linux-stable.git/drivers/spi, branch linux-7.1.y Linux kernel stable tree Merge tag 'spi-fix-v7.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi 2026-06-12T18:06:16+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-06-12T18:06:16+00:00 28608283615e5e7e92ea79c8ea13507f4b5e0cbe Pull spi fixes from Mark Brown: "A couple of driver specific fixes: a small targeted fix for hardware error handling on DesignWare controllers and another for handling of custom chip select management on Qualcomm GENI controllers" * tag 'spi-fix-v7.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: dw: fix race between IRQ handler and error handler on SMP spi: qcom-geni: Fix cs_change handling on the last transfer 
Pull spi fixes from Mark Brown:
 "A couple of driver specific fixes: a small targeted fix for hardware
  error handling on DesignWare controllers and another for handling of
  custom chip select management on Qualcomm GENI controllers"

* tag 'spi-fix-v7.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
  spi: dw: fix race between IRQ handler and error handler on SMP
  spi: qcom-geni: Fix cs_change handling on the last transfer
spi: rzv2h-rspi: Fix SPDR read access width for 16-bit RX 2026-06-10T15:39:13+00:00 Felix Gu ustc.gu@gmail.com 2026-06-10T12:08:17+00:00 310628484ef06f95c5589374fade917a5689787b The RZ/V2H hardware manual (section 7.5.2.2.1) specifies that read access size for the SPI Data Register (SPDR) are fixed at 32 bits. The RZV2H_RSPI_RX macro for the 16-bit data path used readw(), violating this requirement. Switch to readl() for the 16-bit RX path to conform to the hardware specification. Fixes: 8b61c8919dff ("spi: Add driver for the RZ/V2H(P) RSPI IP") Suggested-by: Geert Uytterhoeven <geert@linux-m68k.org> Signed-off-by: Felix Gu <ustc.gu@gmail.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Fabrizio Castro <fabrizio.castro.jz@renesas.com> Link: https://patch.msgid.link/20260610-rzv2h-rspi-v2-1-40c80b4a2c90@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org> 
The RZ/V2H hardware manual (section 7.5.2.2.1) specifies that read access
size for the SPI Data Register (SPDR) are fixed at 32 bits. The
RZV2H_RSPI_RX macro for the 16-bit data path used readw(), violating
this requirement.

Switch to readl() for the 16-bit RX path to conform to the hardware
specification.

Fixes: 8b61c8919dff ("spi: Add driver for the RZ/V2H(P) RSPI IP")
Suggested-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Fabrizio Castro <fabrizio.castro.jz@renesas.com>
Link: https://patch.msgid.link/20260610-rzv2h-rspi-v2-1-40c80b4a2c90@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
spi: dw: fix race between IRQ handler and error handler on SMP 2026-06-09T23:07:39+00:00 Peng Yang pyangyyd@gmail.com 2026-06-08T09:58:49+00:00 3c60184e39b57e5efe664fe8540cdbc1bc7ea899 On SMP systems, dw_spi_handle_err() can be called from the SPI core kthread while the IRQ handler is still accessing the FIFO on another CPU. Resetting the chip via dw_spi_reset_chip() during an active FIFO read/write causes a bus error. Fix this by calling disable_irq() before the chip reset, which masks the IRQ and waits for any in-flight handler to complete via synchronize_irq(). This ensures no handler is accessing the FIFO when the reset occurs. Signed-off-by: Peng Yang <pyangyyd@amazon.com> Suggested-by: Jonathan Chocron <jonnyc@amazon.com> Link: https://patch.msgid.link/20260608095849.3446-1-pyangyyd@amazon.com Signed-off-by: Mark Brown <broonie@kernel.org> 
On SMP systems, dw_spi_handle_err() can be called from the SPI core
kthread while the IRQ handler is still accessing the FIFO on another
CPU. Resetting the chip via dw_spi_reset_chip() during an active FIFO
read/write causes a bus error.

Fix this by calling disable_irq() before the chip reset, which masks
the IRQ and waits for any in-flight handler to complete via
synchronize_irq(). This ensures no handler is accessing the FIFO when
the reset occurs.

