Replace the #include of <linux/mod_devicetable.h> by the more specific
<linux/device-id/*.h> where applicable. For most cases the include
can be dropped completely, only a few drivers need one or two headers
added.
Acked-by: Danilo Krummrich <dakr@kernel.org>
Acked-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/1a3f2007c5c5dcf555c09a4035ce3ae8ef1b6c49.1782808461.git.u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
wait_event_interruptible_timeout() can return a negative error code when
interrupted by a signal. The original code treated all non-zero return
values as success, which would incorrectly synchronize DMA channels and
return 0 instead of propagating the interruption error.
Fixes: fa08b56686 ("spi: rzv2h-rspi: add support for DMA mode")
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Reviewed-by: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com>
Tested-by: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com>
Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Link: https://patch.msgid.link/20260627-rspi-v1-1-170c93ee14da@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
nxp_fspi_probe() enables runtime PM and autosuspend before
several operations that can fail.
Some failure paths returned directly before the devm cleanup
action was installed, leaving runtime PM enabled.
Route those failures through a common runtime PM cleanup path.
Use pm_runtime_resume_and_get() for the initial clock enable.
Signed-off-by: Jiawen Liu <1298662399@qq.com>
Link: https://patch.msgid.link/tencent_8FC0B8DFAF4AE67AEBA20548045D53A77707@qq.com
Signed-off-by: Mark Brown <broonie@kernel.org>
dspi_suspend() disabled the IRQ before spi_controller_suspend(),
but ignored a suspend failure and kept tearing the device down.
Restore the IRQ and return the error if suspend fails.
dspi_resume() also left the clock prepared if controller resume or
hardware init failed. Route those failures through clock cleanup.
Signed-off-by: Jiawen Liu <1298662399@qq.com>
Link: https://patch.msgid.link/tencent_427FA55E3D59112524886E9C931CA0F92F06@qq.com
Signed-off-by: Mark Brown <broonie@kernel.org>
spi_controller_suspend() can fail if pending transfers cannot stop.
bcmbca_hsspi_suspend() ignored the error and still disabled the
PLL and core clocks.
Return the error before disabling the clocks.
Signed-off-by: Jiawen Liu <1298662399@qq.com>
Link: https://patch.msgid.link/tencent_54F5634545908FBA724E758054BF03953808@qq.com
Signed-off-by: Mark Brown <broonie@kernel.org>
spi_controller_suspend() can fail when the SPI core cannot stop the
controller. atcspi_suspend() ignored that error and disabled the
controller clock anyway.
Return the error before disabling the clock.
Signed-off-by: Jiawen Liu <1298662399@qq.com>
Link: https://patch.msgid.link/tencent_306FA547FD68D10EE4B2AE9C132060F12F06@qq.com
Signed-off-by: Mark Brown <broonie@kernel.org>
spi_controller_suspend() can fail if the SPI core cannot stop the
controller. bcm_qspi_suspend() ignored that error, disabled the
controller clock, uninitialized the hardware, and returned success.
Return the suspend error before tearing down the clock and hardware
state.
Signed-off-by: Jiawen Liu <1298662399@qq.com>
Reviewed-by: Kamal Dasu <kamal.dasu@broadcom.com>
Link: https://patch.msgid.link/tencent_21BF5F9512F56D45FD9018BAF14ED2805808@qq.com
Signed-off-by: Mark Brown <broonie@kernel.org>
spi_controller_suspend() can fail if the SPI core cannot stop the
controller. bcm63xx_hsspi_suspend() ignored that error, disabled the
PLL and core clocks, and returned success.
Return the suspend error before disabling the clocks.
Signed-off-by: Jiawen Liu <1298662399@qq.com>
Acked-by: William Zhang <william.zhang@broadcom.com>
Link: https://patch.msgid.link/tencent_B5A06807924A77C8690730EBF7A052AABE05@qq.com
Signed-off-by: Mark Brown <broonie@kernel.org>
spi_controller_suspend() can fail if the SPI core cannot stop the
controller. bcm63xx_spi_suspend() ignored that error, disabled the
controller clock, and returned success.
Return the suspend error before tearing down the clock.
Signed-off-by: Jiawen Liu <1298662399@qq.com>
Link: https://patch.msgid.link/tencent_0BD7D4091B90EC17A8B2BA5EBA8803725905@qq.com
Signed-off-by: Mark Brown <broonie@kernel.org>
qcom_spi_ecc_init_ctx_pipelined() allocates qspi->oob_buf as part of the
pipelined ECC context setup. The buffer is then used by the raw and ECC
page I/O paths through the NAND ECC context.
The matching cleanup callback only frees the qpic_ecc structure, and the
init error path also skips the OOB buffer after it has been allocated.
Free qspi->oob_buf on both paths and clear the pointer so the ECC context
teardown owns all resources allocated during init.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260616151129.76060-1-pengpeng@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
If request_irq() fails, report "can not request IRQ" rather than "can
not get IRQ" which may be misread as platform_get_irq() failure.
Signed-off-by: Jisheng Zhang <jszhang@kernel.org>
Link: https://patch.msgid.link/20260615044039.9750-3-jszhang@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Even with proper dma engine support, the first spi transfer always
fallback to PIO, the reason is the dws->n_bytes is 0 after
initialization, so the dw_spi_can_dma() calling from __spi_map_msg()
return false, thus both tx_sg_mapped and rx_sg_mapped are false, so
for the first spi transfer, the spi_xfer_is_dma_mapped() reports false
thus fallback to PIO.
Although this brings no harm, we can simply fix this issue by
calcuating the "n_bytes" from xfer->bits_per_word.
Signed-off-by: Jisheng Zhang <jszhang@kernel.org>
Link: https://patch.msgid.link/20260615044039.9750-2-jszhang@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
The manual page-program path used the UMA command byte for the
first byte of each continuation chunk. That forced command-lane
semantics onto chunked writes and blocked dual/quad payload
writes.
Switch continuation chunks to data-only UMA transactions so WDBPCK
controls the payload bus width.
Signed-off-by: Tomer Maimon <tmaimon77@gmail.com>
Link: https://patch.msgid.link/20260609071458.2692482-1-tmaimon77@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
A fairly unremarkable collection of fixes that came in over the merge
window, plus a new device ID for the DesignWare controller in the
StarFive JHB100 SoC. There's a couple of core fixes included, one
avoiding freeing an empty resource in error handling cases and another
which fixes a NULL dereference which could be triggered by using an
abnormal device registration flow like driver_override.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmo+eSgACgkQJNaLcl1U
h9BiLwf+LSC77vZ/sKOJLV9CZnIq1ZOi5YVRXKbRLNhnFHIU2DetRXeGnRUmNr7s
WJFV6BO1i8eyYcoX/dyb3nf9kFX6dH1fw6FDby8QfA54b9cPkEZqNsl/K+3+Xbwb
3OJwv4zubDdFbr/qLCqMewAHdHSzefc02CbOeRdGv/AerPTa+r5WqXXWqZC2YKku
rhweANmQl0TUufHOaYSBaVDVHRGjblHDg6j9pLoUw2s1jPznIB/tqG8CPXnsiajl
ii6WgR6inaURBpW2LGaLlHiQ4qKJXlxV7uFWVY2KRPUVqHkW6rQj4K4Sa0pnbdz3
4t/5Afm4esZvMathb3lmPmsH7zIKcQ==
=Gy0X
-----END PGP SIGNATURE-----
Merge tag 'spi-fix-v7.2-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi
Pull spi fixes from Mark Brown:
"A fairly unremarkable collection of fixes that came in over the
merge window, plus a new device ID for the DesignWare controller
in the StarFive JHB100 SoC.
There's a couple of core fixes included, one avoiding freeing an
empty resource in error handling cases and another which fixes a
NULL dereference which could be triggered by using an abnormal
device registration flow like driver_override"
* tag 'spi-fix-v7.2-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
spi: imx: reconfigure for PIO when DMA cannot be started
spi: dw: Add support for snps,dwc-ssi-2.00a
spi: dt-bindings: snps,dw-apb-ssi: Add starfive,jhb100-spi
spi: rpc-if: Use correct device for hardware reinitialization on resume
spi: acpi: Free resource list at appropriate time
spi: dw: fix wrong BAUDR setting after resume
spi: uniphier: Fix completion initialization order before devm_request_irq()
spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data()
When an SPI controller operating in target mode has a transfer in
progress at the time of system suspend, the suspend path proceeds
without aborting the ongoing transfer. This can leave the hardware in
an inconsistent state, potentially causing the system to hang or fail
to resume cleanly.
Fix this by invoking the controller's target_abort callback from
spi_controller_suspend() when the controller is in target mode and the
callback is registered. This ensures any active target transfer is
cleanly terminated before the controller is suspended.
Signed-off-by: Praveen Talari <praveen.talari@oss.qualcomm.com>
Link: https://patch.msgid.link/20260625-abort_active_transfer_duirng_s2r-v2-1-1d6f724406b6@oss.qualcomm.com
Signed-off-by: Mark Brown <broonie@kernel.org>
sh_msiof_spi_reset_regs() asserts TX/RX reset and polls until the reset
bits clear, but the poll result is ignored. sh_msiof_transfer_one() can
therefore continue programming a transfer after the controller did not
leave reset.
Return the reset poll result from the helper and abort the transfer on
timeout, matching the existing transfer path's error-return style.
Fixes: fedd694068 ("spi: sh-msiof: Add reset of registers before starting transfer")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260623135834.55442-1-pengpeng@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
When spi_imx_can_dma() selects DMA, the ECSPI is configured for DMA:
spi_imx_setupxfer() sets CTRL.SMC and clears dynamic_burst, and
spi_imx_dma_transfer() programs the dynamic-burst BURST_LENGTH and the
SDMA watermarks.
If the DMA descriptor cannot be prepared (dmaengine_prep_slave_single()
returns NULL), the transfer is failed with SPI_TRANS_FAIL_NO_START and
falls back to PIO. The dynamic-burst DMA path uses its own bounce
buffers instead of the SPI core's mapping, so xfer->{tx,rx}_sg_mapped
are not set and the core's DMA->PIO retry is skipped; the driver falls
back to PIO internally. But none of the DMA-mode configuration is
undone, so the PIO transfer runs with CTRL.SMC set, the wrong burst
length and dynamic_burst cleared, and the transferred data is corrupted.
This is easily hit on i.MX8MP boards that describe ECSPI DMA in the
device tree but run SDMA on ROM firmware (no external sdma-imx7d.bin):
every ECSPI DMA prepare fails. An Infineon SLB9670 TPM on ECSPI1 then
returns shifted TPM2_GetCapability data, is flagged "field failure
mode", /dev/tpmrm0 is never created.
Set controller->fallback before re-running spi_imx_setupxfer() so the
ECSPI is reconfigured exactly like a normal PIO transfer. With
controller->fallback set, spi_imx_setupxfer() sees spi_imx_can_dma()
return false, so it clears spi_imx->usedma and reprograms the controller
(clears CTRL.SMC, restores dynamic_burst and the PIO burst length). No
explicit spi_imx->usedma = false is needed: setupxfer() already updates
it from the can_dma() result.
