From 5e1631df673f3d5355acd06263a884e00d8d007b Mon Sep 17 00:00:00 2001 From: Hemanth Selam Date: Fri, 4 Sep 2026 17:56:44 +0530 Subject: backlight: ili9320/ktd253: Fix typos in comments Fix typos in comments, reported by scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Only touches comments, no code changes. Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam Link: https://patch.msgid.link/20260904122646.32558-1-hemanth.selam@gmail.com Signed-off-by: Lee Jones --- drivers/video/backlight/ili9320.c | 2 +- drivers/video/backlight/ktd253-backlight.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/video/backlight/ili9320.c b/drivers/video/backlight/ili9320.c index 2df96a882119..d2f094dd7fc3 100644 --- a/drivers/video/backlight/ili9320.c +++ b/drivers/video/backlight/ili9320.c @@ -30,7 +30,7 @@ static inline int ili9320_write_spi(struct ili9320 *ili, unsigned char *addr = spi->buffer_addr; unsigned char *data = spi->buffer_data; - /* spi message consits of: + /* spi message consists of: * first byte: ID and operation */ diff --git a/drivers/video/backlight/ktd253-backlight.c b/drivers/video/backlight/ktd253-backlight.c index 327b4ee75254..f2c5527d02e0 100644 --- a/drivers/video/backlight/ktd253-backlight.c +++ b/drivers/video/backlight/ktd253-backlight.c @@ -53,7 +53,7 @@ static int ktd253_backlight_stepdown(struct ktd253_backlight *ktd253) * * Architectures do not always support ndelay() and we will get a few us * instead. If we get to a critical time limit an interrupt has likely - * occured in the low part of the loop and we need to restart from the + * occurred in the low part of the loop and we need to restart from the * top so we have the backlight in a known state. */ u64 ns; -- cgit v1.2.3 From 2cf184caab8b406fdd9db126ee40d62418237456 Mon Sep 17 00:00:00 2001 From: Myeonghun Pak Date: Fri, 2 Oct 2026 23:04:39 -0400 Subject: backlight: lm3630a: Cancel delayed work before destroying workqueue The interrupt handler queues delayed work to read the interrupt status. After free_irq() stops the producer, this work can still be waiting on its timer. destroy_workqueue() cannot drain delayed work that has not yet been queued by its timer, so the timer can outlive both the workqueue and the devm-allocated chip containing the work. Cancel the delayed work synchronously after freeing the IRQ and before destroying the workqueue. This also waits for any running status read to finish before the chip's resources are released. This issue was identified during our ongoing static-analysis research while reviewing kernel code. Fixes: 0c2a665a648e ("backlight: add Backlight driver for lm3630 chip") Cc: stable@vger.kernel.org Assisted-by: LLM Co-developed-by: Ijae Kim Signed-off-by: Ijae Kim Signed-off-by: Myeonghun Pak Reviewed-by: Daniel Thompson (RISCstar) Link: https://patch.msgid.link/20261003030439.599330-1-mhun512@gmail.com Signed-off-by: Lee Jones --- drivers/video/backlight/lm3630a_bl.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/video/backlight/lm3630a_bl.c b/drivers/video/backlight/lm3630a_bl.c index 8f49e59ce374..8ef8163c7fef 100644 --- a/drivers/video/backlight/lm3630a_bl.c +++ b/drivers/video/backlight/lm3630a_bl.c @@ -591,6 +591,7 @@ static void lm3630a_remove(struct i2c_client *client) if (pchip->irq) { free_irq(pchip->irq, pchip); + cancel_delayed_work_sync(&pchip->work); destroy_workqueue(pchip->irqthread); } } -- cgit v1.2.3 From 1dbd46d4b2fb416a8202b1a8e4ef9d0cadbe075f Mon Sep 17 00:00:00 2001 From: David Heidelberg Date: Mon, 21 Sep 2026 12:46:22 +0200 Subject: backlight: qcom-wled: Fix NULL pointer dereference in wled_remove() wled_probe() doesn't set the driver data for the platform device. As a result, platform_get_drvdata() in wled_remove() will return NULL, and the first dereference of it crashes on unbind. Set the platform device driver data in wled_probe(). Cc: stable@vger.kernel.org Fixes: feeab87b3072 ("backlight: qcom-wled: Add support for short circuit handling") Signed-off-by: David Heidelberg Reviewed-by: Daniel Thompson (RISCstar) Reviewed-by: Konrad Dybcio Link: https://patch.msgid.link/20260921-qcom-wled-backlight-v4-1-bab8c7ef73cb@ixit.cz Signed-off-by: Lee Jones --- drivers/video/backlight/qcom-wled.