Commit graph

1,463,462 commits

Author SHA1 Message Date
Linus Probert
d845a18746 staging: rtl8723bs: rename rtw_btcoex_LPS_Leave to rtw_btcoex_lps_leave
Renames rtw_btcoex_LPS_Leave to rtw_btcoex_lps_leave in order to conform
to kernel code style.

Found using checkpatch.pl.

Signed-off-by: Linus Probert <linus.probert@gmail.com>
Reviewed-by: Luka Gejak <luka.gejak@linux.dev>
Link: https://patch.msgid.link/20260427173857.585742-9-linus.probert@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04 16:48:59 +02:00
Linus Probert
45b3b8bffa staging: rtl8723bs: rtw_btcoex_LPS_Enter() -> rtw_btcoex_lps_enter()
Renames rtw_btcoex_LPS_Enter to rtw_btcoex_lps_enter in order to conform
to kernel code style.

Found using checkpatch.pl.

Signed-off-by: Linus Probert <linus.probert@gmail.com>
Reviewed-by: Luka Gejak <luka.gejak@linux.dev>
Link: https://patch.msgid.link/20260427173857.585742-8-linus.probert@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04 16:48:59 +02:00
Linus Probert
3018c91026 staging: rtl8723bs: rename rtw_btcoex_RejectApAggregatedPacket()
Renames rtw_btcoex_RejectApAggregatedPacket to
rtw_btcoex_reject_ap_aggregated_packet in order to conform to kernel
code style.

Found using checkpatch.pl.

Signed-off-by: Linus Probert <linus.probert@gmail.com>
Reviewed-by: Luka Gejak <luka.gejak@linux.dev>
Link: https://patch.msgid.link/20260427173857.585742-7-linus.probert@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04 16:48:59 +02:00
Linus Probert
c8e50e93c0 staging: rtl8723bs: rtw_btcoex_HaltNotify() -> rtw_btcoex_halt_notify()
Renames function rtw_btcoex_HaltNotify to rtw_btcoex_halt_notify in
order to conform to kernel code style.

Found using checkpatch.pl.

Signed-off-by: Linus Probert <linus.probert@gmail.com>
Reviewed-by: Luka Gejak <luka.gejak@linux.dev>
Link: https://patch.msgid.link/20260427173857.585742-6-linus.probert@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04 16:48:59 +02:00
Linus Probert
5b7921d385 staging: rtl8723bs: rename rtw_btcoex_media_status_notify definition arg
Renames rtw_btcoex_media_status_notify_definition argument mediaStatus
to media_status in order to conform to kernel code style.

This was found using checkpatch.pl

Signed-off-by: Linus Probert <linus.probert@gmail.com>
Reviewed-by: Luka Gejak <luka.gejak@linux.dev>
Link: https://patch.msgid.link/20260427173857.585742-5-linus.probert@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04 16:48:59 +02:00
Linus Probert
b55686cb84 staging: rtl8723bs: rename rtw_btcoex_MediaStatusNotify()
Renames function rtw_btcoex_MediaStatusNotify to
rtw_btcoex_media_status_notify which removes CamelCase in order to
conform to kernel code style.

Issue found using checkpatch.pl

Signed-off-by: Linus Probert <linus.probert@gmail.com>
Reviewed-by: Luka Gejak <luka.gejak@linux.dev>
Link: https://patch.msgid.link/20260427173857.585742-4-linus.probert@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04 16:48:59 +02:00
Linus Probert
e045a83f98 staging: rtl8723bs: add function definition arg names to rtw_btcoex.h
Adds function definition argument names to rtw_btcoex.h in order to
conform to kernel code style. This eliminates warnings generated by
checkpatch.pl.

In all cases it's the 'struct adapter *' argument which has been given
the name 'padapter'. This matches the names used in the implementations
of these functions.

Signed-off-by: Linus Probert <linus.probert@gmail.com>
Reviewed-by: Luka Gejak <luka.gejak@linux.dev>
Link: https://patch.msgid.link/20260427173857.585742-3-linus.probert@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04 16:48:40 +02:00
Linus Probert
0752f1f4db staging: rtl8723bs: remove blank line in rtw_btcoex.h
Removes redundant blank line in rtw_btcoex.h.
Found using checkpatch.pl.

