org>
2026-10-14 13:28:57 +01:00
Helge Deller
111a4137ed fbdev: atafb: avoid cast when assigning buffer address pointer
The sparse tool complains that the "cast removes the address space
'__iomem' of expression".
Avoid the cast by using the screen_buffer pointer instead of the
screen_base pointer from the union.

Fixes: d463633d63 ("fbdev: atafb: Add support for SuperVidel's SuperBlitter")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202609261313.kgFtkz2t-lkp@intel.com/
Cc: Miro Kropáček <miro.kropacek@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-10-13 11:33:14 +02:00
Helge Deller
ec4eb034cf fbdev: atafb: fix sparse warnings
Fix two sparse warnings:
- atafb.c:1092: sparse: Using plain integer as NULL pointer

Use NULL instead of 0 when assigning a pointer.

- atafb.c:2824: sparse: switch with no cases

FBCMD_GET_CURRENTPAR and and FBCMD_SET_CURRENTPAR seem to be
historic defines, which are not any longer in the kernel, and
as such the code isn't built any longer and may be dropped.

Fixes: d463633d63 ("fbdev: atafb: Add support for SuperVidel's SuperBlitter")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202609261313.kgFtkz2t-lkp@intel.com/
Cc: Miro Kropacek <miro.kropacek@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
Reviewed-by: Michael Schmitz <schmitzmic@gmail.com>
2026-10-13 11:33:14 +02:00
Hemanth Selam
d72a71b826 fbdev: atyfb_base: fix typos in comments
Assisted-by: Cursor:claude-opus-5
Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-10-13 11:33:14 +02:00
Hemanth Selam
c24ea935ab fbdev: aty128fb: fix typos in comments
Assisted-by: Cursor:claude-opus-5
Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-10-13 11:33:14 +02:00
Hemanth Selam
727a98c917 fbdev: mach64: fix typos in comments
Assisted-by: Cursor:claude-opus-5
Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-10-13 11:33:14 +02:00
Hemanth Selam
e2c83f4c49 fbdev: radeonfb: fix typos in comments
Assisted-by: Cursor:claude-opus-5
Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-10-13 11:33:14 +02:00
Hemanth Selam
be07060f1f fbdev: omap2fb: fix typos in comments
Assisted-by: Cursor:claude-opus-5
Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-10-13 11:33:13 +02:00
Hemanth Selam
b3b8e5b713 fbdev: ocfb: fix typos in comments
Assisted-by: Cursor:claude-opus-5
Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-10-13 11:33:13 +02:00
Hemanth Selam
cac2199814 fbdev: skeletonfb: fix typos in comments
Assisted-by: Cursor:claude-opus-5
Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-10-13 11:33:13 +02:00
Hemanth Selam
4d6c030510 fbdev: pm2fb: fix typos in comments
Assisted-by: Cursor:claude-opus-5
Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-10-13 11:33:13 +02:00
Hemanth Selam
a9cb7304cf fbdev: maxinefb: fix typos in comments
Assisted-by: Cursor:claude-opus-5
Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-10-13 11:33:13 +02:00
Hemanth Selam
0b5126863b fbdev: kyro: fix typos in comments
Assisted-by: Cursor:claude-opus-5
Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-10-13 11:33:13 +02:00
Hemanth Selam
962bc9c4af fbdev: grvga: fix typos in comments
Assisted-by: Cursor:claude-opus-5
Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-10-13 11:33:13 +02:00