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/video/backlight/qcom-wled.c b/drivers/video/backlight/qcom-wled.c index 650dd95f06ef..2281007bdd45 100644 --- a/drivers/video/backlight/qcom-wled.c +++ b/drivers/video/backlight/qcom-wled.c @@ -1680,6 +1680,7 @@ static int wled_probe(struct platform_device *pdev) wled->regmap = regmap; wled->dev = &pdev->dev; + platform_set_drvdata(pdev, wled); wled->version = (uintptr_t)of_device_get_match_data(&pdev->dev); if (!wled->version) { -- cgit v1.2.3 From 22672f81f0724cbabb272fd0228fa424d4306082 Mon Sep 17 00:00:00 2001 From: David Heidelberg Date: Mon, 21 Sep 2026 12:46:23 +0200 Subject: backlight: qcom-wled: Fix WLED3 brightness register stride WLED3 has a 16-bit brightness register pair per string, at 0x40 + 2*n, which is what the pm8941-wled driver wrote to: rc = regmap_bulk_write(wled->regmap, wled->addr + WLED3_CTRL_REG_VAL_BASE + 2 * i, v, 2); The restructuring for WLED3 turned that into WLED3_SINK_REG_BRIGHT(n), defined as 0x40 + n, so the two byte writes for consecutive strings overlap: string 1 overwrites the MSB of string 0 with its own LSB, and with the default three strings only string 1 ends up with the requested value. Use the 2 byte stride. Fixes: 775d2ffb4af6 ("backlight: qcom-wled: Restructure the driver for WLED3") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: David Heidelberg Reviewed-by: Daniel Thompson (RISCstar) Reviewed-by: Konrad Dybcio Link: https://patch.msgid.link/20260921-qcom-wled-backlight-v4-2-bab8c7ef73cb@ixit.cz Signed-off-by: Lee Jones --- drivers/video/backlight/qcom-wled.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/video/backlight/qcom-wled.c b/drivers/video/backlight/qcom-wled.c index 2281007bdd45..f452d328997a 100644 --- a/drivers/video/backlight/qcom-wled.c +++ b/drivers/video/backlight/qcom-wled.c @@ -59,7 +59,7 @@ #define WLED3_SINK_REG_CURR_SINK_SHFT 5 /* WLED3 specific per-'string' registers below */ -#define WLED3_SINK_REG_BRIGHT(n) (0x40 + n) +#define WLED3_SINK_REG_BRIGHT(n) (0x40 + (n * 0x2)) #define WLED3_SINK_REG_STR_MOD_EN(n) (0x60 + (n * 0x10)) #define WLED3_SINK_REG_STR_MOD_MASK BIT(7) -- cgit v1.2.3 From 5eda6b51461932f9fd835ef9e4574650c69c4fe8 Mon Sep 17 00:00:00 2001 From: David Heidelberg Date: Mon, 21 Sep 2026 12:46:24 +0200 Subject: backlight: qcom-wled: Fix unbalanced OVP IRQ enable at probe wled_configure_ovp_irq() derives the initial state of the OVP interrupt from the hardware: /* Keep OVP irq disabled until module is enabled */ if (!(val & WLED3_CTRL_REG_MOD_EN_MASK)) disable_irq(wled->ovp_irq); but wled->brightness, which is what the rest of the driver uses to tell whether the module is on, is left at zero. On boards where the bootloader hands the kernel a lit backlight the two disagree. MOD_EN is already set, so the interrupt is left enabled, while wled_update_status() still believes the backlight is off and takes if (!!brightness != !!wled->brightness) rc = wled_module_enable(wled, !!brightness); on the first backlight update. wled_module_enable() then schedules wled_ovp_work(), which calls enable_irq() on the already enabled interrupt: Unbalanced enable for IRQ 176 WARNING: CPU: 0 PID: 160 at kernel/irq/manage.c:774 __enable_irq+0x50/0x80 Hardware name: Xiaomi Pocophone F1 (DT) Workqueue: events wled_ovp_work Call trace: __enable_irq+0x50/0x80 enable_irq+0x48/0xa0 wled_ovp_work+0x18/0x24 process_one_work+0x1d0/0x350 worker_thread+0x13c/0x460 kthread+0x110/0x114 ret_from_fork+0x10/0x20 The bootloader is not the only way to get there. The readback runs after wledN_setup(), and wled4_setup() sets MOD_EN itself on the path where the sink configuration does not already match, as does the tail of wled_auto_string_detection(), which all three setup paths can reach through wled_auto_detection_at_init(). A cold-booted board with a dark panel can therefore reach the same disagreement. Move the MOD_EN readback into wled_probe() and use it to seed wled->brightness, so the driver starts out agreeing with the hardware, and key the OVP interrupt off wled->brightness instead. The first backlight update then only reprograms the brightness registers and leaves both the module