* [PATCH 5/8] staging: sm750fb: remove unused memory arbitration register definitions
From: Gabriel Windlin @ 2026-03-03 23:24 UTC (permalink / raw)
To: Sudip Mukherjee, Teddy Wang, Greg Kroah-Hartman, linux-fbdev,
linux-staging, linux-kernel
Cc: Gabriel Windlin
In-Reply-To: <20260303232434.1850583-1-gawindlin@gmail.com>
The LOCALMEM_ARBITRATION and PCIMEM_ARBITRATION register macros defined
in ddk750_reg.h are not referenced anywhere in the driver. Remove them
to reduce dead code as noted in the TODO file.
Signed-off-by: Gabriel Windlin <gawindlin@gmail.com>
---
drivers/staging/sm750fb/ddk750_reg.h | 132 ---------------------------
1 file changed, 132 deletions(-)
diff --git a/drivers/staging/sm750fb/ddk750_reg.h b/drivers/staging/sm750fb/ddk750_reg.h
index 24e826c31721..dd1d67fb9856 100644
--- a/drivers/staging/sm750fb/ddk750_reg.h
+++ b/drivers/staging/sm750fb/ddk750_reg.h
@@ -77,138 +77,6 @@
#define GPIO_MUX 0x000008
-#define LOCALMEM_ARBITRATION 0x00000C
-#define LOCALMEM_ARBITRATION_ROTATE BIT(28)
-#define LOCALMEM_ARBITRATION_VGA_MASK (0x7 << 24)
-#define LOCALMEM_ARBITRATION_VGA_OFF (0x0 << 24)
-#define LOCALMEM_ARBITRATION_VGA_PRIORITY_1 (0x1 << 24)
-#define LOCALMEM_ARBITRATION_VGA_PRIORITY_2 (0x2 << 24)
-#define LOCALMEM_ARBITRATION_VGA_PRIORITY_3 (0x3 << 24)
-#define LOCALMEM_ARBITRATION_VGA_PRIORITY_4 (0x4 << 24)
-#define LOCALMEM_ARBITRATION_VGA_PRIORITY_5 (0x5 << 24)
-#define LOCALMEM_ARBITRATION_VGA_PRIORITY_6 (0x6 << 24)
-#define LOCALMEM_ARBITRATION_VGA_PRIORITY_7 (0x7 << 24)
-#define LOCALMEM_ARBITRATION_DMA_MASK (0x7 << 20)
-#define LOCALMEM_ARBITRATION_DMA_OFF (0x0 << 20)
-#define LOCALMEM_ARBITRATION_DMA_PRIORITY_1 (0x1 << 20)
-#define LOCALMEM_ARBITRATION_DMA_PRIORITY_2 (0x2 << 20)
-#define LOCALMEM_ARBITRATION_DMA_PRIORITY_3 (0x3 << 20)
-#define LOCALMEM_ARBITRATION_DMA_PRIORITY_4 (0x4 << 20)
-#define LOCALMEM_ARBITRATION_DMA_PRIORITY_5 (0x5 << 20)
-#define LOCALMEM_ARBITRATION_DMA_PRIORITY_6 (0x6 << 20)
-#define LOCALMEM_ARBITRATION_DMA_PRIORITY_7 (0x7 << 20)
-#define LOCALMEM_ARBITRATION_ZVPORT1_MASK (0x7 << 16)
-#define LOCALMEM_ARBITRATION_ZVPORT1_OFF (0x0 << 16)
-#define LOCALMEM_ARBITRATION_ZVPORT1_PRIORITY_1 (0x1 << 16)
-#define LOCALMEM_ARBITRATION_ZVPORT1_PRIORITY_2 (0x2 << 16)
-#define LOCALMEM_ARBITRATION_ZVPORT1_PRIORITY_3 (0x3 << 16)
-#define LOCALMEM_ARBITRATION_ZVPORT1_PRIORITY_4 (0x4 << 16)
-#define LOCALMEM_ARBITRATION_ZVPORT1_PRIORITY_5 (0x5 << 16)
-#define LOCALMEM_ARBITRATION_ZVPORT1_PRIORITY_6 (0x6 << 16)
-#define LOCALMEM_ARBITRATION_ZVPORT1_PRIORITY_7 (0x7 << 16)
-#define LOCALMEM_ARBITRATION_ZVPORT0_MASK (0x7 << 12)
-#define LOCALMEM_ARBITRATION_ZVPORT0_OFF (0x0 << 12)
-#define LOCALMEM_ARBITRATION_ZVPORT0_PRIORITY_1 (0x1 << 12)
-#define LOCALMEM_ARBITRATION_ZVPORT0_PRIORITY_2 (0x2 << 12)
-#define LOCALMEM_ARBITRATION_ZVPORT0_PRIORITY_3 (0x3 << 12)
-#define LOCALMEM_ARBITRATION_ZVPORT0_PRIORITY_4 (0x4 << 12)
-#define LOCALMEM_ARBITRATION_ZVPORT0_PRIORITY_5 (0x5 << 12)
-#define LOCALMEM_ARBITRATION_ZVPORT0_PRIORITY_6 (0x6 << 12)
-#define LOCALMEM_ARBITRATION_ZVPORT0_PRIORITY_7 (0x7 << 12)
-#define LOCALMEM_ARBITRATION_VIDEO_MASK (0x7 << 8)
-#define LOCALMEM_ARBITRATION_VIDEO_OFF (0x0 << 8)
-#define LOCALMEM_ARBITRATION_VIDEO_PRIORITY_1 (0x1 << 8)
-#define LOCALMEM_ARBITRATION_VIDEO_PRIORITY_2 (0x2 << 8)
-#define LOCALMEM_ARBITRATION_VIDEO_PRIORITY_3 (0x3 << 8)
-#define LOCALMEM_ARBITRATION_VIDEO_PRIORITY_4 (0x4 << 8)
-#define LOCALMEM_ARBITRATION_VIDEO_PRIORITY_5 (0x5 << 8)
-#define LOCALMEM_ARBITRATION_VIDEO_PRIORITY_6 (0x6 << 8)
-#define LOCALMEM_ARBITRATION_VIDEO_PRIORITY_7 (0x7 << 8)
-#define LOCALMEM_ARBITRATION_PANEL_MASK (0x7 << 4)
-#define LOCALMEM_ARBITRATION_PANEL_OFF (0x0 << 4)
-#define LOCALMEM_ARBITRATION_PANEL_PRIORITY_1 (0x1 << 4)
-#define LOCALMEM_ARBITRATION_PANEL_PRIORITY_2 (0x2 << 4)
-#define LOCALMEM_ARBITRATION_PANEL_PRIORITY_3 (0x3 << 4)
-#define LOCALMEM_ARBITRATION_PANEL_PRIORITY_4 (0x4 << 4)
-#define LOCALMEM_ARBITRATION_PANEL_PRIORITY_5 (0x5 << 4)
-#define LOCALMEM_ARBITRATION_PANEL_PRIORITY_6 (0x6 << 4)
-#define LOCALMEM_ARBITRATION_PANEL_PRIORITY_7 (0x7 << 4)
-#define LOCALMEM_ARBITRATION_CRT_MASK 0x7
-#define LOCALMEM_ARBITRATION_CRT_OFF 0x0
-#define LOCALMEM_ARBITRATION_CRT_PRIORITY_1 0x1
-#define LOCALMEM_ARBITRATION_CRT_PRIORITY_2 0x2
-#define LOCALMEM_ARBITRATION_CRT_PRIORITY_3 0x3
-#define LOCALMEM_ARBITRATION_CRT_PRIORITY_4 0x4
-#define LOCALMEM_ARBITRATION_CRT_PRIORITY_5 0x5
-#define LOCALMEM_ARBITRATION_CRT_PRIORITY_6 0x6
-#define LOCALMEM_ARBITRATION_CRT_PRIORITY_7 0x7
-
-#define PCIMEM_ARBITRATION 0x000010
-#define PCIMEM_ARBITRATION_ROTATE BIT(28)
-#define PCIMEM_ARBITRATION_VGA_MASK (0x7 << 24)
-#define PCIMEM_ARBITRATION_VGA_OFF (0x0 << 24)
-#define PCIMEM_ARBITRATION_VGA_PRIORITY_1 (0x1 << 24)
-#define PCIMEM_ARBITRATION_VGA_PRIORITY_2 (0x2 << 24)
-#define PCIMEM_ARBITRATION_VGA_PRIORITY_3 (0x3 << 24)
-#define PCIMEM_ARBITRATION_VGA_PRIORITY_4 (0x4 << 24)
-#define PCIMEM_ARBITRATION_VGA_PRIORITY_5 (0x5 << 24)
-#define PCIMEM_ARBITRATION_VGA_PRIORITY_6 (0x6 << 24)
-#define PCIMEM_ARBITRATION_VGA_PRIORITY_7 (0x7 << 24)
-#define PCIMEM_ARBITRATION_DMA_MASK (0x7 << 20)
-#define PCIMEM_ARBITRATION_DMA_OFF (0x0 << 20)
-#define PCIMEM_ARBITRATION_DMA_PRIORITY_1 (0x1 << 20)
-#define PCIMEM_ARBITRATION_DMA_PRIORITY_2 (0x2 << 20)
-#define PCIMEM_ARBITRATION_DMA_PRIORITY_3 (0x3 << 20)
-#define PCIMEM_ARBITRATION_DMA_PRIORITY_4 (0x4 << 20)
-#define PCIMEM_ARBITRATION_DMA_PRIORITY_5 (0x5 << 20)
-#define PCIMEM_ARBITRATION_DMA_PRIORITY_6 (0x6 << 20)
-#define PCIMEM_ARBITRATION_DMA_PRIORITY_7 (0x7 << 20)
-#define PCIMEM_ARBITRATION_ZVPORT1_MASK (0x7 << 16)
-#define PCIMEM_ARBITRATION_ZVPORT1_OFF (0x0 << 16)
-#define PCIMEM_ARBITRATION_ZVPORT1_PRIORITY_1 (0x1 << 16)
-#define PCIMEM_ARBITRATION_ZVPORT1_PRIORITY_2 (0x2 << 16)
