summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-05-04drm/bridge: tda998x: Use __be32 for audio port OF property pointerKory Maincent (TI)
of_get_property() returns a pointer to big-endian (__be32) data, but port_data in tda998x_get_audio_ports() was declared as const u32 *, causing a sparse endianness type mismatch warning. Fix the declaration to use const __be32 *. Fixes: 7e567624dc5a4 ("drm/i2c: tda998x: Register ASoC hdmi-codec and add audio DT binding") Cc: stable@vger.kernel.org Signed-off-by: Kory Maincent (TI) <kory.maincent@bootlin.com> Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/20260428090457.121894-1-kory.maincent@bootlin.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
2026-05-04dma-buf/dma_fence_array: remove unused functionality v4Christian König
Amdgpu was the only user of the signal on any feature and we dropped that use case recently, so we can remove that functionality. v2: update num_pending only after the fence is signaled v3: separate out simplifying dma_fence_array implementation v4: fix XE patch split fallout Signed-off-by: Christian König <christian.koenig@amd.com> Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Link: https://lore.kernel.org/r/20260422103012.1647-1-christian.koenig@amd.com
2026-05-04staging: octeon: convert cvmx_pip_port_status_t from typedef to plain structEric Wu
The Linux kernel coding style discourages the use of typedefs for structs. Convert cvmx_pip_port_status_t to a plain 'struct cvmx_pip_port_status' and update all users across the MIPS Octeon architecture code and the staging driver. No functional change. Signed-off-by: Eric Wu <kunjinkao.jp@gmail.com> Link: https://patch.msgid.link/20260427155427.668540-8-kunjinkao.jp@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: octeon: convert cvmx_pko_port_status_t from typedef to plain structEric Wu
The Linux kernel coding style discourages the use of typedefs for structs. Convert cvmx_pko_port_status_t to a plain 'struct cvmx_pko_port_status' and update all users across the MIPS Octeon architecture code and the staging driver. No functional change. Signed-off-by: Eric Wu <kunjinkao.jp@gmail.com> Link: https://patch.msgid.link/20260427155427.668540-7-kunjinkao.jp@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: octeon: convert cvmx_pko_status_t from typedef to plain enumEric Wu
The Linux kernel coding style discourages the use of typedefs for enums. Convert cvmx_pko_status_t to a plain 'enum cvmx_pko_status' and update all users across the MIPS Octeon architecture code and the staging driver stubs. No functional change. Signed-off-by: Eric Wu <kunjinkao.jp@gmail.com> Link: https://patch.msgid.link/20260427155427.668540-6-kunjinkao.jp@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: octeon: convert cvmx_pko_lock_t from typedef to plain enumEric Wu
The Linux kernel coding style discourages the use of typedefs for enums. Convert cvmx_pko_lock_t to a plain 'enum cvmx_pko_lock' and update all users across the MIPS Octeon architecture code and the staging driver stubs. No functional change. Signed-off-by: Eric Wu <kunjinkao.jp@gmail.com> Link: https://patch.msgid.link/20260427155427.668540-5-kunjinkao.jp@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: octeon: convert cvmx_pow_wait_t from typedef to plain enumEric Wu
The Linux kernel coding style discourages the use of typedefs for enums. Convert cvmx_pow_wait_t to a plain 'enum cvmx_pow_wait' and update all users across the MIPS Octeon architecture code and the staging driver stubs. No functional change. Signed-off-by: Eric Wu <kunjinkao.jp@gmail.com> Link: https://patch.msgid.link/20260427155427.668540-4-kunjinkao.jp@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: octeon: convert cvmx_helper_interface_mode_t from typedef to plain enumEric Wu
The Linux kernel coding style discourages the use of typedefs for enums. Convert cvmx_helper_interface_mode_t to a plain 'enum cvmx_helper_interface_mode' and update all users across the MIPS Octeon architecture code and the staging driver stubs. No functional change. Signed-off-by: Eric Wu <kunjinkao.jp@gmail.com> Link: https://patch.msgid.link/20260427155427.668540-3-kunjinkao.jp@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: octeon: convert cvmx_spi_mode_t from typedef to plain enumEric Wu
The Linux kernel coding style discourages the use of typedefs for enums. Convert cvmx_spi_mode_t to a plain 'enum cvmx_spi_mode' and update all users across the MIPS Octeon architecture code and the staging driver stubs. This is part of a series converting all remaining enum typedefs in the octeon subsystem to plain enums, improving compliance with the kernel coding style. No functional change. Signed-off-by: Eric Wu <kunjinkao.jp@gmail.com> Link: https://patch.msgid.link/20260427155427.668540-2-kunjinkao.jp@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: most: dim2: remove filename from comment blocksShyam Sunder Reddy Padira