Fixes: faa8e404ad ("spi: imx: support dynamic burst length for ECSPI DMA mode")
Cc: stable@vger.kernel.org
Signed-off-by: Javier Fernandez Pastrana <javier.pastrana@linutronix.de>
Acked-by: Carlos Song <carlos.song@nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260624151958.18626-1-javier.pastrana@linutronix.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Add a new compatible entry "snps,dwc-ssi-2.00a" for the Synopsys
DesignWare SSI controller version 2.00a. This variant uses the same
initialization routine as snps,dwc-ssi-1.01a (dw_spi_hssi_init).
Signed-off-by: Changhuang Liang <changhuang.liang@starfivetech.com>
Link: https://patch.msgid.link/20260619143443.22267-3-changhuang.liang@starfivetech.com
Signed-off-by: Mark Brown <broonie@kernel.org>
rpcif_spi_resume() currently passes the SPI controller device to
rpcif_hw_init(), but the function should be called with the RPC
interface device.
Retrieve the rpcif private data from the SPI controller and pass
rpc->dev instead. Also propagate the return value of rpcif_hw_init() so
that a failure during resume is properly reported rather than silently
ignored.
Fixes: ad4728740b ("spi: rpc-if: Add resume support for RZ/G3E")
Signed-off-by: Quang Nguyen <quang.nguyen.wx@renesas.com>
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20260618081932.172168-1-biju.das.jz@bp.renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>
We do unneeded "double free" (emptying an empty list) in one case.
This is not a critical issue at all, the fix just makes code robust
against any possible future changes in the flow.
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/20260617092406.2649384-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
After resuming from suspend to ram, spi transfer stops working. Further
debugging shows that the BAUDR register isn't correctly set, this is
due to dws->current_freq doesn't match the HW BAUDR setting,
specifically, the dws->current_freq equals to speed_hz, but BAUDR is 0.
so the dw_spi_set_clk() in below code won't be called:
if (dws->current_freq != speed_hz) {
dw_spi_set_clk(dws, clk_div);
dws->current_freq = speed_hz;
}
The mismatch comes from dw_spi_shutdown_chip() when suspending.
Fix this mismatch by setting dws->current_freq to 0 as well when
clearing BAUDR reg in dw_spi_shutdown_chip().
Fixes: e24c745272 ("spi: controller driver for Designware SPI core")
Signed-off-by: Jisheng Zhang <jszhang@kernel.org>
Link: https://patch.msgid.link/20260612002835.5240-1-jszhang@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
The driver calls devm_request_irq() before initializing the completion
used by the interrupt handler. Because the interrupt may occur immediately
after devm_request_irq(), the handler may execute before init_completion().
This may result in calling complete() on an uninitialized completion,
causing undefined behavior. This has been observed with KASAN.
Fix this by initializing the completion before registering the IRQ.
Reported-by: Sangyun Kim <sangyun.kim@snu.ac.kr>
Reported-by: Kyungwook Boo <bookyungwook@gmail.com>
Fixes: 5ba155a4d4 ("spi: add SPI controller driver for UniPhier SoC")
Cc: stable@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Link: https://patch.msgid.link/20260616011223.201357-1-hayashi.kunihiko@socionext.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Prevent NULL pointer dereference when spi_get_device_id() returns NULL,
which can happen when using driver_override without matching SPI ID entry.
Signed-off-by: guoqi0226 <guoqi0226@163.com>
Link: https://patch.msgid.link/20260616103018.105612-3-guoqi0226@163.com
Signed-off-by: Mark Brown <broonie@kernel.org>
This has been quite a busy release, mainly due to the subsystem wide
work Johan Hovold has done to modernise resource allocation for the
subsystem on probe, the subsystem did some very clever allocation
management pre devm which didn't quite mesh comfortably with managed
allocations and made it far too easy to introduce error handling and
removal bugs.
- Cleanup and simplification of controller struct allocation, moving
everything over to devm and making the devm APIs more robust, from
Johan Hovold
- Support for spi-mem devices that don't assert chip select and support
for a secondary read command for memory mapped flashes, some commits
for this are shared with mtd.
- Support for SpacemiT K1.
There will be a simple add/add conflict with the i2c-host tree in the
x86 quirk data in drivers/acpi/acpi_apd.c.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmowLx0ACgkQJNaLcl1U
h9BiuAf/bSzTrdeSLpQyQh/UxCKnl4joFtpyb9SValB/32oSTx9YecNYLDxA2z1L
3dkEPBRGBcGjGCINDQldJM/WMMRT0JKG58aWluF3YNPshKN7qK18iNQxbeN9Dh8F
qykmyWZ7wnLks03UCVm7be9kl2UHs4JJ+oRoHq0+6ktS7o+BrIzgJweprmTBmyB4
rRigCbPSL2BNBZnNvWqrZSYeqWHnonGYabhogaSJnhmeJTkSfKE6mugE8qmGzi+O
ZGeWsTdq270WU1omDZRy/PQQ3YLoLU2lUCGuHWTrT/98sGIJjkYV7UfE58GJwzpi
d1N+y8unL0R5HgSkMM4B+f/4OL3VoA==
=1zbv
-----END PGP SIGNATURE-----
Merge tag 'spi-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi
Pull spi updates from Mark Brown:
"This has been quite a busy release, mainly due to the subsystem wide
work Johan Hovold has done to modernise resource allocation for the
subsystem on probe, the subsystem did some very clever allocation
management pre devm which didn't quite mesh comfortably with managed
allocations and made it far too easy to introduce error handling and
removal bugs.
- Cleanup and simplification of controller struct allocation, moving
everything over to devm and making the devm APIs more robust, from
Johan Hovold
- Support for spi-mem devices that don't assert chip select and
support for a secondary read command for memory mapped flashes,
some commits for this are shared with mtd.
- Support for SpacemiT K1"
* tag 'spi-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (118 commits)
spi: Fix mismatched DT property access types
spi: xilinx: use FIFO occupancy register to determine buffer size
spi: spi-mem: Fix spi_controller_mem_ops kdoc
spi: xilinx: let transfers timeout in case of no IRQ
spi: dt-bindings: nuvoton,npcm750-fiu: Convert to DT schema
spi: meson-spifc: fix runtime PM leak on remove
spi: Use named initializers for platform_device_id arrays
spi: rzv2h-rspi: Add suspend/resume support
spi: dw-pci: remove redundant pci_free_irq_vectors() calls
spi: ep93xx: fix double-free of zeropage on DMA setup failure
spi: cadence-xspi: Revert COMPILE_TEST support
spi: cadence-xspi: Support 32bit and 64bit slave dma interface
spi: tegra210-quad: Allocate DMA memory for DMA engine
spi: imx: replace dmaengine_terminate_all() with dmaengine_terminate_sync()
spi: fsl-lpspi: terminate the RX channel on TX prepare failure path
spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync()
spi: atmel: fix DMA channel and bounce buffer leaks
spi: omap2-mcspi: Use of_device_get_match_data()
spi: Use named initializers for arrays of i2c_device_data
spi: aspeed: Replace VLA parameter with flat pointer in calibration helper
...
- deferred probe:
- Fix race where deferred probe timeout work could be permanently
canceled by using mod_delayed_work()
- Fix missing jiffies conversion in deferred_probe_extend_timeout()
- Guard timeout extension with delayed_work_pending() to prevent
premature firing
- Use system_percpu_wq instead of the deprecated system_wq
- Update deferred_probe_timeout documentation
- device:
- Replace direct struct device bitfield access (can_match, dma_iommu,
dma_skip_sync, dma_ops_bypass, state_synced, dma_coherent,
of_node_reused, offline, offline_disabled) with flag-based
accessors using bit operations
- Reject devices with unregistered buses
- Delete unused DEVICE_ATTR_PREALLOC()
- Add low-level device attribute macros with const show/store
callbacks, allowing device attributes to reside in read-only memory
- Move core device attributes to read-only memory
- Constify group array pointers in driver_add_groups() /
driver_remove_groups(), struct bus_type, and struct device_driver
- device property:
- Fix fwnode reference leak in fwnode_graph_get_endpoint_by_id()
- Initialize all fields of fwnode_handle in fwnode_init()
- Provide swnode_get()/swnode_put() wrappers around kobject_get/put()
- Allow passing struct software_node_ref_args pointers directly to
PROPERTY_ENTRY_REF()
- driver_override:
- Migrate amba, cdx, vmbus, and rpmsg to the generic driver_override
infrastructure, fixing a UAF from unsynchronized access to
driver_override in bus match() callbacks
- Remove the now-unused driver_set_override()
- firmware loader:
- Fix recursive lock deadlock in device_cache_fw_images() when async
work falls back to synchronous execution
- Fix device reference leak in firmware_upload_register()
- platform:
- Pass KBUILD_MODNAME through the platform driver registration macro
to create module symlinks in sysfs for built-in drivers; move
module_kset initialization to a pure_initcall and tegra cbb
registration to core_initcall to ensure correct ordering
- Pass THIS_MODULE implicitly through a coresight_init_driver() macro
- sysfs:
- Upgrade OOB write detection in sysfs_kf_seq_show() from printk to
WARN
- Add return value clamping to sysfs_kf_read()
- Rust:
- ACPI:
- Fix missing match data for PRP0001 by exporting
acpi_of_match_device()
- Auxiliary:
- Replace drvdata() with dedicated registration data on
auxiliary_device. drvdata() exposed the driver's bus device
private data beyond the driver's own scope, creating ordering
constraints and forcing the data to outlive all registrations
that access it. Registration data is instead scoped structurally
to the Registration object, making lifecycle ordering enforced
by construction rather than convention.
- Rust-native device driver lifetimes (HRT):
- Allow Rust device drivers to carry a lifetime parameter on their
bus device private data, tied to the device binding scope -- the
interval during which a bus device is bound to a driver. Device
resources like pci::Bar<'a> and IoMem<'a> can be stored directly
in the driver's bus device private data with a lifetime bounded
by the binding scope, so the compiler enforces at build time that
they do not outlive the binding. This removes Devres indirection
from every access site and eliminates try_access() failure paths
in destructors.
Bus driver traits use a Generic Associated Type (GAT)
Data<'bound> to introduce the lifetime on the private data,
rather than parameterizing the Driver trait itself. Auxiliary
registration data, where the lifetime is not introduced by a
trait callback but must be threaded through Registration, uses
the ForLt trait (a type-level abstraction for types generic over
a lifetime).
