summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2026-08-04drivers/perf: hisi: Remove redundant dev_err()/dev_err_probe()Pan Chuang2-6/+2
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() and dev_err_probe() calls. Signed-off-by: Pan Chuang <panchuang@vivo.com> Acked-by: Yushan Wang <wangyushan12@huawei.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-04perf: arm_cspmu: Remove redundant dev_err()Pan Chuang1-3/+1
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() calls. Signed-off-by: Pan Chuang <panchuang@vivo.com> Reviewed-by: Ilkka Koskinen <ilkka@os.amperecomputing.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-04perf: Remove redundant dev_err()/dev_err_probe()Pan Chuang8-23/+8
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() and dev_err_probe() calls. Signed-off-by: Pan Chuang <panchuang@vivo.com> Reviewed-by: Shuai Xue <xueshuai@linux.alibaba.com> Acked-by: Frank Li <Frank.Li@kernel.org> Reviewed-by: Xu Yang <xu.yang_2@nxp.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-04block/blk-iocost: annotate ioc_pd_stat reads with data_race()Tao Cui1-6/+6
ioc_pd_stat() reads ioc->enabled, ioc->vtime_base_rate, and iocg->last_stat without holding ioc->lock, which trips KCSAN since ioc_adjust_base_vrate() and iocg_flush_stat_upward() write those fields under ioc->lock. Commit 35198e323001 fixed the same issue in ioc_qos_prfill() and ioc_cost_model_prfill() by adding spin_lock_irq(&ioc->lock). However, those functions read configuration parameters (qos/model) that need synchronized reads. In contrast, ioc_pd_stat() only reads stat values (vrate, usage) where stale reads are harmless, so data_race() is more appropriate — it silences the KCSAN warning without adding lock contention during high-frequency stat reads. Signed-off-by: Tao Cui <cuitao@kylinos.cn> Acked-by: Tejun Heo <tj@kernel.org> Link: https://patch.msgid.link/20260804054120.161933-1-cui.tao@linux.dev Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-08-04block: handle nogenerate/noverify properly in fs-integrityChristoph Hellwig1-1/+5
Check the BIP_CHECK flags before generating or verifying PI information, otherwise this can be incorrectly called for non-PI metadata and cause generation of incorrect metadata and crashed in the verification handler. The new behavior matches that of the block layer auto-generated metadata. Fixes: 0bde8a12b554 ("block: add fs_bio_integrity helpers") Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Kanchan Joshi <joshi.k@samsung.com> Reviewed-by: Anuj Gupta <anuj20.g@samsung.com> Link: https://patch.msgid.link/20260804123928.736596-4-hch@lst.de Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-08-04block: lift BIP_CHECK_FLAGS to include/linux/bio-integrity.hChristoph Hellwig2-2/+3
To allow for users outside of bio-integrity-auto.c. Also add a little comment explaining it. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Anuj Gupta <anuj20.g@samsung.com> Reviewed-by: Kanchan Joshi <joshi.k@samsung.com> Link: https://patch.msgid.link/20260804123928.736596-3-hch@lst.de Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-08-04block: remove bip_should_checkChristoph Hellwig1-6/+2
There is no benefit in using this helper over the simple flags check. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Anuj Gupta <anuj20.g@samsung.com> Reviewed-by: Kanchan Joshi <joshi.k@samsung.com> Link: https://patch.msgid.link/20260804123928.736596-2-hch@lst.de Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-08-04Documentation: block: zloop: clarify capacity alignmentXu Rao1-2/+4
zloop divides the requested capacity by the zone size to determine the number of zones. Since it uses one zone size for all zones, a smaller last zone is not supported and an unaligned capacity is rounded down. The capacity_mb description incorrectly states that the capacity is rounded up. Correct it to document the actual behavior. Fixes: 9e4f11c1228c ("Documentation: Document the new zoned loop block device driver") Suggested-by: Damien Le Moal <dlemoal@kernel.org> Reviewed-by: Damien Le Moal <dlemoal@kernel.org> Signed-off-by: Xu Rao <raoxu@uniontech.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Link: https://patch.msgid.link/4659F8F0C6C328EA+20260804052942.1186727-1-raoxu@uniontech.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-08-04spi: cadence-xspi: remove 64BIT dependencyMark Brown2-231/+246
