* [PATCH 6/6] staging: sm750fb: sm750_sw_i2c_init: return -EINVAL for invalid GPIO
From: Soham Kute @ 2026-03-04 17:35 UTC (permalink / raw)
To: sudipm.mukherjee, teddy.wang
Cc: gregkh, linux-fbdev, linux-staging, linux-kernel, dan.carpenter,
Soham Kute
In-Reply-To: <20260304173529.192067-1-officialsohamkute@gmail.com>
Return -EINVAL instead of -1 when the GPIO pin number is out of
range. The caller ignores the return value.
Signed-off-by: Soham Kute <officialsohamkute@gmail.com>
---
drivers/staging/sm750fb/ddk750_swi2c.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/staging/sm750fb/ddk750_swi2c.c b/drivers/staging/sm750fb/ddk750_swi2c.c
index c73943341f66..46599be8d6b9 100644
--- a/drivers/staging/sm750fb/ddk750_swi2c.c
+++ b/drivers/staging/sm750fb/ddk750_swi2c.c
@@ -344,7 +344,7 @@ static unsigned char sw_i2c_read_byte(unsigned char ack)
* data_gpio - The GPIO pin to be used as i2c SDA
*
* Return Value:
- * -1 - Fail to initialize the i2c
+ * -EINVAL - Fail to initialize the i2c
* 0 - Success
*/
static long sm750le_i2c_init(unsigned char clk_gpio, unsigned char data_gpio)
@@ -382,7 +382,7 @@ static long sm750le_i2c_init(unsigned char clk_gpio, unsigned char data_gpio)
* data_gpio - The GPIO pin to be used as i2c SDA
*
* Return Value:
- * -1 - Fail to initialize the i2c
+ * -EINVAL - Fail to initialize the i2c
* 0 - Success
*/
long sm750_sw_i2c_init(unsigned char clk_gpio, unsigned char data_gpio)
@@ -394,7 +394,7 @@ long sm750_sw_i2c_init(unsigned char clk_gpio, unsigned char data_gpio)
* range is only from [0..63]
*/
if ((clk_gpio > 31) || (data_gpio > 31))
- return -1;
+ return -EINVAL;
if (sm750_get_chip_type() == SM750LE)
return sm750le_i2c_init(clk_gpio, data_gpio);
--
2.34.1
^ permalink raw reply related
* [PATCH 5/6] staging: sm750fb: sw_i2c_write_byte: return -EIO on failure
From: Soham Kute @ 2026-03-04 17:35 UTC (permalink / raw)
To: sudipm.mukherjee, teddy.wang
Cc: gregkh, linux-fbdev, linux-staging, linux-kernel, dan.carpenter,
Soham Kute
In-Reply-To: <20260304173529.192067-1-officialsohamkute@gmail.com>
Return -EIO instead of -1 when the I2C byte write fails.
The caller ignores the return value.
Signed-off-by: Soham Kute <officialsohamkute@gmail.com>
---
drivers/staging/sm750fb/ddk750_swi2c.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/sm750fb/ddk750_swi2c.c b/drivers/staging/sm750fb/ddk750_swi2c.c
index 0ef8d4ff2ef9..c73943341f66 100644
--- a/drivers/staging/sm750fb/ddk750_swi2c.c
+++ b/drivers/staging/sm750fb/ddk750_swi2c.c
@@ -239,7 +239,7 @@ static void sw_i2c_stop(void)
*
* Return Value:
* 0 - Success
- * -1 - Fail to write byte
+ * -EIO - Fail to write byte
*/
static long sw_i2c_write_byte(unsigned char data)
{
@@ -294,7 +294,7 @@ static long sw_i2c_write_byte(unsigned char data)
if (i < 0xff)
return 0;
else
- return -1;
+ return -EIO;
}
/*
--
2.34.1
^ permalink raw reply related
* [PATCH 4/6] staging: sm750fb: sm750_hw_imageblit: propagate de_wait() error
From: Soham Kute @ 2026-03-04 17:35 UTC (permalink / raw)
To: sudipm.mukherjee, teddy.wang
Cc: gregkh, linux-fbdev, linux-staging, linux-kernel, dan.carpenter,
Soham Kute
In-Reply-To: <20260304173529.192067-1-officialsohamkute@gmail.com>
Propagate the error from accel->de_wait() instead of returning -1.
The caller ignores the return value.
Signed-off-by: Soham Kute <officialsohamkute@gmail.com>
---
drivers/staging/sm750fb/sm750_accel.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/staging/sm750fb/sm750_accel.c b/drivers/staging/sm750fb/sm750_accel.c
index f2fde011e7ca..7d11810864ae 100644
--- a/drivers/staging/sm750fb/sm750_accel.c
+++ b/drivers/staging/sm750fb/sm750_accel.c
@@ -325,15 +325,16 @@ int sm750_hw_imageblit(struct lynx_accel *accel, const char *pSrcbuf,
unsigned int ulBytesRemain;
unsigned int de_ctrl = 0;
unsigned char ajRemain[4];
- int i, j;
+ int i, j, ret;
startBit &= 7; /* Just make sure the start bit is within legal range */
ulBytesPerScan = (width + startBit + 7) / 8;
ul4BytesPerScan = ulBytesPerScan & ~3;
ulBytesRemain = ulBytesPerScan & 3;
- if (accel->de_wait() != 0)
- return -1;
+ ret = accel->de_wait();
+ if (ret)
+ return ret;
/*
* 2D Source Base.
--
2.34.1
^ permalink raw reply related
* [PATCH 3/6] staging: sm750fb: sm750_hw_copyarea: propagate de_wait() error
From: Soham Kute @ 2026-03-04 17:35 UTC (permalink / raw)
To: sudipm.mukherjee, teddy.wang
Cc: gregkh, linux-fbdev, linux-staging, linux-kernel, dan.carpenter,
Soham Kute
In-Reply-To: <20260304173529.192067-1-officialsohamkute@gmail.com>
Propagate the error from accel->de_wait() instead of returning -1.
