path: root/drivers/video
AgeCommit message (Collapse)Author
2021-06-01Revert "fb_defio: Remove custom address_space_operations"Matthew Wilcox
Commit ccf953d8f3d6 makes framebuffers which use deferred I/O stop displaying updates after the first one. This is because the pages handled by fb_defio no longer have a page_mapping(). That prevents page_mkclean() from marking the PTEs as clean, and so writes are only noticed the first time. Reported-by: Andy Shevchenko <> Signed-off-by: Matthew Wilcox (Oracle) <> Signed-off-by: Daniel Vetter <> Link:
2021-05-21video: hgafb: correctly handle card detect failure during probeAnirudh Rayabharam
The return value of hga_card_detect() is not properly handled causing the probe to succeed even though hga_card_detect() failed. Since probe succeeds, hgafb_open() can be called which will end up operating on an unmapped hga_vram. This results in an out-of-bounds access as reported by kernel test robot [1]. To fix this, correctly detect failure of hga_card_detect() by checking for a non-zero error code. [1]: Fixes: dc13cac4862c ("video: hgafb: fix potential NULL pointer dereference") Cc: stable <> Reported-by: kernel test robot <> Reviewed-by: Igor Matheus Andrade Torrente <> Signed-off-by: Anirudh Rayabharam <> Signed-off-by: Dan Carpenter <> Link: Signed-off-by: Greg Kroah-Hartman <>
2021-05-20Merge tag 'char-misc-5.13-rc3' of ↵Linus Torvalds
git:// Pull char/misc driver fixes from Greg KH: "Here is a big set of char/misc/other driver fixes for 5.13-rc3. The majority here is the fallout of the re-review of all prior submissions. That resulted in a bunch of reverts along with the "correct" changes made, such that there is no regression of any of the potential fixes that were made by those individuals. I would like to thank the over 80 different developers who helped with the review and fixes for this mess. Other than that, there's a few habanna driver fixes for reported issues, and some dyndbg fixes for reported problems. All of these have been in linux-next for a while with no reported problems" * tag 'char-misc-5.13-rc3' of git:// (82 commits) misc: eeprom: at24: check suspend status before disable regulator uio_hv_generic: Fix another memory leak in error handling paths uio_hv_generic: Fix a memory leak in error handling paths uio/uio_pci_generic: fix return value changed in refactoring Revert "Revert "ALSA: usx2y: Fix potential NULL pointer dereference"" dyndbg: drop uninformative vpr_info dyndbg: avoid calling dyndbg_emit_prefix when it has no work binder: Return EFAULT if we fail BINDER_ENABLE_ONEWAY_SPAM_DETECTION cdrom: gdrom: initialize global variable at init time brcmfmac: properly check for bus register errors Revert "brcmfmac: add a check for the status of usb_register" video: imsttfb: check for ioremap() failures Revert "video: imsttfb: fix potential NULL pointer dereferences" net: liquidio: Add missing null pointer checks Revert "net: liquidio: fix a NULL pointer dereference" media: gspca: properly check for errors in po1030_probe() Revert "media: gspca: Check the return value of write_bridge for timeout" media: gspca: mt9m111: Check write_bridge for timeout Revert "media: gspca: mt9m111: Check write_bridge for timeout" media: dvb: Add check on sp8870_readreg return ...
2021-05-15tty: vt: always invoke vc->vc_sw->con_resize callbackTetsuo Handa
syzbot is reporting OOB write at vga16fb_imageblit() [1], for resize_screen() from ioctl(VT_RESIZE) returns 0 without checking whether requested rows/columns fit the amount of memory reserved for the graphical screen if current mode is KD_GRAPHICS. ---------- #include <sys/types.h> #include <sys/stat.h> #include <fcntl.h> #include <sys/ioctl.h> #include <linux/kd.h> #include <linux/vt.h> int main(int argc, char *argv[]) { const int fd = open("/dev/char/4:1", O_RDWR); struct vt_sizes vt = { 0x4100, 2 }; ioctl(fd, KDSETMODE, KD_GRAPHICS); ioctl(fd, VT_RESIZE, &vt); ioctl(fd, KDSETMODE, KD_TEXT); return 0; } ---------- Allow framebuffer drivers to return -EINVAL, by moving vc->vc_mode != KD_GRAPHICS check from resize_screen() to fbcon_resize(). Link: [1] Reported-by: syzbot <> Suggested-by: Linus Torvalds <> Signed-off-by: Tetsuo Handa <> Tested-by: syzbot <> Signed-off-by: Linus Torvalds <>
2021-05-13Merge branch 'resizex' (patches from Maciej)Linus Torvalds
Merge VT_RESIZEX fixes from Maciej Rozycki: "I got to the bottom of the issue with VT_RESIZEX recently discussed and came up with this small patch series, fixing an additional issue that I originally thought might be broken VGA hardware emulation with my laptop, which however turned out to be intertwined with the original problem and also a regression introduced somewhat later. The fix for that because the first patch, and then to make backporting feasible I had to put a revert of the offending change from last September next, followed by a proper fix for the framebuffer issue that change had tried to address. See individual change descriptions for details. These have been verified with true VGA hardware (a Trident TVGA8900 ISA video adapter) using various combinations of `svgatextmode' and `setfont' command invocations to change both the VT size and the font size, and also switching between the text console and X11, both by starting/stopping the X server and by switching between VTs. All this to ensure bringing the behaviour of VGA text console back to correct operation as it used to be with Linux 2.6.18" * emailed patches from Maciej W. Rozycki <>: vt: Fix character height handling with VT_RESIZEX vt_ioctl: Revert VT_RESIZEX parameter handling removal vgacon: Record video mode changes with VT_RESIZEX
