summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2025-12-15sched/fair: Introduce and use the vruntime_cmp() and vruntime_op() wrappers ↵Ingo Molnar
for wrapped-signed aritmetics We have to be careful with vruntime comparisons and subtraction, due to the possibility of wrapping, so we have macros like: #define vruntime_gt(field, lse, rse) ({ (s64)((lse)->field - (rse)->field) > 0; }) Which is used like this: if (vruntime_gt(min_vruntime, se, rse)) se->min_vruntime = rse->min_vruntime; Replace this with an easier to read pattern that uses the regular arithmetics operators: if (vruntime_cmp(se->min_vruntime, ">", rse->min_vruntime)) se->min_vruntime = rse->min_vruntime; Also replace vruntime subtractions with vruntime_op(): - delta = (s64)(sea->vruntime - seb->vruntime) + - (s64)(cfs_rqb->zero_vruntime_fi - cfs_rqa->zero_vruntime_fi); + delta = vruntime_op(sea->vruntime, "-", seb->vruntime) + + vruntime_op(cfs_rqb->zero_vruntime_fi, "-", cfs_rqa->zero_vruntime_fi); In the vruntime_cmp() and vruntime_op() macros use Use __builtin_strcmp(), because of __HAVE_ARCH_STRCMP might turn off the compiler optimizations we rely on here to catch usage bugs. No change in functionality. Signed-off-by: Ingo Molnar <mingo@kernel.org>
2025-12-15sched/fair: Rename cfs_rq::avg_vruntime to ::sum_w_vruntime, and helper ↵Ingo Molnar
functions The ::avg_vruntime field is a misnomer: it says it's an 'average vruntime', but in reality it's the momentary sum of the weighted vruntimes of all queued tasks, which is at least a division away from being an average. This is clear from comments about the math of fair scheduling: * \Sum (v_i - v0) * w_i := cfs_rq->avg_vruntime This confusion is increased by the cfs_avg_vruntime() function, which does perform the division and returns a true average. The sum of all weighted vruntimes should be named thusly, so rename the field to ::sum_w_vruntime. (As arguably ::sum_weighted_vruntime would be a bit of a mouthful.) Understanding the scheduler is hard enough already, without extra layers of obfuscated naming. ;-) Also rename related helper functions: sum_vruntime_add() => sum_w_vruntime_add() sum_vruntime_sub() => sum_w_vruntime_sub() sum_vruntime_update() => sum_w_vruntime_update() With the notable exception of cfs_avg_vruntime(), which was named accurately. Signed-off-by: Ingo Molnar <mingo@kernel.org> Link: https://patch.msgid.link/20251201064647.1851919-7-mingo@kernel.org
2025-12-15sched/fair: Rename cfs_rq::avg_load to cfs_rq::sum_weightIngo Molnar
The ::avg_load field is a long-standing misnomer: it says it's an 'average load', but in reality it's the momentary sum of the load of all currently runnable tasks. We'd have to also perform a division by nr_running (or use time-decay) to arrive at any sort of average value. This is clear from comments about the math of fair scheduling: * \Sum w_i := cfs_rq->avg_load The sum of all weights is ... the sum of all weights, not the average of all weights. To make it doubly confusing, there's also an ::avg_load in the load-balancing struct sg_lb_stats, which *is* a true average. The second part of the field's name is a minor misnomer as well: it says 'load', and it is indeed a load_weight structure as it shares code with the load-balancer - but it's only in an SMP load-balancing context where load = weight, in the fair scheduling context the primary purpose is the weighting of different nice levels. So rename the field to ::sum_weight instead, which makes the terminology of the EEVDF math match up with our implementation of it: * \Sum w_i := cfs_rq->sum_weight Signed-off-by: Ingo Molnar <mingo@kernel.org> Link: https://patch.msgid.link/20251201064647.1851919-6-mingo@kernel.org
2025-12-15sched/fair: Separate se->vlag from se->vprotIngo Molnar
There's no real space concerns here and keeping these fields in a union makes reading (and tracing) the scheduler code harder. Signed-off-by: Ingo Molnar <mingo@kernel.org> Link: https://patch.msgid.link/20251201064647.1851919-4-mingo@kernel.org
2025-12-15sched/fair: Clean up comments in 'struct cfs_rq'Ingo Molnar
- Fix vertical alignment - Fix typos - Fix capitalization Signed-off-by: Ingo Molnar <mingo@kernel.org> Link: https://patch.msgid.link/20251201064647.1851919-3-mingo@kernel.org
2025-12-15sched/fair: Join two #ifdef CONFIG_FAIR_GROUP_SCHED blocksIngo Molnar
Join two identical #ifdef blocks: #ifdef CONFIG_FAIR_GROUP_SCHED ... #endif #ifdef CONFIG_FAIR_GROUP_SCHED ... #endif Also mark nested #ifdef blocks in the usual fashion, to make it more apparent where in a nested hierarchy of #ifdefs we are at a glance. Signed-off-by: Ingo Molnar <mingo@kernel.org> Reviewed-by: Shrikanth Hegde <sshegde@linux.ibm.com> Link: https://patch.msgid.link/20251201064647.1851919-2-mingo@kernel.org
2025-12-15ASoC: Intel: catpt: IPC log improvements and codeMark Brown
Merge series from Cezary Rojewski <cezary.rojewski@intel.com>: Entire patchset provides no new features and does not alter the code from functional (user) perspective. The first two improve IPC-error logging 'mechanism' and align the catpt-driver with what's done in another Intel's driver: the avs-driver. In essence, no need to log the error in every function, let the common handler do so instead. The last three simplify the code, and fix some spacing issues. All in all, we get better readability with lower LOC.