-#define PCIMEM_ARBITRATION_ZVPORT1_PRIORITY_3 (0x3 << 16)
-#define PCIMEM_ARBITRATION_ZVPORT1_PRIORITY_4 (0x4 << 16)
-#define PCIMEM_ARBITRATION_ZVPORT1_PRIORITY_5 (0x5 << 16)
-#define PCIMEM_ARBITRATION_ZVPORT1_PRIORITY_6 (0x6 << 16)
-#define PCIMEM_ARBITRATION_ZVPORT1_PRIORITY_7 (0x7 << 16)
-#define PCIMEM_ARBITRATION_ZVPORT0_MASK (0x7 << 12)
-#define PCIMEM_ARBITRATION_ZVPORT0_OFF (0x0 << 12)
-#define PCIMEM_ARBITRATION_ZVPORT0_PRIORITY_1 (0x1 << 12)
-#define PCIMEM_ARBITRATION_ZVPORT0_PRIORITY_2 (0x2 << 12)
-#define PCIMEM_ARBITRATION_ZVPORT0_PRIORITY_3 (0x3 << 12)
-#define PCIMEM_ARBITRATION_ZVPORT0_PRIORITY_4 (0x4 << 12)
-#define PCIMEM_ARBITRATION_ZVPORT0_PRIORITY_5 (0x5 << 12)
-#define PCIMEM_ARBITRATION_ZVPORT0_PRIORITY_6 (0x6 << 12)
-#define PCIMEM_ARBITRATION_ZVPORT0_PRIORITY_7 (0x7 << 12)
-#define PCIMEM_ARBITRATION_VIDEO_MASK (0x7 << 8)
-#define PCIMEM_ARBITRATION_VIDEO_OFF (0x0 << 8)
-#define PCIMEM_ARBITRATION_VIDEO_PRIORITY_1 (0x1 << 8)
-#define PCIMEM_ARBITRATION_VIDEO_PRIORITY_2 (0x2 << 8)
-#define PCIMEM_ARBITRATION_VIDEO_PRIORITY_3 (0x3 << 8)
-#define PCIMEM_ARBITRATION_VIDEO_PRIORITY_4 (0x4 << 8)
-#define PCIMEM_ARBITRATION_VIDEO_PRIORITY_5 (0x5 << 8)
-#define PCIMEM_ARBITRATION_VIDEO_PRIORITY_6 (0x6 << 8)
-#define PCIMEM_ARBITRATION_VIDEO_PRIORITY_7 (0x7 << 8)
-#define PCIMEM_ARBITRATION_PANEL_MASK (0x7 << 4)
-#define PCIMEM_ARBITRATION_PANEL_OFF (0x0 << 4)
-#define PCIMEM_ARBITRATION_PANEL_PRIORITY_1 (0x1 << 4)
-#define PCIMEM_ARBITRATION_PANEL_PRIORITY_2 (0x2 << 4)
-#define PCIMEM_ARBITRATION_PANEL_PRIORITY_3 (0x3 << 4)
-#define PCIMEM_ARBITRATION_PANEL_PRIORITY_4 (0x4 << 4)
-#define PCIMEM_ARBITRATION_PANEL_PRIORITY_5 (0x5 << 4)
-#define PCIMEM_ARBITRATION_PANEL_PRIORITY_6 (0x6 << 4)
-#define PCIMEM_ARBITRATION_PANEL_PRIORITY_7 (0x7 << 4)
-#define PCIMEM_ARBITRATION_CRT_MASK 0x7
-#define PCIMEM_ARBITRATION_CRT_OFF 0x0
-#define PCIMEM_ARBITRATION_CRT_PRIORITY_1 0x1
-#define PCIMEM_ARBITRATION_CRT_PRIORITY_2 0x2
-#define PCIMEM_ARBITRATION_CRT_PRIORITY_3 0x3
-#define PCIMEM_ARBITRATION_CRT_PRIORITY_4 0x4
-#define PCIMEM_ARBITRATION_CRT_PRIORITY_5 0x5
-#define PCIMEM_ARBITRATION_CRT_PRIORITY_6 0x6
-#define PCIMEM_ARBITRATION_CRT_PRIORITY_7 0x7
-
#define RAW_INT 0x000020
#define RAW_INT_ZVPORT1_VSYNC BIT(4)
#define RAW_INT_ZVPORT0_VSYNC BIT(3)
--
2.53.0
^ permalink raw reply related
* [PATCH 6/8] staging: sm750fb: remove unused interrupt register definitions
From: Gabriel Windlin @ 2026-03-03 23:24 UTC (permalink / raw)
To: Sudip Mukherjee, Teddy Wang, Greg Kroah-Hartman, linux-fbdev,
linux-staging, linux-kernel
Cc: Gabriel Windlin
In-Reply-To: <20260303232434.1850583-1-gawindlin@gmail.com>
The RAW_INT, INT_STATUS, and INT_MASK register macros defined in
ddk750_reg.h are not referenced anywhere in the driver. Remove them
to reduce dead code as noted in the TODO file.
Signed-off-by: Gabriel Windlin <gawindlin@gmail.com>
---
drivers/staging/sm750fb/ddk750_reg.h | 51 ----------------------------
1 file changed, 51 deletions(-)
diff --git a/drivers/staging/sm750fb/ddk750_reg.h b/drivers/staging/sm750fb/ddk750_reg.h
index dd1d67fb9856..8f227d974613 100644
--- a/drivers/staging/sm750fb/ddk750_reg.h
+++ b/drivers/staging/sm750fb/ddk750_reg.h
@@ -77,57 +77,6 @@
#define GPIO_MUX 0x000008
-#define RAW_INT 0x000020
-#define RAW_INT_ZVPORT1_VSYNC BIT(4)
-#define RAW_INT_ZVPORT0_VSYNC BIT(3)
-#define RAW_INT_CRT_VSYNC BIT(2)
-#define RAW_INT_PANEL_VSYNC BIT(1)
-#define RAW_INT_VGA_VSYNC BIT(0)
-
-#define INT_STATUS 0x000024
-#define INT_STATUS_GPIO31 BIT(31)
-#define INT_STATUS_GPIO30 BIT(30)
-#define INT_STATUS_GPIO29 BIT(29)
-#define INT_STATUS_GPIO28 BIT(28)
-#define INT_STATUS_GPIO27 BIT(27)
-#define INT_STATUS_GPIO26 BIT(26)
-#define INT_STATUS_GPIO25 BIT(25)
-#define INT_STATUS_I2C BIT(12)
-#define INT_STATUS_PWM BIT(11)
-#define INT_STATUS_DMA1 BIT(10)
-#define INT_STATUS_DMA0 BIT(9)
-#define INT_STATUS_PCI BIT(8)
-#define INT_STATUS_SSP1 BIT(7)
-#define INT_STATUS_SSP0 BIT(6)
-#define INT_STATUS_DE BIT(5)
-#define INT_STATUS_ZVPORT1_VSYNC BIT(4)
-#define INT_STATUS_ZVPORT0_VSYNC BIT(3)
-#define INT_STATUS_CRT_VSYNC BIT(2)
-#define INT_STATUS_PANEL_VSYNC BIT(1)
-#define INT_STATUS_VGA_VSYNC BIT(0)
-
-#define INT_MASK 0x000028
-#define INT_MASK_GPIO31 BIT(31)
-#define INT_MASK_GPIO30 BIT(30)
-#define INT_MASK_GPIO29 BIT(29)
-#define INT_MASK_GPIO28 BIT(28)
-#define INT_MASK_GPIO27 BIT(27)
-#define INT_MASK_GPIO26 BIT(26)
-#define INT_MASK_GPIO25 BIT(25)
-#define INT_MASK_I2C BIT(12)
-#define INT_MASK_PWM BIT(11)
-#define INT_MASK_DMA1 BIT(10)
-#define INT_MASK_DMA BIT(9)
-#define INT_MASK_PCI BIT(8)
-#define INT_MASK_SSP1 BIT(7)
-#define INT_MASK_SSP0 BIT(6)
-#define INT_MASK_DE BIT(5)
-#define INT_MASK_ZVPORT1_VSYNC BIT(4)
-#define INT_MASK_ZVPORT0_VSYNC BIT(3)
-#define INT_MASK_CRT_VSYNC BIT(2)
-#define INT_MASK_PANEL_VSYNC BIT(1)
-#define INT_MASK_VGA_VSYNC BIT(0)
-
#define CURRENT_GATE 0x000040
#define CURRENT_GATE_MCLK_MASK (0x3 << 14)
#ifdef VALIDATION_CHIP
--
2.53.0
^ permalink raw reply related
* [PATCH 7/8] staging: sm750fb: remove unused CURRENT_GATE, CRT_HWC, and DMA register definitions
From: Gabriel Windlin @ 2026-03-03 23:24 UTC (permalink / raw)
To: Sudip Mukherjee, Teddy Wang, Greg Kroah-Hartman, linux-fbdev,
linux-staging, linux-kernel
Cc: Gabriel Windlin
In-Reply-To: <20260303232434.1850583-1-gawindlin@gmail.com>
The CURRENT_GATE_VGA, CURRENT_GATE_PWM, CURRENT_GATE_SSP, and
CURRENT_GATE_ZVPORT bit field macros, the CRT_HWC hardware cursor
register macros, the DMA_1_SOURCE, DMA_1_DESTINATION, and
DMA_1_SIZE_CONTROL register macros, and the unused
DMA_ABORT_INTERRUPT_ABORT_0, DMA_ABORT_INTERRUPT_INT_1, and
DMA_ABORT_INTERRUPT_INT_0 bit field macros defined in ddk750_reg.h
are not referenced anywhere in the driver. Remove them to reduce dead
code as noted in the TODO file.
