| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
pm_runtime_get_sync() is called in starfive_pcie_probe() without
checking its return value. If runtime resume fails, the driver
proceeds to configure PCIe hardware through regmap_update_bits(),
enable clocks and resets, and power on the PHY, even though the
device may not actually be powered.
pm_runtime_get_sync() also increments the usage counter even when
resume fails, which would leave the counter unbalanced if this
error path were later handled without additional cleanup.
Switch to pm_runtime_resume_and_get(), which balances the usage
counter internally on failure, and bail out of probe before any
hardware is touched if resume does not succeed.
Tested on StarFive VisionFive 2 v1.2A board.
Fixes: 6168efbebace ("PCI: starfive: Enable controller runtime PM before probing host bridge")
Signed-off-by: Ali Tariq <alitariq45892@gmail.com>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Link: https://patch.msgid.link/20260718153352.661930-1-alitariq45892@gmail.com
|
|
The starfive_pcie_remove() path incorrectly disabled runtime PM
before executing plda_pcie_host_deinit(), which can cause unmanaged
hardware register access in plda_pcie_host_deinit() while power domains or
clocks are disabled.
Fix this by restructuring starfive_pcie_remove() to deinitialize the host
controller first while runtime PM is active, followed by a synchronous
pm_runtime_put_sync() and pm_runtime_disable().
This bug was found in automated AI review by sashiko-bot.
Fixes: 39b91eb40c6a ("PCI: starfive: Add JH7110 PCIe controller")
Closes: https://lore.kernel.org/linux-pci/20260712180440.423421F000E9@smtp.kernel.org/
Signed-off-by: Ali Tariq <alitariq45892@gmail.com>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Link: https://patch.msgid.link/20260718133825.445041-1-alitariq45892@gmail.com
|
|
plda_init_interrupts() initializes IRQ domains and creates IRQ mapping but
does not unwind them when later step fails.
If platform_get_irq() or either irq_create_mapping() fails
in plda_init_interrupts(), the domains are never deinitialized. If
irq_create_mapping() fails, port->intx_irq stays initialized.
Hence, remove the IRQ domains in the error path by calling
plda_pcie_irq_domain_deinit().
Since plda_pcie_irq_domain_deinit() now disposes of the intx_irq and
msi_irq mappings itself before removing their domains, the msi_irq
mapping failure path can go directly to err_irq_domain_deinit instead of
disposing of port->intx_irq separately first.
This issue was found by automated review of sashiko-bot
Fixes: 4602c370bdf6 ("PCI: microchip: Move IRQ functions to pcie-plda-host.c")
Fixes: 76c911396807 ("PCI: plda: Add host init/deinit and map bus functions")
Closes: https://lore.kernel.org/linux-pci/20260718120701.DF4111F000E9@smtp.kernel.org/
Signed-off-by: Ali Tariq <alitariq45892@gmail.com>
[mani: commit log]
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260723142824.726655-1-alitariq45892@gmail.com
|
|
plda_pcie_irq_domain_deinit() removes pcie->event_domain via
irq_domain_remove(), but the per-event IRQs mapped from that domain
are requested with devm_request_irq() in plda_init_interrupts(). The
actual free_irq() for a devm-managed IRQ is deferred by devres until
after the calling probe()/remove() function returns.
This means irq_domain_remove() can free the domain's internal data
before the deferred free_irq() for IRQs still mapped into it has run.
When devres later processes that deferred cleanup, it can end up
dereferencing the already-freed domain.
Free each event IRQ explicitly with devm_free_irq() before removing
the domain. This triggers the free immediately and removes the IRQ
from the devres tracking list, so devres will not attempt to free it
a second time later.
Also dispose of the event, INTx, and MSI IRQ mappings with
irq_dispose_mapping() before their owning domains are removed.
Finally, guard the calls to irq_set_chained_handler_and_data() for
pcie->irq, pcie->msi_irq, and pcie->intx_irq so they only run when
those fields hold a valid (>0) IRQ number.
This is a pre-existing issue, flagged by automated review during work
on an earlier, unrelated patch to this driver.
Build-tested and boot-tested on StarFive VisionFive v1.2A board
Fixes: 76c911396807 ("PCI: plda: Add host init/deinit and map bus functions")
Closes: https://lore.kernel.org/linux-pci/20260714115343.4D49E1F000E9@smtp.kernel.org/
Signed-off-by: Ali Tariq <alitariq45892@gmail.com>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260723140434.675512-2-alitariq45892@gmail.com
|
|
Add device tree for the EmbedFire LubanCat 4 single board computer,
featuring the Rockchip RK3588S SoC.
