summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2026-07-29wifi: ath12k: move firmware_mode enum to qmi.hJeff Johnson5-14/+18
The enum ath12k_firmware_mode defines values that are part of the QMI ABI, so it belongs in qmi.h rather than core.h. Consolidate it there along with ATH12K_FIRMWARE_MODE_OFF, which is currently a bare macro. Rename the enum to ath12k_qmi_firmware_mode to align with the naming convention of the other enums in qmi.h, and place it with the other ath12k_qmi_* enums. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c7-00108-QCAHMTSWPL_V1.0_V2.0_SILICONZ_UPSTREAM-3 Assisted-by: Claude:claude-sonnet-4-6 Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com> Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Link: https://patch.msgid.link/20260725-consolidate-firmware_mode-v1-1-aedff0ce0ba5@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-07-29wifi: ath12k: validate TLV length in process_tpc_stats()Jeff Johnson1-0/+8
The outer skb->len guard only confirms the SKB is large enough to hold the full fixed_param struct, but the TLV's own WMI_TLV_LEN field is never checked. Firmware advertising a TLV length shorter than sizeof(*fixed_param) causes reads of pdev_id and event_count beyond the declared TLV payload. Add a check that the TLV length is at least sizeof(*fixed_param) before casting and dereferencing the pointer. Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") Assisted-by: Claude:claude-sonnet-4-6 Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com> Link: https://patch.msgid.link/20260726-ath12k_wmi_process_tpc_stats-len-check-v1-1-c4ba2f84d9c6@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-07-29wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event()Jeff Johnson1-2/+19
There is no policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT, so the parse infrastructure does not enforce a minimum length for the event struct. Additionally, the num_vdevs field is taken directly from firmware and used as a loop bound over the vdev_ids array without checking that it fits within the TLV payload. Either condition can cause an out-of-bounds read. Add a TLV policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT so the parse infrastructure enforces a minimum length for the fixed-size event struct. Add a helper ath11k_wmi_tlv_data_len() to recover the payload length of a parsed TLV from the header preceding its data pointer. Use it in ath11k_wmi_process_csa_switch_count_event() to bound num_vdevs before the loop. Compile tested only. Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices") Assisted-by: Claude:claude-sonnet-4-6 Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com> Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Link: https://patch.msgid.link/20260724-ath12k_wmi_process_csa_switch_count_event-cleanup-v2-2-02a45d7246c0@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-07-29wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event()Jeff Johnson1-0/+16
There is no policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT, so the parse infrastructure does not enforce a minimum length for the event struct. Additionally, the num_vdevs field is taken directly from firmware and used as a loop bound over the vdev_ids array without checking that it fits within the TLV payload. Either condition can cause an out-of-bounds read. Add a TLV policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT so the parse infrastructure enforces a minimum length for the fixed-size event struct. Add a helper ath12k_wmi_tlv_data_len() to recover the payload length of a parsed TLV from the header preceding its data pointer. Use it in ath12k_wmi_process_csa_switch_count_event() to bound num_vdevs before the loop. Compile tested only. Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") Assisted-by: Claude:claude-sonnet-4-6 Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com> Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Link: https://patch.msgid.link/20260724-ath12k_wmi_process_csa_switch_count_event-cleanup-v2-1-02a45d7246c0@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-07-29drm/panthor: Fix comment to reflect actual struct field nameAdrián Larumbe1-1/+1
The mismatch would pop up when building the kernel with W=1. Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com> Reviewed-by: Steven Price <steven.price@arm.com> Reviewed-by: Liviu Dudau <liviu.dudau@arm.com> Signed-off-by: Adrián Larumbe <adrian.larumbe@collabora.com> Link: https://patch.msgid.link/20260720-vm_bind_checks-v6-2-c2c7dbe93a73@collabora.com Signed-off-by: Steven Price <steven.price@arm.com>
2026-07-29drm/panthor: Add vm_bind region with kbo range overlap checkAdrián Larumbe1-0/+9
When a VM is created, caller has to specify the range of the address space carve-out set aside for mapping kernel BO's. That means vm_bind mappings of UM-exposed BO's should not intersect with that region, but at the moment we're not checking this. At first, I thought of giving these values to drm_gpuvm_init() through its reserve_{offset, range} arguments, but it turns out that is meant for VM address spans that are not managed through the usual drm_gpuvm split/merge circuit, so storing the end of the user VA range at VM creation time and doing a quick check in the vm_bind ioctl path was the simplest workaround. The new check also makes sure vm_bind range doesn't overflow the size of a 64-bit unsigned integer. That was already being done further down the call stack inside drm_gpuvm_sm_map -> drm_gpuvm_range_valid, but it's best to fail early in the driver before GPUVM functions are invoked so that we won't waste time allocating vm_bind context resources. Fixes: 12cf826bf1dd ("drm/panthor: Support sparse mappings") Fixes: 647810ec2476 ("drm/panthor: Add the MMU/VM logical block") Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com> Signed-off-by: Adrián Larumbe <adrian.larumbe@collabora.com> Reviewed-by: Steven Price <steven.price@arm.com> Link: https://patch.msgid.link/20260720-vm_bind_checks-v6-1-c2c7dbe93a73@collabora.com Signed-off-by: Steven Price <steven.price@arm.com>