2025-12-14remoteproc: imx_dsp_rproc: Wait for suspend ACK only if WAIT_FW_CONFIRMATION ↵Iuliana Prodan
is set The DSP suspend path currently waits unconditionally for a suspend ack from the firmware. This breaks firmwares that do not implement the mailbox-based CONFIRMATION handshake, as the DSP never responds and system suspend fails with -EBUSY. The driver already uses the WAIT_FW_CONFIRMATION flag to indicate that the firmware supports the CONFIRMATION handshake at boot. Apply the same logic during suspend: only send the suspend message and wait for the suspend ack when the firmware is expected to support it. Signed-off-by: Iuliana Prodan <iuliana.prodan@nxp.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com> Link: https://lore.kernel.org/r/20251204122825.756106-3-iuliana.prodan@oss.nxp.com Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
2025-12-14remoteproc: imx_dsp_rproc: Rename macro to reflect multiple contextsIuliana Prodan
Rename WAIT_FW_READY to WAIT_FW_CONFIRMATION and FEATURE_DONT_WAIT_FW_READY to FEATURE_SKIP_FW_CONFIRMATION. This way, the term CONFIRMATION covers: - waiting for firmware to confirm it is ready to start; - waiting for any other confirmation from firmware. Signed-off-by: Iuliana Prodan <iuliana.prodan@nxp.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com> Link: https://lore.kernel.org/r/20251204122825.756106-2-iuliana.prodan@oss.nxp.com Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
2025-12-14remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX ↵Iuliana Prodan
channel is uninitialized Firmwares that do not use mailbox communication (e.g., the hello_world sample) leave priv->tx_ch as NULL. The current suspend logic unconditionally sends RP_MBOX_SUSPEND_SYSTEM, which is invalid without an initialized TX channel. Detect the no_mailboxes case early and skip sending the suspend message. Instead, proceed directly to the runtime PM suspend path, which is the correct behavior for firmwares that cannot respond to mailbox requests. Signed-off-by: Iuliana Prodan <iuliana.prodan@nxp.com> Link: https://lore.kernel.org/r/20251204122825.756106-1-iuliana.prodan@oss.nxp.com Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
2025-12-14dt-bindings: remoteproc: Fix dead link to Keystone DSP GPIO bindingSoham Metha
The old text binding 'gpio-dsp-keystone.txt' was replaced by a DT schema in commit aff0a1701b020c8e6b172f28828fd4f3e6eed41a ("dt-bindings: gpio: Convert ti,keystone-dsp-gpio to DT schema"). Update the reference to point to the new file. Signed-off-by: Soham Metha <sohammetha01@gmail.com> Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://lore.kernel.org/r/20251203180337.50831-1-sohammetha01@gmail.com Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
2025-12-14rpmsg: core: fix race in driver_override_show() and use core helperGui-Dong Han
The driver_override_show function reads the driver_override string without holding the device_lock. However, the store function modifies and frees the string while holding the device_lock. This creates a race condition where the string can be freed by the store function while being read by the show function, leading to a use-after-free. To fix this, replace the rpmsg_string_attr macro with explicit show and store functions. The new driver_override_store uses the standard driver_set_override helper. Since the introduction of driver_set_override, the comments in include/linux/rpmsg.h have stated that this helper must be used to set or clear driver_override, but the implementation was not updated until now. Because driver_set_override modifies and frees the string while holding the device_lock, the new driver_override_show now correctly holds the device_lock during the read operation to prevent the race. Additionally, since rpmsg_string_attr has only ever been used for driver_override, removing the macro simplifies the code. Fixes: 39e47767ec9b ("rpmsg: Add driver_override device attribute for rpmsg_device") Cc: stable@vger.kernel.org Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com> Link: https://lore.kernel.org/r/20251202174948.12693-1-hanguidong02@gmail.com Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
2025-12-14rpmsg: virtio: EPOLLOUT supportPatrick Oppenlander