- Misc:
- Fix DT overlayed devices not probing by reverting the broken
treewide overlay fix and re-running fw_devlink consumer pickup when
an overlay is applied to a bound device
- Use root_device_register() for faux bus root device; add sanity
check for failed bus init
- Fix dev_has_sync_state() data race with READ_ONCE() and move it to
base.h
- Avoid spurious device_links warning when removing a device while
its supplier is unbinding
- Switch ISA bus to dynamic root device
- Fix suspicious RCU usage in kernfs_put()
- Remove devcoredump exit callback
- Constify devfreq_event_class
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQS2q/xV6QjXAdC7k+1FlHeO1qrKLgUCai1lNQAKCRBFlHeO1qrK
LjX1AP4kEb6SJdvBFlG/IJcG9vyqA7+Cig8OIlx9vEX7e7GvNwEAxL2HltAlAd5Q
cOIJOlu0uM+j1mn0JyuM9b0WJrxDLAA=
=E5mG
-----END PGP SIGNATURE-----
Merge tag 'driver-core-7.2-rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/driver-core/driver-core
Pull driver core updates from Danilo Krummrich:
"Deferred probe:
- Fix race where deferred probe timeout work could be permanently
canceled by using mod_delayed_work()
- Fix missing jiffies conversion in deferred_probe_extend_timeout()
- Guard timeout extension with delayed_work_pending() to prevent
premature firing
- Use system_percpu_wq instead of the deprecated system_wq
- Update deferred_probe_timeout documentation
device:
- Replace direct struct device bitfield access (can_match, dma_iommu,
dma_skip_sync, dma_ops_bypass, state_synced, dma_coherent,
of_node_reused, offline, offline_disabled) with flag-based
accessors using bit operations
- Reject devices with unregistered buses
- Delete unused DEVICE_ATTR_PREALLOC()
- Add low-level device attribute macros with const show/store
callbacks, allowing device attributes to reside in read-only memory
- Move core device attributes to read-only memory
- Constify group array pointers in driver_add_groups() /
driver_remove_groups(), struct bus_type, and struct device_driver
device property:
- Fix fwnode reference leak in fwnode_graph_get_endpoint_by_id()
- Initialize all fields of fwnode_handle in fwnode_init()
- Provide swnode_get()/swnode_put() wrappers around kobject_get/put()
- Allow passing struct software_node_ref_args pointers directly to
PROPERTY_ENTRY_REF()
driver_override:
- Migrate amba, cdx, vmbus, and rpmsg to the generic driver_override
infrastructure, fixing a UAF from unsynchronized access to
driver_override in bus match() callbacks
- Remove the now-unused driver_set_override()
firmware loader:
- Fix recursive lock deadlock in device_cache_fw_images() when async
work falls back to synchronous execution
- Fix device reference leak in firmware_upload_register()
platform:
- Pass KBUILD_MODNAME through the platform driver registration macro
to create module symlinks in sysfs for built-in drivers; move
module_kset initialization to a pure_initcall and tegra cbb
registration to core_initcall to ensure correct ordering
- Pass THIS_MODULE implicitly through a coresight_init_driver() macro
sysfs:
- Upgrade OOB write detection in sysfs_kf_seq_show() from printk to
WARN
- Add return value clamping to sysfs_kf_read()
Rust:
- ACPI:
Fix missing match data for PRP0001 by exporting
acpi_of_match_device()
- Auxiliary:
Replace drvdata() with dedicated registration data on
auxiliary_device. drvdata() exposed the driver's bus device private
data beyond the driver's own scope, creating ordering constraints
and forcing the data to outlive all registrations that access it.
Registration data is instead scoped structurally to the
Registration object, making lifecycle ordering enforced by
construction rather than convention.
- Rust-native device driver lifetimes (HRT):
Allow Rust device drivers to carry a lifetime parameter on their
bus device private data, tied to the device binding scope -- the
interval during which a bus device is bound to a driver. Device
resources like pci::Bar<'a> and IoMem<'a> can be stored directly in
the driver's bus device private data with a lifetime bounded by the
binding scope, so the compiler enforces at build time that they do
not outlive the binding. This removes Devres indirection from every
access site and eliminates try_access() failure paths in
destructors.
Bus driver traits use a Generic Associated Type (GAT) Data<'bound>
to introduce the lifetime on the private data, rather than
parameterizing the Driver trait itself. Auxiliary registration
data, where the lifetime is not introduced by a trait callback but
must be threaded through Registration, uses the ForLt trait (a
type-level abstraction for types generic over a lifetime).
Misc:
- Fix DT overlayed devices not probing by reverting the broken
treewide overlay fix and re-running fw_devlink consumer pickup when
an overlay is applied to a bound device
- Use root_device_register() for faux bus root device; add sanity
check for failed bus init
- Fix dev_has_sync_state() data race with READ_ONCE() and move it to
base.h
- Avoid spurious device_links warning when removing a device while
its supplier is unbinding
- Switch ISA bus to dynamic root device
- Fix suspicious RCU usage in kernfs_put()
- Remove devcoredump exit callback
- Constify devfreq_event_class"
* tag 'driver-core-7.2-rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/driver-core/driver-core: (81 commits)
software node: allow passing reference args to PROPERTY_ENTRY_REF()
driver core: platform: set mod_name in driver registration
coresight: pass THIS_MODULE implicitly through a macro
kernel: param: initialize module_kset in a pure_initcall
soc/tegra: cbb: Move driver registration from pure_initcall to core_initcall
firmware_loader: Fix recursive lock in device_cache_fw_images()
driver core: Use system_percpu_wq instead of system_wq
driver core: remove driver_set_override()
rpmsg: use generic driver_override infrastructure
Drivers: hv: vmbus: use generic driver_override infrastructure
cdx: use generic driver_override infrastructure
amba: use generic driver_override infrastructure
rust: devres: add 'static bound to Devres<T>
samples: rust: rust_driver_auxiliary: showcase lifetime-bound registration data
rust: auxiliary: generalize Registration over ForLt
rust: types: add `ForLt` trait for higher-ranked lifetime support
gpu: nova-core: separate driver type from driver data
samples: rust: rust_driver_pci: use HRT lifetime for Bar
rust: io: make IoMem and ExclusiveIoMem lifetime-parameterized
rust: pci: make Bar lifetime-parameterized
...
The SPI drivers read properties whose bindings use normal uint32 cells.
Using boolean or u16 helpers makes the access look like a different DT
encoding and causes the property checker to flag the call sites.
Use presence checks for unsupported properties and read numeric cell
properties through u32 helpers before assigning to driver fields.
Assisted-by: Codex:gpt-5-5
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Link: https://patch.msgid.link/20260612215017.1884893-1-robh@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
A couple of driver specific fixes for v7.1, a small targetted fix for
hardware error handling on DesignWare controllers and another for
handling of custom chip select managmenet on Qualcomm GENI controllers.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmosRy4ACgkQJNaLcl1U
h9DIigf8CYkVGrJ/PRXvWUcF4xwiwyO1GsM15cDN3LVUC6dD2P2DzHjxVvr5KvzI
J+ZS7Dyh/TDTZxdCS1foHsQWALtwNfLMqVQHk/YdJDH7ELVQkHzyxUwVa9RJtexM
d7HHtCoYivANp3CQugJVXux11cRinRCU8aCBvcj7/o26tRxFmvoRT9U7jsAJULyG
7Mb03RCsOlxi2cOGRSTq3a4b2GanoxD+z7zKde99jTI5haA7oWR3XLEgLSBf5REl
PUEwTkrPopTqESELOZe+YinGwLhVljAkSX+f6yAAVbk33aW2hSmveNpb5wK40dRF
E3NmCpAxjcAxo0iIBfVjUHGXIK8now==
=8A3s
-----END PGP SIGNATURE-----
Merge tag 'spi-fix-v7.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi
Pull spi fixes from Mark Brown:
"A couple of driver specific fixes: a small targeted fix for hardware
error handling on DesignWare controllers and another for handling of
custom chip select management on Qualcomm GENI controllers"
* tag 'spi-fix-v7.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
spi: dw: fix race between IRQ handler and error handler on SMP
spi: qcom-geni: Fix cs_change handling on the last transfer
The method the driver uses to determine the size of the FIFO has a
problem. What it currently does is this:
It stops the SPI hardware and writes to the TX FIFO register until TX
FIFO FULL asserts in the status register. But the hardware does not only
have the FIFO, it also has a shift register which can hold a byte. This
can be seen, when writing a byte to the FIFO (while the SPI hardware is
stopped,) the TX FIFO EMPTY is still empty. So, if we have a FIFO size
of 16 for example, the current method returns a 17.
This is a problem, at least when using the driver in irq mode. The same
size determined for the TX FIFO is also assumed for the RX FIFO. When a
SPI transaction wants to write the amount of the FIFO size or more
bytes, the following happens, for example with 16 bytes FIFO size:
The driver stops the SPI hardware and writes 17 bytes to the TX FIFO and
starts the SPI hardware and goes sleep.
The hardware then shifts out 17 bytes (FIFO + shift register) and
simultaneously reads bytes into the RX FIFO, but it only has 16 places,
so it looses one byte. Then TX FIFO empty asserts, wakes the driver
again, which has a fast path and reads 16 bytes from the RX FIFO, but
before reading the last 17th byte (which is lost) it does this:
sr = xspi->read_fn(xspi->regs + XSPI_SR_OFFSET);
if (!(sr & XSPI_SR_RX_EMPTY_MASK)) {
xilinx_spi_rx(xspi);
rx_words--;
}
It reads the status register and checks if the RX FIFO is not empty.
But it is empty in our case. So this check spins in a while loop
forever locking the driver.
This patch fixes the logic to determine the FIFO size.
Fixes: 4c9a761402 ("spi/xilinx: Simplify spi_fill_tx_fifo")
Signed-off-by: Lars Pöschel <lars.poeschel@edag.com>
Reviewed-by: Michal Simek <michal.simek@amd.com>
Link: https://patch.msgid.link/20260612105244.9076-1-lars.poeschel.linux@edag.com
Signed-off-by: Mark Brown <broonie@kernel.org>
here focus on the shared spi-mem layer which is enhanced in order to
bring two new features:
- The possibility to fill a primary and a secondary operation template
in the direct mapping structure in order to support continuous reads
in SPI NAND, which may require two different read operations.
- SPI controllers may indicate possible CS instabilities over long
transfers by setting a boolean. This capability is related to the
previous one, the need for it has arised while testing SPI NAND
continuous reads with the Cadence QSPI controller which cannot, under
certain conditions, keep the CS asserted for the length of
an eraseblock-large transfer.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEE9HuaYnbmDhq/XIDIJWrqGEe9VoQFAmn4m50ACgkQJWrqGEe9
VoSUzwf8D7an5inOVMcX2IsbXSkA6vKgrzjc1jG3rGiLrFks/bZyo0R8atp4pUsy
6WDkJfFyHg6IzU92N/37Kha8rnFp7um9OhfB/z2O/ztyqr9d1yM6QDtenknYr+WH
BwcuJ8zenyWuIY526Ar04REJ07s8MZpMUhcnUIw/KpvQiS12UR6NHgEaUrmIjtLD
GCKKFTGOY++9dgObo8ZrkrsLlVUhV5GyvCqUtBNNbADTNAt7j4m6YuyztS7rrmwb
b33RoZiWmG0szkUsTJJBDH15cMB/4wV2SoGm3wzsACHqJhCy0n9FvSVAXwcRm5l7
qOLedtMoBIIIIwBbHPsf0SySToy2ag==
=3qpz
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmosAyEACgkQJNaLcl1U
h9BOcgf9EtmCuxpcX2n0PQlE6j88fr/zFDArtOXFZNFKdhL46u2kUWhdrvDH8i0J
1FBbxRWsQqfrLesveqHqzVSg0ub6USe80Cbzjt2Vo1Ri+RF2i0b+5KNd1VrHC/iF
DG+8A2c4VmjdiuCkaNI1gixMqdRJHSSWEjGD61+rv4M/VBIr1YtAV5kIJ+tFLPoY
lYrvNMGcUGUTHUK2tJx4uaMuo7dd3C+hIWnnMu6OZ+TB/VbX77z4jrhqTONzxdYy
uV+Zxh1PPLBvysPsqwSXpdW2FjfUi2SSGYrNn+kw0pdb58Th3/x7Tocb3t7awfWU
Ah5Yw6zUF2vJMBFAOhHNJ9r3hvtoBw==
=WwE4
-----END PGP SIGNATURE-----
spi: spi-mem: Add a no_cs_assertion capability
Merge tag 'mtd/spi-mem-cont-read-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux into spi-7.2
Miquel Raynal <miquel.raynal@bootlin.com> says:
Aside from preparation changes in the SPI NAND core, the changes carried
here focus on the shared spi-mem layer which is enhanced in order to
bring two new features:
- The possibility to fill a primary and a secondary operation template
in the direct mapping structure in order to support continuous reads
in SPI NAND, which may require two different read operations.
