Commit d87773de9e ("clocksource/drivers/arm_arch_timer: Default to EL2
virtual timer when running VHE") updated the ARM arch timer driver to
use the virtual timer by default if the CPU is running at EL2 with VHE
enabled. If the CPU is running at EL2 with VHE enabled but there is no
interrupt provided for the virtual timer, then the following warning is
displayed:
arch_timer: [Firmware Bug]: VHE-capable CPU without EL2 virtual timer
interrupt
This warning is observed on Tegra194 platforms. Tegra194 SoC includes
NVIDIA Carmel ARM v8.2 CPUs and support an EL2 virtual timer. Fix the
above warning by adding the PPI for the EL2 virtual timer interrupt for
Tegra194.
Fixes: 5425fb15d8 ("arm64: tegra: Add Tegra194 chip device tree")
Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
The rk3399-roc-pc-plus inherits the work LED heartbeat trigger from
the common rk3399-roc-pc.dtsi.
On the rk3399-roc-pc-plus this LED is the prominent blue front-panel
status LED. Blinking it continuously is distracting for a PC-style
board. The usual default is a steady power/status indication while
the system is running.
Use the default-on trigger for this board instead. This keeps the LED
useful as a simple running indicator and still lets userspace select a
different trigger or turn it off after boot.
Signed-off-by: Fabio Estevam <festevam@nabladev.com>
Link: https://patch.msgid.link/20260717010736.578419-3-festevam@gmail.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
The rk3399-roc-pc-plus board has an Ampak AP6256 Wi-Fi/Bluetooth
module.
Describe the Wi-Fi function on SDIO0 and the Bluetooth function on
UART0. Add the Bluetooth wake and shutdown pinctrl entries, enable
SDIO0 as a non-removable SDIO device, and add the power sequencing
delays needed by the module.
The module uses the RK808 CLKOUT2 output as its 32 kHz low-power
clock. Drop the duplicate HYM8563 clock-output-names property and
remove the same clock from the SDIO power sequencer so the Bluetooth
node can request the shared LPO clock directly.
Signed-off-by: Fabio Estevam <festevam@nabladev.com>
Link: https://patch.msgid.link/20260717010736.578419-2-festevam@gmail.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
The ES8388 sound card on the rk3399-roc-pc-plus fails to probe because
i2s1 cannot claim its MCLK pin:
pinctrl: pin gpio4-0 already requested by ff880000.i2s; cannot claim for ff890000.i2s
pinctrl: error -EINVAL: pin-128 (ff890000.i2s)
pinctrl: error -EINVAL: could not request pin 128 (gpio4-0) from group i2s-8ch-mclk-pin
on device rockchip-pinctrl
GPIO4_A0 is routed as SCLK_I2S_8CH_OUT and is used by i2s1 as the
external MCLK for the ES8388 codec. The board dts already removes
GPIO4_A0 from the i2s0_8ch_bus pin group, but i2s0 still claims the
same pin through its bclk_off state.
Since the i2s driver requests both states, this blocks i2s1 pinctrl
setup and leaves the simple-audio-card deferred with a parse error.
Override i2s0_8ch_bus_bclk_off as well, matching the existing
i2s0_8ch_bus override, so GPIO4_A0 is left for i2s1/ES8388 audio.
Cc: stable@vger.kernel.org
Fixes: 6d9a7bd6a1 ("arm64: dts: rockchip: add support for Firefly ROC-RK3399-PC-PLUS")
Signed-off-by: Fabio Estevam <festevam@nabladev.com>
Link: https://patch.msgid.link/20260717010736.578419-1-festevam@gmail.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
The Rockchip RK3568 MIPI CSI-2 receiver binding requires the bus-type
property in its input endpoint.
Specify that the Radxa CAM4K modules connected to CSI2 and CSI4 use a
MIPI CSI-2 D-PHY bus. This fixes the following dtbs_check warning:
endpoint: 'bus-type' is a required property
Signed-off-by: Fabio Estevam <festevam@gmail.com>
Link: https://patch.msgid.link/20260727174007.2581714-1-festevam@gmail.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
The panel-simple schema only allows data-mapping overrides for panels
whose mapping is not fixed by their compatible. Consequently, the property
on the Ampire AM-1280800N3TZQW-T00H panel fails validation:
(ampire,am-1280800n3tzqw-t00h): False schema does not allow ['vesa-24']
The panel descriptor already selects 8 bits per color and
MEDIA_BUS_FMT_RGB888_1X7X4_SPWG. The DRM OF helpers translate
"vesa-24" to that exact bus format, and panel-simple falls back to the
descriptor's format when the property is absent. Removing the property
therefore has no functional effect.
Drop the redundant property to satisfy the binding.
Signed-off-by: Fabio Estevam <festevam@gmail.com>
Link: https://patch.msgid.link/20260727175502.2585290-1-festevam@gmail.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Currently, each ath12k AHB device maintains its own RootPD-related
information. However, RootPD is shared across all UserPD devices, so
RootPD-related operations such as RootPD boot, and notifier registration,
should be performed only once during the first UserPD boot up.
