summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2025-12-15clk: renesas: r9a09g077: Add xSPI core and module clocksLad Prabhakar
Add core clocks and module clock definitions required by the xSPI (Expanded SPI) IP on the R9A09G077 SoC. Define the new SCKCR fields FSELXSPI0/FSELXSPI1 and DIVSEL_XSPI0/1 and add two new core clocks XSPI_CLK0 and XSPI_CLK1. The xSPI block uses PCLKH as its bus clock (use as module clock parent) while the operation clock (XSPI_CLKn) is derived from PLL4. To support this arrangement provide mux/div selectors and divider tables for the supported XSPI operating rates. Add CLK_TYPE_RZT2H_FSELXSPI to implement a custom divider/mux clock where the determine_rate() callback enforces the hardware constraint: when the parent output is 600MHz only dividers 8 and 16 are valid, whereas for 800MHz operation the full divider set (6,8,16,32,64) may be used. The custom determine_rate() picks the best parent/divider pair to match the requested rate and programs the appropriate SCKCR fields. Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20251117205627.39376-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2025-12-15clk: renesas: rzg2l: Select correct div round macroChris Brandt
Variable foutvco_rate is an unsigned long, not an unsigned long long. Cc: stable@kernel.org Reported-by: Geert Uytterhoeven <geert+renesas@glider.be> Closes: https://lore.kernel.org/CAMuHMdVf7dSeqAhtyxDCFuCheQRzwS-8996Rr2Ntui21uiBgdA@mail.gmail.com Fixes: dabf72b85f29 ("clk: renesas: rzg2l: Fix FOUTPOSTDIV clk") Signed-off-by: Chris Brandt <chris.brandt@renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20251114194529.3304361-1-chris.brandt@renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2025-12-15clk: renesas: rzg2l: Fix intin variable sizeChris Brandt
INTIN is a 12-bit register value, so u8 is too small. Fixes: 1561380ee72f ("clk: renesas: rzg2l: Add FOUTPOSTDIV clk support") Cc: stable@vger.kernel.org Reported-by: Hugo Villeneuve <hugo@hugovil.com> Closes: https://lore.kernel.org/20251107113058.f334957151d1a8dd94dd740b@hugovil.com Signed-off-by: Chris Brandt <chris.brandt@renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20251114193711.3277912-1-chris.brandt@renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2025-12-15firmware: arm_scmi: Fix uninitialized pointers with __free attrAlly Heev
Uninitialized pointers with `__free` attribute can cause undefined behaviour as the memory assigned(randomly) to the pointer is freed automatically when the pointer goes out of scope arm doesn't have any bugs related to this as of now, but it is better to initialize and assign pointers with `__free` attr in one statement to ensure proper scope-based cleanup Reported-by: Dan Carpenter <dan.carpenter@linaro.org> Closes: https://lore.kernel.org/all/aPiG_F5EBQUjZqsl@stanley.mountain/ Signed-off-by: Ally Heev <allyheev@gmail.com> Reviewed-by: Cristian Marussi <cristian.marussi@arm.com> Message-Id: <20251105-aheev-uninitialized-free-attr-arm-v1-1-f7b6cb5d3361@gmail.com> Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
2025-12-15firmware: arm_ffa: Tie FF-A version checks to specific featuresSudeep Holla
The FF-A driver currently performs loose comparisons when checking the supported FF-A feature, which can inadvertently treat future or intermediate revisions as compatible. Replace generic `version {>,<} FFA_VERSION_1_*` pattern checks with feature-specific macros that clearly express which functionality depends on FF-A versioning. This improves readability and future maintainability by tying each feature (e.g. GET_COUNT_ONLY, size/UUID/exec state in responses) to explicit version requirements instead of relying on generic version comparisons. This improves robustness and clarity as the FF-A specification evolves. No functional change, only improves code readability. Message-Id: <20251016094111.946236-1-sudeep.holla@arm.com> Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
2025-12-15firmware: arm_ffa: Unmap Rx/Tx buffers on init failureHaoxiang Li
ffa_init() maps the Rx/Tx buffers via ffa_rxtx_map() but on the partition setup failure path it never unmaps them. Add the missing ffa_rxtx_unmap() call in the error path so that the Rx/Tx buffers are properly released before freeing the backing pages. Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn> Message-Id: <20251210031656.56194-1-lihaoxiang@isrc.iscas.ac.cn> Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
2025-12-15drm/gem: fix build for mm_get_unmapped_area() call after backmergeJani Nikula
Commit 9ac09bb9feac ("mm: consistently use current->mm in mm_get_unmapped_area()") upstream dropped a parameter from mm_get_unmapped_area() while commit 99bda20d6d4c ("drm/gem: Introduce drm_gem_get_unmapped_area() fop") in drm-misc-next added a new user. Drop the extra parameter from the call. Fixes: 7f790dd21a93 ("Merge drm/drm-next into drm-misc-next") Cc: Maxime Ripard <mripard@kernel.org> Reviewed-by: Francois Dugast <francois.dugast@intel.com> Reviewed-by: Badal Nilawar <badal.nilawar@intel.com> Link: https://patch.msgid.link/20251215092706.3218018-1-jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2025-12-15clk: amlogic: remove potentially unsafe flags from S4 video clocksChuan Liu