- SPI controllers may indicate possible CS instabilities over long
transfers by setting a boolean. This capability is related to the
previous one, the need for it has arised while testing SPI NAND
continuous reads with the Cadence QSPI controller which cannot, under
certain conditions, keep the CS asserted for the length of
an eraseblock-large transfer.
In case of failed HW the driver may not see an interrupt and will stuck
in waiting forever. We can avoid such situation by timing out of
transfers if the interrupt is not seen in a reasonable time.
This problem can be found on unload of ptp_ocp driver for TimeCard which
uses Xilinx SPI AXI and SPI-NOR flash memory. During tear-down process
spi-nor drivers send soft reset command which is not triggering an
interrupt stalling the unload process completely.
Signed-off-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Acked-by: Michal Simek <michal.simek@amd.com>
Link: https://patch.msgid.link/20260610222843.782337-1-vadim.fedorenko@linux.dev
Signed-off-by: Mark Brown <broonie@kernel.org>
The RZ/V2H hardware manual (section 7.5.2.2.1) specifies that read access
size for the SPI Data Register (SPDR) are fixed at 32 bits. The
RZV2H_RSPI_RX macro for the 16-bit data path used readw(), violating
this requirement.
Switch to readl() for the 16-bit RX path to conform to the hardware
specification.
Fixes: 8b61c8919d ("spi: Add driver for the RZ/V2H(P) RSPI IP")
Suggested-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Fabrizio Castro <fabrizio.castro.jz@renesas.com>
Link: https://patch.msgid.link/20260610-rzv2h-rspi-v2-1-40c80b4a2c90@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
On SMP systems, dw_spi_handle_err() can be called from the SPI core
kthread while the IRQ handler is still accessing the FIFO on another
CPU. Resetting the chip via dw_spi_reset_chip() during an active FIFO
read/write causes a bus error.
Fix this by calling disable_irq() before the chip reset, which masks
the IRQ and waits for any in-flight handler to complete via
synchronize_irq(). This ensures no handler is accessing the FIFO when
the reset occurs.
Signed-off-by: Peng Yang <pyangyyd@amazon.com>
Suggested-by: Jonathan Chocron <jonnyc@amazon.com>
Link: https://patch.msgid.link/20260608095849.3446-1-pyangyyd@amazon.com
Signed-off-by: Mark Brown <broonie@kernel.org>
pm_runtime_get_sync() increments the runtime PM usage counter even when it
returns an error. meson_spifc_remove() uses it to resume the controller
before disabling runtime PM, but never drops the usage counter again.
Balance the get with pm_runtime_put_noidle() after disabling runtime PM,
matching the teardown pattern used by other SPI controller drivers.
Found by static analysis. I do not have hardware to test this.
Fixes: c3e4bc5434 ("spi: meson: Add support for Amlogic Meson SPIFC")
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Link: https://patch.msgid.link/20260609052647.5-1-ruoyuw560@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Named initializers are better readable and more robust to changes of the
struct definition. This robustness is relevant for a planned change to
struct platform_device_id replacing .driver_data by an anonymous union.
While touching these arrays unify spacing and usage of commas.
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Link: https://patch.msgid.link/3fcd432a505bb1bb7f8ef0fba9162243200b3347.1780606153.git.u.kleine-koenig@baylibre.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Add suspend/resume support to the rzv2h-rspi driver by implementing
suspend and resume callbacks that delegate to spi_controller_suspend()
and spi_controller_resume() respectively.
Signed-off-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>
Link: https://patch.msgid.link/20260608202509.3651345-1-tommaso.merciai.xr@bp.renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>
TPM TIS SPI probe fails with:
tpm_tis_spi: probe of spi11.0 failed with error -110
TPM TIS SPI sets cs_change=1 on single-transfer messages to keep CS
asserted across the header, wait-state, and data phases of a transaction.
CS deassertion between these phases violates the TCG SPI flow control
specification.
This bug was introduced by commit b99181cdf9 ("spi-geni-qcom: remove
manual CS control"), which replaced manual CS control with automatic CS
control via the FRAGMENTATION bit. The FRAGMENTATION bit controls CS
behavior after a transfer: when set to 1, CS remains asserted; when
cleared to 0, CS is deasserted.
The commit correctly sets FRAGMENTATION for non-last transfers with
cs_change=0 to keep CS asserted between chained transfers, but misses the
case where cs_change=1 is set on the last transfer. When cs_change=1 on
the last transfer, the client requests CS to remain asserted after the
message completes, so FRAGMENTATION must be set to 1 in this case as well.
Fix setup_se_xfer() to set FRAGMENTATION when cs_change=1 on the last
transfer.
Also fix the same missing case in setup_gsi_xfer() and correct it to
write 1 instead of the raw bitmask FRAGMENTATION (value 4) to
peripheral.fragmentation. This field is a 1-bit boolean consumed by
gpi_create_spi_tre() via u32_encode_bits(..., TRE_SPI_GO_FRAG). Writing 4
to a 1-bit field causes u32_encode_bits() to mask it to 0, silently
disabling the FRAGMENTATION bit in the GPI TRE regardless of the
cs_change logic.
Fixes: b99181cdf9 ("spi-geni-qcom: remove manual CS control")
Cc: stable@vger.kernel.org
Reviewed-by: Jonathan Marek <jonathan@marek.ca>
Signed-off-by: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
Link: https://patch.msgid.link/20260609-fix-spi-fragmentation-bit-logic-v2-1-e18efc255563@oss.qualcomm.com
Signed-off-by: Mark Brown <broonie@kernel.org>
The driver uses pcim_enable_device(), so IRQ vectors are automatically
freed by devres on driver detach. The explicit pci_free_irq_vectors()
calls in the probe error path and remove function are redundant.
Drop them and the now-unused error label.
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Link: https://patch.msgid.link/20260530-dw-pci-v1-1-5d2cf798b3c3@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
If DMA setup fails after allocating the zeropage, the error path frees
the page but leaves espi->zeropage dangling. A subsequent call to
ep93xx_spi_release_dma() sees the non-NULL pointer and frees the page
again.
Clear the pointer after freeing in the error path of
ep93xx_spi_setup_dma().
Fixes: 626a96db11 ("spi/ep93xx: add DMA support")
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Link: https://patch.msgid.link/20260529-ep93xx-v1-1-9185070ca1fc@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Commit 0c5b5c40dc ("spi: cadence-xspi: Add COMPILE_TEST support")
allows this driver to be built for 32-bit platforms, which causes a
semantic conflict with commit 4954d4eca4 ("spi: cadence-xspi: Support
32bit and 64bit slave dma interface"), as readsq() and writesq() are
only available when targeting 64-bit platforms:
drivers/spi/spi-cadence-xspi.c: In function 'cdns_xspi_sdma_read':
drivers/spi/spi-cadence-xspi.c:601:25: error: implicit declaration of function 'readsq'; did you mean 'readsl'? [-Wimplicit-function-declaration]
601 | readsq(src, buf, len >> 3);
| ^~~~~~
| readsl
drivers/spi/spi-cadence-xspi.c: In function 'cdns_xspi_sdma_write':
drivers/spi/spi-cadence-xspi.c:623:25: error: implicit declaration of function 'writesq'; did you mean 'writesl'? [-Wimplicit-function-declaration]
623 | writesq(dst, buf, len >> 3);
| ^~~~~~~
| writesl
As there are no known 32-bit platforms that use this controller, revert
compile testing support to restrict the driver to 64-bit platforms to
avoid burdening the driver with workarounds.
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Fixes: 4954d4eca4 ("spi: cadence-xspi: Support 32bit and 64bit slave dma interface")
Acked-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
Link: https://patch.msgid.link/20260606-spi-cadence-xspi-revert-compile-testing-v1-1-76219ea378bd@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
The cdns xspi controller slave dma interface may support wider data
width. Wider I/O width can benefit performance. We can know the width
by checking the CTRL_FEATURES_REG's DMA_DATA_WIDTH bit, 0 means 32bit
1 means 64bit.
A simple test with QSPI nor flash on one arm64 platform:
Use 8bit slave dma data width (now):
# dd if=/dev/mtdblock0 of=/dev/null bs=8192 count=1000
1000+0 records in
1000+0 records out
8192000 bytes (7.8MB) copied, 1.368735 seconds, 5.7MB/s
Use 32bit slave dma data width:
# dd if=/dev/mtdblock0 of=/dev/null bs=8192 count=1000
1000+0 records in
1000+0 records out
8192000 bytes (7.8MB) copied, 1.088787 seconds, 7.2MB/s
Improved by 26.3%!
Use 64bit slave dma data width:
# dd if=/dev/mtdblock0 of=/dev/null bs=8192 count=1000
1000+0 records in
1000+0 records out
8192000 bytes (7.8MB) copied, 0.831104 seconds, 9.4MB/s
Improved by 64.9%!
Signed-off-by: Jisheng Zhang <jszhang@kernel.org>
Link: https://patch.msgid.link/20260602235825.28614-1-jszhang@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
When the SPI controllers are running in DMA mode, it is the DMA engine
that performs the memory accesses rather than the SPI controller. Pass
the DMA engine's struct device pointer to the DMA API to make sure the
correct DMA operations are used.
Suggested-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Aaron Kling <webgeek1234@gmail.com>
Link: https://patch.msgid.link/20260525-tegra194-qspi-iommu-v2-1-a11c53f804b2@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
dmaengine_terminate_all() has been deprecated, so replace it with
dmaengine_terminate_sync().
Fixes: ba9b28652c ("spi: imx: enable DMA mode for target operation")
Fixes: a450c8b77f ("spi: imx: handle DMA submission errors with dma_submit_error()")
Signed-off-by: Carlos Song <carlos.song@nxp.com>
Link: https://patch.msgid.link/20260525062928.3191821-1-carlos.song@oss.nxp.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Carlos Song (OSS) <carlos.song@oss.nxp.com> says:
This series fixes two issues in the fsl-lpspi DMA transfer error paths.