Previously, polling an rpmsg endpoint (e.g. /dev/ttyRPMSGx) would generate EPOLLIN events but no EPOLLOUT events. Unfortunately, poll support means that we can no longer disable tx-complete interrupts as there is no way to know whether a poller is waiting in sendq, so we always need notifications. Signed-off-by: Patrick Oppenlander <patrick.oppenlander@gmail.com> Link: https://lore.kernel.org/r/20251022032817.320378-1-patrick.oppenlander@gmail.com Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
2025-12-15Add support for MAX77675 deviceMark Brown
Merge series from Joan Na <joan.na@analog.com>: MAX77675 regulator driver and device tree bindings
2025-12-15ASoC: amd/sdw: Fix confusing cleanup.hMark Brown
Merge series from Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>: cleanup.h coding style asks to avoid having constructors with redundant values (= NULL). On purpose, because it is just not making the code simpler. The constructor should be meaningful not just NULL. If you do not agree in declaration-in-place-of-use (fair!), then do not use cleanup.h. If you want to use cleanup.h, then please read cleanup.h before.
2025-12-15Add {24,32}-bit sample width support for RZ/G2L SSIMark Brown
Merge series from Biju <biju.das.au@gmail.com>: Add support for 24 and 32-bit sample format width for RZ/G2L SoCs. Apart from this, the patch series includes some code cleanups.
2025-12-15ASoC: qcom: Fix confusing cleanup.hMark Brown
Merge series from Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>: Please, please stop ending cleanup.h patches for very simple code like: foo = kzalloc(); kfree(foo); return; ... *if you do not intend to read cleanup.h*. These changes are making simple code not necessarily simpler. But worse, if you do not read cleanup.h then you introduce actually undesired, error-prone and wrong style of having constructors with redundant values (= NULL). This is actually worse code. If you do not agree in declaration-in-place-of-use (fair!), then do not use cleanup.h. If you want to use cleanup.h, then please read cleanup.h before. This is second mixup I see recently around Qualcomm files.
2025-12-15Add DMA support for RZ/T2H RSPIMark Brown
Merge series from Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com>: The DMA controller can be used to transfer data to and from the SPI controller without involving the CPU for each word of a SPI transfer. Add support for DMA mode, and do some other cleanups while touching the same code.
2025-12-15Support ECSPI dynamic burst feature for DMA modeMark Brown
Merge series from Carlos Song <carlos.song@nxp.com>: ECSPI has a low throughput because of no dynamic burst support, it transfers only one word per frame in DMA mode, causing SCLK stalls between words due to BURST_LENGTH updates. This patch set is to support ECSPI dynamic burst feature to help improve the ECSPI DMA mode performance. Performance test (spidev_test @10MHz, 4KB): Before: tx/rx ~6651.9 kbps After: tx/rx ~9922.2 kbps (~50% improvement) For compatibility with slow SPI devices, add configurable word delay in DMA mode. When word delay is set, dynamic burst is disabled and BURST_LENGTH equals word length. Also support target DMA mode with enabled dynamic burst. --- Changes since v2: * Patch1~4: no change * Patch5: remove __counted_by from *dma_data, because spi_imx struct is allocated with a fixed memory in probe, flexible array is not suitable, so just remove it to avoid the build error. Also add review-by tag * Patch6: add review-by tag Changes since v1: * Patch1~3: * Add review-by tag * Patch4: * Add review-by tag * Improve patch commit log * Patch5: * Clean up tab instead of space for dma_tx_addr and dma_rx_addr * Add __counted_by(dma_package_num) for dma_data_package *dma_data * Move temp and bytes_per_word to if() * Add comment for spi_imx_dma_rx_data_handle() and spi_imx_dma_tx_data_handle() * Use kzalloc instead of kmalloc(x, x | __GFP_ZERO) * Use sizeof(*temp) instead of BYTES_PER_32BITS_WORD in suitable place * Add comments and fix comments according to discussion * Propagate the error value of dma_mapping_error() * Use round_down() to replace DIV_ROUND_DOWN_ULL() * Improve transfer->error |= SPI_TRANS_FAIL_NO_START judgment for better readability * Patch6: * Improve patch commit log * Add READ_ONCE for spi_imx->target_aborted * Add comments for data length limit * Move data length limit to spi_imx_can_dma() Carlos Song (6): spi: imx: group spi_imx_dma_configure() with spi_imx_dma_transfer() spi: imx: introduce helper to clear DMA mode logic spi: imx: avoid dmaengine_terminate_all() on TX prep failure spi: imx: handle DMA submission errors with dma_submit_error() spi: imx: support dynamic burst length for ECSPI DMA mode spi: imx: enable DMA mode for target operation drivers/spi/spi-imx.c | 625 +++++++++++++++++++++++++++++++++++------- 1 file changed, 519 insertions(+), 106 deletions(-) -- 2.34.1