The video clocks enci, encp, vdac and hdmitx share the same clock source. Adding CLK_SET_RATE_PARENT to the mux may unintentionally change the shared parent clock, which could affect other video clocks. Signed-off-by: Chuan Liu <chuan.liu@amlogic.com> Link: https://lore.kernel.org/r/20250919-add_video_clk-v6-3-fe223161fb3f@amlogic.com Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
2025-12-15clk: amlogic: add video-related clocks for S4 SoCChuan Liu
Add video encoder, demodulator and CVBS clocks. Signed-off-by: Chuan Liu <chuan.liu@amlogic.com> Link: https://lore.kernel.org/r/20250919-add_video_clk-v6-2-fe223161fb3f@amlogic.com Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
2025-12-15clk: meson: t7: add t7 clock peripherals controller driverJian Hu
Add Peripheral clock controller driver for the Amlogic T7 SoC family. Signed-off-by: Jian Hu <jian.hu@amlogic.com> Link: https://lore.kernel.org/r/20251212022619.3072132-6-jian.hu@amlogic.com Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
2025-12-15clk: meson: t7: add support for the T7 SoC PLL clockJian Hu
Add PLL clock controller driver for the Amlogic T7 SoC family. Signed-off-by: Jian Hu <jian.hu@amlogic.com> Link: https://lore.kernel.org/r/20251212022619.3072132-5-jian.hu@amlogic.com Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
2025-12-15drm/i915/display: group and sort the parent interface wrappers betterJani Nikula
Aligning with the parent interface struct definitions, also group and sort the parent interface wrappers to improve clarity on where to add new stuff. Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/b61af1d33d0448cd904cccccb2714f0d07d85b07.1765548786.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2025-12-15drm/xe: sort parent interface initializationJani Nikula
Sort the member initializers to improve clarity. Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/0af6654afb2174c472f75710cea328eb443f4b73.1765548786.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2025-12-15drm/i915: sort parent interface initializationJani Nikula
Sort the member initializers to improve clarity. Separate individual function initializers with a blank line in between. Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/7f5deefc30703006bc2daa1ce1093a4947f6e049.1765548786.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2025-12-15Revert "wifi: rtw88: add WQ_UNBOUND to alloc_workqueue users"Bitterblue Smith
This reverts commit 9c194fe4625db18f93d5abcfb7f7997557a0b29d. This commit breaks all USB wifi adapters supported by rtw88: usb 1-2: new high-speed USB device number 6 using xhci_hcd usb 1-2: New USB device found, idVendor=2357, idProduct=0138, bcdDevice= 2.10 usb 1-2: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-2: Product: 802.11ac NIC usb 1-2: Manufacturer: Realtek usb 1-2: SerialNumber: 123456 ------------[ cut here ]------------ WARNING: CPU: 3 PID: 152 at kernel/workqueue.c:5667 alloc_workqueue_noprof+0x676/0x770 [...] Call Trace: <TASK> ? rtw_usb_probe+0x30e/0xa5c [rtw88_usb 4af3cb64eedafeecbfb08f80c1e9e2893e2ee7a6] rtw_usb_probe+0x3eb/0xa5c [rtw88_usb 4af3cb64eedafeecbfb08f80c1e9e2893e2ee7a6] usb_probe_interface+0xdd/0x2c0 really_probe+0xdb/0x340 ? pm_runtime_barrier+0x55/0x90 ? __pfx___device_attach_driver+0x10/0x10 __driver_probe_device+0x78/0x140 driver_probe_device+0x1f/0xa0 __device_attach_driver+0x89/0x110 bus_for_each_drv+0x8f/0xe0 __device_attach+0xb0/0x1c0 bus_probe_device+0x90/0xa0 device_add+0x663/0x880 usb_set_configuration+0x5a5/0x870 usb_generic_driver_probe+0x4a/0x70 usb_probe_device+0x3d/0x140 ? driver_sysfs_add+0x59/0xd0 really_probe+0xdb/0x340 ? pm_runtime_barrier+0x55/0x90 ? __pfx___device_attach_driver+0x10/0x10 __driver_probe_device+0x78/0x140 driver_probe_device+0x1f/0xa0 __device_attach_driver+0x89/0x110 bus_for_each_drv+0x8f/0xe0 __device_attach+0xb0/0x1c0 bus_probe_device+0x90/0xa0 device_add+0x663/0x880 usb_new_device.cold+0x141/0x3b5 hub_event+0x1132/0x1900 ? page_counter_uncharge+0x4a/0x90 process_one_work+0x190/0x350 worker_thread+0x2d7/0x410 ? __pfx_worker_thread+0x10/0x10 kthread+0xf9/0x240 ? __pfx_kthread+0x10/0x10 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x1c1/0x1f0 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> ---[ end trace 0000000000000000 ]--- rtw88_8822bu 1-2:1.0: failed to create RX work queue rtw88_8822bu 1-2:1.0: failed to init USB RX rtw88_8822bu 1-2:1.0: Firmware version 27.2.0, H2C version 13 rtw88_8822bu 1-2:1.0: probe with driver rtw88_8822bu failed with error -12 WQ_UNBOUND is not compatible with WQ_BH. Comment in enum wq_flags in workqueue.h says: /* BH wq only allows the following flags */ __WQ_BH_ALLOWS = WQ_BH | WQ_HIGHPRI | WQ_PERCPU, Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/d57efe48-b8ff-4bf1-942c-7e808535eda6@gmail.com