Signed-off-by: Linus Probert <linus.probert@gmail.com>
Reviewed-by: Luka Gejak <luka.gejak@linux.dev>
Link: https://patch.msgid.link/20260427173857.585742-2-linus.probert@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04 16:48:40 +02:00
Maha Maryam Javaid
fa093d85bd staging: rtl8723bs: fix typo in rtw_pwrctrl.c
Fix spelling mistake: willl -> will

Signed-off-by: Maha Maryam Javaid <mahamaryamjavaid@gmail.com>
Reviewed-by: Luka Gejak <luka.gejak@linux.dev>
Link: https://patch.msgid.link/20260429034156.11523-1-mahamaryamjavaid@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04 16:48:28 +02:00
Miguel Cyrineu Vale
7b07c48f8e staging: rtl8723bs: replace NULL comparison with NOT operator
Fix checkpatch error "Comparison to NULL could be written "!psta"" in
ioctl_cfg80211.c:2432

Signed-off-by: Miguel Cyrineu Vale <miguelcvalealt@gmail.com>
Reviewed-by: Luka Gejak <luka.gejak@linux.dev>
Link: https://patch.msgid.link/20260427193759.71642-1-miguelcvalealt@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04 16:47:58 +02:00
Kory Maincent (TI)
2a46a9356b drm/bridge: tda998x: Use __be32 for audio port OF property pointer
of_get_property() returns a pointer to big-endian (__be32) data, but
port_data in tda998x_get_audio_ports() was declared as const u32 *,
causing a sparse endianness type mismatch warning. Fix the declaration
to use const __be32 *.

Fixes: 7e567624dc ("drm/i2c: tda998x: Register ASoC hdmi-codec and add audio DT binding")
Cc: stable@vger.kernel.org
Signed-off-by: Kory Maincent (TI) <kory.maincent@bootlin.com>
Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Link: https://patch.msgid.link/20260428090457.121894-1-kory.maincent@bootlin.com
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
2026-05-04 16:42:54 +02:00
Christian König
d4c14903bf dma-buf/dma_fence_array: remove unused functionality v4
Amdgpu was the only user of the signal on any feature and we dropped
that use case recently, so we can remove that functionality.

v2: update num_pending only after the fence is signaled
v3: separate out simplifying dma_fence_array implementation
v4: fix XE patch split fallout

Signed-off-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Link: https://lore.kernel.org/r/20260422103012.1647-1-christian.koenig@amd.com
2026-05-04 16:28:14 +02:00
Eric Wu
90a7073e8a staging: octeon: convert cvmx_pip_port_status_t from typedef to plain struct
The Linux kernel coding style discourages the use of typedefs for
structs. Convert cvmx_pip_port_status_t to a plain 'struct
cvmx_pip_port_status' and update all users across the MIPS Octeon
architecture code and the staging driver.

No functional change.

Signed-off-by: Eric Wu <kunjinkao.jp@gmail.com>
Link: https://patch.msgid.link/20260427155427.668540-8-kunjinkao.jp@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04 16:21:34 +02:00
Eric Wu
32c681e669 staging: octeon: convert cvmx_pko_port_status_t from typedef to plain struct
The Linux kernel coding style discourages the use of typedefs for
structs. Convert cvmx_pko_port_status_t to a plain 'struct
cvmx_pko_port_status' and update all users across the MIPS Octeon
architecture code and the staging driver.

No functional change.

Signed-off-by: Eric Wu <kunjinkao.jp@gmail.com>
Link: https://patch.msgid.link/20260427155427.668540-7-kunjinkao.jp@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04 16:21:34 +02:00
Eric Wu
95147c0f62 staging: octeon: convert cvmx_pko_status_t from typedef to plain enum
The Linux kernel coding style discourages the use of typedefs for
enums. Convert cvmx_pko_status_t to a plain 'enum cvmx_pko_status' and
update all users across the MIPS Octeon architecture code and the
staging driver stubs.

No functional change.

Signed-off-by: Eric Wu <kunjinkao.jp@gmail.com>
Link: https://patch.msgid.link/20260427155427.668540-6-kunjinkao.jp@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04 16:21:34 +02:00
Eric Wu
8b804dad84 staging: octeon: convert cvmx_pko_lock_t from typedef to plain enum
The Linux kernel coding style discourages the use of typedefs for
enums. Convert cvmx_pko_lock_t to a plain 'enum cvmx_pko_lock' and
update all users across the MIPS Octeon architecture code and the
staging driver stubs.

No functional change.

Signed-off-by: Eric Wu <kunjinkao.jp@gmail.com>
Link: https://patch.msgid.link/20260427155427.668540-5-kunjinkao.jp@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04 16:21:34 +02:00
Eric Wu
3711d19ae0 staging: octeon: convert cvmx_pow_wait_t from typedef to plain enum
The Linux kernel coding style discourages the use of typedefs for
enums. Convert cvmx_pow_wait_t to a plain 'enum cvmx_pow_wait' and
update all users across the MIPS Octeon architecture code and the
staging driver stubs.

No functional change.

Signed-off-by: Eric Wu <kunjinkao.jp@gmail.com>
Link: https://patch.msgid.link/20260427155427.668540-4-kunjinkao.jp@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04 16:21:34 +02:00
Eric Wu
1397bb27f4 staging: octeon: convert cvmx_helper_interface_mode_t from typedef to plain enum
The Linux kernel coding style discourages the use of typedefs for
enums. Convert cvmx_helper_interface_mode_t to a plain 'enum
cvmx_helper_interface_mode' and update all users across the MIPS
Octeon architecture code and the staging driver stubs.

No functional change.

Signed-off-by: Eric Wu <kunjinkao.jp@gmail.com>
Link: https://patch.msgid.link/20260427155427.668540-3-kunjinkao.jp@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04 16:21:34 +02:00
Eric Wu
4f44225a9b staging: octeon: convert cvmx_spi_mode_t from typedef to plain enum
The Linux kernel coding style discourages the use of typedefs for
enums. Convert cvmx_spi_mode_t to a plain 'enum cvmx_spi_mode' and
update all users across the MIPS Octeon architecture code and the
staging driver stubs.

This is part of a series converting all remaining enum typedefs in
the octeon subsystem to plain enums, improving compliance with the
kernel coding style.

No functional change.

Signed-off-by: Eric Wu <kunjinkao.jp@gmail.com>
Link: https://patch.msgid.link/20260427155427.668540-2-kunjinkao.jp@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04 16:21:34 +02:00
Shyam Sunder Reddy Padira
4776aefb5a staging: most: dim2: remove filename from comment blocks
Remove redundant filename references from top-of-file
comment blocks across dim2 source files to resolve
checkpatch.pl warnings.

The filename is already implied by the file path and
including it in comments can become outdated.

No functional changes.

Signed-off-by: Shyam Sunder Reddy Padira <shyamsunderreddypadira@gmail.com>
Link: https://patch.msgid.link/20260503104447.64657-1-shyamsunderreddypadira@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04 16:17:58 +02:00
Maha Maryam Javaid
24b42bcd06 staging: greybus: fix typo in sysfs-bus-greybus
Fix spelling mistake: attibute -> attribute

Signed-off-by: Maha Maryam Javaid <mahamaryamjavaid@gmail.com>
Link: https://patch.msgid.link/20260429033816.11282-1-mahamaryamjavaid@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04 16:17:55 +02:00
Ahmet Sezgin Duran
593df953f6 staging: sm750fb: remove double space in fb_ops entries
Remove extra space after '=' in .fb_check_var assignments.

Signed-off-by: Ahmet Sezgin Duran <ahmet@sezginduran.net>
Link: https://patch.msgid.link/20260428204416.55374-1-ahmet@sezginduran.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04 16:17:26 +02:00
Shyam Sunder Reddy Padira
b6c1f5d3ff staging: most: video: remove filename from the top-of-file comment
Remove the filename reference from top-of-file comment,
to resolve checkpatch.pl warning. The filename can become
outdated if the file is renamed.

No functional change.

Signed-off-by: Shyam Sunder Reddy Padira <shyamsunderreddypadira@gmail.com>
Link: https://patch.msgid.link/20260427175636.4605-1-shyamsunderreddypadira@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04 16:17:21 +02:00
Alexandru Hossu
fb2ae75b1a staging: nvec: fix unconditional pm_power_off teardown
tegra_nvec_remove() unconditionally sets pm_power_off = NULL, even if
nvec was not the one that registered it. This breaks any other driver
that may have set pm_power_off to its own handler.

Replace the unconditional assignment with a guarded check so that
pm_power_off is only cleared if nvec was the one that set it.

Also remove the stale FIXME comment, as the guard addresses exactly
what it was asking for.

Reviewed-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
Link: https://patch.msgid.link/20260427081713.3401874-3-hossu.alexandru@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04 16:17:10 +02:00
Alexandru Hossu
2681388118 staging: nvec: fix use-after-free in nvec_rx_completed()
In nvec_rx_completed(), when an incomplete RX transfer is detected,
nvec_msg_free() is called to return the message back to the pool by
clearing its 'used' atomic flag. Immediately after this, the code
accesses nvec->rx->data[0] to check the message type.

Since nvec_msg_free() marks the pool slot as available via atomic_set(),
any concurrent or subsequent call to nvec_msg_alloc() could claim that
same slot and overwrite its data[] array. Reading nvec->rx->data[0] after
freeing the message is therefore a use-after-free.