Signed-off-by: Gabriel Windlin <gawindlin@gmail.com>
---
drivers/staging/sm750fb/ddk750_reg.h | 41 ----------------------------
1 file changed, 41 deletions(-)
diff --git a/drivers/staging/sm750fb/ddk750_reg.h b/drivers/staging/sm750fb/ddk750_reg.h
index 8f227d974613..328254d3d7cc 100644
--- a/drivers/staging/sm750fb/ddk750_reg.h
+++ b/drivers/staging/sm750fb/ddk750_reg.h
@@ -102,12 +102,8 @@
#define CURRENT_GATE_M2XCLK_DIV_3 (0x2 << 12)
#define CURRENT_GATE_M2XCLK_DIV_4 (0x3 << 12)
#endif
-#define CURRENT_GATE_VGA BIT(10)
-#define CURRENT_GATE_PWM BIT(9)
#define CURRENT_GATE_I2C BIT(8)
-#define CURRENT_GATE_SSP BIT(7)
#define CURRENT_GATE_GPIO BIT(6)
-#define CURRENT_GATE_ZVPORT BIT(5)
#define CURRENT_GATE_CSC BIT(4)
#define CURRENT_GATE_DE BIT(3)
#define CURRENT_GATE_DISPLAY BIT(2)
@@ -602,26 +598,6 @@
#define CRT_SCALE_HORIZONTAL_MODE BIT(15)
#define CRT_SCALE_HORIZONTAL_SCALE_MASK 0xfff
-/* CRT Cursor Control */
-
-#define CRT_HWC_ADDRESS 0x080230
-#define CRT_HWC_ADDRESS_ENABLE BIT(31)
-#define CRT_HWC_ADDRESS_EXT BIT(27)
-#define CRT_HWC_ADDRESS_ADDRESS_MASK 0x3ffffff
-
-#define CRT_HWC_LOCATION 0x080234
-#define CRT_HWC_LOCATION_TOP BIT(27)
-#define CRT_HWC_LOCATION_Y_MASK (0x7ff << 16)
-#define CRT_HWC_LOCATION_LEFT BIT(11)
-#define CRT_HWC_LOCATION_X_MASK 0x7ff
-
-#define CRT_HWC_COLOR_12 0x080238
-#define CRT_HWC_COLOR_12_2_RGB565_MASK (0xffff << 16)
-#define CRT_HWC_COLOR_12_1_RGB565_MASK 0xffff
-
-#define CRT_HWC_COLOR_3 0x08023C
-#define CRT_HWC_COLOR_3_RGB565_MASK 0xffff
-
/* This vertical expansion below start at 0x080240 ~ 0x080264 */
#define CRT_VERTICAL_EXPANSION 0x080240
#ifndef VALIDATION_CHIP
@@ -703,25 +679,8 @@
#define I2C_DATA14 0x010052
#define I2C_DATA15 0x010053
-#define DMA_1_SOURCE 0x0D0010
-#define DMA_1_SOURCE_ADDRESS_EXT BIT(27)
-#define DMA_1_SOURCE_ADDRESS_CS BIT(26)
-#define DMA_1_SOURCE_ADDRESS_MASK 0x3ffffff
-
-#define DMA_1_DESTINATION 0x0D0014
-#define DMA_1_DESTINATION_ADDRESS_EXT BIT(27)
-#define DMA_1_DESTINATION_ADDRESS_CS BIT(26)
-#define DMA_1_DESTINATION_ADDRESS_MASK 0x3ffffff
-
-#define DMA_1_SIZE_CONTROL 0x0D0018
-#define DMA_1_SIZE_CONTROL_STATUS BIT(31)
-#define DMA_1_SIZE_CONTROL_SIZE_MASK 0xffffff
-
#define DMA_ABORT_INTERRUPT 0x0D0020
#define DMA_ABORT_INTERRUPT_ABORT_1 BIT(5)
-#define DMA_ABORT_INTERRUPT_ABORT_0 BIT(4)
-#define DMA_ABORT_INTERRUPT_INT_1 BIT(1)
-#define DMA_ABORT_INTERRUPT_INT_0 BIT(0)
/* Default i2c CLK and Data GPIO. These are the default i2c pins */
#define DEFAULT_I2C_SCL 30
--
2.53.0
^ permalink raw reply related
* [PATCH 8/8] staging: sm750fb: remove unused GPIO bit field and interrupt definitions
From: Gabriel Windlin @ 2026-03-03 23:24 UTC (permalink / raw)
To: Sudip Mukherjee, Teddy Wang, Greg Kroah-Hartman, linux-fbdev,
linux-staging, linux-kernel
Cc: Gabriel Windlin
In-Reply-To: <20260303232434.1850583-1-gawindlin@gmail.com>
The GPIO_DATA_0..31, GPIO_DATA_DIRECTION_0..31 bit field macros, and
the GPIO_INTERRUPT_SETUP and GPIO_INTERRUPT_STATUS register macros
defined in ddk750_reg.h are not referenced anywhere in the driver. The
register addresses GPIO_DATA and GPIO_DATA_DIRECTION are kept as they
are still in use. Remove the rest to reduce dead code as noted in the
TODO file.
Signed-off-by: Gabriel Windlin <gawindlin@gmail.com>
---
drivers/staging/sm750fb/ddk750_reg.h | 96 ----------------------------
1 file changed, 96 deletions(-)
diff --git a/drivers/staging/sm750fb/ddk750_reg.h b/drivers/staging/sm750fb/ddk750_reg.h
index 328254d3d7cc..d21e4a5e5ac4 100644
--- a/drivers/staging/sm750fb/ddk750_reg.h
+++ b/drivers/staging/sm750fb/ddk750_reg.h
@@ -215,104 +215,8 @@
#endif
#define GPIO_DATA 0x010000
-#define GPIO_DATA_31 BIT(31)
-#define GPIO_DATA_30 BIT(30)
-#define GPIO_DATA_29 BIT(29)
-#define GPIO_DATA_28 BIT(28)
-#define GPIO_DATA_27 BIT(27)
-#define GPIO_DATA_26 BIT(26)
-#define GPIO_DATA_25 BIT(25)
-#define GPIO_DATA_24 BIT(24)
-#define GPIO_DATA_23 BIT(23)
-#define GPIO_DATA_22 BIT(22)
-#define GPIO_DATA_21 BIT(21)
-#define GPIO_DATA_20 BIT(20)
-#define GPIO_DATA_19 BIT(19)
-#define GPIO_DATA_18 BIT(18)
-#define GPIO_DATA_17 BIT(17)
-#define GPIO_DATA_16 BIT(16)
-#define GPIO_DATA_15 BIT(15)
-#define GPIO_DATA_14 BIT(14)
-#define GPIO_DATA_13 BIT(13)
-#define GPIO_DATA_12 BIT(12)
-#define GPIO_DATA_11 BIT(11)
-#define GPIO_DATA_10 BIT(10)
-#define GPIO_DATA_9 BIT(9)
-#define GPIO_DATA_8 BIT(8)
-#define GPIO_DATA_7 BIT(7)
-#define GPIO_DATA_6 BIT(6)
-#define GPIO_DATA_5 BIT(5)
-#define GPIO_DATA_4 BIT(4)
-#define GPIO_DATA_3 BIT(3)
-#define GPIO_DATA_2 BIT(2)
-#define GPIO_DATA_1 BIT(1)
-#define GPIO_DATA_0 BIT(0)
#define GPIO_DATA_DIRECTION 0x010004
-#define GPIO_DATA_DIRECTION_31 BIT(31)
-#define GPIO_DATA_DIRECTION_30 BIT(30)
-#define GPIO_DATA_DIRECTION_29 BIT(29)
-#define GPIO_DATA_DIRECTION_28 BIT(28)
-#define GPIO_DATA_DIRECTION_27 BIT(27)
-#define GPIO_DATA_DIRECTION_26 BIT(26)
-#define GPIO_DATA_DIRECTION_25 BIT(25)
-#define GPIO_DATA_DIRECTION_24 BIT(24)
-#define GPIO_DATA_DIRECTION_23 BIT(23)
-#define GPIO_DATA_DIRECTION_22 BIT(22)
-#define GPIO_DATA_DIRECTION_21 BIT(21)
-#define GPIO_DATA_DIRECTION_20 BIT(20)
-#define GPIO_DATA_DIRECTION_19 BIT(19)
-#define GPIO_DATA_DIRECTION_18 BIT(18)
-#define GPIO_DATA_DIRECTION_17 BIT(17)
-#define GPIO_DATA_DIRECTION_16 BIT(16)
-#define GPIO_DATA_DIRECTION_15 BIT(15)
-#define GPIO_DATA_DIRECTION_14 BIT(14)
-#define GPIO_DATA_DIRECTION_13 BIT(13)
-#define GPIO_DATA_DIRECTION_12 BIT(12)
-#define GPIO_DATA_DIRECTION_11 BIT(11)
-#define GPIO_DATA_DIRECTION_10 BIT(10)
-#define GPIO_DATA_DIRECTION_9 BIT(9)
-#define GPIO_DATA_DIRECTION_8 BIT(8)
-#define GPIO_DATA_DIRECTION_7 BIT(7)
-#define GPIO_DATA_DIRECTION_6 BIT(6)
-#define GPIO_DATA_DIRECTION_5 BIT(5)
-#define GPIO_DATA_DIRECTION_4 BIT(4)
-#define GPIO_DATA_DIRECTION_3 BIT(3)
-#define GPIO_DATA_DIRECTION_2 BIT(2)
-#define GPIO_DATA_DIRECTION_1 BIT(1)
-#define GPIO_DATA_DIRECTION_0 BIT(0)
-
-#define GPIO_INTERRUPT_SETUP 0x010008
-#define GPIO_INTERRUPT_SETUP_TRIGGER_31 BIT(22)
-#define GPIO_INTERRUPT_SETUP_TRIGGER_30 BIT(21)
-#define GPIO_INTERRUPT_SETUP_TRIGGER_29 BIT(20)
-#define GPIO_INTERRUPT_SETUP_TRIGGER_28 BIT(19)
-#define GPIO_INTERRUPT_SETUP_TRIGGER_27 BIT(18)
-#define GPIO_INTERRUPT_SETUP_TRIGGER_26 BIT(17)
-#define GPIO_INTERRUPT_SETUP_TRIGGER_25 BIT(16)
-#define GPIO_INTERRUPT_SETUP_ACTIVE_31 BIT(14)
-#define GPIO_INTERRUPT_SETUP_ACTIVE_30 BIT(13)
-#define GPIO_INTERRUPT_SETUP_ACTIVE_29 BIT(12)
-#define GPIO_INTERRUPT_SETUP_ACTIVE_28 BIT(11)
-#define GPIO_INTERRUPT_SETUP_ACTIVE_27 BIT(10)
-#define GPIO_INTERRUPT_SETUP_ACTIVE_26 BIT(9)
-#define GPIO_INTERRUPT_SETUP_ACTIVE_25 BIT(8)
-#define GPIO_INTERRUPT_SETUP_ENABLE_31 BIT(6)
-#define GPIO_INTERRUPT_SETUP_ENABLE_30 BIT(5)
-#define GPIO_INTERRUPT_SETUP_ENABLE_29 BIT(4)
-#define GPIO_INTERRUPT_SETUP_ENABLE_28 BIT(3)
-#define GPIO_INTERRUPT_SETUP_ENABLE_27 BIT(2)
-#define GPIO_INTERRUPT_SETUP_ENABLE_26 BIT(1)
-#define GPIO_INTERRUPT_SETUP_ENABLE_25 BIT(0)
-
-#define GPIO_INTERRUPT_STATUS 0x01000C
-#define GPIO_INTERRUPT_STATUS_31 BIT(22)
-#define GPIO_INTERRUPT_STATUS_30 BIT(21)
-#define GPIO_INTERRUPT_STATUS_29 BIT(20)
-#define GPIO_INTERRUPT_STATUS_28 BIT(19)
-#define GPIO_INTERRUPT_STATUS_27 BIT(18)
-#define GPIO_INTERRUPT_STATUS_26 BIT(17)
-#define GPIO_INTERRUPT_STATUS_25 BIT(16)
#define PANEL_DISPLAY_CTRL 0x080000
#define PANEL_DISPLAY_CTRL_RESERVED_MASK 0xc0f08000
--
2.53.0
^ permalink raw reply related
* Re: [RFC PATCH] fbcon: Fix out-of-bounds memory in fbcon_putcs
From: chenjun (AM) @ 2026-03-04 3:47 UTC (permalink / raw)
To: Thomas Zimmermann, simona@ffwll.ch, deller@gmx.de,
linux-fbdev@vger.kernel.org, linux-kernel@vger.kernel.org
Cc: linruifeng (A)
In-Reply-To: <8772d571-43a9-45ea-9bd7-63928e357ab0@suse.de>
在 2026/3/2 19:34, Thomas Zimmermann 写道:
> Hi
>
> Am 02.03.26 um 12:24 schrieb chenjun (AM):
>> 在 2026/3/2 18:19, Thomas Zimmermann 写道:
>>>
>>> Am 27.02.26 um 15:43 schrieb Chen Jun:
>>>> When a font is set on an invisible console, the screen will not update.