2025-12-15wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc()Morning Star
TID getting from ieee80211_get_tid() might be out of range of array size of sta_entry->tids[], so check TID is less than MAX_TID_COUNT. Othwerwise, UBSAN warn: UBSAN: array-index-out-of-bounds in drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c:514:30 index 10 is out of range for type 'rtl_tid_data [9]' Fixes: 8ca4cdef9329 ("wifi: rtlwifi: rtl8192cu: Fix TX aggregation") Signed-off-by: Morning Star <alexbestoso@gmail.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/1764232628-13625-1-git-send-email-pkshih@realtek.com
2025-12-15wifi: rtw88: limit indirect IO under powered off for RTL8822CSPing-Ke Shih
The indirect IO is necessary for RTL8822CS, but not necessary for other chips. Otherwiese, it throws errors and becomes unusable. rtw88_8723cs mmc1:0001:1: WOW Firmware version 11.0.0, H2C version 0 rtw88_8723cs mmc1:0001:1: Firmware version 11.0.0, H2C version 0 rtw88_8723cs mmc1:0001:1: sdio read32 failed (0xf0): -110 rtw88_8723cs mmc1:0001:1: sdio write8 failed (0x1c): -110 rtw88_8723cs mmc1:0001:1: sdio read32 failed (0xf0): -110 By vendor driver, only RTL8822CS and RTL8822ES need indirect IO, but RTL8822ES isn't supported yet. Therefore, limit it to RTL8822CS only. Reported-by: Andrey Skvortsov <andrej.skvortzov@gmail.com> Closes: https://lore.kernel.org/linux-wireless/07a32e2d6c764eb1bd9415b5a921a652@realtek.com/T/#m997b4522f7209ba629561c776bfd1d13ab24c1d4 Fixes: 58de1f91e033 ("wifi: rtw88: sdio: use indirect IO for device registers before power-on") Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Tested-by: Andrey Skvortsov <andrej.skvortzov@gmail.com> Link: https://patch.msgid.link/1764034729-1251-1-git-send-email-pkshih@realtek.com
2025-12-15Merge drm/drm-next into drm-misc-nextMaxime Ripard
Let's kickstart the v6.20 (7.0?) release cycle. Signed-off-by: Maxime Ripard <mripard@kernel.org>
2025-12-15soc/xilinx: replace use of system_unbound_wq with system_dfl_wqMarco Crivellari
Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. This patch continues the effort to refactor worqueue APIs, which has begun with the change introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") system_dfl_wq should be the default workqueue so as not to enforce locality constraints for random work whenever it's not required. The old system_unbound_wq will be kept for a few release cycles. Suggested-by: Tejun Heo <tj@kernel.org> Signed-off-by: Marco Crivellari <marco.crivellari@suse.com> Signed-off-by: Michal Simek <michal.simek@amd.com> Link: https://lore.kernel.org/r/20251104103942.96647-1-marco.crivellari@suse.com
2025-12-15ata: libata: Allow more quirksNiklas Cassel
We have currently used up 30 out of the 32-bits in the struct ata_device struct member quirks. Thus, it is only possible to add two more quirks. Change the struct ata_device struct member quirks from an unsigned int to an u64. Doing this core level change now, will make it easier for us now, as we will not need to also do core level changes once the final two bits are used as well. Signed-off-by: Niklas Cassel <cassel@kernel.org> Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> Reviewed-by: Damien Le Moal <dlemoal@kernel.org> Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
2025-12-15ata: libata: Add libata.force parameter max_secNiklas Cassel
Add a new libata.force parameter called max_sec. The parameter can take an arbitrary value using the format: libata.force=max_sec=<number of 512B sectors> e.g. libata.force=max_sec=8191 or libata.force=max_sec=2048 This will allow the user to set an arbitrary maximum command size (dev->max_sectors) using libata.force. We cannot remove the existing libata.force parameters "max_sec_128" and "max_sec_1024", as these are a part of the exising user facing API. Signed-off-by: Niklas Cassel <cassel@kernel.org> Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> Reviewed-by: Damien Le Moal <dlemoal@kernel.org> Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
2025-12-15ata: libata: Add support to parse equal sign in libata.forceNiklas Cassel
Currently, no libata.force parameter supports an arbitrary value. All allowed values, e.g. udma/16, udma/25, udma/33, udma/44, udma/66, udma/100, udma/133 have hardcoded entries in the force_tbl table. Add code to allow a libata.force param with the format libata.force=param=param_value, where param_value can be an arbitrary value. This code will be used in a follow up commit. Signed-off-by: Niklas Cassel <cassel@kernel.org> Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> Reviewed-by: Damien Le Moal <dlemoal@kernel.org> Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
2025-12-15ata: libata: Change libata.force to use the generic ATA_QUIRK_MAX_SEC quirkNiklas Cassel