Jisheng Zhang <jszhang@kernel.org> says: Currently, cadence-xspi depends on 64BIT. This dependency isn't from cadence xspi controller itself, but from marvell support code and 64bit slave dma interface performance optimization. This series tries to remove the 64BIT dependency. patch1 is the preparation patch to move some code so we can group marvell support code together. No functionality change. patch2 and patch3 remove the two causes of 64BIT dependency. patch4 finally removes the 64BIT Kconfig dependency. Link: https://patch.msgid.link/20260803140728.12747-1-jszhang@kernel.org
2026-08-04spi: cadence-xspi: remove 64BIT Kconfig dependencyJisheng Zhang1-1/+1
Now everything is ready, we can remove 64BIT Kconfig dependency now. Signed-off-by: Jisheng Zhang <jszhang@kernel.org> Link: https://patch.msgid.link/20260803140728.12747-5-jszhang@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-04spi: cadence-xspi: only use readsq/writesq under 64BITJisheng Zhang1-2/+6
Currently, cadence-xspi depends on 64BIT. This dependency isn't from cadence xspi controller itself, but from marvell support code and 64bit slave dma interface performance optimization. readsq and writesq are only available under 64BIT. For 32BIT platforms, we can fallback to ioread32_rep/iowrite32_rep. So we can remove another reason of the 64BIT dependency. Signed-off-by: Jisheng Zhang <jszhang@kernel.org> Link: https://patch.msgid.link/20260803140728.12747-4-jszhang@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-04spi: cadence-xspi: put marvell support code under CONFIG_64BITJisheng Zhang1-0/+12
Currently, cadence-xspi depends on 64BIT. This dependency isn't from cadence xspi controller itself, but from marvell support code and 64bit slave dma interface performance optimization. Put marvell support code under CONFIG_64BIT to remove one reason of the 64BIT dependency. Signed-off-by: Jisheng Zhang <jszhang@kernel.org> Link: https://patch.msgid.link/20260803140728.12747-3-jszhang@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-04spi: cadence-xspi: group marvell support code togetherJisheng Zhang1-228/+227
We will remove the 64BIT dependency from cadence-xspi for non marvell platform soon. No functionality change. Signed-off-by: Jisheng Zhang <jszhang@kernel.org> Link: https://patch.msgid.link/20260803140728.12747-2-jszhang@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-04mmc: atmel-mci: Fix use-after-free in atmci_remove due to race conditionPei Xiao1-0/+2
In atmci_probe, &host->bh_work is bound with atmci_work_func, and atmci_interrupt, atmci_timeout_timer and atmci_dma_complete can all queue this work on system_bh_wq. If we remove the module, atmci_remove makes cleanup and the memory allocated for host with devm_kzalloc() is released after the remove callback returns, while the work mentioned above may still be pending or running. The sequence of operations that may lead to a UAF bug is as follows: CPU0 CPU1 | atmci_interrupt | queue_work(system_bh_wq, | &host->bh_work) atmci_remove | atmci_cleanup_slot(...) | atmci_writel(host, ATMCI_IDR, ~0UL) | timer_delete_sync(&host->timer) | dma_release_channel(host->dma.chan) | free_irq(platform_get_irq(pdev, 0), host) | | atmci_work_func | // use host // devm resources released after | // remove returns, host is freed | | // use host (use-after-free) Fix it by canceling the work after all the sources that can schedule it (IRQ handler, timeout timer and DMA completion callback) have been stopped, and before proceeding with the remaining cleanup in atmci_remove. Fixes: 7d2be0749a59 ("atmel-mci: Driver for Atmel on-chip MMC controllers") Assisted-by: Codex:deepseek-v4-flash Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn> Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson <ulfh@kernel.org>
2026-08-04ublk: clear auto buf reg before updating io->buf in batch commitYang Xiuwei1-1/+1