The caller ignores the return value.
Signed-off-by: Soham Kute <officialsohamkute@gmail.com>
---
drivers/staging/sm750fb/sm750_accel.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/sm750fb/sm750_accel.c b/drivers/staging/sm750fb/sm750_accel.c
index 1bd0502db039..f2fde011e7ca 100644
--- a/drivers/staging/sm750fb/sm750_accel.c
+++ b/drivers/staging/sm750fb/sm750_accel.c
@@ -152,6 +152,7 @@ int sm750_hw_copyarea(struct lynx_accel *accel,
unsigned int rop2)
{
unsigned int nDirection, de_ctrl;
+ int ret;
nDirection = LEFT_TO_RIGHT;
/* Direction of ROP2 operation: 1 = Left to Right, (-1) = Right to Left */
@@ -261,8 +262,9 @@ int sm750_hw_copyarea(struct lynx_accel *accel,
DE_WINDOW_WIDTH_DST_MASK) |
(sPitch / Bpp & DE_WINDOW_WIDTH_SRC_MASK)); /* dpr3c */
- if (accel->de_wait() != 0)
- return -1;
+ ret = accel->de_wait();
+ if (ret)
+ return ret;
write_dpr(accel, DE_SOURCE,
((sx << DE_SOURCE_X_K1_SHIFT) & DE_SOURCE_X_K1_MASK) |
--
2.34.1
^ permalink raw reply related
* [PATCH 2/6] staging: sm750fb: sm750_hw_fillrect: propagate de_wait() error
From: Soham Kute @ 2026-03-04 17:35 UTC (permalink / raw)
To: sudipm.mukherjee, teddy.wang
Cc: gregkh, linux-fbdev, linux-staging, linux-kernel, dan.carpenter,
Soham Kute
In-Reply-To: <20260304173529.192067-1-officialsohamkute@gmail.com>
Propagate the error from accel->de_wait() instead of returning -1.
The caller treats all non-zero return values as failure.
Signed-off-by: Soham Kute <officialsohamkute@gmail.com>
---
drivers/staging/sm750fb/sm750_accel.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/drivers/staging/sm750fb/sm750_accel.c b/drivers/staging/sm750fb/sm750_accel.c
index 046b9282b24a..1bd0502db039 100644
--- a/drivers/staging/sm750fb/sm750_accel.c
+++ b/drivers/staging/sm750fb/sm750_accel.c
@@ -90,14 +90,12 @@ int sm750_hw_fillrect(struct lynx_accel *accel,
u32 color, u32 rop)
{
u32 de_ctrl;
+ int ret;
- if (accel->de_wait() != 0) {
- /*
- * int time wait and always busy,seems hardware
- * got something error
- */
+ ret = accel->de_wait();
+ if (ret) {
pr_debug("De engine always busy\n");
- return -1;
+ return ret;
}
write_dpr(accel, DE_WINDOW_DESTINATION_BASE, base); /* dpr40 */
--
2.34.1
^ permalink raw reply related
* [PATCH 1/6] staging: sm750fb: hw_sm750le_de_wait: return -ETIMEDOUT on timeout
From: Soham Kute @ 2026-03-04 17:35 UTC (permalink / raw)
To: sudipm.mukherjee, teddy.wang
Cc: gregkh, linux-fbdev, linux-staging, linux-kernel, dan.carpenter,
Soham Kute
In-Reply-To: <aaVT1mSeKrSSlrha@stanley.mountain>
Return -ETIMEDOUT instead of -1 when the DE engine poll loop
times out. The callers check for non-zero return value and
propagate the error code back to their callers.
Signed-off-by: Soham Kute <officialsohamkute@gmail.com>
---
drivers/staging/sm750fb/sm750_hw.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/sm750fb/sm750_hw.c b/drivers/staging/sm750fb/sm750_hw.c
index ce46f240cbaf..e4b6b254335e 100644
--- a/drivers/staging/sm750fb/sm750_hw.c
+++ b/drivers/staging/sm750fb/sm750_hw.c
@@ -518,7 +518,7 @@ int hw_sm750le_de_wait(void)
return 0;
}
/* timeout error */
- return -1;
+ return -ETIMEDOUT;
}
int hw_sm750_de_wait(void)
@@ -536,7 +536,7 @@ int hw_sm750_de_wait(void)
return 0;
}
/* timeout error */
- return -1;
+ return -ETIMEDOUT;
}
int hw_sm750_pan_display(struct lynxfb_crtc *crtc,
--
2.34.1
^ permalink raw reply related
* [PATCH] fbdev: wmt_ge_rops: use devm_platform_ioremap_resource()
From: Amin GATTOUT @ 2026-03-04 17:10 UTC (permalink / raw)
To: Alexey Charkov, Krzysztof Kozlowski, Helge Deller
Cc: linux-arm-kernel, linux-fbdev, dri-devel, linux-kernel,
Thomas Zimmermann, Amin GATTOUT
Replace the open-coded platform_get_resource() + ioremap() pair with
devm_platform_ioremap_resource(), which requests the memory region and
maps it in a single call, with automatic cleanup on device removal.
Also reset regbase to NULL in remove() so that the single-instance
guard in probe() works correctly if the device is re-probed.
