summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2026-07-30crypto: drivers - remove conditional return with no effectSang-Heon Jeon
Both branches of the check return the same value, so the check has no effect. Remove it and return the value directly. This is the result of running the Coccinelle script from scripts/coccinelle/misc/cond_return_no_effect.cocci. Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-30crypto: octeontx - simplify get_{eng,ucode}_type_str helpersThorsten Blum
Remove the local variables, add default cases, and return the strings directly. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-30crypto: qce - drop redundant variable in qce_skcipher_doneThorsten Blum
Remove the local ret variable and return the result directly. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-30crypto: bcm - use memcpy_and_pad in ahash_hmac_setkeyThorsten Blum
Use memcpy_and_pad() instead of memcpy() followed by memset() to simplify ahash_hmac_setkey(). Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-30crypto: cesa - manage SRAM teardown with devmRosen Penev
mv_cesa_put_sram() is called explicitly from both the probe error path and mv_cesa_remove(). The non-pool ioremap is already devm-managed, but dma_map_resource() and gen_pool_dma_alloc() have no devm helpers, so the mapping is released by hand. This is error-prone: the error path iterates over every engine and can dma_unmap_resource() an uninitialized/zero address for engines that were never set up. Convert the teardown into a devm_add_action_or_reset() callback registered only after a mapping is successfully established. The callback fires automatically on probe failure (devres rollback) and on device detach, after mv_cesa_remove() has already stopped the engine and freed the IRQ, so the unmap still happens in a safe order. This deletes the explicit mv_cesa_put_sram() calls and the uninitialized-engine bug at once. Add a struct mv_cesa_dev back-pointer to struct mv_cesa_engine so the callback can reach cesa->dev and cesa->sram_size from the engine alone. Assisted-by: opencode:hy3-free Signed-off-by: Rosen Penev <rosenp@gmail.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-30crypto: starfive - use scatterlist length before DMA mappingThorsten Blum
Using sg_dma_len() is only valid after mapping a scatterlist with dma_map_sg(). However, starfive_aes_aead_do_one_req() uses it before mapping the scatterlist. Use the original scatterlist length because the DMA length has not been populated yet when CONFIG_NEED_SG_DMA_LENGTH=y. Fixes: 7467147ef9bf ("crypto: starfive - Use dma for aes requests") Cc: stable@vger.kernel.org Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-30crypto: qce - fix error path in devm_qce_register_algsThorsten Blum
If ops->register_algs() fails, the error path repeatedly calls the same ops->unregister_algs() from the failed registration. Use the loop index to unregister the previously registered algorithms instead. Fixes: e80cf84b6087 ("crypto: qce - unregister previously registered algos in error path") Cc: stable@vger.kernel.org Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-30crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req()Vladislav Dronov
Perform rctx->cryptlen calculation in tegra_gcm_do_one_req() the same way it is done in tegra_ccm_crypt_init(). The current formulae may lead to a crash if a caller does not call tegra_gcm_setauthsize() and so ctx->authsize remains zero. Then a decrypt operation with incorrect rctx->cryptlen will lead to a write beyound rctx->dst_sg buffer. As a follow-up cleanup delete struct tegra_aead_ctx->authsize field since it appears to be completely unused. Also simplify tegra_ccm_setauthsize() and tegra_gcm_setauthsize() functions respectively. Fixes: 0880bb3b00c8 ("crypto: tegra - Add Tegra Security Engine driver") Signed-off-by: Vladislav Dronov <vdronov@redhat.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-07-30md/raid5: protect bitmap batch counters aka seq_flush/seq_write consistencyChen Cheng