ublk_batch_commit_io() stored the new auto_buf into io->buf before calling ublk_clear_auto_buf_reg(). Clear takes the unregister index from io->buf.auto_reg, so it could drop the new slot and leave the old registered buffer behind. Fixes: 1e500e106d5a ("ublk: handle UBLK_U_IO_COMMIT_IO_CMDS") Signed-off-by: Yang Xiuwei <yangxiuwei@kylinos.cn> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-08-04block: split out a new blk_plug.h headerChristoph Hellwig16-95/+108
blkdev.h gets included in various places outside the block layer just for struct blk_plug and related plugging functions. Split blk_plug into a separate helper to reduce the amount of code that needs to get rebuilt when blkdev.h changes and to slightly reduce compile times. In io_uring this requires pulling in a few other headers explicitly that previously were implicitly included through blkdev.h. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Christian Brauner (Amutable) <brauner@kernel.org> Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com> Reviewed-by: Damien Le Moal <dlemoal@kernel.org> Link: https://patch.msgid.link/20260804125524.740996-1-hch@lst.de Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-08-04block: implement async io_uring zone reset allChristoph Hellwig2-0/+38
Add a new BLOCK_URING_CMD_ZONE_RESET_ALL uring cmd to reset all zones for a given block device. This can be used by storage systems or file system mkfs tools to initialize multiple devices in parallel. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Damien Le Moal <dlemoal@kernel.org> Link: https://patch.msgid.link/20260804125038.740388-7-hch@lst.de Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-08-04block: remove most blkdev_cmd_discard argumentsChristoph Hellwig1-13/+10
All other arguments can be derived from cmd, so do that to simplify the calling convention. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Damien Le Moal <dlemoal@kernel.org> Link: https://patch.msgid.link/20260804125038.740388-6-hch@lst.de Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-08-04block: also reject zone open / close on conventional zonesChristoph Hellwig1-6/+3
Just like zone reset / finish, these only apply to sequential zones. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Damien Le Moal <dlemoal@kernel.org> Link: https://patch.msgid.link/20260804125038.740388-5-hch@lst.de Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-08-04block: remove blk_zone_wplug_handle_zone_mgmtChristoph Hellwig2-20/+8
blk_zone_wplug_handle_zone_mgmt now only checks that zone reset and zone finish operations are directed to a sequential write required zone. This has nothing to do with zone write plugs and is better handled with other bio validity checks in submit_bio_noacct. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Damien Le Moal <dlemoal@kernel.org> Link: https://patch.msgid.link/20260804125038.740388-4-hch@lst.de Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-08-04block: allow REQ_NOWAIT zone management commandsChristoph Hellwig1-9/+0
Commit efae226c2ef1 ("block: handle zone management operations completions") moved all block layer tracking of zone management operations to the I/O completion handler. With that REQ_NOWAIT zone management operations are just fine, so allow them. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Damien Le Moal <dlemoal@kernel.org> Link: https://patch.msgid.link/20260804125038.740388-3-hch@lst.de Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-08-04block: remove a dead return statement in blk_zone_plug_bioChristoph Hellwig1-2/+0
The switch at the end of blk_zone_plug_bio always returns, so remove the dead extra return statement after it. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Damien Le Moal <dlemoal@kernel.org> Link: https://patch.msgid.link/20260804125038.740388-2-hch@lst.de Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-08-04zloop: truncate finished zones to zone capacityXu Rao2-6/+6