Modify the existing libata.force parameters "max_sec_128" and "max_sec_1024" to use the generic ATA_QUIRK_MAX_SEC quirk rather than individual quirks. This also allows us to remove the individual quirks ATA_QUIRK_MAX_SEC_128 and ATA_QUIRK_MAX_SEC_1024. Signed-off-by: Niklas Cassel <cassel@kernel.org> Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> Reviewed-by: Damien Le Moal <dlemoal@kernel.org> Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
2025-12-15ata: libata: Add ata_force_get_fe_for_dev() helperNiklas Cassel
Add ata_force_get_fe_for_dev() helper to get the struct ata_force_ent for a struct ata_device. Use the helper in ata_force_quirks(). The helper will also be used in follow up commits. No functional change intended. Signed-off-by: Niklas Cassel <cassel@kernel.org> Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> Reviewed-by: Damien Le Moal <dlemoal@kernel.org> Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
2025-12-15ata: libata: Add ATA_QUIRK_MAX_SEC and convert all device quirksNiklas Cassel
Add a new quirk ATA_QUIRK_MAX_SEC, which has a separate table with device specific values. Convert all existing ATA_QUIRK_MAX_SEC_XXX device quirks in __ata_dev_quirks to the new format. Quirks ATA_QUIRK_MAX_SEC_128 and ATA_QUIRK_MAX_SEC_1024 cannot be removed yet, since they are also used by libata.force, which functionally, is a separate user of the quirks. The quirks will be removed once all users have been converted to use the new format. The quirk ATA_QUIRK_MAX_SEC_8191 can be removed since it has no equivalent libata.force parameter. Signed-off-by: Niklas Cassel <cassel@kernel.org> Reviewed-by: Damien Le Moal <dlemoal@kernel.org> Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
2025-12-15ata: libata: avoid long timeouts on hot-unplugged SATA DASHenry Tseng
When a SATA DAS enclosure is connected behind a Thunderbolt PCIe switch, hot-unplugging the whole enclosure causes pciehp to tear down the PCI hierarchy before the SCSI layer issues SYNCHRONIZE CACHE and START STOP UNIT for the disks. libata still queues these commands and the AHCI driver tries to access the HBA registers even though the PCI channel is already offline. This results in a series of timeouts and error recovery attempts, e.g.: [ 824.778346] pcieport 0000:00:07.0: pciehp: Slot(14): Link Down [ 891.612720] ata8.00: qc timeout after 5000 msecs (cmd 0xec) [ 902.876501] ata8.00: qc timeout after 10000 msecs (cmd 0xec) [ 934.107998] ata8.00: qc timeout after 30000 msecs (cmd 0xec) [ 936.206431] sd 7:0:0:0: [sda] Synchronize Cache(10) failed: Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK ... [ 1006.298356] ata1.00: qc timeout after 5000 msecs (cmd 0xec) [ 1017.561926] ata1.00: qc timeout after 10000 msecs (cmd 0xec) [ 1048.791790] ata1.00: qc timeout after 30000 msecs (cmd 0xec) [ 1050.890035] sd 0:0:0:0: [sdb] Synchronize Cache(10) failed: Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK With this patch applied, the same hot-unplug looks like: [ 59.965496] pcieport 0000:00:07.0: pciehp: Slot(14): Link Down [ 60.002502] sd 7:0:0:0: [sda] Synchronize Cache(10) failed: Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK ... [ 60.103050] sd 0:0:0:0: [sdb] Synchronize Cache(10) failed: Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK In this test setup with two disks, the hot-unplug sequence shrinks from about 226 seconds (~3.8 minutes) between the Link Down event and the last SYNCHRONIZE CACHE failure to under a second. Without this patch the total delay grows roughly with the number of disks, because each disk gets its own SYNCHRONIZE CACHE and qc timeout series. If the underlying PCI device is already gone, these commands cannot succeed anyway. Avoid issuing them by introducing ata_adapter_is_online(), which checks pci_channel_offline() for PCI-based hosts. It is used from ata_scsi_find_dev() to return NULL, causing the SCSI layer to fail new commands with DID_BAD_TARGET immediately, and from ata_qc_issue() to bail out before touching the HBA registers. Since such failures would otherwise trigger libata error handling, ata_adapter_is_online() is also consulted from ata_scsi_port_error_handler(). When the adapter is offline, libata skips ap->ops->error_handler(ap) and completes error handling using the existing path, rather than running a full EH sequence against a dead adapter. With this change, SYNCHRONIZE CACHE and START STOP UNIT commands issued during hot-unplug fail quickly once the PCI channel is offline, without qc timeout spam or long libata EH delays. Suggested-by: Damien Le Moal <dlemoal@kernel.org> Signed-off-by: Henry Tseng <henrytseng@qnap.com> Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
2025-12-15ata: libata-scsi: Remove superfluous local_irq_save()Niklas Cassel