>>>> However, the fontbuffer is not updated to match the new font dimensions.
>>>>
>>>> This inconsistency leads to out-of-bounds memory access when writing to
>>>> the tty bound to fbcon, as demonstrated by the following KASAN report:
>>>>
>>>> BUG: KASAN: slab-out-of-bounds in fb_pad_aligned_buffer+0xdf/0x140
>>>> Read of size 1 at addr ffff8881195a2280 by task a.out/971
>>>> Call Trace:
>>>> <TASK>
>>>> fb_pad_aligned_buffer+0xdf/0x140
>>>> ud_putcs+0x88a/0xde0
>>>> fbcon_putcs+0x319/0x430
>>>> do_update_region+0x23c/0x3b0
>>>> do_con_write+0x225c/0x67f0
>>>> con_write+0xe/0x30
>>>> n_tty_write+0x4b5/0xff0
>>>> file_tty_write.isra.41+0x46c/0x880
>>>> vfs_write+0x868/0xd60
>>>> ksys_write+0xf2/0x1d0
>>>> do_syscall_64+0xfa/0x570
>>>>
>>>> Fix this by calling fbcon_rotate_font() if vc is invisible in
>>>> fbcon_do_set_font().
>>>>
>>>> Signed-off-by: Chen Jun <chenjun102@huawei.com>
>>> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
>> Hi Thomas,
>>
>> Thanks for your review.
>>
>> I'm not familiar with the fbcon module. Is there a better way to fix this?
>
> Not really, I think. The whole module first needs a redesign to be
> easier to understand.
>
> Best regards
> Thomas
>
>>
>>>> ---
>>>> drivers/video/fbdev/core/fbcon.c | 5 +++++
>>>> 1 file changed, 5 insertions(+)
>>>>
>>>> diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
>>>> index 666261ae59d8..d76100188bee 100644
>>>> --- a/drivers/video/fbdev/core/fbcon.c
>>>> +++ b/drivers/video/fbdev/core/fbcon.c
>>>> @@ -2444,6 +2444,11 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, int charcount,
>>>> rows = FBCON_SWAP(par->rotate, info->var.yres, info->var.xres);
>>>> cols /= w;
>>>> rows /= h;
>>>> + if (!con_is_visible(vc)) {
>>>> + ret = fbcon_rotate_font(info, vc);
>>>> + if (ret)
>>>> + goto err_out;
>>>> + }
Hi Thomas and Helge,
I apologize, but after reviewing the code, I believe there is a problem.
The issue is that fbcon_do_set_font() updates members of
info->fbcon_par, and the info are shared with other vc instances.
Best regards
Chen Jun
>>>> ret = vc_resize(vc, cols, rows);
>>>> if (ret)
>>>> goto err_out;
>>
>
^ permalink raw reply
* Re: [PATCH v2 03/13] vt: Store font in struct vc_font
From: Thomas Zimmermann @ 2026-03-04 7:49 UTC (permalink / raw)
To: Helge Deller, gregkh, sam; +Cc: linux-fbdev, dri-devel, linux-kernel
In-Reply-To: <7e17139f-47bf-4fec-b13f-d4a1b3a7a62d@gmx.de>
Hi
Am 03.03.26 um 15:31 schrieb Helge Deller:
> On 3/2/26 15:08, Thomas Zimmermann wrote:
>> Replace struct console_font with struct vc_font for the type of the
>> vc_font field of struct vc_data. Struct console_font is UAPI, which
>> prevents further changes. Hence a new data type is required.
>>
>> Struct console_font has a documented vertical pitch of 32 bytes. This
>> is not the case after the font data has been loaded into the kernel.
>> Changing the type of vc_font addresses this inconsistency.
>>
>> The font data is now declared as constant, as it might come from the
>> kernel's read-only section. There's some fallout throughout the console
>> code where non-const variables refer to it. Fix them. A later update
>> will declare the font data to a dedicated data type.
>>
>> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
>> ---
>> drivers/video/fbdev/core/bitblit.c | 11 +++++------
>> drivers/video/fbdev/core/fbcon.c | 4 ++--
>> drivers/video/fbdev/core/fbcon.h | 4 ++--
>> include/linux/console_struct.h | 29 +++++++++++++++++++++++++++--
>> 4 files changed, 36 insertions(+), 12 deletions(-)
>>
> ....
>> diff --git a/include/linux/console_struct.h
>> b/include/linux/console_struct.h
>> index ebdb9750d348..7fdcae6ed49c 100644
>> --- a/include/linux/console_struct.h
>> +++ b/include/linux/console_struct.h
>> @@ -13,8 +13,9 @@
>> #ifndef _LINUX_CONSOLE_STRUCT_H
>> #define _LINUX_CONSOLE_STRUCT_H
>> -#include <linux/wait.h>
>> +#include <linux/math.h>
>> #include <linux/vt.h>
>> +#include <linux/wait.h>
>> #include <linux/workqueue.h>
>> struct uni_pagedict;
>> @@ -58,6 +59,30 @@ struct vc_state {
>> bool reverse;
>> };
>> +/**
>> + * struct vc_font - Describes a font
>> + * @width: The width of a single glyph in bits
>> + * @height: The height of a single glyph in scanlines
>> + * @charcount: The number of glyphs in the font
>> + * @data: The raw font data
>> + *
>> + * Font data is organized as an array of glyphs. Each glyph is a
>> bitmap with
>> + * set bits indicating the foreground color. Unset bits indicate
>> background
>> + * color. The fields @width and @height store a single glyph's
>> number of
>> + * horizontal bits and vertical scanlines. If width is not a
>> multiple of 8,
>> + * there are trailing bits to fill up the byte. These bits should
>> not be drawn.
>> + *
>> + * The field @data points to the first glphy's first byte. The value
>> @charcount
>> + * gives the number of glyphs in the font. There are no empty
>> scanlines between
>> + * two adjacent glyphs.
>> + */
>> +struct vc_font {
>> + unsigned int width;
>> + unsigned int height;
>> + unsigned int charcount;
>
> I wonder if we shouldn't declare width and height as "u8" or "short
> int" type?
> And charcount as u16 or "short int" ?
> Makes later calculations shorter & easier.
That would be a change to vt and possibly affect a lot of consoles. In
any case, I'd rather do this separately.
Best regards
Thomas
>
> Helge
--
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstr. 146, 90461 Nürnberg, Germany, www.suse.com
GF: Jochen Jaser, Andrew McDonald, Werner Knoblich, (HRB 36809, AG Nürnberg)
^ permalink raw reply
* Re: [PATCH v2 07/13] lib/fonts: Store font data as font_data_t; update consoles
From: Thomas Zimmermann @ 2026-03-04 7:51 UTC (permalink / raw)
To: Helge Deller, gregkh, sam; +Cc: linux-fbdev, dri-devel, linux-kernel
In-Reply-To: <b0a688dc-c613-4cb0-9858-56d8720487c2@gmx.de>
Hi
Am 03.03.26 um 15:57 schrieb Helge Deller:
> On 3/2/26 15:08, Thomas Zimmermann wrote:
>> Store font data as pointer to font_data_t instead of unsigned char.
>> Update consoles.
>>
>> Pointers to font data refer to the raw data. There is a hidden header
>> before the data that contains additional state. Document the existing
>> layout and semantics of font_data_t.
>>
>> The data field in struct vc_font can be used by any console. Therefore
>> it still points to plain data without the additional header. Fbcon sets
>> its value from struct fbcon_display.fontdata. Hence, update the size
>> test in fbcon_resize() to use struct fbcon_display.fontdata instead of
>> struct vc_font.data.