The size of a sequential zone backing file records the amount of data written and is used to restore the zone state. A backing file whose size is equal to the zone capacity is restored as a full zone, while a file larger than the zone capacity is rejected as invalid. However, zloop_finish_zone() currently truncates the backing file to the zone size. For devices with a reduced zone capacity, finishing a zone therefore creates a backing file larger than the zone capacity. After the device is removed and later re-added, that zone file is rejected instead of being restored as a full zone. Truncate finished sequential zones to the zone capacity, matching the persistent representation accepted by zloop_update_seq_zone() for a full zone. Suggested-by: Damien Le Moal <dlemoal@kernel.org> Fixes: eb0570c7df23 ("block: new zoned loop block device driver") Cc: stable@vger.kernel.org Signed-off-by: Xu Rao <raoxu@uniontech.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Damien Le Moal <dlemoal@kernel.org> Link: https://patch.msgid.link/B39E5FD81D1A07F4+20260804023403.939767-1-raoxu@uniontech.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-08-04rust: revocable: Use LKMM atomics instead of Rust atomicsGary Guo1-8/+13
Kernel code should use LKMM atomics. The existing code is `AtomicBool` with the need to use `xchg`, so convert it to `AtomicFlag`. Signed-off-by: Gary Guo <gary@garyguo.net> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Reviewed-by: FUJITA Tomonori <fujita.tomonori@gmail.com> Signed-off-by: Boqun Feng <boqun@kernel.org> Link: https://patch.msgid.link/20260716145536.3681630-1-gary@kernel.org
2026-08-04rust: sync: Add generic memory barriersGary Guo2-29/+100
Implement a generic interface for memory barriers (full system/DMA/SMP). The interface uses a parameter to force user to specify their intent with barriers. Provide `Read`, `Write`, `Full` orderings which map to the existing `rmb()`, `wmb()` and `mb()`. Generic is used here instead of providing individual standalone functions to reduce code duplication; for example, the `CONFIG_SMP` check in `smp_mb` is uniformly implemented for all SMP barriers. This could extend to `virt_mb`'s if they're introduced in the future. It would also make it easier if new ordering types are introduced in the future (e.g. `Acquire`, `Release`). Signed-off-by: Gary Guo <gary@garyguo.net> Signed-off-by: Boqun Feng <boqun@kernel.org> Link: https://patch.msgid.link/20260609-rust-barrier-v2-2-30fcc48e1cd0@garyguo.net
2026-08-04rust: sync: Add helpers for mb, dma_mb and friendsGary Guo1-0/+30
They supplement the existing smp_mb, smp_rmb and smp_wmb. Reviewed-by: Eliot Courtney <ecourtney@nvidia.com> Signed-off-by: Gary Guo <gary@garyguo.net> Signed-off-by: Boqun Feng <boqun@kernel.org> Link: https://patch.msgid.link/20260609-rust-barrier-v2-1-30fcc48e1cd0@garyguo.net
2026-08-04rust: sync: Use safe synchronize_rcu() abstraction in pollPhilipp Stanner1-4/+6
We now have a safe wrapper for the foreign function synchronize_rcu(). Use it in poll.rs. Signed-off-by: Philipp Stanner <phasta@kernel.org> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Reviewed-by: Onur Özkan <work@onurozkan.dev> Reviewed-by: Danilo Krummrich <dakr@kernel.org> Reviewed-by: Gary Guo <gary@garyguo.net> Signed-off-by: Boqun Feng <boqun@kernel.org> Link: https://patch.msgid.link/20260624150704.1504001-5-phasta@kernel.org
2026-08-04rust: revocable: Use safe synchronize_rcu() abstractionPhilipp Stanner1-3/+6
We now have a safe wrapper for the foreign function synchronize_rcu(). Use it in revocable.rs. Signed-off-by: Philipp Stanner <phasta@kernel.org> Reviewed-by: Onur Özkan <work@onurozkan.dev> Reviewed-by: Danilo Krummrich <dakr@kernel.org> Reviewed-by: Gary Guo <gary@garyguo.net> Signed-off-by: Boqun Feng <boqun@kernel.org> Link: https://patch.msgid.link/20260624150704.1504001-4-phasta@kernel.org
2026-08-04rust: sync: Add abstraction for synchronize_rcu()Philipp Stanner1-0/+16
synchronize_rcu() is a frequently used C function which is always safe to be called. Add a safe abstraction for synchronize_rcu(). Signed-off-by: Philipp Stanner <phasta@kernel.org> Reviewed-by: Onur Özkan <work@onurozkan.dev> Reviewed-by: Danilo Krummrich <dakr@kernel.org> Reviewed-by: Gary Guo <gary@garyguo.net> [boqun: Fix rustdoc reported by kernel test robot <lkp@intel.com>] Signed-off-by: Boqun Feng <boqun@kernel.org> Link: https://patch.msgid.link/20260624150704.1504001-3-phasta@kernel.org
2026-08-04spi: Add support for StarFive JHB100 SFCMark Brown530-2938/+7456