2026-07-29spi: davinci: switch to managed controller allocationFan Wu1-4/+3
The controller is allocated with the non-managed spi_alloc_host() while the interrupt is registered with devm_request_threaded_irq(). During removal, spi_bitbang_stop() only unregisters the controller; the subsequent spi_controller_put() then frees the controller together with its embedded davinci_spi devdata, which is the IRQ handler's dev_id. The devm_request_threaded_irq() release action (free_irq()), which drains the handler, does not run until after .remove() returns. A late or latched interrupt can therefore reach davinci_spi_irq() and dereference already-freed memory. Switch to devm_spi_alloc_host() so that the devres LIFO order releases the controller only after free_irq() has drained the handler, and drop the now-redundant spi_controller_put() from .remove(). The probe error path is simplified to direct returns. The clock is acquired with devm_clk_get_enabled(), which is registered after the IRQ and thus released before it by the devres LIFO order. Drain the interrupt explicitly with devm_free_irq() before disabling the controller so that a late interrupt cannot access the registers of a clock-gated controller. This issue was found by an in-house static analysis tool. Fixes: 5b3bb5963ff2 ("spi: davinci: Use devm_*() functions") Assisted-by: Codex:gpt-5.6 Signed-off-by: Fan Wu <fanwu01@zju.edu.cn> Link: https://patch.msgid.link/20260719010014.3163356-2-fanwu01@zju.edu.cn Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-29dt-bindings: PCI: rcar-gen4-pci-host: Document optional msi-parentMarek Vasut1-0/+3
The R-Car Gen4 PCIe controller can optionally use GIC ITS as an MSI controller. This configuration is described in DT by setting msi-parent DT property in the PCIe controller node. Document this configuration. Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Acked-by: Rob Herring (Arm) <robh@kernel.org> Link: https://patch.msgid.link/20260720015505.314957-1-marek.vasut+renesas@mailbox.org
2026-07-29drm/panthor: validate firmware interface structure sizesOsama Abdelkader1-12/+24
iface_fw_to_cpu_addr() only checks that the firmware-provided MCU virtual address points inside the shared section. The returned pointer is later used as a full firmware interface structure, so accepting an address near the end of the shared section can still lead to out-of-bounds accesses. Pass the expected object size to iface_fw_to_cpu_addr() and reject ranges that do not fit entirely in the shared section. Fixes: 2718d91816ee ("drm/panthor: Add the FW logical block") Cc: stable@vger.kernel.org Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com> Reviewed-by: Steven Price <steven.price@arm.com> Signed-off-by: Steven Price <steven.price@arm.com> Link: https://patch.msgid.link/20260720114918.15973-1-osama.abdelkader@gmail.com
2026-07-29nvmet: reject out-of-range mdts values in configfs storeGuixin Liu1-4/+6
nvmet_param_mdts_store() accepts any integer that kstrtoint() can parse and stores it directly into port->mdts. The value is only range-checked later, when the port is enabled: nvmet_enable_port() silently resets port->mdts to 0 if it is negative or greater than NVMET_MAX_MDTS. As a result, writing e.g. "mdts=1000" succeeds and reading the attribute back returns 1000, yet enabling the port quietly turns it into 0. This is confusing and hides the invalid input from the user. Validate the value against [0, NVMET_MAX_MDTS] in the store handler and reject anything out of range with -EINVAL, so the error is reported at write time and port->mdts never holds a value the port cannot use. Fixes: 0a5a94648627 ("nvmet: introduce new mdts configuration entry") Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Guixin Liu <kanie@linux.alibaba.com> Signed-off-by: Keith Busch <kbusch@kernel.org>
2026-07-29nvme-pci: return error when parsing a quirk string failsGuixin Liu1-0/+1
quirks_param_set() reuses 'err', which param_set_copystring() left as 0, as the return value of the whole function. When nvme_parse_quirk_entry() fails to parse a field, the code jumps to out_free_qlist and returns that stale 0, so a malformed quirks= parameter is silently accepted as valid. Set err to -EINVAL before jumping out on a parse failure. Fixes: 7bb8c40f5ad8 ("nvme: add support for dynamic quirk configuration via module parameter") Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Daniel Wagner <dwagner@suse.de> Signed-off-by: Guixin Liu <kanie@linux.alibaba.com> Signed-off-by: Keith Busch <kbusch@kernel.org>
2026-07-29nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_requestGuixin Liu1-0/+6