2021-05-13vt: Fix character height handling with VT_RESIZEXMaciej W. Rozycki
Restore the original intent of the VT_RESIZEX ioctl's `v_clin' parameter which is the number of pixel rows per character (cell) rather than the height of the font used. For framebuffer devices the two values are always the same, because the former is inferred from the latter one. For VGA used as a true text mode device these two parameters are independent from each other: the number of pixel rows per character is set in the CRT controller, while font height is in fact hardwired to 32 pixel rows and fonts of heights below that value are handled by padding their data with blanks when loaded to hardware for use by the character generator. One can change the setting in the CRT controller and it will update the screen contents accordingly regardless of the font loaded. The `v_clin' parameter is used by the `vgacon' driver to set the height of the character cell and then the cursor position within. Make the parameter explicit then, by defining a new `vc_cell_height' struct member of `vc_data', set it instead of `vc_font.height' from `v_clin' in the VT_RESIZEX ioctl, and then use it throughout the `vgacon' driver except where actual font data is accessed which as noted above is independent from the CRTC setting. This way the framebuffer console driver is free to ignore the `v_clin' parameter as irrelevant, as it always should have, avoiding any issues attempts to give the parameter a meaning there could have caused, such as one that has led to commit 988d0763361b ("vt_ioctl: make VT_RESIZEX behave like VT_RESIZE"): "syzbot is reporting UAF/OOB read at bit_putcs()/soft_cursor() [1][2], for vt_resizex() from ioctl(VT_RESIZEX) allows setting font height larger than actual font height calculated by con_font_set() from ioctl(PIO_FONT). Since fbcon_set_font() from con_font_set() allocates minimal amount of memory based on actual font height calculated by con_font_set(), use of vt_resizex() can cause UAF/OOB read for font data." The problem first appeared around Linux 2.5.66 which predates our repo history, but the origin could be identified with the old MIPS/Linux repo also at: <git://> as commit 9736a3546de7 ("Merge with Linux 2.5.66."), where VT_RESIZEX code in `vt_ioctl' was updated as follows: if (clin) - video_font_height = clin; + vc->vc_font.height = clin; making the parameter apply to framebuffer devices as well, perhaps due to the use of "font" in the name of the original `video_font_height' variable. Use "cell" in the new struct member then to avoid ambiguity. References: [1] [2] Signed-off-by: Maciej W. Rozycki <> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: # v2.6.12+ Signed-off-by: Linus Torvalds <>
2021-05-13vgacon: Record video mode changes with VT_RESIZEXMaciej W. Rozycki
Fix an issue with VGA console font size changes made after the initial video text mode has been changed with a user tool like `svgatextmode' calling the VT_RESIZEX ioctl. As it stands in that case the original screen geometry continues being used to validate further VT resizing. Consequently when the video adapter is firstly reprogrammed from the original say 80x25 text mode using a 9x16 character cell (720x400 pixel resolution) to say 80x37 text mode and the same character cell (720x592 pixel resolution), and secondly the CRTC character cell updated to 9x8 (by loading a suitable font with the KD_FONT_OP_SET request of the KDFONTOP ioctl), the VT geometry does not get further updated from 80x37 and only upper half of the screen is used for the VT, with the lower half showing rubbish corresponding to whatever happens to be there in the video memory that maps to that part of the screen. Of course the proportions change according to text mode geometries and font sizes chosen. Address the problem then, by updating the text mode geometry defaults rather than checking against them whenever the VT is resized via a user ioctl. Signed-off-by: Maciej W. Rozycki <> Fixes: e400b6ec4ede ("vt/vgacon: Check if screen resize request comes from userspace") Cc: # v2.6.24+ Signed-off-by: Linus Torvalds <>
2021-05-13video: imsttfb: check for ioremap() failuresGreg Kroah-Hartman
We should check if ioremap() were to somehow fail in imsttfb_probe() and handle the unwinding of the resources allocated here properly. Ideally if anyone cares about this driver (it's for a PowerMac era PCI display card), they wouldn't even be using fbdev anymore. Or the devm_* apis could be used, but that's just extra work for diminishing returns... Cc: Finn Thain <> Cc: Bartlomiej Zolnierkiewicz <> Reviewed-by: Rob Herring <> Link: Signed-off-by: Greg Kroah-Hartman <>
2021-05-13Revert "video: imsttfb: fix potential NULL pointer dereferences"Greg Kroah-Hartman
This reverts commit 1d84353d205a953e2381044953b7fa31c8c9702d. Because of recent interactions with developers from, all commits from them have been recently re-reviewed to ensure if they were correct or not. Upon review, this commit was found to be incorrect for the reasons below, so it must be reverted. It will be fixed up "correctly" in a later kernel change. The original commit here, while technically correct, did not fully handle all of the reported issues that the commit stated it was fixing, so revert it until it can be "fixed" fully. Note, ioremap() probably will never fail for old hardware like this, and if anyone actually used this hardware (a PowerMac era PCI display card), they would not be using fbdev anymore. Cc: Kangjie Lu <> Cc: Aditya Pakki <> Cc: Finn Thain <> Cc: Bartlomiej Zolnierkiewicz <> Reviewed-by: Rob Herring <> Fixes: 1d84353d205a ("video: imsttfb: fix potential NULL pointer dereferences") Cc: stable <> Link: Signed-off-by: Greg Kroah-Hartman <>
