summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-03-23wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_tx_check_aggr()Ming Yen Hsieh
Move the NULL check for 'sta' before dereferencing it to prevent a possible crash. Fixes: 44eb173bdd4f ("wifi: mt76: mt7925: add link handling in mt7925_txwi_free") Signed-off-by: Ming Yen Hsieh <mingyen.hsieh@mediatek.com> Link: https://patch.msgid.link/20250904030649.655436-4-mingyen.hsieh@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: fix list corruption in mt76_wcid_cleanupZac Bowling
mt76_wcid_cleanup() was not removing wcid entries from sta_poll_list before mt76_reset_device() reinitializes the master list. This leaves stale pointers in wcid->poll_list, causing list corruption when mt76_wcid_add_poll() later checks list_empty() and tries to add the entry back. The fix adds proper cleanup of poll_list in mt76_wcid_cleanup(), matching how tx_list is already handled. This is similar to what mt7996_mac_sta_deinit_link() already does correctly. Fixes list corruption warnings like: list_add corruption. prev->next should be next (ffffffff...) Signed-off-by: Zac Bowling <zac@zacbowling.com> Link: https://patch.msgid.link/20260120201043.38225-3-zac@zacbowling.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7925: fix incorrect length field in txpower commandMing Yen Hsieh
Set `tx_power_tlv->len` to `msg_len` instead of `sizeof(*tx_power_tlv)` to ensure the correct message length is sent to firmware. Cc: stable@vger.kernel.org Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips") Signed-off-by: Ming Yen Hsieh <mingyen.hsieh@mediatek.com> Link: https://patch.msgid.link/20250908072526.1833938-1-mingyen.hsieh@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7996: add support for ERP CTS & HT protectionRyder Lee
This patch adds support for handling BSS_CHANGED_ERP_CTS_PROT and BSS_CHANGED_HT. With this change, when the Wi-Fi driver needs to adjust its behavior for compatibility or performance, especially concerning older 11g/n devices, by enabling or disabling CTS protection frames, often for hidden SSIDs or to manage legacy clients. It also introduces debugfs options to manually control protection mode, allowing users to select betweenno protection, RTS/CTS, and CTS-to-self. Reviewed-by: Money Wang <money.wang@mediatek.com> Signed-off-by: Ryder Lee <ryder.lee@mediatek.com> Link: https://patch.msgid.link/942ddb5777d5c201930d6609e9ba877a6ba6714a.1768879119.git.ryder.lee@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7915: fix use_cts_prot supportRyder Lee
With this fix, when driver needs to adjust its behavior for compatibility, especially concerning older 11g/n devices, by enabling or disabling CTS protection frames, often for hidden SSIDs or to manage legacy clients. Fixes: 150b91419d3d ("wifi: mt76: mt7915: enable use_cts_prot support") Signed-off-by: Ryder Lee <ryder.lee@mediatek.com> Link: https://patch.msgid.link/eb8db4d0bf1c89b7486e89facb788ae3e510dd8b.1768879119.git.ryder.lee@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7615: fix use_cts_prot supportRyder Lee
Driver should not directly write WTBL to prevent overwritten issues. With this fix, when driver needs to adjust its behavior for compatibility, especially concerning older 11g/n devices, by enabling or disabling CTS protection frames, often for hidden SSIDs or to manage legacy clients. Fixes: e34235ccc5e3 ("wifi: mt76: mt7615: enable use_cts_prot support") Signed-off-by: Ryder Lee <ryder.lee@mediatek.com> Link: https://patch.msgid.link/edb87088b0111b32fafc6c4179f54a5286dd37d8.1768879119.git.ryder.lee@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt7601u: check multiple firmware pathsChristian Hewitt
The linux-firmware repo moved mt7601u.bin from its root folder to the mediatek sub-folder some time ago, but the driver still tries to load firmware from the old location. Users might have firmware in either location so update the driver to check both. Signed-off-by: Christian Hewitt <christianshewitt@gmail.com> Link: https://patch.msgid.link/20251227112219.2768439-1-christianshewitt@gmail.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt792x: Fix a potential deadlock in high-load situationsLeon Yen