__nvme_fc_init_request() maps cmd_iu and then rsp_iu for DMA. If the rsp_iu mapping fails, the original code only recorded the error and fell through: it left the already-mapped cmd_iu unmapped and still marked the op as FCPOP_STATE_IDLE before returning. Since blk-mq does not call .exit_request() when .init_request() fails, the cmd_iu mapping is leaked for every op whose rsp_iu mapping fails. Jump to an error path on rsp_iu mapping failure that unmaps cmd_iu and returns the error without marking the op idle, so it stays in the FCPOP_STATE_UNINIT state set by the initial memset(). Fixes: e399441de911 ("nvme-fabrics: Add host support for FC transport") Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Guixin Liu <kanie@linux.alibaba.com> Signed-off-by: Keith Busch <kbusch@kernel.org>
2026-07-29nvmet: fix return status of RMI log page on allocation failureGuixin Liu1-1/+3
nvmet_execute_get_log_page_rmi() leaves 'status' holding NVME_SC_SUCCESS (set by the successful nvmet_req_find_ns() call) when the kzalloc() for the log buffer fails. It then jumps to the out label and completes the request with a success status, so the host is told the command succeeded while no data was transferred. Initialize 'status' to NVME_SC_INTERNAL, matching the smart log handler, so an allocation failure is reported as an internal error. Fixes: 5fd075cdaf36 ("nvmet: implement rotational media information log") Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Guixin Liu <kanie@linux.alibaba.com> Signed-off-by: Keith Busch <kbusch@kernel.org>
2026-07-29Merge tag 'samsung-drivers-7.3' of ↵Arnd Bergmann3-5/+27
https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/drivers Samsung SoC drivers for v7.3 1. Fix very old leak of OF node in PMU driver. 2. Few cleanups and new bindings for ExynosAutov920 HSI0 syscon. * tag 'samsung-drivers-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: dt-bindings: samsung: exynos-pmu: Narrow allowed reboot modes dt-bindings: samsung: exynos-pmu: Restrict children with unevaluatedProperties dt-bindings: soc: samsung: exynos-sysreg: Add hsi0 for ExynosAutov920 soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-07-29Merge tag 'memory-controller-drv-7.3' of ↵Arnd Bergmann5-22/+127
https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl into soc/drivers Memory controller drivers for v7.3 1. Few improvements: STM32 OMM, Tegra MC and JZ4780-nemc. 2. Refactor Tegra MC interconnect code to better represent actual hardware in multi-socket NUMA cases. * tag 'memory-controller-drv-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl: memory: jz4780-nemc: Use dev_err_probe() for clock error memory: tegra: Guard against NULL mc_regs in IRQ handler memory: tegra: add multi-socket support to the memory interconnect memory: stm32_omm: initialize ret in stm32_omm_set_amcr Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-07-29Merge tag 'cix-dt-v7.3-rc1' of https://github.com/cixtech/linux-mainline ↵Arnd Bergmann1-0/+14
into soc/dt dt: add DMA-350 support for Sky1 * tag 'cix-dt-v7.3-rc1' of https://github.com/cixtech/linux-mainline: arm64: dts: cix: add sky1 DMA-350 node with channel IRQ entries Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-07-29drm/panthor: harden firmware build-info bounds checksOsama Abdelkader1-1/+2
panthor_fw_read_build_info() checks whether the metadata range fits in the firmware image with hdr.meta_start + hdr.meta_size. Both fields are u32, so the addition can wrap and let an out-of-bounds range pass validation. The function also reads the "git_sha: " prefix without first checking that the metadata is long enough, and meta_size == 0 can underflow the NULL terminator index. Use subtraction-based bounds checking and reject metadata that is too short to contain the expected prefix and trailing NULL byte. Fixes: 2718d91816ee ("drm/panthor: Add the FW logical block") Cc: stable@vger.kernel.org Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com> Reviewed-by: Steven Price <steven.price@arm.com> Signed-off-by: Steven Price <steven.price@arm.com> Link: https://patch.msgid.link/20260720113212.11981-1-osama.abdelkader@gmail.com
2026-07-29ASoC: ti: preparation for Card capsulingMark Brown3-20/+18
Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> says: I will post Card capsuling patch. To makes its review easy, tidyup its drivers to reduce un-related diff as preparation. No functional change, but is preparation for cleanup driver. Link: https://patch.msgid.link/87ldb5i0do.wl-kuninori.morimoto.gx@renesas.com
2026-07-29ASoC: ti: ams-delta: use &pdev->dev instead of card->devKuninori Morimoto1-2/+2
ams_delta_probe() will be updated when Card capsuling. To makes its review easy, use &pdev->dev instead of card->dev. These are same card->dev = &pdev->dev; No functional change, but is preparation for Card capsuling. Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87h5lti0cu.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-29ASoC: ti: tidyup not to use *card on rx51_soc_probe()Kuninori Morimoto1-15/+16
struct snd_soc_card will be capsuled soon, its member will not be able to access from non soc-card.c. To reduce the difference during conversion, replace dev. - card->dev, ... + dev, ... No functional change, but is preparation for Card capsuling. Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Acked-by: Jarkko Nikula <jarkko.nikula@bitmer.com> Tested-by: Jarkko Nikula <jarkko.nikula@bitmer.com> Link: https://patch.msgid.link/87ik69i0d0.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-29ASoC: ti: omap-hdmi: remove unused *cardKuninori Morimoto1-3/+0
No one is using ad->card. Remove it. Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87jyqpi0d9.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-29arm64: dts: rockchip: Add Anbernic RG Vita-ProChris Morgan2-0/+1284