Changhuang Liang <changhuang.liang@starfivetech.com> says: This serial add support for the StarFive JHB100 SoC SPI Flash Controller (SFC), which is based on the Synopsys DesignWare SSI version 2.00a but with some customizations and it also add enhanced SPI for DesignWare SPI controllers. I picked up some patches from series [1]. This series depends on the series [2]: [1] https://lore.kernel.org/all/20221212180732.79167-1-sudip.mukherjee@sifive.com/ [2] https://lore.kernel.org/all/20260521012932.24163-1-changhuang.liang@starfivetech.com/ v1: https://lore.kernel.org/all/20260709055204.138168-1-changhuang.liang@starfivetech.com/ Link: https://patch.msgid.link/20260803124044.156998-1-changhuang.liang@starfivetech.com
2026-08-04spi: dw: Add support for StarFive JHB100 SoC SFCChanghuang Liang3-11/+127
Add support for the StarFive JHB100 SoC SPI Flash Controller (SFC), which is based on the Synopsys DesignWare SSI version 2.00a but with some customizations. The JHB100 SFC controller has the following special features: 1. Separate registers for instruction and address (DW_SPI_JHB100_INST and DW_SPI_JHB100_ADDR) instead of using the common data register. 2. A filter interrupt mask register (DW_SPI_JHB100_FILTER_IMR), which is default masked to disable filter interrupts as they are not used. 3. Requires a system controller phandle "starfive,sfc-filter-syscon" to configure 3-byte/4-byte address mode switching per chip select. 4. Different Set CS and Enable Controller Timing. A new quirk flag DW_SPI_QUIRK_JHB100 is introduced to handle these differences in the enhanced SPI memory operation path. The controller uses the HSSI initialization path (DW_HSSI_ID) and shares the same interrupt masking logic. Limit the JHB100 SFC address to 3-byte or 4-byte length. Additionally, the platform_suspend() and platform_resume() callbacks are introduced to handle platform-private suspend/resume procedures. Signed-off-by: Changhuang Liang <changhuang.liang@starfivetech.com> Link: https://patch.msgid.link/20260803124044.156998-12-changhuang.liang@starfivetech.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-04spi: dt-bindings: snps,dw-apb-ssi: Add starfive,jhb100-sfcChanghuang Liang1-0/+22
Add a new compatible string "starfive,jhb100-sfc" for the StarFive JHB100 SPI Flash Controller, it based on the Synopsys DesignWare SSI version 2.00a but with minor modifications. Due to these minor modifications, it only supports access for flash memory and requires a system controller register to configure the address mode filter for SPI NOR flash devices. The starfive,sfc-filter-syscon property is required to provide a phandle to the system controller that manages switching between 3-byte and 4-byte addressing modes, essential for supporting SPI NOR flash devices with different address width requirements. Signed-off-by: Changhuang Liang <changhuang.liang@starfivetech.com> Acked-by: Conor Dooley <conor.dooley@microchip.com> Link: https://patch.msgid.link/20260803124044.156998-11-changhuang.liang@starfivetech.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-04spi: dw: detect enhanced spi modeSudip Mukherjee1-3/+72
All the SSI controllers supporting enhanced spi modes might not support all the three dual or quad or octal modes. Detect the modes that are supported and finally enable the DW_SPI_CAP_EMODE capability which will start using all the enhanced spi functions that has been added. Signed-off-by: Sudip Mukherjee <sudip.mukherjee@sifive.com> Co-developed-by: Changhuang Liang <changhuang.liang@starfivetech.com> Signed-off-by: Changhuang Liang <changhuang.liang@starfivetech.com> Link: https://patch.msgid.link/20260803124044.156998-10-changhuang.liang@starfivetech.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-04spi: dw: use irq handler for enhanced spiSudip Mukherjee1-2/+104
Introduce the interrupt handler for enhanced spi to read or write based on the generated irq. Also, use the xfer_completion from spi_controller to wait for a timeout or completion from irq handler. In enhanced mode we need to calculate RXFTLR based on the length of data we are expecting to receive or the fifo length. Signed-off-by: Sudip Mukherjee <sudip.mukherjee@sifive.com> Co-developed-by: Changhuang Liang <changhuang.liang@starfivetech.com> Signed-off-by: Changhuang Liang <changhuang.liang@starfivetech.com> Link: https://patch.msgid.link/20260803124044.156998-9-changhuang.liang@starfivetech.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-04spi: dw: send cmd and addr to start the spi transferSudip Mukherjee1-0/+15