kcsan detect race : - raid5d() closes the current bitmap batch by updating conf->seq_flush under conf->device_lock. - __add_stripe_bio() read conf->seq_flush without that lock when assigning sh->bm_seq. so, protect seq_flush/seq_write consistency for multiple CPUs by READ_ONCE()/WRITE_ONCE() under the path without held device_lock. re-explain the stripe batch sequence number update flow: 1. sh->bm_seq declare which batch number the stripe belongs to when perform bitmap-related write. ==> bm_seq = seq_flush+1 2. stripe be handled, * if sh->bm_seq - conf->seq_write > 0, means the batch stripes **newer than** the last written batch, it cannot proceed yet, queued on bitmap_list. * otherwise , has already proceed. 3. raid5d() `++seq_flush` to closes the current batch, means * no more stripes join that old batch * just-closed batch ready to write-out to disk 4. raid5d() calls bitmap hooks unplug() or writeout, then, `++seq_write` to the same as bm_seq. - seq_flush - for producer, to close batches. - seq_write - for consumer, the checkpoint number. the report: ==================================== BUG: KCSAN: data-race in __add_stripe_bio / raid5d write to 0xffff88ba5625d470 of 4 bytes by task 82401 on cpu 0: raid5d+0x1d9/0xba0 [.....] read to 0xffff88ba5625d470 of 4 bytes by task 82421 on cpu 8: __add_stripe_bio+0x332/0x400 raid5_make_request+0x6ac/0x2930 md_handle_request+0x4a2/0xa40 md_submit_bio+0x109/0x1a0 __submit_bio+0x2ec/0x390 [.....] Fixes: 7c13edc87510 ("md: incorporate new plugging into raid5.") v1 -> v2: - remove WRITE_ONCE(conf->seq_write) in held device_lock path. - remove READ_ONCE(conf->seq_flush) in held device_lock path. Signed-off-by: Chen Cheng <chencheng@fnnas.com> Reviewed-by: Yu Kuai <yukuai@fygo.io> Link: https://patch.msgid.link/20260622124649.1780233-1-chencheng@fnnas.com Signed-off-by: Yu Kuai <yukuai@fygo.io>
2026-07-30wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb()Abdun Nihaal
The skb passed to the rtw_hci_tx_write() is expected to be freed when the function fails, but the error path in rtw_txq_push_skb() does not free the skb before returning. This can lead to a memory leak in rtw_txq_push() where a dequeued skb is passed to rtw_txq_push_skb(). Fixes: aaab5d0e6737 ("rtw88: kick off TX packets once for higher efficiency") Cc: stable@vger.kernel.org Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260727064223.61836-1-nihaal@cse.iitm.ac.in
2026-07-30wifi: rtw89: remove conditional return with no effect in sys_init_*()Sang-Heon Jeon
Both branches of the check return the same value, so the check has no effect. Remove it and return the value directly. This is the result of running the Coccinelle script from scripts/coccinelle/misc/cond_return_no_effect.cocci. Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260726134034.1385834-3-ekffu200098@gmail.com
2026-07-30wifi: rtlwifi: rtl8821ae: remove conditional return with no effect in ↵Sang-Heon Jeon
_rtl8821ae_llt_write() Both branches of the check return the same value, so the check has no effect. Remove it and return the value directly. This is the result of running the Coccinelle script from scripts/coccinelle/misc/cond_return_no_effect.cocci. Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260726134034.1385834-2-ekffu200098@gmail.com
2026-07-30PCI: epf-mhi: Implement mhi_cntrl->flush_async() to flush DMA read/writeManivannan Sadhasivam
The MHI core needs to make sure that all the current DMA transactions are completed before removing the channels. So implement the mhi_cntrl->flush_async() callback by first making sure all the in-flight DMA operations are completed and then flushing the DMA workqueue. Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
2026-07-30bus: mhi: ep: Flush async transfers before notifying disconnect in ↵Manivannan Sadhasivam
mhi_ep_abort_transfer() mhi_ep_abort_transfer() notifies the client drivers about the channel disconnect using -ENOTCONN and only then flushes the ring workqueue to drain the in-flight transfers. But the async DMA transfers issued by the ring workers can still complete after the notification. And the completion handlers trigger the client xfer_cb() as long as it is set. So a transfer completing during the flush can deliver a success callback to the client even after it has been notified about the disconnect. This can lead to UAF (Use-After-Free) issues as the client can free its per-transfer resources in response to the -ENOTCONN notification and the trailing success callback would then reference the freed resources. So to fix this issue, disable all the channels first to prevent new transfers and then drain both the ring workqueue and the in-flight async transfers before notifying the disconnect. The completion and queue paths bail out once the channel state is not MHI_CH_STATE_RUNNING, so disabling the channels upfront makes sure that no new transfer sneaks in during the drain and all the pending completions are delivered while xfer_cb() is still valid. Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
2026-07-30bus: mhi: ep: Add mhi_cntrl->flush_async() callback to flush the async ↵Manivannan Sadhasivam