Patch 1 replaces the deprecated dmaengine_terminate_all() with
dmaengine_terminate_sync() across all error paths in
fsl_lpspi_dma_transfer().
Patch 2 fixes a missing RX DMA channel termination when TX descriptor
preparation fails. Since the RX channel is already submitted and issued
before the TX descriptor is prepared, returning -EINVAL without
terminating the RX channel leaves it running against buffers that the
SPI core will unmap, potentially causing memory corruption.
Link: https://patch.msgid.link/20260525062357.3191349-1-carlos.song@oss.nxp.com
When dmaengine_prep_slave_sg() fails for the TX channel, the error path
terminates the TX DMA channel but leaves the RX channel running. Since
the RX channel was already submitted and issued prior to preparing
the TX descriptor, returning -EINVAL causes the SPI core to unmap the
DMA buffers while the RX DMA engine continues writing to them, leading
to potential memory corruption or use-after-free.
Terminate the RX channel before returning on the TX prepare failure path.
Fixes: 09c04466ce ("spi: lpspi: add dma mode support")
Cc: stable@vger.kernel.org
Signed-off-by: Carlos Song <carlos.song@nxp.com>
Link: https://patch.msgid.link/20260525062357.3191349-3-carlos.song@oss.nxp.com
Signed-off-by: Mark Brown <broonie@kernel.org>
The original code set use_dma to false when dma_alloc_coherent() for
bounce buffers failed, but DMA channels acquired earlier via
atmel_spi_configure_dma() were never freed.
When devm_request_irq() or clk_prepare_enable() failed later in probe,
the driver also did not release DMA channels or bounce buffers already
allocated.
The out_free_dma error path released DMA channels but did not free the
bounce buffers.
Fix by moving bounce buffer allocation into atmel_spi_configure_dma()
and registering the devres cleanup for DMA channels and bounce buffers.
Fixes: a9889ed62d ("spi: atmel: Implements transfers with bounce buffer")
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Link: https://patch.msgid.link/20260522-atmel-v3-1-23f8c6e6aa43@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
spi_mem_supports_op() accepts a const struct spi_mem_op pointer but
casts away const internally to call spi_mem_adjust_op_freq(). This
mutates the caller's op template, which causes stale max_freq values
when callers reuse persistent templates - subsequent calls won't
re-apply the device frequency cap since spi_mem_adjust_op_freq()
skips non-zero values.
Fix by operating on a stack-local copy instead.
Fixes: a4f8e70d75 ("spi: spi-mem: add spi_mem_adjust_op_freq() in spi_mem_supports_op()")
Cc: Tianyu Xu <xtydtc@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Santhosh Kumar K <s-k6@ti.com>
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://patch.msgid.link/20260527173736.2243004-1-s-k6@ti.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Use of_device_get_match_data() to fetch platform match data directly
instead of open-coding an of_match_device() lookup.
This also lets the driver drop the of_device.h include.
Assisted-by: Codex:GPT-5.5
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://patch.msgid.link/20260519004352.627148-1-rosenp@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQFSBAABCgA8FiEEq68RxlopcLEwq+PEeb4+QwBBGIYFAmoTZAYeHHRvcnZhbGRz
QGxpbnV4LWZvdW5kYXRpb24ub3JnAAoJEHm+PkMAQRiGKZ0H/A8Ti79DXqEl4M6V
S1ZYfteuvyWCdygPfY7+CQsxS1EjfmeRXd0213n95jijUoXvAVe7HJ5FuroTltsF
LYqH3CAedeEWMO1rIZjuDs5J1BzWAh7b0/QoanTlAjI1ZL8c3Btj/o//PoQfztiS
HWlN/aCcsZTi9n0ewV9eQM9jdiuhBlpZujfDX90vYurxAB+3K2c1b0UN+Y4/zMXO
83zaDLMYhIh8cEaU52+23H9UpyfrT0B8n6YgqbU4ZBRIbgA1BC4gloT6B7OHFKfq
PAfjAOBfpe43K8lLUyfbkfNohNblLOboiMmekdf+j2y4wqpCO64o6WigCrZtxtHe
9znkJpM=
=H+I9
-----END PGP SIGNATURE-----
Merge tag 'v7.1-rc5' into driver-core-next
We need the driver-core fixes in here as well to build on top of.
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Another batch of driver fixes from Johan fixing error handling paths,
plus another from Felix. We also have a new device ID added in the DT
bindings for SpacemiT K3.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmoQOJYACgkQJNaLcl1U
h9Cv9AgAg9YV8hoCA8qMNcIurXXnaaJ8+SU2zqOdN9fuHMuxFCnxY+J4xjp1V5b6
waIJxCFX6qqPMEAzmJrqWkGyJtcE2B3sGioJ++mmNWVAJOwbc8/4QWbQyZHdyvuS
Zk/NjdAV7BOC30CAO6DfVGi4rXCZEA3ul8I+qCQYl9KOnu8j5tQTVbhZijC9MHBG
YG+e7stFnx44Psl/IiGvlbVvG6AUi3whlMkX7ep0aeGnz6/g1IVyGty0cMaWlW8K
8DXOlzmDoCTKLdlqAHO5sN063nA/3utjkFzoTZ98THvsL2vaQnNWxZI1bxyfhG45
xZAPcx4Q9DTm/REyZnja19E1x6+wsQ==
=qdyL
-----END PGP SIGNATURE-----
Merge tag 'spi-fix-v7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi
Pull spi fixes from Mark Brown:
"Another batch of driver fixes from Johan fixing error handling paths,
plus another from Felix. We also have a new device ID added in the DT
bindings for SpacemiT K3"
* tag 'spi-fix-v7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
spi: dt-bindings: fsl-qspi: support SpacemiT K3
spi: ti-qspi: fix use-after-free after DMA setup failure
spi: sprd: fix error pointer deref after DMA setup failure
spi: qup: fix error pointer deref after DMA setup failure
spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache()
spi: ep93xx: fix error pointer deref after DMA setup failure
While being less compact, using named initializers allows to more easily
see which members of the structs are assigned which value without having
to lookup the declaration of the struct. And it's also more robust
against changes to the struct definition.
The mentioned robustness is relevant for a planned change to struct
i2c_device_id that replaces .driver_data by an anonymous union.
While touching these arrays, drop a comma after the list terminator.
This patch doesn't modify the compiled arrays, only their representation
in source form benefits. The former was confirmed with x86 and arm64
builds.
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Link: https://patch.msgid.link/20260518170542.807843-2-u.kleine-koenig@baylibre.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Chin-Ting Kuo <chin-ting_kuo@aspeedtech.com> says:
This series fixes two sparse warnings reported by the kernel test robot.
The first patch fixes missing __iomem annotation on an MMIO pointer
parameter, which also caused a redundant cast at the call site.
A VLA function parameter warning is also fixed in this patch series.
Link: https://patch.msgid.link/20260522071621.102507-1-chin-ting_kuo@aspeedtech.com
aspeed_spi_ast2600_optimized_timing() declared its buffer argument as a
variable-length array parameter (u8 buf[rows][cols]), which causes a
sparse warning. Replace the VLA parameter with a plain u8 * and compute
the 2-D index manually. The corresponding call site is also updated.
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202605180441.uD3toFRJ-lkp@intel.com/
Signed-off-by: Chin-Ting Kuo <chin-ting_kuo@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Link: https://patch.msgid.link/20260522071621.102507-3-chin-ting_kuo@aspeedtech.com
Signed-off-by: Mark Brown <broonie@kernel.org>
The dst parameter of aspeed_spi_user_transfer_tx() is an MMIO address
obtained from chip->ahb_base, but it was typed as void * instead of
void __iomem *. This caused a sparse warning report. Fix the
parameter type to void __iomem * and drop the now-unnecessary
cast at the call site.
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202605180441.uD3toFRJ-lkp@intel.com/
Signed-off-by: Chin-Ting Kuo <chin-ting_kuo@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Link: https://patch.msgid.link/20260522071621.102507-2-chin-ting_kuo@aspeedtech.com
Signed-off-by: Mark Brown <broonie@kernel.org>
The SPI controller API is asymmetric in that a controller is allocated
and registered in two step, while it is freed as part of deregistration.
[1]
This is especially unfortunate as any driver data is freed along with
the controller, something which has lead to use-after-free bugs during
deregistration when drivers tear down resources after deregistering the
controller (or tear down resources that may still be in use before
deregistering the controller in an attempt to work around the API).
To reduce the risk of such bugs being introduced a device managed
allocation interface was added, but this arguably made things even less
consistent as now whether the controller gets freed as part of
deregistration depends on how it was allocated. [2][3]
With most drivers converted to use managed allocation in preparation for
fixing the API, the remaining 16 drivers can be converted in one
tree-wide change. Ten of those drivers use the bitbang interface and can
be converted by simply removing the extra reference already taken by
spi_bitbang_start() (and updating the two bitbang drivers that use
managed allocation). [4]
Fix the API inconsistency by no longer dropping a reference when
deregistering non-devres allocated controllers.
[1] 68b892f1fd ("spi: document odd controller reference handling")
[2] 5e844cc37a ("spi: Introduce device-managed SPI controller allocation")
[3] 3f174274d2 ("spi: fix misleading controller deregistration kernel-doc")
[4] 702a4879ec ("spi: bitbang: Let spi_bitbang_start() take a reference to master")
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260521073816.766596-1-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
This ID requires a custom initialization function
dw_spi_hssi_no_dma_init() that sets dws->dws.ip to DW_HSSI_ID.
Signed-off-by: Thomas Lin <thomas_lin@lecomputing.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/20260521-lecarc-acpi-ids-v1-2-ae0ae90b2817@lecomputing.com
Signed-off-by: Mark Brown <broonie@kernel.org>
The Cadence XSPI driver uses readq() and writeq(), which are not provided
directly by all 32-bit architectures. Include the generic non-atomic 64-bit
I/O accessor fallback for non-64-bit builds so the driver can build there.
Drop the 64BIT dependency at the same time. The driver only needs MMIO
and the SPI memory interface at build time, and the fallback accessors
cover the 32-bit compile-test case.
Assisted-by: Codex:GPT-5.5
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://patch.msgid.link/20260519005614.628437-1-rosenp@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Add tracepoints to the Qualcomm GENI (Generic Interface) SPI driver.
These trace events enable runtime debugging and performance analysis
of SPI operations.
The trace events capture SPI clock configuration, setup parameters,
transfer details, interrupt status.
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Praveen Talari <praveen.talari@oss.qualcomm.com>
Link: https://patch.msgid.link/20260518-add-tracepoints-for-qcom-geni-spi-v3-2-7928f6810a79@oss.qualcomm.com
Signed-off-by: Mark Brown <broonie@kernel.org>
The driver falls back to PIO mode if DMA setup fails during probe.
Make sure to clear the DMA channel pointer also if buffer allocation
fails to avoid passing a pointer to the released channel to the DMA
engine (or trying to free the channel a second time on late probe errors
or driver unbind).
This issue was flagged by Sashiko when reviewing a devres allocation
conversion patch.