Add device tree for the Anbernic RG Vita-Pro, based on the Rockchip RK3576. All hardware is currently working except for the accelerometer, the touchscreen, the battery monitor, and DisplayPort over USB-C. PWM is also missing currently, and as a result the LEDs and panel backlight are currently controlled via GPIO but will be changed to PWM once supported. The Anbernic RG Vita-Pro includes the following hardware: - A 1080x1920 DSI display with touch. - 21 buttons. - 3 LEDs. - 64GB eMMC, 2 SDMMC slots. - RTL8852BE WiFi (with Bluetooth via UART) - 1 USB 3.0 USB-C port in OTG mode. - 3.5mm headphone jack with play button support. - 5000mAH battery The following hardware has incomplete driver support and is not yet working: - An Invensense icm42607p accelerometer. - A Cellwise cw221x battery monitor. - A Synaptics i2c touchscreen. - DisplayPort over USB-C alt-mode. - PWM controller. - 2 Analog joysticks with LED controllers. Signed-off-by: Chris Morgan <macromorgan@hotmail.com> Link: https://patch.msgid.link/20260728203832.166402-5-macroalpha82@gmail.com [dropped unused pmic pinconfig definitions, sorted nodes] Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-29PCI: Use standard wait times for PCIe link monitoringThierry Reding7-33/+12
Instead of defining the wait values for each driver, use common values defined in the core pci.h header file. Note that while most drivers use the usleep_range(), it looks like these were mostly cargo culted and msleep() is a better choice given the fixed delay that the specification calls for. Convert all drivers to msleep() and use the existing definition. Signed-off-by: Thierry Reding <treding@nvidia.com> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Reviewed-by: Aksh Garg <a-garg7@ti.com> Link: https://patch.msgid.link/20260716-tegra264-pcie-v8-3-23e51589229b@nvidia.com
2026-07-29dt-bindings: arm: rockchip: Add Anbernic RG Vita-ProChris Morgan1-0/+6
Add compatible string for the Anbernic RG Vita-Pro. Signed-off-by: Chris Morgan <macromorgan@hotmail.com> Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://patch.msgid.link/20260728203832.166402-4-macroalpha82@gmail.com Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-29ASoC: sunxi: Simplify error handlingMark Brown5-99/+63
bui duc phuc <phucduc.bui@gmail.com> says: This series improves probe error handling in the sunxi ASoC drivers. It replaces suitable probe error paths with dev_err_probe() to simplify the code and handle deferred probe errors consistently. It also removes redundant error messages where the called helpers already report failures, avoiding duplicate log messages. Build tested only. Link: https://patch.msgid.link/20260715095525.40668-1-phucduc.bui@gmail.com
2026-07-29ASoC: sunxi: sun8i-codec-analog: Improve probe error handlingbui duc phuc1-7/+4
Drop the redundant error message after devm_platform_ioremap_resource(), which already reports failures, and use dev_err_probe() for regmap initialization errors. Signed-off-by: bui duc phuc <phucduc.bui@gmail.com> Reviewed-by: Chen-Yu Tsai <wens@kernel.org> Link: https://patch.msgid.link/20260715095525.40668-7-phucduc.bui@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-29ASoC: sunxi: sun50i-codec-analog: Improve probe error handlingbui duc phuc1-7/+4
Drop the redundant error message after devm_platform_ioremap_resource(), which already reports failures, and use dev_err_probe() for regmap initialization errors. Signed-off-by: bui duc phuc <phucduc.bui@gmail.com> Reviewed-by: Chen-Yu Tsai <wens@kernel.org> Link: https://patch.msgid.link/20260715095525.40668-6-phucduc.bui@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-29ASoC: sunxi: sun4i-spdif: Use dev_err_probe() for probe error handlingbui duc phuc1-13/+10
Use dev_err_probe() for probe error handling to simplify the error paths and handle -EPROBE_DEFER correctly. Signed-off-by: bui duc phuc <phucduc.bui@gmail.com> Reviewed-by: Chen-Yu Tsai <wens@kernel.org> Link: https://patch.msgid.link/20260715095525.40668-5-phucduc.bui@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-29ASoC: sunxi: sun4i-i2s: Use dev_err_probe() for probe error handlingbui duc phuc1-16/+12
Use dev_err_probe() for probe error handling to simplify the error paths and handle -EPROBE_DEFER correctly. Signed-off-by: bui duc phuc <phucduc.bui@gmail.com> Reviewed-by: Chen-Yu Tsai <wens@kernel.org> Link: https://patch.msgid.link/20260715095525.40668-4-phucduc.bui@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-29ASoC: sunxi: sun4i-codec: Drop redundant error messagesbui duc phuc1-14/+5
The called functions already log failures where appropriate. Return the original error directly and avoid duplicate error messages. Signed-off-by: bui duc phuc <phucduc.bui@gmail.com> Link: https://patch.msgid.link/20260715095525.40668-3-phucduc.bui@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-29ASoC: sunxi: sun4i-codec: Use dev_err_probe() for probe error handlingbui duc phuc1-42/+28
Use dev_err_probe() for probe error handling to simplify the error paths and handle -EPROBE_DEFER correctly. Signed-off-by: bui duc phuc <phucduc.bui@gmail.com> Link: https://patch.msgid.link/20260715095525.40668-2-phucduc.bui@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-29ovpn: add missing rtnl_link_ops->get_size callbackRalf Lici1-0/+7