2021-05-13video: hgafb: fix potential NULL pointer dereferenceIgor Matheus Andrade Torrente
The return of ioremap if not checked, and can lead to a NULL to be assigned to hga_vram. Potentially leading to a NULL pointer dereference. The fix adds code to deal with this case in the error label and changes how the hgafb_probe handles the return of hga_card_detect. Cc: Ferenc Bakonyi <> Cc: Bartlomiej Zolnierkiewicz <> Cc: stable <> Signed-off-by: Igor Matheus Andrade Torrente <> Link: Signed-off-by: Greg Kroah-Hartman <>
2021-05-13Revert "video: hgafb: fix potential NULL pointer dereference"Greg Kroah-Hartman
This reverts commit ec7f6aad57ad29e4e66cc2e18e1e1599ddb02542. Because of recent interactions with developers from, all commits from them have been recently re-reviewed to ensure if they were correct or not. Upon review, this commit was found to be incorrect for the reasons below, so it must be reverted. It will be fixed up "correctly" in a later kernel change. This patch "looks" correct, but the driver keeps on running and will fail horribly right afterward if this error condition ever trips. So points for trying to resolve an issue, but a huge NEGATIVE value for providing a "fake" fix for the problem as nothing actually got resolved at all. I'll go fix this up properly... Cc: Kangjie Lu <> Cc: Aditya Pakki <> Cc: Ferenc Bakonyi <> Cc: Bartlomiej Zolnierkiewicz <> Fixes: ec7f6aad57ad ("video: hgafb: fix potential NULL pointer dereference") Cc: stable <> Link: Signed-off-by: Greg Kroah-Hartman <>
2021-05-09fbmem: fix horribly incorrect placement of __maybe_unusedLinus Torvalds
Commit b9d79e4ca4ff ("fbmem: Mark proc_fb_seq_ops as __maybe_unused") places the '__maybe_unused' in an entirely incorrect location between the "struct" keyword and the structure name. It's a wonder that gcc accepts that silently, but clang quite reasonably warns about it: drivers/video/fbdev/core/fbmem.c:736:21: warning: attribute declaration must precede definition [-Wignored-attributes] static const struct __maybe_unused seq_operations proc_fb_seq_ops = { ^ Fix it. Cc: Guenter Roeck <> Cc: Daniel Vetter <> Signed-off-by: Linus Torvalds <>
2021-05-09Merge tag 'drm-next-2021-05-10' of git:// Torvalds
Pull drm fixes from Dave Airlie: "Bit later than usual, I queued them all up on Friday then promptly forgot to write the pull request email. This is mainly amdgpu fixes, with some radeon/msm/fbdev and one i915 gvt fix thrown in. amdgpu: - MPO hang workaround - Fix for concurrent VM flushes on vega/navi - dcefclk is not adjustable on navi1x and newer - MST HPD debugfs fix - Suspend/resumes fixes - Register VGA clients late in case driver fails to load - Fix GEM leak in user framebuffer create - Add support for polaris12 with 32 bit memory interface - Fix duplicate cursor issue when using overlay - Fix corruption with tiled surfaces on VCN3 - Add BO size and stride check to fix BO size verification radeon: - Fix off-by-one in power state parsing - Fix possible memory leak in power state parsing msm: - NULL ptr dereference fix fbdev: - procfs disabled warning fix i915: - gvt: Fix a possible division by zero in vgpu display rate calculation" * tag 'drm-next-2021-05-10' of git:// drm/amdgpu: Use device specific BO size & stride check. drm/amdgpu: Init GFX10_ADDR_CONFIG for VCN v3 in DPG mode. drm/amd/pm: initialize variable drm/radeon: Avoid power table parsing memory leaks drm/radeon: Fix off-by-one power_state index heap overwrite drm/amd/display: Fix two cursor duplication when using overlay drm/amdgpu: add new MC firmware for Polaris12 32bit ASIC fbmem: Mark proc_fb_seq_ops as __maybe_unused drm/msm/dpu: Delete bonkers code drm/i915/gvt: Prevent divided by zero when calculating refresh rate amdgpu: fix GEM obj leak in amdgpu_display_user_framebuffer_create drm/amdgpu: Register VGA clients after init can no longer fail drm/amdgpu: Handling of amdgpu_device_resume return value for graceful teardown drm/amdgpu: fix r initial values drm/amd/display: fix wrong statement in mst hpd debugfs amdgpu/pm: set pp_dpm_dcefclk to readonly on NAVI10 and newer gpus amdgpu/pm: Prevent force of DCEFCLK on NAVI10 and SIENNA_CICHLID drm/amdgpu: fix concurrent VM flushes on Vega/Navi v2 drm/amd/display: Reject non-zero src_y and src_x for video planes
2021-05-07Merge branch 'akpm' (patches from Andrew)Linus Torvalds
Merge yet more updates from Andrew Morton: "This is everything else from -mm for this merge window. 90 patches. Subsystems affected by this patch series: mm (cleanups and slub), alpha, procfs, sysctl, misc, core-kernel, bitmap, lib, compat, checkpatch, epoll, isofs, nilfs2, hpfs, exit, fork, kexec, gcov, panic, delayacct, gdb, resource, selftests, async, initramfs, ipc, drivers/char, and spelling" * emailed patches from Andrew Morton <>: (90 commits) mm: fix typos in comments mm: fix typos in comments treewide: remove editor modelines and cruft ipc/sem.c: spelling fix fs: fat: fix spelling typo of values kernel/sys.c: fix typo kernel/up.c: fix typo kernel/user_namespace.c: fix typos kernel/umh.c: fix some spelling mistakes include/linux/pgtable.h: few spelling fixes mm/slab.c: fix spelling mistake "disired" -> "desired" scripts/spelling.txt: add "overflw" scripts/spelling.txt: Add "diabled" typo scripts/spelling.txt: add "overlfow" arm: print alloc free paths for address in registers mm/vmalloc: remove vwrite() mm: remove xlate_dev_kmem_ptr() drivers/char: remove /dev/kmem for good mm: fix some typos and code style problems ipc/sem.c: mundane typo fixes ...