Signed-off-by: Amin GATTOUT <amin.gattout@gmail.com>
---
drivers/video/fbdev/wmt_ge_rops.c | 18 ++++--------------
1 file changed, 4 insertions(+), 14 deletions(-)
diff --git a/drivers/video/fbdev/wmt_ge_rops.c b/drivers/video/fbdev/wmt_ge_rops.c
index 2bd26bfb2b46..0cf78bcadfa6 100644
--- a/drivers/video/fbdev/wmt_ge_rops.c
+++ b/drivers/video/fbdev/wmt_ge_rops.c
@@ -148,25 +148,15 @@ EXPORT_SYMBOL_GPL(wmt_ge_sync);
static int wmt_ge_rops_probe(struct platform_device *pdev)
{
- struct resource *res;
-
- res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
- if (res == NULL) {
- dev_err(&pdev->dev, "no I/O memory resource defined\n");
- return -ENODEV;
- }
-
/* Only one ROP engine is presently supported. */
if (unlikely(regbase)) {
WARN_ON(1);
return -EBUSY;
}
- regbase = ioremap(res->start, resource_size(res));
- if (regbase == NULL) {
- dev_err(&pdev->dev, "failed to map I/O memory\n");
- return -EBUSY;
- }
+ regbase = devm_platform_ioremap_resource(pdev, 0);
+ if (IS_ERR(regbase))
+ return PTR_ERR(regbase);
writel(1, regbase + GE_ENABLE_OFF);
printk(KERN_INFO "Enabled support for WMT GE raster acceleration\n");
@@ -176,7 +166,7 @@ static int wmt_ge_rops_probe(struct platform_device *pdev)
static void wmt_ge_rops_remove(struct platform_device *pdev)
{
- iounmap(regbase);
+ regbase = NULL;
}
static const struct of_device_id wmt_dt_ids[] = {
---
base-commit: 11439c4635edd669ae435eec308f4ab8a0804808
change-id: 20260303-master-4dbb344c9a39
Best regards,
--
Amin GATTOUT <amin.gattout@gmail.com>
^ permalink raw reply related
* Re: [PATCH 6/6] staging: sm750fb: sm750_sw_i2c_init: return -EINVAL for invalid GPIO
From: Dan Carpenter @ 2026-03-04 14:30 UTC (permalink / raw)
To: Soham Kute
Cc: sudipm.mukherjee, teddy.wang, gregkh, linux-fbdev, linux-staging,
linux-kernel
In-Reply-To: <20260304084545.156170-7-officialsohamkute@gmail.com>
On Wed, Mar 04, 2026 at 02:15:45PM +0530, Soham Kute wrote:
> Return -EINVAL instead of -1 when the GPIO pin number is out of
> range. The caller checks for non-zero return value as failure.
>
The caller ignores errors.
> Signed-off-by: Soham Kute <officialsohamkute@gmail.com>
> ---
> drivers/staging/sm750fb/ddk750_swi2c.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/staging/sm750fb/ddk750_swi2c.c b/drivers/staging/sm750fb/ddk750_swi2c.c
> index a17f758dda6c..d90a93ab8fdc 100644
> --- a/drivers/staging/sm750fb/ddk750_swi2c.c
> +++ b/drivers/staging/sm750fb/ddk750_swi2c.c
> @@ -394,7 +394,7 @@ long sm750_sw_i2c_init(unsigned char clk_gpio, unsigned char data_gpio)
> * range is only from [0..63]
> */
> if ((clk_gpio > 31) || (data_gpio > 31))
> - return -1;
> + return -EINVAL;
Need to update the comments for the function.
regards,
dan carpenter
>
> if (sm750_get_chip_type() == SM750LE)
> return sm750le_i2c_init(clk_gpio, data_gpio);
> --
> 2.34.1
^ permalink raw reply
* Re: [PATCH 5/6] staging: sm750fb: sw_i2c_write_byte: return -ETIMEDOUT on timeout
From: Dan Carpenter @ 2026-03-04 14:29 UTC (permalink / raw)
To: Soham Kute
Cc: sudipm.mukherjee, teddy.wang, gregkh, linux-fbdev, linux-staging,
linux-kernel
In-Reply-To: <20260304084545.156170-6-officialsohamkute@gmail.com>
On Wed, Mar 04, 2026 at 02:15:44PM +0530, Soham Kute wrote:
> Return -ETIMEDOUT instead of -1 when the I2C byte write times out.
> The callers check for non-zero return value and treat it as failure.
>
"The callers either ignore errors or treat all non-zero returns as
failure and return -1."
> Signed-off-by: Soham Kute <officialsohamkute@gmail.com>
> ---
> drivers/staging/sm750fb/ddk750_swi2c.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/staging/sm750fb/ddk750_swi2c.c b/drivers/staging/sm750fb/ddk750_swi2c.c
> index 0ef8d4ff2ef9..a17f758dda6c 100644
> --- a/drivers/staging/sm750fb/ddk750_swi2c.c
> +++ b/drivers/staging/sm750fb/ddk750_swi2c.c
> @@ -294,7 +294,7 @@ static long sw_i2c_write_byte(unsigned char data)
Need to update the comments at the start of the function as well.
234 /*
235 * This function writes one byte to the slave device
236 *
237 * Parameters:
238 * data - Data to be write to the slave device
239 *
240 * Return Value:
241 * 0 - Success
242 * -1 - Fail to write byte
^^^^^^^^^^^^^^^^^^^^^^^^^
243 */
244 static long sw_i2c_write_byte(unsigned char data)
> if (i < 0xff)
> return 0;
> else
> - return -1;
> + return -ETIMEDOUT;
I don't think -ETIMEDOUT is the correct error code. Maybe -EIO or
-EINVAL.
regards,
dan carpenter
^ permalink raw reply
* Re: [PATCH 4/6] staging: sm750fb: sm750_hw_imageblit: propagate de_wait() error
From: Dan Carpenter @ 2026-03-04 14:25 UTC (permalink / raw)
To: Soham Kute
Cc: sudipm.mukherjee, teddy.wang, gregkh, linux-fbdev, linux-staging,
linux-kernel
In-Reply-To: <20260304084545.156170-5-officialsohamkute@gmail.com>
On Wed, Mar 04, 2026 at 02:15:43PM +0530, Soham Kute wrote:
> Propagate the error from accel->de_wait() instead of returning -1.
> The caller treats all non-zero return values as failure.