Due to per-device RootPD information, the driver is unable to track
shared RootPD state across multiple UserPDs, which can result in these
operations being performed multiple times.
Fix this by introducing a new ath12k_ahb_rproc_info structure to hold
shared RootPD-related information such as notifier callbacks, boot
state, and number of userPD.
Allocate this structure during the first device probe in
ath12k_ahb_rproc_info_alloc() and reuse the same structure for all
subsequent device probes.
Also handle rproc deconfiguration correctly when multiple UserPDs share a
common RootPD. The RootPD provides shared firmware services and resources
for all UserPDs. Therefore, do not shut down the RootPD while any UserPD
remains powered on or is still in the boot process.
In addition, a UserPD can be powered down before its associated resources
are fully released. Defer g_rproc_info cleanup until all UserPD-related
state and resources have been cleaned up.
For intermediate UserPD removal, cleanup only per-device information
and remove the UserPD from the tracking array while keeping the RootPD
running for remaining active UserPDs.
Note: UserPD IDs start from 1, as ID 0 is used by RootPD, which is
completely handled by the remoteproc driver.
The multi-PD architecture on AHB platforms operates as follows:
+-----------------------------+
| Q6 RootPD (rproc) |
| (Shared Resource) |
| |
| - Manages UserPD lifecycle |
| - Provides SSR notifiers |
+--------------+--------------+
|
| Manages
|
+---------------------+---------------------+
| | |
+----v----+ +----v----+ +----v----+
| UserPD1 | | UserPD2 | | UserPD3 |
| ID=1 | | ID=2 | | ID=3 |
| (Radio) | | (Radio) | | (Radio) |
+---------+ +---------+ +---------+
| | |
| | |
ath12k_ahb ath12k_ahb ath12k_ahb
(device 1) (device 2) (device 3)
| | |
+---------------------+---------------------+
|
| All reference
|
+---------v----------+
| ath12k_ahb_rproc_ |
| info (shared) |
| |
| - tgt_rproc |
| - notifiers |
| - rootpd_ready |
| - num_userpd |
| - userpd[] array |
+--------------------+
Tested-on: IPQ5332 hw1.0 AHB WLAN.WBE.1.6-01275-QCAHKSWPL_SILICONZ-1
Signed-off-by: Aaradhana Sahu <aaradhana.sahu@oss.qualcomm.com>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20260721065038.126046-3-aaradhana.sahu@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
AHB-based platforms associate each device with a userPD ID that determines
the firmware name and Peripheral Authentication Service ID (PASID) used
during firmware authentication.
Current implementation does not support platforms with multiple devices
sharing the same compatible string but using different userPD IDs.
As a result, the driver cannot uniquely identify each device for firmware
selection and authentication.
Add an AHB platform descriptor to store device-specific configuration.
Implement userPD ID resolution by matching device tree reg properties, with
node name matching as a fallback. Centralize platform configuration to
simplify the probe path by removing hardware-specific conditionals.
Tested-on: IPQ5332 hw1.0 AHB WLAN.WBE.1.6-01275-QCAHKSWPL_SILICONZ-1
Signed-off-by: Aaradhana Sahu <aaradhana.sahu@oss.qualcomm.com>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20260721065038.126046-2-aaradhana.sahu@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
In ath12k_wifi7_mac_op_tx(), the MLO multicast broadcast path iterates
over all active links and copies the original skb for transmission on
each link. When firmware crash recovery is underway (ATH12K_FLAG_CRASH_FLUSH
set), the per-link copy is allocated and partially processed before
ath12k_wifi7_dp_tx() eventually rejects it with -ESHUTDOWN.
This wastes GFP_ATOMIC memory and produces spurious "failed to transmit
frame" warnings for every active MLO link during the recovery window.
The unicast and non-MLO paths are unaffected: they call ath12k_wifi7_dp_tx()
directly, which already guards against the flag at its entry.
Skip any link whose associated ath12k_base has ATH12K_FLAG_CRASH_FLUSH set
before performing the skb_copy(), matching the behaviour of
ath12k_wifi7_dp_tx() but avoiding the unnecessary allocation entirely.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.6-01243-QCAHKSWPL_SILICONZ-1
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
Signed-off-by: Pavankumar Nandeshwar <pavankumar.nandeshwar@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Link: https://patch.msgid.link/20260723054653.2794550-1-pavankumar.nandeshwar@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Currently, the RX release ring size is hardcoded to 1024 entries via
DP_RX_RELEASE_RING_SIZE. This value was sufficient for older generations,
but is not adequate for Wi-Fi 7 scenarios with higher aggregation,
parallel processing, and increased likelihood of error bursts.
In Wi-Fi 7, a PPDU can carry up to 1024 MPDUs and each MPDU may contain
multiple MSDUs. In error scenarios such as REO out-of-order (OOR) events,
a large number of MSDUs can be pushed to the RX release ring in a short
duration. With multiple PPDUs being processed in parallel (e.g. multi-core
or MLO scenarios), this can lead to significant bursts of descriptors.