A deadlock may occur between two works, ps_work and mac_work, if their work functions run simultaneously as they attempt to cancel each other by calling cancel_delayed_work_sync(). mt792x_mac_work() -> ... -> cancel_delayed_work_sync(&pm->ps_work); mt792x_pm_power_save_work() -> cancel_delayed_work_sync(&mphy->mac_work); In high-load situations, they are queued but may not have chance to be executed until the CPUs are released. Once the CPUs are available, there is a high possibility that the ps_work function and mac_work function will be executed simultaneously, resulting in a possible deadlock. This patch replaces cancel_delayed_work_sync() with cancel_delayed_work() in ps_work to eliminate the deadlock and make the code easier to maintain. Signed-off-by: Leon Yen <leon.yen@mediatek.com> Tested-by: Chia-Lin Kao (AceLan) <acelan.kao@canonical.com> Link: https://patch.msgid.link/20251215122231.3180648-1-leon.yen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7925: Fix incorrect MLO mode in firmware controlLeon Yen
The selection of MLO mode should depend on the capabilities of the STA rather than those of the peer AP to avoid compatibility issues with certain APs, such as Xiaomi BE5000 WiFi7 router. Fixes: 69acd6d910b0c ("wifi: mt76: mt7925: add mt7925_change_vif_links") Signed-off-by: Leon Yen <leon.yen@mediatek.com> Link: https://patch.msgid.link/20251211123836.4169436-1-leon.yen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7921: Reset ampdu_state state in case of failure in ↵Sean Wang
mt76_connac2_tx_check_aggr() Reset ampdu_state if ieee80211_start_tx_ba_session() fails in mt76_connac2_tx_check_aggr(), otherwise the driver may incorrectly assume aggregation is active and skip future BA setup attempts. Fixes: 163f4d22c118 ("mt76: mt7921: add MAC support") Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20251216005930.9412-1-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7996: Reset ampdu_state state in case of failure in ↵Lorenzo Bianconi
mt7996_tx_check_aggr() Reset the ampdu_state configured state if ieee80211_start_tx_ba_session routine fails in mt7996_tx_check_aggr() Fixes: 98686cd21624c ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20251214-mt7996-aggr-check-fix-v1-1-33a8b62ec0fc@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7996: Clear wcid pointer in mt7996_mac_sta_deinit_link()Lorenzo Bianconi
Clear WCID pointer removing the sta link in mt7996_mac_sta_deinit_link routine. Fixes: dd82a9e02c054 ("wifi: mt76: mt7996: Rely on mt7996_sta_link in sta_add/sta_remove callbacks") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20251205-mt76-txq-wicd-fix-v2-4-f19ba48af7c1@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7996: Switch to the secondary link if the default one is removedLorenzo Bianconi
Switch to the secondary link if available in mt7996_mac_sta_remove_links routine if the primary one is removed. Moreover reset secondary link index for single link scenario. Fixes: 85cd5534a3f2e ("wifi: mt76: mt7996: use correct link_id when filling TXD and TXP") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20251205-mt76-txq-wicd-fix-v2-3-f19ba48af7c1@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7996: Reset mtxq->idx if primary link is removed in ↵Lorenzo Bianconi
mt7996_vif_link_remove() Reset WCID index in mt76_txq struct if primary link is removed in mt7996_vif_link_remove routine. Fixes: a3316d2fc669f ("wifi: mt76: mt7996: set vif default link_id adding/removing vif links") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20251205-mt76-txq-wicd-fix-v2-2-f19ba48af7c1@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7996: Set mtxq->wcid just for primary linkLorenzo Bianconi
Set WCID index in mt76_txq struct just for the primary link in mt7996_vif_link_add routine. Fixes: 69d54ce7491d0 ("wifi: mt76: mt7996: switch to single multi-radio wiphy") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20251205-mt76-txq-wicd-fix-v2-1-f19ba48af7c1@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7996: Fix spelling mistake "retriving" -> "retrieving"Colin Ian King
There are a handful of spelling mistakes in various warning messages. Fix them. Signed-off-by: Colin Ian King <colin.i.king@gmail.com> Link: https://patch.msgid.link/20251128174430.318838-1-colin.i.king@gmail.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7925: introduce CSA support in non-MLO modeLeon Yen
Add CSA (Channel Switch Announcement) related implementation in collaboration with mac80211 to deal with dynamic channel switching. Signed-off-by: Leon Yen <leon.yen@mediatek.com> Signed-off-by: Ming Yen Hsieh <mingyen.hsieh@mediatek.com> Link: https://patch.msgid.link/20250926053447.4036650-1-mingyen.hsieh@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt76x02: wake queues after reconfigDavid Bauer
