Commit graph

1,447,411 commits

Author SHA1 Message Date
Lad Prabhakar
abf3502033 soc: renesas: r9a09g056-sys: Mark rzv2n_sys_init_data as __initconst
Annotate rzv2n_sys_init_data with __initconst as it is only used during
initialization.

Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Link: https://patch.msgid.link/20260309165946.3003731-4-prabhakar.mahadev-lad.rj@bp.renesas.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-03-16 11:04:18 +01:00
Lad Prabhakar
71e94c7960 soc: renesas: r9a09g047-sys: Mark rzg3e_sys_init_data as __initconst
Annotate rzg3e_sys_init_data with __initconst as it is only used during
initialization.

Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Reviewed-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20260309165946.3003731-3-prabhakar.mahadev-lad.rj@bp.renesas.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-03-16 11:04:18 +01:00
Lad Prabhakar
a01c4cd7e2 soc: renesas: r9a09g057-sys: Mark rzv2h_sys_init_data as __initconst
Annotate rzv2h_sys_init_data with __initconst as it is only used during
initialization.

Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Link: https://patch.msgid.link/20260309165946.3003731-2-prabhakar.mahadev-lad.rj@bp.renesas.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-03-16 11:04:18 +01:00
Geert Uytterhoeven
d784bbad7f ARM: shmobile: rcar-gen2: Use of_phandle_args_equal() helper
Use the existing of_phandle_args_equal() helper instead of open-coding
the same operation.

Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/d8338ff1fd795912b466ccf55b49dcd6885b6925.1773241833.git.geert+renesas@glider.be
2026-03-16 10:59:59 +01:00
Eric Dumazet
eb2d16a7d5 af_key: validate families in pfkey_send_migrate()
syzbot was able to trigger a crash in skb_put() [1]

Issue is that pfkey_send_migrate() does not check old/new families,
and that set_ipsecrequest() @family argument was truncated,
thus possibly overfilling the skb.

Validate families early, do not wait set_ipsecrequest().

[1]

skbuff: skb_over_panic: text:ffffffff8a752120 len:392 put:16 head:ffff88802a4ad040 data:ffff88802a4ad040 tail:0x188 end:0x180 dev:<NULL>
 kernel BUG at net/core/skbuff.c:214 !
Call Trace:
 <TASK>
  skb_over_panic net/core/skbuff.c:219 [inline]
  skb_put+0x159/0x210 net/core/skbuff.c:2655
  skb_put_zero include/linux/skbuff.h:2788 [inline]
  set_ipsecrequest net/key/af_key.c:3532 [inline]
  pfkey_send_migrate+0x1270/0x2e50 net/key/af_key.c:3636
  km_migrate+0x155/0x260 net/xfrm/xfrm_state.c:2848
  xfrm_migrate+0x2140/0x2450 net/xfrm/xfrm_policy.c:4705
  xfrm_do_migrate+0x8ff/0xaa0 net/xfrm/xfrm_user.c:3150

Fixes: 08de61beab ("[PFKEYV2]: Extension for dynamic update of endpoint address(es)")
Reported-by: syzbot+b518dfc8e021988fbd55@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/69b5933c.050a0220.248e02.00f2.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
2026-03-16 10:58:21 +01:00
Minwoo Ra
29fe3a61bc xfrm: prevent policy_hthresh.work from racing with netns teardown
A XFRM_MSG_NEWSPDINFO request can queue the per-net work item
policy_hthresh.work onto the system workqueue.

The queued callback, xfrm_hash_rebuild(), retrieves the enclosing
struct net via container_of(). If the net namespace is torn down
before that work runs, the associated struct net may already have
been freed, and xfrm_hash_rebuild() may then dereference stale memory.

xfrm_policy_fini() already flushes policy_hash_work during teardown,
but it does not synchronize policy_hthresh.work.

Synchronize policy_hthresh.work in xfrm_policy_fini() as well, so the
queued work cannot outlive the net namespace teardown and access a
freed struct net.