Signed-off-by: Peng Yang <pyangyyd@amazon.com>
Suggested-by: Jonathan Chocron <jonnyc@amazon.com>
Link: https://patch.msgid.link/20260608095849.3446-1-pyangyyd@amazon.com
Signed-off-by: Mark Brown <broonie@kernel.org>
spi: qcom-geni: Fix cs_change handling on the last transfer 2026-06-09T21:40:47+00:00 Viken Dadhaniya viken.dadhaniya@oss.qualcomm.com 2026-06-09T08:43:09+00:00 5ac5ec84734fd338867055d4d7b650f18a023cb0 TPM TIS SPI probe fails with: tpm_tis_spi: probe of spi11.0 failed with error -110 TPM TIS SPI sets cs_change=1 on single-transfer messages to keep CS asserted across the header, wait-state, and data phases of a transaction. CS deassertion between these phases violates the TCG SPI flow control specification. This bug was introduced by commit b99181cdf9fa ("spi-geni-qcom: remove manual CS control"), which replaced manual CS control with automatic CS control via the FRAGMENTATION bit. The FRAGMENTATION bit controls CS behavior after a transfer: when set to 1, CS remains asserted; when cleared to 0, CS is deasserted. The commit correctly sets FRAGMENTATION for non-last transfers with cs_change=0 to keep CS asserted between chained transfers, but misses the case where cs_change=1 is set on the last transfer. When cs_change=1 on the last transfer, the client requests CS to remain asserted after the message completes, so FRAGMENTATION must be set to 1 in this case as well. Fix setup_se_xfer() to set FRAGMENTATION when cs_change=1 on the last transfer. Also fix the same missing case in setup_gsi_xfer() and correct it to write 1 instead of the raw bitmask FRAGMENTATION (value 4) to peripheral.fragmentation. This field is a 1-bit boolean consumed by gpi_create_spi_tre() via u32_encode_bits(..., TRE_SPI_GO_FRAG). Writing 4 to a 1-bit field causes u32_encode_bits() to mask it to 0, silently disabling the FRAGMENTATION bit in the GPI TRE regardless of the cs_change logic. Fixes: b99181cdf9fa ("spi-geni-qcom: remove manual CS control") Cc: stable@vger.kernel.org Reviewed-by: Jonathan Marek <jonathan@marek.ca> Signed-off-by: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com> Link: https://patch.msgid.link/20260609-fix-spi-fragmentation-bit-logic-v2-1-e18efc255563@oss.qualcomm.com Signed-off-by: Mark Brown <broonie@kernel.org> 
TPM TIS SPI probe fails with:

   tpm_tis_spi: probe of spi11.0 failed with error -110

TPM TIS SPI sets cs_change=1 on single-transfer messages to keep CS
asserted across the header, wait-state, and data phases of a transaction.
CS deassertion between these phases violates the TCG SPI flow control
specification.

This bug was introduced by commit b99181cdf9fa ("spi-geni-qcom: remove
manual CS control"), which replaced manual CS control with automatic CS
control via the FRAGMENTATION bit. The FRAGMENTATION bit controls CS
behavior after a transfer: when set to 1, CS remains asserted; when
cleared to 0, CS is deasserted.

The commit correctly sets FRAGMENTATION for non-last transfers with
cs_change=0 to keep CS asserted between chained transfers, but misses the
case where cs_change=1 is set on the last transfer. When cs_change=1 on
the last transfer, the client requests CS to remain asserted after the
message completes, so FRAGMENTATION must be set to 1 in this case as well.

Fix setup_se_xfer() to set FRAGMENTATION when cs_change=1 on the last
transfer.

Also fix the same missing case in setup_gsi_xfer() and correct it to
write 1 instead of the raw bitmask FRAGMENTATION (value 4) to
peripheral.fragmentation. This field is a 1-bit boolean consumed by
gpi_create_spi_tre() via u32_encode_bits(..., TRE_SPI_GO_FRAG). Writing 4
to a 1-bit field causes u32_encode_bits() to mask it to 0, silently
disabling the FRAGMENTATION bit in the GPI TRE regardless of the
cs_change logic.