Field observations have shown frequent OOR conditions and back-pressure
issues with smaller ring sizes. Increasing the RX release ring size helps
absorb these bursts and avoids back-pressure in the RXDMA/REO pipeline.
Without sufficient ring capacity (e.g. 16K), back-pressure was observed
under stress conditions.
To address this, make the RX release ring size configurable per memory
profile by adding rx_release_ring_size to ath12k_dp_profile_params:
- Default memory profile: 16384 entries
- Low memory profile (512M): 8192 entries
The larger size in the default profile improves robustness under high
traffic and error conditions by reducing the probability of ring overflow
and pipeline stalls. The reduced size in the low memory profile balances
memory usage while still providing sufficient headroom compared to the
previous fixed value.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
Signed-off-by: Pavankumar Nandeshwar <pavankumar.nandeshwar@oss.qualcomm.com>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20260721110459.2203038-1-pavankumar.nandeshwar@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
The enumerator names ATH12K_FIRMWARE_MODE_* lack the QMI infix that all
other constants in qmi.h use (ATH12K_QMI_FILE_TYPE_*,
ATH12K_QMI_BDF_TYPE_*, ATH12K_QMI_MEMORY_MODE_*, etc.). Rename them to
ATH12K_QMI_FIRMWARE_MODE_* for consistency and to prevent a future
re-introduction of ATH12K_FIRMWARE_MODE_* names causing a silent collision.
While here, add a comment noting that values 2-3 are reserved by the
firmware QMI ABI to explain the gap before ATH12K_QMI_FIRMWARE_MODE_OFF = 4.
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c7-00108-QCAHMTSWPL_V1.0_V2.0_SILICONZ_UPSTREAM-3
Assisted-by: Claude:claude-sonnet-4-6
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20260725-consolidate-firmware_mode-v1-2-aedff0ce0ba5@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
The enum ath12k_firmware_mode defines values that are part of the QMI
ABI, so it belongs in qmi.h rather than core.h. Consolidate it there
along with ATH12K_FIRMWARE_MODE_OFF, which is currently a bare macro.
Rename the enum to ath12k_qmi_firmware_mode to align with the naming
convention of the other enums in qmi.h, and place it with the other
ath12k_qmi_* enums.
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c7-00108-QCAHMTSWPL_V1.0_V2.0_SILICONZ_UPSTREAM-3
Assisted-by: Claude:claude-sonnet-4-6
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20260725-consolidate-firmware_mode-v1-1-aedff0ce0ba5@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
The outer skb->len guard only confirms the SKB is large enough
to hold the full fixed_param struct, but the TLV's own WMI_TLV_LEN
field is never checked. Firmware advertising a TLV length shorter
than sizeof(*fixed_param) causes reads of pdev_id and event_count
beyond the declared TLV payload.
Add a check that the TLV length is at least sizeof(*fixed_param)
before casting and dereferencing the pointer.
Fixes: d889913205 ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
Assisted-by: Claude:claude-sonnet-4-6
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Link: https://patch.msgid.link/20260726-ath12k_wmi_process_tpc_stats-len-check-v1-1-c4ba2f84d9c6@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
There is no policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT, so
the parse infrastructure does not enforce a minimum length for the event
struct. Additionally, the num_vdevs field is taken directly from firmware
and used as a loop bound over the vdev_ids array without checking that it
fits within the TLV payload. Either condition can cause an out-of-bounds
read.
Add a TLV policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT so
the parse infrastructure enforces a minimum length for the fixed-size event
struct. Add a helper ath11k_wmi_tlv_data_len() to recover the payload
length of a parsed TLV from the header preceding its data pointer. Use it
in ath11k_wmi_process_csa_switch_count_event() to bound num_vdevs before
the loop.
Compile tested only.
Fixes: d5c65159f2 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
Assisted-by: Claude:claude-sonnet-4-6
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20260724-ath12k_wmi_process_csa_switch_count_event-cleanup-v2-2-02a45d7246c0@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
There is no policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT, so
the parse infrastructure does not enforce a minimum length for the event
struct. Additionally, the num_vdevs field is taken directly from firmware
and used as a loop bound over the vdev_ids array without checking that it
fits within the TLV payload. Either condition can cause an out-of-bounds
read.
Add a TLV policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT so
the parse infrastructure enforces a minimum length for the fixed-size event
struct. Add a helper ath12k_wmi_tlv_data_len() to recover the payload
length of a parsed TLV from the header preceding its data pointer. Use it
in ath12k_wmi_process_csa_switch_count_event() to bound num_vdevs before
the loop.
Compile tested only.
Fixes: d889913205 ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
Assisted-by: Claude:claude-sonnet-4-6
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20260724-ath12k_wmi_process_csa_switch_count_event-cleanup-v2-1-02a45d7246c0@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
The mismatch would pop up when building the kernel with W=1.
Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Reviewed-by: Liviu Dudau <liviu.dudau@arm.com>
Signed-off-by: Adrián Larumbe <adrian.larumbe@collabora.com>
Link: https://patch.msgid.link/20260720-vm_bind_checks-v6-2-c2c7dbe93a73@collabora.com
Signed-off-by: Steven Price <steven.price@arm.com>
When a VM is created, caller has to specify the range of the address space
carve-out set aside for mapping kernel BO's. That means vm_bind mappings of
UM-exposed BO's should not intersect with that region, but at the moment
we're not checking this.