2025-12-15spi: stm32: Update for OSPI and QSPI driversMark Brown
Merge series from Patrice Chotard <patrice.chotard@foss.st.com>: This serie applies the following updates on the spi-stm32-ospi and spi-stm32-qspi dirvers : _ Update FIFO accesses using u16 and u32 when possible instead of u8 only to optimize throughput. _ Replace Transmit Complete and Transmit Error interrupt management by usage of read_poll_timeout_atomic() to optimize throughtput. _ Simplify Status Match interrupt check. _ Set DMA burst configuration dynamically. Signed-off-by: Patrice Chotard <patrice.chotard@foss.st.com> --- Changes in v2: - Fix compilation error in stm32_ospi_wait_cmd() - Link to v1: https://lore.kernel.org/r/20251205-upstream_qspi_ospi_updates-v1-0-7e6c8b9f5141@foss.st.com --- Patrice Chotard (8): spi: stm32-ospi: Set DMA maxburst dynamically spi: stm32-ospi: Optimize FIFO accesses using u16 or u32 spi: stm32-ospi: Remove CR_TCIE and CR_TEIE irq usage spi: stm32-ospi: Simplify SMIE interrupt test spi: stm32-qspi: Set DMA maxburst dynamically spi: stm32-qspi: Optimize FIFO accesses using u16 or u32 spi: stm32-qspi: Remove CR_TCIE and CR_TEIE irq usage spi: stm32-qspi: Simplify SMIE interrupt test drivers/spi/spi-stm32-ospi.c | 107 +++++++++++++++++++++++++---------------- drivers/spi/spi-stm32-qspi.c | 111 +++++++++++++++++++++++++------------------ 2 files changed, 132 insertions(+), 86 deletions(-) --- base-commit: 7d0a66e4bb9081d75c82ec4957c50034cb0ea449 change-id: 20251205-upstream_qspi_ospi_updates-4faf7a3b098c Best regards, -- Patrice Chotard <patrice.chotard@foss.st.com>
2025-12-14ksmbd: fix buffer validation by including null terminator size in EA lengthNamjae Jeon
The smb2_set_ea function, which handles Extended Attributes (EA), was performing buffer validation checks that incorrectly omitted the size of the null terminating character (+1 byte) for EA Name. This patch fixes the issue by explicitly adding '+ 1' to EaNameLength where the null terminator is expected to be present in the buffer, ensuring the validation accurately reflects the total required buffer size. Cc: stable@vger.kernel.org Reported-by: Roger <roger.andersen@protonmail.com> Reported-by: Stanislas Polu <spolu@dust.tt> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-14ksmbd: Fix refcount leak when invalid session is found on session lookupNamjae Jeon
When a session is found but its state is not SMB2_SESSION_VALID, It indicates that no valid session was found, but it is missing to decrement the reference count acquired by the session lookup, which results in a reference count leak. This patch fixes the issue by explicitly calling ksmbd_user_session_put to release the reference to the session. Cc: stable@vger.kernel.org Reported-by: Alexandre <roger.andersen@protonmail.com> Reported-by: Stanislas Polu <spolu@dust.tt> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-14ksmbd: remove redundant DACL check in smb_check_perm_daclAlexey Velichayshiy
A zero value of pdacl->num_aces is already handled at the start of smb_check_perm_dacl() so the second check is useless. Drop the unreachable code block, no functional impact intended. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Alexey Velichayshiy <a.velichayshiy@ispras.ru> Acked-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-14ksmbd: convert comma to semicolonChen Ni
Replace comma between expressions with semicolons. Using a ',' in place of a ';' can have unintended side effects. Although that is not the case here, it is seems best to use ';' unless ',' is intended. Found by inspection. No functional change intended. Compile tested only. Signed-off-by: Chen Ni <nichen@iscas.ac.cn> Acked-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-14smb: server: defer the initial recv completion logic to ↵Stefan Metzmacher