Fixes: b99181cdf9fa ("spi-geni-qcom: remove manual CS control")
Cc: stable@vger.kernel.org
Reviewed-by: Jonathan Marek <jonathan@marek.ca>
Signed-off-by: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
Link: https://patch.msgid.link/20260609-fix-spi-fragmentation-bit-logic-v2-1-e18efc255563@oss.qualcomm.com
Signed-off-by: Mark Brown <broonie@kernel.org>
spi: spi-mem: avoid mutating op template in spi_mem_supports_op() 2026-05-28T12:49:00+00:00 Santhosh Kumar K s-k6@ti.com 2026-05-27T17:37:36+00:00 79378db6a86c7014cce40b65252e6c18f5b8bcc2 spi_mem_supports_op() accepts a const struct spi_mem_op pointer but casts away const internally to call spi_mem_adjust_op_freq(). This mutates the caller's op template, which causes stale max_freq values when callers reuse persistent templates - subsequent calls won't re-apply the device frequency cap since spi_mem_adjust_op_freq() skips non-zero values. Fix by operating on a stack-local copy instead. Fixes: a4f8e70d75dd ("spi: spi-mem: add spi_mem_adjust_op_freq() in spi_mem_supports_op()") Cc: Tianyu Xu <xtydtc@gmail.com> Cc: stable@vger.kernel.org Signed-off-by: Santhosh Kumar K <s-k6@ti.com> Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com> Link: https://patch.msgid.link/20260527173736.2243004-1-s-k6@ti.com Signed-off-by: Mark Brown <broonie@kernel.org> 
spi_mem_supports_op() accepts a const struct spi_mem_op pointer but
casts away const internally to call spi_mem_adjust_op_freq(). This
mutates the caller's op template, which causes stale max_freq values
when callers reuse persistent templates - subsequent calls won't
re-apply the device frequency cap since spi_mem_adjust_op_freq()
skips non-zero values.

Fix by operating on a stack-local copy instead.

Fixes: a4f8e70d75dd ("spi: spi-mem: add spi_mem_adjust_op_freq() in spi_mem_supports_op()")
Cc: Tianyu Xu <xtydtc@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Santhosh Kumar K <s-k6@ti.com>
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://patch.msgid.link/20260527173736.2243004-1-s-k6@ti.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Merge tag 'spi-fix-v7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi 2026-05-22T20:19:41+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-05-22T20:19:41+00:00 e216d85eaf4ca525520ca2c0a7d99ee8639a5718 Pull spi fixes from Mark Brown: "Another batch of driver fixes from Johan fixing error handling paths, plus another from Felix. We also have a new device ID added in the DT bindings for SpacemiT K3" * tag 'spi-fix-v7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: dt-bindings: fsl-qspi: support SpacemiT K3 spi: ti-qspi: fix use-after-free after DMA setup failure spi: sprd: fix error pointer deref after DMA setup failure spi: qup: fix error pointer deref after DMA setup failure spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() spi: ep93xx: fix error pointer deref after DMA setup failure 
Pull spi fixes from Mark Brown:
 "Another batch of driver fixes from Johan fixing error handling paths,
  plus another from Felix. We also have a new device ID added in the DT
  bindings for SpacemiT K3"

* tag 'spi-fix-v7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
  spi: dt-bindings: fsl-qspi: support SpacemiT K3
  spi: ti-qspi: fix use-after-free after DMA setup failure
  spi: sprd: fix error pointer deref after DMA setup failure
  spi: qup: fix error pointer deref after DMA setup failure
  spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache()
  spi: ep93xx: fix error pointer deref after DMA setup failure
spi: ti-qspi: fix use-after-free after DMA setup failure 2026-05-18T16:40:51+00:00 Johan Hovold johan@kernel.org 2026-05-12T07:48:09+00:00 ea6ec3343e05f7937a53eb6d7617b3abdb4abc19 The driver falls back to PIO mode if DMA setup fails during probe. Make sure to clear the DMA channel pointer also if buffer allocation fails to avoid passing a pointer to the released channel to the DMA engine (or trying to free the channel a second time on late probe errors or driver unbind). This issue was flagged by Sashiko when reviewing a devres allocation conversion patch. Fixes: c687c46e9e45 ("spi: spi-ti-qspi: Use bounce buffer if read buffer is not DMA'ble") Link: https://sashiko.dev/#/patchset/20260505072909.618363-1-johan%40kernel.org?part=17 Cc: stable@vger.kernel.org # 4.12 Cc: Vignesh R <vigneshr@ti.com> Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260512074809.915084-1-johan@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org> 
The driver falls back to PIO mode if DMA setup fails during probe.

Make sure to clear the DMA channel pointer also if buffer allocation
fails to avoid passing a pointer to the released channel to the DMA
engine (or trying to free the channel a second time on late probe errors
or driver unbind).

This issue was flagged by Sashiko when reviewing a devres allocation
conversion patch.