At first, I thought of giving these values to drm_gpuvm_init() through its
reserve_{offset, range} arguments, but it turns out that is meant for VM
address spans that are not managed through the usual drm_gpuvm split/merge
circuit, so storing the end of the user VA range at VM creation time and
doing a quick check in the vm_bind ioctl path was the simplest workaround.
The new check also makes sure vm_bind range doesn't overflow the size of a
64-bit unsigned integer. That was already being done further down the call
stack inside drm_gpuvm_sm_map -> drm_gpuvm_range_valid, but it's best to
fail early in the driver before GPUVM functions are invoked so that we
won't waste time allocating vm_bind context resources.
Fixes: 12cf826bf1 ("drm/panthor: Support sparse mappings")
Fixes: 647810ec24 ("drm/panthor: Add the MMU/VM logical block")
Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
Signed-off-by: Adrián Larumbe <adrian.larumbe@collabora.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Link: https://patch.msgid.link/20260720-vm_bind_checks-v6-1-c2c7dbe93a73@collabora.com
Signed-off-by: Steven Price <steven.price@arm.com>
The controller is allocated with the non-managed spi_alloc_host() while
the interrupt is registered with devm_request_threaded_irq(). During
removal, spi_bitbang_stop() only unregisters the controller; the
subsequent spi_controller_put() then frees the controller together with
its embedded davinci_spi devdata, which is the IRQ handler's dev_id.
The devm_request_threaded_irq() release action (free_irq()), which
drains the handler, does not run until after .remove() returns. A late
or latched interrupt can therefore reach davinci_spi_irq() and
dereference already-freed memory.
Switch to devm_spi_alloc_host() so that the devres LIFO order releases
the controller only after free_irq() has drained the handler, and drop
the now-redundant spi_controller_put() from .remove(). The probe error
path is simplified to direct returns.
The clock is acquired with devm_clk_get_enabled(), which is registered
after the IRQ and thus released before it by the devres LIFO order.
Drain the interrupt explicitly with devm_free_irq() before disabling the
controller so that a late interrupt cannot access the registers of a
clock-gated controller.
This issue was found by an in-house static analysis tool.
Fixes: 5b3bb5963f ("spi: davinci: Use devm_*() functions")
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Link: https://patch.msgid.link/20260719010014.3163356-2-fanwu01@zju.edu.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
The R-Car Gen4 PCIe controller can optionally use GIC ITS as an
MSI controller. This configuration is described in DT by setting
msi-parent DT property in the PCIe controller node. Document this
configuration.
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Acked-by: Rob Herring (Arm) <robh@kernel.org>
Link: https://patch.msgid.link/20260720015505.314957-1-marek.vasut+renesas@mailbox.org
iface_fw_to_cpu_addr() only checks that the firmware-provided MCU virtual
address points inside the shared section. The returned pointer is later
used as a full firmware interface structure, so accepting an address near
the end of the shared section can still lead to out-of-bounds accesses.
Pass the expected object size to iface_fw_to_cpu_addr() and reject ranges
that do not fit entirely in the shared section.
Fixes: 2718d91816 ("drm/panthor: Add the FW logical block")
Cc: stable@vger.kernel.org
Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Signed-off-by: Steven Price <steven.price@arm.com>
Link: https://patch.msgid.link/20260720114918.15973-1-osama.abdelkader@gmail.com
nvmet_param_mdts_store() accepts any integer that kstrtoint() can parse
and stores it directly into port->mdts. The value is only range-checked
later, when the port is enabled: nvmet_enable_port() silently resets
port->mdts to 0 if it is negative or greater than NVMET_MAX_MDTS.
As a result, writing e.g. "mdts=1000" succeeds and reading the attribute
back returns 1000, yet enabling the port quietly turns it into 0. This
is confusing and hides the invalid input from the user.
Validate the value against [0, NVMET_MAX_MDTS] in the store handler and
reject anything out of range with -EINVAL, so the error is reported at
write time and port->mdts never holds a value the port cannot use.
Fixes: 0a5a946486 ("nvmet: introduce new mdts configuration entry")
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
quirks_param_set() reuses 'err', which param_set_copystring() left as 0,
as the return value of the whole function. When nvme_parse_quirk_entry()
fails to parse a field, the code jumps to out_free_qlist and returns that
stale 0, so a malformed quirks= parameter is silently accepted as valid.
Set err to -EINVAL before jumping out on a parse failure.
Fixes: 7bb8c40f5a ("nvme: add support for dynamic quirk configuration via module parameter")
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Daniel Wagner <dwagner@suse.de>
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
__nvme_fc_init_request() maps cmd_iu and then rsp_iu for DMA. If the
rsp_iu mapping fails, the original code only recorded the error and fell
through: it left the already-mapped cmd_iu unmapped and still marked the
op as FCPOP_STATE_IDLE before returning. Since blk-mq does not call
.exit_request() when .init_request() fails, the cmd_iu mapping is leaked
for every op whose rsp_iu mapping fails.