2021-05-07treewide: remove editor modelines and cruftMasahiro Yamada
The section "19) Editor modelines and other cruft" in Documentation/process/coding-style.rst clearly says, "Do not include any of these in source files." I recently receive a patch to explicitly add a new one. Let's do treewide cleanups, otherwise some people follow the existing code and attempt to upstream their favoriate editor setups. It is even nicer if scripts/ can check it. If we like to impose coding style in an editor-independent manner, I think editorconfig (patch [1]) is a saner solution. [1] Link: Signed-off-by: Masahiro Yamada <> Acked-by: Geert Uytterhoeven <> Reviewed-by: Miguel Ojeda <> [auxdisplay] Signed-off-by: Andrew Morton <> Signed-off-by: Linus Torvalds <>
2021-05-07Merge tag 'drm-misc-next-fixes-2021-05-06' of ↵Dave Airlie
git:// into drm-next Two patches, one to fix a null pointer dereference in msm, and one to fix an unused warning for in fbdev when PROCFS is disabled. Signed-off-by: Dave Airlie <> # gpg: Signature made Thu 06 May 2021 22:26:35 AEST # gpg: using ? key E3EF0D6F671851C5 # gpg: Can't check signature: unknown pubkey algorithm From: Maxime Ripard <> Link:
2021-05-04fbmem: Mark proc_fb_seq_ops as __maybe_unusedGuenter Roeck
With CONFIG_PROC_FS=n and -Werror, 0-day reports: drivers/video/fbdev/core/fbmem.c:736:36: error: 'proc_fb_seq_ops' defined but not used Mark it as __maybe_unused. Reported-by: kernel test robot <> Signed-off-by: Guenter Roeck <> Signed-off-by: Daniel Vetter <> Link:
2021-04-30Merge tag 'drm-next-2021-04-30' of git:// Torvalds
Pull more drm updates from Dave Airlie: "Looks like I missed a tegra feature request for next, but should still be fine since it's pretty self contained. Apart from that got a set of i915 and amdgpu fixes as per usual along with a few misc fixes. tegra: - Tegra186 hardware cursor support - better capability reporting for different SoC - better framebuffer modifier support - host1x fixes ttm: - fix unswappable BO handling efifb: - check for PCI before using it amdgpu: - Fixes for Aldebaran - Display LTTPR fixes - eDP fixes - Fixes for Vangogh - RAS fixes - ASPM support - Renoir SMU fixes - Modifier fixes - Misc code cleanups - Freesync fixes i915: - Several fixes to GLK handling in recent display refactoring - Rare watchdog timer race fix - Cppcheck redundant condition fix - Overlay error code propagation fix - Documentation fix - gvt: Remove one unused function warning - gvt: Fix intel_gvt_init_device() return type - gvt: Remove one duplicated register accessible check" * tag 'drm-next-2021-04-30' of git:// (111 commits) efifb: Check efifb_pci_dev before using it drm/i915: Fix docbook descriptions for i915_gem_shrinker drm/i915: fix an error code in intel_overlay_do_put_image() drm/i915/display/psr: Fix cppcheck warnings drm/i915: Disable LTTPR detection on GLK once again drm/i915: Restore lost glk ccs w/a drm/i915: Restore lost glk FBC 16bpp w/a drm/i915: Take request reference before arming the watchdog timer drm/ttm: fix error handling if no BO can be swapped out v4 drm/i915/gvt: Remove duplicated register accessible check drm/amdgpu/gmc9: remove dummy read workaround for newer chips drm/amdgpu: Add mem sync flag for IB allocated by SA drm/amdgpu: Fix SDMA RAS error reporting on Aldebaran drm/amdgpu: Reset RAS error count and status regs Revert "drm/amdgpu: workaround the TMR MC address issue (v2)" drm/amd/display: 3.2.132 drm/amd/display: [FW Promotion] Release 0.0.62 drm/amd/display: add helper for enabling mst stream features drm/amd/display: Report Proper Quantization Range in AVI Infoframe drm/amd/display: Fix call to pass bpp in 16ths of a bit ...
2021-04-30Merge tag 'drm-misc-next-fixes-2021-04-29' of ↵Dave Airlie
git:// into drm-next Two patches in drm-misc-next-fixes this week, one to fix the error handling in TTM when a BO can't be swapped out and one to prevent a wrong dereference in efifb. Signed-off-by: Dave Airlie <> From: Maxime Ripard <> Link:
2021-04-28Merge tag 'backlight-next-5.13' of ↵Linus Torvalds
git:// Pull backlight updates from Lee Jones: "New Device Support: - Add support for PMI8994 to Qualcom WLED - Add support for KTD259 to Kinetic KTD253 Fix-ups: - Device Tree related fix-ups; kinetic,ktd253 - Use proper sequence during sync_toggle; qcom-wled - Fix Wmisleading-indentation warnings; jornada720_bl Bug Fixes: - Fix sync toggle on WLED4; qcom-wled - Fix FSC update on WLED5; qcom-wled" * tag 'backlight-next-5.13' of git:// backlight: journada720: Fix Wmisleading-indentation warning backlight: qcom-wled: Correct the sync_toggle sequence backlight: qcom-wled: Fix FSC update issue for WLED5 dt-bindings: backlight: Add Kinetic KTD259 bindings backlight: ktd253: Support KTD259 backlight: qcom-wled: Use sink_addr for sync toggle dt-bindings: backlight: qcom-wled: Add PMI8994 compatible
2021-04-28Merge tag 'drm-next-2021-04-28' of git:// Torvalds
Pull drm updates from Dave Airlie: "The usual lots of work all over the place. i915 has gotten some Alderlake work and prelim DG1 code, along with a major locking rework over the GEM code, and brings back the property of timing out long running jobs using a watchdog. amdgpu has some Alderbran support (new GPU), freesync HDMI support along with a lot other fixes. Outside of the drm, there is a new printf specifier added which should have all the correct acks/sobs: - printk fourcc modifier support added %p4cc Summary: core: - drm_crtc_commit_wait - atomic plane state helpers reworked for full state - dma-buf heaps API rework - edid: rework and improvements for displayid dp-mst: - better topology logging bridge: - Chipone ICN6211 - Lontium LT8912B - anx7625 regulator support panel: - fix lt9611 4k panels handling simple-kms: - add plane state helpers ttm: - debugfs support - removal of unused sysfs - ignore signaled moved fences - ioremap buffer according to mem caching i915: - Alderlake S enablement - Conversion to dma_resv_locking - Bring back watchdog timeout support - legacy ioctl cleanups - add GEM TDDO and RFC process - DG1 LMEM preparation work - intel_display.c refactoring - Gen9/TGL PCH combination support - eDP MSO Support - multiple PSR instance support - Link training debug updates - Disable PSR2 support on JSL/EHL - DDR5/LPDDR5 support for bw calcs - LSPCON limited to gen9/10 platforms - HSW/BDW async flip/VTd corruption workaround - SAGV watermark fixes - SNB hard hang on ring resume fix - Limit imported dma-buf size - move to use new tasklet API - refactor KBL/TGL/ADL-S display/gt steppings - refactoring legacy DP/HDMI, FB plane code out amdgpu: - uapi: add ioctl to query video capabilities - Iniital AMD Freesync HDMI support - Initial Adebaran support - 10bpc dithering improvements - DCN secure display support - Drop legacy IO BAR requirements - PCIE/S0ix/RAS/Prime/Reset fixes - Display ASSR support - SMU gfx busy queues for RV/PCO - Initial LTTPR display work amdkfd: - MMU notifier fixes - APU fixes radeon: - debugfs cleanps - fw error handling ifix - Flexible array cleanups msm: - big DSI phy/pll cleanup - sc7280 initial support - commong bandwidth scaling path - shrinker locking contention fixes - unpin/swap support for GEM objcets ast: - cursor plane handling reworked tegra: - don't register DP AUX channels before connectors zynqmp: - fix OOB struct padding memset gma500: - drop ttm and medfield support exynos: - request_irq cleanup function mediatek: - fine tune line time for EOTp - MT8192 dpi support - atomic crtc config updates - don't support HDMI connector creation mxsdb: - imx8mm support panfrost: - MMU IRQ handling rework qxl: - locking fixes - resource deallocation changes sun4i: - add alpha properties to UI/VI layers vc4: - RPi4 CEC support vmwgfx: - doc cleanups arc: - moved to drm/tiny" * tag 'drm-next-2021-04-28' of git:// (1390 commits) drm/ttm: Don't count pages in SG BOs against pages_limit drm/ttm: fix return value check drm/bridge: lt8912b: fix incorrect handling of of_* return values drm: bridge: fix LONTIUM use of mipi_dsi_() functions drm: bridge: fix ANX7625 use of mipi_dsi_() functions drm/amdgpu: page retire over debugfs mechanism drm/radeon: Fix a missing check bug in radeon_dp_mst_detect() drm/amd/display: Fix the Wunused-function warning drm/radeon/r600: Fix variables that are not used after assignment drm/amdgpu/smu7: fix CAC setting on TOPAZ drm/amd/display: Update DCN302 SR Exit Latency drm/amdgpu: enable ras eeprom on aldebaran drm/amdgpu: RAS harvest on driver load drm/amdgpu: add ras aldebaran ras eeprom driver drm/amd/pm: increase time out value when sending msg to SMU drm/amdgpu: add DMUB outbox event IRQ source define/complete/debug flag drm/amd/pm: add the callback to get vbios bootup values for vangogh drm/radeon: Fix size overflow drm/amdgpu: Fix size overflow drm/amdgpu: move mmhub ras_func init to ip specific file ...