ovpn_fill_info emits IFLA_OVPN_MODE inside IFLA_INFO_DATA, but ovpn_link_ops does not provide a get_size callback. Consequently, rtnetlink's size estimate for ovpn link messages does not include the nested mode attribute. Available skb tailroom may hide this mismatch. When the remaining space is insufficient, however, ovpn_fill_info returns -EMSGSIZE and message construction fails. Add the callback and account for IFLA_OVPN_MODE. Fixes: c2d950c4672a ("ovpn: add basic interface creation/destruction/management routines") Signed-off-by: Ralf Lici <ralf@mandelbit.com> Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
2026-07-29powerpc: Move CONFIG_QE_GPIO to SoCChristophe Leroy (CS GROUP)3-8/+9
Commit 7aa1aa6ecec2 ("QE: Move QE from arch/powerpc to drivers/soc") moved QE into drivers/soc including gpio.c but left CONFIG_QE_GPIO in powerpc's Kconfig. Move it to SoC as well as it is the only place it is used: drivers/soc/fsl/qe/Makefile:obj-$(CONFIG_QE_GPIO) += gpio.o qe_ports_ic.o include/soc/fsl/qe/qe.h:#ifdef CONFIG_QE_GPIO include/soc/fsl/qe/qe.h:#endif /* CONFIG_QE_GPIO */ There is also a dependency in USB subsystem for CONFIG_USB_FHCI_HCD: drivers/usb/host/Kconfig: depends on QE_GPIO && QUICC_ENGINE Because that USB driver selects CONFIG_FSL_GTM which is specific to powerpc, it has to depend on CONFIG_PPC. Acked-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://lore.kernel.org/r/9a7131d15a94e2017877e628f0e97f9aa2e0aae9.1785140877.git.chleroy@kernel.org Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
2026-07-29fprobe: Fix module reference count leak on error in register_fprobe()Masami Hiramatsu (Google)1-4/+2
In register_fprobe(), get_ips_from_filter() resolves target function addresses and increments module reference counts via try_module_get() for symbols in kernel modules. If get_ips_from_filter() fails on the second pass and returns an error, register_fprobe() returned directly without releasing module references acquired up to that point. Fix this by ensuring the cleanup loop executing module_put() runs even when get_ips_from_filter() returns a negative error. Link: https://lore.kernel.org/all/178528125360.101985.4144133640239273153.stgit@devnote2/ Fixes: d24fa977eec5 ("tracing: fprobe: Fix to lock module while registering fprobe") Assisted-by: Antigravity:gemini-3.6-flash Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
2026-07-29drm/xe/pt: check no-DMA huge-pte cases before DMA segment testHimal Prasad Ghimiray1-5/+8
On a non-range clear, curs.size is never set, so the segment test (next - va_curs_start > curs->size) returns false for every level > 0 before the clear_pt short-circuit is reached. The clear then descends to level 0 instead of forming a huge zero-leaf, wasting page tables and risking -ENOMEM on unbind. Move the null-VMA, purged-BO and clear_pt short-circuits above the curs->size test. The bind path always sets curs.size, so it is unaffected. v2 - Also set curs.size on the clear path so the cursor stays meaningful during the walk. clear_pt is only reached with range == NULL, so assert that invariant. (Matthew Brost) Cc: Matthew Brost <matthew.brost@intel.com> Fixes: 5b658b7e89c3 ("drm/xe: Clear scratch page on vm_bind") Reported-by: Sashiko <sashiko-bot@kernel.org> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260728055916.593707-2-himal.prasad.ghimiray@intel.com Signed-off-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com> (cherry picked from commit 04eeeb45cb61b8a3e9d785003457e550c920ba49) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-07-29ASoC: dt-bindings: realtek,rt5640: Make interrupts optionalFabio Estevam1-1/+0
The RT5640 GPIO1/IRQ pin can be configured either as GPIO1 or as the codec interrupt output. Some boards, such as the Firefly-RK3399, do not connect the codec interrupt output. This causes the following binding validation warning: 'interrupts' is a required property Make the interrupts property optional to support such hardware configurations. Signed-off-by: Fabio Estevam <festevam@gmail.com> Link: https://patch.msgid.link/20260727185814.2599488-1-festevam@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-29drm/imagination: Update the trace point pvr_job_submit_fw()Brajesh Gupta1-2/+5
Trace point pvr_job_submit_fw() is used to trace job submission to the FW. Currently it is recorded when a command is written to the Client circular buffer. Move trace recording after writing command to the Kernel circular buffer to better represent command submission to the FW. Fixes: c1079aebb4de ("drm/imagination: Add support for trace points") Signed-off-by: Brajesh Gupta <brajesh.gupta@imgtec.com> Reviewed-by: Alessio Belle <alessio.belle@imgtec.com> Link: https://patch.msgid.link/20260724-b4-tracepoint-fix-v3-1-8f8e5e8179d3@imgtec.com Signed-off-by: Alessio Belle <alessio.belle@imgtec.com>
2026-07-29Merge tag 'socfpga_dts_updates_for_v7.3' of ↵Arnd Bergmann12-14/+346
https://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux into soc/dt SoCFPGA DTS updates for v7.3 - dt-bindings updates: - Document compatible for Agilex72 - Document additional interrupts for Agilex5 - Add the additional interrupts for the gmac on Agilex5 - Use decimal number for interrupts, not hexadecimal - Enable the SMMU on Agilex5 - Add dma-coherent on XGMAC nodes - Add initial support for the Agilex72 SoCDK - Correct indentation on Arria10 - Update QSPI boot partition label * tag 'socfpga_dts_updates_for_v7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: arm64: dts: socfpga: use consistent QSPI boot partition label ARM: dts: intel: arria10: Correct indentation arm64: dts: socfpga: agilex5: update channel interrupts for gmac1 and gmac2 dt-bindings: net: altr,socfpga-stmmac: add more interrupts for Agilex5 arm64: dts: socfpga: agilex72: Add initial device tree dt-bindings: arm: altera: Add Agilex72 SoCFPGA compatible strings arm64: dts: socfpga: agilex5: Add dma-coherent to XGMAC nodes arm64: dts: socfpga: agilex5: Enable the SMMU arm64: dts: intel: keembay: Always use decimal interrupts arm64: dts: socfpga: agilex5: Add per-channel interrupts to gmac0 Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-07-29Merge tag 'v7.3-rockchip-dts32-1' of ↵Arnd Bergmann8-0/+587