Commit 28a3fc2295a7 ("libata: implement ZBC IN translation") added ata_scsi_report_zones_complete(). Since the beginning, this function has disabled IRQs on the local CPU using local_irq_save(). qc->complete_fn is always called with ap->lock held, and the ap->lock is always taken using spin_lock_irq*(). Thus, this local_irq_save() is superfluous and can be removed. Signed-off-by: Niklas Cassel <cassel@kernel.org> Reviewed-by: Hannes Reinecke <hare@suse.de> Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
2025-12-14remoteproc: imx_dsp_rproc: Wait for suspend ACK only if WAIT_FW_CONFIRMATION ↵Iuliana Prodan
is set The DSP suspend path currently waits unconditionally for a suspend ack from the firmware. This breaks firmwares that do not implement the mailbox-based CONFIRMATION handshake, as the DSP never responds and system suspend fails with -EBUSY. The driver already uses the WAIT_FW_CONFIRMATION flag to indicate that the firmware supports the CONFIRMATION handshake at boot. Apply the same logic during suspend: only send the suspend message and wait for the suspend ack when the firmware is expected to support it. Signed-off-by: Iuliana Prodan <iuliana.prodan@nxp.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com> Link: https://lore.kernel.org/r/20251204122825.756106-3-iuliana.prodan@oss.nxp.com Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
2025-12-14remoteproc: imx_dsp_rproc: Rename macro to reflect multiple contextsIuliana Prodan
Rename WAIT_FW_READY to WAIT_FW_CONFIRMATION and FEATURE_DONT_WAIT_FW_READY to FEATURE_SKIP_FW_CONFIRMATION. This way, the term CONFIRMATION covers: - waiting for firmware to confirm it is ready to start; - waiting for any other confirmation from firmware. Signed-off-by: Iuliana Prodan <iuliana.prodan@nxp.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com> Link: https://lore.kernel.org/r/20251204122825.756106-2-iuliana.prodan@oss.nxp.com Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
2025-12-14remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX ↵Iuliana Prodan
channel is uninitialized Firmwares that do not use mailbox communication (e.g., the hello_world sample) leave priv->tx_ch as NULL. The current suspend logic unconditionally sends RP_MBOX_SUSPEND_SYSTEM, which is invalid without an initialized TX channel. Detect the no_mailboxes case early and skip sending the suspend message. Instead, proceed directly to the runtime PM suspend path, which is the correct behavior for firmwares that cannot respond to mailbox requests. Signed-off-by: Iuliana Prodan <iuliana.prodan@nxp.com> Link: https://lore.kernel.org/r/20251204122825.756106-1-iuliana.prodan@oss.nxp.com Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
2025-12-14rpmsg: core: fix race in driver_override_show() and use core helperGui-Dong Han
The driver_override_show function reads the driver_override string without holding the device_lock. However, the store function modifies and frees the string while holding the device_lock. This creates a race condition where the string can be freed by the store function while being read by the show function, leading to a use-after-free. To fix this, replace the rpmsg_string_attr macro with explicit show and store functions. The new driver_override_store uses the standard driver_set_override helper. Since the introduction of driver_set_override, the comments in include/linux/rpmsg.h have stated that this helper must be used to set or clear driver_override, but the implementation was not updated until now. Because driver_set_override modifies and frees the string while holding the device_lock, the new driver_override_show now correctly holds the device_lock during the read operation to prevent the race. Additionally, since rpmsg_string_attr has only ever been used for driver_override, removing the macro simplifies the code. Fixes: 39e47767ec9b ("rpmsg: Add driver_override device attribute for rpmsg_device") Cc: stable@vger.kernel.org Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com> Link: https://lore.kernel.org/r/20251202174948.12693-1-hanguidong02@gmail.com Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
2025-12-14rpmsg: virtio: EPOLLOUT supportPatrick Oppenlander
Previously, polling an rpmsg endpoint (e.g. /dev/ttyRPMSGx) would generate EPOLLIN events but no EPOLLOUT events. Unfortunately, poll support means that we can no longer disable tx-complete interrupts as there is no way to know whether a poller is waiting in sendq, so we always need notifications. Signed-off-by: Patrick Oppenlander <patrick.oppenlander@gmail.com> Link: https://lore.kernel.org/r/20251022032817.320378-1-patrick.oppenlander@gmail.com Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
2025-12-15Add DMA support for RZ/T2H RSPIMark Brown
Merge series from Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com>: The DMA controller can be used to transfer data to and from the SPI controller without involving the CPU for each word of a SPI transfer. Add support for DMA mode, and do some other cleanups while touching the same code.