Remove redundant filename references from top-of-file comment blocks across dim2 source files to resolve checkpatch.pl warnings. The filename is already implied by the file path and including it in comments can become outdated. No functional changes. Signed-off-by: Shyam Sunder Reddy Padira <shyamsunderreddypadira@gmail.com> Link: https://patch.msgid.link/20260503104447.64657-1-shyamsunderreddypadira@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: greybus: fix typo in sysfs-bus-greybusMaha Maryam Javaid
Fix spelling mistake: attibute -> attribute Signed-off-by: Maha Maryam Javaid <mahamaryamjavaid@gmail.com> Link: https://patch.msgid.link/20260429033816.11282-1-mahamaryamjavaid@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: sm750fb: remove double space in fb_ops entriesAhmet Sezgin Duran
Remove extra space after '=' in .fb_check_var assignments. Signed-off-by: Ahmet Sezgin Duran <ahmet@sezginduran.net> Link: https://patch.msgid.link/20260428204416.55374-1-ahmet@sezginduran.net Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: most: video: remove filename from the top-of-file commentShyam Sunder Reddy Padira
Remove the filename reference from top-of-file comment, to resolve checkpatch.pl warning. The filename can become outdated if the file is renamed. No functional change. Signed-off-by: Shyam Sunder Reddy Padira <shyamsunderreddypadira@gmail.com> Link: https://patch.msgid.link/20260427175636.4605-1-shyamsunderreddypadira@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: nvec: fix unconditional pm_power_off teardownAlexandru Hossu
tegra_nvec_remove() unconditionally sets pm_power_off = NULL, even if nvec was not the one that registered it. This breaks any other driver that may have set pm_power_off to its own handler. Replace the unconditional assignment with a guarded check so that pm_power_off is only cleared if nvec was the one that set it. Also remove the stale FIXME comment, as the guard addresses exactly what it was asking for. Reviewed-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com> Link: https://patch.msgid.link/20260427081713.3401874-3-hossu.alexandru@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: nvec: fix use-after-free in nvec_rx_completed()Alexandru Hossu
In nvec_rx_completed(), when an incomplete RX transfer is detected, nvec_msg_free() is called to return the message back to the pool by clearing its 'used' atomic flag. Immediately after this, the code accesses nvec->rx->data[0] to check the message type. Since nvec_msg_free() marks the pool slot as available via atomic_set(), any concurrent or subsequent call to nvec_msg_alloc() could claim that same slot and overwrite its data[] array. Reading nvec->rx->data[0] after freeing the message is therefore a use-after-free. Fix this by saving the message type byte before calling nvec_msg_free(), then using the saved value for the battery quirk check. Fixes: d6bdcf2e1019 ("staging: nvec: Add battery quirk to ignore incomplete responses") Reviewed-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com> Link: https://patch.msgid.link/20260427081713.3401874-2-hossu.alexandru@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: sm750fb: fix typo in commentHungyu Lin
Fix typo in a comment. Signed-off-by: Hungyu Lin <dennylin0707@gmail.com> Link: https://patch.msgid.link/20260427060420.1076-1-dennylin0707@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: sm750fb: propagate error codes from de_wait()Hungyu Lin
The sm750 acceleration functions currently return -1 when de_wait() fails, discarding the original error code. Since de_wait() now returns proper errno values, propagate the error code instead of returning -1. Signed-off-by: Hungyu Lin <dennylin0707@gmail.com> Link: https://patch.msgid.link/20260427054657.758-3-dennylin0707@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: sm750fb: return -ETIMEDOUT on timeout in de_wait functionsHungyu Lin
The hw_sm750le_de_wait() and hw_sm750_de_wait() functions return -1 when a timeout occurs. Replace these with -ETIMEDOUT to use a proper errno value and better describe the error condition. All callers check the return value as non-zero, so this change does not alter existing behavior. Signed-off-by: Hungyu Lin <dennylin0707@gmail.com> Link: https://patch.msgid.link/20260427054657.758-2-dennylin0707@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: rtl8723bs: reduce nesting in rtw_security.cMaksym Pikhotskyi
Improve readability of functions: rtw_tkip_encrypt, rtw_tkip_decrypt, rtw_aes_encrypt in rtw_security.c by adding early returns for the encryption type check and the stainfo null check. Signed-off-by: Maksym Pikhotskyi <mpikhotskyi@gmail.com> Reviewed-by: Luka Gejak <luka.gejak@linux.dev> Link: https://patch.msgid.link/20260417095452.23440-2-mpikhotskyi@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04staging: rtl8723bs: fix stainfo check in rtw_aes_decryptMaksym Pikhotskyi