smb_direct_negotiate_recv_work() The previous change to relax WARN_ON_ONCE(SMBDIRECT_SOCKET_*) checks in recv_done() and smb_direct_cm_handler() seems to work around the problem that the order of initial recv completion and RDMA_CM_EVENT_ESTABLISHED is random, but it's still a bit ugly. This implements a better solution deferring the recv completion processing to smb_direct_negotiate_recv_work(), which is queued only if both events arrived. In order to avoid more basic changes to the main recv_done callback, I introduced a smb_direct_negotiate_recv_done, which is only used for the first pdu, this will allow further cleanup and simplifications in recv_done as a future patch. smb_direct_negotiate_recv_work() is also very basic with only basic error checking and the transition from SMBDIRECT_SOCKET_NEGOTIATE_NEEDED to SMBDIRECT_SOCKET_NEGOTIATE_RUNNING, which allows smb_direct_prepare() to continue as before. Cc: Tom Talpey <tom@talpey.com> Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher <metze@samba.org> Acked-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-14smb: server: initialize recv_io->cqe.done = recv_done just onceStefan Metzmacher
smbdirect_recv_io structures are pre-allocated so we can set the callback function just once. This will make it easy to move smb_direct_post_recv to common code soon. Cc: Tom Talpey <tom@talpey.com> Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher <metze@samba.org> Acked-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-14smb: smbdirect: introduce smbdirect_socket.connect.{lock,work}Stefan Metzmacher
This will first be used by the server in order to defer the processing of the initial recv of the negotiation request. But in future it will also be used by the client in order to implement an async connect. Cc: Tom Talpey <tom@talpey.com> Cc: Long Li <longli@microsoft.com> Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher <metze@samba.org> Acked-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-14lib/crypto: riscv: Add poly1305-core.S to .gitignoreCharles Mirabile
poly1305-core.S is an auto-generated file, so it should be ignored. Fixes: bef9c7559869 ("lib/crypto: riscv/poly1305: Import OpenSSL/CRYPTOGAMS implementation") Cc: stable@vger.kernel.org Signed-off-by: Charles Mirabile <cmirabil@redhat.com> Link: https://lore.kernel.org/r/20251212184717.133701-1-cmirabil@redhat.com Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2025-12-14arm64/simd: Avoid pointless clearing of FP/SIMD bufferArd Biesheuvel
The buffer provided to kernel_neon_begin() is only used if the task is scheduled out while the FP/SIMD is in use by the kernel, or when such a section is interrupted by a softirq that also uses the FP/SIMD. IOW, this happens rarely, and even if it happened often, there is still no reason for this buffer to be cleared beforehand, which happens unconditionally, due to the use of a compound literal expression. So define that buffer variable explicitly, and mark it as __uninitialized so that it will not get cleared, even when -ftrivial-auto-var-init is in effect. This requires some preprocessor gymnastics, due to the fact that the variable must be defined throughout the entire guarded scope, and the expression ({ struct user_fpsimd_state __uninitialized st; &st; }) is problematic in that regard, even though the compilers seem to permit it. So instead, repeat the 'for ()' trick that is also used in the implementation of the guarded scope helpers. Cc: Will Deacon <will@kernel.org> Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: Kees Cook <keescook@chromium.org> Cc: Eric Biggers <ebiggers@kernel.org> Signed-off-by: Ard Biesheuvel <ardb@kernel.org> Fixes: 4fa617cc6851 ("arm64/fpsimd: Allocate kernel mode FP/SIMD buffers on the stack") Link: https://lore.kernel.org/r/20251209054848.998878-2-ardb@kernel.org Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2025-12-14hwmon: (tmp401) fix overflow caused by default conversion rate valueAlexey Simakov