read/write MHI EP stack makes use of the MHI controller drivers like MHI EPF to do read/write to the host memory. And that driver is free to use mechanisms like DMA to offload the read/write operations. So if DMA is used for offload, then there is no guarantee that those DMA operations would be completed by the time mhi_ep_remove() gets called. This can lead to UAF (Use-After-Free) issues as the DMA callback can trigger xfer_cb() even after mhi_ep_remove() has returned. So to fix this issue, introduce the mhi_cntrl->flush_async() callback and call it in mhi_ep_remove() to drain all the in-flight async transfers before disconnecting the channels. The completion handlers keep triggering xfer_cb() as long as it is set. So flushing the transfers after notifying the client about the disconnect (-ENOTCONN) would still let a success callback slip through afterwards and lead to the same UAF. So disable the channels first to prevent new transfers, then flush the in-flight transfers so that their completions are delivered while xfer_cb() is still valid and only then notify the disconnect and clear xfer_cb(). Fixes: 2547beb00ddb ("bus: mhi: ep: Add support for async DMA read operation") Fixes: ee08acb58fe4 ("bus: mhi: ep: Add support for async DMA write operation") Reviewed-by: Frank Li <Frank.Li@nxp.com> Cc: stable+noautosel@kernel.org # Needs dmaengine driver fix as well Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
2026-07-30bus: mhi: host: Fix controller cleanup on EDL sysfs failureYuho Choi
mhi_register_controller() adds the controller device before creating the optional trigger_edl sysfs file. If sysfs_create_file() fails, the error path only drops the device reference and leaves the device registered. Hence, call device_del() in the error path before put_device(). Fixes: 17553ba8e19d ("bus: mhi: host: Add sysfs entry to force device to enter EDL") Signed-off-by: Yuho Choi <dbgh9129@gmail.com> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
2026-07-30bus: mhi: pci_generic: Add SAHARA channel support for Foxconn productsSlark Xiao
Add SAHARA channel to support capturing crash dump (ramdump) using the in-kernel sahara client driver. Signed-off-by: Slark Xiao <slark_xiao@163.com> [mani: commit log] Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
2026-07-30bus: mhi: host: pci_generic: Set 'mhi_cntrl->no_m3' flagManivannan Sadhasivam
Commit 0494cf9793b7 ("bus: mhi: host: pci_generic: Disable runtime PM for QDU100") added the 'no_m3' flag to indicate that the QDU100 device doesn't support M3 state and used this flag to skip runtime PM. But it didn't prevent the MHI bus from transitioning the device to M3 during system suspend. So set 'mhi_cntrl->no_m3' flag based on the local 'info->no_m3' flag to indicate MHI bus that this device doesn't support M3 state so that it can skip the transition. Cc: stable+noautosel@kernel.org # depends on the 'mhi_cntrl->no_m3' flag addition Fixes: 0494cf9793b7 ("bus: mhi: host: pci_generic: Disable runtime PM for QDU100") Reported-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
2026-07-30bus: mhi: host: Add support for devices with no M3 stateManivannan Sadhasivam
MHI bus transitions the device into M3 state during suspend and back to M0 state during resume. But due to hardware issues, some devices do not support M3 state. To support these devices properly, MHI bus needs to skip transitioning the device to M3 during suspend and back to M0 during resume. For this purpose, introduce the 'mhi_cntrl->no_m3' flag and allow it to be set by the MHI controller drivers. Once set, this flag lets the MHI bus skip transitioning the device to M3/M0 during suspend/resume. But, simply skipping suspend/resume for such devices is not sufficient, as it leaves the MHI host in M0 state with device access enabled. Client drivers that do not implement PM callbacks (for instance, the non-freezable rx_refill worker in mhi_net driver) could then keep ringing channel doorbells and issue MMIO to the device even after the controller driver has disabled it and moved it to D3 during its own suspend, resulting in access to a powered down device. So instead of skipping the entire suspend/resume operation, run the full host suspend/resume sequence but without the device-side M state handshake. During suspend, only transition the host to M3 without sending the MHICTRL M3 command or waiting for the device M3 event. During resume, bring the host back to M0 through mhi_pm_m0_transition() without sending the MHICTRL M0 command. With the host in M3, all device access is gated by MHI_DB_ACCESS_VALID() and MHI_REG_ACCESS_VALID(), so any transfer queued by the clients during suspend is deferred until resume, where mhi_pm_m0_transition() rings the pending doorbells. Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