The null-pointer-guard was incorrect, returning _FAIL on valid pointer. Invert the guard, so it returns _FAIL on invalid pointer. Fixes: e23ad1570028 ("staging: rtl8723bs: use guard clause for stainfo check") Reported-by: Luka Gejak <luka.gejak@linux.dev> Closes: https://lore.kernel.org/linux-staging/E4BF62EF-C6F6-431F-8EDC-77C1E613E66B@linux.dev/ Reviewed-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Maksym Pikhotskyi <mpikhotskyi@gmail.com> Reviewed-by: Luka Gejak <luka.gejak@linux.dev> Link: https://patch.msgid.link/20260417095452.23440-1-mpikhotskyi@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-04wifi: ath5k: do not access array OOBJiri Slaby (SUSE)
Vincent reports: > The ath5k driver seems to do an array-index-out-of-bounds access as > shown by the UBSAN kernel message: > UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath5k/base.c:1741:20 > index 4 is out of range for type 'ieee80211_tx_rate [4]' > ... > Call Trace: > <TASK> > dump_stack_lvl+0x5d/0x80 > ubsan_epilogue+0x5/0x2b > __ubsan_handle_out_of_bounds.cold+0x46/0x4b > ath5k_tasklet_tx+0x4e0/0x560 [ath5k] > tasklet_action_common+0xb5/0x1c0 It is real. 'ts->ts_final_idx' can be 3 on 5212, so: info->status.rates[ts->ts_final_idx + 1].idx = -1; with the array defined as: struct ieee80211_tx_rate rates[IEEE80211_TX_MAX_RATES]; while the size is: #define IEEE80211_TX_MAX_RATES 4 is indeed bogus. Set this 'idx = -1' sentinel only if the array index is less than the array size. As mac80211 will not look at rates beyond the size (IEEE80211_TX_MAX_RATES). Note: The effect of the OOB write is negligible. It just overwrites the next member of info->status, i.e. ack_signal. Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org> Reported-by: Vincent Danjean <vdanjean@debian.org> Link: https://lore.kernel.org/all/aQYUkIaT87ccDCin@eldamar.lan Closes: https://bugs.debian.org/1119093 Fixes: 6d7b97b23e11 ("ath5k: fix tx status reporting issues") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251209100459.2253198-1-jirislaby@kernel.org Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-05-04wifi: ath12k: fix peer_id usage in normal RX pathBaochen Qiang
ath12k_dp_rx_deliver_msdu() currently uses hal_rx_desc_data::peer_id parsed from mpdu_start descriptor to do peer lookup. However In an A-MSDU aggregation scenario, hardware only populates mpdu_start descriptor for the first sub-msdu, but not the following ones. In that case peer_id could be invalid, leading to peer lookup failure: ath12k_wifi7_pci 0000:06:00.0: rx skb 00000000c391c041 len 1532 peer (null) 0 ucast sn 0 eht320 rate_idx 12 vht_nss 2 freq 6105 band 3 flag 0x40d1a fcs-err 0 mic-err 0 amsdu-more 0 As a result pubsta is NULL and parts of ieee80211_rx_status structure are left uninitialized, which may cause unexpected behavior. Fix it by switching the normal RX path to use ath12k_skb_rxcb::peer_id which is parsed from REO ring's rx_mpdu_desc and is always valid. hal_rx_desc_data::peer_id is still used in ath12k_wifi7_dp_rx_frag_h_mpdu(), which is safe since A-MSDU aggregation does not occur for fragmented frames. Similarly, ath12k_skb_rxcb::peer_id may be overwritten by hal_rx_desc_data::peer_id in ath12k_wifi7_dp_rx_h_mpdu(), which only handles non-aggregated multicast/broadcast traffic. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 Fixes: 11157e0910fd ("wifi: ath12k: Use ath12k_dp_peer in per packet Tx & Rx paths") Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com> Link: https://patch.msgid.link/20260427-ath12k-fix-peer-id-source-v1-1-b5f701fb8e88@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-05-04wifi: ath12k: initialize RSSI dBm conversion event stateRameshkumar Sundaram
Currently, the RSSI dBm conversion event handler leaves struct ath12k_wmi_rssi_dbm_conv_info_arg uninitialized on the stack before calling the TLV parser. If one of the optional sub-TLVs is absent, the corresponding *_present flag retains stack garbage and later gets read in ath12k_wmi_update_rssi_offsets(). With UBSAN enabled this triggers an invalid-load report for _Bool: UBSAN: invalid-load in drivers/net/wireless/ath/ath12k/wmi.c:9682:15 load of value 9 is not a valid value for type '_Bool' Call Trace: ath12k_wmi_rssi_dbm_conversion_params_info_event.cold+0x72/0x85 [ath12k] ath12k_wmi_op_rx+0x1871/0x2ab0 [ath12k] ath12k_htc_rx_completion_handler+0x44b/0x810 [ath12k] ath12k_ce_recv_process_cb+0x554/0x9f0 [ath12k] ath12k_ce_per_engine_service+0xbe/0xf0 [ath12k] ath12k_pci_ce_workqueue+0x69/0x120 [ath12k] Initialize the parsed event state to zero before passing it to the TLV parser so missing sub-TLVs correctly leave the presence flags false. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Fixes: 0314ee81a91d ("wifi: ath12k: handle WMI event for real noise floor calculation") Signed-off-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com> Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Link: https://patch.msgid.link/20260427103011.2983269-1-rameshkumar.sundaram@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-05-04wifi: ath12k: fix leak in some ath12k_wmi_xxx() functionsNicolas Escande