https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/dt New board: Alientek DLRV1126 Eeprom for RK3288-Tinker-board * tag 'v7.3-rockchip-dts32-1' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: ARM: dts: rockchip: Add Alientek DLRV1126 ARM: dts: rockchip: Add RV1126 I2C5 dt-bindings: arm: rockchip: Add Alientek DLRV1126 dt-bindings: vendor-prefixes: add alientek ARM: dts: rockchip: add eeprom node to rk3288-tinker Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-07-29fsnotify: Remove Matt Bobrowski as a reviewerJan Kara1-1/+0
Matt was not very active reviewer in last years. Furthermore he apparently left Google and his email doesn't work anymore. I didn't find any working contact for him so at least for now delete the entry with non-existent email. Signed-off-by: Jan Kara <jack@suse.cz>
2026-07-29Merge tag 'thead-dt-for-v7.3' of ↵Arnd Bergmann2-37/+157
https://git.kernel.org/pub/scm/linux/kernel/git/fustini/linux into soc/dt T-HEAD device tree changes for v7.3 There is just one set of changes that the remaining IO expansion chips on the TH1520-based LicheePi 4a board. * tag 'thead-dt-for-v7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/fustini/linux: riscv: dts: thead: Add remaining Lichee Pi 4A IO expansions riscv: dts: thead: Add IO labels for the IO expansion on I2C1 riscv: dts: thead: lpi4a: sort nodes riscv: dts: thead: Add TH1520 I2C nodes riscv: dts: thead: th1520: remove pclk for I2C1 Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-07-29drm/i915/dp: Ignore the sink's DSC max FRL rate without a PCON DSC encoderAlexander Kaplan1-1/+8
intel_dp_hdmi_sink_max_frl() limits the sink's max FRL rate by its DSC max FRL rate whenever the sink supports DSC 1.2. However, the DSC max FRL rate (HF-VSDB DSC_Max_FRL_Rate) only applies to compressed video transport, which requires a DSC 1.2 encoder in the PCON (configured via intel_dp_pcon_dsc_configure()). Without such an encoder the HDMI link always carries uncompressed video, for which the regular Max_FRL_Rate is the correct limit. Applying the DSC limit unconditionally trains the FRL link at a lower rate than both the PCON and the sink support. E.g. an LG OLED G4 (Max_FRL_Rate 48 Gbps, DSC_Max_FRL_Rate 24 Gbps) behind a Synaptics VMM7100 PCON (PCON max FRL bw 48 Gbps, no DSC encoder): Sink max rate from EDID = 24 Gbps FRL trained with : 24 Gbps while Windows/macOS train the same hardware at 40/48 Gbps. The too low FRL rate needlessly constrains the formats available to the sink. Only apply the sink's DSC max FRL rate if the PCON has a DSC 1.2 encoder, matching the gate in intel_dp_pcon_dsc_configure(). PCONs with a DSC encoder keep the current conservative behavior, since the link is trained once and compressed transport may be used for any subsequent mode. With this the setup above trains at 48 Gbps. Tested on PTL (xe) with the above PCON/sink combo. Fixes: 10fec80b48c5 ("drm/i915/display: Configure PCON for DSC1.1 to DSC1.2 encoding") Cc: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Cc: Ville Syrjälä <ville.syrjala@linux.intel.com> Reviewed-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Signed-off-by: Alexander Kaplan <alexander.kaplan@sms-medipool.de> Signed-off-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Link: https://patch.msgid.link/20260718105207.5565-3-alexander.kaplan@sms-medipool.de (cherry picked from commit 71b57dd92f94569dca4bdf883fbd8ca5d4ed4bae) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-07-29Merge tag 'samsung-dt64-7.3' of ↵Arnd Bergmann7-0/+829
https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/dt Samsung DTS ARM64 changes for v7.3 1. New SoC Exynos8855 (market naming: Exynos 1580) basic support with its SMDK development board. That's a 8-core SoC, released in Q4 2024. 2. ExynosAutov920: Add HSI0 syscon node. * tag 'samsung-dt64-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: MAINTAINERS: Add entry for Samsung Exynos8855 SoC arm64: dts: exynos: add initial support for Samsung Exynos8855 smdk dt-binding: ARM: samsung: Add Samsung Exynos8855 arm64: dts: exynosautov920: Add hsi0 syscon node for PCIe PHY Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-07-29ext2: Simplify error handling of IO error when adding xattrJan Kara1-9/+5
When we fail to write out inode when adding new xattr block, we backed out some changes (like quota modifications) but left others (like block allocation or inode xattr block modification). Just leave the inode intact in this case because we can hardly reach a consistent state and defer fixing to e2fsck. Also remove outdated comment and special data handling since sync_inode_metadata() does not write out any data. Link: https://patch.msgid.link/20260728154724.3934977-2-jack@suse.cz Signed-off-by: Jan Kara <jack@suse.cz>
2026-07-29KVM: riscv: selftests: add Zicfiss/Zicfilp extension to get-reg-list testInochi Amaoto1-0/+69