Jump to an error path on rsp_iu mapping failure that unmaps cmd_iu and
returns the error without marking the op idle, so it stays in the
FCPOP_STATE_UNINIT state set by the initial memset().
Fixes: e399441de9 ("nvme-fabrics: Add host support for FC transport")
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
nvmet_execute_get_log_page_rmi() leaves 'status' holding NVME_SC_SUCCESS
(set by the successful nvmet_req_find_ns() call) when the kzalloc() for
the log buffer fails. It then jumps to the out label and completes the
request with a success status, so the host is told the command succeeded
while no data was transferred.
Initialize 'status' to NVME_SC_INTERNAL, matching the smart log handler,
so an allocation failure is reported as an internal error.
Fixes: 5fd075cdaf ("nvmet: implement rotational media information log")
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
1. Fix very old leak of OF node in PMU driver.
2. Few cleanups and new bindings for ExynosAutov920 HSI0 syscon.
-----BEGIN PGP SIGNATURE-----
iQJEBAABCgAuFiEE3dJiKD0RGyM7briowTdm5oaLg9cFAmpnqlgQHGtyemtAa2Vy
bmVsLm9yZwAKCRDBN2bmhouD1+MtD/9M66W36D7KaI9tnHLxVO+2h+VZV73Q9+jI
Siy6LaytoSX9Zz3jYYeLT8AFCm2ykbydGfIWOBw8lWKrc5tSlQhE/zFrl8fcigr6
7xvHbHPoUa/cv8yxDn0v0JPQtnbKyRz6+vNuYPSTGFsLCqavMEPlq3PGNz43j5rG
6TgbpE2HC1K0fhuYMkootj/O4QLVN0RbUbAjYmdbxY35/z5pPq/5lAvOZU9GdI9d
l+rICXNJy9ZMPw9u5HR8IEDiV9dH+Znwk7jkGxIzyDpSxi4FW9jrfui124aqFDCU
qc97cBzYZ1mf7FK1zkfT3KRZ/TaAxl49kxbOB4WzOxDDtZ866ciSN2OGtvMmFlzd
5jnHj7b7hnm5L1U59GPDZD940qNFydK/2cgS1x4bc0aPsT324NxV/m0TuzIro91Z
xwbllGGfHmEC5Rl1WthrrXZPBTkM23KJAdvA9d4M/yPv6tEMJsAkqwKcoiV+wPeQ
hhtuyH2bCw+UZZ7rxN0gAuT8hdj1bexuminZilixCBAZkNymV9njiueipNEL9Hb0
2bfTKE84plPjjQ8ijgoAZ/Sefv/6at51gEwYjWZnX66huzkp3w8pXj2MhkG7lgmv
DC5hWpOU/kFNCamePeQUeJ9hwbdPCy13NDkjmuh0s6Ouzy9DpuIxCmE4U8cID5MQ
x+Rh4YbWPQ==
=xeyD
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmpqFiQACgkQmmx57+YA
GNlYKw/+KxY6PubRpNhKHivaGqFBFgD+GlPaJNRMkFgXYIiUz6CDwnFK0v9XozOr
UfwrfIDGBvdq0XrNJmiRPW68A4PhGV9MP7Tq3iwEFr/hjRCgjylGNe92znzTIHat
oJtB96EdAPd+Dgr5vuZ923yA9t3zGf1Ns5YqlLos7xGWDBzXuAKmQVbf7j7exLg5
FwjabWAwHsf3le13WYsEY4TleqHMYuspLnsIVSQXJwiX4Ex67ndKcwQdIECY7eYs
y7790ofY67mBa2y+JRiybCMCk6KbgBxtbDb1jL/GJ8zde4mpoX7hdJ8u6hMIdOMJ
5lpHL0m31nuKyzIsBAAKcdKJviNL09d8yy+RzU1/DT84kVxz6eFsxfj+NR6inHKE
ZsBZS7oJRoRpMxCLxvnE44PVFCnCuv517CqvDfvEyCMx2pKmUl3C2O1CgE5mIK2n
FqgbuTy4rQLw7pKR3HF+qEyhyHYiuARWftVuXPWf8NHCPNSb37x50HjC4FYJPcOq
rP9fKAlqxHd4CQ0WlUx1J0mmp5USmYj9xbc2aUS/g1bJ1GaWfSuT/a7wZuI57769
HIc2Mqv9G+3LaEd2UNCods7QXW3zZTK80qm8WyEm4PddSX/9K6R/gzCzl0CwMfCe
/qFewzZTL9SJ4F3MRiefc897g7+JMtrg5+xNbZyIInUGJQsR3sA=
=rMXV
-----END PGP SIGNATURE-----
Merge tag 'samsung-drivers-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/drivers
Samsung SoC drivers for v7.3
1. Fix very old leak of OF node in PMU driver.
2. Few cleanups and new bindings for ExynosAutov920 HSI0 syscon.
* tag 'samsung-drivers-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux:
dt-bindings: samsung: exynos-pmu: Narrow allowed reboot modes
dt-bindings: samsung: exynos-pmu: Restrict children with unevaluatedProperties
dt-bindings: soc: samsung: exynos-sysreg: Add hsi0 for ExynosAutov920
soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap()
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
1. Few improvements: STM32 OMM, Tegra MC and JZ4780-nemc.
2. Refactor Tegra MC interconnect code to better represent actual
hardware in multi-socket NUMA cases.