2026-07-30bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSETManivannan Sadhasivam
mhi_soc_reset() tries to reset the device by writing to the MHI_SOC_RESET_REQ_OFFSET register. But it doesn't do a read-back to ensure that the write gets flushed to the device before returning to the caller. This may lead to the delay (if implemented) on the caller to be insufficient, if the posted write doesn't reach the device before the delay. So add a read-back after writing to the MHI_SOC_RESET_REQ_OFFSET register. Fixes: b5a8d233a588 ("bus: mhi: core: Add device hardware reset support") Reported-by: Alex Williamson <alex@shazbot.org> Closes: https://lore.kernel.org/linux-pci/20260622160822.09350246@shazbot.org Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com> Link: https://patch.msgid.link/20260623145134.43976-1-manivannan.sadhasivam@oss.qualcomm.com
2026-07-30thunderbolt: Initialize ->domain_released completion before it is being usedMika Westerberg
Both Woody and Marek reported following crash: BUG: unable to handle page fault for address: fffffffffffffff8 Call Trace: <TASK> device_release+0x43/0x90 kobject_cleanup+0x3c/0x180 icm_probe+0x19c/0x550 [thunderbolt] nhi_probe+0x1a4/0x370 [thunderbolt] local_pci_probe+0x41/0x90 pci_call_probe+0x5b/0x1a0 ... This only triggers on the error path when icm_probe() fails and the domain structure is released, it tries to complete() uninitialized completion. Fix this by initializing the completion earlier. Reported-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com> Closes: https://lore.kernel.org/linux-usb/amdezCBiW4fd_DuB@mail-itl/ Reported-by: Woody Suwalski <terraluna977@gmail.com> Tested_by: Woody Suwalski <terraluna977@gmail.com> Closes: https://lore.kernel.org/linux-usb/62caf7f8-b403-d0dd-15bc-b31b56f71c28@gmail.com/ Fixes: f5cc545f5969 ("thunderbolt: Wait for tb_domain_release() to complete when driver is removed") Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
2026-07-30gpu: nova-core: Move one PBUS register definitionAntonin Malzieu Ridolfi
Move NV_PBUS_SW_SCRATCH_0E_FRTS_ERR register definition into gsp module and update registers visibility. Suggested-by: Alexandre Courbot <acourbot@nvidia.com> Suggested-by: Danilo Krummrich <dakr@kernel.org> Signed-off-by: Antonin Malzieu Ridolfi <dev@nanonej.com> Link: https://patch.msgid.link/20260727-nova-core-regs-split-v2-3-21b5e6e32ea5@nanonej.com Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
2026-07-30gpu: nova-core: Move PFB registers definitionsAntonin Malzieu Ridolfi
Move PFB registers definitions into fb module and update registers visibility. Suggested-by: Alexandre Courbot <acourbot@nvidia.com> Suggested-by: Danilo Krummrich <dakr@kernel.org> Signed-off-by: Antonin Malzieu Ridolfi <dev@nanonej.com> Link: https://patch.msgid.link/20260727-nova-core-regs-split-v2-2-21b5e6e32ea5@nanonej.com Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
2026-07-30gpu: nova-core: Add function to query WPR2 rangeAntonin Malzieu Ridolfi
Create new function abstracting WPR2 region range query. Refactor gsp hal tu102 to query the WPR2 region range using this new function. Suggested-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Antonin Malzieu Ridolfi <dev@nanonej.com> Link: https://patch.msgid.link/20260727-nova-core-regs-split-v2-1-21b5e6e32ea5@nanonej.com Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
2026-07-30drm/xe/tests: add live KUnit coverage for BO page-size allocation modesNareshkumar Gollakoti
Add live KUnit coverage for the debug-controlled BO page-size allocation modes. The new tests cover forced 2M mode, forced 1G mode, and mixed mode. They verify that user BO creation applies the expected NEEDS_* flags, that no unexpected page-size flags are added in the forced modes, that BO size is rounded as expected, and that page_alignment matches the selected leaf size. The mixed-mode test does not assume a strict per-allocation rotation sequence, since the device-global mixed-mode index may be perturbed by concurrent BO creation on a live system. Instead, it validates that each allocation results in one valid mixed-mode page-size outcome. Treat transient VRAM allocation failures as skipped test cases so the tests can run in varying live environments without producing false failures. v3 - address review comments - rework mixed-mode test to avoid assuming strict rotation order - reword commit message v4 - skip VRAM-targeted live tests on non-dGFX devices v5 - advance the mixed-mode index in the test v6 - Gaurd kunit tests under CONFIG_DRM_XE_DEBUG_PAGE_SIZE v9 - consider XE_VRAM_FLAGS_NEED64K in mixed mode for certain platoform min alignment expectations. Signed-off-by: Nareshkumar Gollakoti <naresh.kumar.g@intel.com> Reviewed-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com> Link: https://patch.msgid.link/20260729121843.1255891-7-naresh.kumar.g@intel.com Signed-off-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