The shared reset procedure of MT7610 and MT7612 stop all queues before starting the reset sequence. They however never restart these like other supported mt76 chips do in the reconfig_complete call. This leads to TX not continuing after the reset. Restart queues in the reconfig_complete callback to restore functionality after the reset. Signed-off-by: David Bauer <mail@david-bauer.net> Link: https://patch.msgid.link/20251129023904.288484-1-mail@david-bauer.net Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggrQuan Zhou
Previously, the AMPDU state bit for a given TID was set before attempting to start a BA session, which could result in the AMPDU state being marked active even if ieee80211_start_tx_ba_session() failed. This patch changes the logic to only set the AMPDU state bit after successfully starting a BA session, ensuring proper synchronization between AMPDU state and BA session status. This fixes potential issues with aggregation state tracking and improves compatibility with mac80211 BA session management. Fixes: 44eb173bdd4f ("wifi: mt76: mt7925: add link handling in mt7925_txwi_free") Cc: stable@vger.kernel.org Signed-off-by: Quan Zhou <quan.zhou@mediatek.com> Reviewed-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/d5960fbced0beaf33c30203f7f8fb91d0899c87b.1764228973.git.quan.zhou@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7996: fix iface combination for different chipsetsShayne Chen
MT7992 and MT7990 support up to 19 interfaces per band and 32 in total. Fixes: 8df63a4bbe3d ("wifi: mt76: mt7996: adjust interface num and wtbl size for mt7992") Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Link: https://patch.msgid.link/20251215063728.3013365-7-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7996: add duplicated WTBL commandShayne Chen
This is a firmware mechanism to improve packet loss issues for mt7996 and mt7992 chipsets. Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Link: https://patch.msgid.link/20251215063728.3013365-6-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7996: offload radar threshold initializationStanleyYP Wang
Since some radar specifications maintained by the driver are incorrect and are now also maintained by the firmware, offload the initialization procedure to the firmware. This fixes issues for radar detection rate testings. Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com> Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Link: https://patch.msgid.link/20251215063728.3013365-5-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7996: abort CCA when CSA is startingStanleyYP Wang
When CSA countdown is going to start, carry UNI_BSS_INFO_BCN_BCC tag to abort any CCA countdown. Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com> Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Link: https://patch.msgid.link/20251215063728.3013365-4-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7996: set specific BSSINFO and STAREC commands after channel ↵StanleyYP Wang
switch After channel switch, some tags of BSSINFO (rfch) and STAREC (bfer, rate_ctrl) commands should also be updated. Otherwise, a BSS might not be able to transmit with its peer using correct bandwidth. Co-developed-by: Shayne Chen <shayne.chen@mediatek.com> Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com> Link: https://patch.msgid.link/20251215063728.3013365-3-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7996: fix the behavior of radar detectionStanleyYP Wang
RDD_DET_MODE is a firmware command intended for testing and does not pause TX after radar detection, so remove it from the normal flow; instead, use the MAC_ENABLE_CTRL firmware command to resume TX after the radar-triggered channel switch completes. Fixes: 1529e335f93d ("wifi: mt76: mt7996: rework radar HWRDD idx") Co-developed-by: Shayne Chen <shayne.chen@mediatek.com> Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com> Link: https://patch.msgid.link/20251215063728.3013365-2-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7996: extend CSA and CCA support for MLOShayne Chen
Use correct link_id to report CSA and CCA countdown events, and also modify mt7996_channel_switch_beacon() to set beacon with the correct link_id. Co-developed-by: Peter Chiu <chui-hao.chiu@mediatek.com> Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com> Co-developed-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com> Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com> Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Link: https://patch.msgid.link/20251215063728.3013365-1-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23fanotify: replace deprecated strcpy in fanotify_info_copy_{name,name2}Thorsten Blum
strcpy() has been deprecated [1] because it performs no bounds checking on the destination buffer, which can lead to buffer overflows. Replace it with the safer strscpy(). Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strcpy [1] Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Link: https://patch.msgid.link/20260321210544.519259-4-thorsten.blum@linux.dev Signed-off-by: Jan Kara <jack@suse.cz>
2026-03-23pinctrl: realtek: add rtd1625 pinctrl driverTzuyi Chang
Add support for Realtek RTD1625 SoC using the realtek common pinctrl driver. This patch introduces the RTK_PIN_CONFIG_V2 and RTK_PIN_CONFIG_I2C macros, which are required to describe the specific register layout and electrical features (such as slew rate and high VIL) of the RTD1625 pins. Signed-off-by: Tzuyi Chang <tychang@realtek.com> Signed-off-by: Yu-Chun Lin <eleanor.lin@realtek.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-03-23pinctrl: realtek: add support for slew rate, input voltage and high VILTzuyi Chang
Add support for configuring slew rate, input voltage level and high VIL mode. This involves updating the pin configuration parsing logic to handle PIN_CONFIG_SLEW_RATE, PIN_CONFIG_INPUT_VOLTAGE_UV and the new custom property "realtek,high-vil-microvolt". Reviewed-by: Linus Walleij <linusw@kernel.org> Signed-off-by: Tzuyi Chang <tychang@realtek.com> Co-developed-by: Yu-Chun Lin <eleanor.lin@realtek.com> Signed-off-by: Yu-Chun Lin <eleanor.lin@realtek.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-03-23dt-bindings: pinctrl: realtek: Add RTD1625 pinctrl bindingTzuyi Chang
Add device tree bindings for RTD1625. Reviewed-by: Conor Dooley <conor.dooley@microchip.com> Reviewed-by: Linus Walleij <linusw@kernel.org> Signed-off-by: Tzuyi Chang <tychang@realtek.com> Co-developed-by: Yu-Chun Lin <eleanor.lin@realtek.com> Signed-off-by: Yu-Chun Lin <eleanor.lin@realtek.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-03-23dt-bindings: pinctrl: realtek: Improve 'realtek,duty-cycle' descriptionYu-Chun Lin
The previous description was misleading because this hardware block is not a PWM generator. It does not generate a signal with a specific frequency and duty ratio. Instead, it provides a fixed nanosecond-level adjustment to the rising/ falling edges of an existing signal. The property name is kept as 'realtek,duty-cycle' rather than being renamed to strictly preserve Device Tree ABI backward compatibility. Acked-by: Conor Dooley <conor.dooley@microchip.com> Reviewed-by: Linus Walleij <linusw@kernel.org> Signed-off-by: Yu-Chun Lin <eleanor.lin@realtek.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-03-23pinctrl: pinconf-generic: Add properties 'input-threshold-voltage-microvolt'Tzuyi Chang
Add a new generic pin configuration parameter PIN_CONFIG_INPUT_VOLTAGE_UV. This parameter is used to specify the input voltage level of a pin in microvolts, which corresponds to the 'input-voltage-microvolt' property in Device Tree. Reviewed-by: Linus Walleij <linusw@kernel.org> Signed-off-by: Tzuyi Chang <tychang@realtek.com> Co-developed-by: Yu-Chun Lin <eleanor.lin@realtek.com> Signed-off-by: Yu-Chun Lin <eleanor.lin@realtek.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-03-23dt-bindings: pincfg-node: Add input-threshold-voltage-microvolt propertyTzuyi Chang
Add a generic pin configuration property "input-threshold-voltage-microvolt" to support hardware designs where the input logic threshold is decoupled from the power supply voltage. This property allows the pinctrl driver to configure the correct internal reference voltage for pins that need to accept input signals at a different voltage level than their power supply. For example, a pin powered by 3.3V may need to accept 1.8V logic signals. This defines the reference for VIH (Input High Voltage) and VIL (Input Low Voltage) thresholds, enabling proper signal detection across different voltage domains. Signed-off-by: Tzuyi Chang <tychang@realtek.com> Co-developed-by: Yu-Chun Lin <eleanor.lin@realtek.com> Signed-off-by: Yu-Chun Lin <eleanor.lin@realtek.com> Acked-by: Conor Dooley <conor.dooley@microchip.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-03-23pinctrl: realtek: Fix function signature for config argumentYu-Chun Lin
The argument originates from pinconf_to_config_argument(), which returns a u32. Therefore, the arg parameter should be an unsigned int instead of enum pin_config_param. Fixes: e99ce78030db ("pinctrl: realtek: Add common pinctrl driver for Realtek DHC RTD SoCs") Signed-off-by: Yu-Chun Lin <eleanor.lin@realtek.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-03-23Merge 7.0-rc5 into tty-nextGreg Kroah-Hartman
We need the tty/serial fixes in here as well. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-23gpio: shared: handle pins shared by child nodes of devicesBartosz Golaszewski
Shared GPIOs may be assigned to child nodes of device nodes which don't themselves bind to any struct device. We need to pass the firmware node that is the actual consumer to gpiolib-shared and compare against it instead of unconditionally using the fwnode of the consumer device. Fixes: a060b8c511ab ("gpiolib: implement low-level, shared GPIO support") Reported-by: Jon Hunter <jonathanh@nvidia.com> Closes: https://lore.kernel.org/all/921ba8ce-b18e-4a99-966d-c763d22081e2@nvidia.com/ Tested-by: Jon Hunter <jonathanh@nvidia.com> Acked-by: Jon Hunter <jonathanh@nvidia.com> Link: https://patch.msgid.link/20260318-gpio-shared-xlate-v2-2-0ce34c707e81@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-03-23gpio: shared: call gpio_chip::of_xlate() if setBartosz Golaszewski
OF-based GPIO controller drivers may provide a translation function that calculates the real chip offset from whatever devicetree sources provide. We need to take this into account in the shared GPIO management and call of_xlate() if it's provided and adjust the entry->offset we initially set when scanning the tree. To that end: modify the shared GPIO API to take the GPIO chip as argument on setup (to avoid having to rcu_dereference() it from the GPIO device) and protect the access to entry->offset with the existing lock. Fixes: a060b8c511ab ("gpiolib: implement low-level, shared GPIO support") Reported-by: Jon Hunter <jonathanh@nvidia.com> Closes: https://lore.kernel.org/all/921ba8ce-b18e-4a99-966d-c763d22081e2@nvidia.com/ Reviewed-by: Linus Walleij <linusw@kernel.org> Tested-by: Jon Hunter <jonathanh@nvidia.com> Acked-by: Jon Hunter <jonathanh@nvidia.com> Link: https://patch.msgid.link/20260318-gpio-shared-xlate-v2-1-0ce34c707e81@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-03-23drm/xe/pf: Fix use-after-free in migration restoreMichał Winiarski
When an error is returned from xe_sriov_pf_migration_restore_produce(), the data pointer is not set to NULL, which can trigger use-after-free in subsequent .write() calls. Set the pointer to NULL upon error to fix the problem. Fixes: 1ed30397c0b92 ("drm/xe/pf: Add support for encap/decap of bitstream to/from packet") Reported-by: Sebastian Österlund <sebastian.osterlund@intel.com> Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/7230 Reviewed-by: Shuicheng Lin <shuicheng.lin@intel.com> Link: https://patch.msgid.link/20260217154118.176902-1-michal.winiarski@intel.com Signed-off-by: Michał Winiarski <michal.winiarski@intel.com>
2026-03-23drm/i915/dp_tunnel: Fix error handling when clearing stream BW in atomic stateImre Deak
Clearing the DP tunnel stream BW in the atomic state involves getting the tunnel group state, which can fail. Handle the error accordingly. This fixes at least one issue where drm_dp_tunnel_atomic_set_stream_bw() failed to get the tunnel group state returning -EDEADLK, which wasn't handled. This lead to the ctx->contended warn later in modeset_lock() while taking a WW mutex for another object in the same atomic state, and thus within the same already contended WW context. Moving intel_crtc_state_alloc() later would avoid freeing saved_state on the error path; this stable patch leaves that simplification for a follow-up. Cc: Uma Shankar <uma.shankar@intel.com> Cc: Ville Syrjälä <ville.syrjala@linux.intel.com> Cc: <stable@vger.kernel.org> # v6.9+ Fixes: a4efae87ecb2 ("drm/i915/dp: Compute DP tunnel BW during encoder state computation") Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/7617 Reviewed-by: Michał Grzelak <michal.grzelak@intel.com> Reviewed-by: Uma Shankar <uma.shankar@intel.com> Signed-off-by: Imre Deak <imre.deak@intel.com> Link: https://patch.msgid.link/20260320092900.13210-1-imre.deak@intel.com
2026-03-23hrtimer: add usage examples to documentationAndreas Hindborg
Add documentation examples showing various ways to use hrtimers: - Box-allocated timers with shared state in Arc. - Arc-allocated timers. - Stack-based timers for scoped usage. - Mutable stack-based timers with shared state. Tested-by: Daniel Almeida <daniel.almeida@collabora.com> Reviewed-by: Daniel Almeida <daniel.almeida@collabora.com> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Link: https://msgid.link/20260219-hrtimer-examples-v6-19-rc1-v2-1-810cc06ca9f6@kernel.org Signed-off-by: Andreas Hindborg <a.hindborg@kernel.org>
2026-03-23rust: time: make ClockSource unsafe traitFUJITA Tomonori
Mark the ClockSource trait as unsafe and document its safety requirements. Specifically, implementers must guarantee that their `ktime_get()` implementation returns a value in the inclusive range [0, KTIME_MAX]. Update all existing implementations to use `unsafe impl` with corresponding safety comments. Note that there could be potential users of a customized clock source [1] so we don't seal the trait. Link: https://lore.kernel.org/rust-for-linux/Z9xb1r1x5tOzAIZT@boqun-archlinux/ [1] Suggested-by: Boqun Feng <boqun.feng@gmail.com> Signed-off-by: FUJITA Tomonori <fujita.tomonori@gmail.com> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Link: https://msgid.link/20250630131011.405219-1-fujita.tomonori@gmail.com [ Change range expressions in docs. - Andreas ] Signed-off-by: Andreas Hindborg <a.hindborg@kernel.org>
2026-03-23rust/time: Add Delta::from_nanos()Lyude Paul
Since rvkms is going to need to create its own Delta instances, and we already have functions for creating Delta with every other unit of time. Signed-off-by: Lyude Paul <lyude@redhat.com> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Link: https://msgid.link/20251114184207.459335-1-lyude@redhat.com Signed-off-by: Andreas Hindborg <a.hindborg@kernel.org>
2026-03-23drm/i915: Unlink NV12 planes earlierVille Syrjälä
unlink_nv12_plane() will clobber parts of the plane state potentially already set up by plane_atomic_check(), so we must make sure not to call the two in the wrong order. The problem happens when a plane previously selected as a Y plane is now configured as a normal plane by user space. plane_atomic_check() will first compute the proper plane state based on the userspace request, and unlink_nv12_plane() later clears some of the state. This used to work on account of unlink_nv12_plane() skipping the state clearing based on the plane visibility. But I removed that check, thinking it was an impossible situation. Now when that situation happens unlink_nv12_plane() will just WARN and proceed to clobber the state. Rather than reverting to the old way of doing things, I think it's more clear if we unlink the NV12 planes before we even compute the new plane state. Cc: stable@vger.kernel.org Reported-by: Khaled Almahallawy <khaled.almahallawy@intel.com> Closes: https://lore.kernel.org/intel-gfx/20260212004852.1920270-1-khaled.almahallawy@intel.com/ Tested-by: Khaled Almahallawy <khaled.almahallawy@intel.com> Fixes: 6a01df2f1b2a ("drm/i915: Remove pointless visible check in unlink_nv12_plane()") Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/20260316163953.12905-2-ville.syrjala@linux.intel.com Reviewed-by: Uma Shankar <uma.shankar@intel.com> (cherry picked from commit 017ecd04985573eeeb0745fa2c23896fb22ee0cc) Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
2026-03-23drm/i915: Order OP vs. timeout correctly in __wait_for()Ville Syrjälä
Put the barrier() before the OP so that anything we read out in OP and check in COND will actually be read out after the timeout has been evaluated. Currently the only place where we use OP is __intel_wait_for_register(), but the use there is precisely susceptible to this reordering, assuming the ktime_*() stuff itself doesn't act as a sufficient barrier: __intel_wait_for_register(...) { ... ret = __wait_for(reg_value = intel_uncore_read_notrace(...), (reg_value & mask) == value, ...); ... } Cc: stable@vger.kernel.org Fixes: 1c3c1dc66a96 ("drm/i915: Add compiler barrier to wait_for") Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/20260313110740.24620-1-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula <jani.nikula@intel.com> (cherry picked from commit a464bace0482aa9a83e9aa7beefbaf44cd58e6cf) Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
2026-03-23drm/i915/gmbus: fix spurious timeout on 512-byte burst readsSamasth Norway Ananda
When reading exactly 512 bytes with burst read enabled, the extra_byte_added path breaks out of the inner do-while without decrementing len. The outer while(len) then re-enters and gmbus_wait() times out since all data has been delivered. Decrement len before the break so the outer loop terminates correctly. Fixes: d5dc0f43f268 ("drm/i915/gmbus: Enable burst read") Signed-off-by: Samasth Norway Ananda <samasth.norway.ananda@oracle.com> Reviewed-by: Jani Nikula <jani.nikula@intel.com> Link: https://patch.msgid.link/20260316231920.135438-2-samasth.norway.ananda@oracle.com Signed-off-by: Jani Nikula <jani.nikula@intel.com> (cherry picked from commit 4ab0f09ee73fc853d00466682635f67c531f909c) Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
2026-03-23thunderbolt: Use kzalloc_flex() for struct tb_path allocationRosen Penev
Simplifies allocation of struct tb_path by using a flexible array member. Also added __counted_by for extra runtime analysis. Signed-off-by: Rosen Penev <rosenp@gmail.com> Reviewed-by: Kees Cook <kees@kernel.org> Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
2026-03-23drm/sun4i: Use backend/mixer as dedicated DMA deviceChen-Yu Tsai
The sun4i DRM driver deals with DMA constraints in a peculiar way. Instead of using the actual DMA device in various helpers, it justs reconfigures the DMA constraints of the virtual display device using the DMA device's device tree node by calling of_dma_configure(). Turns out of_dma_configure() should only be called from bus code. Lately this also triggers a big warning through of_iommu_configure() and ultimately __iommu_probe_device(): late IOMMU probe at driver bind, something fishy here! Now that the GEM DMA helpers have proper support for allocating and mapping buffers with a dedicated DMA device, switch over to it as the proper solution. The mixer change was tested on a Pine H64 model B. The backend change was only compile tested. Though I don't expect any issues, help testing on an older device would be appreciated. Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com> Link: https://patch.msgid.link/20260311094929.3393338-5-wenst@chromium.org Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
2026-03-23drm/mediatek: Set dedicated DMA device and drop custom GEM callbacksChen-Yu Tsai
In commit 9b54a32c7c6a ("drm/mediatek: mtk_gem: Partial refactor and use drm_gem_dma_object") the MediaTek DRM driver was refactored to use drm_gem_dma_object, but custom callbacks were still needed to deal with using the first device of the pipeline as the DMA device, instead of the MMSYS device that the DRM driver binds to. Turns out there is already partial support for dedicated DMA devices in the DRM subsystem for PRIME imports. The preceding patches add support for dedicated DMA devices to the GEM DMA helpers. This allows us to just set the dedicated DMA device for the DRM device, and drop all the custom GEM callbacks. Also drop the .dma_dev field from the driver private data as it is no longer needed. There are slight differences in the mmap helper: the VM_DONTDUMP and VM_IO flags are no longer set. Both were lifted from drm_gem_mmap_obj(). VM_IO probably doesn't make sense since the buffer is allocated using dma_alloc_attrs(). Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Acked-by: Chun-Kuang Hu <chunkuang.hu@kernel.org> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Link: https://patch.msgid.link/20260311094929.3393338-4-wenst@chromium.org Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
2026-03-23drm/gem-dma: Support dedicated DMA device for allocation and mappingChen-Yu Tsai
Support for a dedicated DMA device for prime imports was added in commit 143ec8d3f939 ("drm/prime: Support dedicated DMA device for dma-buf imports"). This allowed the DRM driver to provide a dedicated DMA device when its own underlying device was not capable of DMA, for example when it is a USB device (the original target) or a virtual device. The latter case is common on embedded SoCs, on which the display pipeline is composed of various fixed function blocks, and the DRM device is simply a made-up device, an address space managing the routing between the blocks, or whichever block the implementor thought made sense at the time. The point is that the chosen device is often not the actual device doing the DMA. Various drivers have used workarounds or reimplemented the GEM DMA helpers to get the DMA addresses and IOMMUs to work correctly. Add support for the dedicated DMA device to the GEM DMA helpers. No existing driver currently uses the GEM DMA helpers and calls drm_dev_set_dma_dev() to set a dedicated DMA device, so no existing users should be affected. Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Link: https://patch.msgid.link/20260311094929.3393338-3-wenst@chromium.org Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
2026-03-23drm/prime: Limit scatter list size with dedicated DMA deviceChen-Yu Tsai
If a dedicated DMA device is specified for the DRM device, then the scatter list size limit should pertain to the DMA device. Use the dedicated DMA device, if given, to limit the scatter list size. This only applies to drivers that have called drm_dev_set_dma_dev() and are using drm_prime_pages_to_sg() either directly or through the SHMEM helpers. At the time of this writing, the former case only includes the Rockchip DRM driver, while the latter case includes the gud, udl, and the tiny appletbdrm and gm12u320 drivers. Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Link: https://patch.msgid.link/20260311094929.3393338-2-wenst@chromium.org Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>