kernel/linux.git/drivers/accel/qaic, branch v6.19.12

accel/qaic: Handle DBC deactivation if the owner went away

2026-04-11T12:29:36+00:00

[ Upstream commit 2feec5ae5df785658924ab6bd91280dc3926507c ] When a DBC is released, the device sends a QAIC_TRANS_DEACTIVATE_FROM_DEV transaction to the host over the QAIC_CONTROL MHI channel. QAIC handles this by calling decode_deactivate() to release the resources allocated for that DBC. Since that handling is done in the qaic_manage_ioctl() context, if the user goes away before receiving and handling the deactivation, the host will be out-of-sync with the DBCs available for use, and the DBC resources will not be freed unless the device is removed. If another user loads and requests to activate a network, then the device assigns the same DBC to that network, QAIC will "indefinitely" wait for dbc->in_use = false, leading the user process to hang. As a solution to this, handle QAIC_TRANS_DEACTIVATE_FROM_DEV transactions that are received after the user has gone away. Fixes: 129776ac2e38 ("accel/qaic: Add control path") Signed-off-by: Youssef Samir Reviewed-by: Lizhi Hou Reviewed-by: Jeff Hugo Signed-off-by: Jeff Hugo Link: https://patch.msgid.link/20260205123415.3870898-1-youssef.abdulrahman@oss.qualcomm.com Signed-off-by: Sasha Levin

net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels

2026-03-04T12:21:03+00:00

[ Upstream commit 51731792a25cb312ca94cdccfa139eb46de1b2ef ] MHI stack offers the 'auto_queue' feature, which allows the MHI stack to auto queue the buffers for the RX path (DL channel). Though this feature simplifies the client driver design, it introduces race between the client drivers and the MHI stack. For instance, with auto_queue, the 'dl_callback' for the DL channel may get called before the client driver is fully probed. This means, by the time the dl_callback gets called, the client driver's structures might not be initialized, leading to NULL ptr dereference. Currently, the drivers have to workaround this issue by initializing the internal structures before calling mhi_prepare_for_transfer_autoqueue(). But even so, there is a chance that the client driver's internal code path may call the MHI queue APIs before mhi_prepare_for_transfer_autoqueue() is called, leading to similar NULL ptr dereference. This issue has been reported on the Qcom X1E80100 CRD machines affecting boot. So to properly fix all these races, drop the MHI 'auto_queue' feature altogether and let the client driver (QRTR) manage the RX buffers manually. In the QRTR driver, queue the RX buffers based on the ring length during probe and recycle the buffers in 'dl_callback' once they are consumed. This also warrants removing the setting of 'auto_queue' flag from controller drivers. Currently, this 'auto_queue' feature is only enabled for IPCR DL channel. So only the QRTR client driver requires the modification. Fixes: 227fee5fc99e ("bus: mhi: core: Add an API for auto queueing buffers for DL channel") Fixes: 68a838b84eff ("net: qrtr: start MHI channel after endpoit creation") Reported-by: Johan Hovold Closes: https://lore.kernel.org/linux-arm-msm/ZyTtVdkCCES0lkl4@hovoldconsulting.com Suggested-by: Chris Lew Signed-off-by: Manivannan Sadhasivam Reviewed-by: Jeff Hugo Reviewed-by: Loic Poulain Acked-by: Jeff Johnson # drivers/net/wireless/ath/... Acked-by: Jeff Hugo Acked-by: Paolo Abeni Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251218-qrtr-fix-v2-1-c7499bfcfbe0@oss.qualcomm.com Signed-off-by: Sasha Levin

accel/qaic: Add qaic_ prefix to irq_polling_work

2025-11-07T18:27:46+00:00

Rename irq_polling_work to qaic_irq_polling_work to reduce ambiguity and avoid potential naming conflicts in the future. Signed-off-by: Zack McKevitt Reviewed-by: Jeff Hugo Signed-off-by: Jeff Hugo Link: https://patch.msgid.link/20251031192511.3179130-1-zachary.mckevitt@oss.qualcomm.com

accel/qaic: Collect crashdump from SSR channel

2025-11-07T18:16:51+00:00

After subsystem of the device has crashed it sends a message with command DEBUG_TRANSFER_INFO to kernel(host). Send ACK for that message and then prepare to collect the ramdump of the subsystem Steps of crashdump collection is as follows, 1) Device sends DEBUG_TRANSFER_INFO message indicating that device wants to send crashdump. 2) Send an acknowledgment to that message either ACK or NACK. a) NACK will inform the device that host will not download the crashdump b) ACK will inform the device that host will download the crashdump 3) Along with the DEBUG_TRANSFER_INFO we receive a table base address and its length, use that to download that table from device. a) This table is meta data of the crashdump and not the actual crashdump. 4) After we respond as ACK for message received on step 1) we start downloading the table. Use series of MEMORY_READ/MEMORY_READ_RSP SSR commands to download the entire table. 5) Each entry in the table represents a segment of crashdump. Once the table downloading is complete, iterate through each entry of table and download each crashdump segment(same as table itself). Table entry contains the memory base address and length along with other info. 6) After the entire crashdump is downloaded send DEBUG_TRANSFER_DONE which marks that host is terminating the crashdump transfer. This message can be send in both success or error case. 7) After receiving DEBUG_TRANSFER_DONE_RSP hand over the crashdump to dev_coredumpv() and free all the necessary memory. Co-developed-by: Jeffrey Hugo Signed-off-by: Jeffrey Hugo Co-developed-by: Pranjal Ramajor Asha Kanojiya Signed-off-by: Pranjal Ramajor Asha Kanojiya Signed-off-by: Pranjal Ramajor Asha Kanojiya Signed-off-by: Youssef Samir Signed-off-by: Zack McKevitt Reviewed-by: Jeff Hugo Signed-off-by: Jeff Hugo Link: https://patch.msgid.link/20251031174059.2814445-4-zachary.mckevitt@oss.qualcomm.com