The caller ignores errors.
regards,
dan carpenter
^ permalink raw reply
* Re: [PATCH 3/6] staging: sm750fb: sm750_hw_copyarea: propagate de_wait() error
From: Dan Carpenter @ 2026-03-04 14:24 UTC (permalink / raw)
To: Soham Kute
Cc: sudipm.mukherjee, teddy.wang, gregkh, linux-fbdev, linux-staging,
linux-kernel
In-Reply-To: <20260304084545.156170-4-officialsohamkute@gmail.com>
On Wed, Mar 04, 2026 at 02:15:42PM +0530, Soham Kute wrote:
> Propagate the error from accel->de_wait() instead of returning -1.
> The caller treats all non-zero return values as failure.
>
The caller just ignores errors.
regards,
dan carpenter
^ permalink raw reply
* Re: [RFC PATCH] fbcon: Fix out-of-bounds memory in fbcon_putcs
From: Helge Deller @ 2026-03-04 13:19 UTC (permalink / raw)
To: Thomas Zimmermann, chenjun (AM), simona@ffwll.ch,
linux-fbdev@vger.kernel.org
Cc: linruifeng (A)
In-Reply-To: <33bab812-163b-4cf1-88bc-19e6949cc038@suse.de>
On 3/4/26 10:57, Thomas Zimmermann wrote:
> Hi
>
> Am 04.03.26 um 04:47 schrieb chenjun (AM):
>> 在 2026/3/2 19:34, Thomas Zimmermann 写道:
>>> Hi
>>>
>>> Am 02.03.26 um 12:24 schrieb chenjun (AM):
>>>> 在 2026/3/2 18:19, Thomas Zimmermann 写道:
>>>>> Am 27.02.26 um 15:43 schrieb Chen Jun:
>>>>>> When a font is set on an invisible console, the screen will not update.
>>>>>> However, the fontbuffer is not updated to match the new font dimensions.
>>>>>>
>>>>>> This inconsistency leads to out-of-bounds memory access when writing to
>>>>>> the tty bound to fbcon, as demonstrated by the following KASAN report:
>>>>>>
>>>>>> BUG: KASAN: slab-out-of-bounds in fb_pad_aligned_buffer+0xdf/0x140
>>>>>> Read of size 1 at addr ffff8881195a2280 by task a.out/971
>>>>>> Call Trace:
>>>>>> <TASK>
>>>>>> fb_pad_aligned_buffer+0xdf/0x140
>>>>>> ud_putcs+0x88a/0xde0
>>>>>> fbcon_putcs+0x319/0x430
>>>>>> do_update_region+0x23c/0x3b0
>>>>>> do_con_write+0x225c/0x67f0
>>>>>> con_write+0xe/0x30
>>>>>> n_tty_write+0x4b5/0xff0
>>>>>> file_tty_write.isra.41+0x46c/0x880
>>>>>> vfs_write+0x868/0xd60
>>>>>> ksys_write+0xf2/0x1d0
>>>>>> do_syscall_64+0xfa/0x570
>>>>>>
>>>>>> Fix this by calling fbcon_rotate_font() if vc is invisible in
>>>>>> fbcon_do_set_font().
>>>>>>
>>>>>> Signed-off-by: Chen Jun <chenjun102@huawei.com>
>>>>> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
>>>> Hi Thomas,
>>>>
>>>> Thanks for your review.
>>>>
>>>> I'm not familiar with the fbcon module. Is there a better way to fix this?
>>> Not really, I think. The whole module first needs a redesign to be
>>> easier to understand.
>>>
>>> Best regards
>>> Thomas
>>>
>>>>>> ---
>>>>>> drivers/video/fbdev/core/fbcon.c | 5 +++++
>>>>>> 1 file changed, 5 insertions(+)
>>>>>>
>>>>>> diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
>>>>>> index 666261ae59d8..d76100188bee 100644
>>>>>> --- a/drivers/video/fbdev/core/fbcon.c
>>>>>> +++ b/drivers/video/fbdev/core/fbcon.c
>>>>>> @@ -2444,6 +2444,11 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, int charcount,
>>>>>> rows = FBCON_SWAP(par->rotate, info->var.yres, info->var.xres);
>>>>>> cols /= w;
>>>>>> rows /= h;
>>>>>> + if (!con_is_visible(vc)) {
>>>>>> + ret = fbcon_rotate_font(info, vc);
>>>>>> + if (ret)
>>>>>> + goto err_out;
>>>>>> + }
>> Hi Thomas and Helge,
>>
>> I apologize, but after reviewing the code, I believe there is a problem.
>> The issue is that fbcon_do_set_font() updates members of
>> info->fbcon_par, and the info are shared with other vc instances.
>
> Than let's drop the patch for now.
Patch is now dropped from fbdev git tree.
Helge
^ permalink raw reply
* Re: [PATCH] staging: fbtft: Update RA8875 Kconfig help description
From: Andy Shevchenko @ 2026-03-04 11:06 UTC (permalink / raw)
To: Adam Azuddin
Cc: andy, gregkh, dri-devel, linux-fbdev, linux-staging, linux-kernel
In-Reply-To: <aaf9uQOBzCwQuff4@marchy>
On Wed, Mar 4, 2026 at 11:39 AM Adam Azuddin <azuddinadam@gmail.com> wrote:
>
> The current description is too brief. Update the description to
> include the manufacturer (RAiO) and the supported resolution
> (up to 800x480 pixels) to help users identify the correct driver.
While this is a good intention, I don't know if it's a good point at
the end as the idea is to have a proper driver to be located under
drivers/gpu/drm/.
Reviewed-by: Andy Shevchenko <andy@kernel.org>
in case Greg wants to take it.