-----BEGIN PGP SIGNATURE-----
iQJEBAABCgAuFiEE3dJiKD0RGyM7briowTdm5oaLg9cFAmpnrDcQHGtyemtAa2Vy
bmVsLm9yZwAKCRDBN2bmhouD1xaMD/wPkFz7Vj8UDRDbMVjdk0VoYmawxFc83r0P
kwdrp7OxSwH7Js+HANgs8zYFYbIRSVFkkHyAi5aekTaXBzXohwdtiW4t3qHynmtX
wBvAF4xZLxLsII+OZU8wbTJw6ZWJscM6AloW1TZPVOiOJ6m7kKBztMkl7US/hwKR
3hbCMT5zXRz/MCniq1cH3hT3KUQLopcT6vclJrz+kaHfoQN6T6TE23teaciKOYUB
tvjQk1eWZ7gRUdqnvflZHTuSyx+VvVxrukIy8d7IljEGEsWDSoQmxfrNTCwRZwrB
OIqVj6+ZhygJKpb/LdxCNjvZqUCiaCr6vlMMhkQ08HHS+EW3tmqkCJuwkoODr2G0
l+EhL24rBJeIQGstRhNV43q4YstCZB5u0ZO7ixxFxdZ74PYDFFLlbxJZ/wyPLaYf
jala4+STTOyuy13eCf90OUPosgPWFGJyb2ouJlZJuquJv4XBzNF/ukguEMDLS0S8
JDOL9WIHIwNd7d2bDwbTS3zL5qvwhFpa2Z2LfjARnLXiZjClzhIR+HCe+lmLSSvr
4sANn7m1ouwKBtBO+WqLgf7tvEY+v5TVwNCHiIsI6t4yxetCp/HUN+1sHiD4hOs0
40IMvl3wM89ET0fLo1VWoN5lC06n0bdREsgstL2AFHcRAnHBaFcldtR3jW8AsyFh
hXvNH/iFdw==
=s70S
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmpqFI4ACgkQmmx57+YA
GNmmRw//WkrjLuFY7GzUoqxrYJe4glU14C956miHhS45Nio+NUN2Aa8ArymsPyl4
vukxkI9Ej6oQGZI5m8CLHDPP7W7yUJ+z3JzCly1QuxkGD7wSUd6/ih7WfWWAPDfD
xUbuk3/h0wal6apCpCUaWEczfn68FTr33fVd24S4VdwA18nYnabXDI/0XXgItg7F
956KUPt7FxOm6XmQB6xrCW4ry2hm2gwo+isMxjDGoIQXaQWPhi6A2ahvpm8ECFvI
bQx8vJZKHz6P9erhPLMxtkTcghaVg2i8aUqQR7cOtGYLkL45XlyNoyRH3FaL34Mg
7neHNg4H/tynyWFt9WEARdpsunJySeUuYpZ5+po5DUXuMUlz0vS2FeOsJ05ocnpR
KRSblMjflHtwYJ4NbCSf8c10TF8bp8Os8JN7wGG7fI9cXbM3/Ih+bWRF275VQuIX
Ko6qCvv4UzcndseAb1NFIYnrKHhaNGb1TmP7bQA59BB43DSrjaUTug99+UVd2HXa
bnMrtxIsu8pRB7mmaiCMtqyoeH+dt8vb/7JGyf6x4Xyqgnme0kAQatMGwqKLXM3y
G06IJqTsbO++xlrkZy0hHriRTFQRC2wIKYd6jqoZ8XZg7k8KvVQYjLoLcDyIqhBc
2vuNtFSBOPiLPLPkA4aYJVwQsuTyfuQBH2LNBy4pOkoU0g+IxyE=
=YFm3
-----END PGP SIGNATURE-----
Merge tag 'memory-controller-drv-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl into soc/drivers
Memory controller drivers for v7.3
1. Few improvements: STM32 OMM, Tegra MC and JZ4780-nemc.
2. Refactor Tegra MC interconnect code to better represent actual
hardware in multi-socket NUMA cases.
* tag 'memory-controller-drv-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl:
memory: jz4780-nemc: Use dev_err_probe() for clock error
memory: tegra: Guard against NULL mc_regs in IRQ handler
memory: tegra: add multi-socket support to the memory interconnect
memory: stm32_omm: initialize ret in stm32_omm_set_amcr
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
panthor_fw_read_build_info() checks whether the metadata range fits in the
firmware image with hdr.meta_start + hdr.meta_size. Both fields are u32, so
the addition can wrap and let an out-of-bounds range pass validation.
The function also reads the "git_sha: " prefix without first checking that
the metadata is long enough, and meta_size == 0 can underflow the NULL
terminator index.
Use subtraction-based bounds checking and reject metadata that is too short
to contain the expected prefix and trailing NULL byte.
Fixes: 2718d91816 ("drm/panthor: Add the FW logical block")
Cc: stable@vger.kernel.org
Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Signed-off-by: Steven Price <steven.price@arm.com>
Link: https://patch.msgid.link/20260720113212.11981-1-osama.abdelkader@gmail.com
Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> says:
I will post Card capsuling patch.
To makes its review easy, tidyup its drivers to reduce
un-related diff as preparation.
No functional change, but is preparation for cleanup driver.
Link: https://patch.msgid.link/87ldb5i0do.wl-kuninori.morimoto.gx@renesas.com
ams_delta_probe() will be updated when Card capsuling.
To makes its review easy, use &pdev->dev instead of card->dev.
These are same
card->dev = &pdev->dev;
No functional change, but is preparation for Card capsuling.
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Link: https://patch.msgid.link/87h5lti0cu.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>
struct snd_soc_card will be capsuled soon, its member will not be
able to access from non soc-card.c.
To reduce the difference during conversion, replace dev.
- card->dev, ...
+ dev, ...
No functional change, but is preparation for Card capsuling.
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Acked-by: Jarkko Nikula <jarkko.nikula@bitmer.com>
Tested-by: Jarkko Nikula <jarkko.nikula@bitmer.com>
Link: https://patch.msgid.link/87ik69i0d0.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Add device tree for the Anbernic RG Vita-Pro, based on the Rockchip
RK3576. All hardware is currently working except for the accelerometer,
the touchscreen, the battery monitor, and DisplayPort over USB-C. PWM
is also missing currently, and as a result the LEDs and panel backlight
are currently controlled via GPIO but will be changed to PWM once
supported.
The Anbernic RG Vita-Pro includes the following hardware:
- A 1080x1920 DSI display with touch.
- 21 buttons.
- 3 LEDs.
- 64GB eMMC, 2 SDMMC slots.
- RTL8852BE WiFi (with Bluetooth via UART)
- 1 USB 3.0 USB-C port in OTG mode.
- 3.5mm headphone jack with play button support.
- 5000mAH battery
The following hardware has incomplete driver support and is not yet
working:
- An Invensense icm42607p accelerometer.
- A Cellwise cw221x battery monitor.
- A Synaptics i2c touchscreen.
- DisplayPort over USB-C alt-mode.
- PWM controller.
- 2 Analog joysticks with LED controllers.
Signed-off-by: Chris Morgan <macromorgan@hotmail.com>
Link: https://patch.msgid.link/20260728203832.166402-5-macroalpha82@gmail.com
[dropped unused pmic pinconfig definitions, sorted nodes]
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Instead of defining the wait values for each driver, use common values
defined in the core pci.h header file. Note that while most drivers use
the usleep_range(), it looks like these were mostly cargo culted and
msleep() is a better choice given the fixed delay that the specification
calls for. Convert all drivers to msleep() and use the existing
definition.
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Reviewed-by: Aksh Garg <a-garg7@ti.com>
Link: https://patch.msgid.link/20260716-tegra264-pcie-v8-3-23e51589229b@nvidia.com
Add compatible string for the Anbernic RG Vita-Pro.
Signed-off-by: Chris Morgan <macromorgan@hotmail.com>
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Link: https://patch.msgid.link/20260728203832.166402-4-macroalpha82@gmail.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
bui duc phuc <phucduc.bui@gmail.com> says:
This series improves probe error handling in the sunxi ASoC drivers.
It replaces suitable probe error paths with dev_err_probe() to
simplify the code and handle deferred probe errors consistently.
It also removes redundant error messages where the called helpers
already report failures, avoiding duplicate log messages.
Build tested only.
Link: https://patch.msgid.link/20260715095525.40668-1-phucduc.bui@gmail.com
Drop the redundant error message after devm_platform_ioremap_resource(),
which already reports failures, and use dev_err_probe() for regmap
initialization errors.
Signed-off-by: bui duc phuc <phucduc.bui@gmail.com>
Reviewed-by: Chen-Yu Tsai <wens@kernel.org>
Link: https://patch.msgid.link/20260715095525.40668-7-phucduc.bui@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Drop the redundant error message after devm_platform_ioremap_resource(),
which already reports failures, and use dev_err_probe() for regmap
initialization errors.
Signed-off-by: bui duc phuc <phucduc.bui@gmail.com>
Reviewed-by: Chen-Yu Tsai <wens@kernel.org>
Link: https://patch.msgid.link/20260715095525.40668-6-phucduc.bui@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Use dev_err_probe() for probe error handling to simplify the error paths
and handle -EPROBE_DEFER correctly.
Signed-off-by: bui duc phuc <phucduc.bui@gmail.com>
Reviewed-by: Chen-Yu Tsai <wens@kernel.org>
Link: https://patch.msgid.link/20260715095525.40668-5-phucduc.bui@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Use dev_err_probe() for probe error handling to simplify the error paths
and handle -EPROBE_DEFER correctly.