Some wmi functions were using plain 'return ath12k_wmi_cmd_send(...)' without explicitly handling the error code. This leads to leaking the skb in case of error. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00218-QCAHKSWPL_SILICONZ-1 Fixes: 66a9448b1b89 ("wifi: ath12k: implement hardware data filter") Fixes: 593174170919 ("wifi: ath12k: implement WoW enable and wakeup commands") Fixes: 4a3c212eee0e ("wifi: ath12k: add basic WoW functionalities") Fixes: 16f474d6d49d ("wifi: ath12k: add WoW net-detect functionality") Fixes: 1666108c74c4 ("wifi: ath12k: support ARP and NS offload") Fixes: aab4ae566fa1 ("wifi: ath12k: support GTK rekey offload") Fixes: 7af01e569529 ("wifi: ath12k: handle keepalive during WoWLAN suspend and resume") Signed-off-by: Nicolas Escande <nico.escande@gmail.com> Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com> Link: https://patch.msgid.link/20260422163258.3013872-1-nico.escande@gmail.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-05-04drm: uapi: Use SPDX in DRM core uAPI headersLaurent Pinchart
The DRM core uAPI headers are licensed under the MIT license, and carry copies of the license with slight variations. Replace them with SPDX headers. Following a discussion with Simona Vetter on this topic, add a clarification in the drm-uapi.rst file that independent closed-source userspace implementations of software using the DRM uAPI are accepted, as allowed by the MIT license. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Reviewed-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: Simona Vetter <simona.vetter@ffwll.ch> Reviewed-by: Dave Airlie <airlied@redhat.com> Link: https://patch.msgid.link/20260407104951.1781047-1-laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
2026-05-04mm/memfd_luo: document preservation of file sealsDavid Carlier
Commit 8a552d68a86e ("mm: memfd_luo: preserve file seals") started preserving file seals across live update and restoring them via memfd_add_seals() on retrieve, but the DOC header was not updated and still listed seals under "Non-Preserved Properties" as being unsealed on restore. Move the Seals entry to the "Preserved Properties" section and describe the actual behavior, including the MEMFD_LUO_ALL_SEALS restriction that both preserve and retrieve enforce. Fixes: 8a552d68a86e ("mm: memfd_luo: preserve file seals") Signed-off-by: David Carlier <devnexen@gmail.com> Reviewed-by: Pratyush Yadav <pratyush@kernel.org> Reviewed-by: Pasha Tatashin <pasha.tatashin@soleen.com> Link: https://patch.msgid.link/20260423125648.152113-2-devnexen@gmail.com Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
2026-05-04mm/memfd_luo: reject memfds whose page count exceeds UINT_MAXDavid Carlier
memfd_luo_preserve_folios() declares max_folios as unsigned int and computes it from the inode size, then passes it to memfd_pin_folios() which itself caps max_folios at unsigned int. For files whose base-page count exceeds UINT_MAX (larger than 16 TiB with 4 KiB pages), the assignment truncates silently: only a prefix of the file gets pinned and preserved, while memfd_luo_preserve() still records the full inode size in ser->size. On retrieve the inode is restored to the full size but only the preserved prefix repopulates the page cache, so the tail comes back as holes and user data is silently lost across the live update. Reject such files at preserve time with -EFBIG rather than chunk the pin loop, which would also require enlarging the preserved folios array well beyond what is practical. Fixes: b3749f174d68 ("mm: memfd_luo: allow preserving memfd") Signed-off-by: David Carlier <devnexen@gmail.com> Reviewed-by: Pasha Tatashin <pasha.tatashin@soleen.com> Reviewed-by: Pratyush Yadav <pratyush@kernel.org> Link: https://patch.msgid.link/20260423125648.152113-1-devnexen@gmail.com Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
2026-05-04mtd: sm_ftl: allocate cis_buffer with main structRosen Penev
Use a flexible array member and kzalloc_flex() to do so. Simplifies memory allocation slightly. Signed-off-by: Rosen Penev <rosenp@gmail.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-05-04mtd: spinand: Prevent continuous reads on some controllersMiquel Raynal
Some controllers do not have full control over the CS line state and may deassert it under certain conditions in the middle of a (long) transfer. Continuous reads are stopped with a CS deassert, hence both features cannot live together. Whenever a controller flags that it cannot maintain the CS state reliably, disable continuous reads entirely. Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-05-04mtd: spinand: Make sure continuous read is always disabled during probeMiquel Raynal
Recent changes made sure whenever we were using continuous reads, we would first start by disabling the feature to ensure a well proven and stable probe sequence. For development purposes, it might also matter to make sure we always disable continuous reads at first, in case the ECC configuration would change. Doing this "automatically" will become even more relevant when we add extra controller flags to prevent continuous reads at all. Ensure we disable continuous reads if the feature is available on the chip, regardless of whether it will be used or not. Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-05-04drm/bridge: replace use of system_wq with system_percpu_wqMarco Crivellari
Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. This patch continues the effort to refactor worqueue APIs, which has begun with the change introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") system_wq should be the per-cpu workqueue, yet in this name nothing makes that clear, so replace system_wq with system_percpu_wq. The old wq (system_wq) will be kept for a few release cycles. Suggested-by: Tejun Heo <tj@kernel.org> Signed-off-by: Marco Crivellari <marco.crivellari@suse.com> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patch.msgid.link/20251104111339.128685-1-marco.crivellari@suse.com
2026-05-04mtd: spinand: winbond: Add support for continuous reads on W25NxxJWMiquel Raynal
As for the W35NxxJW family, add support for W25N{01,02}JW continuous read support. Similar operations require to be done, such as setting a specific bit in a configuration register, and providing a set of read variants without the address cycles. As read from cache variants are badly supported by SPI memory controllers, we create a new set of read from cache templates with a fake address cycle and just enough dummy cycles. There are two unsupported configurations (which would require 4.5 dummy bytes), so we just do not provide them. The same extra value in the ECC is possible as with the W35NxxJW family, so we reference the same helper to retrieve the ECC status. Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com> --- All variants have been validated on a Nuvoton MA35D1 platform.
2026-05-04mtd: spinand: winbond: Create a helper to detect the need for the HS bitMiquel Raynal
The logic is not complex but might be reused to cleanup a bit the section by moving it to a dedicated helper. Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-05-04mtd: spinand: winbond: Create a helper to write the HS bitMiquel Raynal
Updating the HS bit is not complex but implies reading, setting/clearing a bit and writing. Clean a bit this section by moving this logic in its own helper. Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-05-04mtd: spinand: winbond: Add support for continuous reads on W35NxxJWMiquel Raynal
W35N{01,02,04}JW support being read continuously under certain circumstances. A bit must be set in their configuration register, and a specific read from cache operation, a bit shorter than usual because it no longer requires the address cycles, must be used for the occasion. Setting the "enable" bit is already supported by the core, aside from the subtlety of making sure the HFREQ bit is also set in octal DTR mode above 90MHz. However, handling two different read from cache templates involves creating a list of read from cache variants adapted the continuous reads, ie. without address cycles. Unfortunately, these operations, despite being very close to their original read from cache cousins, are often unsupported by smart SPI controller drivers because reading from cache historically allowed changing the offset at which the host would start by providing a 2-byte column address. In order to prevent issues with this, it has been decided to implement these variants with a single "ignored" address byte (respectively two in the octal DTR case), further reducing the amount of dummy cycles needed before the first bit of data. Enabling continuous reads has a side effect: the ECC status register now may also return the value b11, which means that more than 1 uncorrectable error happened during the read. This non standard behaviour requires to re-implement, almost identically the "get ECC" helper from the core, with just an extra case for this value (it is prefixed "w25w35nxxjw" because all these chips have the same behaviour). Speed gain is substantial, see below. The flash_speed -C benchmark has been run on a TI AM62A7 LP SK with CPU power management disabled, mounted with a W35N01JW chip. 1S-8S-8S: 1 page read speed is 15058 KiB/s 2 page read speed is 15058 KiB/s 3 page read speed is 16800 KiB/s 4 page read speed is 17066 KiB/s 5 page read speed is 18461 KiB/s 6 page read speed is 18461 KiB/s 7 page read speed is 19384 KiB/s 8 page read speed is 19692 KiB/s 9 page read speed is 19384 KiB/s 10 page read speed is 20000 KiB/s 11 page read speed is 20000 KiB/s 12 page read speed is 20000 KiB/s 13 page read speed is 20800 KiB/s 14 page read speed is 20363 KiB/s 15 page read speed is 20000 KiB/s 16 page read speed is 19692 KiB/s 32 page read speed is 19692 KiB/s 64 page read speed is 19692 KiB/s 8D-8D-8D: 1 page read speed is 23272 KiB/s 2 page read speed is 23272 KiB/s 3 page read speed is 28000 KiB/s 4 page read speed is 32000 KiB/s 5 page read speed is 34285 KiB/s 6 page read speed is 34285 KiB/s 7 page read speed is 36000 KiB/s 8 page read speed is 36571 KiB/s 9 page read speed is 36000 KiB/s 10 page read speed is 34285 KiB/s 11 page read speed is 36666 KiB/s 12 page read speed is 40000 KiB/s 13 page read speed is 41600 KiB/s 14 page read speed is 37333 KiB/s 15 page read speed is 40000 KiB/s 16 page read speed is 36571 KiB/s 32 page read speed is 42666 KiB/s 64 page read speed is 42666 KiB/s Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com> --- Not all configurations have been tested/validated yet.
