Commit graph

1,464,522 commits

Author SHA1 Message Date
Asbjørn Sloth Tønnesen
b8bcc17f58 wireguard: netlink: lower .maxattr for WG_CMD_GET_DEVICE
Previously .maxattr was shared for both WG_CMD_GET_DEVICE and
WG_CMD_SET_DEVICE. Now that it is split, then we can lower it
for WG_CMD_GET_DEVICE to follow the documentation which defines
.maxattr as WGDEVICE_A_IFNAME for WG_CMD_GET_DEVICE.

$ grep -hC5 'one but not both of:' include/uapi/linux/wireguard.h
 * WG_CMD_GET_DEVICE
 * -----------------
 *
 * May only be called via NLM_F_REQUEST | NLM_F_DUMP. The command
 * should contain one but not both of:
 *
 *    WGDEVICE_A_IFINDEX: NLA_U32
 *    WGDEVICE_A_IFNAME: NLA_NUL_STRING, maxlen IFNAMSIZ - 1
 *
 * The kernel will then return several messages [...]

While other attributes weren't rejected previously, the consensus
is that nobody sends those attributes, so nothing should break.

Link: https://lore.kernel.org/r/aRyLoy2iqbkUipZW@zx2c4.com/
Suggested-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.net>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2025-12-01 03:25:09 +01:00
Asbjørn Sloth Tønnesen
73af07d7f2 wireguard: netlink: convert to split ops
This patch converts WireGuard from using the legacy struct genl_ops
to struct genl_split_ops, by applying the same transformation as
genl_cmd_full_to_split() would otherwise do at runtime.

WGDEVICE_A_MAX is swapped for WGDEVICE_A_PEERS, while they are
currently equivalent, then .maxattr should be the maximum attribute
that a given command supports, and not change along with WGDEVICE_A_MAX.

This is an incremental step towards adopting netlink policy code
generated by ynl-gen, ensuring that the code and spec is aligned.

This is a trivial patch with no behavioural changes intended.

Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.net>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2025-12-01 03:25:09 +01:00
Asbjørn Sloth Tønnesen
9755f9de8f wireguard: netlink: use WG_KEY_LEN in policies
When converting the netlink policies to YNL, the constants used
in the policy have to be visible to userspace.

As NOISE_*_KEY_LEN isn't visible to userspace, change the policy
to use WG_KEY_LEN, as also documented in the UAPI header:

$ grep WG_KEY_LEN include/uapi/linux/wireguard.h
 *    WGDEVICE_A_PRIVATE_KEY: NLA_EXACT_LEN, len WG_KEY_LEN
 *    WGDEVICE_A_PUBLIC_KEY: NLA_EXACT_LEN, len WG_KEY_LEN
 *            WGPEER_A_PUBLIC_KEY: NLA_EXACT_LEN, len WG_KEY_LEN
 *            WGPEER_A_PRESHARED_KEY: NLA_EXACT_LEN, len WG_KEY_LEN
 [...]

Add a couple of BUILD_BUG_ON() to ensure that they stay in sync.

No behavioural changes intended.

Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.net>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2025-12-01 03:25:09 +01:00
Asbjørn Sloth Tønnesen
aea199fa15 wireguard: netlink: validate nested arrays in policy
Use NLA_POLICY_NESTED_ARRAY() to perform nested array validation
in the policy validation step.

The nested policy was already enforced through nla_parse_nested(),
however extack wasn't passed previously, so no fancy error messages.

With the nested attributes being validated directly in the policy, the
policy argument can be set to NULL in the calls to nla_parse_nested().

Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.net>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2025-12-01 03:25:09 +01:00
Asbjørn Sloth Tønnesen
e0e1b6db2e wireguard: netlink: enable strict genetlink validation
WireGuard is a modern enough genetlink family, that it doesn't need
resv_start_op. It already had policies in place when it was first
merged, it has also never used the reserved field, or other things
toggled by resv_start_op.

wireguard-tools have always used zero initialized memory, and have never
touched the reserved field, neither have any other clients I have
checked. Closed-source clients are much more likely to use the
embeddedable library from wireguard-tools, than a DIY implementation
using uninitialized memory.

Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.net>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2025-12-01 03:25:08 +01:00
Michael S. Tsirkin
205dd7a5d6 virtio_pci: drop kernel.h
virtio UAPI headers really have no business pulling in kernel.h
Replace it with const.h which seems to be what's needed
for __KERNEL_DIV_ROUND_UP.

Fixes: 7c1ae151e8 ("virtio_pci: Introduce device parts access commands")
Cc: Yishai Hadas <yishaih@nvidia.com>
Cc: Alex Williamson <alex.williamson@redhat.com>
Message-ID: <7a73b6c6af67e13b86633cd7bf11ad56b5d9809b.1763535341.git.mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2025-11-30 18:02:43 -05:00
Michael S. Tsirkin
dfe44d177a vhost: switch to arrays of feature bits
The current interface where caller has to know in which 64 bit chunk
each bit is, is inelegant and fragile.
Let's simply use arrays of bits.
By using unroll macros text size grows only slightly.