>>
>> v2:
>> - 'Font lookup' -> 'Font description' in <linux/font.h>
>>
>> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
>> ---
>> drivers/video/console/newport_con.c | 17 ++++++-----
>> drivers/video/fbdev/core/fbcon.c | 44 ++++++++++++++++-----------
>> drivers/video/fbdev/core/fbcon.h | 3 +-
>> include/linux/font.h | 47 ++++++++++++++++++++++++++++-
>> 4 files changed, 84 insertions(+), 27 deletions(-)
>>
>> diff --git a/drivers/video/console/newport_con.c
>> b/drivers/video/console/newport_con.c
>> index e2922caa8685..9b9ed1940404 100644
>> --- a/drivers/video/console/newport_con.c
>> +++ b/drivers/video/console/newport_con.c
>> @@ -33,9 +33,9 @@
>> #define NEWPORT_LEN 0x10000
>> -#define FONT_DATA ((unsigned char *)font_vga_8x16.data)
>> +#define FONT_DATA font_vga_8x16.data
>> -static unsigned char *font_data[MAX_NR_CONSOLES];
>> +static font_data_t *font_data[MAX_NR_CONSOLES];
>> static struct newport_regs *npregs;
>> static unsigned long newport_addr;
>> @@ -370,9 +370,9 @@ static void newport_clear(struct vc_data *vc,
>> unsigned int sy, unsigned int sx,
>> static void newport_putc(struct vc_data *vc, u16 charattr, unsigned
>> int ypos,
>> unsigned int xpos)
>> {
>> - unsigned char *p;
>> + const unsigned char *p;
>> - p = &font_data[vc->vc_num][(charattr & 0xff) << 4];
>> + p = &font_data_buf(font_data[vc->vc_num])[(charattr & 0xff) << 4];
>> charattr = (charattr >> 8) & 0xff;
>> xpos <<= 3;
>> ypos <<= 4;
>> @@ -400,7 +400,7 @@ static void newport_putcs(struct vc_data *vc,
>> const u16 *s,
>> unsigned int count, unsigned int ypos,
>> unsigned int xpos)
>> {
>> - unsigned char *p;
>> + const unsigned char *p;
>> unsigned int i;
>> u16 charattr;
>> @@ -424,7 +424,7 @@ static void newport_putcs(struct vc_data *vc,
>> const u16 *s,
>> NPORT_DMODE0_L32);
>> for (i = 0; i < count; i++, xpos += 8) {
>> - p = &font_data[vc->vc_num][(scr_readw(s++) & 0xff) << 4];
>> + p = &font_data_buf(font_data[vc->vc_num])[(scr_readw(s++) &
>> 0xff) << 4];
>> newport_wait(npregs);
>> @@ -503,7 +503,8 @@ static int newport_set_font(int unit, const
>> struct console_font *op,
>> int h = op->height;
>> int size = h * op->charcount;
>> int i;
>> - unsigned char *new_data, *data = op->data, *p;
>> + font_data_t *new_data;
>> + unsigned char *data = op->data, *p;
>> /* ladis: when I grow up, there will be a day... and more
>> sizes will
>> * be supported ;-) */
>> @@ -519,7 +520,7 @@ static int newport_set_font(int unit, const
>> struct console_font *op,
>> REFCOUNT(new_data) = 0; /* usage counter */
>> FNTSUM(new_data) = 0;
>> - p = new_data;
>> + p = (unsigned char *)font_data_buf(new_data);
>> for (i = 0; i < op->charcount; i++) {
>> memcpy(p, data, h);
>> data += 32;
>> diff --git a/drivers/video/fbdev/core/fbcon.c
>> b/drivers/video/fbdev/core/fbcon.c
>> index 103e91c8d874..8d7840b9ebad 100644
>> --- a/drivers/video/fbdev/core/fbcon.c
>> +++ b/drivers/video/fbdev/core/fbcon.c
>> @@ -1019,8 +1019,10 @@ static const char *fbcon_startup(void)
>> info->pixmap.blit_y);
>> vc->vc_font.width = font->width;
>> vc->vc_font.height = font->height;
>> - vc->vc_font.data = (void *)(p->fontdata = font->data);
>> + vc->vc_font.data = font_data_buf(font->data);
>> vc->vc_font.charcount = font->charcount;
>> +
>> + p->fontdata = font->data;
>> }
>> cols = FBCON_SWAP(par->rotate, info->var.xres, info->var.yres);
>> @@ -1078,11 +1080,12 @@ static void fbcon_init(struct vc_data *vc,
>> bool init)
>> if (t->fontdata) {
>> struct vc_data *fvc = vc_cons[fg_console].d;
>> - vc->vc_font.data = (void *)(p->fontdata =
>> - fvc->vc_font.data);
>> + vc->vc_font.data = fvc->vc_font.data;
>> vc->vc_font.width = fvc->vc_font.width;
>> vc->vc_font.height = fvc->vc_font.height;
>> vc->vc_font.charcount = fvc->vc_font.charcount;
>> +
>> + p->fontdata = t->fontdata;
>> p->userfont = t->userfont;
>> if (p->userfont)
>> @@ -1097,8 +1100,10 @@ static void fbcon_init(struct vc_data *vc,
>> bool init)
>> info->pixmap.blit_y);
>> vc->vc_font.width = font->width;
>> vc->vc_font.height = font->height;
>> - vc->vc_font.data = (void *)(p->fontdata = font->data);
>> + vc->vc_font.data = font_data_buf(font->data);
>> vc->vc_font.charcount = font->charcount;
>> +
>> + p->fontdata = font->data;
>> }
>> }
>> @@ -1409,11 +1414,12 @@ static void fbcon_set_disp(struct fb_info
>> *info, struct fb_var_screeninfo *var,
>> svc = *default_mode;
>> t = &fb_display[svc->vc_num];
>> - if (!vc->vc_font.data) {
>> - vc->vc_font.data = (void *)(p->fontdata = t->fontdata);
>> + if (!p->fontdata) {
>> + vc->vc_font.data = font_data_buf(t->fontdata);
>> vc->vc_font.width = (*default_mode)->vc_font.width;
>> vc->vc_font.height = (*default_mode)->vc_font.height;
>> vc->vc_font.charcount = (*default_mode)->vc_font.charcount;
>> + p->fontdata = t->fontdata;
>> p->userfont = t->userfont;
>> if (p->userfont)
>> REFCOUNT(p->fontdata)++;
>> @@ -2047,7 +2053,7 @@ static int fbcon_resize(struct vc_data *vc,
>> unsigned int width,
>> struct fb_var_screeninfo var = info->var;
>> int x_diff, y_diff, virt_w, virt_h, virt_fw, virt_fh;
>> - if (p->userfont && FNTSIZE(vc->vc_font.data)) {
>> + if (p->userfont && FNTSIZE(p->fontdata)) {
>> unsigned int size = vc_font_size(&vc->vc_font);
>> /*
>> @@ -2057,7 +2063,7 @@ static int fbcon_resize(struct vc_data *vc,
>> unsigned int width,
>> * charcount can change and cannot be used to determine the
>> * font data allocated size.
>> */
>> - if (!size || size > FNTSIZE(vc->vc_font.data))
>> + if (!size || size > FNTSIZE(p->fontdata))
>> return -EINVAL;
>> }
>> @@ -2281,7 +2287,8 @@ static bool fbcon_blank(struct vc_data *vc,
>> enum vesa_blank_mode blank,
>> static int fbcon_get_font(struct vc_data *vc, struct console_font
>> *font, unsigned int vpitch)
>> {
>> - const u8 *fontdata = vc->vc_font.data;
>> + struct fbcon_display *p = &fb_display[vc->vc_num];
>> + font_data_t *fontdata = p->fontdata;
>> u8 *data = font->data;
>> int i, j;
>> @@ -2406,16 +2413,18 @@ static void set_vc_hi_font(struct vc_data
>> *vc, bool set)
>> }
>> static int fbcon_do_set_font(struct vc_data *vc, int w, int h,
>> int charcount,
>> - const u8 * data, int userfont)
>> + font_data_t *data, int userfont)
>> {
>> struct fb_info *info = fbcon_info_from_console(vc->vc_num);
>> struct fbcon_par *par = info->fbcon_par;
>> struct fbcon_display *p = &fb_display[vc->vc_num];
>> int resize, ret, old_userfont, old_width, old_height,
>> old_charcount;
>> + font_data_t *old_fontdata = p->fontdata;
>> const u8 *old_data = vc->vc_font.data;
>> resize = (w != vc->vc_font.width) || (h != vc->vc_font.height);
>> - vc->vc_font.data = (void *)(p->fontdata = data);
>> + p->fontdata = data;
>> + vc->vc_font.data = font_data_buf(p->fontdata);
>> old_userfont = p->userfont;
>> if ((p->userfont = userfont))
>> REFCOUNT(data)++;
>> @@ -2448,12 +2457,12 @@ static int fbcon_do_set_font(struct vc_data
>> *vc, int w, int h, int charcount,
>> update_screen(vc);
>> }
>> - if (old_userfont && (--REFCOUNT(old_data) == 0))
>> - kfree(old_data - FONT_EXTRA_WORDS * sizeof(int));
>> + if (old_userfont && (--REFCOUNT(old_fontdata) == 0))
>> + kfree(old_fontdata - FONT_EXTRA_WORDS * sizeof(int));
>> return 0;
>> err_out:
>> - p->fontdata = old_data;
>> + p->fontdata = old_fontdata;
>> vc->vc_font.data = old_data;
>> if (userfont) {
>> @@ -2483,7 +2492,8 @@ static int fbcon_set_font(struct vc_data *vc,
>> const struct console_font *font,
>> int h = font->height;
>> int size, alloc_size;
>> int i, csum;
>> - u8 *new_data, *data = font->data;
>> + font_data_t *new_data;
>> + u8 *data = font->data;
>> int pitch = PITCH(font->width);
>> /* Is there a reason why fbconsole couldn't handle any
>> charcount >256?
>> @@ -2522,13 +2532,13 @@ static int fbcon_set_font(struct vc_data *vc,
>> const struct console_font *font,
>> if (!new_data)
>> return -ENOMEM;
>> - memset(new_data, 0, FONT_EXTRA_WORDS * sizeof(int));
>> + memset((u8 *)new_data, 0, FONT_EXTRA_WORDS * sizeof(int));
>> new_data += FONT_EXTRA_WORDS * sizeof(int);
>> FNTSIZE(new_data) = size;
>> REFCOUNT(new_data) = 0; /* usage counter */
>> for (i=0; i< charcount; i++) {
>> - memcpy(new_data + i*h*pitch, data + i*vpitch*pitch, h*pitch);
>> + memcpy((u8 *)new_data + i * h * pitch, data + i * vpitch *
>> pitch, h * pitch);
>> }
>> /* Since linux has a nice crc32 function use it for counting
>> font
>> diff --git a/drivers/video/fbdev/core/fbcon.h
>> b/drivers/video/fbdev/core/fbcon.h
>> index 3f4386a40237..d26ee7860cf5 100644
>> --- a/drivers/video/fbdev/core/fbcon.h
>> +++ b/drivers/video/fbdev/core/fbcon.h
>> @@ -11,6 +11,7 @@
>> #ifndef _VIDEO_FBCON_H
>> #define _VIDEO_FBCON_H
>> +#include <linux/font.h>
>> #include <linux/types.h>
>> #include <linux/vt_buffer.h>
>> #include <linux/vt_kern.h>
>> @@ -25,7 +26,7 @@
>> struct fbcon_display {
>> /* Filled in by the low-level console driver */
>> - const u_char *fontdata;
>> + font_data_t *fontdata;
>> int userfont; /* != 0 if fontdata kmalloc()ed */
>> #ifdef CONFIG_FRAMEBUFFER_CONSOLE_LEGACY_ACCELERATION
>> u_short scrollmode; /* Scroll Method, use
>> fb_scrollmode() */
>> diff --git a/include/linux/font.h b/include/linux/font.h
>> index d929c5fa32ca..f19abd112c18 100644
>> --- a/include/linux/font.h
>> +++ b/include/linux/font.h
>> @@ -13,12 +13,57 @@
>> #include <linux/types.h>
>> +/*
>> + * font_data_t and helpers
>> + */
>> +
>> +/**
>> + * font_data_t - Raw font data
>> + *
>> + * Values of type font_data_t store a pointer to raw font data. The
>> format
>> + * is monochrome. Each bit sets a pixel of a stored glyph. Font data
>> does
>> + * not store geometry information for the individual glyphs. Users
>> of the
>> + * font have to store glyph size, pitch and characer count separately.
>> + *
>> + * Font data in font_data_t is not equivalent to raw u8. Each
>> pointer stores
>> + * an additional hidden header before the fotn data. The layout is
>
> typo: fotn -> font
>
>
>> struct font_desc {
>> int idx;
>> const char *name;
>> unsigned int width, height;
>> unsigned int charcount;
>
> FYI - maybe type of width, height, charcount would need update here if
> it's
> changed as I proposed in the other patch?
There are places like [1] that use font_desc and I honestly don't dare
touching this code.
[1]
https://elixir.bootlin.com/linux/v6.19.3/source/arch/m68k/kernel/asm-offsets.c#L83
Best regards
Thomas
>
> Helge
--
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstr. 146, 90461 Nürnberg, Germany, www.suse.com
GF: Jochen Jaser, Andrew McDonald, Werner Knoblich, (HRB 36809, AG Nürnberg)
^ permalink raw reply
* Re: [PATCH 7/8] staging: sm750fb: remove unused CURRENT_GATE, CRT_HWC, and DMA register definitions
From: Dan Carpenter @ 2026-03-04 8:10 UTC (permalink / raw)
To: Gabriel Windlin
Cc: Sudip Mukherjee, Teddy Wang, Greg Kroah-Hartman, linux-fbdev,
linux-staging, linux-kernel
In-Reply-To: <20260303232434.1850583-7-gawindlin@gmail.com>
On Wed, Mar 04, 2026 at 12:24:28AM +0100, Gabriel Windlin wrote:
> The CURRENT_GATE_VGA, CURRENT_GATE_PWM, CURRENT_GATE_SSP, and
> CURRENT_GATE_ZVPORT bit field macros, the CRT_HWC hardware cursor
> register macros, the DMA_1_SOURCE, DMA_1_DESTINATION, and
> DMA_1_SIZE_CONTROL register macros, and the unused
> DMA_ABORT_INTERRUPT_ABORT_0, DMA_ABORT_INTERRUPT_INT_1, and
> DMA_ABORT_INTERRUPT_INT_0 bit field macros defined in ddk750_reg.h
> are not referenced anywhere in the driver. Remove them to reduce dead
> code as noted in the TODO file.