2026-05-04ASoC: Improve SDCA support for duplicated featuresMark Brown
Charles Keepax <ckeepax@opensource.cirrus.com> says: There are some short comings of the current SDCA class driver with respect to duplicated functions and jacks. Fix some issues in the reporting of jacks when there are multiple jacks represented in the SDCA topology. When a single device contains multiple instances of the same type of SDCA function the current class driver will create duplicate controls, update the code to fix this. Finally whilst working through this also tidy up the handling of the sdca_function_desc pointers as it turns out some duplication has crept into the code on that front.
2026-05-04ASoC: SDCA: Support devices with multiple functions of identical typeCharles Keepax
It is possible that SDCAs devices might have multiple functions of the same type, as the entity names within a function are defined by the specification it is very likely such a device will have duplicate entities. This causes problems where DAIs and ALSA controls end up with clashing names. This can be handled by adding the function address into the names to ensure uniqueness, although, ideally this would have been included from the start. User-space already has UCM using the current control names, so as a compromise the first function of a given type will use the raw entity names, then duplicates will get an added function address. Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev> Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Link: https://patch.msgid.link/20260430150931.2025953-4-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-05-04ASoC: SDCA: Remove sdca_function_data duplicationCharles Keepax
The class driver internally has an array of sdca_function_data pointers that it uses to store the parsed DisCo data. However, there is already an sdca_function_data attached to the auxdev device. It makes more sense to use the one already provided in the auxdev device, as it could also be used by custom drivers for parts that require those. Using the auxdev copy also prevents the need for the class function drivers to search through the array for the correct data, which currently is based off matching the function type. This has problems when two functions have the same type as the current code will find the same data for both drivers, using the auxdev copy of the data avoids this problem. Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev> Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Link: https://patch.msgid.link/20260430150931.2025953-3-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-05-04ASoC: SDCA: Add correct masks whilst reporting SDCA jack statusCharles Keepax
Currently, all SDCA jacks simply report against a mask of 0xFFFF. This works fine for system with a single SDCA jack control as the status reflects that single control at all times. However, if two SDCA jack controls exist in the system, such as a separate representation for input and output, then the second control can cancel reports from the other since it will only report its relevant bits and zero in all other slots. This is exactly what the mask is for. Build up a mask using all the possible states for an SCDA jack control at registration time and use that mask when reporting a particular jack. It is worth noting this still doesn't handle cases such as two headphone jacks as that would require separate ALSA jacks to report to. Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev> Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Link: https://patch.msgid.link/20260430150931.2025953-2-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-05-04mtd: spinand: winbond: Add support for continuous reads on W25NxxJWMiquel Raynal
As for the W35NxxJW family, add support for W25N{01,02}JW continuous read support. Similar operations require to be done, such as setting a specific bit in a configuration register, and providing a set of read variants without the address cycles. As read from cache variants are badly supported by SPI memory controllers, we create a new set of read from cache templates with a fake address cycle and just enough dummy cycles. There are two unsupported configurations (which would require 4.5 dummy bytes), so we just do not provide them. The same extra value in the ECC is possible as with the W35NxxJW family, so we reference the same helper to retrieve the ECC status. Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-05-04spi: microchip core-qspi gpio-cs fixes + cleanupMark Brown
Conor Dooley <conor@kernel.org> says: v3 with the review comment about the core handing CS_HIGH dealt with. I noticed that in the same function there was a "raw" BIT(1), which I replaced with a macro that the patch was already adding for use in the setup function...