Message-ID: <637e182e139980e5930d50b928ba5ac072d628a9.1764225384.git.mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2025-11-30 18:02:43 -05:00
Linus Torvalds
7d0a66e4bb Linux 6.18 v6.18 2025-11-30 14:42:10 -08:00
Frederic Weisbecker
9a08942f17 Merge branch 'rcu/misc' into next
- In order to prepare the layout for nohz_full work deferral to
  user exit, the context tracking state must shrink the counter
  of transitions to/from RCU not watching. The only possible hazard
  is to trigger wrap-around more easily, delaying a bit grace periods
  when that happens. This should be a rare event though. Yet add
  debugging and torture code to test that assumption.

- Fix memory leak on locktorture module

- Annotate accesses in rculist_nulls.h to prevent from KCSAN warnings.
  On recent discussions, we also concluded that all those WRITE_ONCE()
  and READ_ONCE() on list APIs deserve appropriate comments. Something
  to be expected for the next cycle.

- Provide a script to apply several configs to several commits with torture.

- Allow torture to reuse a build directory in order to save needless
  rebuild time.

- Various cleanups.
2025-11-30 22:20:33 +01:00
Johan Hovold
b276445e98
clk: keystone: fix compile testing
Some keystone clock drivers can be selected when COMPILE_TEST is
enabled but since commit b745c0794e ("clk: keystone: Add sci-clk
driver support") they are never actually built.

Enable compile testing by allowing the build system to process the
keystone drivers.

Fixes: b745c0794e ("clk: keystone: Add sci-clk driver support")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
2025-11-30 12:06:21 -08:00
Johan Hovold
9c75986a29
clk: keystone: syscon-clk: fix regmap leak on probe failure
The mmio regmap allocated during probe is never freed.

Switch to using the device managed allocator so that the regmap is
released on probe failures (e.g. probe deferral) and on driver unbind.

Fixes: a250cd4c19 ("clk: keystone: syscon-clk: Do not use syscon helper to build regmap")
Cc: stable@vger.kernel.org	# 6.15
Cc: Andrew Davis <afd@ti.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
2025-11-30 12:05:45 -08:00
Stephen Boyd
1413717ad0
clk: qcom: Mark camcc_sm7150_hws static
This isn't used outside this file. Mark it static.

Fixes: 9f0532da42 ("clk: qcom: Add Camera Clock Controller driver for SM7150")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
2025-11-30 12:04:10 -08:00
Stephen Boyd
c2c332d78c Qualcomm clock updates for v6.19
Introduce support for the IPQ5424 Network Subsystem Clock Controller and
 the video clock controller for SM8750.
 
 Describe the parent/child relationship among the Titan GDSCs on SM845,
 SM6350, SM7150, SM8250, SM8450, and SM8550.
 
 Define display subsystem reset signals for SM6350, SM7150, and SDM660.
 
 Add missing USB4 clocks and resets on Hamoa.
 
 Address a variety of smaller issues across the drivers, and a few more
 Kconfig dependency issues.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEBd4DzF816k8JZtUlCx85Pw2ZrcUFAmknOH4ACgkQCx85Pw2Z
 rcUzOQ//dZEwgnhAf2sXjhpXRJtS9rblarhKjn3XPR9BiarB6lBgCxSPTvgClbY1
 6eGedSsjz/gg9L4uBZK+HkgbLUtIZVUlSh6gwUSr3/rRMSeYvgIuSwg+zbVlQpR1
 7m/wKGmfv6E1s5llfNSb7CW2Wsg5VybtuIf6qt0EJp09h6KbGkOvN4O2iDzCGOrC
 YSRFLVGamTNj6zCBZE5bUoz7GUy/aI7fBE93qdHw4AE8HaiV2VphCD+WRv37ylDG
 H4NgY6pFC7RU4wjYtGKfKhzQlz2HRqoGCmIU7R00TTyrcMbOaMdqAqMN/X76D68U
 f8eeu5eFJUt066w6ihYBaNNJdHd1xyEKjcuVds70Vv9Sv1yQXPwFKEKfuQ+uJALa
 IdtcT/cE8KxaQrLcO7jQXeK+SUAPc9xLhneAL06U6ZPcYmoyD4XFnbdgz8Lx0/AM
 7CsWaBEffHyoXwyClt1fIEdbGFEXiM/PzoaJ8UPbuCqc9NbyHOk571Zm9Rqd9i0S
 wbR9qZ/koaAKu66qtQV2mRAjgUPJJ/etRiMCcedRdoTFIqj1xS1x6IYUGdFLqMrC
 J9aTEYqL/t+ZoqHKkLDAuM1BrjtgDHd1XbZ/ldxkAWd8A509kS+bNIOTkqwKvQk4
 wEO0kx3FBdOKv/BLGyU57QsOkAE2ACQ8akkqbdhFQC0nFla12Lk=
 =AcfU
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQJIBAABCAAyFiEE9L57QeeUxqYDyoaDrQKIl8bklSUFAmksn6MUHHN3Ym95ZEBj
 aHJvbWl1bS5vcmcACgkQrQKIl8bklSW2sRAAkDablW+O9uP+CxK/2p6OUslDpS0e
 oMedJbOnR+BoLQD39AfgOZMS03pV8hVSY/jJzENAVzr9bex/rgb3Y2k0IZfAfBgx
 NILk5vO3My4q2WXASG1pSu4jwI6/4OI69uX4mkLnOF/NdsLBixLKqbu6dUQ82R7S
 kppvuy9PNcxBrAswJFDY1y4odvrTwLuL2xUFf3Gawdbf8cc4hOpvTrYHQ+wSFdje
 Vms2GLbAV4DRAzAE124evXPLWXdqesnlWSToCfK8n1Q48S2IRtH512x8Hk9/rxhK
 sUQp1GZk582d5frnyrr5IV3upzjmOZHE/0QTF/FAQzCOGpslPmNwqLp2jSTZIz3G
 jQwAJWO13L8xy6YFGZcQzMcXUHiLiKevQoOY9JgecTMWddRN5aYB7xKCGML12ELC
 xElUyvx9hrZfU1tpxdnT9Y56TtUh53TNZH3qK4MEVM5SEjXcBYSbxTvz1+jOMw9t
 UCIvfErUDWiKdxIcxd+krpA7hJBPkvJbWRQqfZgKAHURiw18x9rzRjyTIbqCP5sL
 p24NWo2472o/U4zr7/Izz8PbBhEc8jtlzmgoNBoGk/QbJeVGsy/J5Cg7G2B6xjIS
 DoEALQ2+iMfGIN6eiQzoENCSwrRHGpRCSjJqkIEuo+rqTSpxm8J/1jm+w8DwXb4v
 V/myHZfh0hTtRA8=
 =yEfl
 -----END PGP SIGNATURE-----