Fixes: c687c46e9e ("spi: spi-ti-qspi: Use bounce buffer if read buffer is not DMA'ble")
Link: https://sashiko.dev/#/patchset/20260505072909.618363-1-johan%40kernel.org?part=17
Cc: stable@vger.kernel.org # 4.12
Cc: Vignesh R <vigneshr@ti.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260512074809.915084-1-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
The driver falls back to PIO mode if DMA setup fails during probe.
Make sure to check the dma.enabled flag before trying to release the DMA
channels also on late probe errors to avoid dereferencing an error
pointer (or attempting to release a channel a second time).
This issue was flagged by Sashiko when reviewing a devres allocation
conversion patch.
Fixes: 386119bc7b ("spi: sprd: spi: sprd: Add DMA mode support")
Link: https://sashiko.dev/#/patchset/20260505072909.618363-1-johan%40kernel.org?part=10
Cc: stable@vger.kernel.org # 5.1
Cc: Lanqing Liu <lanqing.liu@unisoc.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260512074733.915029-1-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Johan Hovold <johan@kernel.org> says:
In preparation for fixing the SPI controller API so that it no longer
drops a reference when deregistering (non-managed) controllers (cf.
[1]), this series converts drivers using managed registration to also
use managed allocation.
Included is also a related cleanup of a lp8841-rtc.
This leaves us with 18 drivers using non-managed allocation, which is
few enough to be able to fix the API in tree-wide change.
Johan
[1] https://lore.kernel.org/lkml/20260325145319.1132072-1-johan@kernel.org/
Link: https://patch.msgid.link/20260511150408.796155-1-johan@kernel.org
Switch to device managed controller allocation for consistency and to
simplify error handling.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260511150408.796155-9-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation for consistency and to
simplify error handling.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260511150408.796155-8-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation for consistency and to
simplify error handling.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260511150408.796155-7-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation for consistency and to
simplify error handling.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260511150408.796155-6-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation for consistency and to
simplify error handling.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260511150408.796155-5-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation for consistency and to
simplify error handling.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260511150408.796155-4-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation for consistency and to
simplify error handling.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260511150408.796155-3-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation for consistency and to
simplify error handling.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260511150408.796155-2-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
When DMA read times out in mtk_snand_read_page_cache(), the original code
erroneously jumped to cleanup label which skips DMA unmapping and ECC
disable, causing a resource leak.
Fixes: 764f1b7481 ("spi: add driver for MTK SPI NAND Flash Interface")
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Link: https://patch.msgid.link/20260510-snfi-v1-1-bc375cf1af8e@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Use devm_reset_control_get_optional_exclusive_deasserted() to combine
get + deassert + cleanup in a single call, removing the redundant
rspi_reset_control_assert() helper.
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Link: https://patch.msgid.link/20260507-rspi-v1-1-8cfa47cd56aa@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
When the SPI core registers the Kunpeng controller it may need to acquire
chip-select GPIO descriptors. If the GPIO provider has not probed yet,
spi_register_controller() returns -EPROBE_DEFER.
On a Kunpeng system this currently prints an alarming error even though the
next deferred-probe retry succeeds:
hisi-kunpeng-spi HISI03E1:00: failed to register spi host, ret=-517
hisi-kunpeng-spi HISI03E1:00: hw version:0x30 max-freq:12500 kHz
Use dev_err_probe() so that -EPROBE_DEFER is reported through the deferred
probe mechanism instead of as a hard error, while preserving normal error
reporting for real registration failures.
Fixes: c770d8631e ("spi: Add HiSilicon SPI Controller Driver for Kunpeng SoCs")
Signed-off-by: Qiang Ma <maqianga@uniontech.com>
Link: https://patch.msgid.link/20260515102620.1926930-1-maqianga@uniontech.com
Signed-off-by: Mark Brown <broonie@kernel.org>
The driver falls back to PIO mode if DMA setup fails during probe.
Make sure to the clear the DMA channel pointers on setup failure to
avoid dereferencing an error pointer on later probe errors or driver
unbind.
This issue was flagged by Sashiko when reviewing a devres allocation
conversion patch.
Fixes: e79e7c2df6 ("spi: ep93xx: add DT support for Cirrus EP93xx")
Link: https://sashiko.dev/#/patchset/20260429091333.165363-1-johan%40kernel.org?part=10
Cc: stable@vger.kernel.org # 6.12
Cc: Nikita Shubin <nikita.shubin@maquefel.me>
Signed-off-by: Johan Hovold <johan@kernel.org>
Acked-by: Nikita Shubin <nikita.shubin@maquefel.me>
Link: https://patch.msgid.link/20260512074849.915143-1-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Hans Zhang <18255117159@163.com> says:
Replace open-coded bitfield modifications with the standard FIELD_MODIFY()
macro across multiple SPI controller drivers. This improves readability and
adds compile-time checking without functional changes.
Each patch modifies a single driver, allowing independent review and
application.
Link: https://patch.msgid.link/20260430155456.36998-1-18255117159@163.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Use FIELD_MODIFY() to remove open-coded bit manipulation.
No functional change intended.
Signed-off-by: Hans Zhang <18255117159@163.com>
Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com>
Link: https://patch.msgid.link/20260430155456.36998-9-18255117159@163.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Use FIELD_MODIFY() to remove open-coded bit manipulation.
No functional change intended.
Signed-off-by: Hans Zhang <18255117159@163.com>
Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com>
Link: https://patch.msgid.link/20260430155456.36998-8-18255117159@163.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Use FIELD_MODIFY() to remove open-coded bit manipulation.
No functional change intended.
Signed-off-by: Hans Zhang <18255117159@163.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260430155456.36998-6-18255117159@163.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Johan Hovold <johan@kernel.org> says:
In preparation for fixing the SPI controller API so that it no longer
drops a reference when deregistering (non-managed) controllers (cf.
[1]), this series converts drivers using non-managed registration to use
managed allocation.
Included is also a related cleanup of a ti-qspi error path.
This second set will be followed by a third set of 12 patches for
drivers using managed registration.
That leaves us with 18 drivers using non-managed allocation, which is
few enough to be able to fix the API in tree-wide change.
Johan
[1] https://lore.kernel.org/lkml/20260325145319.1132072-1-johan@kernel.org/
Link: https://patch.msgid.link/20260505072909.618363-1-johan@kernel.org
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260505072909.618363-21-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260505072909.618363-20-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Add a proper error path for when registration fails so that the probe
tests for errors consistently.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260505072909.618363-19-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260505072909.618363-18-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260505072909.618363-17-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260505072909.618363-16-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260505072909.618363-15-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260505072909.618363-14-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260505072909.618363-13-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260505072909.618363-12-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260505072909.618363-11-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260505072909.618363-10-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260505072909.618363-9-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260505072909.618363-8-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260505072909.618363-7-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260505072909.618363-6-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260505072909.618363-5-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20260505072909.618363-4-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260505072909.618363-3-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260505072909.618363-2-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
On platforms where the HID2 SPI controller (AMDI0063) is enumerated via
ACPI instead of PCI, amd_spi_probe() unconditionally sets bus_num to 0,
while the PCI probe path assigns bus_num 2 for HID2 controller.
Align the ACPI probe path to use the same bus number so that userspace
and SPI client drivers see a consistent bus assignment regardless of the
enumeration method.
Fixes: b644c27766 ("spi: spi_amd: Add PCI-based driver for AMD HID2 SPI controller")
Cc: stable@vger.kernel.org # v6.16+
Signed-off-by: Krishnamoorthi M <krishnamoorthi.m@amd.com>
Link: https://patch.msgid.link/20260507180051.4158674-1-krishnamoorthi.m@amd.com
Signed-off-by: Mark Brown <broonie@kernel.org>
aml_spisg_setup_transfer() takes a non-NULL exdesc pointer; the
function dereferences exdesc unconditionally later in the body to
populate the SPI scatter-gather descriptors (tx_ccsg / rx_ccsg).
The sole caller, aml_spisg_transfer_one_message(), always passes a
valid pointer derived from kcalloc().
The "if (exdesc)" guard around the memset() at the start of the
function is therefore dead and misleading -- it suggests callers
may pass NULL when in fact they may not. smatch flags the
inconsistency:
drivers/spi/spi-amlogic-spisg.c:314 aml_spisg_setup_transfer()
error: we previously assumed 'exdesc' could be null (see line 261)
Drop the check; the unconditional memset matches the unconditional
dereferences elsewhere in the function and removes the inconsistency
that smatch reports.
No functional change.
Signed-off-by: Stepan Ionichev <sozdayvek@gmail.com>
Reviewed-by: Xianwei Zhao <xianwei.zhao@amlogic.com>
Link: https://patch.msgid.link/20260506183513.482-1-sozdayvek@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
The company name "QiHeng Electronics" is incorrect.
The correct legal name is "Nanjing Qinheng Microelectronics Co., Ltd.".
Update the module description accordingly.
Signed-off-by: Jiawei Liu <ljw@wch.cn>
Link: https://patch.msgid.link/20260506062412.371034-1-ljw@wch.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
The .driver_data member of the various struct pci_device_id arrays were
initialized by list expressions. This isn't easily readable if you're
not into PCI. Using named initializers is more explicit and thus easier
to parse. Also skip explicit assignments of 0 (which the compiler then
takes care of).
This change doesn't introduce changes to the compiled pci_device_id
arrays. Tested on x86 and arm64.
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Link: https://patch.msgid.link/20260504142117.2116978-2-u.kleine-koenig@baylibre.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Conor Dooley <conor@kernel.org> says:
v3 with the review comment about the core handing CS_HIGH dealt with.
I noticed that in the same function there was a "raw" BIT(1), which I
replaced with a macro that the patch was already adding for use in the
setup function...
Remove inline markings from a number of functions that are called as
part of mem ops callbacks. None of them are either particularly trivial
or sensitive to overhead of a function call. Just let the compiler
decide what to do with them.
Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
Link: https://patch.msgid.link/20260430-serpent-stimulate-59fb860ef429@spud
Signed-off-by: Mark Brown <broonie@kernel.org>
The core will deal with reads by creating clock cycles itself, there's
no need to generate clock cycles by transmitting garbage data at the
driver level. Further, transmitting garbage data just bricks the transfer
since QSPI doesn't have a dedicated master-out line like MOSI in regular
SPI. I'm not entirely sure if the transfer is bricked because of the
garbage data being transmitted on the bus or because the core loses
track of whether it is supposed to be sending or receiving data.
Fixes: 8f9cf02c88 ("spi: microchip-core-qspi: Add regular transfers")
CC: stable@vger.kernel.org
Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
Link: https://patch.msgid.link/20260430-freezing-saloon-95b1f3d9dad0@spud
Signed-off-by: Mark Brown <broonie@kernel.org>
The coreQSPI IP supports only a single chip select, which is
automagically operated by the hardware - set low when the transmit
buffer first gets written to and set high when the number of bytes
written to the TOTALBYTES field of the FRAMES register have been sent on
the bus. Additional devices must use GPIOs for their chip selects.
It was reported to me that if there are two devices attached to this
QSPI controller that the in-built chip select is set low while linux
tries to access the device attached to the GPIO.