The KVM RISC-V allows Zicfiss/Zicfilp extensions for Guest/VM so add these extensions to get-reg-list test. Assisted-by: YuanSheng:claude-4.7-opus Co-developed-by: Quan Zhou <zhouquan@iscas.ac.cn> Signed-off-by: Quan Zhou <zhouquan@iscas.ac.cn> Signed-off-by: Inochi Amaoto <inochiama@gmail.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260713010302.303278-9-inochiama@gmail.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-07-29RISC-V: KVM: Add support for control-flow integrity FWFT featuresInochi Amaoto2-0/+107
Control-flow integrity is controlled through a WARL field in henvcfg. Expose the feature only if the Zicfilp/Zicfiss is supported for VS-mode. Allow the VMM to block access to the feature by disabling the ISA extension in the guest. Assisted-by: YuanSheng:claude-4.7-opus Co-developed-by: Quan Zhou <zhouquan@iscas.ac.cn> Signed-off-by: Quan Zhou <zhouquan@iscas.ac.cn> Signed-off-by: Inochi Amaoto <inochiama@gmail.com> Link: https://lore.kernel.org/r/20260713010302.303278-8-inochiama@gmail.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-07-29IB/isert: reject login PDUs declaring more data than was receivedYehyeong Lee1-1/+24
isert_login_recv_done() records how many bytes the HCA actually placed in the login buffer, but nothing compares that against the length the login PDU's BHS declares. isert_rx_login_req() copies min(login_req_len, MAX_KEY_VALUE_PAIRS) bytes into login->req_buf, and the login code then reads the declared length back out of that buffer - for the first PDU in iscsi_target_locate_portal(), payload_length = ntoh24(login_req->dlength); tmpbuf = kmemdup_nul(login->req_buf, payload_length, GFP_KERNEL); and for the ones after it in iscsi_decode_text_input(), reached from iscsi_target_do_login(). login->req_buf is a fixed MAX_KEY_VALUE_PAIRS (8192) byte allocation, so an initiator that declares more than it sends reads off the end of it, before authentication and with the length under its control: BUG: KASAN: slab-out-of-bounds in kmemdup_nul+0x43/0x80 Read of size 8193 at addr ffff8881056a8000 by task iscsi_np/167 __asan_memcpy+0x23/0x60 kmemdup_nul+0x43/0x80 iscsi_target_locate_portal+0x48d/0x1180 iscsi_target_login_thread+0x19a9/0x3350 Allocated by task 167: __kmalloc_cache_noprof+0x158/0x370 iscsi_target_login_thread+0x971/0x3350 which belongs to the cache kmalloc-8k of size 8192 allocated 8192-byte region Falsifying the second login PDU instead reaches the other reader, on the same buffer: BUG: KASAN: slab-out-of-bounds in kmemdup_nul+0x43/0x80 Read of size 8193 at addr ffff888104d10000 by task kworker/1:1/50 Workqueue: isert_login_wq iscsi_target_do_login_rx __asan_memcpy+0x23/0x60 kmemdup_nul+0x43/0x80 iscsi_decode_text_input+0xc6/0x11c0 iscsi_target_do_login+0x261/0x1470 iscsi_target_do_login_rx+0x51d/0x7d0 iscsit over TCP is not exposed: iscsit_get_login_rx() validates the declared length with iscsi_target_check_login_request() and then reads exactly that many bytes off the socket, so the declared length governs how much arrives rather than how much is copied out of an already-filled buffer. isert does not call iscsi_target_check_login_request() at all. Reject a login PDU whose declared DataSegmentLength exceeds what was received, in both paths that reach isert_rx_login_req(): isert_get_login_rx() for the first login PDU and isert_login_recv_done() for the ones after it. dlength <= login_req_len is allowed because the received count can include up to three bytes of iSCSI padding. Once the check is in place the copy out can no longer exceed the copy in: the posted login SGE is ISER_RX_PAYLOAD_SIZE, so login_req_len cannot exceed MAX_KEY_VALUE_PAIRS and the min() in isert_rx_login_req() is login_req_len. Like the existing short-PDU check added by 29e7b925ae6d, the reject in isert_login_recv_done() returns without completing login_req_comp, so a malformed subsequent PDU leaves the login to be torn down by the login timer rather than failing immediately. The first-PDU path returns an error and fails straight away. Reproduced on 7.2.0-rc4 with soft-RoCE (rdma_rxe) under KASAN, using an initiator that sends the real key=value payload while declaring 8193 in the BHS, on the first login PDU and on the second in separate runs. The reported read size tracks the declared value exactly; 16384 and 61440 behave the same. Unpatched 3 of 3 runs report on each of the two paths, patched 0 of 3 on both, run alternately in a single session, and a normal login still completes on the patched build. Fixes: b8d26b3be8b3 ("iser-target: Add iSCSI Extensions for RDMA (iSER) target driver") Suggested-by: Leon Romanovsky <leonro@nvidia.com> Signed-off-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr> Link: https://patch.msgid.link/20260726163931.971063-3-yhlee@isslab.korea.ac.kr Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-29IB/isert: reject PDUs declaring more data than was receivedYehyeong Lee1-0/+15