>
> Signed-off-by: Gabriel Windlin <gawindlin@gmail.com>
> ---
> drivers/staging/sm750fb/ddk750_reg.h | 41 ----------------------------
We always remove unused code, but I don't really understand the point
of removing these. It's not like they hurt readability. They function
as documentation.
regards,
dan carpenter
^ permalink raw reply
* [PATCH v2 0/6] staging: sm750fb: fix error return values
From: Soham Kute @ 2026-03-04 8:45 UTC (permalink / raw)
To: sudipm.mukherjee, teddy.wang
Cc: gregkh, linux-fbdev, linux-staging, linux-kernel, dan.carpenter,
Soham Kute
In-Reply-To: <aaVT1mSeKrSSlrha@stanley.mountain>
This is v2 of the sm750fb error code fixes, split into one patch
per function as requested by Dan Carpenter.
Changes in v2:
- Split into one patch per function
- Propagate de_wait() error instead of hardcoding -EBUSY
- Each commit message describes caller behavior
Soham Kute (6):
11ca38f0ec63 staging: sm750fb: hw_sm750le_de_wait: return -ETIMEDOUT on timeout
28df828cc89b staging: sm750fb: sm750_hw_fillrect: propagate de_wait() error
2378ece78154 staging: sm750fb: sm750_hw_copyarea: propagate de_wait() error
85139ac8c7fe staging: sm750fb: sm750_hw_imageblit: propagate de_wait() error
9c2430311e23 staging: sm750fb: sw_i2c_write_byte: return -ETIMEDOUT on timeout
915599b01e9b staging: sm750fb: sm750_sw_i2c_init: return -EINVAL for invalid GPIO
^ permalink raw reply
* [PATCH 1/6] staging: sm750fb: hw_sm750le_de_wait: return -ETIMEDOUT on timeout
From: Soham Kute @ 2026-03-04 8:45 UTC (permalink / raw)
To: sudipm.mukherjee, teddy.wang
Cc: gregkh, linux-fbdev, linux-staging, linux-kernel, dan.carpenter,
Soham Kute
In-Reply-To: <20260304084545.156170-1-officialsohamkute@gmail.com>
Return -ETIMEDOUT instead of -1 when the DE engine poll loop
times out. The callers check for non-zero return value and
propagate the error code back to their callers.
Signed-off-by: Soham Kute <officialsohamkute@gmail.com>
---
drivers/staging/sm750fb/sm750_hw.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/sm750fb/sm750_hw.c b/drivers/staging/sm750fb/sm750_hw.c
index ce46f240cbaf..e4b6b254335e 100644
--- a/drivers/staging/sm750fb/sm750_hw.c
+++ b/drivers/staging/sm750fb/sm750_hw.c
@@ -518,7 +518,7 @@ int hw_sm750le_de_wait(void)
return 0;
}
/* timeout error */
- return -1;
+ return -ETIMEDOUT;
}
int hw_sm750_de_wait(void)
@@ -536,7 +536,7 @@ int hw_sm750_de_wait(void)
return 0;
}
/* timeout error */
- return -1;
+ return -ETIMEDOUT;
}
int hw_sm750_pan_display(struct lynxfb_crtc *crtc,
--
2.34.1
^ permalink raw reply related
* [PATCH 2/6] staging: sm750fb: sm750_hw_fillrect: propagate de_wait() error
From: Soham Kute @ 2026-03-04 8:45 UTC (permalink / raw)
To: sudipm.mukherjee, teddy.wang
Cc: gregkh, linux-fbdev, linux-staging, linux-kernel, dan.carpenter,
Soham Kute
In-Reply-To: <20260304084545.156170-1-officialsohamkute@gmail.com>
Propagate the error from accel->de_wait() instead of returning -1.
The caller treats all non-zero return values as failure.
Signed-off-by: Soham Kute <officialsohamkute@gmail.com>
---
drivers/staging/sm750fb/sm750_accel.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/drivers/staging/sm750fb/sm750_accel.c b/drivers/staging/sm750fb/sm750_accel.c
index 046b9282b24a..1bd0502db039 100644
--- a/drivers/staging/sm750fb/sm750_accel.c
+++ b/drivers/staging/sm750fb/sm750_accel.c
@@ -90,14 +90,12 @@ int sm750_hw_fillrect(struct lynx_accel *accel,
u32 color, u32 rop)
{
u32 de_ctrl;
+ int ret;
- if (accel->de_wait() != 0) {
- /*
- * int time wait and always busy,seems hardware
- * got something error
- */
+ ret = accel->de_wait();
+ if (ret) {
pr_debug("De engine always busy\n");
- return -1;
+ return ret;
}
write_dpr(accel, DE_WINDOW_DESTINATION_BASE, base); /* dpr40 */
--
2.34.1
^ permalink raw reply related
* [PATCH 3/6] staging: sm750fb: sm750_hw_copyarea: propagate de_wait() error
From: Soham Kute @ 2026-03-04 8:45 UTC (permalink / raw)
To: sudipm.mukherjee, teddy.wang
Cc: gregkh, linux-fbdev, linux-staging, linux-kernel, dan.carpenter,
Soham Kute
In-Reply-To: <20260304084545.156170-1-officialsohamkute@gmail.com>
Propagate the error from accel->de_wait() instead of returning -1.
The caller treats all non-zero return values as failure.
Signed-off-by: Soham Kute <officialsohamkute@gmail.com>
---
drivers/staging/sm750fb/sm750_accel.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/sm750fb/sm750_accel.c b/drivers/staging/sm750fb/sm750_accel.c
index 1bd0502db039..f2fde011e7ca 100644
--- a/drivers/staging/sm750fb/sm750_accel.c
+++ b/drivers/staging/sm750fb/sm750_accel.c
@@ -152,6 +152,7 @@ int sm750_hw_copyarea(struct lynx_accel *accel,
unsigned int rop2)
{
unsigned int nDirection, de_ctrl;
+ int ret;
nDirection = LEFT_TO_RIGHT;
/* Direction of ROP2 operation: 1 = Left to Right, (-1) = Right to Left */
@@ -261,8 +262,9 @@ int sm750_hw_copyarea(struct lynx_accel *accel,
DE_WINDOW_WIDTH_DST_MASK) |
(sPitch / Bpp & DE_WINDOW_WIDTH_SRC_MASK)); /* dpr3c */
- if (accel->de_wait() != 0)
- return -1;
+ ret = accel->de_wait();
+ if (ret)
+ return ret;
write_dpr(accel, DE_SOURCE,
((sx << DE_SOURCE_X_K1_SHIFT) & DE_SOURCE_X_K1_MASK) |
--
2.34.1
^ permalink raw reply related
* [PATCH 4/6] staging: sm750fb: sm750_hw_imageblit: propagate de_wait() error
From: Soham Kute @ 2026-03-04 8:45 UTC (permalink / raw)
To: sudipm.mukherjee, teddy.wang
Cc: gregkh, linux-fbdev, linux-staging, linux-kernel, dan.carpenter,
Soham Kute
In-Reply-To: <20260304084545.156170-1-officialsohamkute@gmail.com>
Propagate the error from accel->de_wait() instead of returning -1.
The caller treats all non-zero return values as failure.
Signed-off-by: Soham Kute <officialsohamkute@gmail.com>
---
drivers/staging/sm750fb/sm750_accel.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/staging/sm750fb/sm750_accel.c b/drivers/staging/sm750fb/sm750_accel.c
index f2fde011e7ca..7d11810864ae 100644
--- a/drivers/staging/sm750fb/sm750_accel.c
+++ b/drivers/staging/sm750fb/sm750_accel.c
@@ -325,15 +325,16 @@ int sm750_hw_imageblit(struct lynx_accel *accel, const char *pSrcbuf,
unsigned int ulBytesRemain;
unsigned int de_ctrl = 0;
unsigned char ajRemain[4];
- int i, j;
+ int i, j, ret;
startBit &= 7; /* Just make sure the start bit is within legal range */
ulBytesPerScan = (width + startBit + 7) / 8;
ul4BytesPerScan = ulBytesPerScan & ~3;
ulBytesRemain = ulBytesPerScan & 3;
- if (accel->de_wait() != 0)
- return -1;
+ ret = accel->de_wait();
+ if (ret)
+ return ret;
/*
* 2D Source Base.
--
2.34.1
^ permalink raw reply related
* [PATCH 5/6] staging: sm750fb: sw_i2c_write_byte: return -ETIMEDOUT on timeout
From: Soham Kute @ 2026-03-04 8:45 UTC (permalink / raw)
To: sudipm.mukherjee, teddy.wang
Cc: gregkh, linux-fbdev, linux-staging, linux-kernel, dan.carpenter,
Soham Kute
In-Reply-To: <20260304084545.156170-1-officialsohamkute@gmail.com>
Return -ETIMEDOUT instead of -1 when the I2C byte write times out.
The callers check for non-zero return value and treat it as failure.
Signed-off-by: Soham Kute <officialsohamkute@gmail.com>
---
drivers/staging/sm750fb/ddk750_swi2c.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/sm750fb/ddk750_swi2c.c b/drivers/staging/sm750fb/ddk750_swi2c.c
index 0ef8d4ff2ef9..a17f758dda6c 100644
--- a/drivers/staging/sm750fb/ddk750_swi2c.c
+++ b/drivers/staging/sm750fb/ddk750_swi2c.c
@@ -294,7 +294,7 @@ static long sw_i2c_write_byte(unsigned char data)
if (i < 0xff)
return 0;
else
- return -1;
+ return -ETIMEDOUT;
}
/*
--
2.34.1
^ permalink raw reply related
* [PATCH 6/6] staging: sm750fb: sm750_sw_i2c_init: return -EINVAL for invalid GPIO
From: Soham Kute @ 2026-03-04 8:45 UTC (permalink / raw)
To: sudipm.mukherjee, teddy.wang
Cc: gregkh, linux-fbdev, linux-staging, linux-kernel, dan.carpenter,
Soham Kute
In-Reply-To: <20260304084545.156170-1-officialsohamkute@gmail.com>
Return -EINVAL instead of -1 when the GPIO pin number is out of
range. The caller checks for non-zero return value as failure.