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply
* Re: [PATCH v7 2/4] backlight: add max25014atg backlight
From: Daniel Thompson @ 2026-03-04 10:38 UTC (permalink / raw)
To: maudspierings
Cc: Lee Jones, Jingoo Han, Pavel Machek, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Helge Deller, Shawn Guo,
Sascha Hauer, Pengutronix Kernel Team, Fabio Estevam,
Liam Girdwood, Mark Brown, dri-devel, linux-leds, devicetree,
linux-kernel, linux-fbdev, imx, linux-arm-kernel
In-Reply-To: <20260123-max25014-v7-2-15e504b9acc7@gocontroll.com>
On Fri, Jan 23, 2026 at 12:31:31PM +0100, Maud Spierings via B4 Relay wrote:
> From: Maud Spierings <maudspierings@gocontroll.com>
>
> The Maxim MAX25014 is a 4-channel automotive grade backlight driver IC
> with integrated boost controller.
>
> Signed-off-by: Maud Spierings <maudspierings@gocontroll.com>
Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org>
Daniel.
^ permalink raw reply
* Re: [PATCH v2] backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt()
From: Daniel Thompson @ 2026-03-04 10:32 UTC (permalink / raw)
To: Chen Ni
Cc: daniel, deller, dri-devel, jingoohan1, lee, linusw, linux-fbdev,
linux-kernel
In-Reply-To: <20260203021625.578678-1-nichen@iscas.ac.cn>
On Tue, Feb 03, 2026 at 10:16:25AM +0800, Chen Ni wrote:
> The devm_gpiod_get_optional() function may return an ERR_PTR in case of
> genuine GPIO acquisition errors, not just NULL which indicates the
> legitimate absence of an optional GPIO.
>
> Add an IS_ERR() check after the call in sky81452_bl_parse_dt(). On
> error, return the error code to ensure proper failure handling rather
> than proceeding with invalid pointers.
>
> Fixes: e1915eec54a6 ("backlight: sky81452: Convert to GPIO descriptors")
> Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org>
Daniel.
^ permalink raw reply
* Re: [RFC PATCH] fbcon: Fix out-of-bounds memory in fbcon_putcs
From: Thomas Zimmermann @ 2026-03-04 9:57 UTC (permalink / raw)
To: chenjun (AM), simona@ffwll.ch, deller@gmx.de,
linux-fbdev@vger.kernel.org, linux-kernel@vger.kernel.org
Cc: linruifeng (A)
In-Reply-To: <ab91899d3fc34585ab119dc2b246c24a@huawei.com>
Hi
Am 04.03.26 um 04:47 schrieb chenjun (AM):
> 在 2026/3/2 19:34, Thomas Zimmermann 写道:
>> Hi
>>
>> Am 02.03.26 um 12:24 schrieb chenjun (AM):
>>> 在 2026/3/2 18:19, Thomas Zimmermann 写道:
>>>> Am 27.02.26 um 15:43 schrieb Chen Jun:
>>>>> When a font is set on an invisible console, the screen will not update.
>>>>> However, the fontbuffer is not updated to match the new font dimensions.
>>>>>
>>>>> This inconsistency leads to out-of-bounds memory access when writing to
>>>>> the tty bound to fbcon, as demonstrated by the following KASAN report:
>>>>>
>>>>> BUG: KASAN: slab-out-of-bounds in fb_pad_aligned_buffer+0xdf/0x140
>>>>> Read of size 1 at addr ffff8881195a2280 by task a.out/971
>>>>> Call Trace:
>>>>> <TASK>
>>>>> fb_pad_aligned_buffer+0xdf/0x140
>>>>> ud_putcs+0x88a/0xde0
>>>>> fbcon_putcs+0x319/0x430
>>>>> do_update_region+0x23c/0x3b0
>>>>> do_con_write+0x225c/0x67f0
>>>>> con_write+0xe/0x30
>>>>> n_tty_write+0x4b5/0xff0
>>>>> file_tty_write.isra.41+0x46c/0x880
>>>>> vfs_write+0x868/0xd60
>>>>> ksys_write+0xf2/0x1d0
>>>>> do_syscall_64+0xfa/0x570
>>>>>
>>>>> Fix this by calling fbcon_rotate_font() if vc is invisible in
>>>>> fbcon_do_set_font().
>>>>>
>>>>> Signed-off-by: Chen Jun <chenjun102@huawei.com>
>>>> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
>>> Hi Thomas,
>>>
>>> Thanks for your review.
>>>
>>> I'm not familiar with the fbcon module. Is there a better way to fix this?
>> Not really, I think. The whole module first needs a redesign to be
>> easier to understand.
>>
>> Best regards
>> Thomas
>>
>>>>> ---
>>>>> drivers/video/fbdev/core/fbcon.c | 5 +++++
>>>>> 1 file changed, 5 insertions(+)
>>>>>
>>>>> diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
>>>>> index 666261ae59d8..d76100188bee 100644
>>>>> --- a/drivers/video/fbdev/core/fbcon.c
>>>>> +++ b/drivers/video/fbdev/core/fbcon.c
>>>>> @@ -2444,6 +2444,11 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, int charcount,
>>>>> rows = FBCON_SWAP(par->rotate, info->var.yres, info->var.xres);
>>>>> cols /= w;
>>>>> rows /= h;
>>>>> + if (!con_is_visible(vc)) {
>>>>> + ret = fbcon_rotate_font(info, vc);
>>>>> + if (ret)
>>>>> + goto err_out;
>>>>> + }
> Hi Thomas and Helge,
>
> I apologize, but after reviewing the code, I believe there is a problem.
> The issue is that fbcon_do_set_font() updates members of
> info->fbcon_par, and the info are shared with other vc instances.
Than let's drop the patch for now.
My best idea to fix this is to move the rotated font out of fbcon_par.
The unrotated font data is stored at [1]. The struct fbcon_display
stores a vc's display settings. It might be possible to move the rotated
data there as well. Tracked correctly, each vc would have its own
rotated font. BUT this might also have other side effects.