2025-12-15Support ECSPI dynamic burst feature for DMA modeMark Brown
Merge series from Carlos Song <carlos.song@nxp.com>: ECSPI has a low throughput because of no dynamic burst support, it transfers only one word per frame in DMA mode, causing SCLK stalls between words due to BURST_LENGTH updates. This patch set is to support ECSPI dynamic burst feature to help improve the ECSPI DMA mode performance. Performance test (spidev_test @10MHz, 4KB): Before: tx/rx ~6651.9 kbps After: tx/rx ~9922.2 kbps (~50% improvement) For compatibility with slow SPI devices, add configurable word delay in DMA mode. When word delay is set, dynamic burst is disabled and BURST_LENGTH equals word length. Also support target DMA mode with enabled dynamic burst. --- Changes since v2: * Patch1~4: no change * Patch5: remove __counted_by from *dma_data, because spi_imx struct is allocated with a fixed memory in probe, flexible array is not suitable, so just remove it to avoid the build error. Also add review-by tag * Patch6: add review-by tag Changes since v1: * Patch1~3: * Add review-by tag * Patch4: * Add review-by tag * Improve patch commit log * Patch5: * Clean up tab instead of space for dma_tx_addr and dma_rx_addr * Add __counted_by(dma_package_num) for dma_data_package *dma_data * Move temp and bytes_per_word to if() * Add comment for spi_imx_dma_rx_data_handle() and spi_imx_dma_tx_data_handle() * Use kzalloc instead of kmalloc(x, x | __GFP_ZERO) * Use sizeof(*temp) instead of BYTES_PER_32BITS_WORD in suitable place * Add comments and fix comments according to discussion * Propagate the error value of dma_mapping_error() * Use round_down() to replace DIV_ROUND_DOWN_ULL() * Improve transfer->error |= SPI_TRANS_FAIL_NO_START judgment for better readability * Patch6: * Improve patch commit log * Add READ_ONCE for spi_imx->target_aborted * Add comments for data length limit * Move data length limit to spi_imx_can_dma() Carlos Song (6): spi: imx: group spi_imx_dma_configure() with spi_imx_dma_transfer() spi: imx: introduce helper to clear DMA mode logic spi: imx: avoid dmaengine_terminate_all() on TX prep failure spi: imx: handle DMA submission errors with dma_submit_error() spi: imx: support dynamic burst length for ECSPI DMA mode spi: imx: enable DMA mode for target operation drivers/spi/spi-imx.c | 625 +++++++++++++++++++++++++++++++++++------- 1 file changed, 519 insertions(+), 106 deletions(-) -- 2.34.1
2025-12-15spi: stm32: Update for OSPI and QSPI driversMark Brown
Merge series from Patrice Chotard <patrice.chotard@foss.st.com>: This serie applies the following updates on the spi-stm32-ospi and spi-stm32-qspi dirvers : _ Update FIFO accesses using u16 and u32 when possible instead of u8 only to optimize throughput. _ Replace Transmit Complete and Transmit Error interrupt management by usage of read_poll_timeout_atomic() to optimize throughtput. _ Simplify Status Match interrupt check. _ Set DMA burst configuration dynamically. Signed-off-by: Patrice Chotard <patrice.chotard@foss.st.com> --- Changes in v2: - Fix compilation error in stm32_ospi_wait_cmd() - Link to v1: https://lore.kernel.org/r/20251205-upstream_qspi_ospi_updates-v1-0-7e6c8b9f5141@foss.st.com --- Patrice Chotard (8): spi: stm32-ospi: Set DMA maxburst dynamically spi: stm32-ospi: Optimize FIFO accesses using u16 or u32 spi: stm32-ospi: Remove CR_TCIE and CR_TEIE irq usage spi: stm32-ospi: Simplify SMIE interrupt test spi: stm32-qspi: Set DMA maxburst dynamically spi: stm32-qspi: Optimize FIFO accesses using u16 or u32 spi: stm32-qspi: Remove CR_TCIE and CR_TEIE irq usage spi: stm32-qspi: Simplify SMIE interrupt test drivers/spi/spi-stm32-ospi.c | 107 +++++++++++++++++++++++++---------------- drivers/spi/spi-stm32-qspi.c | 111 +++++++++++++++++++++++++------------------ 2 files changed, 132 insertions(+), 86 deletions(-) --- base-commit: 7d0a66e4bb9081d75c82ec4957c50034cb0ea449 change-id: 20251205-upstream_qspi_ospi_updates-4faf7a3b098c Best regards, -- Patrice Chotard <patrice.chotard@foss.st.com>
2025-12-14hwmon: (tmp401) fix overflow caused by default conversion rate valueAlexey Simakov
The driver computes conversion intervals using the formula: interval = (1 << (7 - rate)) * 125ms where 'rate' is the sensor's conversion rate register value. According to the datasheet, the power-on reset value of this register is 0x8, which could be assigned to the register, after handling i2c general call. Using this default value causes a result greater than the bit width of left operand and an undefined behaviour in the calculation above, since shifting by values larger than the bit width is undefined behaviour as per C language standard. Limit the maximum usable 'rate' value to 7 to prevent undefined behaviour in calculations. Found by Linux Verification Center (linuxtesting.org) with Svace. Note (groeck): This does not matter in practice unless someone overwrites the chip configuration from outside the driver while the driver is loaded. The conversion time register is initialized with a value of 5 (500ms) when the driver is loaded, and the driver never writes a bad value. Fixes: ca53e7640de7 ("hwmon: (tmp401) Convert to _info API") Signed-off-by: Alexey Simakov <bigalex934@gmail.com> Link: https://lore.kernel.org/r/20251211164342.6291-1-bigalex934@gmail.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2025-12-14hwmon: (ibmpex) fix use-after-free in high/low storeJunrui Luo