Supported peripherals:
- UART2 debug console
- RK806 SPI PMIC with the full regulator tree, and RK8602/RK8603
fan53555-family supplies for the big CPU cluster and NPU
- eMMC (HS400 enhanced strobe) and SD card (UHS SDR104)
- GMAC1 with RGMII PHY on MDIO1 (Realtek RTL8211F, described via
the generic clause-22 compatible)
- HDMI0 output through hdptxphy0 and VOP2
- PCIe 2.0 x1 (mini PCIe slot) via combphy0_ps
- USB 2.0 host ports and one USB 3.0 host port
- HYM8563 RTC on I2C0
- On-board heartbeat LED and PWM fan header
Tested on hardware: gmac1 negotiates 1000Mbps/Full duplex with
phy-mode = "rgmii" (Realtek RTL8211F PHY, PCB provides ~2ns clock
skew on both TXC and RXC).
Signed-off-by: Pufan Jin <2254650260@qq.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch> #for gmac1 + mdio1
Link: https://patch.msgid.link/tencent_D22A164B3AEEA50562C1EC988862BA827A09@qq.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
|
|
Add compatible string for the EmbedFire LubanCat 4 single board
computer based on the Rockchip RK3588S SoC.
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Pufan Jin <2254650260@qq.com>
Link: https://patch.msgid.link/tencent_0DA92AE62C08A802ACC4FE9E47A0192C8E05@qq.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
|
|
When a fan tach channel is present, npcm7xx_pwm_fan_probe() starts
fan_timer. The timer callback polls tach state and rearms the timer, but
the driver has no remove callback or devm cleanup action to stop it. On
device detach, the devm-managed driver data and I/O mappings can be
released while the timer is still pending or running.
Register a devm cleanup action before starting the timer and shut the
timer down synchronously from that action.
This issue was found by a static analysis tool.
Fixes: f1fd4a4db777 ("hwmon: Add NPCM7xx PWM and Fan driver")
Cc: stable@vger.kernel.org
Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
Link: https://lore.kernel.org/r/20260729100116.790-1-getshell@seu.edu.cn
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
|
|
fault_addr in gstage_page_fault() and the fault_addr parameter of
kvm_riscv_vcpu_mmio_load/store() are unsigned long. On RV32 with
Sv32x4, guest physical addresses are 34 bits, so a 32-bit unsigned
long truncates bits 32/33 at two points:
- reconstruction: fault_addr = (trap->htval << 2) | ... is evaluated
in 32-bit arithmetic, dropping bits 32/33 before widening;
- the MMIO handler call: even with the local widened, the handler's
unsigned long parameter narrows it back to 32 bits, aliasing
accesses above 4 GB into the low 4 GB.
Widen fault_addr to gpa_t end to end: the local in gstage_page_fault(),
the (gpa_t) cast before the <<2 shift, and the fault_addr parameters of
kvm_riscv_vcpu_mmio_load/store(). The handlers' internal uses
(run->mmio.phys_addr is __u64, kvm_io_bus_read/write() take gpa_t) are
already 64-bit, so no further changes are needed.
Also in preparation for sharing a common struct kvm_page_fault across
architectures, where fault_addr is gpa_t. No functional change on RV64.
Fixes: 9d05c1fee837 ("RISC-V: KVM: Implement stage2 page table programming")
Assisted-by: YuanSheng: deepseek-v4-pro
Co-developed-by: Quan Zhou <zhouquan@iscas.ac.cn>
Signed-off-by: Quan Zhou <zhouquan@iscas.ac.cn>
Signed-off-by: Bingyu Xian <shanbeeyoo@gmail.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260729120733.829457-4-shanbeeyoo@gmail.com
Signed-off-by: Anup Patel <anup@brainfault.org>
|
|
vma_pageshift in kvm_riscv_mmu_map() was declared short. Use unsigned
int, the conventional kernel type for bit widths and shift counts, in
preparation for sharing a common struct kvm_page_fault across
architectures. No functional change.
Assisted-by: YuanSheng: deepseek-v4-pro
Co-developed-by: Quan Zhou <zhouquan@iscas.ac.cn>
Signed-off-by: Quan Zhou <zhouquan@iscas.ac.cn>
Signed-off-by: Bingyu Xian <shanbeeyoo@gmail.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260729120733.829457-3-shanbeeyoo@gmail.com
Signed-off-by: Anup Patel <anup@brainfault.org>
|
|
Commit d87773de9efe ("clocksource/drivers/arm_arch_timer: Default to EL2
virtual timer when running VHE") updated the ARM arch timer driver to
use the virtual timer by default if the CPU is running at EL2 with VHE
enabled. If the CPU is running at EL2 with VHE enabled but there is no
interrupt provided for the virtual timer, then the following warning is
displayed:
arch_timer: [Firmware Bug]: VHE-capable CPU without EL2 virtual timer
interrupt
This warning is observed on Tegra194 platforms. Tegra194 SoC includes
NVIDIA Carmel ARM v8.2 CPUs and support an EL2 virtual timer. Fix the
above warning by adding the PPI for the EL2 virtual timer interrupt for
Tegra194.