2026-07-30drm/xe/pt: allow selecting the bind leaf PTE levelNareshkumar Gollakoti
Add a target_leaf_level field to the page-table bind walk and use it to control the level at which leaf entries are emitted. By default, the bind walk emits level-0 leaf PTEs and relies on xe_pt_hugepte_possible() to select huge mappings when possible. Add an explicit target leaf level so the walk can stop earlier when the VMA requests a larger mapping size. Use level 1 for 2M PDE mappings and level 2 for 1G PDP mappings, while keeping level 0 for normal mappings. The existing huge-page heuristic is preserved for the default level-0 path. This allows the bind path to emit 2M and 1G leaf entries when requested by the VMA, while still validating alignment and size requirements. v2 - avoid using max_level to control walk depth - use target_leaf_level to preserve the normal walk behavior - keep the default huge-page heuristic only for the level-0 path - refine commit message v3 - reword commit message v4 - allow fallback to smaller huge-page levels for non-zero target_leaf_level - avoid constraining clear_pt walks by target_leaf_level v5(Himal) - Restrict only intended level in debug page size policy mode - Allow the normal path to proceed smoothly when no debug page-size mode is selected. v8 (Himal) - Drop https://patchwork.freedesktop.org/patch/740059/?series=168905&rev=5 patch and populate target_leaf_level from bo flags - populate target_leaf_level if it is in debug page size mode otherwise fill with 0 which is having no effect on the normal flow v10 (Himal) - use xe_bo_is_vram() instead of raw VRAM flag checks so huge-page selection is based on BO VRAM placement. Signed-off-by: Nareshkumar Gollakoti <naresh.kumar.g@intel.com> Reviewed-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com> Link: https://patch.msgid.link/20260729121843.1255891-6-naresh.kumar.g@intel.com Signed-off-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
2026-07-30drm/xe: apply debug page-size allocation policy to user BOsNareshkumar Gollakoti
Apply the debug page-size allocation policy during user BO creation. When page-size allocation control is enabled, override the user BO page-size selection flags based on the selected debug mode and round the requested size up to the corresponding granularity: - 2M mode selects 2M handling - 1G mode selects 1G handling - mixed mode selects the page size from the current mixed-mode index This is intended for internal debug and validation flows. When the control mode is left at the default setting, the normal user BO creation path is unchanged. v2 - ensure debug page-size allocation does not affect the default path (sashiko) - rework synchronization for concurrent access (sashiko) - refactor commit message for readability v3 - update user BO size alignment based on debug policy mode - reword commit message - ensure normal user flow is unchanged when debug policy is disabled v4(sashiko) - limit debug page-size policy application to VRAM BOs - do not override preexisting page-size requirement flags - advance mixed-mode index only after successful BO create ioctl completion - add overflow checks before ALIGN() in debug page-size handling - ensure CONFIG_DRM_XE_DEBUG_PAGE_SIZE enabled and it is dgfx v5(Himal) v5: - Guard debug page-size policy paths with CONFIG_DRM_XE_DEBUG_PAGE_SIZE - Leave the normal BO creation path unchanged when no debug mode is selected v8(Himal) - Avoid current index increment for system BO's - Simplify mixed mode align logic by changing array to struct array - Have a inline check if it is on debug mode or not - Avoid condition compiled debug in function code blocks Signed-off-by: Nareshkumar Gollakoti <naresh.kumar.g@intel.com> Reviewed-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com> Link: https://patch.msgid.link/20260729121843.1255891-5-naresh.kumar.g@intel.com Signed-off-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
2026-07-30drm/xe: add XE_BO_FLAG_NEEDS_1G for minimum page-size sizingNareshkumar Gollakoti