Fixes: 880a6fab8f ("xfrm: configure policy hash table thresholds by netlink")
Signed-off-by: Minwoo Ra <raminwo0202@gmail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
2026-03-16 10:58:21 +01:00
Tejun Heo
618a9db015 sched_ext: Use kobject_put() for kobject_init_and_add() failure in scx_alloc_and_add_sched()
kobject_init_and_add() failure requires kobject_put() for proper cleanup, but
the error paths were using kfree(sch) possibly leaking the kobject name. The
kset_create_and_add() failure was already using kobject_put() correctly.

Switch the kobject_init_and_add() error paths to use kobject_put(). As the
release path puts the cgroup ref, make scx_alloc_and_add_sched() always
consume @cgrp via a new err_put_cgrp label at the bottom of the error chain
and update scx_sub_enable_workfn() accordingly.

Fixes: 17108735b4 ("sched_ext: Use dynamic allocation for scx_sched")
Reported-by: David Carlier <devnexen@gmail.com>
Link: https://lore.kernel.org/r/20260314134457.46216-1-devnexen@gmail.com
Signed-off-by: Tejun Heo <tj@kernel.org>
Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-03-15 23:27:04 -10:00
Tejun Heo
0c66b0da00 sched_ext: Fix cgroup double-put on sub-sched abort path
The abort path in scx_sub_enable_workfn() fell through to out_put_cgrp,
double-putting the cgroup ref already owned by sch->cgrp. It also skipped
kthread_flush_work() needed to flush the disable path.

Relocate the abort block above err_unlock_and_disable so it falls through to
err_disable.

Fixes: 337ec00b1d ("sched_ext: Implement cgroup sub-sched enabling and disabling")
Signed-off-by: Tejun Heo <tj@kernel.org>
Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-03-15 23:26:35 -10:00
Bartosz Golaszewski
09c8ef6236 Merge branch 'gpio/dev-init-rework' into gpio/for-current
Pull in the gpiochip_add_data_with_key() rework addressing resource
leaks in error path.
2026-03-16 10:23:47 +01:00
Srinivas Kandagatla
fc334ad4a1 dt-bindings: pinctrl: qcom,sm8650-lpass-lpi-pinctrl: Add Glymur pinctrl
Document compatible for Qualcomm Glymur SoC LPASS TLMM pin controller,
fully compatible with previous SM8650 generation (same amount of pins
and functions).

Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-03-16 10:11:09 +01:00
Rosen Penev
a6e53d05ab gpio: cs5535: use dynamically allocated priv struct
Static allocation is deprecated.

Remove the FIXME as gpiochip_add_data allows using gpiod_get_data.
No need for container_of.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://patch.msgid.link/20260313001209.117823-1-rosenp@gmail.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-03-16 10:11:02 +01:00
Tzung-Bi Shih
3518fd4c78 Revert "gpio: Access gpio_bus_type in gpiochip_setup_dev()"
This reverts commit cc11f4ef66.

Commit cc11f4ef66 ("gpio: Access `gpio_bus_type` in
gpiochip_setup_dev()") moved the bus type assignment from
gpiochip_add_data_with_key() to gpiochip_setup_dev().

This change introduced a bug where dev_printk() and friends might access
the bus name after gpiochip_add_data_with_key() but before
gpiochip_setup_dev() has run.  In this window, the bus type is not yet
initialized, leading to empty bus names in logs.

Move the bus type assignment back to gpiochip_add_data_with_key() to
ensure the bus name is available before any potential users like
dev_printk().

Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
Closes: https://lore.kernel.org/all/CAMuHMdU0Xb=Moca5LUex+VxyHQa2-uYJgYf4hzHiSEjDCQQT=Q@mail.gmail.com/
Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
Link: https://patch.msgid.link/20260313054112.1248074-1-tzungbi@kernel.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-03-16 10:10:02 +01:00
Linus Walleij
7673e4c7f7 Do not enable the v1 uAPI by default
It's been five years since we introduced the v2 uAPI and
the major consumer libgpiod is at v2.2.3.

Let's discourage the old ABI.

Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Reviewed-by: Kent Gibson <warthog618@gmail.com>
Link: https://patch.msgid.link/20260314-no-y-uapi1-default-v2-1-578f09c91b8f@kernel.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-03-16 10:08:09 +01:00
Alban Bedel
a25f48fd92 gpio: kempld: Implement the interrupt controller
Add a GPIO IRQ chip implementation for the kempld GPIO controller. Of
note is only how the parent IRQ is obtained.

The IRQ for the GPIO controller can be configured in the BIOS, along
with the IRQ for the I2C controller. These IRQ are returned by ACPI
but this information is only usable if both IRQ are configured. When
only one is configured, only one is returned making it impossible to
know which one it is.

Luckily the BIOS will set the configured IRQ in the PLD registers, so
it can be read from there instead, and that also work on platforms
without ACPI.

The vendor driver allowed to override the IRQ using a module
parameters, so there are boards in field which used this parameter
instead of properly configuring the BIOS. This implementation provides
this as well for compatibility.

Signed-off-by: Alban Bedel <alban.bedel@lht.dlh.de>
Link: https://patch.msgid.link/20260311143120.2179347-5-alban.bedel@lht.dlh.de
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-03-16 10:05:33 +01:00
Alban Bedel
2443c2e122 gpio: kempld: Add support for get/set multiple
As the bus accesses are quiet slow with this device, supporting the
get/set multiple API can help with performences. The implementation
tries to keep the number of bus access to a minimum by checking
the mask to only read or write the needed bytes.

Signed-off-by: Alban Bedel <alban.bedel@lht.dlh.de>
Link: https://patch.msgid.link/20260311143120.2179347-4-alban.bedel@lht.dlh.de
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-03-16 10:05:33 +01:00
Alban Bedel
84cb463d2f gpio: kempld: Add support for PLD version >= 2.8
Starting with version 2.8 there is a dedicated register to configure
the output level. Read the PLD version in the probe and select the
correct register to use for the set operations.

Signed-off-by: Alban Bedel <alban.bedel@lht.dlh.de>
Link: https://patch.msgid.link/20260311143120.2179347-3-alban.bedel@lht.dlh.de
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-03-16 10:05:32 +01:00
Alban Bedel
4071437cd2 gpio: kempld: Simplify the bit level register accesses
The hardware uses 8 bit registers but supports configurations with up
to 16 GPIO, so all GPIO registers come in pairs. Most accesses to
single bits is done using the kempld_gpio_bitop() and
kempld_gpio_get_bit() functions, which take a register index and bit
offset as parameter. These functions apply a modulo on the bit offset
but leave the register index as is, so callers have to use an
additional macro to fix the register index before the call.

Simplify things by also handling the register index offsetting in the
bitop functions.

Signed-off-by: Alban Bedel <alban.bedel@lht.dlh.de>
Link: https://patch.msgid.link/20260311143120.2179347-2-alban.bedel@lht.dlh.de
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-03-16 10:05:32 +01:00
Jani Nikula
9876394f64 drm/{i915,xe}: move framebuffer bo to parent interface
Add .framebuffer_init, .framebuffer_fini and .framebuffer_lookup to the
bo parent interface. While they're about framebuffers, they're
specifically about framebuffer objects, so the bo interface is a good
enough fit, and there's no need to add another interface struct.

Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com>
Link: https://patch.msgid.link/848d32a44bf844cba3d66e44ba9f20bea4a8352d.1773238670.git.jani.nikula@intel.com
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-03-16 11:00:21 +02:00
Jani Nikula
a65c06a948 drm/i915/fb: make intel_fb_bo.c less dependent on display
intel_fb_bo.c is i915 core specific code, and should use struct
drm_i915_private instead of struct intel_display.

Switch one DISPLAY_VER() to GRAPHICS_VER(). The check is for < 4, where
they're effectively the same thing.

Reviewed-by: Suraj Kandpal@intel.com>
Link: https://patch.msgid.link/13087bd24bd5af5265ca6af67f086b93e26e311f.1773238670.git.jani.nikula@intel.com
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-03-16 11:00:21 +02:00
Jani Nikula
37a6ed2c28 drm/{i915, xe}/bo: move display bo calls to parent interface
Continue i915 and xe separation from display by moving the bo calls to
the display parent interface. Instead of adding all these functions to
intel_parent.[ch], reuse the now vacated intel_bo.[ch], and avoid mass
renames to calls of these functions. This is similar to
intel_display_rpm.[ch].

Make many of the hooks optional to avoid having to implement dummy
functions in xe. Indeed now we can remove many of the existing dummy
functions.

Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com>
Link: https://patch.msgid.link/7899eef2ccf0cd603df69099df065226a0df917b.1773238670.git.jani.nikula@intel.com
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-03-16 11:00:21 +02:00
Jani Nikula
49464bb697 drm/xe: rename intel_bo.c to xe_display_bo.c
Follow the xe_ prefixed file naming in xe. With xe_bo.[ch] already being
a thing in xe core, use xe_display_bo.c.

Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com>
Link: https://patch.msgid.link/2f73eda5117462407f12113ce096496282ee3fcc.1773238670.git.jani.nikula@intel.com
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-03-16 11:00:21 +02:00
Jani Nikula
e3ef2c2117 drm/i915: move i915 specific bo implementation to i915
The bo interface implementation is different for both i915 and xe. Move
the i915 specific implementation from display to i915 core.

Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com>
Link: https://patch.msgid.link/e159166d623899996a51a577365ca7ab9b1a0974.1773238670.git.jani.nikula@intel.com
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-03-16 11:00:21 +02:00
Linus Walleij
803e822b00 gpiolib: Update gpiochip_find_base_unlocked() kerneldoc
This function albeit static was lacking a kerneldoc, and the
function returns a dangerous number for internal use so make
that clear in the kerneldoc.

Reported-by: Matthijs Kooijman <matthijs@stdin.nl>
Signed-off-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20260311-gpio-discourage-dynamic-v1-1-c8b68fc84203@kernel.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-03-16 09:53:25 +01:00
Richard Lyu
8a3613898f gpio: max732x: use guard(mutex) to simplify locking
Convert the max732x driver to use the RAII-based guard(mutex) macro from
<linux/cleanup.h>. This change replaces manual mutex_lock() and
mutex_unlock() calls, allowing the chip lock to be managed automatically
based on function scope.

Refactor max732x_gpio_set_mask() and max732x_irq_update_mask() to
improve code readability. This allows for direct returns and removes
the redundant 'out' label in the set_mask function, resulting in
cleaner and more maintainable code.

While at it: order includes alphabetically and add missing ones.

Signed-off-by: Richard Lyu <richard.lyu@suse.com>
Link: https://patch.msgid.link/20260311085924.191288-1-richard.lyu@suse.com
[Bartosz: tweak commit message, add err.h and device.h to includes]
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-03-16 09:52:51 +01:00
Bartosz Golaszewski
696e9ba9a3 gpio: sim: allow to define the active-low setting of a simulated hog
Add a new configfs attribute to the hog group allowing to configure the
active-low lookup flag for hogged lines. This will allow us to extend
tests to also cover the line config of hogs set up using software nodes.

Reviewed-by: Linus Walleij <linusw@kernel.org>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/20260309-gpio-hog-fwnode-v2-6-4e61f3dbf06a@oss.qualcomm.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-03-16 09:51:07 +01:00
Bartosz Golaszewski
dea046e7f4 gpio: remove machine hogs
With no more users, remove legacy machine hog API from the kernel.

Reviewed-by: Linus Walleij <linusw@kernel.org>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/20260309-gpio-hog-fwnode-v2-5-4e61f3dbf06a@oss.qualcomm.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-03-16 09:51:06 +01:00
Bartosz Golaszewski
e627fc9fad ARM: omap1: ams-delta: convert GPIO hogs to using firmware nodes
Setup a software node hierarchy for the latch2 GPIO controller defining
the required hog and stop using legacy machine hog API.

Acked-by: Kevin Hilman <khilman@baylibre.com>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/20260309-gpio-hog-fwnode-v2-4-4e61f3dbf06a@oss.qualcomm.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-03-16 09:51:06 +01:00
Bartosz Golaszewski
5cfbd0eb78 gpio: sim: use fwnode-based GPIO hogs
Convert gpio-sim to using software nodes for setting up simulated hogs
instead of legacy machine hogs.