Fixes: 5425fb15d8ee ("arm64: tegra: Add Tegra194 chip device tree")
Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
|
|
The rk3399-roc-pc-plus inherits the work LED heartbeat trigger from
the common rk3399-roc-pc.dtsi.
On the rk3399-roc-pc-plus this LED is the prominent blue front-panel
status LED. Blinking it continuously is distracting for a PC-style
board. The usual default is a steady power/status indication while
the system is running.
Use the default-on trigger for this board instead. This keeps the LED
useful as a simple running indicator and still lets userspace select a
different trigger or turn it off after boot.
Signed-off-by: Fabio Estevam <festevam@nabladev.com>
Link: https://patch.msgid.link/20260717010736.578419-3-festevam@gmail.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
|
|
The rk3399-roc-pc-plus board has an Ampak AP6256 Wi-Fi/Bluetooth
module.
Describe the Wi-Fi function on SDIO0 and the Bluetooth function on
UART0. Add the Bluetooth wake and shutdown pinctrl entries, enable
SDIO0 as a non-removable SDIO device, and add the power sequencing
delays needed by the module.
The module uses the RK808 CLKOUT2 output as its 32 kHz low-power
clock. Drop the duplicate HYM8563 clock-output-names property and
remove the same clock from the SDIO power sequencer so the Bluetooth
node can request the shared LPO clock directly.
Signed-off-by: Fabio Estevam <festevam@nabladev.com>
Link: https://patch.msgid.link/20260717010736.578419-2-festevam@gmail.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
|
|
The ES8388 sound card on the rk3399-roc-pc-plus fails to probe because
i2s1 cannot claim its MCLK pin:
pinctrl: pin gpio4-0 already requested by ff880000.i2s; cannot claim for ff890000.i2s
pinctrl: error -EINVAL: pin-128 (ff890000.i2s)
pinctrl: error -EINVAL: could not request pin 128 (gpio4-0) from group i2s-8ch-mclk-pin
on device rockchip-pinctrl
GPIO4_A0 is routed as SCLK_I2S_8CH_OUT and is used by i2s1 as the
external MCLK for the ES8388 codec. The board dts already removes
GPIO4_A0 from the i2s0_8ch_bus pin group, but i2s0 still claims the
same pin through its bclk_off state.
Since the i2s driver requests both states, this blocks i2s1 pinctrl
setup and leaves the simple-audio-card deferred with a parse error.
Override i2s0_8ch_bus_bclk_off as well, matching the existing
i2s0_8ch_bus override, so GPIO4_A0 is left for i2s1/ES8388 audio.
Cc: stable@vger.kernel.org
Fixes: 6d9a7bd6a13c ("arm64: dts: rockchip: add support for Firefly ROC-RK3399-PC-PLUS")
Signed-off-by: Fabio Estevam <festevam@nabladev.com>
Link: https://patch.msgid.link/20260717010736.578419-1-festevam@gmail.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
|
|
The Rockchip RK3568 MIPI CSI-2 receiver binding requires the bus-type
property in its input endpoint.
Specify that the Radxa CAM4K modules connected to CSI2 and CSI4 use a
MIPI CSI-2 D-PHY bus. This fixes the following dtbs_check warning:
endpoint: 'bus-type' is a required property
Signed-off-by: Fabio Estevam <festevam@gmail.com>
Link: https://patch.msgid.link/20260727174007.2581714-1-festevam@gmail.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
|
|
The panel-simple schema only allows data-mapping overrides for panels
whose mapping is not fixed by their compatible. Consequently, the property
on the Ampire AM-1280800N3TZQW-T00H panel fails validation:
(ampire,am-1280800n3tzqw-t00h): False schema does not allow ['vesa-24']
The panel descriptor already selects 8 bits per color and
MEDIA_BUS_FMT_RGB888_1X7X4_SPWG. The DRM OF helpers translate
"vesa-24" to that exact bus format, and panel-simple falls back to the
descriptor's format when the property is absent. Removing the property
therefore has no functional effect.
Drop the redundant property to satisfy the binding.
Signed-off-by: Fabio Estevam <festevam@gmail.com>
Link: https://patch.msgid.link/20260727175502.2585290-1-festevam@gmail.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
|
|
Currently, each ath12k AHB device maintains its own RootPD-related
information. However, RootPD is shared across all UserPD devices, so
RootPD-related operations such as RootPD boot, and notifier registration,
should be performed only once during the first UserPD boot up.
Due to per-device RootPD information, the driver is unable to track
shared RootPD state across multiple UserPDs, which can result in these
operations being performed multiple times.