Signed-off-by: Soham Kute <officialsohamkute@gmail.com>
---
drivers/staging/sm750fb/ddk750_swi2c.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/sm750fb/ddk750_swi2c.c b/drivers/staging/sm750fb/ddk750_swi2c.c
index a17f758dda6c..d90a93ab8fdc 100644
--- a/drivers/staging/sm750fb/ddk750_swi2c.c
+++ b/drivers/staging/sm750fb/ddk750_swi2c.c
@@ -394,7 +394,7 @@ long sm750_sw_i2c_init(unsigned char clk_gpio, unsigned char data_gpio)
* range is only from [0..63]
*/
if ((clk_gpio > 31) || (data_gpio > 31))
- return -1;
+ return -EINVAL;
if (sm750_get_chip_type() == SM750LE)
return sm750le_i2c_init(clk_gpio, data_gpio);
--
2.34.1
^ permalink raw reply related
* Re: [PATCH v2 00/13] vc,fbcon,fonts: Proper handling of font data
From: Thomas Zimmermann @ 2026-03-04 9:11 UTC (permalink / raw)
To: Helge Deller, gregkh, sam; +Cc: linux-fbdev, dri-devel, linux-kernel
In-Reply-To: <11c9e67c-36f9-4d27-8064-41b804cc0c02@gmx.de>
Hi
Am 03.03.26 um 16:29 schrieb Helge Deller:
> On 3/2/26 15:08, Thomas Zimmermann wrote:
>> Provide helpers for handling console font data. Update consoles and VT.
>>
>> VT's vc_state stores font data as a plain byte array of glphys. Fbcon,
>> newport_con and the kernel's internal fonts store the glyph data as an
>> array of plain bytes plus a hidden header for reference counting, check
>> sums and buffer sizes. The reference counting only works for user-space
>> fonts but not for internal fonts. Font-data handling is duplicated in
>> several places. Most of the font handling is open-coded and mixed up
>> with
>> VT's plain glyph arrays.
>>
>> To address these issues, add proper handling of font data to all
>> involved
>> components: struct vc_font for font state in VC; a font data type for
>> the
>> consoles. Then implement interfaces for handling font data one by one.
>>
>> Patch 1 prepares the fbdev interface.
>>
>> Patches 2 to 4 prepare VT's font handling.
>>
>> Patches 5 to 13 refactor fbcon and newport_con to use clean
>> interfaces for
>> their fonts.
>>
>> Fbcon has long been a source of problems and bug reports. [1] With its
>> confusing implementation, it is hard to find the cause of these bugs.
>> Cleaning up the fbcon code will hopefully help with resolving bug
>> reports
>> in the future.
>>
>> The series has been tested with fbcon under DRM's bochs driver by
>> changing
>> fonts at runtime using the setfont utility. [2] The changes to
>> newport_con
>> have only been tested to compile.
>>
>> v2:
>> - keep declaring the internal fonts in the public header file (Helge)
>> - rebase and clean up
>>
>> [1]
>> https://lore.kernel.org/all/6992c84c.a70a0220.2c38d7.00e8.GAE@google.com/
>> [2] https://www.man7.org/linux/man-pages/man8/setfont.8.html
>>
>> Thomas Zimmermann (13):
>> fbdev: Declare src parameter of fb_pad_ helpers as constant
>> vt: Remove trailing whitespaces
>> vt: Store font in struct vc_font
>> vt: Calculate font-buffer size with vc_font_size()
>> lib/fonts: Remove trailing whitespaces
>> lib/fonts: Remove FNTCHARCNT()
>> lib/fonts: Store font data as font_data_t; update consoles
>> lib/fonts: Read font size with font_data_size()
>> lib/fonts: Compare font data for equality with font_data_is_equal()
>> lib/fonts: Manage font-data lifetime with font_data_get/_put()
>> lib/fonts: Create font_data_t from struct console_font with
>> font_data_import()
>> lib/fonts: Store font data for user space with font_data_export()
>> lib/fonts: Remove internal symbols and macros from public header file
>>
>> drivers/video/console/newport_con.c | 61 +++----
>> drivers/video/fbdev/core/bitblit.c | 11 +-
>> drivers/video/fbdev/core/fbcon.c | 194 +++++++----------------
>> drivers/video/fbdev/core/fbcon.h | 8 +-
>> drivers/video/fbdev/core/fbmem.c | 6 +-
>> include/linux/console_struct.h | 59 ++++++-
>> include/linux/fb.h | 10 +-
>> include/linux/font.h | 115 +++++++++-----
>> lib/fonts/font.h | 38 +++++
>> lib/fonts/font_10x18.c | 2 +-
>> lib/fonts/font_6x10.c | 3 +-
>> lib/fonts/font_6x11.c | 2 +-
>> lib/fonts/font_6x8.c | 3 +-
>> lib/fonts/font_7x14.c | 2 +-
>> lib/fonts/font_8x16.c | 3 +-
>> lib/fonts/font_8x8.c | 2 +-
>> lib/fonts/font_acorn_8x8.c | 4 +-
>> lib/fonts/font_mini_4x6.c | 10 +-
>> lib/fonts/font_pearl_8x8.c | 2 +-
>> lib/fonts/font_sun12x22.c | 3 +-
>> lib/fonts/font_sun8x16.c | 3 +-
>> lib/fonts/font_ter10x18.c | 4 +-
>> lib/fonts/font_ter16x32.c | 4 +-
>> lib/fonts/fonts.c | 236 +++++++++++++++++++++++++++-
>> 24 files changed, 518 insertions(+), 267 deletions(-)
>> create mode 100644 lib/fonts/font.h
> Thomas, thanks for the nice cleanup!
> Beside a few minor comments which I posted to the various patches, the
> series looks good.
>
> I've applied it for further testing to the fbdev git tree.
Great, thanks!
> In case you send later v3 series, I'll update it.
I'd preferably not modify the data structures for now. Shall I send an
update for the typos?
Best regards
Thomas
>
> Thanks a lot!
> Helge
--
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstr. 146, 90461 Nürnberg, Germany, www.suse.com
GF: Jochen Jaser, Andrew McDonald, Werner Knoblich, (HRB 36809, AG Nürnberg)
^ permalink raw reply
* [PATCH] staging: fbtft: Update RA8875 Kconfig help description
From: Adam Azuddin @ 2026-03-04 9:39 UTC (permalink / raw)
To: andy, gregkh; +Cc: dri-devel, linux-fbdev, linux-staging, linux-kernel
The current description is too brief. Update the description to
include the manufacturer (RAiO) and the supported resolution
(up to 800x480 pixels) to help users identify the correct driver.
Signed-off-by: Adam Azuddin <azuddinadam@gmail.com>
---
drivers/staging/fbtft/Kconfig | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/staging/fbtft/Kconfig b/drivers/staging/fbtft/Kconfig
index 578412a2f379..92943564cb91 100644
--- a/drivers/staging/fbtft/Kconfig
+++ b/drivers/staging/fbtft/Kconfig
@@ -86,7 +86,11 @@ config FB_TFT_PCD8544
config FB_TFT_RA8875
tristate "FB driver for the RA8875 LCD Controller"
help
- Generic Framebuffer support for RA8875
+ This enables generic framebuffer support for the RAiO RA8875
+ display controller. The controller is intended for medium size text/graphic
+ mixed displays with a resolution of up to 800x480 pixels.
+
+ Say Y if you have such a display that utilizes this controller.
config FB_TFT_S6D02A1
tristate "FB driver for the S6D02A1 LCD Controller"
--
2.53.0
^ permalink raw reply related
* Re: [RFC PATCH] fbcon: Fix out-of-bounds memory in fbcon_putcs
From: Thomas Zimmermann @ 2026-03-04 9:57 UTC (permalink / raw)
To: chenjun (AM), simona@ffwll.ch, deller@gmx.de,
linux-fbdev@vger.kernel.org, linux-kernel@vger.kernel.org
Cc: linruifeng (A)
In-Reply-To: <ab91899d3fc34585ab119dc2b246c24a@huawei.com>
Hi
Am 04.03.26 um 04:47 schrieb chenjun (AM):
> 在 2026/3/2 19:34, Thomas Zimmermann 写道:
>> Hi
>>
>> Am 02.03.26 um 12:24 schrieb chenjun (AM):
>>> 在 2026/3/2 18:19, Thomas Zimmermann 写道:
>>>> Am 27.02.26 um 15:43 schrieb Chen Jun:
>>>>> When a font is set on an invisible console, the screen will not update.
>>>>> However, the fontbuffer is not updated to match the new font dimensions.
>>>>>
>>>>> This inconsistency leads to out-of-bounds memory access when writing to
>>>>> the tty bound to fbcon, as demonstrated by the following KASAN report:
>>>>>
>>>>> BUG: KASAN: slab-out-of-bounds in fb_pad_aligned_buffer+0xdf/0x140
>>>>> Read of size 1 at addr ffff8881195a2280 by task a.out/971
>>>>> Call Trace:
>>>>> <TASK>
>>>>> fb_pad_aligned_buffer+0xdf/0x140
>>>>> ud_putcs+0x88a/0xde0
>>>>> fbcon_putcs+0x319/0x430
>>>>> do_update_region+0x23c/0x3b0
>>>>> do_con_write+0x225c/0x67f0
>>>>> con_write+0xe/0x30
>>>>> n_tty_write+0x4b5/0xff0
>>>>> file_tty_write.isra.41+0x46c/0x880
>>>>> vfs_write+0x868/0xd60
>>>>> ksys_write+0xf2/0x1d0
>>>>> do_syscall_64+0xfa/0x570
>>>>>
>>>>> Fix this by calling fbcon_rotate_font() if vc is invisible in
>>>>> fbcon_do_set_font().
>>>>>
>>>>> Signed-off-by: Chen Jun <chenjun102@huawei.com>
>>>> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
>>> Hi Thomas,
>>>
>>> Thanks for your review.
>>>
>>> I'm not familiar with the fbcon module. Is there a better way to fix this?
>> Not really, I think. The whole module first needs a redesign to be
>> easier to understand.
>>
>> Best regards
>> Thomas
>>
>>>>> ---
>>>>> drivers/video/fbdev/core/fbcon.c | 5 +++++
>>>>> 1 file changed, 5 insertions(+)
>>>>>
>>>>> diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
>>>>> index 666261ae59d8..d76100188bee 100644
>>>>> --- a/drivers/video/fbdev/core/fbcon.c
>>>>> +++ b/drivers/video/fbdev/core/fbcon.c
>>>>> @@ -2444,6 +2444,11 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, int charcount,
>>>>> rows = FBCON_SWAP(par->rotate, info->var.yres, info->var.xres);
>>>>> cols /= w;
>>>>> rows /= h;
>>>>> + if (!con_is_visible(vc)) {
>>>>> + ret = fbcon_rotate_font(info, vc);
>>>>> + if (ret)
>>>>> + goto err_out;
>>>>> + }
> Hi Thomas and Helge,
>
> I apologize, but after reviewing the code, I believe there is a problem.
> The issue is that fbcon_do_set_font() updates members of
> info->fbcon_par, and the info are shared with other vc instances.
Than let's drop the patch for now.
My best idea to fix this is to move the rotated font out of fbcon_par.