This went undetected as the boards that connected multiple devices to
the SPI controller all exclusively used GPIOs for chip selects, not
relying on the built-in chip select at all. It turns out that this was
because the built-in chip select, when controlled automagically, is set
low when active and high when inactive, thereby ruling out its use for
active-high devices or devices that need to transmit with the chip
select disabled.
Modify the driver so that it controls chip select directly, retaining
the behaviour for mem_ops of setting the chip select active for the
entire duration of the transfer in the exec_op callback. For regular
transfers, implement the set_cs callback for the core to use.
As part of this, the existing setup callback, mchp_coreqspi_setup_op(),
is removed. Modifying the CLKIDLE field is not safe to do during
operation when there are multiple devices, so this code is removed
entirely. Setting the MASTER and ENABLE fields is something that can be
done once at probe, it doesn't need to be re-run for each device.
Instead the new setup callback sets the built-in chip select to its
inactive state for active-low devices, as the reset value of the chip
select in software controlled mode is low.
Fixes: 8f9cf02c88 ("spi: microchip-core-qspi: Add regular transfers")
Fixes: 8596124c4c ("spi: microchip-core-qspi: Add support for microchip fpga qspi controllers")
CC: stable@vger.kernel.org
Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
Link: https://patch.msgid.link/20260430-hamstring-busload-f941d0347b5e@spud
Signed-off-by: Mark Brown <broonie@kernel.org>
spi_imx_setupxfer() calls the per-variant prepare_transfer()
callback and returns 0 unconditionally:
spi_imx->devtype_data->prepare_transfer(spi_imx, spi, t);
return 0;
mx51_ecspi_prepare_transfer() can return -EINVAL when the requested
word_delay does not fit in MX51_ECSPI_PERIOD_MASK. The error is
detected after a partial set of register writes (CTRL: BL, clkdiv,
SMC), so the controller is left in a partially-configured state and
the transfer is then submitted as if setup succeeded.
Propagate the return value. The other variants' prepare_transfer
callbacks all return 0, so this is a no-op for them.
Fixes: a3bb4e663d ("spi: imx: support word delay")
Signed-off-by: John Madieu <john.madieu@gmail.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260501135951.2416527-4-john.madieu@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
When transfer->len exceeds MX51_ECSPI_CTRL_MAX_BURST and is not a
multiple of it, spi_imx_dma_data_prepare() splits the transfer into
two DMA packages. If preparing the second package fails:
ret = spi_imx_dma_tx_data_handle(spi_imx, &spi_imx->dma_data[1],
transfer->tx_buf + spi_imx->dma_data[0].data_len,
false);
if (ret) {
kfree(spi_imx->dma_data[0].dma_tx_buf);
kfree(spi_imx->dma_data[0].dma_rx_buf);
kfree(spi_imx->dma_data);
}
}
return 0;
the function frees the package-0 buffers and the dma_data array,
then falls through to `return 0`, telling the caller the prepare
succeeded. The caller then dereferences the freed dma_data array,
producing a use-after-free.
Return the error from the failure path so the caller takes its
existing failure branch.
Fixes: faa8e404ad ("spi: imx: support dynamic burst length for ECSPI DMA mode")
Signed-off-by: John Madieu <john.madieu@gmail.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260501135951.2416527-3-john.madieu@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
The watermark search in spi_imx_dma_max_wml_find() reads:
if (!dma_data->dma_len % (i * bytes_per_word))
break;
The unary ! binds tighter than %, so this parses as:
if ((!dma_data->dma_len) % (i * bytes_per_word))
break;
!dma_data->dma_len is 0 or 1, and `0 % x == 0` for any x; `1 % x` is
0 unless x == 1. The condition is therefore false in every case
except dma_len != 0 with i * bytes_per_word == 1, i.e. i == 1 and
bytes_per_word == 1.
The loop almost always falls through to its end, leaving i == 0,
which the post-loop fallback rewrites to 1:
if (i == 0)
i = 1;
So spi_imx->wml ends up at 1 for essentially every DMA transfer,
defeating the entire purpose of the function. The DMA engine then
requests service after every single FIFO word instead of using
multi-word bursts, hurting throughput on every DMA-capable variant.
Add the missing parentheses so the modulo is computed first, then
negated:
if (!(dma_data->dma_len % (i * bytes_per_word)))
break;
Fixes: faa8e404ad ("spi: imx: support dynamic burst length for ECSPI DMA mode")
Signed-off-by: John Madieu <john.madieu@gmail.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260501135951.2416527-2-john.madieu@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
This patch introduces the driver for the SPI controller found in the
SpacemiT K1 SoC. Currently the driver supports master mode only.
The SPI hardware implements RX and TX FIFOs, 32 entries each, and
supports both PIO and DMA mode transfers.
Signed-off-by: Alex Elder <elder@riscstar.com>
Signed-off-by: Guodong Xu <guodong@riscstar.com>
Link: https://patch.msgid.link/20260502-spi-spacemit-k1-v10-2-f412e1ae8a34@riscstar.com
Signed-off-by: Mark Brown <broonie@kernel.org>
The QSPI controller has two interconnect paths:
1. qspi-config: CPU to QSPI controller for register access
2. qspi-memory: QSPI controller to memory for DMA operations
Currently, the driver only manages the qspi-config path. Add support for
the qspi-memory path to ensure proper bandwidth allocation for QSPI data
transfers to/from memory. Enable and disable both paths during runtime PM
transitions.
Signed-off-by: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
Link: https://patch.msgid.link/20260429-spi-nor-v5-3-993016c9711e@oss.qualcomm.com
Signed-off-by: Mark Brown <broonie@kernel.org>
The runtime PM functions had incomplete error handling that could leave the
system in an inconsistent state. If any operation failed midway through
suspend or resume, some resources would be left in the wrong state while
others were already changed, leading to potential clock/power imbalances.
Reorder the suspend/resume sequences to avoid brownout risk by ensuring the
performance state is set appropriately before clocks are enabled and clocks
are disabled before dropping the performance state.
Fix by adding proper error checking for all operations and using goto-based
cleanup to ensure all successfully acquired resources are properly released
on any error.
Signed-off-by: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
Link: https://patch.msgid.link/20260429-spi-nor-v5-2-993016c9711e@oss.qualcomm.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Return explicit zero on successful probe to clearly separate the success
and error paths and make the code more readable.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260430120200.249323-4-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260430120200.249323-2-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260429091333.165363-20-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260429091333.165363-18-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260429091333.165363-17-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260429091333.165363-16-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260429091333.165363-15-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260429091333.165363-14-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260429091333.165363-13-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260429091333.165363-12-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260429091333.165363-11-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260429091333.165363-10-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260429091333.165363-9-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260429091333.165363-8-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260429091333.165363-7-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260429091333.165363-6-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Acked-by: William Zhang <william.zhang@broadcom.com>
Link: https://patch.msgid.link/20260429091333.165363-5-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260429091333.165363-4-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260429091333.165363-3-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260429091333.165363-2-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Drop the dead runtime PM support which has never been enabled.
Fixes: 96ed3ecde2 ("spi: at91-usart: add power management support")
Cc: Radu Pirea <radu_nicolae.pirea@upb.ro>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260429092005.166128-1-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
In some situations, direct mappings may need to use different
operation templates.
For instance, when enabling continuous reads, Winbond SPI NANDs no
longer expect address cycles because they would be ignoring them
otherwise. Hence, right after the command opcode, they start counting
dummy cycles, followed by the data cycles as usual.
This breaks the assumptions of "reads from cache" always being done
identically once the best variant has been picked up, across the
lifetime of the system.
In order to support this feature, we must give direct mapping more than
a single operation template to use, in order to switch to using
secondary operations upon request by the upper layer.
Create the concept of optional secondary operation template, which may
or may not be fulfilled by the SPI NAND and SPI NOR cores. If the
underlying SPI controller does not leverage any kind of direct mapping
acceleration, the feature has no impact and can be freely
used. Otherwise, the controller driver needs to opt-in for using this
feature, if supported.
The condition checked to know whether a secondary operation has been
provided or not is to look for a non zero opcode to limit the creation
of extra variables. In practice, the opcode 0x00 exist, but is not
related to any cache related operation.
Acked-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
As of now, we only use a single operation template when creating SPI
memory direct mappings. With the idea to extend this possibility to 2,
rename the template to reflect that we are currently setting the
"primary" operation, and create a pointer in the same structure to point
to it.
From a user point of view, the op_tmpl name remains but becomes a
pointer, leading to minor changes in both the SPI NAND and SPI NOR
cores.
There is no functional change.
Acked-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
I noticed this define was incorrect, it should be UpperAddress, but in
renaming it it became clear there were actually no users. Just get rid
of it.
Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
Link: https://patch.msgid.link/20260428-viability-crepe-4e4c85e7c506@spud
Signed-off-by: Mark Brown <broonie@kernel.org>
When prepare_message callbacks fail, the SPI core already reports which
controller the failure happened on. The corresponding code in the mem_ops
portion of the driver already reports the device a timeout occurred on,
so make the regular part of the driver do the same.
Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
Link: https://patch.msgid.link/20260428-porcupine-ninetieth-af00cb11b990@spud
Signed-off-by: Mark Brown <broonie@kernel.org>
Move init_completion(&spisg->completion) to before devm_request_irq()
to avoid a potential race condition where an interrupt could fire
before the completion structure is initialized.
Fixes: cef9991e04 ("spi: Add Amlogic SPISG driver")
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Link: https://patch.msgid.link/20260428-amlogic-spisg-v1-1-8eecc3b446d6@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
ax_spi_fill_tx_fifo() can be called from ax_spi_irq() which is a hard
irq handler. Replace usleep_range(10, 10) with udelay(10) in atomic
context.
Fixes: e75a6b00ad ("spi: axiado: Add driver for Axiado SPI DB controller")
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Link: https://patch.msgid.link/20260428-axiado-v1-1-cd767500af72@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
DMA resource is initialized after SPI controller registration. So
when driver unbind, this can trigger a use-after-free when DMA is
torn down while the controller is still alive and triggers DMA transfers.
Fixes: 34e3815ea4 ("spi: atcspi200: Add ATCSPI200 SPI controller driver")
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Link: https://patch.msgid.link/20260417-atcspi-v1-1-854831667d63@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Johan Hovold <johan@kernel.org> says:
This series fixes some runtime PM related issues in the cadence-quadspi
driver.
Included is also a couple of related cleanups.
Commit 30dbc1c8d5 ("spi: cadence-qspi: defer runtime support on
socfpga if reset bit is enabled") fixed a warm reset issue on SoCFPGA by
disabling runtime PM on that platform.
Clean up the quirk implementation by never dropping the runtime PM usage
count on probe instead of sprinkling conditionals throughout the driver
which makes the code unnecessarily hard to read and maintain.
Cc: Khairul Anuar Romli <khairul.anuar.romli@altera.com>
Cc: Adrian Ng Ho Yin <adrianhoyin.ng@altera.com>
Cc: Niravkumar L Rabara <nirav.rabara@altera.com>
Cc: Matthew Gerlach <matthew.gerlach@altera.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260421125354.1534871-6-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Make sure to balance the runtime PM usage count before returning on
probe failure (to allow the controller to suspend after a probe
deferral) and to only drop the usage count on driver unbind to avoid a
clock disable imbalance.