Fix this by introducing a new ath12k_ahb_rproc_info structure to hold
shared RootPD-related information such as notifier callbacks, boot
state, and number of userPD.
Allocate this structure during the first device probe in
ath12k_ahb_rproc_info_alloc() and reuse the same structure for all
subsequent device probes.
Also handle rproc deconfiguration correctly when multiple UserPDs share a
common RootPD. The RootPD provides shared firmware services and resources
for all UserPDs. Therefore, do not shut down the RootPD while any UserPD
remains powered on or is still in the boot process.
In addition, a UserPD can be powered down before its associated resources
are fully released. Defer g_rproc_info cleanup until all UserPD-related
state and resources have been cleaned up.
For intermediate UserPD removal, cleanup only per-device information
and remove the UserPD from the tracking array while keeping the RootPD
running for remaining active UserPDs.
Note: UserPD IDs start from 1, as ID 0 is used by RootPD, which is
completely handled by the remoteproc driver.
The multi-PD architecture on AHB platforms operates as follows:
+-----------------------------+
| Q6 RootPD (rproc) |
| (Shared Resource) |
| |
| - Manages UserPD lifecycle |
| - Provides SSR notifiers |
+--------------+--------------+
|
| Manages
|
+---------------------+---------------------+
| | |
+----v----+ +----v----+ +----v----+
| UserPD1 | | UserPD2 | | UserPD3 |
| ID=1 | | ID=2 | | ID=3 |
| (Radio) | | (Radio) | | (Radio) |
+---------+ +---------+ +---------+
| | |
| | |
ath12k_ahb ath12k_ahb ath12k_ahb
(device 1) (device 2) (device 3)
| | |
+---------------------+---------------------+
|
| All reference
|
+---------v----------+
| ath12k_ahb_rproc_ |
| info (shared) |
| |
| - tgt_rproc |
| - notifiers |
| - rootpd_ready |
| - num_userpd |
| - userpd[] array |
+--------------------+
Tested-on: IPQ5332 hw1.0 AHB WLAN.WBE.1.6-01275-QCAHKSWPL_SILICONZ-1
Signed-off-by: Aaradhana Sahu <aaradhana.sahu@oss.qualcomm.com>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20260721065038.126046-3-aaradhana.sahu@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
|
|
AHB-based platforms associate each device with a userPD ID that determines
the firmware name and Peripheral Authentication Service ID (PASID) used
during firmware authentication.
Current implementation does not support platforms with multiple devices
sharing the same compatible string but using different userPD IDs.
As a result, the driver cannot uniquely identify each device for firmware
selection and authentication.
Add an AHB platform descriptor to store device-specific configuration.
Implement userPD ID resolution by matching device tree reg properties, with
node name matching as a fallback. Centralize platform configuration to
simplify the probe path by removing hardware-specific conditionals.
Tested-on: IPQ5332 hw1.0 AHB WLAN.WBE.1.6-01275-QCAHKSWPL_SILICONZ-1
Signed-off-by: Aaradhana Sahu <aaradhana.sahu@oss.qualcomm.com>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20260721065038.126046-2-aaradhana.sahu@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
|
|
In ath12k_wifi7_mac_op_tx(), the MLO multicast broadcast path iterates
over all active links and copies the original skb for transmission on
each link. When firmware crash recovery is underway (ATH12K_FLAG_CRASH_FLUSH
set), the per-link copy is allocated and partially processed before
ath12k_wifi7_dp_tx() eventually rejects it with -ESHUTDOWN.
This wastes GFP_ATOMIC memory and produces spurious "failed to transmit
frame" warnings for every active MLO link during the recovery window.
The unicast and non-MLO paths are unaffected: they call ath12k_wifi7_dp_tx()
directly, which already guards against the flag at its entry.
Skip any link whose associated ath12k_base has ATH12K_FLAG_CRASH_FLUSH set
before performing the skb_copy(), matching the behaviour of
ath12k_wifi7_dp_tx() but avoiding the unnecessary allocation entirely.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.6-01243-QCAHKSWPL_SILICONZ-1
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
Signed-off-by: Pavankumar Nandeshwar <pavankumar.nandeshwar@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Link: https://patch.msgid.link/20260723054653.2794550-1-pavankumar.nandeshwar@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
|
|
Currently, the RX release ring size is hardcoded to 1024 entries via
DP_RX_RELEASE_RING_SIZE. This value was sufficient for older generations,
but is not adequate for Wi-Fi 7 scenarios with higher aggregation,
parallel processing, and increased likelihood of error bursts.
In Wi-Fi 7, a PPDU can carry up to 1024 MPDUs and each MPDU may contain
multiple MSDUs. In error scenarios such as REO out-of-order (OOR) events,
a large number of MSDUs can be pushed to the RX release ring in a short
duration. With multiple PPDUs being processed in parallel (e.g. multi-core
or MLO scenarios), this can lead to significant bursts of descriptors.