and the interrupt alone. The OVP interrupt also stays armed from probe whenever the module is already enabled, rather than being disabled at probe and only enabled once something writes brightness. Note that a backlight update requesting brightness 0 before any non-zero one now really does turn the module off wherever MOD_EN was already set, where before it was silently ignored. wled->brightness is seeded with default-brightness rather than the level the bootloader actually programmed, so the first update can still step the brightness. Reading that level back is version specific and is done in a follow-up, to keep this fix small enough to backport. Assisted-by: LLM Fixes: 8663c188beea ("backlight: qcom-wled: Add auto string detection logic") Cc: stable@vger.kernel.org Signed-off-by: David Heidelberg Reviewed-by: Daniel Thompson (RISCstar) Link: https://patch.msgid.link/20260921-qcom-wled-backlight-v4-3-bab8c7ef73cb@ixit.cz Signed-off-by: Lee Jones --- drivers/video/backlight/qcom-wled.c | 32 +++++++++++++++++++++----------- 1 file changed, 21 insertions(+), 11 deletions(-) diff --git a/drivers/video/backlight/qcom-wled.c b/drivers/video/backlight/qcom-wled.c index f452d328997a..3ce3bade3b8d 100644 --- a/drivers/video/backlight/qcom-wled.c +++ b/drivers/video/backlight/qcom-wled.c @@ -1627,7 +1627,6 @@ static int wled_configure_ovp_irq(struct wled *wled, struct platform_device *pdev) { int rc; - u32 val; wled->ovp_irq = platform_get_irq_byname(pdev, "ovp"); if (wled->ovp_irq < 0) { @@ -1643,13 +1642,8 @@ static int wled_configure_ovp_irq(struct wled *wled, return 0; } - rc = regmap_read(wled->regmap, wled->ctrl_addr + - WLED3_CTRL_REG_MOD_EN, &val); - if (rc < 0) - return rc; - - /* Keep OVP irq disabled until module is enabled */ - if (!(val & WLED3_CTRL_REG_MOD_EN_MASK)) + /* Keep the OVP irq disabled until the module is enabled */ + if (!wled->brightness) disable_irq(wled->ovp_irq); return 0; @@ -1665,6 +1659,7 @@ static int wled_probe(struct platform_device *pdev) struct backlight_device *bl; struct wled *wled; struct regmap *regmap; + u32 mod_en; u32 val; int rc; @@ -1735,6 +1730,24 @@ static int wled_probe(struct platform_device *pdev) INIT_DELAYED_WORK(&wled->ovp_work, wled_ovp_work); + val = WLED_DEFAULT_BRIGHTNESS; + of_property_read_u32(pdev->dev.of_node, "default-brightness", &val); + + /* + * The module may already be enabled, either by a bootloader that left + * the backlight lit or by the setup above. Record that, so that the + * first brightness update does not enable an already enabled module, + * and so that the OVP irq is armed from probe rather than from that + * first update. + */ + rc = regmap_read(wled->regmap, wled->ctrl_addr + WLED3_CTRL_REG_MOD_EN, + &mod_en); + if (rc < 0) + return rc; + + if (mod_en & WLED3_CTRL_REG_MOD_EN_MASK) + wled->brightness = val; + rc = wled_configure_short_irq(wled, pdev); if (rc < 0) return rc; @@ -1743,9 +1756,6 @@ static int wled_probe(struct platform_device *pdev) if (rc < 0) return rc; - val = WLED_DEFAULT_BRIGHTNESS; - of_property_read_u32(pdev->dev.of_node, "default-brightness", &val); - memset(&props, 0, sizeof(struct backlight_properties)); props.type = BACKLIGHT_RAW; props.brightness = val; -- cgit v1.2.3 From eacfbe6f9716d00536edc229a58895405e73c2e4 Mon Sep 17 00:00:00 2001 From: David Heidelberg Date: Mon, 21 Sep 2026 12:46:25 +0200 Subject: backlight: qcom-wled: Read back the programmed brightness at probe Since the previous change wled_probe() seeds wled->brightness from MOD_EN, but with default-brightness rather than the level the hardware is actually driving, so a backlight left lit by the bootloader still visibly steps on the first update, and actual_brightness reports the last value written rather than what the panel shows. Add wled_read_brightness(), which returns 0 when MOD_EN is clear and otherwise reads the brightness register the matching wledN_set_brightness() writes: the first enabled string on WLED3 and WLED4, the selected modulator on WLED5. Use it to seed both wled->brightness and the initial backlight property, and expose it as backlight_ops.get_brightness so that actual_brightness reflects the hardware too. A module that is enabled