Best regards
Thomas
[1]
https://elixir.bootlin.com/linux/v6.19.3/source/drivers/video/fbdev/core/fbcon.h#L28
>
> Best regards
> Chen Jun
>
>>>>> ret = vc_resize(vc, cols, rows);
>>>>> if (ret)
>>>>> goto err_out;
>
--
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstr. 146, 90461 Nürnberg, Germany, www.suse.com
GF: Jochen Jaser, Andrew McDonald, Werner Knoblich, (HRB 36809, AG Nürnberg)
^ permalink raw reply
* [PATCH] staging: fbtft: Update RA8875 Kconfig help description
From: Adam Azuddin @ 2026-03-04 9:39 UTC (permalink / raw)
To: andy, gregkh; +Cc: dri-devel, linux-fbdev, linux-staging, linux-kernel
The current description is too brief. Update the description to
include the manufacturer (RAiO) and the supported resolution
(up to 800x480 pixels) to help users identify the correct driver.
Signed-off-by: Adam Azuddin <azuddinadam@gmail.com>
---
drivers/staging/fbtft/Kconfig | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/staging/fbtft/Kconfig b/drivers/staging/fbtft/Kconfig
index 578412a2f379..92943564cb91 100644
--- a/drivers/staging/fbtft/Kconfig
+++ b/drivers/staging/fbtft/Kconfig
@@ -86,7 +86,11 @@ config FB_TFT_PCD8544
config FB_TFT_RA8875
tristate "FB driver for the RA8875 LCD Controller"
help
- Generic Framebuffer support for RA8875
+ This enables generic framebuffer support for the RAiO RA8875
+ display controller. The controller is intended for medium size text/graphic
+ mixed displays with a resolution of up to 800x480 pixels.
+
+ Say Y if you have such a display that utilizes this controller.
config FB_TFT_S6D02A1
tristate "FB driver for the S6D02A1 LCD Controller"
--
2.53.0
^ permalink raw reply related
* Re: [PATCH v2 00/13] vc,fbcon,fonts: Proper handling of font data
From: Thomas Zimmermann @ 2026-03-04 9:11 UTC (permalink / raw)
To: Helge Deller, gregkh, sam; +Cc: linux-fbdev, dri-devel, linux-kernel
In-Reply-To: <11c9e67c-36f9-4d27-8064-41b804cc0c02@gmx.de>
Hi
Am 03.03.26 um 16:29 schrieb Helge Deller:
> On 3/2/26 15:08, Thomas Zimmermann wrote:
>> Provide helpers for handling console font data. Update consoles and VT.
>>
>> VT's vc_state stores font data as a plain byte array of glphys. Fbcon,
>> newport_con and the kernel's internal fonts store the glyph data as an
>> array of plain bytes plus a hidden header for reference counting, check
>> sums and buffer sizes. The reference counting only works for user-space
>> fonts but not for internal fonts. Font-data handling is duplicated in
>> several places. Most of the font handling is open-coded and mixed up
>> with
>> VT's plain glyph arrays.
>>
>> To address these issues, add proper handling of font data to all
>> involved
>> components: struct vc_font for font state in VC; a font data type for
>> the
>> consoles. Then implement interfaces for handling font data one by one.
>>
>> Patch 1 prepares the fbdev interface.
>>
>> Patches 2 to 4 prepare VT's font handling.
>>
>> Patches 5 to 13 refactor fbcon and newport_con to use clean
>> interfaces for
>> their fonts.
>>
>> Fbcon has long been a source of problems and bug reports. [1] With its
>> confusing implementation, it is hard to find the cause of these bugs.
>> Cleaning up the fbcon code will hopefully help with resolving bug
>> reports
>> in the future.
>>
>> The series has been tested with fbcon under DRM's bochs driver by
>> changing
>> fonts at runtime using the setfont utility. [2] The changes to
>> newport_con
>> have only been tested to compile.
>>
>> v2:
>> - keep declaring the internal fonts in the public header file (Helge)
>> - rebase and clean up
>>
>> [1]
>> https://lore.kernel.org/all/6992c84c.a70a0220.2c38d7.00e8.GAE@google.com/
>> [2] https://www.man7.org/linux/man-pages/man8/setfont.8.html
>>
>> Thomas Zimmermann (13):
>> fbdev: Declare src parameter of fb_pad_ helpers as constant
>> vt: Remove trailing whitespaces
>> vt: Store font in struct vc_font
>> vt: Calculate font-buffer size with vc_font_size()
>> lib/fonts: Remove trailing whitespaces
>> lib/fonts: Remove FNTCHARCNT()
>> lib/fonts: Store font data as font_data_t; update consoles
>> lib/fonts: Read font size with font_data_size()
>> lib/fonts: Compare font data for equality with font_data_is_equal()
>> lib/fonts: Manage font-data lifetime with font_data_get/_put()
>> lib/fonts: Create font_data_t from struct console_font with
>> font_data_import()
>> lib/fonts: Store font data for user space with font_data_export()
>> lib/fonts: Remove internal symbols and macros from public header file
>>
>> drivers/video/console/newport_con.c | 61 +++----
>> drivers/video/fbdev/core/bitblit.c | 11 +-
>> drivers/video/fbdev/core/fbcon.c | 194 +++++++----------------
>> drivers/video/fbdev/core/fbcon.h | 8 +-
>> drivers/video/fbdev/core/fbmem.c | 6 +-
>> include/linux/console_struct.h | 59 ++++++-
>> include/linux/fb.h | 10 +-
>> include/linux/font.h | 115 +++++++++-----
>> lib/fonts/font.h | 38 +++++
>> lib/fonts/font_10x18.c | 2 +-
>> lib/fonts/font_6x10.c | 3 +-
>> lib/fonts/font_6x11.c | 2 +-
>> lib/fonts/font_6x8.c | 3 +-
>> lib/fonts/font_7x14.c | 2 +-
>> lib/fonts/font_8x16.c | 3 +-
>> lib/fonts/font_8x8.c | 2 +-
>> lib/fonts/font_acorn_8x8.c | 4 +-
>> lib/fonts/font_mini_4x6.c | 10 +-
>> lib/fonts/font_pearl_8x8.c | 2 +-
>> lib/fonts/font_sun12x22.c | 3 +-
>> lib/fonts/font_sun8x16.c | 3 +-
>> lib/fonts/font_ter10x18.c | 4 +-
>> lib/fonts/font_ter16x32.c | 4 +-
>> lib/fonts/fonts.c | 236 +++++++++++++++++++++++++++-
>> 24 files changed, 518 insertions(+), 267 deletions(-)
>> create mode 100644 lib/fonts/font.h
> Thomas, thanks for the nice cleanup!