The ibmpex_high_low_store() function retrieves driver data using dev_get_drvdata() and uses it without validation. This creates a race condition where the sysfs callback can be invoked after the data structure is freed, leading to use-after-free. Fix by adding a NULL check after dev_get_drvdata(), and reordering operations in the deletion path to prevent TOCTOU. Reported-by: Yuhao Jiang <danisjiang@gmail.com> Reported-by: Junrui Luo <moonafterrain@outlook.com> Fixes: 57c7c3a0fdea ("hwmon: IBM power meter driver") Signed-off-by: Junrui Luo <moonafterrain@outlook.com> Link: https://lore.kernel.org/r/MEYPR01MB7886BE2F51BFE41875B74B60AFA0A@MEYPR01MB7886.ausprd01.prod.outlook.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2025-12-14hwmon: (dell-smm) Limit fan multiplier to avoid overflowDenis Sergeev
The fan nominal speed returned by SMM is limited to 16 bits, but the driver allows the fan multiplier to be set via a module parameter. Clamp the computed fan multiplier so that fan_nominal_speed * i8k_fan_mult always fits into a signed 32-bit integer and refuse to initialize the driver if the value is too large. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 20bdeebc88269 ("hwmon: (dell-smm) Introduce helper function for data init") Signed-off-by: Denis Sergeev <denserg.edu@gmail.com> Link: https://lore.kernel.org/r/20251209063706.49008-1-denserg.edu@gmail.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2025-12-14spi: spi-fsl-lpspi: convert min_t() to simple min()Carlos Song
Current min() has supported comparison by normal integer promotion rules, so explicit type casts or min_t() are not needed. Signed-off-by: Carlos Song <carlos.song@nxp.com> Reviewed-by: David Laight <david.laight.linux@gmail.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20251210105001.3891776-1-carlos.song@nxp.com Signed-off-by: Mark Brown <broonie@kernel.org>
2025-12-14spi: virtio: Fix confusing cleanup.h syntaxKrzysztof Kozlowski
Initializing automatic __free variables to NULL without need (e.g. branches with different allocations), followed by actual allocation is in contrary to explicit coding rules guiding cleanup.h: "Given that the "__free(...) = NULL" pattern for variables defined at the top of the function poses this potential interdependency problem the recommendation is to always define and assign variables in one statement and not group variable definitions at the top of the function when __free() is used." Code does not have a bug, but is less readable and uses discouraged coding practice, so fix that by moving declaration to the place of assignment. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://patch.msgid.link/20251208020830.5225-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Mark Brown <broonie@kernel.org>
2025-12-14spi: cadence-quadspi: Parse DT for flashes with the rest of the DT parsingMark Brown
The recent refactoring of where runtime PM is enabled done in commit f1eb4e792bb1 ("spi: spi-cadence-quadspi: Enable pm runtime earlier to avoid imbalance") made the fact that when we do a pm_runtime_disable() in the error paths of probe() we can trigger a runtime disable which in turn results in duplicate clock disables. This is particularly likely to happen when there is missing or broken DT description for the flashes attached to the controller. Early on in the probe function we do a pm_runtime_get_noresume() since the probe function leaves the device in a powered up state but in the error path we can't assume that PM is enabled so we also manually disable everything, including clocks. This means that when runtime PM is active both it and the probe function release the same reference to the main clock for the IP, triggering warnings from the clock subsystem: [ 8.693719] clk:75:7 already disabled [ 8.693791] WARNING: CPU: 1 PID: 185 at /usr/src/kernel/drivers/clk/clk.c:1188 clk_core_disable+0xa0/0xb ... [ 8.694261] clk_core_disable+0xa0/0xb4 (P) [ 8.694272] clk_disable+0x38/0x60 [ 8.694283] cqspi_probe+0x7c8/0xc5c [spi_cadence_quadspi] [ 8.694309] platform_probe+0x5c/0xa4 Dealing with this issue properly is complicated by the fact that we don't know if runtime PM is active so can't tell if it will disable the clocks or not. We can, however, sidestep the issue for the flash descriptions by moving their parsing to when we parse the controller properties which also save us doing a bunch of setup which can never be used so let's do that. Reported-by: Francesco Dolcini <francesco@dolcini.it> Closes: https://lore.kernel.org/r/20251201072844.GA6785@francesco-nb Signed-off-by: Mark Brown <broonie@kernel.org> Link: https://patch.msgid.link/20251204-spi-cadence-qspi-runtime-pm-imbalance-v2-1-10af9115d531@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2025-12-14spi: spi-qpic-snand: remove superfluous qcom_spi_set_read_loc() callsGabor Juhos