Add XE_BO_FLAG_NEEDS_1G to mark BOs that require 1G minimum page-size sizing. Update xe_bo_init_locked() to honor the new flag in the existing VRAM/stolen-memory minimum page-size sizing path. When XE_BO_FLAG_NEEDS_1G is set, the BO size is rounded up to 1G. Otherwise, the existing 2M and 64K sizing behavior is preserved. If multiple minimum page-size flags are set, the largest requirement takes precedence: 1G over 2M over 64K. v3 - commit message reworded Signed-off-by: Nareshkumar Gollakoti <naresh.kumar.g@intel.com> Reviewed-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com> Link: https://patch.msgid.link/20260729121843.1255891-4-naresh.kumar.g@intel.com Signed-off-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
2026-07-30drm/xe/debugfs: add page-size allocation mode knobNareshkumar Gollakoti
Expose a debugfs control to override the page-size allocation mode used for user BOs. The interface allows switching between the default allocation policy, forced 2M, forced 1G, and mixed allocation modes at runtime. This provides a simple way to validate behavior and debug page-size-dependent allocation flows. The debugfs entry is built only when CONFIG_DRM_XE_DEBUG_PAGE_SIZE is enabled. v2 - update changelog to match mutex-based cur_index handling - reset cur_index when switching to mixed mode (sashiko) v3 - add CONFIG guard for page-size allocation debugfs support (Himal) - create debugfs entry under CONFIG_DRM_XE_DEBUG_PAGE_SIZE v4 - reorderd this patch with kconfig patch to ensure patch builds - Gurding this debug knob for only discrete graphics v5(Himal) - Guard all page size calls with CONFIG_DRM_XE_DEBUG_PAGE_SIZE v8(Himal) - For read/show used READ_ONCE instead lock - to match Reader used WRITE_ONCE under lock protection - change modes to string format to read/writer for debugfs v9(Himal) - Add an OOB guard for mode in page_size_alloc_mode_show(). This check makes the function display "unknown" if mode has been maliciously altered by KMD, preventing out-of-bounds access. Under normal operation, values set through debugfs are validated, so OOB values should not occur. - simplify mode-to-string lookup using page_size_alloc_mode_names[] - use sysfs_match_string() to parse page_size_alloc_mode writes Signed-off-by: Nareshkumar Gollakoti <naresh.kumar.g@intel.com> Reviewed-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com> Link: https://patch.msgid.link/20260729121843.1255891-3-naresh.kumar.g@intel.com Signed-off-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
2026-07-30drm/xe: add page size allocation control state to xe_deviceNareshkumar Gollakoti
Introduce xe_page_size_alloc_ctrl_mode and add page_size_alloc_ctrl state to struct xe_device along with mutex lock. The new control supports forcing user BO allocations to 2M pages, forcing them to 1G pages, or using a mixed round-robin mode across 4K, 64K, 2M, and 1G page sizes. Track the current mixed-mode index in xe_device so allocation policy can be applied consistently. v2 - make cur_index to atomic as update need in later patch to avoid race/concurency (sashiko) v3 - reworded comments - protect mode/index updates with a mutex for proper concurrency handling v4(sashiko) - move xe_debug_page_size_alloc_ctrl_init() before drm_dev_register(), so mutex and control states are initialized before any userspace visibility v5(Himal) - Guard all the debug page size policy code under CONFIG - Squash Kconfig patch to have Kconfig entry for DEBUG_PAGE_SIZE - Add inline to check debug page size support and exact mode configured if it is supported. v6 (fix CI build) v8 (Himal) - use drmm_mutex_init to avoid leak with mutex_init - call xe_debug_page_size_alloc_ctrl_init unconditionally - Add missed mixed mode check on xe_debug_page_size_mode_not_none check - Add xe_debug_page_size_mode_is_mixed() function v9 - make xe_debug_page_size_alloc_ctrl_init() return int - fail probe if drmm_mutex_init() for page_size_alloc_ctrl.lock fails Signed-off-by: Nareshkumar Gollakoti <naresh.kumar.g@intel.com> Reviewed-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com> Link: https://patch.msgid.link/20260729121843.1255891-2-naresh.kumar.g@intel.com Signed-off-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
2026-07-30wifi: rtw89: coex: Handle Bluetooth LE-Audio related coexistence featureChing-Te Ku
Implement event handler of BTF_EVNT_BT_LEAUDIO_INFO C2H command, and related coexistence mechanism for Bluetooth LE-Audio feature. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260724135640.3195044-15-pkshih@realtek.com
2026-07-30wifi: rtw89: coex: Fix H2C command redundant send & version fall throughChing-Te Ku
I/O offload higher priority sending event didn't return after H2C command was sent, add a return to prevent send twice in the same time. Update driver info entry which is handling module control info didn't handle the version 9 command format, add if condition to handle it. TX power update H2C command result checker logic was reversed, it will lead to the TX power value never update again after first update, fix the issue. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260724135640.3195044-14-pkshih@realtek.com