> Beside a few minor comments which I posted to the various patches, the
> series looks good.
>
> I've applied it for further testing to the fbdev git tree.
Great, thanks!
> In case you send later v3 series, I'll update it.
I'd preferably not modify the data structures for now. Shall I send an
update for the typos?
Best regards
Thomas
>
> Thanks a lot!
> Helge
--
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstr. 146, 90461 Nürnberg, Germany, www.suse.com
GF: Jochen Jaser, Andrew McDonald, Werner Knoblich, (HRB 36809, AG Nürnberg)
^ permalink raw reply
* [PATCH 6/6] staging: sm750fb: sm750_sw_i2c_init: return -EINVAL for invalid GPIO
From: Soham Kute @ 2026-03-04 8:45 UTC (permalink / raw)
To: sudipm.mukherjee, teddy.wang
Cc: gregkh, linux-fbdev, linux-staging, linux-kernel, dan.carpenter,
Soham Kute
In-Reply-To: <20260304084545.156170-1-officialsohamkute@gmail.com>
Return -EINVAL instead of -1 when the GPIO pin number is out of
range. The caller checks for non-zero return value as failure.
Signed-off-by: Soham Kute <officialsohamkute@gmail.com>
---
drivers/staging/sm750fb/ddk750_swi2c.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/sm750fb/ddk750_swi2c.c b/drivers/staging/sm750fb/ddk750_swi2c.c
index a17f758dda6c..d90a93ab8fdc 100644
--- a/drivers/staging/sm750fb/ddk750_swi2c.c
+++ b/drivers/staging/sm750fb/ddk750_swi2c.c
@@ -394,7 +394,7 @@ long sm750_sw_i2c_init(unsigned char clk_gpio, unsigned char data_gpio)
* range is only from [0..63]
*/
if ((clk_gpio > 31) || (data_gpio > 31))
- return -1;
+ return -EINVAL;
if (sm750_get_chip_type() == SM750LE)
return sm750le_i2c_init(clk_gpio, data_gpio);
--
2.34.1
^ permalink raw reply related
* [PATCH 5/6] staging: sm750fb: sw_i2c_write_byte: return -ETIMEDOUT on timeout
From: Soham Kute @ 2026-03-04 8:45 UTC (permalink / raw)
To: sudipm.mukherjee, teddy.wang
Cc: gregkh, linux-fbdev, linux-staging, linux-kernel, dan.carpenter,
Soham Kute
In-Reply-To: <20260304084545.156170-1-officialsohamkute@gmail.com>
Return -ETIMEDOUT instead of -1 when the I2C byte write times out.
The callers check for non-zero return value and treat it as failure.
Signed-off-by: Soham Kute <officialsohamkute@gmail.com>
---
drivers/staging/sm750fb/ddk750_swi2c.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/sm750fb/ddk750_swi2c.c b/drivers/staging/sm750fb/ddk750_swi2c.c
index 0ef8d4ff2ef9..a17f758dda6c 100644
--- a/drivers/staging/sm750fb/ddk750_swi2c.c
+++ b/drivers/staging/sm750fb/ddk750_swi2c.c
@@ -294,7 +294,7 @@ static long sw_i2c_write_byte(unsigned char data)
if (i < 0xff)
return 0;
else
- return -1;
+ return -ETIMEDOUT;
}
/*
--
2.34.1
^ permalink raw reply related
* [PATCH 4/6] staging: sm750fb: sm750_hw_imageblit: propagate de_wait() error
From: Soham Kute @ 2026-03-04 8:45 UTC (permalink / raw)
To: sudipm.mukherjee, teddy.wang
Cc: gregkh, linux-fbdev, linux-staging, linux-kernel, dan.carpenter,
Soham Kute
In-Reply-To: <20260304084545.156170-1-officialsohamkute@gmail.com>
Propagate the error from accel->de_wait() instead of returning -1.
The caller treats all non-zero return values as failure.
Signed-off-by: Soham Kute <officialsohamkute@gmail.com>
---
drivers/staging/sm750fb/sm750_accel.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/staging/sm750fb/sm750_accel.c b/drivers/staging/sm750fb/sm750_accel.c
index f2fde011e7ca..7d11810864ae 100644
--- a/drivers/staging/sm750fb/sm750_accel.c
+++ b/drivers/staging/sm750fb/sm750_accel.c
@@ -325,15 +325,16 @@ int sm750_hw_imageblit(struct lynx_accel *accel, const char *pSrcbuf,
unsigned int ulBytesRemain;
unsigned int de_ctrl = 0;
unsigned char ajRemain[4];
- int i, j;
+ int i, j, ret;
startBit &= 7; /* Just make sure the start bit is within legal range */
ulBytesPerScan = (width + startBit + 7) / 8;
ul4BytesPerScan = ulBytesPerScan & ~3;
ulBytesRemain = ulBytesPerScan & 3;
- if (accel->de_wait() != 0)
- return -1;
+ ret = accel->de_wait();
+ if (ret)
+ return ret;
/*
* 2D Source Base.
--
2.34.1
^ permalink raw reply related
* [PATCH 3/6] staging: sm750fb: sm750_hw_copyarea: propagate de_wait() error
From: Soham Kute @ 2026-03-04 8:45 UTC (permalink / raw)
To: sudipm.mukherjee, teddy.wang
Cc: gregkh, linux-fbdev, linux-staging, linux-kernel, dan.carpenter,
Soham Kute
In-Reply-To: <20260304084545.156170-1-officialsohamkute@gmail.com>
Propagate the error from accel->de_wait() instead of returning -1.