Before configuring the registers related to page read, both the qcom_spi_read_page_ecc() and the qcom_spi_read_page_oob() functions are calling qcom_spi_set_read_loc() to set the read location for the first codeword. However the qcom_spi_set_read_loc() function puts the passed value into the register write cache only, from where those gets written to the corresponding register later via DMA. Yet, the qcom_spi_set_read_loc() is also gets called within the internal loops, and during the first iteration the read location register values written by the initial call gets overwritten in the register cache. This means that the values written by the first calls are never getting used in practice, so remove the calls as those are superfluous. Signed-off-by: Gabor Juhos <j4g8y7@gmail.com> Link: https://patch.msgid.link/20251129-qpic-snand-superfluous-readloc-v1-1-b84ca17095d9@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2025-12-14spi-geni-qcom: rework setup_fifo_paramsJonathan Marek
Update each register only if it changes. This also fixes the chipselect related registers not being changed when chipselect changes but not the mode. Signed-off-by: Jonathan Marek <jonathan@marek.ca> Link: https://patch.msgid.link/20251120211204.24078-5-jonathan@marek.ca Signed-off-by: Mark Brown <broonie@kernel.org>
2025-12-14spi-geni-qcom: initialize mode related registers to 0Jonathan Marek
setup_fifo_params assumes these will be zero, it won't write these registers if the initial mode is zero. Signed-off-by: Jonathan Marek <jonathan@marek.ca> Link: https://patch.msgid.link/20251120211204.24078-4-jonathan@marek.ca Signed-off-by: Mark Brown <broonie@kernel.org>
2025-12-14spi-geni-qcom: use xfer->bits_per_word for can_dma()Jonathan Marek
mas->cur_bits_per_word may not reflect the value of xfer->bits_per_word when can_dma() is called. Use the right value instead. Signed-off-by: Jonathan Marek <jonathan@marek.ca> Link: https://patch.msgid.link/20251120211204.24078-3-jonathan@marek.ca Signed-off-by: Mark Brown <broonie@kernel.org>
2025-12-14spi-geni-qcom: don't set max clock in setup_fifo_paramsJonathan Marek
setup_se_xfer() already sets the correct clock (xfer->speed_hz). Setting the clock to max_speed_hz here makes the driver change the clock rate between speed_hz and max_speed_hz for every message (if not equal), slowing it down significantly. Signed-off-by: Jonathan Marek <jonathan@marek.ca> Link: https://patch.msgid.link/20251120211204.24078-2-jonathan@marek.ca Signed-off-by: Mark Brown <broonie@kernel.org>
2025-12-14spi-geni-qcom: remove manual CS controlJonathan Marek
The GPI_DMA mode already uses automatic CS control, to use automatic CS control for non-GPI case all that's needed is to set the FRAGMENTATION flag using the same logic as setup_gsi_xfer(). (note clearing SPI_TRANS_CFG's CS_TOGGLE bit enables automatic CS control, the comment was wrong) spi_geni_set_cs() is slow, so this is a big performance improvement. Signed-off-by: Jonathan Marek <jonathan@marek.ca> Link: https://patch.msgid.link/20251120211204.24078-1-jonathan@marek.ca Signed-off-by: Mark Brown <broonie@kernel.org>
2025-12-14spi: cadence-qspi: Remove redundant pm_runtime_mark_last_busy callAkif Ejaz
The pm_runtime_mark_last_busy() call is redundant in probe function as pm_runtime_put_autosuspend() already calls pm_runtime_mark_last_busy() internally to update the last access time of the device before queuing autosuspend. Remove the pm_runtime_mark_last_busy() call from the probe function. Tested on StarFive VisionFive 2 v1.2A board. Fixes: e1f2e77624db ("spi: cadence-qspi: Fix runtime PM imbalance in probe") Signed-off-by: Akif Ejaz <akifejaz40@gmail.com> Link: https://patch.msgid.link/20251203181921.97171-1-akifejaz40@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2025-12-14spi: cadence-xspi: Replace OF/ACPI specifics by agnostic APIsAndy Shevchenko
Replace OF/ACPI specific call to get matched driver data with the agnostic one. This doesn't change functionality. While at it, add missing property.h include, and drop now unneeded of.h. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://patch.msgid.link/20251129150704.3998301-1-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org>
2025-12-14spi: cadence-xspi: Replace ACPI specifics by agnostic APIsAndy Shevchenko
Replace ACPI specific calls to get device property with the agnostic one. The code looses the direct dependency to the ACPI APIs and get cleaner. This doesn't change functionality. While at it, drop now unneeded acpi.h. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://patch.msgid.link/20251129151739.3998668-1-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-09-30 10:50:19 +0000