Fixes: c687c46e9e45 ("spi: spi-ti-qspi: Use bounce buffer if read buffer is not DMA'ble")
Link: https://sashiko.dev/#/patchset/20260505072909.618363-1-johan%40kernel.org?part=17
Cc: stable@vger.kernel.org	# 4.12
Cc: Vignesh R <vigneshr@ti.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260512074809.915084-1-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
spi: sprd: fix error pointer deref after DMA setup failure 2026-05-18T16:40:30+00:00 Johan Hovold johan@kernel.org 2026-05-12T07:47:33+00:00 3d67fffb74267772d461c02c67f1eff893ad547d The driver falls back to PIO mode if DMA setup fails during probe. Make sure to check the dma.enabled flag before trying to release the DMA channels also on late probe errors to avoid dereferencing an error pointer (or attempting to release a channel a second time). This issue was flagged by Sashiko when reviewing a devres allocation conversion patch. Fixes: 386119bc7be9 ("spi: sprd: spi: sprd: Add DMA mode support") Link: https://sashiko.dev/#/patchset/20260505072909.618363-1-johan%40kernel.org?part=10 Cc: stable@vger.kernel.org # 5.1 Cc: Lanqing Liu <lanqing.liu@unisoc.com> Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260512074733.915029-1-johan@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org> 
The driver falls back to PIO mode if DMA setup fails during probe.

Make sure to check the dma.enabled flag before trying to release the DMA
channels also on late probe errors to avoid dereferencing an error
pointer (or attempting to release a channel a second time).

This issue was flagged by Sashiko when reviewing a devres allocation
conversion patch.

Fixes: 386119bc7be9 ("spi: sprd: spi: sprd: Add DMA mode support")
Link: https://sashiko.dev/#/patchset/20260505072909.618363-1-johan%40kernel.org?part=10
Cc: stable@vger.kernel.org	# 5.1
Cc: Lanqing Liu <lanqing.liu@unisoc.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260512074733.915029-1-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
spi: qup: fix error pointer deref after DMA setup failure 2026-05-18T16:36:26+00:00 Johan Hovold johan@kernel.org 2026-05-12T07:43:34+00:00 a7e8f3efd50a165ba0189f6dc57f7e51a7d149db The driver falls back to PIO mode if DMA setup fails during probe. Make sure to the clear the DMA channel pointers on setup failure to avoid dereferencing an error pointer (or attempting to release a channel a second time) on later probe errors or driver unbind. This issue was flagged by Sashiko when reviewing a devres allocation conversion patch. Fixes: 612762e82ae6 ("spi: qup: Add DMA capabilities") Link: https://sashiko.dev/#/patchset/20260505072909.618363-1-johan%40kernel.org?part=4 Cc: stable@vger.kernel.org # 4.1 Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260512074334.914735-1-johan@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org> 
The driver falls back to PIO mode if DMA setup fails during probe.

Make sure to the clear the DMA channel pointers on setup failure to
avoid dereferencing an error pointer (or attempting to release a channel
a second time) on later probe errors or driver unbind.

This issue was flagged by Sashiko when reviewing a devres allocation
conversion patch.

Fixes: 612762e82ae6 ("spi: qup: Add DMA capabilities")
Link: https://sashiko.dev/#/patchset/20260505072909.618363-1-johan%40kernel.org?part=4
Cc: stable@vger.kernel.org	# 4.1
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260512074334.914735-1-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() 2026-05-16T02:27:08+00:00 Felix Gu ustc.gu@gmail.com 2026-05-09T17:55:37+00:00 496ba79b9496b8b3747cbc764ebd33ee7325e806 When DMA read times out in mtk_snand_read_page_cache(), the original code erroneously jumped to cleanup label which skips DMA unmapping and ECC disable, causing a resource leak. Fixes: 764f1b748164 ("spi: add driver for MTK SPI NAND Flash Interface") Signed-off-by: Felix Gu <ustc.gu@gmail.com> Link: https://patch.msgid.link/20260510-snfi-v1-1-bc375cf1af8e@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org> 
When DMA read times out in mtk_snand_read_page_cache(), the original code
erroneously jumped to cleanup label which skips DMA unmapping and ECC
disable, causing a resource leak.

Fixes: 764f1b748164 ("spi: add driver for MTK SPI NAND Flash Interface")
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Link: https://patch.msgid.link/20260510-snfi-v1-1-bc375cf1af8e@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>