2026-05-04spi: microchip-core-qspi: remove some inline markingsConor Dooley
Remove inline markings from a number of functions that are called as part of mem ops callbacks. None of them are either particularly trivial or sensitive to overhead of a function call. Just let the compiler decide what to do with them. Signed-off-by: Conor Dooley <conor.dooley@microchip.com> Link: https://patch.msgid.link/20260430-serpent-stimulate-59fb860ef429@spud Signed-off-by: Mark Brown <broonie@kernel.org>
2026-05-04spi: microchip-core-qspi: don't attempt to transmit during emulated ↵Conor Dooley
read-only dual/quad operations The core will deal with reads by creating clock cycles itself, there's no need to generate clock cycles by transmitting garbage data at the driver level. Further, transmitting garbage data just bricks the transfer since QSPI doesn't have a dedicated master-out line like MOSI in regular SPI. I'm not entirely sure if the transfer is bricked because of the garbage data being transmitted on the bus or because the core loses track of whether it is supposed to be sending or receiving data. Fixes: 8f9cf02c88528 ("spi: microchip-core-qspi: Add regular transfers") CC: stable@vger.kernel.org Signed-off-by: Conor Dooley <conor.dooley@microchip.com> Link: https://patch.msgid.link/20260430-freezing-saloon-95b1f3d9dad0@spud Signed-off-by: Mark Brown <broonie@kernel.org>
2026-05-04spi: microchip-core-qspi: control built-in cs manuallyConor Dooley
The coreQSPI IP supports only a single chip select, which is automagically operated by the hardware - set low when the transmit buffer first gets written to and set high when the number of bytes written to the TOTALBYTES field of the FRAMES register have been sent on the bus. Additional devices must use GPIOs for their chip selects. It was reported to me that if there are two devices attached to this QSPI controller that the in-built chip select is set low while linux tries to access the device attached to the GPIO. This went undetected as the boards that connected multiple devices to the SPI controller all exclusively used GPIOs for chip selects, not relying on the built-in chip select at all. It turns out that this was because the built-in chip select, when controlled automagically, is set low when active and high when inactive, thereby ruling out its use for active-high devices or devices that need to transmit with the chip select disabled. Modify the driver so that it controls chip select directly, retaining the behaviour for mem_ops of setting the chip select active for the entire duration of the transfer in the exec_op callback. For regular transfers, implement the set_cs callback for the core to use. As part of this, the existing setup callback, mchp_coreqspi_setup_op(), is removed. Modifying the CLKIDLE field is not safe to do during operation when there are multiple devices, so this code is removed entirely. Setting the MASTER and ENABLE fields is something that can be done once at probe, it doesn't need to be re-run for each device. Instead the new setup callback sets the built-in chip select to its inactive state for active-low devices, as the reset value of the chip select in software controlled mode is low. Fixes: 8f9cf02c88528 ("spi: microchip-core-qspi: Add regular transfers") Fixes: 8596124c4c1bc ("spi: microchip-core-qspi: Add support for microchip fpga qspi controllers") CC: stable@vger.kernel.org Signed-off-by: Conor Dooley <conor.dooley@microchip.com> Link: https://patch.msgid.link/20260430-hamstring-busload-f941d0347b5e@spud Signed-off-by: Mark Brown <broonie@kernel.org>
2026-05-04spi: imx: Three fixes for the i.MX SPI driverMark Brown
John Madieu <john.madieu@gmail.com> says: This series independent fixes found in the i.MX SPI driver. These are: 1/3 fixes a precedence bug in spi_imx_dma_max_wml_find() that makes the watermark-finding logic effectively dead code. The function currently always returns wml = 1 because of how the !-operator binds to the modulo expression. 2/3 fixes a missing return on the package-1 failure path in spi_imx_dma_data_prepare(). The error path frees the dma_data array and the package-0 buffers, then falls through to "return 0" - the caller proceeds with a freed pointer. 3/3 makes spi_imx_setupxfer() propagate the prepare_transfer() return value. Currently a -EINVAL from mx51_ecspi_prepare_transfer (e.g. on a word_delay overflow) is silently swallowed and the transfer proceeds with a partially-configured controller.