2021-04-26efifb: Check efifb_pci_dev before using itKai-Heng Feng
On some platforms like Hyper-V and RPi4 with UEFI firmware, efifb is not a PCI device. So make sure efifb_pci_dev is found before using it. Fixes: a6c0fd3d5a8b ("efifb: Ensure graphics device for efifb stays at PCI D0") BugLink: Signed-off-by: Kai-Heng Feng <> Signed-off-by: Alex Deucher <> Reviewed-by: Alex Deucher <> Link:
2021-04-26Merge tag 'tty-5.13-rc1' of ↵Linus Torvalds
git:// Pull tty and serial driver updates from Greg KH: "Here is the big set of tty and serial driver updates for 5.13-rc1. Actually busy this release, with a number of cleanups happening: - much needed core tty cleanups by Jiri Slaby - removal of unused and orphaned old-style serial drivers. If anyone shows up with this hardware, it is trivial to restore these but we really do not think they are in use anymore. - fixes and cleanups from Johan Hovold on a number of termios setting corner cases that loads of drivers got wrong as well as removing unneeded code due to tty core changes from long ago that were never propagated out to the drivers - loads of platform-specific serial port driver updates and fixes - coding style cleanups and other small fixes and updates all over the tty/serial tree. All of these have been in linux-next for a while now with no reported issues" * tag 'tty-5.13-rc1' of git:// (186 commits) serial: extend compile-test coverage serial: stm32: add FIFO threshold configuration dt-bindings: serial: 8250: update TX FIFO trigger level dt-bindings: serial: stm32: override FIFO threshold properties dt-bindings: serial: add RX and TX FIFO properties serial: xilinx_uartps: drop low-latency workaround serial: vt8500: drop low-latency workaround serial: timbuart: drop low-latency workaround serial: sunsu: drop low-latency workaround serial: sifive: drop low-latency workaround serial: txx9: drop low-latency workaround serial: sa1100: drop low-latency workaround serial: rp2: drop low-latency workaround serial: rda: drop low-latency workaround serial: owl: drop low-latency workaround serial: msm_serial: drop low-latency workaround serial: mpc52xx_uart: drop low-latency workaround serial: meson: drop low-latency workaround serial: mcf: drop low-latency workaround serial: lpc32xx_hs: drop low-latency workaround ...
2021-04-26Merge tag 'char-misc-5.13-rc1' of ↵Linus Torvalds
git:// Pull char/misc driver updates from Greg KH: "Here is the big set of various smaller driver subsystem updates for 5.13-rc1. Major bits in here are: - habanalabs driver updates - hwtracing driver updates - interconnect driver updates - mhi driver updates - extcon driver updates - fpga driver updates - new binder features added - nvmem driver updates - phy driver updates - soundwire driver updates - smaller misc and char driver fixes and updates. - bluetooth driver bugfix that maintainer wanted to go through this tree. All of these have been in linux-next with no reported issues" * tag 'char-misc-5.13-rc1' of git:// (330 commits) bluetooth: eliminate the potential race condition when removing the HCI controller coresight: etm-perf: Fix define build issue when built as module phy: Revert "phy: ti: j721e-wiz: add missing of_node_put" phy: ti: j721e-wiz: Add missing include linux/slab.h phy: phy-twl4030-usb: Fix possible use-after-free in twl4030_usb_remove() stm class: Use correct UUID APIs intel_th: pci: Add Alder Lake-M support intel_th: pci: Add Rocket Lake CPU support intel_th: Consistency and off-by-one fix intel_th: Constify attribute_group structs intel_th: Constify all drvdata references stm class: Remove an unused function habanalabs/gaudi: Fix uninitialized return code rc when read size is zero greybus: es2: fix kernel-doc warnings mei: me: add Alder Lake P device id. dw-xdata-pcie: Update outdated info and improve text format dw-xdata-pcie: Fix documentation build warns fbdev: zero-fill colormap in fbcmap.c firmware: qcom-scm: Fix QCOM_SCM configuration speakup: i18n: Switch to kmemdup_nul() in spk_msg_set() ...