2026-07-30wifi: rtw89: coex: Fix TDMA v8 handling to unblock BTC report parsingChing-Te Ku
fcxtdma=8 was not handled in _chk_btc_report(), causing the parser to hit 'goto err' and return 0 when processing the TDMA sub-report. This broke the _parse_btc_report() loop before reaching BT_VER (type=9), leaving bt->ver_info.fw always zero on RTL8922A/D. TDMA v8 uses the same struct layout as v3/v4/v7 (rtw89_btc_fbtc_tdma_v3, 12 bytes), so add it to the existing v3/v4/v7 branch in both switch cases. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260724135640.3195044-13-pkshih@realtek.com
2026-07-30wifi: rtw89: coex: Add dual Bluetooth debug info dumpChing-Te Ku
As RTL8922D support dual Bluetooth, add BT debug info dump for it. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260724135640.3195044-12-pkshih@realtek.com
2026-07-30wifi: rtw89: coex: Add BTC report version 8 support for BT sub-reportsChing-Te Ku
RTL8922A (FW >= 0.35.111) and RTL8922D (FW >= 0.35.94) set fcxbtver, fcxbtscan and fcxbtafh to 8, but the handler in _chk_btc_report only had branches for version 1 and 7. When version 8 arrived pfinfo was left NULL and pcinfo->req_len was left at zero, so the length check at validation stage rejected the report and bt->ver_info.fw was never written, causing BT_FW:0x0 in the BTC dump. BT-scan and BT-afh version 8 hit the goto err path for the same reason, making all BT sub-reports silently broken on these chips. The structural change in version 8 is that the previously reserved second byte in each struct is now bt_id (0 = BT0, 1 = BT1), allowing firmware to send separate reports for each Bluetooth device. All three structs are otherwise layout-compatible with version 7. Add rtw89_btc_fbtc_btver_v8, rtw89_btc_fbtc_btscan_v8 and rtw89_btc_fbtc_btafh_v8 structs with the bt_id field, extend the corresponding unions, add version 8 branches to _chk_btc_report, and update _update_bt_report to route each report to BT0 or BT1 according to BT ID. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260724135640.3195044-11-pkshih@realtek.com
2026-07-30wifi: rtw89: coex: Fix log dump format with proper newlineChing-Te Ku
Fix the log output format in _show_mreg_v7() where the phy-0 gnt_status line was missing the proper field label and newline. Use the standard " %-15s : " format with "[gnt_status]" label consistent with the rest of the dump output. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260724135640.3195044-10-pkshih@realtek.com
2026-07-30wifi: rtw89: coex: Refine RF calibration notify flowChing-Te Ku
BT-coexistence only needs to record RF calibration is doing or not, don't need to record the status of the calibration steps. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260724135640.3195044-9-pkshih@realtek.com
2026-07-30wifi: rtw89: coex: complete GPIO debug configuration handlerChing-Te Ku
Complete the implementation of _fw_set_gpio() function to support all GPIO control configuration types for coexistence. Included debug signal, antenna switch, external I2C mailbox, external PTA related GPIO configuration. This function is called during initialization and when BT re-enables. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260724135640.3195044-8-pkshih@realtek.com
2026-07-30wifi: rtw89: coex: Decrease Wi-Fi special packet protect timeChing-Te Ku
While Wi-Fi is doing special packet handshake, or going into some transient state, BT-Coexistence will held timer to fix control logic to protect the segment. Set the protection duration to 1 second, it is enough to cover the situation. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260724135640.3195044-7-pkshih@realtek.com
2026-07-30wifi: rtw89: coex: Separate _ntfy_role_info into two functionChing-Te Ku
To make logic more clearly, separate _ntfy_role_info into two function by data collecting and using. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260724135640.3195044-6-pkshih@realtek.com
2026-07-30wifi: rtw89: coex: Rearrange _ntfy_role_info infoChing-Te Ku
rtw89_btc_wl_link_info is duplicated declaring in the function, remove one of them. We need MAC Address only when Wi-Fi role is station, included the copy operation into if statement. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260724135640.3195044-5-pkshih@realtek.com
2026-07-30wifi: rtw89: coex: Add firmware 0.35.111.X support for RTL8922A/DChing-Te Ku