Reviewed-by: Linus Walleij <linusw@kernel.org>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/20260309-gpio-hog-fwnode-v2-3-4e61f3dbf06a@oss.qualcomm.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-03-16 09:51:06 +01:00
Bartosz Golaszewski
d1d564ec49 gpio: move hogs into GPIO core
Refactor line hogging code by moving the parts duplicated in
gpiolib-acpi-core.c and gpiolib-of.c into gpiolib.c, leaving just the
OF-specific bits in the latter.

This makes fwnode the primary API for setting up hogs and allows to use
software nodes in addition to ACPI and OF nodes.

Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/20260309-gpio-hog-fwnode-v2-2-4e61f3dbf06a@oss.qualcomm.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-03-16 09:51:05 +01:00
Bartosz Golaszewski
bbee90e750 gpio: of: clear OF_POPULATED on hog nodes in remove path
The previously set OF_POPULATED flag should be cleared on the hog nodes
when removing the chip.

Cc: stable@vger.kernel.org
Fixes: 63636d956c ("gpio: of: Add DT overlay support for GPIO hogs")
Acked-by: Linus Walleij <linusw@kernel.org>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/20260309-gpio-hog-fwnode-v2-1-4e61f3dbf06a@oss.qualcomm.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-03-16 09:51:05 +01:00
Damien Le Moal
ce5ae93d1a ata: libata-core: disable LPM on ADATA SU680 SSD
ADATA SU680 SSDs suffer from NCQ read and write commands timeouts or bus
errors when link power management (LPM) is enabled. Flag these devices
with the ATA_QUIRK_NOLPM quirk to prevent the use of LPM and avoid these
command failures.

Reported-by: Mohammad Khaled Bayan <mhd.khaled.bayan@gmail.com>
Closes: https://bugs.launchpad.net/ubuntu/+source/linux-hwe-6.17/+bug/2144060
Cc: stable@vger.kernel.org
Tested-by: Mohammad-Khaled Bayan <mhd.khaled.bayan@gmail.com>
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Niklas Cassel <cassel@kernel.org>
2026-03-16 09:05:18 +01:00
Imre Deak
ac57eb3b7d drm/i915/dmc: Fix an unlikely NULL pointer deference at probe
intel_dmc_update_dc6_allowed_count() oopses when DMC hasn't been
initialized, and dmc is thus NULL.

That would be the case when the call path is
intel_power_domains_init_hw() -> {skl,bxt,icl}_display_core_init() ->
gen9_set_dc_state() -> intel_dmc_update_dc6_allowed_count(), as
intel_power_domains_init_hw() is called *before* intel_dmc_init().

However, gen9_set_dc_state() calls intel_dmc_update_dc6_allowed_count()
conditionally, depending on the current and target DC states. At probe,
the target is disabled, but if DC6 is enabled, the function is called,
and an oops follows. Apparently it's quite unlikely that DC6 is enabled
at probe, as we haven't seen this failure mode before.

It is also strange to have DC6 enabled at boot, since that would require
the DMC firmware (loaded by BIOS); the BIOS loading the DMC firmware and
the driver stopping / reprogramming the firmware is a poorly specified
sequence and as such unlikely an intentional BIOS behaviour. It's more
likely that BIOS is leaving an unintentionally enabled DC6 HW state
behind (without actually loading the required DMC firmware for this).

The tracking of the DC6 allowed counter only works if starting /
stopping the counter depends on the _SW_ DC6 state vs. the current _HW_
DC6 state (since stopping the counter requires the DC5 counter captured
when the counter was started). Thus, using the HW DC6 state is incorrect
and it also leads to the above oops. Fix both issues by using the SW DC6
state for the tracking.

This is v2 of the fix originally sent by Jani, updated based on the
first Link: discussion below.

Link: https://lore.kernel.org/all/3626411dc9e556452c432d0919821b76d9991217@intel.com
Link: https://lore.kernel.org/all/20260228130946.50919-2-ltao@redhat.com
Fixes: 88c1f9a4d3 ("drm/i915/dmc: Create debugfs entry for dc6 counter")
Cc: Mohammed Thasleem <mohammed.thasleem@intel.com>
Cc: Jani Nikula <jani.nikula@linux.intel.com>
Cc: Tao Liu <ltao@redhat.com>
Cc: <stable@vger.kernel.org> # v6.16+
Tested-by: Tao Liu <ltao@redhat.com>
Reviewed-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Imre Deak <imre.deak@intel.com>
Link: https://patch.msgid.link/20260309164803.1918158-1-imre.deak@intel.com
(cherry picked from commit 2344b93af8)
Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
2026-03-16 09:41:15 +02:00
Dave Airlie
02e778f123 amd-drm-next-7.1-2026-03-12:
amdgpu:
 - SMU13 fix
 - SMU14 fix
 - Fixes for bring up hw testing
 - Kerneldoc fix
 - GC12 idle power fix for compute workloads
 - DCCG fixes
 - UserQ fixes
 - Move test for fbdev object to a generic helper
 - GC 12.1 updates
 - Use struct drm_edid in non-DC code
 - Include IP discovery data in devcoredump
 - SMU 13.x updates
 - Misc cleanups
 - DML 2.1 fixes
 - Enable NV12/P010 support on primary planes
 - Enable color encoding and color range on overlay planes
 - DC underflow fixes
 - HWSS fast path fixes
 - Replay fixes
 - DCN 4.2 updates
 - Support newer IP discovery tables
 - LSDMA 7.1 support
 - IH 7.1 fixes
 - SoC v1 updates
 - GC12.1 updates
 - PSP 15 updates
 - XGMI fixes
 - GPUVM locking fix
 
 amdkfd:
 - Fix missing BO unreserve in an error path
 
 radeon:
 - Move test for fbdev object to a generic helper
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQQgO5Idg2tXNTSZAr293/aFa7yZ2AUCabMItwAKCRC93/aFa7yZ
 2BiwAQD3yQsA6xuspaMXduQwFE0tu6rL6bB+NSB7bfM2YYdE1AEAqi2GQPOlfohH
 DK/zb58ZPoeJfCdShPPQ85cSkPSu2wY=
 =OtzL
 -----END PGP SIGNATURE-----

Merge tag 'amd-drm-next-7.1-2026-03-12' of https://gitlab.freedesktop.org/agd5f/linux into drm-next

amd-drm-next-7.1-2026-03-12:

amdgpu:
- SMU13 fix
- SMU14 fix
- Fixes for bring up hw testing
- Kerneldoc fix
- GC12 idle power fix for compute workloads
- DCCG fixes
- UserQ fixes
- Move test for fbdev object to a generic helper
- GC 12.1 updates
- Use struct drm_edid in non-DC code
- Include IP discovery data in devcoredump
- SMU 13.x updates
- Misc cleanups
- DML 2.1 fixes
- Enable NV12/P010 support on primary planes
- Enable color encoding and color range on overlay planes
- DC underflow fixes
- HWSS fast path fixes
- Replay fixes
- DCN 4.2 updates
- Support newer IP discovery tables
- LSDMA 7.1 support
- IH 7.1 fixes
- SoC v1 updates
- GC12.1 updates
- PSP 15 updates
- XGMI fixes
- GPUVM locking fix

amdkfd:
- Fix missing BO unreserve in an error path

radeon:
- Move test for fbdev object to a generic helper

From: Alex Deucher <alexander.deucher@amd.com>
Link: https://patch.msgid.link/20260312184425.3875669-1-alexander.deucher@amd.com
Signed-off-by: Dave Airlie <airlied@redhat.com>
2026-03-16 16:50:53 +10:00
Zong-Zhe Yang
a1488456f7 wifi: rtw89: debug: simulate Wi-Fi 7 SER L0/L1 without PS mode
Current triggers of Wi-Fi 7 SER (system error recovery) L0/L1 simulation
don't yet guarantee working with PS mode. So, leave PS mode first before
triggering them for now.

Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260310080146.31113-14-pkshih@realtek.com
2026-03-16 14:23:05 +08:00
Po-Hao Huang
45ba9226b1 wifi: rtw89: Recalculate station aggregates when AMSDU length changes for MLO links
Currently, AMSDU length is updated per-link for MLO but not propagated
to the station aggregates, causing suboptimal TX throughput. This change
ensures station aggregates are recalculated when any link's AMSDU length
changes.

Signed-off-by: Po-Hao Huang <phhuang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260310080146.31113-13-pkshih@realtek.com
2026-03-16 14:22:52 +08:00
Po-Hao Huang
bda294ed0e wifi: rtw89: Drop malformed AMPDU frames with abnormal PN
Fix connection issue caused by AMPDU frames with abnormal PN patterns
(out-of-order packets with correct MPDU sequence numbers but paired
with abnormal PN values, which is next PN of previous in-order packet).
This is causing packet drops, low throughput and disconnections. It is
observed in fields with some specific AP firmwares. Do this workaround for
better interoperability since some APs could never receive a proper FW
update.

Signed-off-by: Po-Hao Huang <phhuang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260310080146.31113-12-pkshih@realtek.com
2026-03-16 14:21:16 +08:00
Zong-Zhe Yang
829b89c2b0 wifi: rtw89: replace RF mutex with wiphy lock assertion
Now, stack has introduced wiphy lock. And, the normal paths calling
RF read/write should be under wiphy lock. So, replace RF mutex with
wiphy lock assertion. Besides, in dbgfs paths, add the corresponding
lock option.

Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260310080146.31113-11-pkshih@realtek.com
2026-03-16 14:19:37 +08:00
Chin-Yen Lee
72dbc78594 wifi: rtw89: wow: add retry for ensuring packet are processed
Before entering WoWLAN mode, the driver must ensure that
all received packets have been processed to prevent packet
loss. Consequently, a retry mechanism has been implemented
to guarantee completion.

Signed-off-by: Chin-Yen Lee <timlee@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260310080146.31113-10-pkshih@realtek.com
2026-03-16 14:18:29 +08:00
Zong-Zhe Yang
cf3cd3687d wifi: rtw89: chan: recalc MLO DBCC mode based on current entity mode
Since MLD vif can do MLSR switch, it may not always run on HW band 0.
But when preparing MCC for MLD + P2P, P2P vif needs to use HW band 0
to handle connection, i.e. uses of HW bands may be different by vif.

The current major role/vif can be indicated through entity mode. So,
based on it, recalculate MLO DBCC mode to change use of HW band.

Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260310080146.31113-9-pkshih@realtek.com
2026-03-16 14:18:19 +08:00
Zong-Zhe Yang
2fed8de4eb wifi: rtw89: chan: simplify link handling related to ROC
The original channel is swapped out for the target channel during ROC.
And, all vifs/links accessing the original channel will be marked with
off-channel. So, it doesn't seem necessary for chan.c to determine which
link instance it is.

Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260310080146.31113-8-pkshih@realtek.com
2026-03-16 14:16:43 +08:00
Zong-Zhe Yang
4516621686 wifi: rtw89: tweak settings of TX power and channel for Wi-Fi 7
The support_mlo flag depends on FW features, so it's determined at runtime.
Since Wi-Fi 7 chip now needs to initialize second HW band, if support_mlo
is not allowed, second HW band might act without settings of TX power and
channel. So, set that for Wi-Fi 7 chip.

Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260310080146.31113-7-pkshih@realtek.com
2026-03-16 14:16:31 +08:00
Zong-Zhe Yang
be28b2c4ee wifi: rtw89: move disabling dynamic mechanism functions to core
Some dynamic mechanism (DM) may need to be disabled during some normal
processes rather than debugging. For example, should not do MLSR switch
during SCAN/ROC or even MCC. So, move the disabling DM functions to core
for impending uses.

No logic changes.

Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260310080146.31113-6-pkshih@realtek.com
2026-03-16 14:14:54 +08:00
Ping-Ke Shih
84f5e0eaf8 wifi: rtw89: phy: limit AMPDU number for RA try rate
When RA (Rate Adaptive) does try higher rate, a TRY bit is flagged, and
hardware will reference registers configured by this patch as maximum
number of AMPDU. To prevent aggregate too many MPDU over peer's capability
causing loss in peer side, set the minimum values across all stations and
TID since there is single one register per hardware band. Consider MLD
case, a BA session can run across two hardware bands, so set the same
value as well.

Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260310080146.31113-5-pkshih@realtek.com
2026-03-16 14:13:26 +08:00
Ping-Ke Shih
9a38ef92aa wifi: rtw89: mac: remove A-die off setting for RTL8852C and RTL8922A
Fix timing issue of A-die off followed by XTAL off. Otherwise, device might
get lost potentially.

Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260310080146.31113-4-pkshih@realtek.com
2026-03-16 14:13:13 +08:00
Ping-Ke Shih
177520960c wifi: rtw89: pci: update SER parameters for suspend/resume
In suspend mode, SER timer unit is different from normal mode. Set proper
value to prevent expected SER happened during suspend.

Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260310080146.31113-3-pkshih@realtek.com
2026-03-16 14:12:49 +08:00
Jaime Saguillo Revilla
e1b6b5af5d wifi: rtlwifi: rtl8192d: fix typo in H2C wait counter names
Rename local variables in rtl92d_fill_h2c_cmd()
from wait_writeh2c_limmit/wait_h2c_limmit
to wait_writeh2c_limit/wait_h2c_limit.

No functional change.

Signed-off-by: Jaime Saguillo Revilla <jaime.saguillo@gmail.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260308111850.20420-1-jaime.saguillo@gmail.com
2026-03-16 14:10:04 +08:00
Johan Hovold
fc25b384fc wifi: rtlwifi: usb: drop redundant device reference
Driver core holds a reference to the USB interface and its parent USB
device while the interface is bound to a driver and there is no need to
take additional references unless the structures are needed after
disconnect.

Drop the redundant device reference to reduce cargo culting, make it
easier to spot drivers where an extra reference is needed, and reduce
the risk of memory leaks when drivers fail to release it.

Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260309083336.16397-1-johan@kernel.org
2026-03-16 14:06:11 +08:00
Johan Hovold
c2a21f35ce wifi: rtw89: drop redundant device reference
Driver core holds a reference to the USB interface and its parent USB
device while the interface is bound to a driver and there is no need to
take additional references unless the structures are needed after
disconnect.

Drop the redundant device reference to reduce cargo culting, make it
easier to spot drivers where an extra reference is needed, and reduce
the risk of memory leaks when drivers fail to release it.

Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260306093206.21081-1-johan@kernel.org
2026-03-16 14:03:39 +08:00
Johan Hovold
bbb15e7115 wifi: rtw88: fix device leak on probe failure
Driver core holds a reference to the USB interface and its parent USB
device while the interface is bound to a driver and there is no need to
take additional references unless the structures are needed after
disconnect.

This driver takes a reference to the USB device during probe but does
not to release it on all probe errors (e.g. when descriptor parsing
fails).

Drop the redundant device reference to fix the leak, reduce cargo
culting, make it easier to spot drivers where an extra reference is
needed, and reduce the risk of further memory leaks.

Fixes: a82dfd33d1 ("wifi: rtw88: Add common USB chip support")
Reported-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://lore.kernel.org/netdev/2026022319-turbofan-darkened-206d@gregkh/
Cc: stable@vger.kernel.org	# 6.2
Cc: Sascha Hauer <s.hauer@pengutronix.de>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260306085144.12064-19-johan@kernel.org
2026-03-16 14:00:10 +08:00
Johan Hovold
711b8add39 wifi: rtl8xxxu: drop redundant device reference
Driver core holds a reference to the USB interface and its parent USB
device while the interface is bound to a driver and there is no need to
take additional references unless the structures are needed after
disconnect.

Drop the redundant device reference to reduce cargo culting, make it
easier to spot drivers where an extra reference is needed, and reduce
the risk of memory leaks when drivers fail to release it.

Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260306085144.12064-18-johan@kernel.org
2026-03-16 13:59:59 +08:00