2021-04-26Merge tag 'hyperv-next-signed-20210426' of ↵Linus Torvalds
git:// Pull Hyper-V updates from Wei Liu: - VMBus enhancement - Free page reporting support for Hyper-V balloon driver - Some patches for running Linux as Arm64 Hyper-V guest - A few misc clean-up patches * tag 'hyperv-next-signed-20210426' of git:// (30 commits) drivers: hv: Create a consistent pattern for checking Hyper-V hypercall status x86/hyperv: Move hv_do_rep_hypercall to asm-generic video: hyperv_fb: Add ratelimit on error message Drivers: hv: vmbus: Increase wait time for VMbus unload Drivers: hv: vmbus: Initialize unload_event statically Drivers: hv: vmbus: Check for pending channel interrupts before taking a CPU offline Drivers: hv: vmbus: Drivers: hv: vmbus: Introduce CHANNELMSG_MODIFYCHANNEL_RESPONSE Drivers: hv: vmbus: Introduce and negotiate VMBus protocol version 5.3 Drivers: hv: vmbus: Use after free in __vmbus_open() Drivers: hv: vmbus: remove unused function Drivers: hv: vmbus: Remove unused linux/version.h header x86/hyperv: remove unused linux/version.h header x86/Hyper-V: Support for free page reporting x86/hyperv: Fix unused variable 'hi' warning in hv_apic_read x86/hyperv: Fix unused variable 'msr_val' warning in hv_qlock_wait hv: hyperv.h: a few mundane typo fixes drivers: hv: Fix EXPORT_SYMBOL and tab spaces issue Drivers: hv: vmbus: Drop error message when 'No request id available' asm-generic/hyperv: Add missing function prototypes per -W1 warnings clocksource/drivers/hyper-v: Move handling of STIMER0 interrupts ...
2021-04-20video: hyperv_fb: Add ratelimit on error messageMichael Kelley
Due to a full ring buffer, the driver may be unable to send updates to the Hyper-V host. But outputing the error message can make the problem worse because console output is also typically written to the frame buffer. As a result, in some circumstances the error message is output continuously. Break the cycle by rate limiting the error message. Also output the error code for additional diagnosability. Signed-off-by: Michael Kelley <> Link: Signed-off-by: Wei Liu <>
2021-04-13Merge drm/drm-fixes into drm-nextDaniel Vetter
msm-next pull request has a baseline with stuff from -fixes, roll forward first. Some simple conflicts in amdgpu, ttm and one in i915 where git gets confused and tries to add the same function twice. Signed-off-by: Daniel Vetter <>
2021-04-10fbdev: zero-fill colormap in fbcmap.cPhillip Potter
Use kzalloc() rather than kmalloc() for the dynamically allocated parts of the colormap in fb_alloc_cmap_gfp, to prevent a leak of random kernel data to userspace under certain circumstances. Fixes a KMSAN-found infoleak bug reported by syzbot at: Reported-by: Cc: stable <> Reviewed-by: Geert Uytterhoeven <> Signed-off-by: Phillip Potter <> Link: Signed-off-by: Greg Kroah-Hartman <>
2021-04-05Merge 5.12-rc6 into tty-nextGreg Kroah-Hartman
We need the serial/tty fixes in here as well. Signed-off-by: Greg Kroah-Hartman <>
2021-04-03Merge tag 'hyperv-fixes-signed-20210402' of ↵Linus Torvalds
git:// Pull Hyper-V fixes from Wei Liu: "One fix from Lu Yunlong for a double free in hvfb_probe" * tag 'hyperv-fixes-signed-20210402' of git:// video: hyperv_fb: Fix a double free in hvfb_probe
2021-03-25video: hyperv_fb: Fix a double free in hvfb_probeLv Yunlong
Function hvfb_probe() calls hvfb_getmem(), expecting upon return that info->apertures is either NULL or points to memory that should be freed by framebuffer_release(). But hvfb_getmem() is freeing the memory and leaving the pointer non-NULL, resulting in a double free if an error occurs or later if hvfb_remove() is called. Fix this by removing all kfree(info->apertures) calls in hvfb_getmem(). This will allow framebuffer_release() to free the memory, which follows the pattern of other fbdev drivers. Fixes: 3a6fb6c4255c ("video: hyperv: hyperv_fb: Use physical memory for fb on HyperV Gen 1 VMs.") Signed-off-by: Lv Yunlong <> Reviewed-by: Michael Kelley <> Link: Signed-off-by: Wei Liu <>
2021-03-23drivers: video: fbcon: fix NULL dereference in fbcon_cursor()Du Cheng
add null-check on function pointer before dereference on ops->cursor Reported-by: Cc: stable <> Signed-off-by: Du Cheng <> Link: Signed-off-by: Greg Kroah-Hartman <>
2021-03-23backlight: journada720: Fix Wmisleading-indentation warningArnd Bergmann
With gcc-11, we get a warning about code that looks correct but badly indented: drivers/video/backlight/jornada720_bl.c: In function ‘jornada_bl_update_status’: drivers/video/backlight/jornada720_bl.c:66:11: error: this ‘else’ clause does not guard... [-Werror=misleading-indentation] 66 | } else /* turn on backlight */ | ^~~~ Change the formatting according to our normal conventions. Fixes: 13a7b5dc0d17 ("backlight: Adds HP Jornada 700 series backlight driver") Signed-off-by: Arnd Bergmann <> Reviewed-by: Daniel Thompson <> Signed-off-by: Lee Jones <>
2021-03-23backlight: qcom-wled: Correct the sync_toggle sequenceKiran Gunda
As per the current implementation, after FSC (Full Scale Current) and brightness update the sync bits are set-then-cleared. But, the FSC and brightness sync takes place when the sync bits are set (e.g. on a rising edge). So the hardware team recommends a clear-then-set approach in order to guarantee such a transition regardless of the previous register state. Signed-off-by: Kiran Gunda <> Reviewed-by: Daniel Thompson <> Signed-off-by: Lee Jones <>
2021-03-23vgacon: drop unused vga_init_doneStephen Kitt
Commit 973c096f6a85 ("vgacon: remove software scrollback support") removed all uses of vga_init_done, so let's get rid of it entirely. Signed-off-by: Stephen Kitt <> Link: Signed-off-by: Greg Kroah-Hartman <>