The driver computes conversion intervals using the formula: interval = (1 << (7 - rate)) * 125ms where 'rate' is the sensor's conversion rate register value. According to the datasheet, the power-on reset value of this register is 0x8, which could be assigned to the register, after handling i2c general call. Using this default value causes a result greater than the bit width of left operand and an undefined behaviour in the calculation above, since shifting by values larger than the bit width is undefined behaviour as per C language standard. Limit the maximum usable 'rate' value to 7 to prevent undefined behaviour in calculations. Found by Linux Verification Center (linuxtesting.org) with Svace. Note (groeck): This does not matter in practice unless someone overwrites the chip configuration from outside the driver while the driver is loaded. The conversion time register is initialized with a value of 5 (500ms) when the driver is loaded, and the driver never writes a bad value. Fixes: ca53e7640de7 ("hwmon: (tmp401) Convert to _info API") Signed-off-by: Alexey Simakov <bigalex934@gmail.com> Link: https://lore.kernel.org/r/20251211164342.6291-1-bigalex934@gmail.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2025-12-14hwmon: (ibmpex) fix use-after-free in high/low storeJunrui Luo
The ibmpex_high_low_store() function retrieves driver data using dev_get_drvdata() and uses it without validation. This creates a race condition where the sysfs callback can be invoked after the data structure is freed, leading to use-after-free. Fix by adding a NULL check after dev_get_drvdata(), and reordering operations in the deletion path to prevent TOCTOU. Reported-by: Yuhao Jiang <danisjiang@gmail.com> Reported-by: Junrui Luo <moonafterrain@outlook.com> Fixes: 57c7c3a0fdea ("hwmon: IBM power meter driver") Signed-off-by: Junrui Luo <moonafterrain@outlook.com> Link: https://lore.kernel.org/r/MEYPR01MB7886BE2F51BFE41875B74B60AFA0A@MEYPR01MB7886.ausprd01.prod.outlook.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2025-12-14hwmon: (dell-smm) Limit fan multiplier to avoid overflowDenis Sergeev
The fan nominal speed returned by SMM is limited to 16 bits, but the driver allows the fan multiplier to be set via a module parameter. Clamp the computed fan multiplier so that fan_nominal_speed * i8k_fan_mult always fits into a signed 32-bit integer and refuse to initialize the driver if the value is too large. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 20bdeebc88269 ("hwmon: (dell-smm) Introduce helper function for data init") Signed-off-by: Denis Sergeev <denserg.edu@gmail.com> Link: https://lore.kernel.org/r/20251209063706.49008-1-denserg.edu@gmail.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2025-12-14spi: spi-fsl-lpspi: convert min_t() to simple min()Carlos Song
Current min() has supported comparison by normal integer promotion rules, so explicit type casts or min_t() are not needed. Signed-off-by: Carlos Song <carlos.song@nxp.com> Reviewed-by: David Laight <david.laight.linux@gmail.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20251210105001.3891776-1-carlos.song@nxp.com Signed-off-by: Mark Brown <broonie@kernel.org>
2025-12-14spi: virtio: Fix confusing cleanup.h syntaxKrzysztof Kozlowski
Initializing automatic __free variables to NULL without need (e.g. branches with different allocations), followed by actual allocation is in contrary to explicit coding rules guiding cleanup.h: "Given that the "__free(...) = NULL" pattern for variables defined at the top of the function poses this potential interdependency problem the recommendation is to always define and assign variables in one statement and not group variable definitions at the top of the function when __free() is used." Code does not have a bug, but is less readable and uses discouraged coding practice, so fix that by moving declaration to the place of assignment. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://patch.msgid.link/20251208020830.5225-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Mark Brown <broonie@kernel.org>
2025-12-14spi: cadence-quadspi: Parse DT for flashes with the rest of the DT parsingMark Brown
The recent refactoring of where runtime PM is enabled done in commit f1eb4e792bb1 ("spi: spi-cadence-quadspi: Enable pm runtime earlier to avoid imbalance") made the fact that when we do a pm_runtime_disable() in the error paths of probe() we can trigger a runtime disable which in turn results in duplicate clock disables. This is particularly likely to happen when there is missing or broken DT description for the flashes attached to the controller. Early on in the probe function we do a pm_runtime_get_noresume() since the probe function leaves the device in a powered up state but in the error path we can't assume that PM is enabled so we also manually disable