accel/qaic: Implement basic SSR handling

2025-11-07T18:01:18+00:00

Subsystem restart (SSR) for a qaic device means that a NSP has crashed, and will be restarted. However the restart process will lose any state associated with activation, so the user will need to do some recovery. While SSR has the provision to collect a crash dump, this patch does not implement support for it. Co-developed-by: Jeffrey Hugo Signed-off-by: Jeffrey Hugo Co-developed-by: Pranjal Ramajor Asha Kanojiya Signed-off-by: Pranjal Ramajor Asha Kanojiya Co-developed-by: Troy Hanson Signed-off-by: Troy Hanson Co-developed-by: Aswin Venkatesan Signed-off-by: Aswin Venkatesan Signed-off-by: Jeffrey Hugo Signed-off-by: Youssef Samir Signed-off-by: Zack McKevitt Reviewed-by: Jeff Hugo [jhugo: Fix minor checkpatch whitespace issues] Signed-off-by: Jeff Hugo Link: https://patch.msgid.link/20251031174059.2814445-3-zachary.mckevitt@oss.qualcomm.com

accel/qaic: Add DMA Bridge Channel(DBC) sysfs and uevents

2025-11-07T17:55:39+00:00

Expose sysfs files for each DBC representing the current state of that DBC. For example, sysfs for DBC ID 0 and accel minor number 0 looks like this, /sys/class/accel/accel0/dbc0_state Following are the states and their corresponding values, DBC_STATE_IDLE (0) DBC_STATE_ASSIGNED (1) DBC_STATE_BEFORE_SHUTDOWN (2) DBC_STATE_AFTER_SHUTDOWN (3) DBC_STATE_BEFORE_POWER_UP (4) DBC_STATE_AFTER_POWER_UP (5) Signed-off-by: Pranjal Ramajor Asha Kanojiya Signed-off-by: Youssef Samir Signed-off-by: Zack McKevitt Reviewed-by: Jeff Hugo Signed-off-by: Jeff Hugo Link: https://patch.msgid.link/20251031174059.2814445-2-zachary.mckevitt@oss.qualcomm.com

accel/qaic: Add support for PM callbacks

2025-11-05T22:41:43+00:00

Add initial support for suspend and hibernation PM callbacks to QAIC. The device can be suspended any time in which the data path is not busy as queued I/O operations are lost on suspension and cannot be resumed after suspend. Signed-off-by: Youssef Samir Reviewed-by: Carl Vanderlip Signed-off-by: Zack McKevitt Reviewed-by: Jeff Hugo Signed-off-by: Jeff Hugo Link: https://patch.msgid.link/20251029181808.1216466-1-zachary.mckevitt@oss.qualcomm.com

accel/qaic: Rename constant for clarity

2025-10-27T18:11:38+00:00

QAIC_MANAGE_EXT_MSG_LENGTH is ambiguous and has been confused with QAIC_MANAGE_MAX_MSG_LENGTH. Rename it to clarify it's a wire length. Signed-off-by: Troy Hanson Signed-off-by: Youssef Samir Reviewed-by: Carl Vanderlip Reviewed-by: Jeff Hugo [jhugo: capitalize subject] Signed-off-by: Jeff Hugo Link: https://patch.msgid.link/20251022141606.3740470-1-youssef.abdulrahman@oss.qualcomm.com

accel/qaic: Fix comment

2025-10-27T18:06:46+00:00

Replace the word "Qranium" with "qaic" in the function parameter description. Signed-off-by: Aswin Venkatesan Signed-off-by: Youssef Samir Reviewed-by: Carl Vanderlip Reviewed-by: Jeff Hugo [jhugo: adjust word wrapping in commit text] Signed-off-by: Jeff Hugo Link: https://patch.msgid.link/20251022124107.3712466-1-youssef.abdulrahman@oss.qualcomm.com

accel/qaic: Update the sahara image table for AIC200

2025-10-27T17:52:09+00:00

Update the Sahara image table for the AIC200 to add entries for: - qupv3fw.elf at id 54 - xbl_config.elf at id 38 - tz_qti_config.mbn at id 76 And move pvs.bin to id 78 to avoid firmware conflict. Co-developed-by: Zack McKevitt Signed-off-by: Zack McKevitt Co-developed-by: Aswin Venkatesan Signed-off-by: Aswin Venkatesan Signed-off-by: Youssef Samir Signed-off-by: Youssef Samir Reviewed-by: Karol Wachowski Reviewed-by: Jeff Hugo Signed-off-by: Jeff Hugo Link: https://patch.msgid.link/20251017173432.1207656-1-youssef.abdulrahman@oss.qualcomm.com