In enhanced spi mode, read or write will start by sending the cmd and address (if present). Signed-off-by: Sudip Mukherjee <sudip.mukherjee@sifive.com> Co-developed-by: Changhuang Liang <changhuang.liang@starfivetech.com> Signed-off-by: Changhuang Liang <changhuang.liang@starfivetech.com> Link: https://patch.msgid.link/20260803124044.156998-8-changhuang.liang@starfivetech.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-04spi: dw: Introduce enhanced single/dual/quad/octal spiSudip Mukherjee2-1/+95
If the spi transfer is using enhanced single/dual/quad/octal spi mode, then we need to update the SPI_CTRLR0 register. The SPI_CTRLR0 register will be updated in dw_spi_update_config() via the values in dw_spi_enh_cfg. Signed-off-by: Sudip Mukherjee <sudip.mukherjee@sifive.com> Co-developed-by: Changhuang Liang <changhuang.liang@starfivetech.com> Signed-off-by: Changhuang Liang <changhuang.liang@starfivetech.com> Link: https://patch.msgid.link/20260803124044.156998-7-changhuang.liang@starfivetech.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-04spi: dw: update NDF while using enhanced spi modeSudip Mukherjee1-0/+3
If the transfer of Transmit only mode is using enhanced SPI then NDF needs to be updated with the number of data frames. If the Transmit FIFO goes empty in-between, DWC_ssi masks the serial clock and wait for rest of the data until the programmed amount of frames are transferred successfully. In receive mode, the number of data frames received is equal to this register value plus 1. In transmit mode, the number of data frames is equal this register value. Signed-off-by: Sudip Mukherjee <sudip.mukherjee@sifive.com> Co-developed-by: Changhuang Liang <changhuang.liang@starfivetech.com> Signed-off-by: Changhuang Liang <changhuang.liang@starfivetech.com> Link: https://patch.msgid.link/20260803124044.156998-6-changhuang.liang@starfivetech.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-04spi: dw: adjust size of mem_opSudip Mukherjee1-2/+16
In enhanced mode adjust the size of the data that can be sent or received as this will then be used to set the NDF. Signed-off-by: Sudip Mukherjee <sudip.mukherjee@sifive.com> Co-developed-by: Changhuang Liang <changhuang.liang@starfivetech.com> Signed-off-by: Changhuang Liang <changhuang.liang@starfivetech.com> Link: https://patch.msgid.link/20260803124044.156998-5-changhuang.liang@starfivetech.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-04spi: dw: add check for support of enhanced spiSudip Mukherjee2-1/+34
Before doing the mem op, spi controller will be queried about the buswidths it supports. Add the single/dual/quad/octal if the controller has the DW_SPI_CAP_EMODE capability. The DW_SPI_CAP_EMODE capability will be enabled in a later patch. Signed-off-by: Sudip Mukherjee <sudip.mukherjee@sifive.com> Co-developed-by: Changhuang Liang <changhuang.liang@starfivetech.com> Signed-off-by: Changhuang Liang <changhuang.liang@starfivetech.com> Link: https://patch.msgid.link/20260803124044.156998-4-changhuang.liang@starfivetech.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-04spi: dw: update SPI_CTRLR0 registerSudip Mukherjee2-4/+28
If the SPI transfer is being done in enhanced mode then SPI_CTRLR0 register needs to be updated to mention the instruction length, address length, address and instruction transfer format, wait cycles. And, we also need to enable clock stretching. Signed-off-by: Sudip Mukherjee <sudip.mukherjee@sifive.com> Co-developed-by: Changhuang Liang <changhuang.liang@starfivetech.com> Signed-off-by: Changhuang Liang <changhuang.liang@starfivetech.com> Link: https://patch.msgid.link/20260803124044.156998-3-changhuang.liang@starfivetech.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-04spi: dw: Introduce spi_frf and STD_SPISudip Mukherjee2-1/+19
The DW APB SSI controllers of v4.x and newer and DW AHB SSI controllers supports enhanced SPI modes which can be defined from SPI_FRF of DW_SPI_CTRLR0 register. Without enhanced mode, these controllers will work in the standard spi mode. Signed-off-by: Sudip Mukherjee <sudip.mukherjee@sifive.com> Co-developed-by: Changhuang Liang <changhuang.liang@starfivetech.com> Signed-off-by: Changhuang Liang <changhuang.liang@starfivetech.com> Link: https://patch.msgid.link/20260803124044.156998-2-changhuang.liang@starfivetech.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-04dt-bindings: mmc: sunxi: add compatible string for Allwinner A733 MMC0/1/2Jerome Brunet1-1/+3
The A733 MMC0/1/2 controllers are compatible with the D1 ones. Add an A733-specific compatible string, with the D1 as fallback. Signed-off-by: Jerome Brunet <jbrunet@baylibre.com> Signed-off-by: Ulf Hansson <ulfh@kernel.org>
2026-08-04dt-bindings: mmc: Document fixed-layout NVMEM provider supportLoic Poulain1-1/+22
Allow an eMMC hardware partition node to describe an NVMEM layout so the partition can be exposed as an NVMEM provider. This lets a partition (e.g. an eMMC boot partition) store device-specific information such as a WiFi MAC address or a Bluetooth BD address and reference it through NVMEM cells. Accept "fixed-layout" as the partition node compatible, in addition to "fixed-partitions", so the layout can be described directly on the partition node. Reviewed-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com> Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Signed-off-by: Ulf Hansson <ulfh@kernel.org>
2026-08-04mmc: sdhci: unmap the bounce buffer before device releaseMyeonghun Pak1-0/+16
sdhci_allocate_bounce_buffer() allocates its buffer with devm_kmalloc() but maps it with dma_map_single(). The buffer is therefore released by devres without the streaming DMA mapping being unmapped. Register a managed action after dma_map_single() succeeds so the mapping is removed before devres releases the buffer. The action is registered only for buffers allocated and mapped by the SDHCI core, leaving buffers provided by host drivers under their existing ownership. Fixes: bd9b902798ab ("mmc: sdhci: Implement an SDHCI-specific bounce buffer") Cc: stable@vger.kernel.org Co-developed-by: Ijae Kim <ae878000@gmail.com> Signed-off-by: Ijae Kim <ae878000@gmail.com> Signed-off-by: Myeonghun Pak <mhun512@gmail.com> Reviewed-by: Linus Walleij <linusw@kernel.org> Signed-off-by: Ulf Hansson <ulfh@kernel.org>
2026-08-04mmc: sdhci: make tuning_err a signed intHaibo Chen1-1/+1
Coverity report INTEGER_OVERFLOW for host->tuning_err. The tuning_err field in struct sdhci_host is used to store an error code for re-tuning, but it was declared as unsigned int. Several call sites store negative error codes into it and later compare against negative values: - sdhci.c, sdhci-of-dwcmshc.c and sdhci-pci-gli.c assign it the return value of __sdhci_execute_tuning()/__sdhci_execute_tuning_9750(), both of which return a signed int (possibly a negative errno); - sdhci-of-esdhc.c assigns host->tuning_err = -EAGAIN and later does "ret = host->tuning_err; if (ret == -EAGAIN ...)"; - sdhci-of-dwcmshc.c prints it with the %d (signed) conversion. Storing a negative errno in an unsigned int and reading it back as a signed int only happens to work because of two's-complement, same-width integer conversions. It is misleading and triggers sign-conversion warnings. All users treat the value either as a signed error code or as a boolean (zero / non-zero), so changing the type to a signed int is safe and makes the intent explicit. Fixes: 7d8bb1f46e13 ("mmc: sdhci: add tuning error codes") Assisted-by: Cline:claude-sonnet [read_file, search_files, git] Signed-off-by: Haibo Chen <haibo.chen@nxp.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson <ulfh@kernel.org>
2026-08-04ALSA: hda/core: Log stream DMA errors on interruptArun Raghavan1-0/+5
The stream descriptor status register reports FIFO and descriptor errors, but these are currently cleared silently along with the rest of the interrupt status. Log them, rate-limited, so DMA problems are visible instead of only manifesting as audible glitches. Observed on some AMD GPU HDMI audio controllers under specific low power circumstances. Signed-off-by: Arun Raghavan <arunr@valvesoftware.com> Cc: Arun Raghavan <arun@arunraghavan.net> Link: https://patch.msgid.link/20260803-master-v1-1-9bcedb736978@valvesoftware.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-08-04drm/omap: dsi: Do not copy isr tableAndreas Kemnade2-8/+1
To be able to unregister stuff from isrs, the corresponding table was copied. Nobody seems to unregister stuff that way, so it does not help. But there are stack-allocated objects passed to these isrs giving chances of UAF of these objects if irqs are unregistered while they are handled, so better do not copy that table. Fixes: 4ae2ddddf44cd ("OMAP: DSS2: DSI: Add ISR support") Signed-off-by: Andreas Kemnade <andreas@kemnade.info> Link: https://patch.msgid.link/20260702-dsi-uaf-v2-1-dbb4aa0f0b8e@kemnade.info Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
2026-08-04net/openvswitch: check Ethernet header length in key_extract()Cen Zhang (Microsoft)1-4/+7
When a packet arrives on an ARPHRD_NONE device (e.g. TUN), ovs_flow_key_extract() trusts the user-provided skb->protocol field: if it is ETH_P_TEB, the packet is classified as MAC_PROTO_ETHERNET and key_extract() is called without ensuring the skb has ETH_HLEN (14) bytes of linear data. key_extract() unconditionally pulls 2 * ETH_ALEN bytes for MAC addresses and parse_ethertype() pulls 2 more, either of which triggers a kernel BUG in __skb_pull() when the linear area is too small. kernel BUG at include/linux/skbuff.h:2848! RIP: 0010:key_extract+0xa7e/0xd90 net/openvswitch/flow.c:933 ovs_flow_key_extract+0x419/0xa70 ovs_vport_receive+0x222/0x390 netdev_frame_hook+0x3e0/0x630 tun_get_user+0x2d0c/0x38e0 Fixed by calling check_header() in key_extract() before accessing the Ethernet header. Fixes: 217ac77a3c25 ("openvswitch: allow L3 netdev ports") Reported-by: AutonomousCodeSecurity@microsoft.com Reviewed-by: Eelco Chaudron <echaudro@redhat.com> Signed-off-by: Cen Zhang (Microsoft) <blbllhy@gmail.com> Reviewed-by: Ilya Maximets <i.maximets@ovn.org> Link: https://patch.msgid.link/20260730222006.118652-1-blbllhy@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-04mm/slab, kfence, memcg: completely remove obj_ext for kfence objectsVlastimil Babka (SUSE)5-34/+26
We have already disabled memory allocation profiling for objects allocated for KFENCE to avoid complexity. KFENCE allocations are rare and there can be only CONFIG_KFENCE_NUM_OBJECTS (default to 255) outstanding ones at any time, so they are among noise in the profiling stats. For the same reasons, we can stop memcg_kmem accounting of kfence objects as their memory usage will be negligible wrt any practical memcg limits. This allows us simplifying the code and getting rid of is_kfence_address() checks in various places, including slab_obj_ext()'s usage of obj_to_index(). Instead we rely on the fact that slab_obj_exts() will now always return 0 for a kfence object's fake slab, which makes those places unreachable. All we need to do to keep this assumption valid is not to allocate obj_exts for kfence objects, so the checks need to guard alloc_slab_obj_exts() where necessary. Suggested-by: Harry Yoo <harry@kernel.org> Link: https://patch.msgid.link/20260727-b4-objext_split-v3-13-c29ef0f1f257@kernel.org Reviewed-by: Hao Li <hao.li@linux.dev> Signed-off-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
2026-08-04futex: Avoid private hash use-after-free on final putFelix Hoffmann1-2/+8
futex_private_hash_put() drops the reference to fph before evaluating fph->mm for wake_up_var(). futex_ref_put() enables preemption again before returning. If that put drops the final reference and the task is preempted, another task can pivot to the replacement hash and free the old hash after an RCU grace period. The first task then reads fph->mm from the freed allocation when it resumes. KASAN reports a slab-use-after-free in futex_private_hash_put(), with the read at offset 24 in a freed kmalloc-512 allocation. The allocation and free stacks point to futex_hash_allocate() and the RCU free path, respectively. Load the mm pointer while the fph reference is still held and pass the saved value to wake_up_var(). wake_up_var() uses the pointer as a waitqueue key and does not dereference the mm through it. Fixes: bd54df5ea7ca ("futex: Allow to resize the private local hash") Signed-off-by: Felix Hoffmann <f3lix.dev@gmx.de> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260731155024.1150011-1-f3lix.dev@gmx.de
generated by cgit (git 2.54.0.dirty) at 2026-09-29 22:54:05 +0000