everything, including clocks. This means that when runtime PM is active both it and the probe function release the same reference to the main clock for the IP, triggering warnings from the clock subsystem: [ 8.693719] clk:75:7 already disabled [ 8.693791] WARNING: CPU: 1 PID: 185 at /usr/src/kernel/drivers/clk/clk.c:1188 clk_core_disable+0xa0/0xb ... [ 8.694261] clk_core_disable+0xa0/0xb4 (P) [ 8.694272] clk_disable+0x38/0x60 [ 8.694283] cqspi_probe+0x7c8/0xc5c [spi_cadence_quadspi] [ 8.694309] platform_probe+0x5c/0xa4 Dealing with this issue properly is complicated by the fact that we don't know if runtime PM is active so can't tell if it will disable the clocks or not. We can, however, sidestep the issue for the flash descriptions by moving their parsing to when we parse the controller properties which also save us doing a bunch of setup which can never be used so let's do that. Reported-by: Francesco Dolcini <francesco@dolcini.it> Closes: https://lore.kernel.org/r/20251201072844.GA6785@francesco-nb Signed-off-by: Mark Brown <broonie@kernel.org> Link: https://patch.msgid.link/20251204-spi-cadence-qspi-runtime-pm-imbalance-v2-1-10af9115d531@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2025-12-14spi: spi-qpic-snand: remove superfluous qcom_spi_set_read_loc() callsGabor Juhos
Before configuring the registers related to page read, both the qcom_spi_read_page_ecc() and the qcom_spi_read_page_oob() functions are calling qcom_spi_set_read_loc() to set the read location for the first codeword. However the qcom_spi_set_read_loc() function puts the passed value into the register write cache only, from where those gets written to the corresponding register later via DMA. Yet, the qcom_spi_set_read_loc() is also gets called within the internal loops, and during the first iteration the read location register values written by the initial call gets overwritten in the register cache. This means that the values written by the first calls are never getting used in practice, so remove the calls as those are superfluous. Signed-off-by: Gabor Juhos <j4g8y7@gmail.com> Link: https://patch.msgid.link/20251129-qpic-snand-superfluous-readloc-v1-1-b84ca17095d9@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2025-12-14spi-geni-qcom: rework setup_fifo_paramsJonathan Marek
Update each register only if it changes. This also fixes the chipselect related registers not being changed when chipselect changes but not the mode. Signed-off-by: Jonathan Marek <jonathan@marek.ca> Link: https://patch.msgid.link/20251120211204.24078-5-jonathan@marek.ca Signed-off-by: Mark Brown <broonie@kernel.org>
2025-12-14spi-geni-qcom: initialize mode related registers to 0Jonathan Marek
setup_fifo_params assumes these will be zero, it won't write these registers if the initial mode is zero. Signed-off-by: Jonathan Marek <jonathan@marek.ca> Link: https://patch.msgid.link/20251120211204.24078-4-jonathan@marek.ca Signed-off-by: Mark Brown <broonie@kernel.org>
2025-12-14spi-geni-qcom: use xfer->bits_per_word for can_dma()Jonathan Marek
mas->cur_bits_per_word may not reflect the value of xfer->bits_per_word when can_dma() is called. Use the right value instead. Signed-off-by: Jonathan Marek <jonathan@marek.ca> Link: https://patch.msgid.link/20251120211204.24078-3-jonathan@marek.ca Signed-off-by: Mark Brown <broonie@kernel.org>
2025-12-14spi-geni-qcom: don't set max clock in setup_fifo_paramsJonathan Marek
setup_se_xfer() already sets the correct clock (xfer->speed_hz). Setting the clock to max_speed_hz here makes the driver change the clock rate between speed_hz and max_speed_hz for every message (if not equal), slowing it down significantly. Signed-off-by: Jonathan Marek <jonathan@marek.ca> Link: https://patch.msgid.link/20251120211204.24078-2-jonathan@marek.ca Signed-off-by: Mark Brown <broonie@kernel.org>
2025-12-14spi-geni-qcom: remove manual CS controlJonathan Marek
The GPI_DMA mode already uses automatic CS control, to use automatic CS control for non-GPI case all that's needed is to set the FRAGMENTATION flag using the same logic as setup_gsi_xfer(). (note clearing SPI_TRANS_CFG's CS_TOGGLE bit enables automatic CS control, the comment was wrong) spi_geni_set_cs() is slow, so this is a big performance improvement. Signed-off-by: Jonathan Marek <jonathan@marek.ca> Link: https://patch.msgid.link/20251120211204.24078-1-jonathan@marek.ca Signed-off-by: Mark Brown <broonie@kernel.org>