2021-03-22backlight: qcom-wled: Fix FSC update issue for WLED5Kiran Gunda
Currently, for WLED5, the FSC (Full scale current) setting is not updated properly due to driver toggling the wrong register after an FSC update. On WLED5 we should only toggle the MOD_SYNC bit after a brightness update. For an FSC update we need to toggle the SYNC bits instead. Fix it by adopting the common wled3_sync_toggle() for WLED5 and introducing new code to the brightness update path to compensate. Signed-off-by: Kiran Gunda <> Reviewed-by: Daniel Thompson <> Signed-off-by: Lee Jones <>
2021-03-22backlight: ktd253: Support KTD259Linus Walleij
The KTD259 works just like KTD253 so add this compatible to the driver. Signed-off-by: Linus Walleij <> Reviewed-by: Daniel Thompson <> Signed-off-by: Lee Jones <>
2021-03-22backlight: qcom-wled: Use sink_addr for sync toggleObeida Shamoun
WLED3_SINK_REG_SYNC is, as the name implies, a sink register offset. Therefore, use the sink address as base instead of the ctrl address. This fixes the sync toggle on wled4, which can be observed by the fact that adjusting brightness now works. It has no effect on wled3 because sink and ctrl base addresses are the same. This allows adjusting the brightness without having to disable then reenable the module. Signed-off-by: Obeida Shamoun <> Signed-off-by: Konrad Dybcio <> Signed-off-by: Marijn Suijten <> Reviewed-by: Daniel Thompson <> Acked-by: Kiran Gunda <> Signed-off-by: Lee Jones <>
2021-03-22fbdev: omapfb: avoid -Wempty-body warningArnd Bergmann
Building with 'make W=1' shows a few harmless warnings: drivers/video/fbdev/omap2/omapfb/omapfb-main.c: In function 'omapfb_calc_addr': drivers/video/fbdev/omap2/omapfb/omapfb-main.c:823:56: error: suggest braces around empty body in an 'if' statement [-Werror=empty-body] 823 | var->xoffset, var->yoffset, offset); | ^ drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c: In function 'omapfb_ioctl': drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c:911:45: error: suggest braces around empty body in an 'if' statement [-Werror=empty-body] 911 | DBG("ioctl failed: %d\n", r); Avoid these by using no_printk(), which adds format string checking as well. Signed-off-by: Arnd Bergmann <> Signed-off-by: Daniel Vetter <> Link:
2021-03-16Merge drm/drm-next into drm-misc-nextMaxime Ripard
Noralf needs some patches in 5.12-rc3, and we've been delaying the 5.12 merge due to the swap issue so it looks like a good time. Signed-off-by: Maxime Ripard <>
2021-03-16Merge tag 'drm-misc-next-2021-03-03' of ↵Dave Airlie
git:// into drm-next drm-misc-next for 5.13: UAPI Changes: Cross-subsystem Changes: Core Changes: - %p4cc printk format modifier - atomic: introduce drm_crtc_commit_wait, rework atomic plane state helpers to take the drm_commit_state structure - dma-buf: heaps rework to return a struct dma_buf - simple-kms: Add plate state helpers - ttm: debugfs support, removal of sysfs Driver Changes: - Convert drivers to shadow plane helpers - arc: Move to drm/tiny - ast: cursor plane reworks - gma500: Remove TTM and medfield support - mxsfb: imx8mm support - panfrost: MMU IRQ handling rework - qxl: rework to better handle resources deallocation, locking - sun4i: Add alpha properties for UI and VI layers - vc4: RPi4 CEC support - vmwgfx: doc cleanup Signed-off-by: Dave Airlie <> From: Maxime Ripard <> Link:
2021-03-15Merge 5.12-rc3 into tty-nextGreg Kroah-Hartman
Resolves a merge issue with: drivers/tty/hvc/hvcs.c and we want the tty/serial fixes from 5.12-rc3 in here as well. Signed-off-by: Greg Kroah-Hartman <>
2021-03-12fb_defio: Remove custom address_space_operationsMatthew Wilcox (Oracle)
There's no need to give the page an address_space. Leaving the page->mapping as NULL will cause the VM to handle set_page_dirty() the same way that it's handled now, and that was the only reason to set the address_space in the first place. Signed-off-by: Matthew Wilcox (Oracle) <> Reviewed-by: Christoph Hellwig <> Reviewed-by: William Kucharski <> Signed-off-by: Daniel Vetter <> Link:
2021-03-11fbdev: atyfb: use LCD management functions for PPC_PMAC alsoRandy Dunlap
Include PPC_PMAC in the configs that use aty_ld_lcd() and aty_st_lcd() implementations so that the PM code may work correctly for PPC_PMAC. Suggested-by: Ville Syrjälä <> Signed-off-by: Randy Dunlap <> Cc: Daniel Vetter <> Cc: Nick Desaulniers <> Cc: Cc: Cc: Bartlomiej Zolnierkiewicz <> Cc: Sam Ravnborg <> Cc: David Airlie <> Cc: Jani Nikula <> Signed-off-by: Ville Syrjälä <> Link: Signed-off-by: Maarten Lankhorst <>
2021-03-11fbdev: atyfb: always declare aty_{ld,st}_lcd()Randy Dunlap
The previously added stubs for aty_{ld,}st_lcd() make it so that these functions are used regardless of the config options that were guarding them, so remove the #ifdef/#endif lines and make their declarations always visible. This fixes build warnings that were reported by clang: drivers/video/fbdev/aty/atyfb_base.c:180:6: warning: no previous prototype for function 'aty_st_lcd' [-Wmissing-prototypes] void aty_st_lcd(int index, u32 val, const struct atyfb_par *par) ^ drivers/video/fbdev/aty/atyfb_base.c:180:1: note: declare 'static' if the function is not intended to be used outside of this translation unit void aty_st_lcd(int index, u32 val, const struct atyfb_par *par) drivers/video/fbdev/aty/atyfb_base.c:183:5: warning: no previous prototype for function 'aty_ld_lcd' [-Wmissing-prototypes] u32 aty_ld_lcd(int index, const struct atyfb_par *par) ^ drivers/video/fbdev/aty/atyfb_base.c:183:1: note: declare 'static' if the function is not intended to be used outside of this translation unit u32 aty_ld_lcd(int index, const struct atyfb_par *par) They should not be marked as static since they are used in mach64_ct.c. Fixes: bfa5782b9caa ("fbdev: atyfb: add stubs for aty_{ld,st}_lcd()") Signed-off-by: Randy Dunlap <> Reported-by: kernel test robot <> Cc: Daniel Vetter <> Cc: Nick Desaulniers <> Cc: Cc: Cc: Bartlomiej Zolnierkiewicz <> Cc: Sam Ravnborg <> Cc: David Airlie <> Cc: Jani Nikula <> Signed-off-by: Ville Syrjälä <> Link: Acked-by: Nick Desaulniers <> Signed-off-by: Maarten Lankhorst <>