with the brightness registers at zero, which wled4_setup() and wled_auto_string_detection() can leave behind on a cold boot, now reads back as off. The OVP interrupt is then armed by the first brightness update rather than from probe, which is what happens on every other board where the module starts out disabled. Suggested-by: Konrad Dybcio Assisted-by: LLM Signed-off-by: David Heidelberg Reviewed-by: Daniel Thompson (RISCstar) Link: https://patch.msgid.link/20260921-qcom-wled-backlight-v4-4-bab8c7ef73cb@ixit.cz Signed-off-by: Lee Jones --- drivers/video/backlight/qcom-wled.c | 74 +++++++++++++++++++++++++++++++------ 1 file changed, 63 insertions(+), 11 deletions(-) diff --git a/drivers/video/backlight/qcom-wled.c b/drivers/video/backlight/qcom-wled.c index 3ce3bade3b8d..ca350f320e17 100644 --- a/drivers/video/backlight/qcom-wled.c +++ b/drivers/video/backlight/qcom-wled.c @@ -290,6 +290,50 @@ static int wled5_set_brightness(struct wled *wled, u16 brightness) return rc; } +static int wled_read_brightness(struct wled *wled) +{ + u16 addr, mask; + __le16 v; + u32 val; + int rc; + + rc = regmap_read(wled->regmap, wled->ctrl_addr + WLED3_CTRL_REG_MOD_EN, + &val); + if (rc < 0) + return rc; + + if (!(val & WLED3_CTRL_REG_MOD_EN_MASK)) + return 0; + + switch (wled->version) { + case 3: + addr = wled->sink_addr + + WLED3_SINK_REG_BRIGHT(wled->cfg.enabled_strings[0]); + mask = WLED3_SINK_REG_BRIGHT_MAX; + break; + case 4: + addr = wled->sink_addr + + WLED4_SINK_REG_BRIGHT(wled->cfg.enabled_strings[0]); + mask = WLED3_SINK_REG_BRIGHT_MAX; + break; + case 5: + addr = wled->sink_addr + (wled->cfg.mod_sel == MOD_A ? + WLED5_SINK_REG_MOD_A_BRIGHTNESS_LSB : + WLED5_SINK_REG_MOD_B_BRIGHTNESS_LSB); + mask = WLED5_SINK_REG_BRIGHT_MAX_15B; + break; + default: + dev_err(wled->dev, "Invalid WLED version\n"); + return -EINVAL; + } + + rc = regmap_bulk_read(wled->regmap, addr, &v, sizeof(v)); + if (rc < 0) + return rc; + + return min_t(u32, le16_to_cpu(v) & mask, wled->max_brightness); +} + static void wled_ovp_work(struct work_struct *work) { struct wled *wled = container_of(work, @@ -480,6 +524,18 @@ unlock_mutex: return rc; } +static int wled_get_brightness(struct backlight_device *bl) +{ + struct wled *wled = bl_get_data(bl); + int rc; + + mutex_lock(&wled->lock); + rc = wled_read_brightness(wled); + mutex_unlock(&wled->lock); + + return rc; +} + static int wled4_cabc_config(struct wled *wled, bool enable) { int i, j, rc; @@ -1651,6 +1707,7 @@ static int wled_configure_ovp_irq(struct wled *wled, static const struct backlight_ops wled_ops = { .update_status = wled_update_status, + .get_brightness = wled_get_brightness, }; static int wled_probe(struct platform_device *pdev) @@ -1659,7 +1716,6 @@ static int wled_probe(struct platform_device *pdev) struct backlight_device *bl; struct wled *wled; struct regmap *regmap; - u32 mod_en; u32 val; int rc; @@ -1734,19 +1790,15 @@ static int wled_probe(struct platform_device *pdev) of_property_read_u32(pdev->dev.of_node, "default-brightness", &val); /* - * The module may already be enabled, either by a bootloader that left - * the backlight lit or by the setup above. Record that, so that the - * first brightness update does not enable an already enabled module, - * and so that the OVP irq is armed from probe rather than from that - * first update. + * The module may already be lit, either by the bootloader or by the + * setup above. Start from what the hardware is driving, so that the + * first brightness update does not step the brightness. */ - rc = regmap_read(wled->regmap, wled->ctrl_addr + WLED3_CTRL_REG_MOD_EN, - &mod_en); + rc = wled_read_brightness(wled); if (rc < 0) return rc; - if (mod_en & WLED3_CTRL_REG_MOD_EN_MASK) - wled->brightness = val; + wled->brightness = rc; rc = wled_configure_short_irq(wled, pdev); if (rc < 0) @@ -1758,7 +1810,7 @@ static int wled_probe(struct platform_device *pdev) memset(&props, 0, sizeof(struct backlight_properties)); props.type = BACKLIGHT_RAW; - props.brightness = val; + props.brightness = wled->brightness ?: val; props.max_brightness = wled->max_brightness; bl = devm_backlight_device_register(&pdev->dev, wled->name, &pdev->dev, wled, -- cgit v1.2.3