2026-05-04spi: imx: Propagate prepare_transfer() error from spi_imx_setupxfer()John Madieu
spi_imx_setupxfer() calls the per-variant prepare_transfer() callback and returns 0 unconditionally: spi_imx->devtype_data->prepare_transfer(spi_imx, spi, t); return 0; mx51_ecspi_prepare_transfer() can return -EINVAL when the requested word_delay does not fit in MX51_ECSPI_PERIOD_MASK. The error is detected after a partial set of register writes (CTRL: BL, clkdiv, SMC), so the controller is left in a partially-configured state and the transfer is then submitted as if setup succeeded. Propagate the return value. The other variants' prepare_transfer callbacks all return 0, so this is a no-op for them. Fixes: a3bb4e663df3 ("spi: imx: support word delay") Signed-off-by: John Madieu <john.madieu@gmail.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260501135951.2416527-4-john.madieu@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-05-04spi: imx: Fix UAF on package-1 prepare failure in spi_imx_dma_data_prepare()John Madieu
When transfer->len exceeds MX51_ECSPI_CTRL_MAX_BURST and is not a multiple of it, spi_imx_dma_data_prepare() splits the transfer into two DMA packages. If preparing the second package fails: ret = spi_imx_dma_tx_data_handle(spi_imx, &spi_imx->dma_data[1], transfer->tx_buf + spi_imx->dma_data[0].data_len, false); if (ret) { kfree(spi_imx->dma_data[0].dma_tx_buf); kfree(spi_imx->dma_data[0].dma_rx_buf); kfree(spi_imx->dma_data); } } return 0; the function frees the package-0 buffers and the dma_data array, then falls through to `return 0`, telling the caller the prepare succeeded. The caller then dereferences the freed dma_data array, producing a use-after-free. Return the error from the failure path so the caller takes its existing failure branch. Fixes: faa8e404ad8e ("spi: imx: support dynamic burst length for ECSPI DMA mode") Signed-off-by: John Madieu <john.madieu@gmail.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260501135951.2416527-3-john.madieu@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-05-04spi: imx: Fix precedence bug in spi_imx_dma_max_wml_find()John Madieu
The watermark search in spi_imx_dma_max_wml_find() reads: if (!dma_data->dma_len % (i * bytes_per_word)) break; The unary ! binds tighter than %, so this parses as: if ((!dma_data->dma_len) % (i * bytes_per_word)) break; !dma_data->dma_len is 0 or 1, and `0 % x == 0` for any x; `1 % x` is 0 unless x == 1. The condition is therefore false in every case except dma_len != 0 with i * bytes_per_word == 1, i.e. i == 1 and bytes_per_word == 1. The loop almost always falls through to its end, leaving i == 0, which the post-loop fallback rewrites to 1: if (i == 0) i = 1; So spi_imx->wml ends up at 1 for essentially every DMA transfer, defeating the entire purpose of the function. The DMA engine then requests service after every single FIFO word instead of using multi-word bursts, hurting throughput on every DMA-capable variant. Add the missing parentheses so the modulo is computed first, then negated: if (!(dma_data->dma_len % (i * bytes_per_word))) break; Fixes: faa8e404ad8e ("spi: imx: support dynamic burst length for ECSPI DMA mode") Signed-off-by: John Madieu <john.madieu@gmail.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260501135951.2416527-2-john.madieu@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-05-04ASoC: fsl_xcvr: Fix event generation for cached controlsCássio Gabriel
ALSA controls should return 1 from a put callback when the control value changes. fsl_xcvr_capds_put() and fsl_xcvr_tx_cs_put() both update cached control data but always return 0, so ALSA suppresses change notifications for the Capabilities Data Structure and playback IEC958 channel status controls. Compare the old and new cached values before copying the new data, and return whether the control value changed. Fixes: 28564486866f ("ASoC: fsl_xcvr: Add XCVR ASoC CPU DAI driver") Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com> Link: https://patch.msgid.link/20260428-asoc-fsl-xcvr-event-generation-v1-1-f21cf0812c4f@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-05-04spi: spacemit: introduce SpacemiT K1 SPI controller driverAlex Elder
This patch introduces the driver for the SPI controller found in the SpacemiT K1 SoC. Currently the driver supports master mode only. The SPI hardware implements RX and TX FIFOs, 32 entries each, and supports both PIO and DMA mode transfers. Signed-off-by: Alex Elder <elder@riscstar.com> Signed-off-by: Guodong Xu <guodong@riscstar.com> Link: https://patch.msgid.link/20260502-spi-spacemit-k1-v10-2-f412e1ae8a34@riscstar.com Signed-off-by: Mark Brown <broonie@kernel.org>