Fix this by saving the message type byte before calling nvec_msg_free(),
then using the saved value for the battery quirk check.

Fixes: d6bdcf2e10 ("staging: nvec: Add battery quirk to ignore incomplete responses")
Reviewed-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
Link: https://patch.msgid.link/20260427081713.3401874-2-hossu.alexandru@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04 16:17:10 +02:00
Hungyu Lin
070e099a40 staging: sm750fb: fix typo in comment
Fix typo in a comment.

Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
Link: https://patch.msgid.link/20260427060420.1076-1-dennylin0707@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04 16:16:42 +02:00
Hungyu Lin
785ad91332 staging: sm750fb: propagate error codes from de_wait()
The sm750 acceleration functions currently return -1 when
de_wait() fails, discarding the original error code.

Since de_wait() now returns proper errno values, propagate
the error code instead of returning -1.

Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
Link: https://patch.msgid.link/20260427054657.758-3-dennylin0707@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04 16:15:48 +02:00
Hungyu Lin
2381baa4a9 staging: sm750fb: return -ETIMEDOUT on timeout in de_wait functions
The hw_sm750le_de_wait() and hw_sm750_de_wait() functions return -1
when a timeout occurs. Replace these with -ETIMEDOUT to use a proper
errno value and better describe the error condition.

All callers check the return value as non-zero, so this change does
not alter existing behavior.

Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
Link: https://patch.msgid.link/20260427054657.758-2-dennylin0707@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04 16:15:47 +02:00
Maksym Pikhotskyi
13d883fa23 staging: rtl8723bs: reduce nesting in rtw_security.c
Improve readability of functions:
rtw_tkip_encrypt, rtw_tkip_decrypt, rtw_aes_encrypt
in rtw_security.c by adding early returns for the
encryption type check and the stainfo null check.

Signed-off-by: Maksym Pikhotskyi <mpikhotskyi@gmail.com>
Reviewed-by: Luka Gejak <luka.gejak@linux.dev>
Link: https://patch.msgid.link/20260417095452.23440-2-mpikhotskyi@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04 16:15:40 +02:00
Maksym Pikhotskyi
9a3f9b3c47 staging: rtl8723bs: fix stainfo check in rtw_aes_decrypt
The null-pointer-guard was incorrect, returning _FAIL on valid pointer.
Invert the guard, so it returns _FAIL on invalid pointer.

Fixes: e23ad15700 ("staging: rtl8723bs: use guard clause for stainfo check")
Reported-by: Luka Gejak <luka.gejak@linux.dev>
Closes: https://lore.kernel.org/linux-staging/E4BF62EF-C6F6-431F-8EDC-77C1E613E66B@linux.dev/
Reviewed-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Maksym Pikhotskyi <mpikhotskyi@gmail.com>
Reviewed-by: Luka Gejak <luka.gejak@linux.dev>
Link: https://patch.msgid.link/20260417095452.23440-1-mpikhotskyi@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04 16:15:40 +02:00
Jiri Slaby (SUSE)
d748603f12 wifi: ath5k: do not access array OOB
Vincent reports:
> The ath5k driver seems to do an array-index-out-of-bounds access as
> shown by the UBSAN kernel message:
> UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath5k/base.c:1741:20
> index 4 is out of range for type 'ieee80211_tx_rate [4]'
> ...
> Call Trace:
>  <TASK>
>  dump_stack_lvl+0x5d/0x80
>  ubsan_epilogue+0x5/0x2b
>  __ubsan_handle_out_of_bounds.cold+0x46/0x4b
>  ath5k_tasklet_tx+0x4e0/0x560 [ath5k]
>  tasklet_action_common+0xb5/0x1c0

It is real. 'ts->ts_final_idx' can be 3 on 5212, so:
   info->status.rates[ts->ts_final_idx + 1].idx = -1;
with the array defined as:
   struct ieee80211_tx_rate rates[IEEE80211_TX_MAX_RATES];
while the size is:
   #define IEEE80211_TX_MAX_RATES  4
is indeed bogus.

Set this 'idx = -1' sentinel only if the array index is less than the
array size. As mac80211 will not look at rates beyond the size
(IEEE80211_TX_MAX_RATES).

Note: The effect of the OOB write is negligible. It just overwrites the
next member of info->status, i.e. ack_signal.

Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org>
Reported-by: Vincent Danjean <vdanjean@debian.org>
Link: https://lore.kernel.org/all/aQYUkIaT87ccDCin@eldamar.lan
Closes: https://bugs.debian.org/1119093
Fixes: 6d7b97b23e ("ath5k: fix tx status reporting issues")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20251209100459.2253198-1-jirislaby@kernel.org
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-05-04 07:15:20 -07:00
Baochen Qiang
0e1308803d wifi: ath12k: fix peer_id usage in normal RX path
ath12k_dp_rx_deliver_msdu() currently uses hal_rx_desc_data::peer_id
parsed from mpdu_start descriptor to do peer lookup. However In an A-MSDU
aggregation scenario, hardware only populates mpdu_start descriptor for
the first sub-msdu, but not the following ones. In that case peer_id could
be invalid, leading to peer lookup failure:

ath12k_wifi7_pci 0000:06:00.0: rx skb 00000000c391c041 len 1532 peer (null) 0 ucast sn 0 eht320 rate_idx 12 vht_nss 2 freq 6105 band 3 flag 0x40d1a fcs-err 0 mic-err 0 amsdu-more 0

As a result pubsta is NULL and parts of ieee80211_rx_status structure are
left uninitialized, which may cause unexpected behavior.

Fix it by switching the normal RX path to use ath12k_skb_rxcb::peer_id
which is parsed from REO ring's rx_mpdu_desc and is always valid.

hal_rx_desc_data::peer_id is still used in
ath12k_wifi7_dp_rx_frag_h_mpdu(), which is safe since A-MSDU
aggregation does not occur for fragmented frames. Similarly,
ath12k_skb_rxcb::peer_id may be overwritten by hal_rx_desc_data::peer_id
in ath12k_wifi7_dp_rx_h_mpdu(), which only handles non-aggregated
multicast/broadcast traffic.

Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3

Fixes: 11157e0910 ("wifi: ath12k: Use ath12k_dp_peer in per packet Tx & Rx paths")
Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Link: https://patch.msgid.link/20260427-ath12k-fix-peer-id-source-v1-1-b5f701fb8e88@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-05-04 07:15:20 -07:00
Rameshkumar Sundaram
81594a12d5 wifi: ath12k: initialize RSSI dBm conversion event state
Currently, the RSSI dBm conversion event handler leaves struct
ath12k_wmi_rssi_dbm_conv_info_arg uninitialized on the stack before
calling the TLV parser. If one of the optional sub-TLVs is absent, the
corresponding *_present flag retains stack garbage and later gets read
in ath12k_wmi_update_rssi_offsets(). With UBSAN enabled this triggers an
invalid-load report for _Bool:

UBSAN: invalid-load in drivers/net/wireless/ath/ath12k/wmi.c:9682:15
load of value 9 is not a valid value for type '_Bool'
Call Trace:
 ath12k_wmi_rssi_dbm_conversion_params_info_event.cold+0x72/0x85 [ath12k]
 ath12k_wmi_op_rx+0x1871/0x2ab0 [ath12k]
 ath12k_htc_rx_completion_handler+0x44b/0x810 [ath12k]
 ath12k_ce_recv_process_cb+0x554/0x9f0 [ath12k]
 ath12k_ce_per_engine_service+0xbe/0xf0 [ath12k]
 ath12k_pci_ce_workqueue+0x69/0x120 [ath12k]

Initialize the parsed event state to zero before passing it to the TLV
parser so missing sub-TLVs correctly leave the presence flags false.

Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1

Fixes: 0314ee81a9 ("wifi: ath12k: handle WMI event for real noise floor calculation")
Signed-off-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20260427103011.2983269-1-rameshkumar.sundaram@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-05-04 07:15:20 -07:00
Nicolas Escande
05c5078de8 wifi: ath12k: fix leak in some ath12k_wmi_xxx() functions
Some wmi functions were using plain 'return ath12k_wmi_cmd_send(...)'
without explicitly handling the error code. This leads to leaking the skb
in case of error.

Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00218-QCAHKSWPL_SILICONZ-1

Fixes: 66a9448b1b ("wifi: ath12k: implement hardware data filter")
Fixes: 5931741709 ("wifi: ath12k: implement WoW enable and wakeup commands")
Fixes: 4a3c212eee ("wifi: ath12k: add basic WoW functionalities")
Fixes: 16f474d6d4 ("wifi: ath12k: add WoW net-detect functionality")
Fixes: 1666108c74 ("wifi: ath12k: support ARP and NS offload")
Fixes: aab4ae566f ("wifi: ath12k: support GTK rekey offload")
Fixes: 7af01e5695 ("wifi: ath12k: handle keepalive during WoWLAN suspend and resume")
Signed-off-by: Nicolas Escande <nico.escande@gmail.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
Link: https://patch.msgid.link/20260422163258.3013872-1-nico.escande@gmail.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-05-04 07:15:19 -07:00
Laurent Pinchart
a1b6cf8e5e drm: uapi: Use SPDX in DRM core uAPI headers
The DRM core uAPI headers are licensed under the MIT license, and carry
copies of the license with slight variations. Replace them with SPDX
headers.

Following a discussion with Simona Vetter on this topic, add a
clarification in the drm-uapi.rst file that independent closed-source
userspace implementations of software using the DRM uAPI are accepted,
as allowed by the MIT license.

Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Simona Vetter <simona.vetter@ffwll.ch>
Reviewed-by: Dave Airlie <airlied@redhat.com>
Link: https://patch.msgid.link/20260407104951.1781047-1-laurent.pinchart+renesas@ideasonboard.com
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
2026-05-04 17:14:18 +03:00
David Carlier
7b0b68b2b9
mm/memfd_luo: document preservation of file seals
Commit 8a552d68a8 ("mm: memfd_luo: preserve file seals") started
preserving file seals across live update and restoring them via
memfd_add_seals() on retrieve, but the DOC header was not updated and
still listed seals under "Non-Preserved Properties" as being unsealed
on restore.

Move the Seals entry to the "Preserved Properties" section and describe
the actual behavior, including the MEMFD_LUO_ALL_SEALS restriction that
both preserve and retrieve enforce.

Fixes: 8a552d68a8 ("mm: memfd_luo: preserve file seals")
Signed-off-by: David Carlier <devnexen@gmail.com>
Reviewed-by: Pratyush Yadav <pratyush@kernel.org>
Reviewed-by: Pasha Tatashin <pasha.tatashin@soleen.com>
Link: https://patch.msgid.link/20260423125648.152113-2-devnexen@gmail.com
Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
2026-05-04 14:03:16 +00:00
David Carlier
d581fc99d3
mm/memfd_luo: reject memfds whose page count exceeds UINT_MAX
memfd_luo_preserve_folios() declares max_folios as unsigned int and
computes it from the inode size, then passes it to memfd_pin_folios()
which itself caps max_folios at unsigned int.  For files whose base-page
count exceeds UINT_MAX (larger than 16 TiB with 4 KiB pages), the
assignment truncates silently: only a prefix of the file gets pinned and
preserved, while memfd_luo_preserve() still records the full inode size
in ser->size.  On retrieve the inode is restored to the full size but
only the preserved prefix repopulates the page cache, so the tail comes
back as holes and user data is silently lost across the live update.

Reject such files at preserve time with -EFBIG rather than chunk the
pin loop, which would also require enlarging the preserved folios array
well beyond what is practical.

Fixes: b3749f174d ("mm: memfd_luo: allow preserving memfd")
Signed-off-by: David Carlier <devnexen@gmail.com>
Reviewed-by: Pasha Tatashin <pasha.tatashin@soleen.com>
Reviewed-by: Pratyush Yadav <pratyush@kernel.org>
Link: https://patch.msgid.link/20260423125648.152113-1-devnexen@gmail.com
Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
2026-05-04 14:03:15 +00:00
Rosen Penev
87eee18f29 mtd: sm_ftl: allocate cis_buffer with main struct
Use a flexible array member and kzalloc_flex() to do so. Simplifies
memory allocation slightly.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-05-04 15:50:47 +02:00
Miquel Raynal
9e3997d3ab mtd: spinand: Prevent continuous reads on some controllers
Some controllers do not have full control over the CS line state and may
deassert it under certain conditions in the middle of a (long)
transfer.

Continuous reads are stopped with a CS deassert, hence both features
cannot live together.

Whenever a controller flags that it cannot maintain the CS state
reliably, disable continuous reads entirely.

Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-05-04 15:27:03 +02:00
Miquel Raynal
7845161ede mtd: spinand: Make sure continuous read is always disabled during probe
Recent changes made sure whenever we were using continuous reads, we
would first start by disabling the feature to ensure a well proven and
stable probe sequence. For development purposes, it might also matter to
make sure we always disable continuous reads at first, in case the ECC
configuration would change. Doing this "automatically" will become even
more relevant when we add extra controller flags to prevent continuous
reads at all.

Ensure we disable continuous reads if the feature is available on the
chip, regardless of whether it will be used or not.

Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-05-04 15:27:03 +02:00
Marco Crivellari
cd4fe814f3 drm/bridge: replace use of system_wq with system_percpu_wq
Currently if a user enqueue a work item using schedule_delayed_work() the
used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use
WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to
schedule_work() that is using system_wq and queue_work(), that makes use
again of WORK_CPU_UNBOUND.

This lack of consistentcy cannot be addressed without refactoring the API.

This patch continues the effort to refactor worqueue APIs, which has begun
with the change introducing new workqueues and a new alloc_workqueue flag:

commit 128ea9f6cc ("workqueue: Add system_percpu_wq and system_dfl_wq")
commit 930c2ea566 ("workqueue: Add new WQ_PERCPU flag")

system_wq should be the per-cpu workqueue, yet in this name nothing makes
that clear, so replace system_wq with system_percpu_wq.

The old wq (system_wq) will be kept for a few release cycles.

Suggested-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Marco Crivellari <marco.crivellari@suse.com>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patch.msgid.link/20251104111339.128685-1-marco.crivellari@suse.com
2026-05-04 15:26:10 +02:00
Miquel Raynal
e1ff8802ac mtd: spinand: winbond: Add support for continuous reads on W25NxxJW
As for the W35NxxJW family, add support for W25N{01,02}JW continuous
read support. Similar operations require to be done, such as setting a
specific bit in a configuration register, and providing a set of read
variants without the address cycles.

As read from cache variants are badly supported by SPI memory
controllers, we create a new set of read from cache templates with a
fake address cycle and just enough dummy cycles. There are two
unsupported configurations (which would require 4.5 dummy bytes), so we
just do not provide them.

The same extra value in the ECC is possible as with the W35NxxJW family,
so we reference the same helper to retrieve the ECC status.

Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
---
All variants have been validated on a Nuvoton MA35D1 platform.
2026-05-04 15:25:12 +02:00
Miquel Raynal
ca842a62fe mtd: spinand: winbond: Create a helper to detect the need for the HS bit
The logic is not complex but might be reused to cleanup a bit the
section by moving it to a dedicated helper.

Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-05-04 15:25:12 +02:00
Miquel Raynal
240e65cb44 mtd: spinand: winbond: Create a helper to write the HS bit
Updating the HS bit is not complex but implies reading, setting/clearing
a bit and writing. Clean a bit this section by moving this logic in its
own helper.

Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-05-04 15:25:12 +02:00
Miquel Raynal
5e85bff62b mtd: spinand: winbond: Add support for continuous reads on W35NxxJW
W35N{01,02,04}JW support being read continuously under certain
circumstances. A bit must be set in their configuration register, and
a specific read from cache operation, a bit shorter than usual because
it no longer requires the address cycles, must be used for the occasion.

Setting the "enable" bit is already supported by the core, aside from
the subtlety of making sure the HFREQ bit is also set in octal DTR mode
above 90MHz. However, handling two different read from cache templates
involves creating a list of read from cache variants adapted the
continuous reads, ie. without address cycles.

Unfortunately, these operations, despite being very close to their
original read from cache cousins, are often unsupported by smart SPI
controller drivers because reading from cache historically allowed
changing the offset at which the host would start by providing a 2-byte
column address. In order to prevent issues with this, it has been
decided to implement these variants with a single "ignored" address byte
(respectively two in the octal DTR case), further reducing the amount of
dummy cycles needed before the first bit of data.

Enabling continuous reads has a side effect: the ECC status register now
may also return the value b11, which means that more than 1
uncorrectable error happened during the read. This non standard
behaviour requires to re-implement, almost identically the "get ECC"
helper from the core, with just an extra case for this value (it is
prefixed "w25w35nxxjw" because all these chips have the same behaviour).

Speed gain is substantial, see below. The flash_speed -C benchmark has
been run on a TI AM62A7 LP SK with CPU power management disabled,
mounted with a W35N01JW chip.

1S-8S-8S:

     1 page read speed is 15058 KiB/s
     2 page read speed is 15058 KiB/s
     3 page read speed is 16800 KiB/s
     4 page read speed is 17066 KiB/s
     5 page read speed is 18461 KiB/s
     6 page read speed is 18461 KiB/s
     7 page read speed is 19384 KiB/s
     8 page read speed is 19692 KiB/s
     9 page read speed is 19384 KiB/s
     10 page read speed is 20000 KiB/s
     11 page read speed is 20000 KiB/s
     12 page read speed is 20000 KiB/s
     13 page read speed is 20800 KiB/s
     14 page read speed is 20363 KiB/s
     15 page read speed is 20000 KiB/s
     16 page read speed is 19692 KiB/s
     32 page read speed is 19692 KiB/s
     64 page read speed is 19692 KiB/s

8D-8D-8D:

     1 page read speed is 23272 KiB/s
     2 page read speed is 23272 KiB/s
     3 page read speed is 28000 KiB/s
     4 page read speed is 32000 KiB/s
     5 page read speed is 34285 KiB/s
     6 page read speed is 34285 KiB/s
     7 page read speed is 36000 KiB/s
     8 page read speed is 36571 KiB/s
     9 page read speed is 36000 KiB/s
     10 page read speed is 34285 KiB/s
     11 page read speed is 36666 KiB/s
     12 page read speed is 40000 KiB/s
     13 page read speed is 41600 KiB/s
     14 page read speed is 37333 KiB/s
     15 page read speed is 40000 KiB/s
     16 page read speed is 36571 KiB/s
     32 page read speed is 42666 KiB/s
     64 page read speed is 42666 KiB/s

Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
---
Not all configurations have been tested/validated yet.
2026-05-04 15:25:02 +02:00
Mark Brown
50c2f0f086
ASoC: Improve SDCA support for duplicated features
Charles Keepax <ckeepax@opensource.cirrus.com> says:

There are some short comings of the current SDCA class driver with
respect to duplicated functions and jacks. Fix some issues in the
reporting of jacks when there are multiple jacks represented in the SDCA
topology. When a single device contains multiple instances of the same
type of SDCA function the current class driver will create duplicate
controls, update the code to fix this. Finally whilst working through
this also tidy up the handling of the sdca_function_desc pointers as it
turns out some duplication has crept into the code on that front.
2026-05-04 22:24:44 +09:00
Charles Keepax
250922577e
ASoC: SDCA: Support devices with multiple functions of identical type
It is possible that SDCAs devices might have multiple functions of
the same type, as the entity names within a function are defined by
the specification it is very likely such a device will have duplicate
entities. This causes problems where DAIs and ALSA controls end up
with clashing names.

This can be handled by adding the function address into the names to
ensure uniqueness, although, ideally this would have been included from
the start. User-space already has UCM using the current control names,
so as a compromise the first function of a given type will use the
raw entity names, then duplicates will get an added function address.

Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev>
Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://patch.msgid.link/20260430150931.2025953-4-ckeepax@opensource.cirrus.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2026-05-04 22:24:42 +09:00
Charles Keepax
df036250d7
ASoC: SDCA: Remove sdca_function_data duplication
The class driver internally has an array of sdca_function_data pointers
that it uses to store the parsed DisCo data. However, there is already
an sdca_function_data attached to the auxdev device. It makes more sense
to use the one already provided in the auxdev device, as it could also
be used by custom drivers for parts that require those.

Using the auxdev copy also prevents the need for the class function
drivers to search through the array for the correct data, which
currently is based off matching the function type. This has problems
when two functions have the same type as the current code will find the
same data for both drivers, using the auxdev copy of the data avoids
this problem.

Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev>
Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://patch.msgid.link/20260430150931.2025953-3-ckeepax@opensource.cirrus.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2026-05-04 22:24:41 +09:00
Charles Keepax
cb3c257e08
ASoC: SDCA: Add correct masks whilst reporting SDCA jack status
Currently, all SDCA jacks simply report against a mask of 0xFFFF. This
works fine for system with a single SDCA jack control as the status
reflects that single control at all times. However, if two SDCA
jack controls exist in the system, such as a separate representation for
input and output, then the second control can cancel reports from the
other since it will only report its relevant bits and zero in all other
slots. This is exactly what the mask is for.

Build up a mask using all the possible states for an SCDA jack control
at registration time and use that mask when reporting a particular jack.
It is worth noting this still doesn't handle cases such as two headphone
jacks as that would require separate ALSA jacks to report to.

Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev>
Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://patch.msgid.link/20260430150931.2025953-2-ckeepax@opensource.cirrus.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2026-05-04 22:24:40 +09:00
Miquel Raynal
e1c172bbe1 mtd: spinand: winbond: Add support for continuous reads on W25NxxJW
As for the W35NxxJW family, add support for W25N{01,02}JW continuous
read support. Similar operations require to be done, such as setting a
specific bit in a configuration register, and providing a set of read
variants without the address cycles.

As read from cache variants are badly supported by SPI memory
controllers, we create a new set of read from cache templates with a
fake address cycle and just enough dummy cycles. There are two
unsupported configurations (which would require 4.5 dummy bytes), so we
just do not provide them.

The same extra value in the ECC is possible as with the W35NxxJW family,
so we reference the same helper to retrieve the ECC status.

Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-05-04 15:23:57 +02:00