Field observations have shown frequent OOR conditions and back-pressure
issues with smaller ring sizes. Increasing the RX release ring size helps
absorb these bursts and avoids back-pressure in the RXDMA/REO pipeline.
Without sufficient ring capacity (e.g. 16K), back-pressure was observed
under stress conditions.
To address this, make the RX release ring size configurable per memory
profile by adding rx_release_ring_size to ath12k_dp_profile_params:
- Default memory profile: 16384 entries
- Low memory profile (512M): 8192 entries
The larger size in the default profile improves robustness under high
traffic and error conditions by reducing the probability of ring overflow
and pipeline stalls. The reduced size in the low memory profile balances
memory usage while still providing sufficient headroom compared to the
previous fixed value.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
Signed-off-by: Pavankumar Nandeshwar <pavankumar.nandeshwar@oss.qualcomm.com>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20260721110459.2203038-1-pavankumar.nandeshwar@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
|
|
The enumerator names ATH12K_FIRMWARE_MODE_* lack the QMI infix that all
other constants in qmi.h use (ATH12K_QMI_FILE_TYPE_*,
ATH12K_QMI_BDF_TYPE_*, ATH12K_QMI_MEMORY_MODE_*, etc.). Rename them to
ATH12K_QMI_FIRMWARE_MODE_* for consistency and to prevent a future
re-introduction of ATH12K_FIRMWARE_MODE_* names causing a silent collision.
While here, add a comment noting that values 2-3 are reserved by the
firmware QMI ABI to explain the gap before ATH12K_QMI_FIRMWARE_MODE_OFF = 4.
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c7-00108-QCAHMTSWPL_V1.0_V2.0_SILICONZ_UPSTREAM-3
Assisted-by: Claude:claude-sonnet-4-6
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20260725-consolidate-firmware_mode-v1-2-aedff0ce0ba5@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
|
|
The enum ath12k_firmware_mode defines values that are part of the QMI
ABI, so it belongs in qmi.h rather than core.h. Consolidate it there
along with ATH12K_FIRMWARE_MODE_OFF, which is currently a bare macro.
Rename the enum to ath12k_qmi_firmware_mode to align with the naming
convention of the other enums in qmi.h, and place it with the other
ath12k_qmi_* enums.
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c7-00108-QCAHMTSWPL_V1.0_V2.0_SILICONZ_UPSTREAM-3
Assisted-by: Claude:claude-sonnet-4-6
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20260725-consolidate-firmware_mode-v1-1-aedff0ce0ba5@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
|
|
The outer skb->len guard only confirms the SKB is large enough
to hold the full fixed_param struct, but the TLV's own WMI_TLV_LEN
field is never checked. Firmware advertising a TLV length shorter
than sizeof(*fixed_param) causes reads of pdev_id and event_count
beyond the declared TLV payload.
Add a check that the TLV length is at least sizeof(*fixed_param)
before casting and dereferencing the pointer.
Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
Assisted-by: Claude:claude-sonnet-4-6
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Link: https://patch.msgid.link/20260726-ath12k_wmi_process_tpc_stats-len-check-v1-1-c4ba2f84d9c6@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
|
|
There is no policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT, so
the parse infrastructure does not enforce a minimum length for the event
struct. Additionally, the num_vdevs field is taken directly from firmware
and used as a loop bound over the vdev_ids array without checking that it
fits within the TLV payload. Either condition can cause an out-of-bounds
read.
Add a TLV policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT so
the parse infrastructure enforces a minimum length for the fixed-size event
struct. Add a helper ath11k_wmi_tlv_data_len() to recover the payload
length of a parsed TLV from the header preceding its data pointer. Use it
in ath11k_wmi_process_csa_switch_count_event() to bound num_vdevs before
the loop.
Compile tested only.
Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
Assisted-by: Claude:claude-sonnet-4-6
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20260724-ath12k_wmi_process_csa_switch_count_event-cleanup-v2-2-02a45d7246c0@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
|
|
There is no policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT, so
the parse infrastructure does not enforce a minimum length for the event
struct. Additionally, the num_vdevs field is taken directly from firmware
and used as a loop bound over the vdev_ids array without checking that it
fits within the TLV payload. Either condition can cause an out-of-bounds
read.
Add a TLV policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT so
the parse infrastructure enforces a minimum length for the fixed-size event
struct. Add a helper ath12k_wmi_tlv_data_len() to recover the payload
length of a parsed TLV from the header preceding its data pointer. Use it
in ath12k_wmi_process_csa_switch_count_event() to bound num_vdevs before
the loop.
Compile tested only.
Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
Assisted-by: Claude:claude-sonnet-4-6
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20260724-ath12k_wmi_process_csa_switch_count_event-cleanup-v2-1-02a45d7246c0@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
|
|
The mismatch would pop up when building the kernel with W=1.
Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Reviewed-by: Liviu Dudau <liviu.dudau@arm.com>
Signed-off-by: Adrián Larumbe <adrian.larumbe@collabora.com>
Link: https://patch.msgid.link/20260720-vm_bind_checks-v6-2-c2c7dbe93a73@collabora.com
Signed-off-by: Steven Price <steven.price@arm.com>
|
|
When a VM is created, caller has to specify the range of the address space
carve-out set aside for mapping kernel BO's. That means vm_bind mappings of
UM-exposed BO's should not intersect with that region, but at the moment
we're not checking this.
At first, I thought of giving these values to drm_gpuvm_init() through its
reserve_{offset, range} arguments, but it turns out that is meant for VM
address spans that are not managed through the usual drm_gpuvm split/merge
circuit, so storing the end of the user VA range at VM creation time and
doing a quick check in the vm_bind ioctl path was the simplest workaround.
The new check also makes sure vm_bind range doesn't overflow the size of a
64-bit unsigned integer. That was already being done further down the call
stack inside drm_gpuvm_sm_map -> drm_gpuvm_range_valid, but it's best to
fail early in the driver before GPUVM functions are invoked so that we
won't waste time allocating vm_bind context resources.
Fixes: 12cf826bf1dd ("drm/panthor: Support sparse mappings")
Fixes: 647810ec2476 ("drm/panthor: Add the MMU/VM logical block")
Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
Signed-off-by: Adrián Larumbe <adrian.larumbe@collabora.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Link: https://patch.msgid.link/20260720-vm_bind_checks-v6-1-c2c7dbe93a73@collabora.com
Signed-off-by: Steven Price <steven.price@arm.com>
|
|
The controller is allocated with the non-managed spi_alloc_host() while
the interrupt is registered with devm_request_threaded_irq(). During
removal, spi_bitbang_stop() only unregisters the controller; the
subsequent spi_controller_put() then frees the controller together with
its embedded davinci_spi devdata, which is the IRQ handler's dev_id.
The devm_request_threaded_irq() release action (free_irq()), which
drains the handler, does not run until after .remove() returns. A late
or latched interrupt can therefore reach davinci_spi_irq() and
dereference already-freed memory.
Switch to devm_spi_alloc_host() so that the devres LIFO order releases
the controller only after free_irq() has drained the handler, and drop
the now-redundant spi_controller_put() from .remove(). The probe error
path is simplified to direct returns.
The clock is acquired with devm_clk_get_enabled(), which is registered
after the IRQ and thus released before it by the devres LIFO order.
Drain the interrupt explicitly with devm_free_irq() before disabling the
controller so that a late interrupt cannot access the registers of a
clock-gated controller.
This issue was found by an in-house static analysis tool.
Fixes: 5b3bb5963ff2 ("spi: davinci: Use devm_*() functions")
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Link: https://patch.msgid.link/20260719010014.3163356-2-fanwu01@zju.edu.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
The R-Car Gen4 PCIe controller can optionally use GIC ITS as an
MSI controller. This configuration is described in DT by setting
msi-parent DT property in the PCIe controller node. Document this
configuration.
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Acked-by: Rob Herring (Arm) <robh@kernel.org>
Link: https://patch.msgid.link/20260720015505.314957-1-marek.vasut+renesas@mailbox.org
|
|
iface_fw_to_cpu_addr() only checks that the firmware-provided MCU virtual
address points inside the shared section. The returned pointer is later
used as a full firmware interface structure, so accepting an address near
the end of the shared section can still lead to out-of-bounds accesses.
Pass the expected object size to iface_fw_to_cpu_addr() and reject ranges
that do not fit entirely in the shared section.
Fixes: 2718d91816ee ("drm/panthor: Add the FW logical block")
Cc: stable@vger.kernel.org
Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Signed-off-by: Steven Price <steven.price@arm.com>
Link: https://patch.msgid.link/20260720114918.15973-1-osama.abdelkader@gmail.com
|
|
nvmet_param_mdts_store() accepts any integer that kstrtoint() can parse
and stores it directly into port->mdts. The value is only range-checked
later, when the port is enabled: nvmet_enable_port() silently resets
port->mdts to 0 if it is negative or greater than NVMET_MAX_MDTS.
As a result, writing e.g. "mdts=1000" succeeds and reading the attribute
back returns 1000, yet enabling the port quietly turns it into 0. This
is confusing and hides the invalid input from the user.
Validate the value against [0, NVMET_MAX_MDTS] in the store handler and
reject anything out of range with -EINVAL, so the error is reported at
write time and port->mdts never holds a value the port cannot use.