2025-12-14spi: cadence-qspi: Remove redundant pm_runtime_mark_last_busy callAkif Ejaz
The pm_runtime_mark_last_busy() call is redundant in probe function as pm_runtime_put_autosuspend() already calls pm_runtime_mark_last_busy() internally to update the last access time of the device before queuing autosuspend. Remove the pm_runtime_mark_last_busy() call from the probe function. Tested on StarFive VisionFive 2 v1.2A board. Fixes: e1f2e77624db ("spi: cadence-qspi: Fix runtime PM imbalance in probe") Signed-off-by: Akif Ejaz <akifejaz40@gmail.com> Link: https://patch.msgid.link/20251203181921.97171-1-akifejaz40@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2025-12-14spi: cadence-xspi: Replace OF/ACPI specifics by agnostic APIsAndy Shevchenko
Replace OF/ACPI specific call to get matched driver data with the agnostic one. This doesn't change functionality. While at it, add missing property.h include, and drop now unneeded of.h. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://patch.msgid.link/20251129150704.3998301-1-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org>
2025-12-14spi: cadence-xspi: Replace ACPI specifics by agnostic APIsAndy Shevchenko
Replace ACPI specific calls to get device property with the agnostic one. The code looses the direct dependency to the ACPI APIs and get cleaner. This doesn't change functionality. While at it, drop now unneeded acpi.h. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://patch.msgid.link/20251129151739.3998668-1-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org>
2025-12-14spi: stm32-qspi: Simplify SMIE interrupt testPatrice Chotard
SR_SMF status bit can only be set if CR_SMIE was previously set, keep status bit check only. Signed-off-by: Patrice Chotard <patrice.chotard@foss.st.com> Link: https://patch.msgid.link/20251208-upstream_qspi_ospi_updates-v2-8-62526c9467dc@foss.st.com Signed-off-by: Mark Brown <broonie@kernel.org>
2025-12-14spi: stm32-qspi: Remove CR_TCIE and CR_TEIE irq usagePatrice Chotard
Replace CR_TCIE and CR_TEIE irq usage by a read_poll_timeout_atomic() in stm32_qspi_wait_cmd(). It will reduce the time waiting for TCF or TEF flags to optimize throughput. before after average time spent in stm32_qspi_wait_cmd: 2615 ns 712 ns Signed-off-by: Patrice Chotard <patrice.chotard@foss.st.com> Link: https://patch.msgid.link/20251208-upstream_qspi_ospi_updates-v2-7-62526c9467dc@foss.st.com Signed-off-by: Mark Brown <broonie@kernel.org>
2025-12-14spi: stm32-qspi: Optimize FIFO accesses using u16 or u32Patrice Chotard
FIFO accesses uses u8 only for read/write. In order to optimize throughput, add u16 or u32 read/write accesses when possible. Running mtd_speedtest on a 4MB sNOR partition using a stm32mp257f-ev1 board gives the following results: before after gain Read : 5773 KiB/s 22170 KiB/s 384% Write: 796 KiB/s 890 KiB/s 12% Signed-off-by: Patrice Chotard <patrice.chotard@foss.st.com> Link: https://patch.msgid.link/20251208-upstream_qspi_ospi_updates-v2-6-62526c9467dc@foss.st.com Signed-off-by: Mark Brown <broonie@kernel.org>
2025-12-14spi: stm32-qspi: Set DMA maxburst dynamicallyPatrice Chotard
Set src_maxburst and dst_maxburst dynamically from DMA capabilities. Signed-off-by: Patrice Chotard <patrice.chotard@foss.st.com> Link: https://patch.msgid.link/20251208-upstream_qspi_ospi_updates-v2-5-62526c9467dc@foss.st.com Signed-off-by: Mark Brown <broonie@kernel.org>
2025-12-14spi: stm32-ospi: Simplify SMIE interrupt testPatrice Chotard
SR_SMF status bit can only be set if CR_SMIE was previously set, keep status bit check only. Signed-off-by: Patrice Chotard <patrice.chotard@foss.st.com> Link: https://patch.msgid.link/20251208-upstream_qspi_ospi_updates-v2-4-62526c9467dc@foss.st.com Signed-off-by: Mark Brown <broonie@kernel.org>
2025-12-14spi: stm32-ospi: Remove CR_TCIE and CR_TEIE irq usagePatrice Chotard
Replace CR_TCIE and CR_TEIE irq usage by a read_poll_timeout_atomic() in stm32_ospi_wait_cmd(). It will reduce the time waiting for TCF or TEF flags to optimize throughput. before after average time spent in stm32_omi_wait_cmd: 5685 ns 923 ns Signed-off-by: Patrice Chotard <patrice.chotard@foss.st.com> Link: https://patch.msgid.link/20251208-upstream_qspi_ospi_updates-v2-3-62526c9467dc@foss.st.com Signed-off-by: Mark Brown <broonie@kernel.org>