The unrotated font data is stored at [1]. The struct fbcon_display
stores a vc's display settings. It might be possible to move the rotated
data there as well. Tracked correctly, each vc would have its own
rotated font. BUT this might also have other side effects.
Best regards
Thomas
[1]
https://elixir.bootlin.com/linux/v6.19.3/source/drivers/video/fbdev/core/fbcon.h#L28
>
> Best regards
> Chen Jun
>
>>>>> ret = vc_resize(vc, cols, rows);
>>>>> if (ret)
>>>>> goto err_out;
>
--
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstr. 146, 90461 Nürnberg, Germany, www.suse.com
GF: Jochen Jaser, Andrew McDonald, Werner Knoblich, (HRB 36809, AG Nürnberg)
^ permalink raw reply
* Re: [PATCH v2] backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt()
From: Daniel Thompson @ 2026-03-04 10:32 UTC (permalink / raw)
To: Chen Ni
Cc: daniel, deller, dri-devel, jingoohan1, lee, linusw, linux-fbdev,
linux-kernel
In-Reply-To: <20260203021625.578678-1-nichen@iscas.ac.cn>
On Tue, Feb 03, 2026 at 10:16:25AM +0800, Chen Ni wrote:
> The devm_gpiod_get_optional() function may return an ERR_PTR in case of
> genuine GPIO acquisition errors, not just NULL which indicates the
> legitimate absence of an optional GPIO.
>
> Add an IS_ERR() check after the call in sky81452_bl_parse_dt(). On
> error, return the error code to ensure proper failure handling rather
> than proceeding with invalid pointers.
>
> Fixes: e1915eec54a6 ("backlight: sky81452: Convert to GPIO descriptors")
> Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org>
Daniel.
^ permalink raw reply
* Re: [PATCH v7 2/4] backlight: add max25014atg backlight
From: Daniel Thompson @ 2026-03-04 10:38 UTC (permalink / raw)
To: maudspierings
Cc: Lee Jones, Jingoo Han, Pavel Machek, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Helge Deller, Shawn Guo,
Sascha Hauer, Pengutronix Kernel Team, Fabio Estevam,
Liam Girdwood, Mark Brown, dri-devel, linux-leds, devicetree,
linux-kernel, linux-fbdev, imx, linux-arm-kernel
In-Reply-To: <20260123-max25014-v7-2-15e504b9acc7@gocontroll.com>
On Fri, Jan 23, 2026 at 12:31:31PM +0100, Maud Spierings via B4 Relay wrote:
> From: Maud Spierings <maudspierings@gocontroll.com>
>
> The Maxim MAX25014 is a 4-channel automotive grade backlight driver IC
> with integrated boost controller.
>
> Signed-off-by: Maud Spierings <maudspierings@gocontroll.com>
Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org>
Daniel.
^ permalink raw reply
* Re: [PATCH] staging: fbtft: Update RA8875 Kconfig help description
From: Andy Shevchenko @ 2026-03-04 11:06 UTC (permalink / raw)
To: Adam Azuddin
Cc: andy, gregkh, dri-devel, linux-fbdev, linux-staging, linux-kernel
In-Reply-To: <aaf9uQOBzCwQuff4@marchy>
On Wed, Mar 4, 2026 at 11:39 AM Adam Azuddin <azuddinadam@gmail.com> wrote:
>
> The current description is too brief. Update the description to
> include the manufacturer (RAiO) and the supported resolution
> (up to 800x480 pixels) to help users identify the correct driver.
While this is a good intention, I don't know if it's a good point at
the end as the idea is to have a proper driver to be located under
drivers/gpu/drm/.
Reviewed-by: Andy Shevchenko <andy@kernel.org>
in case Greg wants to take it.
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply
* Re: [RFC PATCH] fbcon: Fix out-of-bounds memory in fbcon_putcs
From: Helge Deller @ 2026-03-04 13:19 UTC (permalink / raw)
To: Thomas Zimmermann, chenjun (AM), simona@ffwll.ch,
linux-fbdev@vger.kernel.org
Cc: linruifeng (A)
In-Reply-To: <33bab812-163b-4cf1-88bc-19e6949cc038@suse.de>
On 3/4/26 10:57, Thomas Zimmermann wrote:
> Hi
>
> Am 04.03.26 um 04:47 schrieb chenjun (AM):
>> 在 2026/3/2 19:34, Thomas Zimmermann 写道:
>>> Hi
>>>
>>> Am 02.03.26 um 12:24 schrieb chenjun (AM):
>>>> 在 2026/3/2 18:19, Thomas Zimmermann 写道:
>>>>> Am 27.02.26 um 15:43 schrieb Chen Jun:
>>>>>> When a font is set on an invisible console, the screen will not update.
>>>>>> However, the fontbuffer is not updated to match the new font dimensions.
>>>>>>
>>>>>> This inconsistency leads to out-of-bounds memory access when writing to
>>>>>> the tty bound to fbcon, as demonstrated by the following KASAN report:
>>>>>>
>>>>>> BUG: KASAN: slab-out-of-bounds in fb_pad_aligned_buffer+0xdf/0x140
>>>>>> Read of size 1 at addr ffff8881195a2280 by task a.out/971
>>>>>> Call Trace:
>>>>>> <TASK>
>>>>>> fb_pad_aligned_buffer+0xdf/0x140
>>>>>> ud_putcs+0x88a/0xde0
>>>>>> fbcon_putcs+0x319/0x430
>>>>>> do_update_region+0x23c/0x3b0
>>>>>> do_con_write+0x225c/0x67f0
>>>>>> con_write+0xe/0x30
>>>>>> n_tty_write+0x4b5/0xff0
>>>>>> file_tty_write.isra.41+0x46c/0x880
>>>>>> vfs_write+0x868/0xd60
>>>>>> ksys_write+0xf2/0x1d0
>>>>>> do_syscall_64+0xfa/0x570
>>>>>>
>>>>>> Fix this by calling fbcon_rotate_font() if vc is invisible in
>>>>>> fbcon_do_set_font().
>>>>>>
>>>>>> Signed-off-by: Chen Jun <chenjun102@huawei.com>
>>>>> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
>>>> Hi Thomas,
>>>>
>>>> Thanks for your review.
>>>>
>>>> I'm not familiar with the fbcon module. Is there a better way to fix this?
>>> Not really, I think. The whole module first needs a redesign to be
>>> easier to understand.
>>>
>>> Best regards
>>> Thomas
>>>
>>>>>> ---
>>>>>> drivers/video/fbdev/core/fbcon.c | 5 +++++
>>>>>> 1 file changed, 5 insertions(+)
>>>>>>
>>>>>> diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
>>>>>> index 666261ae59d8..d76100188bee 100644
>>>>>> --- a/drivers/video/fbdev/core/fbcon.c
>>>>>> +++ b/drivers/video/fbdev/core/fbcon.c
>>>>>> @@ -2444,6 +2444,11 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, int charcount,
>>>>>> rows = FBCON_SWAP(par->rotate, info->var.yres, info->var.xres);
>>>>>> cols /= w;
>>>>>> rows /= h;
>>>>>> + if (!con_is_visible(vc)) {
>>>>>> + ret = fbcon_rotate_font(info, vc);
>>>>>> + if (ret)
>>>>>> + goto err_out;
>>>>>> + }
>> Hi Thomas and Helge,
>>
>> I apologize, but after reviewing the code, I believe there is a problem.
>> The issue is that fbcon_do_set_font() updates members of
>> info->fbcon_par, and the info are shared with other vc instances.
>
> Than let's drop the patch for now.
Patch is now dropped from fbdev git tree.
Helge
^ permalink raw reply
* Re: [PATCH 3/6] staging: sm750fb: sm750_hw_copyarea: propagate de_wait() error
From: Dan Carpenter @ 2026-03-04 14:24 UTC (permalink / raw)
To: Soham Kute
Cc: sudipm.mukherjee, teddy.wang, gregkh, linux-fbdev, linux-staging,
linux-kernel
In-Reply-To: <20260304084545.156170-4-officialsohamkute@gmail.com>
On Wed, Mar 04, 2026 at 02:15:42PM +0530, Soham Kute wrote:
> Propagate the error from accel->de_wait() instead of returning -1.
> The caller treats all non-zero return values as failure.
>
The caller just ignores errors.
regards,
dan carpenter
^ permalink raw reply
* Re: [PATCH 4/6] staging: sm750fb: sm750_hw_imageblit: propagate de_wait() error
From: Dan Carpenter @ 2026-03-04 14:25 UTC (permalink / raw)
To: Soham Kute
Cc: sudipm.mukherjee, teddy.wang, gregkh, linux-fbdev, linux-staging,
linux-kernel
In-Reply-To: <20260304084545.156170-5-officialsohamkute@gmail.com>
On Wed, Mar 04, 2026 at 02:15:43PM +0530, Soham Kute wrote:
> Propagate the error from accel->de_wait() instead of returning -1.
> The caller treats all non-zero return values as failure.
The caller ignores errors.
regards,
dan carpenter
^ permalink raw reply
* Re: [PATCH 5/6] staging: sm750fb: sw_i2c_write_byte: return -ETIMEDOUT on timeout
From: Dan Carpenter @ 2026-03-04 14:29 UTC (permalink / raw)
To: Soham Kute
Cc: sudipm.mukherjee, teddy.wang, gregkh, linux-fbdev, linux-staging,
linux-kernel
In-Reply-To: <20260304084545.156170-6-officialsohamkute@gmail.com>
On Wed, Mar 04, 2026 at 02:15:44PM +0530, Soham Kute wrote:
> Return -ETIMEDOUT instead of -1 when the I2C byte write times out.
> The callers check for non-zero return value and treat it as failure.
>
"The callers either ignore errors or treat all non-zero returns as
failure and return -1."
> Signed-off-by: Soham Kute <officialsohamkute@gmail.com>
> ---
> drivers/staging/sm750fb/ddk750_swi2c.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/staging/sm750fb/ddk750_swi2c.c b/drivers/staging/sm750fb/ddk750_swi2c.c
> index 0ef8d4ff2ef9..a17f758dda6c 100644
> --- a/drivers/staging/sm750fb/ddk750_swi2c.c
> +++ b/drivers/staging/sm750fb/ddk750_swi2c.c
> @@ -294,7 +294,7 @@ static long sw_i2c_write_byte(unsigned char data)
Need to update the comments at the start of the function as well.
234 /*
235 * This function writes one byte to the slave device
236 *
237 * Parameters:
238 * data - Data to be write to the slave device
239 *
240 * Return Value:
241 * 0 - Success
242 * -1 - Fail to write byte
^^^^^^^^^^^^^^^^^^^^^^^^^
243 */
244 static long sw_i2c_write_byte(unsigned char data)
> if (i < 0xff)
> return 0;
> else
> - return -1;
> + return -ETIMEDOUT;
I don't think -ETIMEDOUT is the correct error code. Maybe -EIO or
-EINVAL.
regards,
dan carpenter
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox