summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2025-10-30Merge tag 'net-6.18-rc4' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from wireless, Bluetooth and netfilter. Current release - regressions: - tcp: fix too slow tcp_rcvbuf_grow() action - bluetooth: fix corruption in h4_recv_buf() after cleanup Previous releases - regressions: - mptcp: restore window probe - bluetooth: - fix connection cleanup with BIG with 2 or more BIS - fix crash in set_mesh_sync and set_mesh_complete - batman-adv: release references to inactive interfaces - nic: - ice: fix usage of logical PF id - sfc: fix potential memory leak in efx_mae_process_mport() Previous releases - always broken: - devmem: refresh devmem TX dst in case of route invalidation - netfilter: add seqadj extension for natted connections - wifi: - iwlwifi: fix potential use after free in iwl_mld_remove_link() - brcmfmac: fix crash while sending action frames in standalone AP Mode - eth: - mlx5e: cancel tls RX async resync request in error flows - ixgbe: fix memory leak and use-after-free in ixgbe_recovery_probe() - hibmcge: fix rx buf avl irq is not re-enabled in irq_handle issue - cxgb4: fix potential use-after-free in ipsec callback - nfp: fix memory leak in nfp_net_alloc()" * tag 'net-6.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (75 commits) net: sctp: fix KMSAN uninit-value in sctp_inq_pop net: devmem: refresh devmem TX dst in case of route invalidation net: stmmac: est: Fix GCL bounds checks net: stmmac: Consider Tx VLAN offload tag length for maxSDU net: stmmac: vlan: Disable 802.1AD tag insertion offload net/mlx5e: kTLS, Cancel RX async resync request in error flows net: tls: Cancel RX async resync request on rcd_delta overflow net: tls: Change async resync helpers argument net: phy: dp83869: fix STRAP_OPMODE bitmask selftests: net: use BASH for bareudp testing net: mctp: Fix tx queue stall net/mlx5: Don't zero user_count when destroying FDB tables net: usb: asix_devices: Check return value of usbnet_get_endpoints mptcp: zero window probe mib mptcp: restore window probe mptcp: fix MSG_PEEK stream corruption mptcp: drop bogus optimization in __mptcp_check_push() netconsole: Fix race condition in between reader and writer of userdata Documentation: netconsole: Remove obsolete contact people nfp: xsk: fix memory leak in nfp_net_alloc() ...
2025-10-30kbuild: Add '-fms-extensions' to areas with dedicated CFLAGSNathan Chancellor
This is a follow up to commit c4781dc3d1cf ("Kbuild: enable -fms-extensions") but in a separate change due to being substantially different from the initial submission. There are many places within the kernel that use their own CFLAGS instead of the main KBUILD_CFLAGS, meaning code written with the main kernel's use of '-fms-extensions' in mind that may be tangentially included in these areas will result in "error: declaration does not declare anything" messages from the compiler. Add '-fms-extensions' to all these areas to ensure consistency, along with -Wno-microsoft-anon-tag to silence clang's warning about use of the extension that the kernel cares about using. parisc does not build with clang so it does not need this warning flag. LoongArch does not need it either because -W flags from KBUILD_FLAGS are pulled into cflags-vdso. Reported-by: Christian Brauner <brauner@kernel.org> Closes: https://lore.kernel.org/20251030-meerjungfrau-getrocknet-7b46eacc215d@brauner/ Reviewed-by: Christian Brauner <brauner@kernel.org> Acked-by: Ard Biesheuvel <ardb@kernel.org> Signed-off-by: Nathan Chancellor <nathan@kernel.org>
2025-10-31Merge branch 'icc-sa8775p' into icc-nextGeorgi Djakov
This enables QoS configuration for QNOC type device which can be found on SA8775P platform. It enables QoS configuration for master ports with predefined priority and urgency forwarding. This helps in prioritizing the traffic originating from different interconnect masters at NOC. The system may function normally without this feature. However, enabling QoS helps optimize latency and bandwidth across subsystems like CPU, GPU, and multimedia engines, which becomes important in high-throughput scenarios. This is a feature aimed at performance enhancement to improve system performance under concurrent workloads. * icc-sa8775p dt-bindings: interconnect: add reg and clocks properties to enable QoS on sa8775p interconnect: qcom: sa8775p: enable QoS configuration Link: https://lore.kernel.org/r/20251001073344.6599-1-odelu.kukatla@oss.qualcomm.com Signed-off-by: Georgi Djakov <djakov@kernel.org>
2025-10-31Merge branch 'icc-sdx75' into icc-nextGeorgi Djakov
Drop the QPIC interconnect and BCM nodes for the SDX75 SoC. The reason is that this QPIC BCM resource is already defined as a RPMh clock in clk-rpmh driver as like other SDX SoCs. So it is wrong to describe the same resource in two different providers. Also, without this series, the NAND driver fails to probe on SDX75 as the interconnect sync state disables the QPIC nodes as there were no clients voting for this ICC resource. However, the NAND driver had already voted for this BCM resource through the clk-rpmh driver. Since both votes come from Linux, RPMh was unable to distinguish between these two and ends up disabling the resource during sync state. * icc-sdx75 interconnect: qcom: sdx75: Drop QPIC interconnect and BCM nodes dt-bindings: interconnect: qcom: Drop QPIC_CORE IDs Link: https://lore.kernel.org/r/20250926-sdx75-icc-v2-0-20d6820e455c@oss.qualcomm.com> Signed-off-by: Georgi Djakov <djakov@kernel.org>
2025-10-31Merge branch 'icc-msm8996' into icc-nextGeorgi Djakov
The lack of the interconnects for the USB2 host might result in the register writes for the PHY not reaching the PHY and thus the PLL not locking up, resulting in -EBUSY errors for the USB host on the platform. Add missing interconnect link and add interconnect paths to the USB2 device. * icc-msm8996 interconnect: qcom: msm8996: add missing link to SLAVE_USB_HS arm64: dts: qcom: msm8996: add interconnect paths to USB2 controller Link: https://lore.kernel.org/r/20251002-fix-msm8996-icc-v1-0-a36a05d1f869@oss.qualcomm.com Signed-off-by: Georgi Djakov <djakov@kernel.org>
2025-10-31interconnect: debugfs: Fix incorrect error handling for NULL pathKuan-Wei Chiu
The icc_commit_set() function, used by the debugfs interface, checks the validity of the global cur_path pointer using IS_ERR_OR_NULL(). However, in the specific case where cur_path is NULL, while IS_ERR_OR_NULL(NULL) correctly evaluates to true, the subsequent call to PTR_ERR(NULL) returns 0. This causes the function to return a success code (0) instead of an error, misleading the user into believing their bandwidth request was successfully committed when, in fact, no operation was performed. Fix this by adding an explicit check to return -EINVAL if cur_path is NULL. This prevents silent failures and ensures that an invalid operational sequence is immediately and clearly reported as an error. Fixes: 770c69f037c1 ("interconnect: Add debugfs test client") Signed-off-by: Kuan-Wei Chiu <visitorckw@gmail.com> Link: https://lore.kernel.org/r/20251010151447.2289779-1-visitorckw@gmail.com Signed-off-by: Georgi Djakov <djakov@kernel.org>
2025-10-31interconnect: qcom: sdx75: Drop QPIC interconnect and BCM nodesRaviteja Laggyshetty
As like other SDX SoCs, SDX75 SoC's QPIC BCM resource was modeled as a RPMh clock in clk-rpmh driver. However, for SDX75, this resource was also described as an interconnect and BCM node mistakenly. It is incorrect to describe the same resource in two different providers, as it will lead to votes from clients overriding each other. Hence, drop the QPIC interconnect and BCM nodes and let the clients use clk-rpmh driver to vote for this resource. Without this change, the NAND driver fails to probe on SDX75, as the interconnect sync state disables the QPIC nodes as there were no clients voting for this ICC resource. However, the NAND driver had already voted for this BCM resource through the clk-rpmh driver. Since both votes come from Linux, RPMh was unable to distinguish between these two and ends up disabling the QPIC resource during sync state. Cc: stable@vger.kernel.org Fixes: 3642b4e5cbfe ("interconnect: qcom: Add SDX75 interconnect provider driver") Signed-off-by: Raviteja Laggyshetty <quic_rlaggysh@quicinc.com> [mani: dropped the reference to bcm_qp0, reworded description] Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Tested-by: Lakshmi Sowjanya D <quic_laksd@quicinc.com> # on SDX75 Link: https://lore.kernel.org/r/20250926-sdx75-icc-v2-1-20d6820e455c@oss.qualcomm.com Signed-off-by: Georgi Djakov <djakov@kernel.org>
2025-10-30accel/amdxdna: Fix incorrect command state for timed out jobLizhi Hou
When a command times out, mark it as ERT_CMD_STATE_TIMEOUT. Any other commands that are canceled due to this timeout should be marked as ERT_CMD_STATE_ABORT. Fixes: aac243092b70 ("accel/amdxdna: Add command execution") Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com> Link: https://patch.msgid.link/20251029193423.2430463-1-lizhi.hou@amd.com
2025-10-30Merge tag 'wireless-next-2025-10-30' of ↵Jakub Kicinski
https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Johannes Berg says: ==================== Not that many changes this time: - mac80211: - improved VHT radiotap reporting - S1G improvements - multi-radio monitor improvements - HT action frame handling on 6 GHz - mesh rate tracking improvements - CSA handling improvements - cfg80211: multi-radio debugfs - rt2x00: improvements for embedded platforms * tag 'wireless-next-2025-10-30' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: wifi: mac80211: Allow HT Action frame processing on 6 GHz when HE is supported wifi: rt2x00: add nvmem eeprom support wifi: mac80211: add RX flag to report radiotap VHT information net: wireless: Remove redundant pm_runtime_mark_last_busy() calls wifi: cfg80211: Add parameters to radio-specific debugfs directories wifi: cfg80211: Add debugfs support for multi-radio wiphy wifi: mac80211: fix missing RX bitrate update for mesh forwarding path wifi: cfg80211: default S1G chandef width to 1MHz wifi: mac80211: get probe response chan via ieee80211_get_channel_khz wifi: mac80211: reset CRC valid after CSA wifi: mac80211_hwsim: advertise puncturing feature support wifi: cfg80211/mac80211: validate radio frequency range for monitor mode wifi: rt2x00: check retval for of_get_mac_address ==================== Link: https://patch.msgid.link/20251030105355.13216-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-10-31interconnect: qcom: sa8775p: enable QoS configurationOdelu Kukatla
Enable QoS configuration for master ports with predefinedi priority and urgency forwarding. Signed-off-by: Odelu Kukatla <odelu.kukatla@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Link: https://lore.kernel.org/r/20251001073344.6599-3-odelu.kukatla@oss.qualcomm.com Signed-off-by: Georgi Djakov <djakov@kernel.org>
2025-10-30Merge branch '100GbE' of ↵Jakub Kicinski
git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2025-10-29 (ice, i40e, idpf, ixgbe, igbvf) For ice: Michal converts driver to utilize Page Pool and libeth APIs. Conversion is based on similar changes done for iavf in order to simplify buffer management, improve maintainability, and increase code reuse across Intel Ethernet drivers. Additional details: https://lore.kernel.org/20250925092253.1306476-1-michal.kubiak@intel.com Alexander adds support for header split, configurable via ethtool. Grzegorz allows for use of 100Mbps on E825C SGMII devices. For i40e: Jay Vosburgh avoids sending link state changes to VF if it is already in the requested state. For idpf: Sreedevi removes duplicated defines. For ixgbe: Alok Tiwari fixes some typos. For igbvf: Alok Tiwari fixes output of VLAN warning message. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue: igbvf: fix misplaced newline in VLAN add warning message ixgbe: fix typos in ixgbe driver comments idpf: remove duplicate defines in IDPF_CAP_RSS i40e: avoid redundant VF link state updates ice: Allow 100M speed for E825C SGMII device ice: implement configurable header split for regular Rx ice: switch to Page Pool ice: drop page splitting and recycling ice: remove legacy Rx and construct SKB ==================== Link: https://patch.msgid.link/20251029231218.1277233-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-10-31interconnect: qcom: msm8996: add missing link to SLAVE_USB_HSDmitry Baryshkov
>From the initial submission the interconnect driver missed the link from SNOC_PNOC to the USB 2 configuration space. Add missing link in order to let the platform configure and utilize this path. Fixes: 7add937f5222 ("interconnect: qcom: Add MSM8996 interconnect provider driver") Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/20251002-fix-msm8996-icc-v1-1-a36a05d1f869@oss.qualcomm.com Signed-off-by: Georgi Djakov <djakov@kernel.org>
2025-10-30wifi: ath10k: use = {} to initialize bmi_target_info instead of memsetZhongqiu Han
Initialize the bmi_target_info structure using = {} at declaration time instead of calling memset() in each bus-specific code path. This simplifies the code and avoids an explicit memset. Signed-off-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com> Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com> Link: https://patch.msgid.link/20251030130023.1836808-3-zhongqiu.han@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2025-10-30wifi: ath10k: use = {} to initialize pm_qos_request instead of memsetZhongqiu Han
Initialize the pm_qos_request structure using = {} instead of memset() in ath10k_download_fw(). This ensures the structure is properly zeroed before passing it to cpu_latency_qos_add_request(), and improves efficiency by avoiding an explicit runtime memset. Signed-off-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com> Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com> Link: https://patch.msgid.link/20251030130023.1836808-2-zhongqiu.han@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2025-10-30wifi: ath12k: unassign arvif on scan vdev create failureRameshkumar Sundaram
During scan and remain-on-channel requests, a scan link vif (arvif) is assigned and a temporary vdev is created. If vdev creation fails, the assigned arvif is left attached until the virtual interface is removed, leaving a stale link in ahvif. Fix this by freeing the stale arvif and resetting the corresponding link in ahvif by calling ath12k_mac_unassign_link_vif() when vdev creation fails. While at it, propagate the actual error code from ath12k_mac_vdev_create() instead of returning -EINVAL in ath12k_mac_initiate_hw_scan(). Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Fixes: 477cabfdb776 ("wifi: ath12k: modify link arvif creation and removal for MLO") Signed-off-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com> Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com> Link: https://patch.msgid.link/20251026182254.1399650-3-rameshkumar.sundaram@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2025-10-30wifi: ath12k: enforce vdev limit in ath12k_mac_vdev_create()Rameshkumar Sundaram
Currently, vdev limit check is performed only in ath12k_mac_assign_vif_to_vdev(). If the host has already created maximum number of vdevs for the radio (ar) and a scan request arrives for the same radio, ath12k_mac_initiate_hw_scan() attempts to create a vdev without checking the limit, causing firmware asserts. Centralize the vdev limit guard by moving the check into ath12k_mac_vdev_create() so that all callers obey the limit. While doing this, update the condition from `num_created_vdevs > (TARGET_NUM_VDEVS(ab) - 1)` to `num_created_vdevs >= TARGET_NUM_VDEVS(ab)` for clarity and to eliminate unnecessary arithmetic. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Fixes: 0d6e6736ed9f ("wifi: ath12k: scan statemachine changes for single wiphy") Fixes: 4938ba733ee2 ("wifi: ath12k: modify remain on channel for single wiphy") Signed-off-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com> Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com> Link: https://patch.msgid.link/20251026182254.1399650-2-rameshkumar.sundaram@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2025-10-30wifi: ath12k: Set EHT fixed rates for associated STAsMuna Sinada
Fixed rate is set for STAs that are associated. This will be done during association or with ath12k_sta_rc_update_wk(). Add EHT fixed rate setting for STAs by adding call to ath12k_mac_set_peer_eht_fixed_rate() during the times fixed rate is set for STAs. This new function sets EHT fixed rate for a peer, which sends WMI command with the updated MCS/NSS rate using WMI_PEER_PARAM_FIXED_RATE command id. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1 Co-developed-by: Aaradhana Sahu <quic_aarasahu@quicinc.com> Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com> Signed-off-by: Muna Sinada <muna.sinada@oss.qualcomm.com> Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com> Link: https://patch.msgid.link/20251024001928.257356-7-muna.sinada@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2025-10-30wifi: ath12k: add EHT rates to ath12k_mac_op_set_bitrate_mask()Muna Sinada
Extend ath12k_mac_op_set_bitrate_mask() to handle EHT rates. Create and pass EHT mask containing MCS and NSS along with EHT GI and LTF when calling ath12k_mac_set_rate_params() Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1 Co-developed-by: Aaradhana Sahu <quic_aarasahu@quicinc.com> Signed-off-by: Aaradhana Sahu <quic_aarasahu@quicinc.com> Signed-off-by: Muna Sinada <muna.sinada@oss.qualcomm.com> Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com> Link: https://patch.msgid.link/20251024001928.257356-6-muna.sinada@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2025-10-30wifi: ath12k: Add EHT fixed GI/LTFMuna Sinada
Add EHT functionality to set fixed GI/LTF parameters. Add new wmi vdev parameter id for EHT LTF Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1 Signed-off-by: Muna Sinada <muna.sinada@oss.qualcomm.com> Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com> Link: https://patch.msgid.link/20251024001928.257356-5-muna.sinada@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2025-10-30wifi: ath12k: Add EHT MCS/NSS rates to Peer AssocMuna Sinada
Add EHT MCS/NSS rate functionality to peer association. As part of ath12k_peer_assoc_h_eht() add the calculation of EHT MCS/NSS using intersection of link_sta and phy capability. ath12k_mac_max_eht_mcs_nss() function is utilized when comparing the max NSS of link STA and phy capability since in split phy case, phy supports max NSS of 2 for 5G band. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1 Co-developed-by: Vishal Kumar <quic_visk@quicinc.com> Signed-off-by: Vishal Kumar <quic_visk@quicinc.com> Co-developed-by: Aloka Dixit <aloka.dixit@oss.qualcomm.com> Signed-off-by: Aloka Dixit <aloka.dixit@oss.qualcomm.com> Signed-off-by: Muna Sinada <muna.sinada@oss.qualcomm.com> Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com> Link: https://patch.msgid.link/20251024001928.257356-4-muna.sinada@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2025-10-30wifi: ath12k: add EHT rate handling to existing set rate functionsMuna Sinada
Add EHT rate handling to the existing rate functions that validate, prepare and set rates. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1 Co-developed-by: Aloka Dixit <aloka.dixit@oss.qualcomm.com> Signed-off-by: Aloka Dixit <aloka.dixit@oss.qualcomm.com> Signed-off-by: Muna Sinada <muna.sinada@oss.qualcomm.com> Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com> Link: https://patch.msgid.link/20251024001928.257356-3-muna.sinada@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2025-10-30wifi: ath12k: generalize GI and LTF fixed rate functionsMuna Sinada
Currently, functions in mac.c for setting GI and LTF rates are specifically for HE rates. Remove any mention of "HE" in such functions in order to allow for other modes to utilize the functions. The intention is to prepare for the addition of EHT GI and LTF fixed rate settings. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1 Signed-off-by: Muna Sinada <muna.sinada@oss.qualcomm.com> Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com> Link: https://patch.msgid.link/20251024001928.257356-2-muna.sinada@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2025-10-30wifi: ath12k: fix error handling in creating hardware groupBaochen Qiang
In ath12k_core_init() when ath12k_core_hw_group_create() fails, ath12k_core_hw_group_destroy() is called where for each device below path would get executed ath12k_core_soc_destroy() ath12k_qmi_deinit_service() qmi_handle_release() This results in kernel crash in case one of the device fails at qmi_handle_init() when creating hardware group: ath12k_pci 0000:10:00.0: failed to initialize qmi handle ath12k_pci 0000:10:00.0: failed to initialize qmi :-517 ath12k_pci 0000:10:00.0: failed to create soc core: -517 ath12k_pci 0000:10:00.0: unable to create hw group BUG: unable to handle page fault for address: ffffffffffffffb7 RIP: 0010:qmi_handle_release Call Trace: <TASK> ath12k_qmi_deinit_service ath12k_core_hw_group_destroy ath12k_core_init ath12k_pci_probe The detailed reason is, when qmi_handle_init() fails for a device ab->qmi.handle is not correctly initialized. Then ath12k_core_hw_group_create() returns failure, since error handing is done for all device, eventually qmi_handle_release() is called for the issue device and finally kernel crashes due to the uninitialized ab->qmi.handle. Fix this by moving error handling to ath12k_core_hw_group_create(), this way the issue device can be skipped. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Fixes: 6f245ea0ec6c ("wifi: ath12k: introduce device group abstraction") Link: https://lore.kernel.org/ath12k/fabc97122016d1a66a53ddedd965d134@posteo.net Reported-by: a-development <a-development@posteo.de> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220518 Tested-by: a-development <a-development@posteo.de> Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com> Link: https://patch.msgid.link/20251030-fix-hw-group-create-err-handling-v1-1-0659e4d15fb9@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2025-10-30wifi: ath12k: fix reusing m3 memoryBaochen Qiang
During firmware recovery or suspend/resume, m3 memory could be reused if the size of the new m3 binary is equal to or less than that of the existing memory. There will be issues for the latter case, since m3_mem->size will be updated with a smaller value and this value is eventually used in the free path, where the original total size should be used instead. To fix it, add a new member in m3_mem_region structure to track the original memory size and use it in free path. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 Fixes: 05090ae82f44 ("wifi: ath12k: check M3 buffer size as well whey trying to reuse it") Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com> Link: https://patch.msgid.link/20251029-ath12k-fix-m3-reuse-v1-1-69225bacfc5d@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2025-10-30wifi: ath12k: fix potential memory leak in ath12k_wow_arp_ns_offload()Abdun Nihaal
When the call to ath12k_wmi_arp_ns_offload() fails, the temporary memory allocation for offload is not freed before returning. Fix that by freeing offload in the error path. Fixes: 1666108c74c4 ("wifi: ath12k: support ARP and NS offload") Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in> Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Link: https://patch.msgid.link/20251028170457.134608-1-nihaal@cse.iitm.ac.in Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2025-10-30drm/client: Flush client buffers with drm_client_buffer_sync()Thomas Zimmermann
Rename drm_client_framebuffer_flush() to drm_cient_buffer_flush() and adapt its callers. The old name was left over from previous naming conventions. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com>> Tested-by: Francesco Valla <francesco@valla.it> Link: https://patch.msgid.link/20251027121042.143588-8-tzimmermann@suse.de
2025-10-30drm/client: Create client buffers with drm_client_buffer_create_dumb()Thomas Zimmermann
Rename drm_client_framebuffer_create() to drm_client_buffer_create_dump() and adapt callers. The new name reflects the function's purpose. Using dumb buffers is the easiest way for creating a GEM buffer in a drivers- independent way. There's also drm_client_buffer_create(), which creates the client buffer from a preexisting buffer object. This helper can be exported for drivers that create their own GEM buffer object. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com> Tested-by: Francesco Valla <francesco@valla.it> Link: https://patch.msgid.link/20251027121042.143588-7-tzimmermann@suse.de
2025-10-30drm/client: Remove drm_client_framebuffer_delete()Thomas Zimmermann
Release client buffers with drm_client_buffer_delete() instead of drm_client_framebuffer_delete(). The latter is just a tiny wrapper around the former. Move the test for !buffer into drm_client_buffer_delete(), although all callers appear to always have a valid pointer. v2: - test for !buffer before deref-ing pointer (Jocelyn, Dan) Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com> Tested-by: Francesco Valla <francesco@valla.it> Link: https://patch.msgid.link/20251027121042.143588-6-tzimmermann@suse.de
2025-10-30drm/client: Deprecate struct drm_client_buffer.gemThomas Zimmermann
The client buffer's framebuffer holds a reference and pointer on each of its GEM buffer objects. Thus the field gem in the client- buffer struct is not necessary. Deprecated the field and convert the client-buffer helpers to use the framebuffer's objects. In drm_client_buffer_delete(), do a possible vunmap before releasing the framebuffer. Otherwise we'd eventually release the framebuffer before unmaping its buffer objects. v2: - avoid dependency on CONFIG_DRM_KMS_HELPER Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com> Tested-by: Francesco Valla <francesco@valla.it> Link: https://patch.msgid.link/20251027121042.143588-5-tzimmermann@suse.de
2025-10-30drm/client: Inline drm_client_buffer_addfb() and _rmfb()Thomas Zimmermann
Creating and deleting a client buffer always creates and deletes the underlying DRM framebuffer. Inline the helper functions into their callers. With the _addfb code being inlined into drm_client_buffer_create(), clean up the function's error rollback to release the framebuffer's handle and GEM buffer object as needed. Move the _rmfb code into drm_client_buffer_delete() rather than its current location in drm_client_framebuffer_delete(). The former is now the inverse of drm_client_buffer_create(). Makes no difference for cleaning up. Also prepares for the removal of drm_client_framebuffer_delete(). Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com> Tested-by: Francesco Valla <francesco@valla.it> Link: https://patch.msgid.link/20251027121042.143588-4-tzimmermann@suse.de
2025-10-30drm/client: Move dumb-buffer handling to drm_client_framebuffer_create()Thomas Zimmermann
Dumb-buffer creation within the client code is asymetrically balanced across drm_client_buffer_create() and drm_client_framebuffer_create(). Put all dumb-buffer code into drm_client_framebuffer_create() and leave client-buffer initialization to drm_client_buffer_create(). Clarifies responsibility between these functions. Apart form the architectural improvements, drm_client_buffer_create() can now be exported if needed by clients. The client will be able to initialize buffers that have been created from other interfaces than dumb buffers. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com> Tested-by: Francesco Valla <francesco@valla.it> Link: https://patch.msgid.link/20251027121042.143588-3-tzimmermann@suse.de
2025-10-30drm/client: Remove pitch from struct drm_client_bufferThomas Zimmermann
Only the client-buffer setup uses the pitch field from struct drm_client_buffer. Remove the field and pass the value among setup helpers. Clients that need the pitch should rather look at the framebuffer's pitches[0] directly. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com> Tested-by: Francesco Valla <francesco@valla.it> Link: https://patch.msgid.link/20251027121042.143588-2-tzimmermann@suse.de
2025-10-30drm/ast: Clear preserved bits from register output valueThomas Zimmermann
Preserve the I/O register bits in __ast_write8_i_masked() as specified by preserve_mask. Accidentally OR-ing the output value into these will overwrite the register's previous settings. Fixes display output on the AST2300, where the screen can go blank at boot. The driver's original commit 312fec1405dd ("drm: Initial KMS driver for AST (ASpeed Technologies) 2000 series (v2)") already added the broken code. Commit 6f719373b943 ("drm/ast: Blank with VGACR17 sync enable, always clear VGACRB6 sync off") triggered the bug. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reported-by: Peter Schneider <pschneider1968@googlemail.com> Closes: https://lore.kernel.org/dri-devel/a40caf8e-58ad-4f9c-af7f-54f6f69c29bb@googlemail.com/ Tested-by: Peter Schneider <pschneider1968@googlemail.com> Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com> Fixes: 6f719373b943 ("drm/ast: Blank with VGACR17 sync enable, always clear VGACRB6 sync off") Fixes: 312fec1405dd ("drm: Initial KMS driver for AST (ASpeed Technologies) 2000 series (v2)") Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: Nick Bowler <nbowler@draconx.ca> Cc: Douglas Anderson <dianders@chromium.org> Cc: Dave Airlie <airlied@redhat.com> Cc: Jocelyn Falempe <jfalempe@redhat.com> Cc: dri-devel@lists.freedesktop.org Cc: <stable@vger.kernel.org> # v3.5+ Link: https://patch.msgid.link/20251024073626.129032-1-tzimmermann@suse.de
2025-10-30Merge branches 'acpi-button', 'acpi-video' and 'acpi-fan'Rafael J. Wysocki
Merge ACPI button, ACPI backlight (video), and ACPI fan driver fixes for 6.18-rc4: - Call input_free_device() on failing input device registration as necessary (and mentioned in the input subsystem documentation) in the ACPI button driver (Kaushlendra Kumar) - Fix use-after-free in acpi_video_switch_brightness() by canceling a delayed work during tear-down (Yuhao Jiang) - Use platform device for devres-related actions in the ACPI fan driver to allow device-managed resources to be cleaned up properly (Armin Wolf) * acpi-button: ACPI: button: Call input_free_device() on failing input device registration * acpi-video: ACPI: video: Fix use-after-free in acpi_video_switch_brightness() * acpi-fan: ACPI: fan: Use platform device for devres-related actions ACPI: fan: Use ACPI handle when retrieving _FST
2025-10-30powercap: intel_rapl: Add support for Wildcat Lake platformSrinivas Pandruvada
Add Wildcat Lake to the list of supported processors for RAPL. Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> Link: https://patch.msgid.link/20251023174532.1882008-1-srinivas.pandruvada@linux.intel.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2025-10-30cpufreq: intel_pstate: Add Diamond Rapids OOB mode supportKuppuswamy Sathyanarayanan
Prevent intel_pstate from loading when Out-of-Band (OOB) P-states mode is enabled. The OOB identification mechanism for Diamond Rapids servers is the same as for prior generation CPUs such as Granite Rapids. Add the Diamond Rapids CPU model to intel_pstate_cpu_oob_ids[] to ensure correct OOB handling. Signed-off-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com> Link: https://patch.msgid.link/20251022215425.3566218-1-sathyanarayanan.kuppuswamy@linux.intel.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2025-10-30random: replace use of system_unbound_wq with system_dfl_wqMarco Crivellari
system_unbound_wq has been renamed to system_dfl_wq in 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq"), so update random.c's usage of it system_unbound_wq to reflect the new change. The old system_unbound_wq is slated for removal in the next few cycles. Suggested-by: Tejun Heo <tj@kernel.org> Signed-off-by: Marco Crivellari <marco.crivellari@suse.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2025-10-30random: use offstack cpumask when necessaryArnd Bergmann
The entropy generation function keeps a local cpu mask on the stack, which can trigger warnings in configurations with a large number of CPUs: drivers/char/random.c:1292:20: error: stack frame size (1288) exceeds limit (1280) in 'try_to_generate_entropy' [-Werror,-Wframe-larger-than] Use the cpumask interface to dynamically allocate it in those configurations. Fixes: 1c21fe00eda7 ("random: spread out jitter callback to different CPUs") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2025-10-30media: vivid: use prandomMarkus Theil
This is part of a prandom cleanup, which removes next_pseudo_random32 and replaces it with the standard PRNG. Signed-off-by: Markus Theil <theil.markus@gmail.com> Reviewed-by: Krzysztof Karas <krzysztof.karas@intel.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2025-10-30random: add missing words in function commentsThorsten Blum
s/good as/as good as/ Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2025-10-30i3c: master: svc: Prevent incomplete IBI transactionStanley Chu
If no free IBI slot is available, svc_i3c_master_handle_ibi returns immediately. This causes the STOP condition to be missed because the EmitStop request is sent when the transfer is not complete. To resolve this, svc_i3c_master_handle_ibi must wait for the transfer to complete before returning. Fixes: dd3c52846d59 ("i3c: master: svc: Add Silvaco I3C master driver") Signed-off-by: Stanley Chu <yschu@nuvoton.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com> Link: https://patch.msgid.link/20251027034715.708243-1-yschu@nuvoton.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2025-10-30i3c: fix refcount inconsistency in i3c_master_registerFrank Li
In `i3c_master_register`, a possible refcount inconsistency has been identified, causing possible resource leak. Function `of_node_get` increases the refcount of `parent->of_node`. If function `i3c_bus_init` fails, the function returns immediately without a corresponding decrease, resulting in an inconsistent refcounter. Move call i3c_bus_init() after device_initialize() to let callback i3c_masterdev_release() release of_node. Reported-by: Shuhao Fu <sfual@cse.ust.hk> Closes: https://lore.kernel.org/linux-i3c/aO2tjp_FsV_WohPG@osx.local/T/#m2c05a982beeb14e7bf039c1d8db856734bf234c7 Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure") Signed-off-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20251016143814.2551256-1-Frank.Li@nxp.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2025-10-30USB: serial: ftdi_sio: add support for u-blox EVK-M101Oleksandr Suvorov
The U-Blox EVK-M101 enumerates as 1546:0506 [1] with four FTDI interfaces: - EVK-M101 current sensors - EVK-M101 I2C - EVK-M101 UART - EVK-M101 port D Only the third USB interface is a UART. This change lets ftdi_sio probe the VID/PID and registers only interface #3 as a TTY, leaving the rest available for other drivers. [1] usb 5-1.3: new high-speed USB device number 11 using xhci_hcd usb 5-1.3: New USB device found, idVendor=1546, idProduct=0506, bcdDevice= 8.00 usb 5-1.3: New USB device strings: Mfr=1, Product=2, SerialNumber=0 usb 5-1.3: Product: EVK-M101 usb 5-1.3: Manufacturer: u-blox AG Datasheet: https://content.u-blox.com/sites/default/files/documents/EVK-M10_UserGuide_UBX-21003949.pdf Signed-off-by: Oleksandr Suvorov <cryosay@gmail.com> Link: https://lore.kernel.org/20250926060235.3442748-1-cryosay@gmail.com/ Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold <johan@kernel.org>
2025-10-30platform/x86: acer-wmi: Add support for PHN16-72Armin Wolf
A user reported that the config of the PH16-72 also works on the PHN16-72. Add support for this new device as well. Suggested-by: Fa-Iz Faadhillah Ibrahim <faiz.faadhillah@gmail.com> Signed-off-by: Armin Wolf <W_Armin@gmx.de> Link: https://patch.msgid.link/20251016180008.465593-5-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2025-10-30platform/x86: acer-wmi: Enable fan control for PH16-72 and PT14-51Armin Wolf
Both machines support the necessary WMI methods, so enable fan control for them. Signed-off-by: Armin Wolf <W_Armin@gmx.de> Link: https://patch.msgid.link/20251016180008.465593-4-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2025-10-30platform/x86: acer-wmi: Add fan control supportArmin Wolf
Add support for controlling the fan speed using the SetGamingFanSpeed() and GetGamingFanSpeed() WMI methods. This feature is only enabled if the machine has ACER_CAP_PWM enabled and depend on ACER_CAP_HWMON for detecting the number of available fans. Reviewed-by: Kurt Borja <kuurtb@gmail.com> Signed-off-by: Armin Wolf <W_Armin@gmx.de> Link: https://patch.msgid.link/20251016180008.465593-3-W_Armin@gmx.de [ij: if nested inside else block -> else if] Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2025-10-30platform/x86: acer-wmi: Fix setting of fan behaviorArmin Wolf
After studying the linuwu_sense driver (https://github.com/0x7375646F/Linuwu-Sense) i was able to understand the meaning of the SetGamingFanBehavior() WMI method: - the first 16-bit are a bitmap of all fans affected by a fan behavior change request. - the next 8 bits contain four fan mode fields (2-bit), each being associated with a bit inside the fan bitmap. There are three fan modes: auto, turbo and custom. Use this newfound knowledge to fix the turbo fan handling by setting the correct bits before calling SetGamingFanBehavior(). Also check the result of the WMI method call and return an error should the ACPI firmware signal failure. Reviewed-by: Kurt Borja <kuurtb@gmail.com> Signed-off-by: Armin Wolf <W_Armin@gmx.de> Link: https://patch.msgid.link/20251016180008.465593-2-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2025-10-30accel/ivpu: Wait for CDYN de-assertion during power down sequenceKarol Wachowski
During power down, pending DVFS operations may still be in progress when the NPU reset is asserted after CDYN=0 is set. Since the READY bit may already be deasserted at this point, checking only the READY bit is insufficient to ensure all transactions have completed. Add an explicit check for CDYN de-assertion after the READY bit check to guarantee no outstanding transactions remain before proceeding. Fixes: 550f4dd2cedd ("accel/ivpu: Add support for Nova Lake's NPU") Reviewed-by: Maciej Falkowski <maciej.falkowski@linux.intel.com> Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com> Signed-off-by: Karol Wachowski <karol.wachowski@linux.intel.com> Link: https://patch.msgid.link/20251030091700.293341-1-karol.wachowski@linux.intel.com
2025-10-30drm/imx: parallel-display: add the bridge before attaching itLuca Ceresoli
Invoking drm_bridge_add() is good practice, so add it to this driver. Link: https://lore.kernel.org/all/DDHZ5GO9MPF0.CGYTVBI74FOZ@bootlin.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Reviewed-by: Louis Chauvet <louis.chauvet@bootlin.com> Link: https://patch.msgid.link/20251014-drm-bridge-alloc-imx-ipuv3-v1-2-a1bb1dcbff50@bootlin.com Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
2025-10-30drm/imx: parallel-display: convert to devm_drm_bridge_alloc() APILuca Ceresoli
This is the new API for allocating DRM bridges. This conversion was missed during the initial conversion of all bridges to the new API. Thus all kernels with commit 94d50c1a2ca3 ("drm/bridge: get/put the bridge reference in drm_bridge_attach/detach()") and using this driver now warn due to drm_bridge_attach() incrementing the refcount, which is not initialized without using devm_drm_bridge_alloc() for allocation. To make the conversion simple and straightforward without messing up with the drmm_simple_encoder_alloc(), move the struct drm_bridge from struct imx_parallel_display_encoder to struct imx_parallel_display. Also remove the 'struct imx_parallel_display *pd' from struct imx_parallel_display_encoder, not needed anymore. Fixes: 94d50c1a2ca3 ("drm/bridge: get/put the bridge reference in drm_bridge_attach/detach()") Reported-by: Ernest Van Hoecke <ernestvanhoecke@gmail.com> Closes: https://lore.kernel.org/all/hlf4wdopapxnh4rekl5s3kvoi6egaga3lrjfbx6r223ar3txri@3ik53xw5idyh/ Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Reviewed-by: Louis Chauvet <louis.chauvet@bootlin.com> Tested-by: Ernest Van Hoecke <ernest.vanhoecke@toradex.com> Link: https://patch.msgid.link/20251014-drm-bridge-alloc-imx-ipuv3-v1-1-a1bb1dcbff50@bootlin.com Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>