Fixes: 0a5a94648627 ("nvmet: introduce new mdts configuration entry")
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
|
|
quirks_param_set() reuses 'err', which param_set_copystring() left as 0,
as the return value of the whole function. When nvme_parse_quirk_entry()
fails to parse a field, the code jumps to out_free_qlist and returns that
stale 0, so a malformed quirks= parameter is silently accepted as valid.
Set err to -EINVAL before jumping out on a parse failure.
Fixes: 7bb8c40f5ad8 ("nvme: add support for dynamic quirk configuration via module parameter")
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Daniel Wagner <dwagner@suse.de>
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
|
|
__nvme_fc_init_request() maps cmd_iu and then rsp_iu for DMA. If the
rsp_iu mapping fails, the original code only recorded the error and fell
through: it left the already-mapped cmd_iu unmapped and still marked the
op as FCPOP_STATE_IDLE before returning. Since blk-mq does not call
.exit_request() when .init_request() fails, the cmd_iu mapping is leaked
for every op whose rsp_iu mapping fails.
Jump to an error path on rsp_iu mapping failure that unmaps cmd_iu and
returns the error without marking the op idle, so it stays in the
FCPOP_STATE_UNINIT state set by the initial memset().
Fixes: e399441de911 ("nvme-fabrics: Add host support for FC transport")
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
|
|
nvmet_execute_get_log_page_rmi() leaves 'status' holding NVME_SC_SUCCESS
(set by the successful nvmet_req_find_ns() call) when the kzalloc() for
the log buffer fails. It then jumps to the out label and completes the
request with a success status, so the host is told the command succeeded
while no data was transferred.
Initialize 'status' to NVME_SC_INTERNAL, matching the smart log handler,
so an allocation failure is reported as an internal error.
Fixes: 5fd075cdaf36 ("nvmet: implement rotational media information log")
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
|
|
Samsung SoC drivers for v7.3
1. Fix very old leak of OF node in PMU driver.
2. Few cleanups and new bindings for ExynosAutov920 HSI0 syscon.
* tag 'samsung-drivers-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux:
dt-bindings: samsung: exynos-pmu: Narrow allowed reboot modes
dt-bindings: samsung: exynos-pmu: Restrict children with unevaluatedProperties
dt-bindings: soc: samsung: exynos-sysreg: Add hsi0 for ExynosAutov920
soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap()
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
|
|
Memory controller drivers for v7.3
1. Few improvements: STM32 OMM, Tegra MC and JZ4780-nemc.
2. Refactor Tegra MC interconnect code to better represent actual
hardware in multi-socket NUMA cases.
* tag 'memory-controller-drv-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl:
memory: jz4780-nemc: Use dev_err_probe() for clock error
memory: tegra: Guard against NULL mc_regs in IRQ handler
memory: tegra: add multi-socket support to the memory interconnect
memory: stm32_omm: initialize ret in stm32_omm_set_amcr
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
|
|
dt: add DMA-350 support for Sky1
* tag 'cix-dt-v7.3-rc1' of https://github.com/cixtech/linux-mainline:
arm64: dts: cix: add sky1 DMA-350 node with channel IRQ entries
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
|
|
panthor_fw_read_build_info() checks whether the metadata range fits in the
firmware image with hdr.meta_start + hdr.meta_size. Both fields are u32, so
the addition can wrap and let an out-of-bounds range pass validation.
The function also reads the "git_sha: " prefix without first checking that
the metadata is long enough, and meta_size == 0 can underflow the NULL
terminator index.
Use subtraction-based bounds checking and reject metadata that is too short
to contain the expected prefix and trailing NULL byte.
Fixes: 2718d91816ee ("drm/panthor: Add the FW logical block")
Cc: stable@vger.kernel.org
Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Signed-off-by: Steven Price <steven.price@arm.com>
Link: https://patch.msgid.link/20260720113212.11981-1-osama.abdelkader@gmail.com
|
|
Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> says:
I will post Card capsuling patch.
To makes its review easy, tidyup its drivers to reduce
un-related diff as preparation.
No functional change, but is preparation for cleanup driver.
Link: https://patch.msgid.link/87ldb5i0do.wl-kuninori.morimoto.gx@renesas.com
|
|
ams_delta_probe() will be updated when Card capsuling.
To makes its review easy, use &pdev->dev instead of card->dev.
These are same
card->dev = &pdev->dev;
No functional change, but is preparation for Card capsuling.
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Link: https://patch.msgid.link/87h5lti0cu.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
struct snd_soc_card will be capsuled soon, its member will not be
able to access from non soc-card.c.
To reduce the difference during conversion, replace dev.
- card->dev, ...
+ dev, ...
No functional change, but is preparation for Card capsuling.
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Acked-by: Jarkko Nikula <jarkko.nikula@bitmer.com>
Tested-by: Jarkko Nikula <jarkko.nikula@bitmer.com>
Link: https://patch.msgid.link/87ik69i0d0.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
No one is using ad->card. Remove it.
