linux/drivers/accel/qaic, branch master

accel/qaic: Handle DBC deactivation if the owner went away

2026-03-27T16:48:30Z

When a DBC is released, the device sends a QAIC_TRANS_DEACTIVATE_FROM_DEV transaction to the host over the QAIC_CONTROL MHI channel. QAIC handles this by calling decode_deactivate() to release the resources allocated for that DBC. Since that handling is done in the qaic_manage_ioctl() context, if the user goes away before receiving and handling the deactivation, the host will be out-of-sync with the DBCs available for use, and the DBC resources will not be freed unless the device is removed. If another user loads and requests to activate a network, then the device assigns the same DBC to that network, QAIC will "indefinitely" wait for dbc->in_use = false, leading the user process to hang. As a solution to this, handle QAIC_TRANS_DEACTIVATE_FROM_DEV transactions that are received after the user has gone away. Fixes: 129776ac2e38 ("accel/qaic: Add control path") Signed-off-by: Youssef Samir Reviewed-by: Lizhi Hou Reviewed-by: Jeff Hugo Signed-off-by: Jeff Hugo Link: https://patch.msgid.link/20260205123415.3870898-1-youssef.abdulrahman@oss.qualcomm.com

Convert more 'alloc_obj' cases to default GFP_KERNEL arguments

2026-02-22T04:03:00Z

This converts some of the visually simpler cases that have been split over multiple lines. I only did the ones that are easy to verify the resulting diff by having just that final GFP_KERNEL argument on the next line. Somebody should probably do a proper coccinelle script for this, but for me the trivial script actually resulted in an assertion failure in the middle of the script. I probably had made it a bit _too_ trivial. So after fighting that far a while I decided to just do some of the syntactically simpler cases with variations of the previous 'sed' scripts. The more syntactically complex multi-line cases would mostly really want whitespace cleanup anyway. Signed-off-by: Linus Torvalds

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-22T01:09:51Z

This was done entirely with mindless brute force, using git grep -l '\

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21T09:02:28Z

This is the result of running the Coccinelle script from scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to avoid scalar types (which need careful case-by-case checking), and instead replace kmalloc-family calls that allocate struct or union object instances: Single allocations: kmalloc(sizeof(TYPE), ...) are replaced with: kmalloc_obj(TYPE, ...) Array allocations: kmalloc_array(COUNT, sizeof(TYPE), ...) are replaced with: kmalloc_objs(TYPE, COUNT, ...) Flex array allocations: kmalloc(struct_size(PTR, FAM, COUNT), ...) are replaced with: kmalloc_flex(*PTR, FAM, COUNT, ...) (where TYPE may also be *VAR) The resulting allocations no longer return "void *", instead returning "TYPE *". Signed-off-by: Kees Cook

net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels

2025-12-31T10:54:04Z

MHI stack offers the 'auto_queue' feature, which allows the MHI stack to auto queue the buffers for the RX path (DL channel). Though this feature simplifies the client driver design, it introduces race between the client drivers and the MHI stack. For instance, with auto_queue, the 'dl_callback' for the DL channel may get called before the client driver is fully probed. This means, by the time the dl_callback gets called, the client driver's structures might not be initialized, leading to NULL ptr dereference. Currently, the drivers have to workaround this issue by initializing the internal structures before calling mhi_prepare_for_transfer_autoqueue(). But even so, there is a chance that the client driver's internal code path may call the MHI queue APIs before mhi_prepare_for_transfer_autoqueue() is called, leading to similar NULL ptr dereference. This issue has been reported on the Qcom X1E80100 CRD machines affecting boot. So to properly fix all these races, drop the MHI 'auto_queue' feature altogether and let the client driver (QRTR) manage the RX buffers manually. In the QRTR driver, queue the RX buffers based on the ring length during probe and recycle the buffers in 'dl_callback' once they are consumed. This also warrants removing the setting of 'auto_queue' flag from controller drivers. Currently, this 'auto_queue' feature is only enabled for IPCR DL channel. So only the QRTR client driver requires the modification. Fixes: 227fee5fc99e ("bus: mhi: core: Add an API for auto queueing buffers for DL channel") Fixes: 68a838b84eff ("net: qrtr: start MHI channel after endpoit creation") Reported-by: Johan Hovold Closes: https://lore.kernel.org/linux-arm-msm/ZyTtVdkCCES0lkl4@hovoldconsulting.com Suggested-by: Chris Lew Signed-off-by: Manivannan Sadhasivam Reviewed-by: Jeff Hugo Reviewed-by: Loic Poulain Acked-by: Jeff Johnson # drivers/net/wireless/ath/... Acked-by: Jeff Hugo Acked-by: Paolo Abeni Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251218-qrtr-fix-v2-1-c7499bfcfbe0@oss.qualcomm.com

accel/qaic: Add qaic_ prefix to irq_polling_work

2025-11-07T18:27:46Z

Rename irq_polling_work to qaic_irq_polling_work to reduce ambiguity and avoid potential naming conflicts in the future. Signed-off-by: Zack McKevitt Reviewed-by: Jeff Hugo Signed-off-by: Jeff Hugo Link: https://patch.msgid.link/20251031192511.3179130-1-zachary.mckevitt@oss.qualcomm.com

accel/qaic: Collect crashdump from SSR channel

2025-11-07T18:16:51Z

After subsystem of the device has crashed it sends a message with command DEBUG_TRANSFER_INFO to kernel(host). Send ACK for that message and then prepare to collect the ramdump of the subsystem Steps of crashdump collection is as follows, 1) Device sends DEBUG_TRANSFER_INFO message indicating that device wants to send crashdump. 2) Send an acknowledgment to that message either ACK or NACK. a) NACK will inform the device that host will not download the crashdump b) ACK will inform the device that host will download the crashdump 3) Along with the DEBUG_TRANSFER_INFO we receive a table base address and its length, use that to download that table from device. a) This table is meta data of the crashdump and not the actual crashdump. 4) After we respond as ACK for message received on step 1) we start downloading the table. Use series of MEMORY_READ/MEMORY_READ_RSP SSR commands to download the entire table. 5) Each entry in the table represents a segment of crashdump. Once the table downloading is complete, iterate through each entry of table and download each crashdump segment(same as table itself). Table entry contains the memory base address and length along with other info. 6) After the entire crashdump is downloaded send DEBUG_TRANSFER_DONE which marks that host is terminating the crashdump transfer. This message can be send in both success or error case. 7) After receiving DEBUG_TRANSFER_DONE_RSP hand over the crashdump to dev_coredumpv() and free all the necessary memory. Co-developed-by: Jeffrey Hugo Signed-off-by: Jeffrey Hugo Co-developed-by: Pranjal Ramajor Asha Kanojiya Signed-off-by: Pranjal Ramajor Asha Kanojiya Signed-off-by: Pranjal Ramajor Asha Kanojiya Signed-off-by: Youssef Samir Signed-off-by: Zack McKevitt Reviewed-by: Jeff Hugo Signed-off-by: Jeff Hugo Link: https://patch.msgid.link/20251031174059.2814445-4-zachary.mckevitt@oss.qualcomm.com

accel/qaic: Implement basic SSR handling

2025-11-07T18:01:18Z

Subsystem restart (SSR) for a qaic device means that a NSP has crashed, and will be restarted. However the restart process will lose any state associated with activation, so the user will need to do some recovery. While SSR has the provision to collect a crash dump, this patch does not implement support for it. Co-developed-by: Jeffrey Hugo Signed-off-by: Jeffrey Hugo Co-developed-by: Pranjal Ramajor Asha Kanojiya Signed-off-by: Pranjal Ramajor Asha Kanojiya Co-developed-by: Troy Hanson Signed-off-by: Troy Hanson Co-developed-by: Aswin Venkatesan Signed-off-by: Aswin Venkatesan Signed-off-by: Jeffrey Hugo Signed-off-by: Youssef Samir Signed-off-by: Zack McKevitt Reviewed-by: Jeff Hugo [jhugo: Fix minor checkpatch whitespace issues] Signed-off-by: Jeff Hugo Link: https://patch.msgid.link/20251031174059.2814445-3-zachary.mckevitt@oss.qualcomm.com

accel/qaic: Add DMA Bridge Channel(DBC) sysfs and uevents

2025-11-07T17:55:39Z

Expose sysfs files for each DBC representing the current state of that DBC. For example, sysfs for DBC ID 0 and accel minor number 0 looks like this, /sys/class/accel/accel0/dbc0_state Following are the states and their corresponding values, DBC_STATE_IDLE (0) DBC_STATE_ASSIGNED (1) DBC_STATE_BEFORE_SHUTDOWN (2) DBC_STATE_AFTER_SHUTDOWN (3) DBC_STATE_BEFORE_POWER_UP (4) DBC_STATE_AFTER_POWER_UP (5) Signed-off-by: Pranjal Ramajor Asha Kanojiya Signed-off-by: Youssef Samir Signed-off-by: Zack McKevitt Reviewed-by: Jeff Hugo Signed-off-by: Jeff Hugo Link: https://patch.msgid.link/20251031174059.2814445-2-zachary.mckevitt@oss.qualcomm.com

accel/qaic: Add support for PM callbacks

2025-11-05T22:41:43Z

Add initial support for suspend and hibernation PM callbacks to QAIC. The device can be suspended any time in which the data path is not busy as queued I/O operations are lost on suspension and cannot be resumed after suspend. Signed-off-by: Youssef Samir Reviewed-by: Carl Vanderlip Signed-off-by: Zack McKevitt Reviewed-by: Jeff Hugo Signed-off-by: Jeff Hugo Link: https://patch.msgid.link/20251029181808.1216466-1-zachary.mckevitt@oss.qualcomm.com