Add BTC version table entries for RTL8922A and RTL8922D. The new firmware need driver provide more chip initial related parameters. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260724135640.3195044-4-pkshih@realtek.com
2026-07-30wifi: rtw89: coex: Add Wi-Fi MLO info version 2 H2C commandChing-Te Ku
The info included MLO status, hardware status, firmware will set corresponding register control to do coexistence (PTA slot priority, RF switch etc.) Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260724135640.3195044-3-pkshih@realtek.com
2026-07-30wifi: rtw89: coex: Add chip initial info version 11 for RTL8922A/DChing-Te Ku
The version 11 init info add current RF path control information. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260724135640.3195044-2-pkshih@realtek.com
2026-07-30wifi: rtlwifi: pci: fix error path in rtl_pci_probe()Abdun Nihaal
In the last error path in rtl_pci_probe(), the cleanup functions are skipped due to a wrong goto label. Moreover, the successful call to rtl_init_rfkill(), ieee80211_register_hw(), rtl_debug_add_one() have to be reverted. Fix this issue by updating the labels and adding the relevant cleanup functions to the last error path. Fixes: 0c8173385e54 ("rtl8192ce: Add new driver") Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260723120118.145383-1-nihaal@cse.iitm.ac.in
2026-07-30wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars()Abdun Nihaal
The memory allocated inside rtl92du_init_shared_data() is not freed in any of the subsequent error paths in rtl92du_init_sw_vars(). Fix that by adding a call to rtl92du_deinit_shared_data() in the error path. Fixes: b5dc8873b6ff ("wifi: rtlwifi: Add rtl8192du/sw.c") Cc: stable@vger.kernel.org Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260723114539.136986-1-nihaal@cse.iitm.ac.in
2026-07-30wifi: rtl818x: initialize eeprom_93cx6 struct to zeroStanislaw Gruszka
Commit 7738a7ab9d12 ("misc: eeprom: eeprom_93cx6: Add quirk for extra read clock cycle") added extra 'quirk' field to struct eeprom_93cx6. Many existing users of eeprom_93cx6, including rtl818x drivers, allocate the structure on the stack without initializing all fields. As a result, the added quirk field has an undefined value and can randomly cause reading wrong data from the EEPROM. Fix by initializing the structures with {}. Fixes: 7738a7ab9d12 ("misc: eeprom: eeprom_93cx6: Add quirk for extra read clock cycle") Cc: stable@kernel.org # v6.13+ Signed-off-by: Stanislaw Gruszka <stf_xl@wp.pl> Reviewed-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260723110640.8588-1-stf_xl@wp.pl
2026-07-30platform/chrome: cros_ec_debugfs: Unregister panic notifierHongyan Xu
cros_ec_debugfs_probe() registers notifier_panic with the EC panic notifier chain. The remove path tears down debugfs and the console log, but leaves the notifier registered. A later panic notification can call back into the removed instance and queue work that accesses released data. Unregister the panic notifier before tearing down the debugfs and console log state. This issue was found by a static analysis tool. Fixes: d90fa2c64d59 ("platform/chrome: cros_ec: Poll EC log on EC panic") Signed-off-by: Hongyan Xu <getshell@seu.edu.cn> Link: https://lore.kernel.org/r/f3ab74ef8034be63bb45a325f3d54656d658817f.1785320940.git.getshell@seu.edu.cn Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
2026-07-29net: dsa: realtek: use devm_mutex_init for l2_lockLuiz Angelo Daros de Luca
With CONFIG_DEBUG_MUTEXES enabled, mutex_destroy() needs to be called before the lock is discarded. Use devm_mutex_init() instead so the cleanup is handled automatically. Fixes: 336e3e4a1ab37 ("net: dsa: realtek: rtl8365mb: add FDB support") Reviewed-by: Mieczyslaw Nalewaj <namiltd@yahoo.com> Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com> Reviewed-by: Linus Walleij <linusw@kernel.org> Reviewed-by: Alvin Šipraga <alvin.sipraga@analog.com> Link: https://patch.msgid.link/20260726-realtek_mutext-v2-4-5d62ba998791@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-29net: dsa: realtek: use devm_mutex_init for vlan_lockLuiz Angelo Daros de Luca
With CONFIG_DEBUG_MUTEXES enabled, mutex_destroy() needs to be called before the lock is discarded. Use devm_mutex_init() instead so the cleanup is handled automatically. Fixes: 9da2c8672f771 ("net: dsa: realtek: rtl8365mb: add VLAN support") Reviewed-by: Mieczyslaw Nalewaj <namiltd@yahoo.com> Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com> Reviewed-by: Linus Walleij <linusw@kernel.org> Reviewed-by: Alvin Šipraga <alvin.sipraga@analog.com> Link: https://patch.msgid.link/20260726-realtek_mutext-v2-3-5d62ba998791@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-09-10 10:49:58 +0000