nvec_power_probe() calls devm_kzalloc() with GFP_NOWAIT, which
disables direct reclaim and is meant for atomic context. probe()
runs in normal process context and may sleep, so this needlessly
risks a spurious -ENOMEM under memory pressure instead of just
waiting for reclaim like every other probe() allocation does.

nvec.c's own tegra_nvec_probe() already uses GFP_KERNEL for the
identical pattern, confirming this is an oversight, not intentional.

Signed-off-by: Igor Putko <igorpetindev@gmail.com>
Acked-by: Marc Dietrich <marvin24@gmx.de>
Link: https://patch.msgid.link/20260710150113.3041-1-igorpetindev@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Remove extra space in 'enum nvec_msg_category  {' declaration.

Signed-off-by: Dorian Catric <dorian.catric@gmail.com>
Link: https://patch.msgid.link/20260603172719.398-2-dorian.catric@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Fix typo 'lauchpad.net' -> 'launchpad.net' in the copyright header.
The correct spelling is already used in nvec.h.

Signed-off-by: Dorian Catric <dorian.catric@gmail.com>
Link: https://patch.msgid.link/20260603172719.398-1-dorian.catric@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

tegra_nvec_remove() unconditionally sets pm_power_off = NULL, even if
nvec was not the one that registered it. This breaks any other driver
that may have set pm_power_off to its own handler.

Replace the unconditional assignment with a guarded check so that
pm_power_off is only cleared if nvec was the one that set it.

Also remove the stale FIXME comment, as the guard addresses exactly
what it was asking for.

Reviewed-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
Link: https://patch.msgid.link/20260427081713.3401874-3-hossu.alexandru@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

In nvec_rx_completed(), when an incomplete RX transfer is detected,
nvec_msg_free() is called to return the message back to the pool by
clearing its 'used' atomic flag. Immediately after this, the code
accesses nvec->rx->data[0] to check the message type.

Since nvec_msg_free() marks the pool slot as available via atomic_set(),
any concurrent or subsequent call to nvec_msg_alloc() could claim that
same slot and overwrite its data[] array. Reading nvec->rx->data[0] after
freeing the message is therefore a use-after-free.

Fix this by saving the message type byte before calling nvec_msg_free(),
then using the saved value for the battery quirk check.

Fixes: d6bdcf2e1019 ("staging: nvec: Add battery quirk to ignore incomplete responses")
Reviewed-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
Link: https://patch.msgid.link/20260427081713.3401874-2-hossu.alexandru@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Fix multi-line block comment to use the preferred kernel comment style
with leading asterisks on each line and a trailing */ on a separate
line, as reported by checkpatch.pl.

Signed-off-by: Kibaek Yoo <psykibaek@gmail.com>
Reviewed-by: Ethan Tidmore <ethantidmore06@gmail.com>
Link: https://patch.msgid.link/20260224044946.54022-1-psykibaek@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Several error paths in tegra_nvec_probe() return -ENODEV instead of
propagating the actual error code from the called function. This
prevents probe deferral from working correctly when a dependency
(clock, IRQ) is not yet available.

Fix this for platform_get_irq(), devm_clk_get(), and
devm_request_irq() by propagating their return values. Use
dev_err_probe() for the latter two to suppress log messages during
deferred probing.

The remaining -ENODEV returns for missing device tree node and
slave-addr property are left unchanged as those are permanent
configuration errors unrelated to probe deferral.

Signed-off-by: Artem Lytkin <iprintercanon@gmail.com>
Link: https://patch.msgid.link/20260216202011.1806-1-iprintercanon@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

This was done entirely with mindless brute force, using

    git grep -l '\<k[vmz]*alloc_objs*(.*, GFP_KERNEL)' |
        xargs sed -i 's/\(alloc_objs*(.*\), GFP_KERNEL)/\1)/'

to convert the new alloc_obj() users that had a simple GFP_KERNEL
argument to just drop that argument.

Note that due to the extreme simplicity of the scripting, any slightly
more complex cases spread over multiple lines would not be triggered:
they definitely exist, but this covers the vast bulk of the cases, and
the resulting diff is also then easier to check automatically.

For the same reason the 'flex' versions will be done as a separate
conversion.

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

This is the result of running the Coccinelle script from
scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to
avoid scalar types (which need careful case-by-case checking), and
instead replace kmalloc-family calls that allocate struct or union
object instances:

Single allocations:	kmalloc(sizeof(TYPE), ...)
are replaced with:	kmalloc_obj(TYPE, ...)

Array allocations:	kmalloc_array(COUNT, sizeof(TYPE), ...)
are replaced with:	kmalloc_objs(TYPE, COUNT, ...)

Flex array allocations:	kmalloc(struct_size(PTR, FAM, COUNT), ...)
are replaced with:	kmalloc_flex(*PTR, FAM, COUNT, ...)

(where TYPE may also be *VAR)

The resulting allocations no longer return "void *", instead returning
"TYPE *".

Signed-off-by: Kees Cook <kees@kernel.org>

Due to a HW bug in the Tegra20 SoC a udelay needs to be added after
the first byte has been sent to the EC (I2C master). Move it to the
correct position and add a comment that it should not be replaced by
usleep_range.

Signed-off-by: Marc Dietrich <marvin24@gmx.de>
Link: https://patch.msgid.link/20260103101439.14863-1-marvin24@gmx.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>