isert_recv_done() hands each received PDU to the opcode handlers without ever looking at wc->byte_len, the number of bytes the HCA actually placed in the receive descriptor. The handlers then copy that many bytes - the data-segment length the initiator declared in the BHS (ntoh24(hdr->dlength), via the derived unsol_data_len / imm_data_len) - out of the fixed-size descriptor: isert_handle_iscsi_dataout(): sg_copy_from_buffer(sg_start, sg_nents, isert_get_data(rx_desc), unsol_data_len); isert_handle_scsi_cmd(): sg_copy_from_buffer(cmd->se_cmd.t_data_sg, sg_nents, isert_get_data(rx_desc), imm_data_len); Because the declared length is never checked against wc->byte_len, an initiator can declare a data segment larger than the bytes it actually sent (and larger than the descriptor) and cause an out-of-bounds read of the receive buffer. Nothing upstream of isert closes this door: - __iscsit_check_dataout_hdr() bounds the inbound payload against conn_ops->MaxXmitDataSegmentLength (MXDSL) - a transmit parameter, used here for the inbound check. - iscsi_set_connection_parameters() sets ops->MaxXmitDataSegmentLength = ops->TargetRecvDataSegmentLength; and TARGETRECVDATASEGMENTLENGTH is absent from the min()-clamp list in iscsi_check_acceptor_state(), so the value the initiator declares is adopted verbatim (type range 512..16777215). The initiator effectively raises its own ceiling. - isert never clamps the negotiated value to its own fixed receive descriptor (ISER_RX_SIZE, 9216 bytes), so the target core's bound and the descriptor size are unrelated. The imm_data_len == data_len path is more than an over-read: it aliases the receive descriptor via sg_set_buf() and passes it to the backend as the data source for the SCSI WRITE, so an over-declared length causes heap contents past the descriptor to be written through the backend to the backing store. The backend is the victim of the oversized scatterlist isert hands it, not the cause; no read-back of the written bytes was demonstrated. Trigger: after login completes (full feature phase), an initiator that has declared a large TargetRecvDataSegmentLength and a FirstBurstLength that permits unsolicited/immediate data sends a PDU whose declared data-segment length exceeds what was received. With KASAN: BUG: KASAN: slab-out-of-bounds in sg_copy_buffer+0x150/0x1c0 Read of size 4096 at addr ffff888109720800 by task kworker/1:0H/25 Workqueue: ib-comp-wq ib_cq_poll_work Call Trace: sg_copy_buffer+0x150/0x1c0 isert_recv_done+0xba6/0x2390 __ib_process_cq+0xe1/0x390 ib_cq_poll_work+0x46/0x150 isert_recv_done+0xba6 resolves to isert_handle_iscsi_dataout() (ib_isert.c:1160), inlined through isert_rx_opcode(). Validate wc->byte_len against the framing in isert_recv_done() before the PDU reaches any handler, and reinstate the connection if it is short. Because the test compares without subtracting the header length, it also rejects PDUs shorter than the iSER and iSCSI headers, which would otherwise be parsed out of stale descriptor contents. The login handler rejects PDUs shorter than ISER_HEADERS_LEN (commit 29e7b925ae6d ("IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN")) but does not bound the declared length either; that is fixed in the next patch. The data handlers had no length check at all. isert reads the data segment from a fixed offset: isert_get_data() returns the iSER header plus ISER_HEADERS_LEN and makes no adjustment for an AHS. The bytes the handlers touch are therefore exactly [ISER_HEADERS_LEN, ISER_HEADERS_LEN + dlength), and comparing that sum against wc->byte_len bounds precisely the region that is read. An AHS term would only make the test stricter without bounding anything further, and cannot cause a false reject: a PDU carrying an AHS is longer, not shorter. This is a memory-safety fix that verifies the bytes that were actually received; it does not touch RFC 7145 length negotiation and is not the MaxXmitDataSegmentLength negotiation redesign raised in the 2017 "[Query] iSER-Target: QP errors observed on increasing MaxXmitDataSegmentLength" discussion. That redesign is explicitly out of scope here. The patched kernel rejects the malformed DataOut PDU and both immediate-data variants with "PDU declares ... bytes were received" and continues to pass normal traffic with no regression. Reproduced with soft-RoCE (rdma_rxe) and a raw rdma_cm/ibv initiator; no kernel-side test hooks were needed. Fixes: b8d26b3be8b3 ("iser-target: Add iSCSI Extensions for RDMA (iSER) target driver") Signed-off-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr> Link: https://patch.msgid.link/20260726163931.971063-2-yhlee@isslab.korea.ac.kr Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-29RISC-V: KVM: Handle software-check exits for VCPUInochi Amaoto2-0/+12
The extension Zicfiss/Zicfilp introduces a software-check exception to the privilege architecture. Redirect this exception to VS mode when VCPU enable Zicfiss/Zicfilp so the CFI violations in VU/VS could be reported. Also, update kvm_riscv_vcpu_trap_redirect() to forward the SPELP state to the VS mode. Assisted-by: YuanSheng:claude-4.7-opus Co-developed-by: Quan Zhou <zhouquan@iscas.ac.cn> Signed-off-by: Quan Zhou <zhouquan@iscas.ac.cn> Signed-off-by: Inochi Amaoto <inochiama@gmail.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260713010302.303278-6-inochiama@gmail.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-07-29media: ipu-bridge: Add upside-down sensor DMI quirk for Samsung Galaxy Book5 ↵Mihail Antsev1-0/+8
Pro 360 The Samsung Galaxy Book5 Pro 360 (960QHA) has an upside-down mounted OV02E10 sensor. The 180 degree rotation is reported in neither the SSDB nor the _PLD for the sensor (both report a rotation of 0 degrees), so the image is rendered upside-down in userspace. Add a DMI quirk entry for this laptop so that the sensor fwnode gets a "rotation" property of 180 and userspace (e.g. libcamera) can compensate. Tested on the Galaxy Book5 Pro 360: with the sensor reporting V4L2_CID_CAMERA_SENSOR_ROTATION = 180 (verified with an equivalent local sensor-driver quirk), libcamera renders the image upright. Signed-off-by: Mihail Antsev <mihail.antcev@gmail.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
generated by cgit (git 2.54.0.dirty) at 2026-09-30 14:42:31 +0000