Also restore the autosuspend setting.
Fixes: 0578a6dbfe ("spi: spi-cadence-quadspi: add runtime pm support")
Cc: stable@vger.kernel.org # 6.7
Cc: Dhruva Gole <d-gole@ti.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260421125354.1534871-5-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Drop the bogus runtime PM get on probe failures that was never needed
and that leaks a usage count reference while preventing the clocks from
being disabled (as runtime PM has not yet been enabled).
Fixes: 1889dd2081 ("spi: cadence-quadspi: Fix clock disable on probe failure path")
Cc: stable@vger.kernel.org # 6.19
Cc: Anurag Dutta <a-dutta@ti.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260421125354.1534871-3-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Johan Hovold <johan@kernel.org> says:
This series fixes some runtime PM related issues in the cadence driver.
Included is also a couple of related cleanups.
Drop the redundant initialisation and return explicit zero on successful
probe to make the code more readable.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260421123615.1533617-5-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Make sure that the controller is active before disabling clocks on probe
failure to avoid unbalanced clock disable.
Also drop the usage count before returning (so that the controller can
be suspended after a probe deferral) and restore the autosuspend
setting.
Fixes: d36ccd9f7e ("spi: cadence: Runtime pm adaptation")
Cc: stable@vger.kernel.org # 4.7
Cc: Shubhrajyoti Datta <shubhrajyoti.datta@xilinx.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260421123615.1533617-3-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
The "clk_dis_all" error label is not used to disable clocks since commit
f64b1600f9 ("spi: spi-cadence: Use helper function
devm_clk_get_enabled()").
Similarly, "remove_ctlr" drops a reference rather than deregisters the
controller.
Rename the labels after what they do.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260421123615.1533617-4-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Two CTRLR0 macros are defined but never referenced, and both are wrong:
- CR0_XFM_MASK shifts by SPI_XFM_OFFSET, which does not exist anywhere
in the tree. The intended symbol is CR0_XFM_OFFSET.
- CR0_MTM_OFFSET is defined as 0x21, i.e. bit 33 of a 32-bit register.
The value is meaningless and the macro is unused.
Drop both. They can be re-introduced correctly when an actual user
appears.
Signed-off-by: John Madieu <john.madieu@gmail.com>
Link: https://patch.msgid.link/20260425092936.2590132-3-john.madieu@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
rockchip_spi_isr() decides whether the current interrupt was the
cs-inactive event by reading IMR:
if (rs->cs_inactive &&
readl_relaxed(rs->regs + ROCKCHIP_SPI_IMR) & INT_CS_INACTIVE)
ctlr->target_abort(ctlr);
IMR is the interrupt mask register: it tells which sources are enabled,
not which one fired. In the PIO path, rockchip_spi_prepare_irq() enables
both INT_RF_FULL and INT_CS_INACTIVE in IMR when rs->cs_inactive is true:
if (rs->cs_inactive)
writel_relaxed(INT_RF_FULL | INT_CS_INACTIVE,
rs->regs + ROCKCHIP_SPI_IMR);
so the IMR check is always true once cs_inactive is enabled, and every
PIO interrupt - including normal RF_FULL completions - is dispatched to
ctlr->target_abort(), aborting the transfer. The bug is reachable on
ROCKCHIP_SPI_VER2_TYPE2 in target mode with a DMA-capable controller
when the transfer is short enough to fall back to PIO
(rockchip_spi_can_dma() returns false below fifo_len).
Read ISR (which is RISR masked by IMR) so the check actually reflects
which interrupt fired, and parenthesise the expression for clarity while
at it.
Fixes: 869f2c94db ("spi: rockchip: Stop spi slave dma receiver when cs inactive")
Signed-off-by: John Madieu <john.madieu@gmail.com>
Link: https://patch.msgid.link/20260425092936.2590132-2-john.madieu@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
The driver is relying on the assumption that the invalid interrupt 0 can
be freed without any side effects, but that is not the case on
architectures like x86 where it would trigger a warning about freeing an
already free interrupt.
This should not cause any trouble on powerpc where this driver is used,
but make the code more portable (and obviously correct) by making sure
that the interrupts have been requested before freeing them.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260423075801.2252318-1-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
rzv2h_rspi_setup_clock() is declared to return u32 but returns -EINVAL
when no valid clock parameters are found. Cast to u32, -EINVAL becomes
0xffffffea, which is a non-zero value. The caller in
rzv2h_rspi_prepare_message() guards against failure with:
rspi->freq = rzv2h_rspi_setup_clock(rspi, speed_hz);
if (!rspi->freq)
return -EINVAL;
Because 0xffffffea is non-zero, the check is bypassed and the controller
proceeds to program SPBR/SPCMD with stale values, leading to an unknown
bit rate.
Return 0 on the failed-search path, consistent with the existing
clk_set_rate() failure path which already returns 0.
Fixes: 77d931584d ("spi: rzv2h-rspi: make transfer clock rate finding chip-specific")
Signed-off-by: John Madieu <john.madieu.xa@bp.renesas.com>
Reviewed-by: Biju Das <biju.das.jz@bp.renesas.com>
Reviewed-by: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com>
Link: https://patch.msgid.link/20260425024725.2393632-1-john.madieu.xa@bp.renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>
This is quite a big set of fixes, almost all from Johan Hovold who is on
an ongoing quest to clean up issues with probe and removal handling in
drivers. There isn't anything too concerning here especially with the
deregistration stuff which will very rarely get run in production
systems since this is all platform devices in the SoC on embedded
hardware, but it's all real issues which should be fixed. There's more
in flight here.
We also have a few other minor fixes, one from Felix Gu along the same
lines as Johan's work and a couple of documentation things.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmnrhSUACgkQJNaLcl1U
h9C4HwgAgcnZgIZvPQp5mQ0G3sq1udBJQja4zYyQyuZt7o+1qLs/qiPw+KA1HV/C
hVXFcns2Uy+Sqmi1fPlVadWsOODcwYz3wfS198Du8y4WqIeynVFYoYvXxQmAJYYW
zq0VD9LE/5Y+ONwABzqkfgy7ZvNzykoRgodKPoruqnkYqU0ZH7iY/k7916vxk4+Z
+8hCDlG5JHv7Uw1wAuftwnACIhsi4jN3f7wsvA++ac3OXKpDC/0l4JX2gBzPaxfI
HaT5+W+tDIDk7IbQmweatMMIoi6cvjttieoh6HLqGdJZF0aI7IgH71CDAB+6fWrx
kwZIkX2FL5+mVLA1vCUNjwkZDFS+pg==
=MD5+
-----END PGP SIGNATURE-----
Merge tag 'spi-fix-v7.1-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi
Pull spi fixes from Mark Brown:
"This is quite a big set of fixes, almost all from Johan Hovold who is
on an ongoing quest to clean up issues with probe and removal handling
in drivers.
There isn't anything too concerning here especially with the
deregistration stuff which will very rarely get run in production
systems since this is all platform devices in the SoC on embedded
hardware, but it's all real issues which should be fixed. There's more
in flight here.
We also have a few other minor fixes, one from Felix Gu along the same
lines as Johan's work and a couple of documentation things"
* tag 'spi-fix-v7.1-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (23 commits)
spi: fix controller cleanup() documentation
spi: fix resource leaks on device setup failure
spi: axiado: clean up probe return value
spi: axiado: rename probe error labels
spi: axiado: fix runtime pm imbalance on probe failure
spi: orion: clean up probe return value
spi: orion: fix clock imbalance on registration failure
spi: orion: fix runtime pm leak on unbind
spi: imx: fix runtime pm leak on probe deferral
spi: mpc52xx: fix use-after-free on registration failure
spi: Fix the error description in the `ptp_sts_word_post` comment
spi: topcliff-pch: fix use-after-free on unbind
spi: topcliff-pch: fix controller deregistration
spi: orion: fix controller deregistration
spi: mxic: fix controller deregistration
spi: mpc52xx: fix use-after-free on unbind
spi: mpc52xx: fix controller deregistration
spi: cadence-quadspi: fix controller deregistration
spi: cadence: fix controller deregistration
spi: mtk-snfi: fix memory leak in probe
...
Johan Hovold <johan@kernel.org> says:
Make sure to call controller cleanup() if spi_setup() fails while
registering a device to avoid leaking any resources allocated by
setup().
Make sure to call controller cleanup() if spi_setup() fails while
registering a device to avoid leaking any resources allocated by
setup().
Fixes: c7299fea67 ("spi: Fix spi device unregister flow")
Cc: stable@vger.kernel.org # 5.13
Cc: Saravana Kannan <saravanak@kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260410154907.129248-2-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Johan Hovold <johan@kernel.org> says:
The series fixes some runtime PM related issues in the axiado driver.
Included is also a couple of related cleanups.
Drop the redundant initialisation and return explicit zero on successful
probe to make the code more readable.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260421143925.1551781-4-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Make sure that the controller is active before disabling clocks on late
probe failure and on driver unbind to avoid a clock disable imbalance.
Also make sure that the usage count is balanced on probe failure (e.g.
probe deferral) so that the controller can be suspended when a driver is
later bound.
Note that the runtime PM state can only be set when runtime PM is
disabled.
Fixes: e75a6b00ad ("spi: axiado: Add driver for Axiado SPI DB controller")
Cc: stable@vger.kernel.org # 7.0
Cc: Vladimir Moravcevic <vmoravcevic@axiado.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260421143925.1551781-2-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Drop the redundant initialisation and return explicit zero on successful
probe to make the code more readable.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260421130211.1537628-4-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Make sure that the controller is not runtime suspended before disabling
clocks on probe failure.
Also restore the autosuspend setting.
Fixes: 5c6786945b ("spi: spi-orion: add runtime PM support")
Cc: stable@vger.kernel.org # 3.17
Cc: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260421130211.1537628-3-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Make sure to balance the runtime PM usage count before returning on
probe failure (e.g. probe deferral) so that the controller can be
suspended when a driver is later bound.
Fixes: 43b6bf406c ("spi: imx: fix runtime pm support for !CONFIG_PM")
Cc: stable@vger.kernel.org # 5.10
Cc: Sascha Hauer <s.hauer@pengutronix.de>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260421125632.1537235-1-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Give the driver a chance to flush its queue before releasing the DMA
buffers on driver unbind
Fixes: c37f3c2749 ("spi/topcliff_pch: DMA support")
Cc: stable@vger.kernel.org # 3.1
Cc: Tomoya MORINAGA <tomoya-linux@dsn.okisemi.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260414134319.978196-9-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Make sure to deregister the controller before disabling and releasing
underlying resources like interrupts and DMA during driver unbind.
Fixes: e8b17b5b3f ("spi/topcliff: Add topcliff platform controller hub (PCH) spi bus driver")
Cc: stable@vger.kernel.org # 2.6.37
Cc: Masayuki Ohtake <masa-korg@dsn.okisemi.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260414134319.978196-8-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