The caller treats all non-zero return values as failure.
Signed-off-by: Soham Kute <officialsohamkute@gmail.com>
---
drivers/staging/sm750fb/sm750_accel.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/sm750fb/sm750_accel.c b/drivers/staging/sm750fb/sm750_accel.c
index 1bd0502db039..f2fde011e7ca 100644
--- a/drivers/staging/sm750fb/sm750_accel.c
+++ b/drivers/staging/sm750fb/sm750_accel.c
@@ -152,6 +152,7 @@ int sm750_hw_copyarea(struct lynx_accel *accel,
unsigned int rop2)
{
unsigned int nDirection, de_ctrl;
+ int ret;
nDirection = LEFT_TO_RIGHT;
/* Direction of ROP2 operation: 1 = Left to Right, (-1) = Right to Left */
@@ -261,8 +262,9 @@ int sm750_hw_copyarea(struct lynx_accel *accel,
DE_WINDOW_WIDTH_DST_MASK) |
(sPitch / Bpp & DE_WINDOW_WIDTH_SRC_MASK)); /* dpr3c */
- if (accel->de_wait() != 0)
- return -1;
+ ret = accel->de_wait();
+ if (ret)
+ return ret;
write_dpr(accel, DE_SOURCE,
((sx << DE_SOURCE_X_K1_SHIFT) & DE_SOURCE_X_K1_MASK) |
--
2.34.1
^ permalink raw reply related
* [PATCH 2/6] staging: sm750fb: sm750_hw_fillrect: propagate de_wait() error
From: Soham Kute @ 2026-03-04 8:45 UTC (permalink / raw)
To: sudipm.mukherjee, teddy.wang
Cc: gregkh, linux-fbdev, linux-staging, linux-kernel, dan.carpenter,
Soham Kute
In-Reply-To: <20260304084545.156170-1-officialsohamkute@gmail.com>
Propagate the error from accel->de_wait() instead of returning -1.
The caller treats all non-zero return values as failure.
Signed-off-by: Soham Kute <officialsohamkute@gmail.com>
---
drivers/staging/sm750fb/sm750_accel.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/drivers/staging/sm750fb/sm750_accel.c b/drivers/staging/sm750fb/sm750_accel.c
index 046b9282b24a..1bd0502db039 100644
--- a/drivers/staging/sm750fb/sm750_accel.c
+++ b/drivers/staging/sm750fb/sm750_accel.c
@@ -90,14 +90,12 @@ int sm750_hw_fillrect(struct lynx_accel *accel,
u32 color, u32 rop)
{
u32 de_ctrl;
+ int ret;
- if (accel->de_wait() != 0) {
- /*
- * int time wait and always busy,seems hardware
- * got something error
- */
+ ret = accel->de_wait();
+ if (ret) {
pr_debug("De engine always busy\n");
- return -1;
+ return ret;
}
write_dpr(accel, DE_WINDOW_DESTINATION_BASE, base); /* dpr40 */
--
2.34.1
^ permalink raw reply related
* [PATCH 1/6] staging: sm750fb: hw_sm750le_de_wait: return -ETIMEDOUT on timeout
From: Soham Kute @ 2026-03-04 8:45 UTC (permalink / raw)
To: sudipm.mukherjee, teddy.wang
Cc: gregkh, linux-fbdev, linux-staging, linux-kernel, dan.carpenter,
Soham Kute
In-Reply-To: <20260304084545.156170-1-officialsohamkute@gmail.com>
Return -ETIMEDOUT instead of -1 when the DE engine poll loop
times out. The callers check for non-zero return value and
propagate the error code back to their callers.
Signed-off-by: Soham Kute <officialsohamkute@gmail.com>
---
drivers/staging/sm750fb/sm750_hw.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/sm750fb/sm750_hw.c b/drivers/staging/sm750fb/sm750_hw.c
index ce46f240cbaf..e4b6b254335e 100644
--- a/drivers/staging/sm750fb/sm750_hw.c
+++ b/drivers/staging/sm750fb/sm750_hw.c
@@ -518,7 +518,7 @@ int hw_sm750le_de_wait(void)
return 0;
}
/* timeout error */
- return -1;
+ return -ETIMEDOUT;
}
int hw_sm750_de_wait(void)
@@ -536,7 +536,7 @@ int hw_sm750_de_wait(void)
return 0;
}
/* timeout error */
- return -1;
+ return -ETIMEDOUT;
}
int hw_sm750_pan_display(struct lynxfb_crtc *crtc,
--
2.34.1
^ permalink raw reply related
* [PATCH v2 0/6] staging: sm750fb: fix error return values
From: Soham Kute @ 2026-03-04 8:45 UTC (permalink / raw)
To: sudipm.mukherjee, teddy.wang
Cc: gregkh, linux-fbdev, linux-staging, linux-kernel, dan.carpenter,
Soham Kute
In-Reply-To: <aaVT1mSeKrSSlrha@stanley.mountain>
This is v2 of the sm750fb error code fixes, split into one patch
per function as requested by Dan Carpenter.
Changes in v2:
- Split into one patch per function
- Propagate de_wait() error instead of hardcoding -EBUSY
- Each commit message describes caller behavior
Soham Kute (6):
11ca38f0ec63 staging: sm750fb: hw_sm750le_de_wait: return -ETIMEDOUT on timeout
28df828cc89b staging: sm750fb: sm750_hw_fillrect: propagate de_wait() error
2378ece78154 staging: sm750fb: sm750_hw_copyarea: propagate de_wait() error
85139ac8c7fe staging: sm750fb: sm750_hw_imageblit: propagate de_wait() error
9c2430311e23 staging: sm750fb: sw_i2c_write_byte: return -ETIMEDOUT on timeout
915599b01e9b staging: sm750fb: sm750_sw_i2c_init: return -EINVAL for invalid GPIO
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox