1
0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-01-11 17:10:13 +00:00

Compare commits

..

54 Commits

Author SHA1 Message Date
Linus Torvalds
b6151c4e60 Change since last update:
- Don't bother with s_stack_depth increasing to band-aid
    regressions in some composefs mount setups (EROFS + ovl^2)
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEQ0A6bDUS9Y+83NPFUXZn5Zlu5qoFAmlh3l4RHHhpYW5nQGtl
 cm5lbC5vcmcACgkQUXZn5Zlu5qry/A/+M2JIV6Cu9IW2MZ/8X+mlTK0NOP/fKq1z
 tbtcTvkIXP31L+/ANOPRRlyYC+mNLFvUbig2nbKChkriQxX7Sw/oy9qCOKLUCwmN
 bV1Hv6kbAAAI/+G2DOSUw8pgvrgbT/7cj3EYQHslwdkkgSI/6IjZggU/KjrtAK32
 xlXe2bNR6ATfsUIP8URLdqLEwp2U/mzEbJTa5FhrWYmsDyFWSYbe9g3GHKjO1v/V
 gH/RYl1GETNccuGWQBQOagSWx4tUQZgvhnabPTwT31UyNnAR6+uRDS94zBeLzbku
 6f0MiK69ZsbB7ToelKw0Vj5nWCAFnAIOnMKM0TDY7uuOXlhUx8YOvcrD7/9b0mZ1
 YVq14vKEhZKVj5s9dPu78nq+64UkHwBIhbs95ssu+P1HymyzGtCxaWkVsKkMQRzs
 vK0uoTqfdBgttF7e4mQZEn9KA0VyWIwoGmNlCyABKfuRfvqK/SxX1NFYfl8Zhn++
 b7ifrjuzLG+c0kf4VBWeauIjga+m7NBEqGgCfqulZp9CnWrmiA/8RsevUZLUAhFf
 nGkhBX3IlrZFfsD/gzyh1NWtLlLkmFaZe65pR3cJSJi3+Dl+1pqa0R6fNZAH0WKZ
 B7+VlLPyi3NtHACXWEV5Oqv8qh2G28Yz/54afMzYI7hetUsApVUKbler49qNZEaG
 BbV+G77l7fY=
 =irvd
 -----END PGP SIGNATURE-----

Merge tag 'erofs-for-6.19-rc5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs

Pull erofs fix from Gao Xiang:

 - Don't increase s_stack_depth which caused regressions in some
   composefs mount setups (EROFS + ovl^2)

   Instead just allow one extra unaccounted fs stacking level for
   straightforward cases.

* tag 'erofs-for-6.19-rc5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs:
  erofs: don't bother with s_stack_depth increasing for now
2026-01-09 19:34:50 -10:00
Gao Xiang
072a7c7cdb erofs: don't bother with s_stack_depth increasing for now
Previously, commit d53cd891f0e4 ("erofs: limit the level of fs stacking
for file-backed mounts") bumped `s_stack_depth` by one to avoid kernel
stack overflow when stacking an unlimited number of EROFS on top of
each other.

This fix breaks composefs mounts, which need EROFS+ovl^2 sometimes
(and such setups are already used in production for quite a long time).

One way to fix this regression is to bump FILESYSTEM_MAX_STACK_DEPTH
from 2 to 3, but proving that this is safe in general is a high bar.

After a long discussion on GitHub issues [1] about possible solutions,
one conclusion is that there is no need to support nesting file-backed
EROFS mounts on stacked filesystems, because there is always the option
to use loopback devices as a fallback.

As a quick fix for the composefs regression for this cycle, instead of
bumping `s_stack_depth` for file backed EROFS mounts, we disallow
nesting file-backed EROFS over EROFS and over filesystems with
`s_stack_depth` > 0.

This works for all known file-backed mount use cases (composefs,
containerd, and Android APEX for some Android vendors), and the fix is
self-contained.

Essentially, we are allowing one extra unaccounted fs stacking level of
EROFS below stacking filesystems, but EROFS can only be used in the read
path (i.e. overlayfs lower layers), which typically has much lower stack
usage than the write path.

We can consider increasing FILESYSTEM_MAX_STACK_DEPTH later, after more
stack usage analysis or using alternative approaches, such as splitting
the `s_stack_depth` limitation according to different combinations of
stacking.

Fixes: d53cd891f0e4 ("erofs: limit the level of fs stacking for file-backed mounts")
Reported-and-tested-by: Dusty Mabe <dusty@dustymabe.com>
Reported-by: Timothée Ravier <tim@siosm.fr>
Closes: https://github.com/coreos/fedora-coreos-tracker/issues/2087 [1]
Reported-by: "Alekséi Naidénov" <an@digitaltide.io>
Closes: https://lore.kernel.org/r/CAFHtUiYv4+=+JP_-JjARWjo6OwcvBj1wtYN=z0QXwCpec9sXtg@mail.gmail.com
Acked-by: Amir Goldstein <amir73il@gmail.com>
Acked-by: Alexander Larsson <alexl@redhat.com>
Reviewed-and-tested-by: Sheng Yong <shengyong1@xiaomi.com>
Reviewed-by: Zhiguo Niu <zhiguo.niu@unisoc.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
2026-01-10 13:01:15 +08:00
Linus Torvalds
cb2076b091 block-6.19-20260109
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmlhS3UQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgpqN1EACZI7gCMHL+CI5utvaQVPoZbyDf3jED73KO
 NwDyLKl/frGW2njbM/hcSSH0SITGYnrN0+KGr9JFIIu/AMnl+0prl74DrPjUsQ3x
 b9FwHYcjgQxPEIR39KxqSGAJTrxNxGFyS0OaTg91OMKg8Ze57WlkDRtRIJBpsTB4
 I2OUrMC34fVvjSTzefErB/eNsY3xAO8aFpWbBGD2h/GpH0f3SgGTAu7JH6Hj1Zfw
 kFWyMMSc/JkGB7wSOLxDB2IepS7PkLwlRaU6rHV3xzI1DXs24oUT8E20VU8JMedf
 WLQpzNSfqKws6KQa9LIywMo/bwA4dh3FogUJ6MflJKZoGCiMQnps4f18L6EI+w9L
 NpDCWkNgNwd6siDbTBZebd8YlqkWJYJ7NPwTl9dBdczX4DWsfej0exC2UPgN3B7R
 MQNKuP/+oC7y92igMAXIgFRQIwriVNFCsW/Q3oZSDTJSmaDc7CvONNaLnRom0sen
 1uPt/8w7bz8PkUlVUt6SFl0+KaCXX3mFUnEDiY7+du7nSUeyo1BEL6tm46q7gybC
 lRjyDWp5mz/a/JL3tmiOtavVbnyZ1iy03Nd5HfULUhsARJAQKbE+hAvBEhZGq2F2
 A4FKJgzRd7u5dBcaGLNf8H6UVml600ZX9GPkjH35tVXkqB6z87mQTfJmT6ViLKLU
 vM8AfGWbLQ==
 =DaMl
 -----END PGP SIGNATURE-----

Merge tag 'block-6.19-20260109' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

Pull block fixes from Jens Axboe:

 - Kill unlikely checks for blk-rq-qos. These checks are really
   all-or-nothing, either the branch is taken all the time, or it's not.
   Depending on the configuration, either one of those cases may be
   true. Just remove the annotation

 - Fix for merging bios with different app tags set

 - Fix for a recently introduced slowdown due to RCU synchronization

 - Fix for a status change on loop while it's in use, and then a later
   fix for that fix

 - Fix for the async partition scanning in ublk

* tag 'block-6.19-20260109' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  ublk: fix use-after-free in ublk_partition_scan_work
  blk-mq: avoid stall during boot due to synchronize_rcu_expedited
  loop: add missing bd_abort_claiming in loop_set_status
  block: don't merge bios with different app_tags
  blk-rq-qos: Remove unlikely() hints from QoS checks
  loop: don't change loop device under exclusive opener in loop_set_status
2026-01-09 15:42:46 -10:00
Linus Torvalds
68ad2095ca io_uring-6.19-20260109
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmlhS1wQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgphGvD/9NR0RzWZdM0DwfbK4kyzfmQPCSs1kkqQF4
 LECsSc3B7OrJ/4yX27CiWNRlGdHWpmrOc8mtlAiUv+eArpoBmatjfn1UZACN0u/t
 CC0/ZXeYA6NQ8vnbnQZk+guHE7r9K66EFPFvMcEWmGGQ/CUBUKt1gkDkB1gD8qBp
 pdI/A+tZujCQA3XuyCE+qc5GJX+cFXqEx06GRDGQ+UnnAsJmSrtbUtZrEZsladMj
 16dclDfOX2X0bu9+P42rSkV2IrjwddNntDsLyF933uaayAJX9HbTTWxxw/mWr2Bt
 Be0Xh1+FniVAQFFM7qFQRqrWqecKrnh6RKg9lufWiuB4d5rq7eJT1xGb+IXX6xlr
 j/Lwbi8UkjpJmG1xnyWtk9oDQK4h+7p5MvCgCSqLrp1rY8nYT1CeCEzt1OJjeVWj
 cqm2hhkEUcioCz4gTHU8PBRxhfd4PRr/GBwZJ4jBFBeFTip1vy9kAn94Afrk/VLH
 HAreWZtsNsTDTF9cUSXyKDHYR9uGSi8NpZSEEV8dUaAKYpYBNSIutX5uqT9NBs8y
 3TJ0NrhlpVJIGwa5XtwKli62CXNsibQlNbnsd092+zvkiAAiYUiLNRaQnt3MGctk
 4eBp0sWTUkHxxKO3njUIDXZPB5g9jZvJxpjqK+V0CYzVdeimw2qs8fBQJvnYPtNw
 k3C0E2aJKQ==
 =ObKS
 -----END PGP SIGNATURE-----

Merge tag 'io_uring-6.19-20260109' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

Pull io_uring fixes from Jens Axboe:
 "A single fix for a regression introduced in 6.15, where a failure to
  wake up idle io-wq workers at ring exit will wait for the timeout to
  expire.

  This isn't normally noticeable, as the exit is async.

  But if a parent task created a thread that sets up a ring and uses
  requests that cause io-wq threads to be created, and the parent task
  then waits for the thread to exit, then it can take 5 seconds for that
  pthread_join() to succeed as the child thread is waiting for its
  children to exit.

  On top of that, just a basic cleanup as well"

* tag 'io_uring-6.19-20260109' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  io_uring/io-wq: remove io_wq_for_each_worker() return value
  io_uring/io-wq: fix incorrect io_wq_for_each_worker() termination logic
2026-01-09 15:21:15 -10:00
Linus Torvalds
e28ddd0b7a arm64 fixes:
- Do not return false if !preemptible() in current_in_efi(). EFI
    runtime services can now run with preemption enabled
 
  - Fix uninitialised variable in the arm MPAM driver, reported by sparse
 
  - Fix partial kasan_reset_tag() use in change_memory_common() when
    calculating page indices or comparing ranges
 
  - Save/restore TCR2_EL1 during suspend/resume, otherwise the E0POE bit
    is lost
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE5RElWfyWxS+3PLO2a9axLQDIXvEFAmlhSCwACgkQa9axLQDI
 XvFj5w/+MUtRj+UL2p2Z2BsQvU6eheiKvvoVYr6kRURlYE1YahXh1lmp8S7t2St5
 VYi41VUyT+udAmzIyQvM9GHB1co4d0BPOJcrmU+lKNM5uz/obQ6+Gf8RrHBh6XDM
 ZuoEaWB1cRlLQF3NNUNO8IHHW2PwU88jxriZSbq0jnsqFudu1n70XxSH6FH+ilb7
 MSkjP1NwaqiA+lTLAL6vCWL0XFA+qgXKMKfUPgW2QwVOM0irPAvmAciXHSwUJe69
 W3Fj5UApJVAlwCNkXh6phzwqzorCMshXebVi/Kjxoo8XA/FJ6ezIzjLIsfxTzkgp
 GrBW2sAH0xb5BQDsDsihcikKUZBF9Rpf7HtsVaaGcV5yJabo4Yz/cIyKzs9KLfI0
 INl9Scno21FK2wqH1dZn+hbLUoRewbtw5+j3HK99Y9b0vNGccHU1g0uS6Kf8Bda3
 if8adLIozRz3tcNQn9EWFAlkUYHH8XOKS0kaKTt1VVZWhRRBBTnnFqlDYxQ7Q3WH
 t1S1a568UYi6Op0kAHNm5Gl2w0xF3oMQMHnI/hNn94q63m6S/rpvjyoT4Cmg0f0F
 xW1Olxlqeve/4Siv5pBrl9SdwQT/0yZsCEqHi1NffDGooQOosXiWYR1xx+PsFRqf
 qNvBsREqWkCg/KygtFeDSajrDjOKiN+vsleMR/absogBzvHF8vc=
 =GVR8
 -----END PGP SIGNATURE-----

Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux

Pull arm64 fixes from Catalin Marinas:

 - Do not return false if !preemptible() in current_in_efi(). EFI
   runtime services can now run with preemption enabled

 - Fix uninitialised variable in the arm MPAM driver, reported by sparse

 - Fix partial kasan_reset_tag() use in change_memory_common() when
   calculating page indices or comparing ranges

 - Save/restore TCR2_EL1 during suspend/resume, otherwise the E0POE bit
   is lost

* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
  arm64: Fix cleared E0POE bit after cpu_suspend()/resume()
  arm64: mm: Fix incomplete tag reset in change_memory_common()
  arm_mpam: Stop using uninitialized variables in __ris_msmon_read()
  arm64/efi: Don't fail check current_in_efi() if preemptible
2026-01-09 15:17:48 -10:00
Linus Torvalds
e55feea3a0 soc: fixes for 6.19
The main code change is a revert of the Raspberry Pi RP1 overlay
 support that was decided to not be ready.
 
 The other fixes are all for devicetree sources:
 
  - ethernet configuration on ixp42x-actiontec-mi424wr is
    board revision specific
 
  - validation warning fixes for imx27/imx51/imx6, hikey960 and k3
 
  - Minor corrections across imx8 boards, addressing all types of
    issues with interrups, dma, ethernet and clock settings, all
    simple one-line changes.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmlhOYAACgkQmmx57+YA
 GNlViQ/8CrVllBec/x8Mp7hqTTvRxYSkxnbkPcgqgOLgMyNwg0gZZeA06+EAEJK/
 Pqx/Ht86w61A9yZo2OH/p5w6GjmT17J7a0DHYSKjCuW0Dc52ZB+Xqpng2bI92YmL
 MjdG4XZ0wJDHCJ2Vt8fHPb06szZAzRyTrDQ4iK1r2/vbOep+4lvXzcS70uKlWYHY
 ipIknMork833I5lV434WRhXIg7P/wDfv6U/lXH969pngf2fbxUQipwzHxWZ5OjeE
 s1E8ESdJ7QyBhNeMJXIgeNc0jcHV/8jmyxz7D7rkcULpPeo+dNI/l65n6G9j91V/
 vt7SarnQbkoWj5Z3skwb7coMJ4P8iVBruqxT9z5yotTDgy8rR4vivwuPqiB0Kahm
 gWc00OfdyX9LxBGSdiwq1Ms+tHv2gMrfVkxzI7ppQzRlG+tokD5ZBElM6+cUdMIL
 vUoEolm42GIG8FX/QwFLCBqjrZ0b2pI41Bh8UIEBNV4w8qvcJ9BrOGBWKGI4R1uq
 vdYSS+jvqdOEsW9q9iWz2EdCSjLHoIf43ljWdYzDt3T9xw+g92b7/8h7drJwf17w
 O4nA3G7WFn57lP3YlLmZ/xeR59Zg5i/fC0Za4j5kyu96karn4ySTinxJfOPcqKMb
 mhYxs1N0cdp1r/wsXDEAxOCOQS0Yij0oQc16BfDamrsNq13BdjY=
 =2kPF
 -----END PGP SIGNATURE-----

Merge tag 'soc-fixes-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc

Pull SoC fixes from Arnd Bergmann:
 "The main code change is a revert of the Raspberry Pi RP1 overlay
  support that was decided to not be ready.

  The other fixes are all for devicetree sources:

   - ethernet configuration on ixp42x-actiontec-mi424wr is board
     revision specific

   - validation warning fixes for imx27/imx51/imx6, hikey960 and k3

   - Minor corrections across imx8 boards, addressing all types of
     issues with interrups, dma, ethernet and clock settings, all simple
     one-line changes"

* tag 'soc-fixes-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (25 commits)
  arm64: dts: hisilicon: hikey960: Drop "snps,gctl-reset-quirk" and "snps,tx_de_emphasis*" properties
  Documentation/process: maintainer-soc: Mark 'make' as commands
  Documentation/process: maintainer-soc: Be more explicit about defconfig
  arm64: dts: mba8mx: Fix Ethernet PHY IRQ support
  arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart
  arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM
  arm64: dts: freescale: tx8p-ml81: fix eqos nvmem-cells
  arm64: dts: freescale: moduline-display: fix compatible
  dt-bindings: arm: fsl: moduline-display: fix compatible
  ARM: dts: imx6q-ba16: fix RTC interrupt level
  arm64: dts: freescale: imx95-toradex-smarc: fix SMARC_SDIO_WP label position
  arm64: dts: freescale: imx95-toradex-smarc: use edge trigger for ethphy1 interrupt
  arm64: dts: add off-on-delay-us for usdhc2 regulator
  arm64: dts: imx8qm-mek: correct the light sensor interrupt type to low level
  ARM: dts: nxp: imx: Fix mc13xxx LED node names
  arm64: dts: imx95: correct I3C2 pclk to IMX95_CLK_BUSWAKEUP
  MAINTAINERS: Fix a linusw mail address
  arm64: dts: broadcom: rp1: drop RP1 overlay
  arm64: dts: broadcom: bcm2712: fix RP1 endpoint PCI topology
  misc: rp1: drop overlay support
  ...
2026-01-09 15:11:45 -10:00
Linus Torvalds
4621c338d3 A bunch of libceph fixes split evenly between memory safety and
implementation correctness issues (all marked for stable) and a change
 in maintainers for CephFS: Slava and Alex have formally taken over
 Xiubo's role.
 -----BEGIN PGP SIGNATURE-----
 
 iQFHBAABCAAxFiEEydHwtzie9C7TfviiSn/eOAIR84sFAmlhPnYTHGlkcnlvbW92
 QGdtYWlsLmNvbQAKCRBKf944AhHzi+xRB/4wW8+zp9w+AzK023uL93A9iU4yPM+/
 XYRSIhnR0VWdGTwQsSiQmuwT9RVW5ElH1o0Zzt9BBM9XW8BTIyDnCcdd4yYT+fRc
 ZCG5JUXF0rRgSXYWTpHfEUg5H0wAFCruhhv51vfAuxe5+AFh+7J2/Ct2SraIMt7r
 brShR7vqxUgaBp4TINdsEZBSNBhEIUkPbulZxDDq4+uFN5Cl1ZgESm4QOdxqZFJ8
 lkvPRRjh7rpSIUfULSyH6UVvS/FsSjXrL1rhszlGbgwc297ox+UTk+dOfko8gdmL
 /l92y6Si5CdCxEwLGHvW4lW7qWj9ba9g8v9DCy1BL6dE+CbY1HSjgtJB
 =bROV
 -----END PGP SIGNATURE-----

Merge tag 'ceph-for-6.19-rc5' of https://github.com/ceph/ceph-client

Pull ceph fixes from Ilya Dryomov:
 "A bunch of libceph fixes split evenly between memory safety and
  implementation correctness issues (all marked for stable) and a change
  in maintainers for CephFS: Slava and Alex have formally taken over
  Xiubo's role"

* tag 'ceph-for-6.19-rc5' of https://github.com/ceph/ceph-client:
  libceph: make calc_target() set t->paused, not just clear it
  libceph: reset sparse-read state in osd_fault()
  libceph: return the handler error from mon_handle_auth_done()
  libceph: make free_choose_arg_map() resilient to partial allocation
  ceph: update co-maintainers list in MAINTAINERS
  libceph: replace overzealous BUG_ON in osdmap_apply_incremental()
  libceph: prevent potential out-of-bounds reads in handle_auth_done()
2026-01-09 15:05:19 -10:00
Ming Lei
f0d385f668 ublk: fix use-after-free in ublk_partition_scan_work
A race condition exists between the async partition scan work and device
teardown that can lead to a use-after-free of ub->ub_disk:

1. ublk_ctrl_start_dev() schedules partition_scan_work after add_disk()
2. ublk_stop_dev() calls ublk_stop_dev_unlocked() which does:
   - del_gendisk(ub->ub_disk)
   - ublk_detach_disk() sets ub->ub_disk = NULL
   - put_disk() which may free the disk
3. The worker ublk_partition_scan_work() then dereferences ub->ub_disk
   leading to UAF

Fix this by using ublk_get_disk()/ublk_put_disk() in the worker to hold
a reference to the disk during the partition scan. The spinlock in
ublk_get_disk() synchronizes with ublk_detach_disk() ensuring the worker
either gets a valid reference or sees NULL and exits early.

Also change flush_work() to cancel_work_sync() to avoid running the
partition scan work unnecessarily when the disk is already detached.

Fixes: 7fc4da6a304b ("ublk: scan partition in async way")
Reported-by: Ruikai Peng <ruikai@pwno.io>
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-01-09 06:55:30 -07:00
Yeoreum Yun
bdf3f41760 arm64: Fix cleared E0POE bit after cpu_suspend()/resume()
TCR2_ELx.E0POE is set during smp_init().
However, this bit is not reprogrammed when the CPU enters suspension and
later resumes via cpu_resume(), as __cpu_setup() does not re-enable E0POE
and there is no save/restore logic for the TCR2_ELx system register.

As a result, the E0POE feature no longer works after cpu_resume().

To address this, save and restore TCR2_EL1 in the cpu_suspend()/cpu_resume()
path, rather than adding related logic to __cpu_setup(), taking into account
possible future extensions of the TCR2_ELx feature.

Fixes: bf83dae90fbc ("arm64: enable the Permission Overlay Extension for EL0")
Cc: <stable@vger.kernel.org> # 6.12.x
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
Reviewed-by: Kevin Brodsky <kevin.brodsky@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2026-01-09 10:41:45 +00:00
Jiayuan Chen
5fcd551307 arm64: mm: Fix incomplete tag reset in change_memory_common()
Running KASAN KUnit tests with {HW,SW}_TAGS mode triggers a fault in
change_memory_common():

  Call trace:
   change_memory_common+0x168/0x210 (P)
   set_memory_ro+0x20/0x48
   vmalloc_helpers_tags+0xe8/0x338
   kunit_try_run_case+0x74/0x188
   kunit_generic_run_threadfn_adapter+0x30/0x70
   kthread+0x11c/0x200
   ret_from_fork+0x10/0x20
  ---[ end trace 0000000000000000 ]---
      # vmalloc_helpers_tags: try faulted
      not ok 67 vmalloc_helpers_tags

Commit a06494adb7ef ("arm64: mm: use untagged address to calculate page index")
fixed a KASAN warning in the BPF subsystem by adding kasan_reset_tag() to
the index calculation. In the execmem flow:

    bpf_prog_pack_alloc()
      -> bpf_jit_alloc_exec()
        -> execmem_alloc()

The returned address from execmem_vmalloc/execmem_cache_alloc is passed
through kasan_reset_tag(), so start has no tag while area->addr still
retains the original tag. The fix correctly handled this case by resetting
the tag on area->addr:

    (start - (unsigned long)kasan_reset_tag(area->addr)) >> PAGE_SHIFT

However, in normal vmalloc paths, both start and area->addr have matching
tags(or no tags). Resetting only area->addr causes a mismatch when
subtracting a tagged address from an untagged one, resulting in an
incorrect index.

Fix this by resetting tags on both addresses in the index calculation.
This ensures correct results regardless of the tag state of either address.

Tested with KASAN KUnit tests under CONFIG_KASAN_GENERIC,
CONFIG_KASAN_SW_TAGS, and CONFIG_KASAN_HW_TAGS - all pass. Also verified
the original BPF KASAN warning from [1] is still fixed.

[1] https://lore.kernel.org/all/20251118164115.GA3977565@ax162/

Fixes: a06494adb7ef ("arm64: mm: use untagged address to calculate page index")
Signed-off-by: Jiayuan Chen <jiayuan.chen@shopee.com>
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2026-01-08 19:47:59 +00:00
Ben Horgan
c2803bd580 arm_mpam: Stop using uninitialized variables in __ris_msmon_read()
Dan has reported two uses of uninitialized variables in __ris_msmon_read().
If an unknown monitor type is encountered then the local variable, now, is
used uninitialized. Fix this by returning early on error. If a non-mbwu
monitor is being read then the local variable, overflow, is not initialized
but still read. Initialize it to false as overflow is not relevant for csu
monitors.

Fixes: 823e7c3712c5 ("arm_mpam: Add mpam_msmon_read() to read monitor value")
Fixes: 9e5afb7c3283 ("arm_mpam: Use long MBWU counters if supported")
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/r/202512091519.RBwiJcSq-lkp@intel.com/
Closes: https://lore.kernel.org/r/202512100547.N7QPYgfb-lkp@intel.com/
Signed-off-by: Ben Horgan <ben.horgan@arm.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2026-01-08 19:03:15 +00:00
Rob Herring (Arm)
bf104037eb
arm64: dts: hisilicon: hikey960: Drop "snps,gctl-reset-quirk" and "snps,tx_de_emphasis*" properties
"snps,tx_de_emphasis" is supposed to be a u8, not a u32. Since it is big
endian, 0 will be read rather than 1. The DWC3 Linux driver simply ORs
the value if "snps,tx_de_emphasis_quirk" is set, so the 2 properties
have no effect. (The driver doesn't clear the field either which is
another problem).

"snps,gctl-reset-quirk" is not documented nor used in the driver, so
drop it as well.

Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Link: https://lore.kernel.org/r/20260105174002.2997615-1-robh@kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-01-07 17:55:19 +01:00
Arnd Bergmann
c221cc877b i.MX fixes for 6.19:
- A mba8mx fix from Alexander Stein to correct Ethernet PHY IRQ trigger
   type
 - An i.MX95 fix from Carlos Song to correct I3C2 pclk
 - A couple of imx8qm-mek changes from Haibo Chen to fix light sensor
   interrupt type and usdhc2 regulator configuration
 - An imx6q-ba16 change from Ian Ray to fix RTC interrupt level
 - An imx8mp-dhcom-som change from Marek Vasut to fix sporadic Ethernet
   link bouncing caused by interruptions on the PHY reference clock
 - A couple of imx8mp-tx8p changes from Maud Spierings to fix compatible
   and eqos nvmem-cells
 - An ARM i.MX fix from Rob Herring to correct mc13xxx LED node names
 - An imx8qm-ss-dma change from Sherry Sun to correct DMA channels for
   LPUART
 - A couple of imx95-toradex-smarc changes from Vitor Soares to fix
   ethphy1 interrupt and SMARC_SDIO_WP label position
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEFmJXigPl4LoGSz08UFdYWoewfM4FAmlUl0EACgkQUFdYWoew
 fM4rVAf8CoKCxw3wY6WWGnykrwxb7QNIr1CIfUCJC+6PtSxEsuuwMWmrhsEpvs36
 Idh5YXGl89hC/6DYr9NLy6GHKX+pp8TX5ah/bY4gIkRZ9gc3+TuU7qUv/iFkk9Q7
 DgpMvE7TUKrLrUvkX4nN5rcLFOODkz3+KrJLLi7D3GOBQA3PEQ31dXBlTRygO/WP
 AvaBkbmcCUMM8jpr0b4jcloSwMGunCzI/bpdGrBaFw4peOBCPzhYvAjtE+4FRBX+
 QaO11t7VYFSZ1Asqc944vjpNWaqLMzABjaLvOSAsERm5M8vfjkHD4cLJX7yYeCAa
 Can4xx7yVHmCzPryWH6Asnpx9BttQg==
 =im41
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmlejoMACgkQmmx57+YA
 GNm7rBAAvrbS1D81cjkuU9atoRodFtfW3MvspJRWO2VrgA2uNH9TkmYucgApyGPc
 RJyHoR0rwUIFZfBBX0A3D7CvdIu4KKLBR9Gbx7/0OshTHto7knBxW4nNEh2GUiF2
 2hXQ4dMqtCD+JmD4l4LlAAnvmZ7MYYi/s3+1t34FrTOv5GmItNv7+Vtcx6NpVkiV
 J4ihr7q8L6IB/H3XaVogDnBxqTAwbgNMuXKcPypI2NyCQoJaf8SDEZXh+sesIl+H
 CKIWjhNxs5Tei0lM277xX0C7Oz6FUUUbaKegRT7iPiljpoG6717xqyDVfIcqP7fE
 m7teGkao2faLrSN97sGzcdb6x5Q0s+PMK/a6CeZd6nerEAkfEmeg8CfL7ys75k3O
 yYXr96u4OLWk3laW5xug6ZouJXyobINzy5/FVzKayDb+vXu9iHYuA/olm1L3xGS9
 QWRvK32OCuZ8cBdSZtHfDjFXW6rgIpzhIU8H4vn0ACKNE4gjLqk9RvNW0+gb1JpE
 aH5qgTVsqQDjA9UUcjwbXirBIDBJJcbm8UMu1a1QzRbn7Dcd0hekfp9Ueb8lMww5
 BW2qRj+QXXB06qMM6GTsam2fL1GSwkUEWsl2DoLEfU3OrRiVUxzw02maOBvGJXoO
 INK+TRgFKhvVC2uI0PvNVqf52lieby5blWFH6W+gMJI2Kkn/+oo=
 =BjZ2
 -----END PGP SIGNATURE-----

Merge tag 'imx-fixes-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into arm/fixes

i.MX fixes for 6.19:

- A mba8mx fix from Alexander Stein to correct Ethernet PHY IRQ trigger
  type
- An i.MX95 fix from Carlos Song to correct I3C2 pclk
- A couple of imx8qm-mek changes from Haibo Chen to fix light sensor
  interrupt type and usdhc2 regulator configuration
- An imx6q-ba16 change from Ian Ray to fix RTC interrupt level
- An imx8mp-dhcom-som change from Marek Vasut to fix sporadic Ethernet
  link bouncing caused by interruptions on the PHY reference clock
- A couple of imx8mp-tx8p changes from Maud Spierings to fix compatible
  and eqos nvmem-cells
- An ARM i.MX fix from Rob Herring to correct mc13xxx LED node names
- An imx8qm-ss-dma change from Sherry Sun to correct DMA channels for
  LPUART
- A couple of imx95-toradex-smarc changes from Vitor Soares to fix
  ethphy1 interrupt and SMARC_SDIO_WP label position

* tag 'imx-fixes-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux:
  arm64: dts: mba8mx: Fix Ethernet PHY IRQ support
  arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart
  arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM
  arm64: dts: freescale: tx8p-ml81: fix eqos nvmem-cells
  arm64: dts: freescale: moduline-display: fix compatible
  dt-bindings: arm: fsl: moduline-display: fix compatible
  ARM: dts: imx6q-ba16: fix RTC interrupt level
  arm64: dts: freescale: imx95-toradex-smarc: fix SMARC_SDIO_WP label position
  arm64: dts: freescale: imx95-toradex-smarc: use edge trigger for ethphy1 interrupt
  arm64: dts: add off-on-delay-us for usdhc2 regulator
  arm64: dts: imx8qm-mek: correct the light sensor interrupt type to low level
  ARM: dts: nxp: imx: Fix mc13xxx LED node names
  arm64: dts: imx95: correct I3C2 pclk to IMX95_CLK_BUSWAKEUP

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-01-07 17:49:00 +01:00
Krzysztof Kozlowski
51183d3ff5
Documentation/process: maintainer-soc: Mark 'make' as commands
Improve readability of the docs by marking 'make dtbs/dtbs_check' as
shell commands.

Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Link: https://lore.kernel.org/r/20251223142726.73417-4-krzysztof.kozlowski@oss.qualcomm.com
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-01-07 17:47:43 +01:00
Krzysztof Kozlowski
6efe5322f0
Documentation/process: maintainer-soc: Be more explicit about defconfig
It is already documented but people still send noticeable amount of
patches ignoring the rule - get_maintainers.pl does not work on
arm64/configs/defconfig or any other shared ARM defconfig.

Be more explicit, that one must not rely on typical/simple approach
here for getting To/Cc list.

Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Link: https://lore.kernel.org/r/20251223142726.73417-3-krzysztof.kozlowski@oss.qualcomm.com
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-01-07 17:47:43 +01:00
Arnd Bergmann
902300d332 This pull request contains Broadcom ARM64-SoC Device Tree fixes for
6.19, please pull the following:
 
 - Andrea fixes the RP1 DeviceTree hierarchy and drop overlay support,
   this resolves a number of DTC warnings and other issues
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEm+Rq3+YGJdiR9yuFh9CWnEQHBwQFAmlFuWQACgkQh9CWnEQH
 BwSl9g/9EXHS5ElbrZMTzolABdvD85T6Ab0I8W0rxwagb0YDRog8o9GMplRk7V69
 ggNB9j0K/IvK/ucFjdLZbhUXztDfbrWHvb5kBMo+04J+LMu2XkAJu0t2qFL3eQHa
 FEjzmjTHoa+fGTRmIWGKgk2yBk2GnUJxit/xAeEvCxzLh9r6YDnDBQUhTtkg3ebY
 kXI4l6tUlhmpoAgBpN9gcoUfhLYO7pi2Kbsg87aKXdsiuuhszmgzKyB+RvFH2/vK
 ShmtFr/DZ0zyYmM8TrcQW3LJLbNXeZDnYuomOO+tpQvjErCza5XAPl+ogsZwQ8Bw
 Z7nca8L+9ozcxlohfWBRB/9saO5tteksH2vvcjBeZalRhCABWtzxV1YTTvSWbpHP
 poWhJjthykkUhZ+vENvQRSzv8Hku2tegO18SHPBeqgImfHo6Xghzy8+bQVxy1Jcz
 6Uvtzmj/z8yyz4N0aaY2NNz3DplOM7SpuU7tEFf/e9ZZFChCzyjMOX1YCSV8sOJ1
 ccp8o6ryWhQguSlqS2oMkE/aNwmPQTphxPXA0bOSR6lN4WUdePgwguEbi2T+6N/d
 B2MDtFm7VT/QXJFJZRmpgZC1pq43dyoHAP4shsG4Qek6sz/8lUHvb9pt8e2HICX0
 cY1taqpZrdEKTFa51Vfyl0aMEXPHoH/2+7SI3cdOlEd0+ODMRpY=
 =JCKi
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmlejZ8ACgkQmmx57+YA
 GNl+MhAArb5i/a89Se6g4ORJR9v+6mj+XgYc7lMpulU/XZafz1gNS8PqHkquG62R
 5ZYSi99E44Ibk2HvFv4SD62f8XnuUCmHgmo7dmldjpDn36FMmyTuNOoV/Iil9PzM
 kcrHx/SGIcSDdXns54r2UbWhgkq0WD5UCfrDgVYH2IPY+shzoGeSr5DUAb2Z4Z4y
 ROrnPNaxp0Z5azf44lIHW5zTl6ea6MF8s26zxchkxm8ZhoB5OEejdLKX6lQA124z
 xmFlv1xtcD7tArxT9M+4gQ1OjrWuGQw20nJDOZhaPFb47YAdOiMkEMycqYSPg7yl
 zOxGiq6OjvoAO3WKJ7kaRCg4do9YQK1GtWOYFzoMR9M+GMqxjYBlWFdm2vJsFC8/
 tRM5X+DTTiKK+4sbAolBY1tJe2iOt84mv4n91sgZ1LCywNwUndyFU6h2YmayGvRJ
 1JBeA5pv1y+qMviDzsxX3llVdNjQuL62CakFRxdNyLw2JTqGrrphEIiCFzkLqX9G
 3IWrALY40L2p4OcUP9VIRPVNe96mBuJOnILMxiB5mA0tTVrZIi9MlvZ1egL+qo2U
 PHR2TPuYMhTUogwOCEF7G+YtCgGSVAb72L3AYKGrOSgLleT/CUd79HfsLfv3Gs1j
 MTonYjRoIgSX1eFR6XHwO3+ZSeoXwvrCh98pIV/IWqMmk2nHiUA=
 =IlUv
 -----END PGP SIGNATURE-----

Merge tag 'arm-soc/for-6.19/devicetree-arm64-fixes' of https://github.com/Broadcom/stblinux into arm/fixes

This pull request contains Broadcom ARM64-SoC Device Tree fixes for
6.19, please pull the following:

- Andrea fixes the RP1 DeviceTree hierarchy and drop overlay support,
  this resolves a number of DTC warnings and other issues

* tag 'arm-soc/for-6.19/devicetree-arm64-fixes' of https://github.com/Broadcom/stblinux:
  arm64: dts: broadcom: rp1: drop RP1 overlay
  arm64: dts: broadcom: bcm2712: fix RP1 endpoint PCI topology
  misc: rp1: drop overlay support
  dt-bindings: misc: pci1de4,1: add required reg property for endpoint

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-01-07 17:45:13 +01:00
Mikulas Patocka
9670db22e7 blk-mq: avoid stall during boot due to synchronize_rcu_expedited
On the kernel 6.19-rc, I am experiencing 15-second boot stall in a
virtual machine when probing a virtio-scsi disk:
[    1.011641] SCSI subsystem initialized
[    1.013972] virtio_scsi virtio6: 16/0/0 default/read/poll queues
[    1.015983] scsi host0: Virtio SCSI HBA
[    1.019578] ACPI: \_SB_.GSIA: Enabled at IRQ 16
[    1.020225] ahci 0000:00:1f.2: AHCI vers 0001.0000, 32 command slots, 1.5 Gbps, SATA mode
[    1.020228] ahci 0000:00:1f.2: 6/6 ports implemented (port mask 0x3f)
[    1.020230] ahci 0000:00:1f.2: flags: 64bit ncq only
[    1.024688] scsi host1: ahci
[    1.025432] scsi host2: ahci
[    1.025966] scsi host3: ahci
[    1.026511] scsi host4: ahci
[    1.028371] scsi host5: ahci
[    1.028918] scsi host6: ahci
[    1.029266] ata1: SATA max UDMA/133 abar m4096@0xfea23000 port 0xfea23100 irq 16 lpm-pol 1
[    1.029305] ata2: SATA max UDMA/133 abar m4096@0xfea23000 port 0xfea23180 irq 16 lpm-pol 1
[    1.029316] ata3: SATA max UDMA/133 abar m4096@0xfea23000 port 0xfea23200 irq 16 lpm-pol 1
[    1.029327] ata4: SATA max UDMA/133 abar m4096@0xfea23000 port 0xfea23280 irq 16 lpm-pol 1
[    1.029341] ata5: SATA max UDMA/133 abar m4096@0xfea23000 port 0xfea23300 irq 16 lpm-pol 1
[    1.029356] ata6: SATA max UDMA/133 abar m4096@0xfea23000 port 0xfea23380 irq 16 lpm-pol 1
[    1.118111] scsi 0:0:0:0: Direct-Access     QEMU     QEMU HARDDISK 2.5+ PQ: 0 ANSI: 5
[    1.348916] ata1: SATA link down (SStatus 0 SControl 300)
[    1.350713] ata2: SATA link down (SStatus 0 SControl 300)
[    1.351025] ata6: SATA link down (SStatus 0 SControl 300)
[    1.351160] ata5: SATA link down (SStatus 0 SControl 300)
[    1.351326] ata3: SATA link down (SStatus 0 SControl 300)
[    1.351536] ata4: SATA link down (SStatus 0 SControl 300)
[    1.449153] input: ImExPS/2 Generic Explorer Mouse as /devices/platform/i8042/serio1/input/input2
[   16.483477] sd 0:0:0:0: Power-on or device reset occurred
[   16.483691] sd 0:0:0:0: [sda] 2097152 512-byte logical blocks: (1.07 GB/1.00 GiB)
[   16.483762] sd 0:0:0:0: [sda] Write Protect is off
[   16.483877] sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
[   16.569225] sd 0:0:0:0: [sda] Attached SCSI disk

I bisected it and it is caused by the commit 89e1fb7ceffd which
introduces calls to synchronize_rcu_expedited.

This commit replaces synchronize_rcu_expedited and kfree with a call to
kfree_rcu_mightsleep, avoiding the 15-second delay.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Fixes: 89e1fb7ceffd ("blk-mq: fix potential uaf for 'queue_hw_ctx'")
Reviewed-by: Uladzislau Rezki (Sony) <urezki@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-01-07 08:10:42 -07:00
Tetsuo Handa
2704024d83 loop: add missing bd_abort_claiming in loop_set_status
Commit 08e136ebd193 ("loop: don't change loop device under exclusive
opener in loop_set_status") forgot to call bd_abort_claiming() when
mutex_lock_killable() failed.

Fixes: 08e136ebd193 ("loop: don't change loop device under exclusive opener in loop_set_status")
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-01-07 08:04:42 -07:00
Caleb Sander Mateos
6acd4ac5f8 block: don't merge bios with different app_tags
nvme_set_app_tag() uses the app_tag value from the bio_integrity_payload
of the struct request's first bio. This assumes all the request's bios
have the same app_tag. However, it is possible for bios with different
app_tag values to be merged into a single request.
Add a check in blk_integrity_merge_{bio,rq}() to prevent the merging of
bios/requests with different app_tag values if BIP_CHECK_APPTAG is set.

Signed-off-by: Caleb Sander Mateos <csander@purestorage.com>
Fixes: 3d8b5a22d404 ("block: add support to pass user meta buffer")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-01-06 19:10:08 -07:00
Breno Leitao
7d121d701d blk-rq-qos: Remove unlikely() hints from QoS checks
The unlikely() annotations on QUEUE_FLAG_QOS_ENABLED checks are
counterproductive. Writeback throttling (WBT) might be enabled by
default, mainly because CONFIG_BLK_WBT_MQ defaults to 'y'.

Branch profiling on Meta servers, which have WBT enabled, confirms 100%
misprediction rates on these checks.

Remove the unlikely() annotations to let the CPU's branch predictor
learn the actual behavior, potentially improving I/O path performance.

Signed-off-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-01-06 19:08:23 -07:00
Raphael Pinsonneault-Thibeault
08e136ebd1 loop: don't change loop device under exclusive opener in loop_set_status
loop_set_status() is allowed to change the loop device while there
are other openers of the device, even exclusive ones.

In this case, it causes a KASAN: slab-out-of-bounds Read in
ext4_search_dir(), since when looking for an entry in an inlined
directory, e_value_offs is changed underneath the filesystem by
loop_set_status().

Fix the problem by forbidding loop_set_status() from modifying the loop
device while there are exclusive openers of the device. This is similar
to the fix in loop_configure() by commit 33ec3e53e7b1 ("loop: Don't
change loop device under exclusive opener") alongside commit ecbe6bc0003b
("block: use bd_prepare_to_claim directly in the loop driver").

Reported-by: syzbot+3ee481e21fd75e14c397@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=3ee481e21fd75e14c397
Tested-by: syzbot+3ee481e21fd75e14c397@syzkaller.appspotmail.com
Tested-by: Yongpeng Yang <yangyongpeng@xiaomi.com>
Signed-off-by: Raphael Pinsonneault-Thibeault <rpthibeault@gmail.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-01-06 05:30:18 -07:00
Ben Horgan
dd4d71f587 arm64/efi: Don't fail check current_in_efi() if preemptible
As EFI runtime services can now be run without disabling preemption remove
the check for non preemptible in current_in_efi(). Without this change,
firmware errors that were previously recovered from by
__efi_runtime_kernel_fixup_exception() will lead to a kernel oops.

Fixes: a5baf582f4c0 ("arm64/efi: Call EFI runtime services without disabling preemption")
Signed-off-by: Ben Horgan <ben.horgan@arm.com>
Reviewed-by: Yeoreum Yun <yeoreum.yun@arm.com>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Reviewed-by: Richard Lyu <richard.lyu@suse.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2026-01-06 11:54:31 +00:00
Ilya Dryomov
c0fe2994f9 libceph: make calc_target() set t->paused, not just clear it
Currently calc_target() clears t->paused if the request shouldn't be
paused anymore, but doesn't ever set t->paused even though it's able to
determine when the request should be paused.  Setting t->paused is left
to __submit_request() which is fine for regular requests but doesn't
work for linger requests -- since __submit_request() doesn't operate
on linger requests, there is nowhere for lreq->t.paused to be set.
One consequence of this is that watches don't get reestablished on
paused -> unpaused transitions in cases where requests have been paused
long enough for the (paused) unwatch request to time out and for the
subsequent (re)watch request to enter the paused state.  On top of the
watch not getting reestablished, rbd_reregister_watch() gets stuck with
rbd_dev->watch_mutex held:

  rbd_register_watch
    __rbd_register_watch
      ceph_osdc_watch
        linger_reg_commit_wait

It's waiting for lreq->reg_commit_wait to be completed, but for that to
happen the respective request needs to end up on need_resend_linger list
and be kicked when requests are unpaused.  There is no chance for that
if the request in question is never marked paused in the first place.

The fact that rbd_dev->watch_mutex remains taken out forever then
prevents the image from getting unmapped -- "rbd unmap" would inevitably
hang in D state on an attempt to grab the mutex.

Cc: stable@vger.kernel.org
Reported-by: Raphael Zimmer <raphael.zimmer@tu-ilmenau.de>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
2026-01-06 00:39:43 +01:00
Jens Axboe
e4fdbca2dc io_uring/io-wq: remove io_wq_for_each_worker() return value
The only use of this helper is to iterate all of the workers, and
hence all callers will pass in a func that always returns false to do
that. As none of the callers use the return value, get rid of it.

Reviewed-by: Gabriel Krisman Bertazi <krisman@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-01-05 15:39:20 -07:00
Sam Edwards
11194b416e libceph: reset sparse-read state in osd_fault()
When a fault occurs, the connection is abandoned, reestablished, and any
pending operations are retried. The OSD client tracks the progress of a
sparse-read reply using a separate state machine, largely independent of
the messenger's state.

If a connection is lost mid-payload or the sparse-read state machine
returns an error, the sparse-read state is not reset. The OSD client
will then interpret the beginning of a new reply as the continuation of
the old one. If this makes the sparse-read machinery enter a failure
state, it may never recover, producing loops like:

  libceph:  [0] got 0 extents
  libceph: data len 142248331 != extent len 0
  libceph: osd0 (1)...:6801 socket error on read
  libceph: data len 142248331 != extent len 0
  libceph: osd0 (1)...:6801 socket error on read

Therefore, reset the sparse-read state in osd_fault(), ensuring retries
start from a clean state.

Cc: stable@vger.kernel.org
Fixes: f628d7999727 ("libceph: add sparse read support to OSD client")
Signed-off-by: Sam Edwards <CFSworks@gmail.com>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
2026-01-05 22:46:43 +01:00
Ilya Dryomov
e84b48d31b libceph: return the handler error from mon_handle_auth_done()
Currently any error from ceph_auth_handle_reply_done() is propagated
via finish_auth() but isn't returned from mon_handle_auth_done().  This
results in higher layers learning that (despite the monitor considering
us to be successfully authenticated) something went wrong in the
authentication phase and reacting accordingly, but msgr2 still trying
to proceed with establishing the session in the background.  In the
case of secure mode this can trigger a WARN in setup_crypto() and later
lead to a NULL pointer dereference inside of prepare_auth_signature().

Cc: stable@vger.kernel.org
Fixes: cd1a677cad99 ("libceph, ceph: implement msgr2.1 protocol (crc and secure modes)")
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
2026-01-05 22:46:43 +01:00
Jens Axboe
e0392a10c9 io_uring/io-wq: fix incorrect io_wq_for_each_worker() termination logic
A previous commit added this helper, and had it terminate if false is
returned from the handler. However, that is completely opposite, it
should abort the loop if true is returned.

Fix this up by having io_wq_for_each_worker() keep iterating as long
as false is returned, and only abort if true is returned.

Cc: stable@vger.kernel.org
Fixes: 751eedc4b4b7 ("io_uring/io-wq: move worker lists to struct io_wq_acct")
Reported-by: Lewis Campbell <info@lewiscampbell.tech>
Reviewed-by: Gabriel Krisman Bertazi <krisman@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-01-05 14:37:33 -07:00
Tuo Li
e3fe30e576 libceph: make free_choose_arg_map() resilient to partial allocation
free_choose_arg_map() may dereference a NULL pointer if its caller fails
after a partial allocation.

For example, in decode_choose_args(), if allocation of arg_map->args
fails, execution jumps to the fail label and free_choose_arg_map() is
called. Since arg_map->size is updated to a non-zero value before memory
allocation, free_choose_arg_map() will iterate over arg_map->args and
dereference a NULL pointer.

To prevent this potential NULL pointer dereference and make
free_choose_arg_map() more resilient, add checks for pointers before
iterating.

Cc: stable@vger.kernel.org
Co-authored-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Tuo Li <islituo@gmail.com>
Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
2026-01-05 13:28:26 +01:00
Viacheslav Dubeyko
bc417a4baf ceph: update co-maintainers list in MAINTAINERS
Update the list of co-maintainers for Ceph file system following
Xiubo's departure.

Signed-off-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
Acked-by: Alex Markuze <amarkuze@redhat.com>
Acked-by: Xiubo Li <xiubli@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
2026-01-05 13:28:26 +01:00
Ilya Dryomov
e00c3f71b5 libceph: replace overzealous BUG_ON in osdmap_apply_incremental()
If the osdmap is (maliciously) corrupted such that the incremental
osdmap epoch is different from what is expected, there is no need to
BUG.  Instead, just declare the incremental osdmap to be invalid.

Cc: stable@vger.kernel.org
Reported-by: ziming zhang <ezrakiez@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
2026-01-05 13:28:26 +01:00
ziming zhang
818156caff libceph: prevent potential out-of-bounds reads in handle_auth_done()
Perform an explicit bounds check on payload_len to avoid a possible
out-of-bounds access in the callout.

[ idryomov: changelog ]

Cc: stable@vger.kernel.org
Signed-off-by: ziming zhang <ezrakiez@gmail.com>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
2026-01-05 13:28:25 +01:00
Alexander Stein
89e87d0dc8 arm64: dts: mba8mx: Fix Ethernet PHY IRQ support
Ethernet PHY interrupt mode is level triggered. Adjust the mode
accordingly.

Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Fixes: 70cf622bb16e ("arm64: dts: mba8mx: Add Ethernet PHY IRQ support")
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-30 16:07:39 +08:00
Sherry Sun
a988caeed9 arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart
The commit 616effc0272b5 ("arm64: dts: imx8: Fix lpuart DMA channel
order") swap uart rx and tx channel at common imx8-ss-dma.dtsi. But miss
update imx8qm-ss-dma.dtsi.

The commit 5a8e9b022e569 ("arm64: dts: imx8qm-ss-dma: Pass lpuart
dma-names") just simple add dma-names as binding doc requirement.

Correct lpuart0 - lpuart3 dma rx and tx channels, and use defines for
the FSL_EDMA_RX flag.

Fixes: 5a8e9b022e56 ("arm64: dts: imx8qm-ss-dma: Pass lpuart dma-names")
Signed-off-by: Sherry Sun <sherry.sun@nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-30 10:34:19 +08:00
Marek Vasut
c63749a7dd arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM
Add missing 'clocks' property to LAN8740Ai PHY node, to allow the PHY driver
to manage LAN8740Ai CLKIN reference clock supply. This fixes sporadic link
bouncing caused by interruptions on the PHY reference clock, by letting the
PHY driver manage the reference clock and assure there are no interruptions.

This follows the matching PHY driver recommendation described in commit
bedd8d78aba3 ("net: phy: smsc: LAN8710/20: add phy refclk in support")

Fixes: 8d6712695bc8 ("arm64: dts: imx8mp: Add support for DH electronics i.MX8M Plus DHCOM and PDK2")
Signed-off-by: Marek Vasut <marek.vasut@mailbox.org>
Tested-by: Christoph Niedermaier <cniedermaier@dh-electronics.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-30 10:31:08 +08:00
Maud Spierings
cdf4e631ee arm64: dts: freescale: tx8p-ml81: fix eqos nvmem-cells
On this SoM eqos is the primary ethernet interface, Ka-Ro fuses the
address for it in eth_mac1, eth_mac2 seems to be left unfused. In their
downstream u-boot they fetch it from eth_mac1 [1][2], by setting alias
of eqos to ethernet0, the driver then fetches the mac address based on
the alias number.

Set eqos to read from eth_mac1 instead of eth_mac2. Also set fec to
point at eth_mac2 as it may be fused later even though it is disabled
by default.

With this changed barebox is now capable of loading the correct address.

Link: 3805432784/drivers/net/dwc_eth_qos.c (L1167) [1]
Link: 3805432784/arch/arm/dts/imx8mp-karo.dtsi (L12) [2]

Fixes: bac63d7c5f46 ("arm64: dts: freescale: add Ka-Ro Electronics tx8p-ml81 COM")
Signed-off-by: Maud Spierings <maudspierings@gocontroll.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-30 10:22:29 +08:00
Maud Spierings
056c688751 arm64: dts: freescale: moduline-display: fix compatible
The compatibles should include the SoM compatible, this board is based
on the Ka-Ro TX8P-ML81 SoM, so add it to allow using shared code in the
bootloader which uses upstream Linux devicetrees as a base.

Also add the hardware revision to the board compatible to handle
revision specific quirks in the bootloader/userspace.

This is a breaking change, but it is early enough that it can be
corrected without causing any issues.

Fixes: 03f07be54cdc ("arm64: dts: freescale: Add the GOcontroll Moduline Display baseboard")
Signed-off-by: Maud Spierings <maudspierings@gocontroll.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-30 10:22:29 +08:00
Maud Spierings
1815b16d02 dt-bindings: arm: fsl: moduline-display: fix compatible
The compatibles should include the SoM compatible, this board is based
on the Ka-Ro TX8P-ML81 SoM, so add it to allow using shared code in the
bootloader which uses upstream Linux devicetrees as a base.

Also add the hardware revision to the board compatible to handle
revision specific quirks in the bootloader/userspace.

This is a breaking change, but it is early enough that it can be
corrected without causing any issues.

Fixes: 24e67d28ef95 ("dt-bindings: arm: fsl: Add GOcontroll Moduline Display")
Signed-off-by: Maud Spierings <maudspierings@gocontroll.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-30 10:22:29 +08:00
Ian Ray
e6a4eedd49 ARM: dts: imx6q-ba16: fix RTC interrupt level
RTC interrupt level should be set to "LOW". This was revealed by the
introduction of commit:

  f181987ef477 ("rtc: m41t80: use IRQ flags obtained from fwnode")

which changed the way IRQ type is obtained.

Fixes: 56c27310c1b4 ("ARM: dts: imx: Add Advantech BA-16 Qseven module")
Signed-off-by: Ian Ray <ian.ray@gehealthcare.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-30 10:19:16 +08:00
Vitor Soares
15599306fb arm64: dts: freescale: imx95-toradex-smarc: fix SMARC_SDIO_WP label position
Fix the SMARC_SDIO_WP gpio-line-name position. It should be on line 15
of som_gpio_expander_1, not line 17.

Fixes: 90bbe88e0ea6 ("arm64: dts: freescale: add Toradex SMARC iMX95")
Signed-off-by: Vitor Soares <vitor.soares@toradex.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-29 21:13:44 +08:00
Vitor Soares
466798368e arm64: dts: freescale: imx95-toradex-smarc: use edge trigger for ethphy1 interrupt
Change the PHY interrupt trigger type from IRQ_TYPE_LEVEL_LOW to
IRQ_TYPE_EDGE_FALLING to match the PCA9745 GPIO expander hardware
capabilities and avoid emulated level detection.

Fixes: 90bbe88e0ea6 ("arm64: dts: freescale: add Toradex SMARC iMX95")
Signed-off-by: Vitor Soares <vitor.soares@toradex.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-29 21:13:43 +08:00
Haibo Chen
ca643894a3 arm64: dts: add off-on-delay-us for usdhc2 regulator
For SD card, according to the spec requirement, for sd card power reset
operation, it need sd card supply voltage to be lower than 0.5v and keep
over 1ms, otherwise, next time power back the sd card supply voltage to
3.3v, sd card can't support SD3.0 mode again.

To match such requirement on imx8qm-mek board, add 4.8ms delay between
sd power off and power on.

Fixes: 307fd14d4b14 ("arm64: dts: imx: add imx8qm mek support")
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-29 16:53:00 +08:00
Haibo Chen
e0d8678c2f arm64: dts: imx8qm-mek: correct the light sensor interrupt type to low level
light sensor isl29023 share the interrupt with lsm303arg, but these
two devices use different interrupt type. According to the datasheet
of these two devides, both support low level trigger type, so correct
the interrupt type here to avoid the following error log:

  irq: type mismatch, failed to map hwirq-11 for gpio@5d0c0000!

Fixes: 9918092cbb0e ("arm64: dts: imx8qm-mek: add i2c0 and children devices")
Fixes: 1d8a9f043a77 ("arm64: dts: imx8: use defines for interrupts")
Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-29 16:53:00 +08:00
Rob Herring (Arm)
1a8e81a3bc ARM: dts: nxp: imx: Fix mc13xxx LED node names
Node names are supposed to be generic and use hexadecimal unit-addresses.

Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-29 16:51:03 +08:00
Carlos Song
cd0caaf200 arm64: dts: imx95: correct I3C2 pclk to IMX95_CLK_BUSWAKEUP
I3C2 is in WAKEUP domain. Its pclk should be IMX95_CLK_BUSWAKEUP.

Fixes: 969497ebefcf ("arm64: dts: imx95: Add i3c1 and i3c2")
Signed-off-by: Carlos Song <carlos.song@nxp.com>
Cc: stable@vger.kernel.org
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-29 16:29:54 +08:00
Linus Walleij
c4c6db7ac5 MAINTAINERS: Fix a linusw mail address
The patch adding me to the SoC maintainers was in-flight at the
time I had to change my mail address. This fixes it up.

Signed-off-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20251216-maintainers-fix-v1-1-92f11231b27e@kernel.org
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
2025-12-22 10:56:44 +01:00
Krzysztof Kozlowski
a3b80161fb TI K3 DT fixes for v6.19
- minor fixes for overlay files
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE+KKGk1TrgjIXoxo03bWEnRc2JJ0FAmlACygACgkQ3bWEnRc2
 JJ2qVA//aKeZrA2jMhwpT2mliOLet9V2pa/F6/XlfBtvp5rSv27TARFSSPUkqvch
 ZjSxbo3JgDtdgYcc2ViAqDINZmpBue5BM2wJJEXtBb32Zjk5JD5GGGB85zYfqgCC
 hHhXmYGf0ct7mIl8X0PF+LhHg5gq6FtbOUx28mIPWh7yaNM7Z0WEdDihUg9GxgWM
 XEjcWXw2rRKD0StOFSQxvcSggstM/m+kde/mZkN9VfzPP9SsGzYg0jKfTWxtqYLm
 46CMzElg+WKw0Cs8us7Y7/Up9D0EV9S+AeiwfYMUNCdjasIi8iCoKrmaXlop0M9G
 WhlC1rTxJGhV1Zh+sSaPfNaDHxM3RY81l7iMgsBug+WyBuGppCw8dzDblbT4M1eX
 8y4VnG93fGadkwCrd7KiUlhn6wxVBN3BPqZQHalkZ5WegotsdtKi1qp7WrAzLXXU
 o2ugIJcZb6vOV1N0fWkRn8ZGAXaUiSI3uhAsXYQyn96MgZLqRJAdmJ3FXCq81Yad
 GLBl3KEZojQ+ZUHl10bNdSn6P2WbyKcrqS9Xz+WLGF/Nob1JI73pkL9h7iV5K49K
 +VqE/KagOLNLU8KLMGqCO6QkJ/Vg6VeZ/Uk3eRTOehPOuWomYMvXd8DGuGJleZpA
 5e9EmsE+mKfbOEoSMBjhLKEOZDGOgdOMskXH2bDYrkNnKFL5F9k=
 =r9i6
 -----END PGP SIGNATURE-----

Merge tag 'ti-k3-dt-fixes-for-v6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux into arm/fixes

TI K3 DT fixes for v6.19

- minor fixes for overlay files

* tag 'ti-k3-dt-fixes-for-v6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux:
  arm64: dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema warnings
  arm64: dts: ti: k3-am642-phyboard-electra-x27-gpio1-spi1-uart3: Fix schema warnings
  arm64: dts: ti: k3-am642-phyboard-electra-peb-c-010: Fix icssg-prueth schema warning

Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
2025-12-22 10:44:23 +01:00
Andrea della Porta
9a96cc8bbe arm64: dts: broadcom: rp1: drop RP1 overlay
RP1 support loaded from overlay has been dropped from the driver and
the DTB intended to be loaded with the overlay no longer exists.

Drop unused include file and overlay.

Signed-off-by: Andrea della Porta <andrea.porta@suse.com>
Reviewed-by: Rob Herring <robh@kernel.org>
Link: https://lore.kernel.org/r/85167b815d41ed9ed690ad239a19de5cd2e8be1c.1766077285.git.andrea.porta@suse.com
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
2025-12-19 12:42:36 -08:00
Andrea della Porta
bc97e616a7 arm64: dts: broadcom: bcm2712: fix RP1 endpoint PCI topology
The node describing the RP1 endpoint currently uses a specific name
('rp1_nexus') that does not correctly reflect the PCI topology.

Update the DT with the correct topology and use generic node names.

Additionally, since the driver dropped overlay support in favor of a
fully described DT, rename '...-ovl-rp1.dts' to '...-base.dtsi' for
inclusion in the board DTB, as it is no longer compiled as a
standalone DTB.

Signed-off-by: Andrea della Porta <andrea.porta@suse.com>
Reviewed-by: Rob Herring <robh@kernel.org>
Link: https://lore.kernel.org/r/827b12ba48bb47bc77a0f5e5617aea961c8bc6b5.1766077285.git.andrea.porta@suse.com
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
2025-12-19 12:42:30 -08:00
Andrea della Porta
ce26f588c8 misc: rp1: drop overlay support
The RP1 driver can load an overlay at runtime to describe the inner
peripherals. This has led to a lot of confusion regarding the naming
of nodes, their topology and the reclaiming of related node resources.

Since the overlay is currently not fully functional, drop its support
in the driver in favor of the fully described static DT.

This also means that this driver does not depend on CONFIG_PCI_DYNAMIC_OF_NODES
and no longer requires PCI quirks to dynamically create the intermediate
PCI nodes.

Signed-off-by: Andrea della Porta <andrea.porta@suse.com>
Reviewed-by: Rob Herring <robh@kernel.org>
Link: https://lore.kernel.org/r/4b0aa7160877cf128b9bc713776bcac73c46eb24.1766077285.git.andrea.porta@suse.com
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
2025-12-19 12:42:23 -08:00
Andrea della Porta
c6d0cdf7e5 dt-bindings: misc: pci1de4,1: add required reg property for endpoint
The PCI subsystem links an endpoint Device Tree node to its corresponding
pci_dev structure only if the Bus/Device/Function (BDF) encoded in the
'reg' property matches the actual hardware topology.

Add the 'reg' property and mark it as required to ensure proper binding
between the device_node and the pci_dev.

Update the example to reflect this requirement.

Signed-off-by: Andrea della Porta <andrea.porta@suse.com>
Reviewed-by: Rob Herring <robh@kernel.org>
Link: https://lore.kernel.org/r/b58bfcd957b2270fcf932d463f2db534b2ae1a6d.1766077285.git.andrea.porta@suse.com
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
2025-12-19 12:42:07 -08:00
Linus Walleij
ececfba255 ARM: dts: ixp4xx: Fix up Actiontec MI424WR DTS files
The KS8995 switch was unconditionally wired to EthC (eth1)
on both MI424WR variants, this is wrong: the D revision has
the switch connected to EthB (eth0) so pull this assingment
out of the generic MI424WR DTSI file and make it a property
of the respective variants instead.

Signed-off-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20251211-ixp4xx-actiontec-dts-fix-v1-1-97af8e79d474@kernel.org
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
2025-12-15 21:15:36 +01:00
Wadim Egorov
cf5e8adebe arm64: dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema warnings
Rename pinctrl nodes to comply with naming conventions required by
pinctrl-single schema.

Fixes: e569152274fec ("arm64: dts: ti: am62-lp-sk: Add overlay for NAND expansion card")
Signed-off-by: Wadim Egorov <w.egorov@phytec.de>
Link: https://patch.msgid.link/20251127122733.2523367-3-w.egorov@phytec.de
Signed-off-by: Nishanth Menon <nm@ti.com>
2025-12-15 07:17:46 -06:00
Wadim Egorov
d876bb9353 arm64: dts: ti: k3-am642-phyboard-electra-x27-gpio1-spi1-uart3: Fix schema warnings
Rename pinctrl nodes to comply with naming conventions required by
pinctrl-single schema. Also, replace invalid integer assignment in
SPI node with a boolean to align with omap-spi schema.

Fixes: 638ab30ce4c6 ("arm64: dts: ti: am64-phyboard-electra: Add DT overlay for X27 connector")
Signed-off-by: Wadim Egorov <w.egorov@phytec.de>
Link: https://patch.msgid.link/20251127122733.2523367-2-w.egorov@phytec.de
Signed-off-by: Nishanth Menon <nm@ti.com>
2025-12-15 07:17:46 -06:00
Wadim Egorov
05bbe52d0b arm64: dts: ti: k3-am642-phyboard-electra-peb-c-010: Fix icssg-prueth schema warning
Reduce length of dma-names and dmas properties for icssg1-ethernet
node to comply with ti,icssg-prueth schema constraints. The previous
entries exceeded the allowed count and triggered dtschema warnings
during validation.

Fixes: e53fbf955ea7 ("arm64: dts: ti: k3-am642-phyboard-electra: Add PEB-C-010 Overlay")
Signed-off-by: Wadim Egorov <w.egorov@phytec.de>
Link: https://patch.msgid.link/20251127122733.2523367-1-w.egorov@phytec.de
Signed-off-by: Nishanth Menon <nm@ti.com>
2025-12-15 07:17:46 -06:00
50 changed files with 262 additions and 234 deletions

View File

@ -1105,7 +1105,6 @@ properties:
- gateworks,imx8mp-gw74xx # i.MX8MP Gateworks Board
- gateworks,imx8mp-gw75xx-2x # i.MX8MP Gateworks Board
- gateworks,imx8mp-gw82xx-2x # i.MX8MP Gateworks Board
- gocontroll,moduline-display # GOcontroll Moduline Display controller
- prt,prt8ml # Protonic PRT8ML
- skov,imx8mp-skov-basic # SKOV i.MX8MP baseboard without frontplate
- skov,imx8mp-skov-revb-hdmi # SKOV i.MX8MP climate control without panel
@ -1164,6 +1163,14 @@ properties:
- const: engicam,icore-mx8mp # i.MX8MP Engicam i.Core MX8M Plus SoM
- const: fsl,imx8mp
- description: Ka-Ro TX8P-ML81 SoM based boards
items:
- enum:
- gocontroll,moduline-display
- gocontroll,moduline-display-106
- const: karo,tx8p-ml81
- const: fsl,imx8mp
- description: Kontron i.MX8MP OSM-S SoM based Boards
items:
- const: kontron,imx8mp-bl-osm-s # Kontron BL i.MX8MP OSM-S Board

View File

@ -25,6 +25,10 @@ properties:
items:
- const: pci1de4,1
reg:
maxItems: 1
description: The PCI Bus-Device-Function address.
'#interrupt-cells':
const: 2
description: |
@ -101,6 +105,7 @@ unevaluatedProperties: false
required:
- compatible
- reg
- '#interrupt-cells'
- interrupt-controller
- pci-ep-bus@1
@ -111,8 +116,9 @@ examples:
#address-cells = <3>;
#size-cells = <2>;
rp1@0,0 {
dev@0,0 {
compatible = "pci1de4,1";
reg = <0x10000 0x0 0x0 0x0 0x0>;
ranges = <0x01 0x00 0x00000000 0x82010000 0x00 0x00 0x00 0x400000>;
#address-cells = <3>;
#size-cells = <2>;

View File

@ -57,8 +57,10 @@ Submitting Patches for Given SoC
All typical platform related patches should be sent via SoC submaintainers
(platform-specific maintainers). This includes also changes to per-platform or
shared defconfigs (scripts/get_maintainer.pl might not provide correct
addresses in such case).
shared defconfigs. Note that scripts/get_maintainer.pl might not provide
correct addresses for the shared defconfig, so ignore its output and manually
create CC-list based on MAINTAINERS file or use something like
``scripts/get_maintainer.pl -f drivers/soc/FOO/``).
Submitting Patches to the Main SoC Maintainers
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@ -114,9 +116,9 @@ coordinating how the changes get merged through different maintainer trees.
Usually the branch that includes a driver change will also include the
corresponding change to the devicetree binding description, to ensure they are
in fact compatible. This means that the devicetree branch can end up causing
warnings in the "make dtbs_check" step. If a devicetree change depends on
warnings in the ``make dtbs_check`` step. If a devicetree change depends on
missing additions to a header file in include/dt-bindings/, it will fail the
"make dtbs" step and not get merged.
``make dtbs`` step and not get merged.
There are multiple ways to deal with this:

View File

@ -2012,7 +2012,7 @@ ARM AND ARM64 SoC SUB-ARCHITECTURES (COMMON PARTS)
M: Arnd Bergmann <arnd@arndb.de>
M: Krzysztof Kozlowski <krzk@kernel.org>
M: Alexandre Belloni <alexandre.belloni@bootlin.com>
M: Linus Walleij <linus.walleij@linaro.org>
M: Linus Walleij <linusw@kernel.org>
R: Drew Fustini <fustini@kernel.org>
L: linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
L: soc@lists.linux.dev
@ -5802,7 +5802,8 @@ F: drivers/power/supply/cw2015_battery.c
CEPH COMMON CODE (LIBCEPH)
M: Ilya Dryomov <idryomov@gmail.com>
M: Xiubo Li <xiubli@redhat.com>
M: Alex Markuze <amarkuze@redhat.com>
M: Viacheslav Dubeyko <slava@dubeyko.com>
L: ceph-devel@vger.kernel.org
S: Supported
W: http://ceph.com/
@ -5813,8 +5814,9 @@ F: include/linux/crush/
F: net/ceph/
CEPH DISTRIBUTED FILE SYSTEM CLIENT (CEPH)
M: Xiubo Li <xiubli@redhat.com>
M: Ilya Dryomov <idryomov@gmail.com>
M: Alex Markuze <amarkuze@redhat.com>
M: Viacheslav Dubeyko <slava@dubeyko.com>
L: ceph-devel@vger.kernel.org
S: Supported
W: http://ceph.com/

View File

@ -12,6 +12,17 @@
model = "Actiontec MI424WR rev A/C";
compatible = "actiontec,mi424wr-ac", "intel,ixp42x";
/* Connect the switch to EthC */
spi {
ethernet-switch@0 {
ethernet-ports {
ethernet-port@4 {
ethernet = <&ethc>;
};
};
};
};
soc {
/* EthB used for WAN */
ethernet@c8009000 {

View File

@ -12,6 +12,17 @@
model = "Actiontec MI424WR rev D";
compatible = "actiontec,mi424wr-d", "intel,ixp42x";
/* Connect the switch to EthB */
spi {
ethernet-switch@0 {
ethernet-ports {
ethernet-port@4 {
ethernet = <&ethb>;
};
};
};
};
soc {
/* EthB used for LAN */
ethernet@c8009000 {

View File

@ -152,7 +152,6 @@
};
ethernet-port@4 {
reg = <4>;
ethernet = <&ethc>;
phy-mode = "mii";
fixed-link {
speed = <100>;

View File

@ -248,14 +248,14 @@
linux,default-trigger = "nand-disk";
};
ledg3: led@10 {
reg = <10>;
ledg3: led@a {
reg = <0xa>;
label = "system:green3:live";
linux,default-trigger = "heartbeat";
};
ledb3: led@11 {
reg = <11>;
ledb3: led@b {
reg = <0xb>;
label = "system:blue3:cpu";
linux,default-trigger = "cpu0";
};

View File

@ -398,13 +398,13 @@
#size-cells = <0>;
led-control = <0x0 0x0 0x3f83f8 0x0>;
sysled0@3 {
led@3 {
reg = <3>;
label = "system:green:status";
linux,default-trigger = "default-on";
};
sysled1@4 {
led@4 {
reg = <4>;
label = "system:green:act";
linux,default-trigger = "heartbeat";

View File

@ -225,13 +225,13 @@
#size-cells = <0>;
led-control = <0x0 0x0 0x3f83f8 0x0>;
sysled3: led3@3 {
sysled3: led@3 {
reg = <3>;
label = "system:red:power";
linux,default-trigger = "default-on";
};
sysled4: led4@4 {
sysled4: led@4 {
reg = <4>;
label = "system:green:act";
linux,default-trigger = "heartbeat";

View File

@ -153,13 +153,13 @@
#size-cells = <0>;
led-control = <0x0 0x0 0x3f83f8 0x0>;
sysled3: led3@3 {
sysled3: led@3 {
reg = <3>;
label = "system:red:power";
linux,default-trigger = "default-on";
};
sysled4: led4@4 {
sysled4: led@4 {
reg = <4>;
label = "system:green:act";
linux,default-trigger = "heartbeat";

View File

@ -337,7 +337,7 @@
pinctrl-0 = <&pinctrl_rtc>;
reg = <0x32>;
interrupt-parent = <&gpio4>;
interrupts = <10 IRQ_TYPE_LEVEL_HIGH>;
interrupts = <10 IRQ_TYPE_LEVEL_LOW>;
};
};

View File

@ -7,15 +7,13 @@ dtb-$(CONFIG_ARCH_BCM2835) += bcm2711-rpi-400.dtb \
bcm2711-rpi-4-b.dtb \
bcm2711-rpi-cm4-io.dtb \
bcm2712-rpi-5-b.dtb \
bcm2712-rpi-5-b-ovl-rp1.dtb \
bcm2712-d-rpi-5-b.dtb \
bcm2837-rpi-2-b.dtb \
bcm2837-rpi-3-a-plus.dtb \
bcm2837-rpi-3-b.dtb \
bcm2837-rpi-3-b-plus.dtb \
bcm2837-rpi-cm3-io3.dtb \
bcm2837-rpi-zero-2-w.dtb \
rp1.dtbo
bcm2837-rpi-zero-2-w.dtb
subdir-y += bcmbca
subdir-y += northstar2

View File

@ -1,22 +1,16 @@
// SPDX-License-Identifier: (GPL-2.0 OR MIT)
/*
* bcm2712-rpi-5-b-ovl-rp1.dts is the overlay-ready DT which will make
* the RP1 driver to load the RP1 dtb overlay at runtime, while
* bcm2712-rpi-5-b.dts (this file) is the fully defined one (i.e. it
* already contains RP1 node, so no overlay is loaded nor needed).
* This file is intended to host the override nodes for the RP1 peripherals,
* e.g. to declare the phy of the ethernet interface or the custom pin setup
* for several RP1 peripherals.
* This in turn is due to the fact that there's no current generic
* infrastructure to reference nodes (i.e. the nodes in rp1-common.dtsi) that
* are not yet defined in the DT since they are loaded at runtime via overlay.
* As a loose attempt to separate RP1 customizations from SoC peripherals
* definitioni, this file is intended to host the override nodes for the RP1
* peripherals, e.g. to declare the phy of the ethernet interface or custom
* pin setup.
* All other nodes that do not have anything to do with RP1 should be added
* to the included bcm2712-rpi-5-b-ovl-rp1.dts instead.
* to the included bcm2712-rpi-5-b-base.dtsi instead.
*/
/dts-v1/;
#include "bcm2712-rpi-5-b-ovl-rp1.dts"
#include "bcm2712-rpi-5-b-base.dtsi"
/ {
aliases {
@ -25,7 +19,26 @@
};
&pcie2 {
#include "rp1-nexus.dtsi"
pci@0,0 {
reg = <0x0 0x0 0x0 0x0 0x0>;
ranges;
bus-range = <0 1>;
device_type = "pci";
#address-cells = <3>;
#size-cells = <2>;
dev@0,0 {
compatible = "pci1de4,1";
reg = <0x10000 0x0 0x0 0x0 0x0>;
ranges = <0x1 0x0 0x0 0x82010000 0x0 0x0 0x0 0x400000>;
interrupt-controller;
#interrupt-cells = <2>;
#address-cells = <3>;
#size-cells = <2>;
#include "rp1-common.dtsi"
};
};
};
&rp1_eth {

View File

@ -1,14 +0,0 @@
// SPDX-License-Identifier: (GPL-2.0 OR MIT)
rp1_nexus {
compatible = "pci1de4,1";
#address-cells = <3>;
#size-cells = <2>;
ranges = <0x01 0x00 0x00000000
0x02000000 0x00 0x00000000
0x0 0x400000>;
interrupt-controller;
#interrupt-cells = <2>;
#include "rp1-common.dtsi"
};

View File

@ -1,11 +0,0 @@
// SPDX-License-Identifier: (GPL-2.0 OR MIT)
/dts-v1/;
/plugin/;
&pcie2 {
#address-cells = <3>;
#size-cells = <2>;
#include "rp1-nexus.dtsi"
};

View File

@ -113,6 +113,7 @@
ethphy0f: ethernet-phy@1 { /* SMSC LAN8740Ai */
compatible = "ethernet-phy-id0007.c110",
"ethernet-phy-ieee802.3-c22";
clocks = <&clk IMX8MP_CLK_ENET_QOS>;
interrupt-parent = <&gpio3>;
interrupts = <19 IRQ_TYPE_LEVEL_LOW>;
pinctrl-0 = <&pinctrl_ethphy0>;

View File

@ -9,7 +9,7 @@
#include "imx8mp-tx8p-ml81.dtsi"
/ {
compatible = "gocontroll,moduline-display", "fsl,imx8mp";
compatible = "gocontroll,moduline-display-106", "karo,tx8p-ml81", "fsl,imx8mp";
chassis-type = "embedded";
hardware = "Moduline Display V1.06";
model = "GOcontroll Moduline Display baseboard";

View File

@ -47,6 +47,7 @@
<&clk IMX8MP_SYS_PLL2_100M>,
<&clk IMX8MP_SYS_PLL2_50M>;
assigned-clock-rates = <266000000>, <100000000>, <50000000>;
nvmem-cells = <&eth_mac1>;
phy-handle = <&ethphy0>;
phy-mode = "rmii";
pinctrl-0 = <&pinctrl_eqos>;
@ -75,6 +76,10 @@
};
};
&fec {
nvmem-cells = <&eth_mac2>;
};
&gpio1 {
gpio-line-names = "SODIMM_152",
"SODIMM_42",

View File

@ -263,6 +263,7 @@
regulator-max-microvolt = <3000000>;
gpio = <&lsio_gpio4 7 GPIO_ACTIVE_HIGH>;
enable-active-high;
off-on-delay-us = <4800>;
};
reg_audio: regulator-audio {
@ -576,7 +577,7 @@
compatible = "isil,isl29023";
reg = <0x44>;
interrupt-parent = <&lsio_gpio4>;
interrupts = <11 IRQ_TYPE_EDGE_FALLING>;
interrupts = <11 IRQ_TYPE_LEVEL_LOW>;
};
pressure-sensor@60 {

View File

@ -172,25 +172,25 @@
&lpuart0 {
compatible = "fsl,imx8qm-lpuart", "fsl,imx8qxp-lpuart";
dmas = <&edma2 13 0 0>, <&edma2 12 0 1>;
dmas = <&edma2 12 0 FSL_EDMA_RX>, <&edma2 13 0 0>;
dma-names = "rx","tx";
};
&lpuart1 {
compatible = "fsl,imx8qm-lpuart", "fsl,imx8qxp-lpuart";
dmas = <&edma2 15 0 0>, <&edma2 14 0 1>;
dmas = <&edma2 14 0 FSL_EDMA_RX>, <&edma2 15 0 0>;
dma-names = "rx","tx";
};
&lpuart2 {
compatible = "fsl,imx8qm-lpuart", "fsl,imx8qxp-lpuart";
dmas = <&edma2 17 0 0>, <&edma2 16 0 1>;
dmas = <&edma2 16 0 FSL_EDMA_RX>, <&edma2 17 0 0>;
dma-names = "rx","tx";
};
&lpuart3 {
compatible = "fsl,imx8qm-lpuart", "fsl,imx8qxp-lpuart";
dmas = <&edma2 19 0 0>, <&edma2 18 0 1>;
dmas = <&edma2 18 0 FSL_EDMA_RX>, <&edma2 19 0 0>;
dma-names = "rx","tx";
};

View File

@ -406,8 +406,6 @@
"",
"",
"",
"",
"",
"SMARC_SDIO_WP";
};
@ -582,7 +580,7 @@
ethphy1: ethernet-phy@1 {
reg = <1>;
interrupt-parent = <&som_gpio_expander_1>;
interrupts = <6 IRQ_TYPE_LEVEL_LOW>;
interrupts = <6 IRQ_TYPE_EDGE_FALLING>;
ti,rx-internal-delay = <DP83867_RGMIIDCTL_2_00_NS>;
ti,tx-internal-delay = <DP83867_RGMIIDCTL_2_00_NS>;
};

View File

@ -828,7 +828,7 @@
interrupts = <GIC_SPI 57 IRQ_TYPE_LEVEL_HIGH>;
#address-cells = <3>;
#size-cells = <0>;
clocks = <&scmi_clk IMX95_CLK_BUSAON>,
clocks = <&scmi_clk IMX95_CLK_BUSWAKEUP>,
<&scmi_clk IMX95_CLK_I3C2SLOW>;
clock-names = "pclk", "fast_clk";
status = "disabled";

View File

@ -192,7 +192,7 @@
reset-assert-us = <500000>;
reset-deassert-us = <500>;
interrupt-parent = <&expander2>;
interrupts = <6 IRQ_TYPE_EDGE_FALLING>;
interrupts = <6 IRQ_TYPE_LEVEL_LOW>;
};
};
};

View File

@ -675,10 +675,7 @@
snps,lfps_filter_quirk;
snps,dis_u2_susphy_quirk;
snps,dis_u3_susphy_quirk;
snps,tx_de_emphasis_quirk;
snps,tx_de_emphasis = <1>;
snps,dis_enblslpm_quirk;
snps,gctl-reset-quirk;
usb-role-switch;
role-switch-default-mode = "host";
port {

View File

@ -14,7 +14,7 @@
};
&main_pmx0 {
gpmc0_pins_default: gpmc0-pins-default {
gpmc0_pins_default: gpmc0-default-pins {
pinctrl-single,pins = <
AM62X_IOPAD(0x003c, PIN_INPUT, 0) /* (K19) GPMC0_AD0 */
AM62X_IOPAD(0x0040, PIN_INPUT, 0) /* (L19) GPMC0_AD1 */

View File

@ -30,13 +30,10 @@
<&main_pktdma 0xc206 15>, /* egress slice 1 */
<&main_pktdma 0xc207 15>, /* egress slice 1 */
<&main_pktdma 0x4200 15>, /* ingress slice 0 */
<&main_pktdma 0x4201 15>, /* ingress slice 1 */
<&main_pktdma 0x4202 0>, /* mgmnt rsp slice 0 */
<&main_pktdma 0x4203 0>; /* mgmnt rsp slice 1 */
<&main_pktdma 0x4201 15>; /* ingress slice 1 */
dma-names = "tx0-0", "tx0-1", "tx0-2", "tx0-3",
"tx1-0", "tx1-1", "tx1-2", "tx1-3",
"rx0", "rx1",
"rxmgm0", "rxmgm1";
"rx0", "rx1";
firmware-name = "ti-pruss/am65x-sr2-pru0-prueth-fw.elf",
"ti-pruss/am65x-sr2-rtu0-prueth-fw.elf",

View File

@ -20,13 +20,13 @@
};
&main_pmx0 {
main_gpio1_exp_header_gpio_pins_default: main-gpio1-exp-header-gpio-pins-default {
main_gpio1_exp_header_gpio_pins_default: main-gpio1-exp-header-gpio-default-pins {
pinctrl-single,pins = <
AM64X_IOPAD(0x0220, PIN_INPUT, 7) /* (D14) SPI1_CS1.GPIO1_48 */
>;
};
main_spi1_pins_default: main-spi1-pins-default {
main_spi1_pins_default: main-spi1-default-pins {
pinctrl-single,pins = <
AM64X_IOPAD(0x0224, PIN_INPUT, 0) /* (C14) SPI1_CLK */
AM64X_IOPAD(0x021C, PIN_OUTPUT, 0) /* (B14) SPI1_CS0 */
@ -35,7 +35,7 @@
>;
};
main_uart3_pins_default: main-uart3-pins-default {
main_uart3_pins_default: main-uart3-default-pins {
pinctrl-single,pins = <
AM64X_IOPAD(0x0048, PIN_INPUT, 2) /* (U20) GPMC0_AD3.UART3_RXD */
AM64X_IOPAD(0x004c, PIN_OUTPUT, 2) /* (U18) GPMC0_AD4.UART3_TXD */
@ -52,7 +52,7 @@
&main_spi1 {
pinctrl-names = "default";
pinctrl-0 = <&main_spi1_pins_default>;
ti,pindir-d0-out-d1-in = <1>;
ti,pindir-d0-out-d1-in;
status = "okay";
};

View File

@ -45,7 +45,7 @@ void arch_efi_call_virt_teardown(void);
* switching to the EFI runtime stack.
*/
#define current_in_efi() \
(!preemptible() && efi_rt_stack_top != NULL && \
(efi_rt_stack_top != NULL && \
on_task_stack(current, READ_ONCE(efi_rt_stack_top[-1]), 1))
#define ARCH_EFI_IRQ_FLAGS_MASK (PSR_D_BIT | PSR_A_BIT | PSR_I_BIT | PSR_F_BIT)

View File

@ -2,7 +2,7 @@
#ifndef __ASM_SUSPEND_H
#define __ASM_SUSPEND_H
#define NR_CTX_REGS 13
#define NR_CTX_REGS 14
#define NR_CALLEE_SAVED_REGS 12
/*

View File

@ -171,7 +171,8 @@ static int change_memory_common(unsigned long addr, int numpages,
*/
area = find_vm_area((void *)addr);
if (!area ||
end > (unsigned long)kasan_reset_tag(area->addr) + area->size ||
((unsigned long)kasan_reset_tag((void *)end) >
(unsigned long)kasan_reset_tag(area->addr) + area->size) ||
((area->flags & (VM_ALLOC | VM_ALLOW_HUGE_VMAP)) != VM_ALLOC))
return -EINVAL;
@ -184,7 +185,8 @@ static int change_memory_common(unsigned long addr, int numpages,
*/
if (rodata_full && (pgprot_val(set_mask) == PTE_RDONLY ||
pgprot_val(clear_mask) == PTE_RDONLY)) {
unsigned long idx = (start - (unsigned long)kasan_reset_tag(area->addr))
unsigned long idx = ((unsigned long)kasan_reset_tag((void *)start) -
(unsigned long)kasan_reset_tag(area->addr))
>> PAGE_SHIFT;
for (; numpages; idx++, numpages--) {
ret = __change_memory_common((u64)page_address(area->pages[idx]),

View File

@ -110,6 +110,10 @@ SYM_FUNC_START(cpu_do_suspend)
* call stack.
*/
str x18, [x0, #96]
alternative_if ARM64_HAS_TCR2
mrs x2, REG_TCR2_EL1
str x2, [x0, #104]
alternative_else_nop_endif
ret
SYM_FUNC_END(cpu_do_suspend)
@ -144,6 +148,10 @@ SYM_FUNC_START(cpu_do_resume)
msr tcr_el1, x8
msr vbar_el1, x9
msr mdscr_el1, x10
alternative_if ARM64_HAS_TCR2
ldr x2, [x0, #104]
msr REG_TCR2_EL1, x2
alternative_else_nop_endif
msr sctlr_el1, x12
set_this_cpu_offset x13

View File

@ -140,14 +140,21 @@ EXPORT_SYMBOL_GPL(blk_rq_integrity_map_user);
bool blk_integrity_merge_rq(struct request_queue *q, struct request *req,
struct request *next)
{
struct bio_integrity_payload *bip, *bip_next;
if (blk_integrity_rq(req) == 0 && blk_integrity_rq(next) == 0)
return true;
if (blk_integrity_rq(req) == 0 || blk_integrity_rq(next) == 0)
return false;
if (bio_integrity(req->bio)->bip_flags !=
bio_integrity(next->bio)->bip_flags)
bip = bio_integrity(req->bio);
bip_next = bio_integrity(next->bio);
if (bip->bip_flags != bip_next->bip_flags)
return false;
if (bip->bip_flags & BIP_CHECK_APPTAG &&
bip->app_tag != bip_next->app_tag)
return false;
if (req->nr_integrity_segments + next->nr_integrity_segments >
@ -163,15 +170,21 @@ bool blk_integrity_merge_rq(struct request_queue *q, struct request *req,
bool blk_integrity_merge_bio(struct request_queue *q, struct request *req,
struct bio *bio)
{
struct bio_integrity_payload *bip, *bip_bio = bio_integrity(bio);
int nr_integrity_segs;
if (blk_integrity_rq(req) == 0 && bio_integrity(bio) == NULL)
if (blk_integrity_rq(req) == 0 && bip_bio == NULL)
return true;
if (blk_integrity_rq(req) == 0 || bio_integrity(bio) == NULL)
if (blk_integrity_rq(req) == 0 || bip_bio == NULL)
return false;
if (bio_integrity(req->bio)->bip_flags != bio_integrity(bio)->bip_flags)
bip = bio_integrity(req->bio);
if (bip->bip_flags != bip_bio->bip_flags)
return false;
if (bip->bip_flags & BIP_CHECK_APPTAG &&
bip->app_tag != bip_bio->app_tag)
return false;
nr_integrity_segs = blk_rq_count_integrity_sg(q, bio);

View File

@ -4553,8 +4553,7 @@ static void __blk_mq_realloc_hw_ctxs(struct blk_mq_tag_set *set,
* Make sure reading the old queue_hw_ctx from other
* context concurrently won't trigger uaf.
*/
synchronize_rcu_expedited();
kfree(hctxs);
kfree_rcu_mightsleep(hctxs);
hctxs = new_hctxs;
}

View File

@ -112,29 +112,26 @@ void __rq_qos_queue_depth_changed(struct rq_qos *rqos);
static inline void rq_qos_cleanup(struct request_queue *q, struct bio *bio)
{
if (unlikely(test_bit(QUEUE_FLAG_QOS_ENABLED, &q->queue_flags)) &&
q->rq_qos)
if (test_bit(QUEUE_FLAG_QOS_ENABLED, &q->queue_flags) && q->rq_qos)
__rq_qos_cleanup(q->rq_qos, bio);
}
static inline void rq_qos_done(struct request_queue *q, struct request *rq)
{
if (unlikely(test_bit(QUEUE_FLAG_QOS_ENABLED, &q->queue_flags)) &&
q->rq_qos && !blk_rq_is_passthrough(rq))
if (test_bit(QUEUE_FLAG_QOS_ENABLED, &q->queue_flags) &&
q->rq_qos && !blk_rq_is_passthrough(rq))
__rq_qos_done(q->rq_qos, rq);
}
static inline void rq_qos_issue(struct request_queue *q, struct request *rq)
{
if (unlikely(test_bit(QUEUE_FLAG_QOS_ENABLED, &q->queue_flags)) &&
q->rq_qos)
if (test_bit(QUEUE_FLAG_QOS_ENABLED, &q->queue_flags) && q->rq_qos)
__rq_qos_issue(q->rq_qos, rq);
}
static inline void rq_qos_requeue(struct request_queue *q, struct request *rq)
{
if (unlikely(test_bit(QUEUE_FLAG_QOS_ENABLED, &q->queue_flags)) &&
q->rq_qos)
if (test_bit(QUEUE_FLAG_QOS_ENABLED, &q->queue_flags) && q->rq_qos)
__rq_qos_requeue(q->rq_qos, rq);
}
@ -162,8 +159,7 @@ static inline void rq_qos_done_bio(struct bio *bio)
static inline void rq_qos_throttle(struct request_queue *q, struct bio *bio)
{
if (unlikely(test_bit(QUEUE_FLAG_QOS_ENABLED, &q->queue_flags)) &&
q->rq_qos) {
if (test_bit(QUEUE_FLAG_QOS_ENABLED, &q->queue_flags) && q->rq_qos) {
bio_set_flag(bio, BIO_QOS_THROTTLED);
__rq_qos_throttle(q->rq_qos, bio);
}
@ -172,16 +168,14 @@ static inline void rq_qos_throttle(struct request_queue *q, struct bio *bio)
static inline void rq_qos_track(struct request_queue *q, struct request *rq,
struct bio *bio)
{
if (unlikely(test_bit(QUEUE_FLAG_QOS_ENABLED, &q->queue_flags)) &&
q->rq_qos)
if (test_bit(QUEUE_FLAG_QOS_ENABLED, &q->queue_flags) && q->rq_qos)
__rq_qos_track(q->rq_qos, rq, bio);
}
static inline void rq_qos_merge(struct request_queue *q, struct request *rq,
struct bio *bio)
{
if (unlikely(test_bit(QUEUE_FLAG_QOS_ENABLED, &q->queue_flags)) &&
q->rq_qos) {
if (test_bit(QUEUE_FLAG_QOS_ENABLED, &q->queue_flags) && q->rq_qos) {
bio_set_flag(bio, BIO_QOS_MERGED);
__rq_qos_merge(q->rq_qos, rq, bio);
}
@ -189,8 +183,7 @@ static inline void rq_qos_merge(struct request_queue *q, struct request *rq,
static inline void rq_qos_queue_depth_changed(struct request_queue *q)
{
if (unlikely(test_bit(QUEUE_FLAG_QOS_ENABLED, &q->queue_flags)) &&
q->rq_qos)
if (test_bit(QUEUE_FLAG_QOS_ENABLED, &q->queue_flags) && q->rq_qos)
__rq_qos_queue_depth_changed(q->rq_qos);
}

View File

@ -1225,16 +1225,28 @@ static int loop_clr_fd(struct loop_device *lo)
}
static int
loop_set_status(struct loop_device *lo, const struct loop_info64 *info)
loop_set_status(struct loop_device *lo, blk_mode_t mode,
struct block_device *bdev, const struct loop_info64 *info)
{
int err;
bool partscan = false;
bool size_changed = false;
unsigned int memflags;
/*
* If we don't hold exclusive handle for the device, upgrade to it
* here to avoid changing device under exclusive owner.
*/
if (!(mode & BLK_OPEN_EXCL)) {
err = bd_prepare_to_claim(bdev, loop_set_status, NULL);
if (err)
goto out_reread_partitions;
}
err = mutex_lock_killable(&lo->lo_mutex);
if (err)
return err;
goto out_abort_claiming;
if (lo->lo_state != Lo_bound) {
err = -ENXIO;
goto out_unlock;
@ -1273,6 +1285,10 @@ out_unfreeze:
}
out_unlock:
mutex_unlock(&lo->lo_mutex);
out_abort_claiming:
if (!(mode & BLK_OPEN_EXCL))
bd_abort_claiming(bdev, loop_set_status);
out_reread_partitions:
if (partscan)
loop_reread_partitions(lo);
@ -1352,7 +1368,9 @@ loop_info64_to_old(const struct loop_info64 *info64, struct loop_info *info)
}
static int
loop_set_status_old(struct loop_device *lo, const struct loop_info __user *arg)
loop_set_status_old(struct loop_device *lo, blk_mode_t mode,
struct block_device *bdev,
const struct loop_info __user *arg)
{
struct loop_info info;
struct loop_info64 info64;
@ -1360,17 +1378,19 @@ loop_set_status_old(struct loop_device *lo, const struct loop_info __user *arg)
if (copy_from_user(&info, arg, sizeof (struct loop_info)))
return -EFAULT;
loop_info64_from_old(&info, &info64);
return loop_set_status(lo, &info64);
return loop_set_status(lo, mode, bdev, &info64);
}
static int
loop_set_status64(struct loop_device *lo, const struct loop_info64 __user *arg)
loop_set_status64(struct loop_device *lo, blk_mode_t mode,
struct block_device *bdev,
const struct loop_info64 __user *arg)
{
struct loop_info64 info64;
if (copy_from_user(&info64, arg, sizeof (struct loop_info64)))
return -EFAULT;
return loop_set_status(lo, &info64);
return loop_set_status(lo, mode, bdev, &info64);
}
static int
@ -1549,14 +1569,14 @@ static int lo_ioctl(struct block_device *bdev, blk_mode_t mode,
case LOOP_SET_STATUS:
err = -EPERM;
if ((mode & BLK_OPEN_WRITE) || capable(CAP_SYS_ADMIN))
err = loop_set_status_old(lo, argp);
err = loop_set_status_old(lo, mode, bdev, argp);
break;
case LOOP_GET_STATUS:
return loop_get_status_old(lo, argp);
case LOOP_SET_STATUS64:
err = -EPERM;
if ((mode & BLK_OPEN_WRITE) || capable(CAP_SYS_ADMIN))
err = loop_set_status64(lo, argp);
err = loop_set_status64(lo, mode, bdev, argp);
break;
case LOOP_GET_STATUS64:
return loop_get_status64(lo, argp);
@ -1650,8 +1670,9 @@ loop_info64_to_compat(const struct loop_info64 *info64,
}
static int
loop_set_status_compat(struct loop_device *lo,
const struct compat_loop_info __user *arg)
loop_set_status_compat(struct loop_device *lo, blk_mode_t mode,
struct block_device *bdev,
const struct compat_loop_info __user *arg)
{
struct loop_info64 info64;
int ret;
@ -1659,7 +1680,7 @@ loop_set_status_compat(struct loop_device *lo,
ret = loop_info64_from_compat(arg, &info64);
if (ret < 0)
return ret;
return loop_set_status(lo, &info64);
return loop_set_status(lo, mode, bdev, &info64);
}
static int
@ -1685,7 +1706,7 @@ static int lo_compat_ioctl(struct block_device *bdev, blk_mode_t mode,
switch(cmd) {
case LOOP_SET_STATUS:
err = loop_set_status_compat(lo,
err = loop_set_status_compat(lo, mode, bdev,
(const struct compat_loop_info __user *)arg);
break;
case LOOP_GET_STATUS:

View File

@ -255,20 +255,6 @@ static inline struct request *__ublk_check_and_get_req(struct ublk_device *ub,
u16 q_id, u16 tag, struct ublk_io *io, size_t offset);
static inline unsigned int ublk_req_build_flags(struct request *req);
static void ublk_partition_scan_work(struct work_struct *work)
{
struct ublk_device *ub =
container_of(work, struct ublk_device, partition_scan_work);
if (WARN_ON_ONCE(!test_and_clear_bit(GD_SUPPRESS_PART_SCAN,
&ub->ub_disk->state)))
return;
mutex_lock(&ub->ub_disk->open_mutex);
bdev_disk_changed(ub->ub_disk, false);
mutex_unlock(&ub->ub_disk->open_mutex);
}
static inline struct ublksrv_io_desc *
ublk_get_iod(const struct ublk_queue *ubq, unsigned tag)
{
@ -1597,6 +1583,27 @@ static void ublk_put_disk(struct gendisk *disk)
put_device(disk_to_dev(disk));
}
static void ublk_partition_scan_work(struct work_struct *work)
{
struct ublk_device *ub =
container_of(work, struct ublk_device, partition_scan_work);
/* Hold disk reference to prevent UAF during concurrent teardown */
struct gendisk *disk = ublk_get_disk(ub);
if (!disk)
return;
if (WARN_ON_ONCE(!test_and_clear_bit(GD_SUPPRESS_PART_SCAN,
&disk->state)))
goto out;
mutex_lock(&disk->open_mutex);
bdev_disk_changed(disk, false);
mutex_unlock(&disk->open_mutex);
out:
ublk_put_disk(disk);
}
/*
* Use this function to ensure that ->canceling is consistently set for
* the device and all queues. Do not set these flags directly.
@ -2041,7 +2048,7 @@ static void ublk_stop_dev(struct ublk_device *ub)
mutex_lock(&ub->mutex);
ublk_stop_dev_unlocked(ub);
mutex_unlock(&ub->mutex);
flush_work(&ub->partition_scan_work);
cancel_work_sync(&ub->partition_scan_work);
ublk_cancel_dev(ub);
}

View File

@ -5,8 +5,7 @@
config MISC_RP1
tristate "RaspberryPi RP1 misc device"
depends on OF_IRQ && OF_OVERLAY && PCI_MSI && PCI_QUIRKS
select PCI_DYNAMIC_OF_NODES
depends on OF_IRQ && PCI_MSI
help
Support the RP1 peripheral chip found on Raspberry Pi 5 board.
@ -15,6 +14,3 @@ config MISC_RP1
The driver is responsible for enabling the DT node once the PCIe
endpoint has been configured, and handling interrupts.
This driver uses an overlay to load other drivers to support for
RP1 internal sub-devices.

View File

@ -1,3 +1,2 @@
# SPDX-License-Identifier: GPL-2.0-only
obj-$(CONFIG_MISC_RP1) += rp1-pci.o
rp1-pci-objs := rp1_pci.o rp1-pci.dtbo.o
obj-$(CONFIG_MISC_RP1) += rp1_pci.o

View File

@ -1,25 +0,0 @@
// SPDX-License-Identifier: (GPL-2.0 OR MIT)
/*
* The dts overlay is included from the dts directory so
* it can be possible to check it with CHECK_DTBS while
* also compile it from the driver source directory.
*/
/dts-v1/;
/plugin/;
/ {
fragment@0 {
target-path="";
__overlay__ {
compatible = "pci1de4,1";
#address-cells = <3>;
#size-cells = <2>;
interrupt-controller;
#interrupt-cells = <2>;
#include "arm64/broadcom/rp1-common.dtsi"
};
};
};

View File

@ -34,16 +34,11 @@
/* Interrupts */
#define RP1_INT_END 61
/* Embedded dtbo symbols created by cmd_wrap_S_dtb in scripts/Makefile.lib */
extern char __dtbo_rp1_pci_begin[];
extern char __dtbo_rp1_pci_end[];
struct rp1_dev {
struct pci_dev *pdev;
struct irq_domain *domain;
struct irq_data *pcie_irqds[64];
void __iomem *bar1;
int ovcs_id; /* overlay changeset id */
bool level_triggered_irq[RP1_INT_END];
};
@ -184,24 +179,13 @@ static void rp1_unregister_interrupts(struct pci_dev *pdev)
static int rp1_probe(struct pci_dev *pdev, const struct pci_device_id *id)
{
u32 dtbo_size = __dtbo_rp1_pci_end - __dtbo_rp1_pci_begin;
void *dtbo_start = __dtbo_rp1_pci_begin;
struct device *dev = &pdev->dev;
struct device_node *rp1_node;
bool skip_ovl = true;
struct rp1_dev *rp1;
int err = 0;
int i;
/*
* Either use rp1_nexus node if already present in DT, or
* set a flag to load it from overlay at runtime
*/
rp1_node = of_find_node_by_name(NULL, "rp1_nexus");
if (!rp1_node) {
rp1_node = dev_of_node(dev);
skip_ovl = false;
}
rp1_node = dev_of_node(dev);
if (!rp1_node) {
dev_err(dev, "Missing of_node for device\n");
@ -276,42 +260,29 @@ static int rp1_probe(struct pci_dev *pdev, const struct pci_device_id *id)
rp1_chained_handle_irq, rp1);
}
if (!skip_ovl) {
err = of_overlay_fdt_apply(dtbo_start, dtbo_size, &rp1->ovcs_id,
rp1_node);
if (err)
goto err_unregister_interrupts;
}
err = of_platform_default_populate(rp1_node, NULL, dev);
if (err) {
dev_err_probe(&pdev->dev, err, "Error populating devicetree\n");
goto err_unload_overlay;
goto err_unregister_interrupts;
}
if (skip_ovl)
of_node_put(rp1_node);
of_node_put(rp1_node);
return 0;
err_unload_overlay:
of_overlay_remove(&rp1->ovcs_id);
err_unregister_interrupts:
rp1_unregister_interrupts(pdev);
err_put_node:
if (skip_ovl)
of_node_put(rp1_node);
of_node_put(rp1_node);
return err;
}
static void rp1_remove(struct pci_dev *pdev)
{
struct rp1_dev *rp1 = pci_get_drvdata(pdev);
struct device *dev = &pdev->dev;
of_platform_depopulate(dev);
of_overlay_remove(&rp1->ovcs_id);
rp1_unregister_interrupts(pdev);
}

View File

@ -6308,7 +6308,6 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_XILINX, 0x5020, of_pci_make_dev_node);
DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_XILINX, 0x5021, of_pci_make_dev_node);
DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_REDHAT, 0x0005, of_pci_make_dev_node);
DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_EFAR, 0x9660, of_pci_make_dev_node);
DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_RPI, PCI_DEVICE_ID_RPI_RP1_C0, of_pci_make_dev_node);
/*
* Devices known to require a longer delay before first config space access

View File

@ -1072,7 +1072,7 @@ static void __ris_msmon_read(void *arg)
u64 now;
bool nrdy = false;
bool config_mismatch;
bool overflow;
bool overflow = false;
struct mon_read *m = arg;
struct mon_cfg *ctx = m->ctx;
bool reset_on_next_read = false;
@ -1176,10 +1176,11 @@ static void __ris_msmon_read(void *arg)
}
mpam_mon_sel_unlock(msc);
if (nrdy) {
if (nrdy)
m->err = -EBUSY;
if (m->err)
return;
}
*m->val += now;
}

View File

@ -644,14 +644,20 @@ static int erofs_fc_fill_super(struct super_block *sb, struct fs_context *fc)
* fs contexts (including its own) due to self-controlled RO
* accesses/contexts and no side-effect changes that need to
* context save & restore so it can reuse the current thread
* context. However, it still needs to bump `s_stack_depth` to
* avoid kernel stack overflow from nested filesystems.
* context.
* However, we still need to prevent kernel stack overflow due
* to filesystem nesting: just ensure that s_stack_depth is 0
* to disallow mounting EROFS on stacked filesystems.
* Note: s_stack_depth is not incremented here for now, since
* EROFS is the only fs supporting file-backed mounts for now.
* It MUST change if another fs plans to support them, which
* may also require adjusting FILESYSTEM_MAX_STACK_DEPTH.
*/
if (erofs_is_fileio_mode(sbi)) {
sb->s_stack_depth =
file_inode(sbi->dif0.file)->i_sb->s_stack_depth + 1;
if (sb->s_stack_depth > FILESYSTEM_MAX_STACK_DEPTH) {
erofs_err(sb, "maximum fs stacking depth exceeded");
inode = file_inode(sbi->dif0.file);
if ((inode->i_sb->s_op == &erofs_sops && !sb->s_bdev) ||
inode->i_sb->s_stack_depth) {
erofs_err(sb, "file-backed mounts cannot be applied to stacked fses");
return -ENOTBLK;
}
}

View File

@ -947,16 +947,13 @@ static bool io_acct_for_each_worker(struct io_wq_acct *acct,
return ret;
}
static bool io_wq_for_each_worker(struct io_wq *wq,
static void io_wq_for_each_worker(struct io_wq *wq,
bool (*func)(struct io_worker *, void *),
void *data)
{
for (int i = 0; i < IO_WQ_ACCT_NR; i++) {
if (!io_acct_for_each_worker(&wq->acct[i], func, data))
return false;
}
return true;
for (int i = 0; i < IO_WQ_ACCT_NR; i++)
if (io_acct_for_each_worker(&wq->acct[i], func, data))
break;
}
static bool io_wq_worker_wake(struct io_worker *worker, void *data)

View File

@ -2376,7 +2376,9 @@ static int process_auth_done(struct ceph_connection *con, void *p, void *end)
ceph_decode_64_safe(&p, end, global_id, bad);
ceph_decode_32_safe(&p, end, con->v2.con_mode, bad);
ceph_decode_32_safe(&p, end, payload_len, bad);
ceph_decode_need(&p, end, payload_len, bad);
dout("%s con %p global_id %llu con_mode %d payload_len %d\n",
__func__, con, global_id, con->v2.con_mode, payload_len);

View File

@ -1417,7 +1417,7 @@ static int mon_handle_auth_done(struct ceph_connection *con,
if (!ret)
finish_hunting(monc);
mutex_unlock(&monc->mutex);
return 0;
return ret;
}
static int mon_handle_auth_bad_method(struct ceph_connection *con,

View File

@ -1586,6 +1586,7 @@ static enum calc_target_result calc_target(struct ceph_osd_client *osdc,
struct ceph_pg_pool_info *pi;
struct ceph_pg pgid, last_pgid;
struct ceph_osds up, acting;
bool should_be_paused;
bool is_read = t->flags & CEPH_OSD_FLAG_READ;
bool is_write = t->flags & CEPH_OSD_FLAG_WRITE;
bool force_resend = false;
@ -1654,10 +1655,16 @@ static enum calc_target_result calc_target(struct ceph_osd_client *osdc,
&last_pgid))
force_resend = true;
if (t->paused && !target_should_be_paused(osdc, t, pi)) {
t->paused = false;
should_be_paused = target_should_be_paused(osdc, t, pi);
if (t->paused && !should_be_paused) {
unpaused = true;
}
if (t->paused != should_be_paused) {
dout("%s t %p paused %d -> %d\n", __func__, t, t->paused,
should_be_paused);
t->paused = should_be_paused;
}
legacy_change = ceph_pg_compare(&t->pgid, &pgid) ||
ceph_osds_changed(&t->acting, &acting,
t->used_replica || any_change);
@ -4281,6 +4288,9 @@ static void osd_fault(struct ceph_connection *con)
goto out_unlock;
}
osd->o_sparse_op_idx = -1;
ceph_init_sparse_read(&osd->o_sparse_read);
if (!reopen_osd(osd))
kick_osd_requests(osd);
maybe_request_map(osdc);

View File

@ -241,22 +241,26 @@ static struct crush_choose_arg_map *alloc_choose_arg_map(void)
static void free_choose_arg_map(struct crush_choose_arg_map *arg_map)
{
if (arg_map) {
int i, j;
int i, j;
WARN_ON(!RB_EMPTY_NODE(&arg_map->node));
if (!arg_map)
return;
WARN_ON(!RB_EMPTY_NODE(&arg_map->node));
if (arg_map->args) {
for (i = 0; i < arg_map->size; i++) {
struct crush_choose_arg *arg = &arg_map->args[i];
for (j = 0; j < arg->weight_set_size; j++)
kfree(arg->weight_set[j].weights);
kfree(arg->weight_set);
if (arg->weight_set) {
for (j = 0; j < arg->weight_set_size; j++)
kfree(arg->weight_set[j].weights);
kfree(arg->weight_set);
}
kfree(arg->ids);
}
kfree(arg_map->args);
kfree(arg_map);
}
kfree(arg_map);
}
DEFINE_RB_FUNCS(choose_arg_map, struct crush_choose_arg_map, choose_args_index,
@ -1979,11 +1983,13 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end, bool msgr2,
sizeof(u64) + sizeof(u32), e_inval);
ceph_decode_copy(p, &fsid, sizeof(fsid));
epoch = ceph_decode_32(p);
BUG_ON(epoch != map->epoch+1);
ceph_decode_copy(p, &modified, sizeof(modified));
new_pool_max = ceph_decode_64(p);
new_flags = ceph_decode_32(p);
if (epoch != map->epoch + 1)
goto e_inval;
/* full map? */
ceph_decode_32_safe(p, end, len, e_inval);
if (len > 0) {