Signed-off-by: bui duc phuc <phucduc.bui@gmail.com>
Reviewed-by: Chen-Yu Tsai <wens@kernel.org>
Link: https://patch.msgid.link/20260715095525.40668-4-phucduc.bui@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
The called functions already log failures where appropriate. Return the
original error directly and avoid duplicate error messages.
Signed-off-by: bui duc phuc <phucduc.bui@gmail.com>
Link: https://patch.msgid.link/20260715095525.40668-3-phucduc.bui@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Use dev_err_probe() for probe error handling to simplify the error paths
and handle -EPROBE_DEFER correctly.
Signed-off-by: bui duc phuc <phucduc.bui@gmail.com>
Link: https://patch.msgid.link/20260715095525.40668-2-phucduc.bui@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
ovpn_fill_info emits IFLA_OVPN_MODE inside IFLA_INFO_DATA, but
ovpn_link_ops does not provide a get_size callback. Consequently,
rtnetlink's size estimate for ovpn link messages does not include the
nested mode attribute.
Available skb tailroom may hide this mismatch. When the remaining space
is insufficient, however, ovpn_fill_info returns -EMSGSIZE and message
construction fails.
Add the callback and account for IFLA_OVPN_MODE.
Fixes: c2d950c467 ("ovpn: add basic interface creation/destruction/management routines")
Signed-off-by: Ralf Lici <ralf@mandelbit.com>
Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
Commit 7aa1aa6ece ("QE: Move QE from arch/powerpc to drivers/soc")
moved QE into drivers/soc including gpio.c but left CONFIG_QE_GPIO
in powerpc's Kconfig.
Move it to SoC as well as it is the only place it is used:
drivers/soc/fsl/qe/Makefile:obj-$(CONFIG_QE_GPIO) += gpio.o qe_ports_ic.o
include/soc/fsl/qe/qe.h:#ifdef CONFIG_QE_GPIO
include/soc/fsl/qe/qe.h:#endif /* CONFIG_QE_GPIO */
There is also a dependency in USB subsystem for CONFIG_USB_FHCI_HCD:
drivers/usb/host/Kconfig: depends on QE_GPIO && QUICC_ENGINE
Because that USB driver selects CONFIG_FSL_GTM which is specific to
powerpc, it has to depend on CONFIG_PPC.
Acked-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://lore.kernel.org/r/9a7131d15a94e2017877e628f0e97f9aa2e0aae9.1785140877.git.chleroy@kernel.org
Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
In register_fprobe(), get_ips_from_filter() resolves target function
addresses and increments module reference counts via try_module_get() for
symbols in kernel modules. If get_ips_from_filter() fails on the second
pass and returns an error, register_fprobe() returned directly without
releasing module references acquired up to that point.
Fix this by ensuring the cleanup loop executing module_put() runs even when
get_ips_from_filter() returns a negative error.
Link: https://lore.kernel.org/all/178528125360.101985.4144133640239273153.stgit@devnote2/
Fixes: d24fa977ee ("tracing: fprobe: Fix to lock module while registering fprobe")
Assisted-by: Antigravity:gemini-3.6-flash
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
On a non-range clear, curs.size is never set, so the segment test
(next - va_curs_start > curs->size) returns false for every level > 0
before the clear_pt short-circuit is reached. The clear then descends to
level 0 instead of forming a huge zero-leaf, wasting page tables and
risking -ENOMEM on unbind.
Move the null-VMA, purged-BO and clear_pt short-circuits above the
curs->size test. The bind path always sets curs.size, so it is unaffected.
v2
- Also set curs.size on the clear path so the cursor stays meaningful
during the walk. clear_pt is only reached with range == NULL, so assert
that invariant. (Matthew Brost)
Cc: Matthew Brost <matthew.brost@intel.com>
Fixes: 5b658b7e89 ("drm/xe: Clear scratch page on vm_bind")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Link: https://patch.msgid.link/20260728055916.593707-2-himal.prasad.ghimiray@intel.com
Signed-off-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
(cherry picked from commit 04eeeb45cb)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
The RT5640 GPIO1/IRQ pin can be configured either as GPIO1 or as the
codec interrupt output.
Some boards, such as the Firefly-RK3399, do not connect the codec
interrupt output. This causes the following binding validation warning:
'interrupts' is a required property
Make the interrupts property optional to support such hardware
configurations.
Signed-off-by: Fabio Estevam <festevam@gmail.com>
Link: https://patch.msgid.link/20260727185814.2599488-1-festevam@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Trace point pvr_job_submit_fw() is used to trace job submission to
the FW. Currently it is recorded when a command is written to the Client
circular buffer.
Move trace recording after writing command to the Kernel circular buffer to
better represent command submission to the FW.
Fixes: c1079aebb4 ("drm/imagination: Add support for trace points")
Signed-off-by: Brajesh Gupta <brajesh.gupta@imgtec.com>
Reviewed-by: Alessio Belle <alessio.belle@imgtec.com>
Link: https://patch.msgid.link/20260724-b4-tracepoint-fix-v3-1-8f8e5e8179d3@imgtec.com
Signed-off-by: Alessio Belle <alessio.belle@imgtec.com>