2021-03-10vgacon: comment on vga_rolled_overJiri Slaby
Long time ago, I figured out what this number is good for and documented that locally. But never submitted, so do it now. Cc: Cc: Signed-off-by: Jiri Slaby <> Link: Signed-off-by: Greg Kroah-Hartman <>
2021-02-25Merge tag 'drm-next-2021-02-26' of git:// Torvalds
Pull more drm updates from Dave Airlie: "This is mostly fixes but I missed msm-next pull last week. It's been in drm-next. Otherwise it's a selection of i915, amdgpu and misc fixes, one TTM memory leak, nothing really major stands out otherwise. core: - vblank fence timing improvements dma-buf: - improve error handling ttm: - memory leak fix msm: - a6xx speedbin support - a508, a509, a512 support - various a5xx fixes - various dpu fixes - qseed3lite support for sm8250 - dsi fix for msm8994 - mdp5 fix for framerate bug with cmd mode panels - a6xx GMU OOB race fixes that were showing up in CI - various addition and removal of semicolons - gem submit fix for legacy userspace relocs path amdgpu: - clang warning fix - S0ix platform shutdown/poweroff fix - misc display fixes i915: - color format fix - -Wuninitialised reenabled - GVT ww locking, cmd parser fixes atyfb: - fix build rockchip: - AFBC modifier fix" * tag 'drm-next-2021-02-26' of git:// (60 commits) drm/panel: kd35t133: allow using non-continuous dsi clock drm/rockchip: Require the YTR modifier for AFBC drm/ttm: Fix a memory leak drm/drm_vblank: set the dma-fence timestamp during send_vblank_event dma-fence: allow signaling drivers to set fence timestamp dma-buf: heaps: Rework heap allocation hooks to return struct dma_buf instead of fd dma-buf: system_heap: Make sure to return an error if we abort drm/amd/display: Fix system hang after multiple hotplugs (v3) drm/amdgpu: fix shutdown and poweroff process failed with s0ix drm/i915: Nuke INTEL_OUTPUT_FORMAT_INVALID drm/i915: Enable -Wuninitialized drm/amd/display: Remove Assert from dcn10_get_dig_frontend drm/amd/display: Add vupdate_no_lock interrupts for DCN2.1 Revert "drm/amd/display: reuse current context instead of recreating one" drm/amd/pm/swsmu: Avoid using structure_size uninitialized in smu_cmn_init_soft_gpu_metrics fbdev: atyfb: add stubs for aty_{ld,st}_lcd() drm/i915/gvt: Introduce per object locking in GVT scheduler. drm/i915/gvt: Purge dev_priv->gt drm/i915/gvt: Parse default state to update reg whitelist dt-bindings: dp-connector: Drop maxItems from -supply ...
2021-02-24video: fbdev: acornfb: remove free_unused_pages()David Hildenbrand
Patch series "mm: simplify free_highmem_page() and free_reserved_page()". Let's simplify and unify free_highmem_page() and free_reserved_page(). This patch (of 2): This function is never used and it is one of the last remaining user of __free_reserved_page(). Let's just drop it. Link: Link: Fixes: ffd29195ed720188 ("drivers/video/acornfb.c: remove dead code") Signed-off-by: David Hildenbrand <> Reviewed-by: Oscar Salvador <> Reviewed-by: Anshuman Khandual <> Cc: Thomas Gleixner <> Cc: "Peter Zijlstra (Intel)" <> Cc: Mike Rapoport <> Cc: Michal Hocko <> Cc: Wei Yang <> Cc: "Gustavo A. R. Silva" <> Cc: Sam Ravnborg <> Signed-off-by: Andrew Morton <> Signed-off-by: Linus Torvalds <>
2021-02-22Merge tag 'for-linus' of git:// Torvalds
Pull ARM updates from Russell King: - Generalise byte swapping assembly - Update debug addresses for STI - Validate start of physical memory with DTB - Do not clear SCTLR.nTLSMD in decompressor - amba/locomo/sa1111 devices remove method return type is void - address markers for KASAN in page table dump * tag 'for-linus' of git:// ARM: 9065/1: OABI compat: fix build when EPOLL is not enabled ARM: 9055/1: mailbox: arm_mhuv2: make remove callback return void amba: Make use of bus_type functions amba: Make the remove callback return void vfio: platform: simplify device removal amba: reorder functions amba: Fix resource leak for drivers without .remove ARM: 9054/1: arch/arm/mm/mmu.c: Remove duplicate header ARM: 9053/1: arm/mm/ptdump:Add address markers for KASAN regions ARM: 9051/1: vdso: remove unneded extra-y addition ARM: 9050/1: Kconfig: Select ARCH_HAVE_NMI_SAFE_CMPXCHG where possible ARM: 9049/1: locomo: make locomo bus's remove callback return void ARM: 9048/1: sa1111: make sa1111 bus's remove callback return void ARM: 9047/1: smp: remove unused variable ARM: 9046/1: decompressor: Do not clear SCTLR.nTLSMD for ARMv7+ cores ARM: 9045/1: uncompress: Validate start of physical memory against passed DTB ARM: 9042/1: debug: no uncompress debugging while semihosting ARM: 9041/1: sti LL_UART: add STiH418 SBC UART0 support ARM: 9040/1: use DEBUG_UART_PHYS and DEBUG_UART_VIRT for sti LL_UART ARM: 9039/1: assembler: generalize byte swapping macro into rev_l
2021-02-22Merge tag 'backlight-next-5.12' of ↵Linus Torvalds
git:// Pull backlight updates from Lee Jones: "New Functionality: - Convert to GPIO descriptors Fix-ups: - Trivial: fix coding style in sky81452-backlight - Ensure backlight state is known on bring-up in ktd253 - Use common platform API in qcom-wled and fbdev" * tag 'backlight-next-5.12' of git:// backlight/video: Use Platform getter/setter functions backlight: ktd253: Bring up in a known state backlight: sky81452-backlight: Convert comma to semicolon backlight: lms283gf05: Convert to GPIO descriptors