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Link: https://patch.msgid.link/87jyqpi0d9.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
Add device tree for the Anbernic RG Vita-Pro, based on the Rockchip
RK3576. All hardware is currently working except for the accelerometer,
the touchscreen, the battery monitor, and DisplayPort over USB-C. PWM
is also missing currently, and as a result the LEDs and panel backlight
are currently controlled via GPIO but will be changed to PWM once
supported.
The Anbernic RG Vita-Pro includes the following hardware:
- A 1080x1920 DSI display with touch.
- 21 buttons.
- 3 LEDs.
- 64GB eMMC, 2 SDMMC slots.
- RTL8852BE WiFi (with Bluetooth via UART)
- 1 USB 3.0 USB-C port in OTG mode.
- 3.5mm headphone jack with play button support.
- 5000mAH battery
The following hardware has incomplete driver support and is not yet
working:
- An Invensense icm42607p accelerometer.
- A Cellwise cw221x battery monitor.
- A Synaptics i2c touchscreen.
- DisplayPort over USB-C alt-mode.
- PWM controller.
- 2 Analog joysticks with LED controllers.
Signed-off-by: Chris Morgan <macromorgan@hotmail.com>
Link: https://patch.msgid.link/20260728203832.166402-5-macroalpha82@gmail.com
[dropped unused pmic pinconfig definitions, sorted nodes]
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
|
|
Instead of defining the wait values for each driver, use common values
defined in the core pci.h header file. Note that while most drivers use
the usleep_range(), it looks like these were mostly cargo culted and
msleep() is a better choice given the fixed delay that the specification
calls for. Convert all drivers to msleep() and use the existing
definition.
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Reviewed-by: Aksh Garg <a-garg7@ti.com>
Link: https://patch.msgid.link/20260716-tegra264-pcie-v8-3-23e51589229b@nvidia.com
|
|
Add compatible string for the Anbernic RG Vita-Pro.
Signed-off-by: Chris Morgan <macromorgan@hotmail.com>
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Link: https://patch.msgid.link/20260728203832.166402-4-macroalpha82@gmail.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
|
|
bui duc phuc <phucduc.bui@gmail.com> says:
This series improves probe error handling in the sunxi ASoC drivers.
It replaces suitable probe error paths with dev_err_probe() to
simplify the code and handle deferred probe errors consistently.
It also removes redundant error messages where the called helpers
already report failures, avoiding duplicate log messages.
Build tested only.
Link: https://patch.msgid.link/20260715095525.40668-1-phucduc.bui@gmail.com
|
|
Drop the redundant error message after devm_platform_ioremap_resource(),
which already reports failures, and use dev_err_probe() for regmap
initialization errors.
Signed-off-by: bui duc phuc <phucduc.bui@gmail.com>
Reviewed-by: Chen-Yu Tsai <wens@kernel.org>
Link: https://patch.msgid.link/20260715095525.40668-7-phucduc.bui@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
Drop the redundant error message after devm_platform_ioremap_resource(),
which already reports failures, and use dev_err_probe() for regmap
initialization errors.
Signed-off-by: bui duc phuc <phucduc.bui@gmail.com>
Reviewed-by: Chen-Yu Tsai <wens@kernel.org>
Link: https://patch.msgid.link/20260715095525.40668-6-phucduc.bui@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
Use dev_err_probe() for probe error handling to simplify the error paths
and handle -EPROBE_DEFER correctly.
Signed-off-by: bui duc phuc <phucduc.bui@gmail.com>
Reviewed-by: Chen-Yu Tsai <wens@kernel.org>
Link: https://patch.msgid.link/20260715095525.40668-5-phucduc.bui@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
Use dev_err_probe() for probe error handling to simplify the error paths
and handle -EPROBE_DEFER correctly.
Signed-off-by: bui duc phuc <phucduc.bui@gmail.com>
Reviewed-by: Chen-Yu Tsai <wens@kernel.org>
Link: https://patch.msgid.link/20260715095525.40668-4-phucduc.bui@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
The called functions already log failures where appropriate. Return the
original error directly and avoid duplicate error messages.
Signed-off-by: bui duc phuc <phucduc.bui@gmail.com>
Link: https://patch.msgid.link/20260715095525.40668-3-phucduc.bui@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
Ali Tariq
Pufan Jin
Hongyan Xu
Bingyu.Xian
Jon Hunter
Fabio Estevam
Fabio Estevam
Aaradhana Sahu
Pavankumar Nandeshwar
Jeff Johnson
Adrián Larumbe
Fan Wu
Marek Vasut
Osama Abdelkader
Guixin Liu
Arnd Bergmann
Mark Brown
Kuninori Morimoto
Chris Morgan
Thierry Reding
bui duc phuc