Merge tag 'qcom-clk-for-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into clk-qcom

Pull Qualcomm clk driver updates from Bjorn Andersson:

 - Qualcomm IPQ5424 Network Subsystem Clock Controller
 - Qualcomm SM8750 Video Clock Controller
 - Describe parent/child relationship among the Qualcomm Titan
   GDSCs on SM845, SM6350, SM7150, SM8250, SM8450, and SM8550
 - Define display subsystem reset signals for SM6350, SM7150, and SDM660
 - Add missing USB4 clocks and resets on Hamoa
 - Address a variety of smaller issues across the drivers, and a
   few more Kconfig dependency issues

* tag 'qcom-clk-for-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (47 commits)
  clk: qcom: x1e80100-dispcc: Add USB4 router link resets
  dt-bindings: clock: qcom: x1e80100-dispcc: Add USB4 router link resets
  clk: qcom: videocc-sm8750: Add video clock controller driver for SM8750
  dt-bindings: clock: qcom: Add SM8750 video clock controller
  clk: qcom: branch: Extend invert logic for branch2 mem clocks
  clk: qcom: ecpricc-qdu100: Add mem_enable_mask to the clock memory branch
  clk: qcom: clk_mem_branch: add enable mask and invert flags
  clk: qcom: mmcc-sdm660: Add missing MDSS reset
  dt-bindings: clock: mmcc-sdm660: Add missing MDSS reset
  clk: qcom: use different Kconfig prompts for APSS IPQ5424/6018 drivers
  clk: qcom: apss-ipq5424: remove unused 'apss_clk' structure
  dt-bindings: clock: qcom: Add Kaanapali Global clock controller
  dt-bindings: clock: qcom: Document the Kaanapali TCSR Clock Controller
  dt-bindings: clock: qcom-rpmhcc: Add RPMHCC for Kaanapali
  clk: qcom: tcsrcc-glymur: Update register offsets for clock refs
  clk: qcom: gcc-qcs615: Update the SDCC clock to use shared_floor_ops
  clk: qcom: camcc-sm7150: Fix PLL config of PLL2
  clk: qcom: camcc-sm6350: Fix PLL config of PLL2
  clk: qcom: Add NSS clock controller driver for IPQ5424
  clk: qcom: gcc-ipq5424: Add gpll0_out_aux clock
  ...
2025-11-30 11:47:23 -08:00
Stephen Boyd
53fbbc29dd SCMI clock-ids and max-clk-number removal from dt-binding on RK3568 as
well as clock drivers for the new SoCs RV1126B and RK3506.
 -----BEGIN PGP SIGNATURE-----
 
 iQFEBAABCAAuFiEE7v+35S2Q1vLNA3Lx86Z5yZzRHYEFAmkkzhgQHGhlaWtvQHNu
 dGVjaC5kZQAKCRDzpnnJnNEdgYDxCACjRIEwjNvPpGXQlv861h6LnbvDZH8Vo0xc
 7hHUHIUTVSno/kRCWccfIP8rgk0weIAL8jb2lBZjsM2ECYEnWLwg74zFDlVfJzF+
 Re4vJ2cUYECgSzDIbVIFXQ1uflteOj9mqOcCmw1f9e6Pl6uO0aviYI5Bk+wcm4XI
 rmqwQVt4Q4go2Fx0esH/ZIPrIgCDIozaSggA1H1WfV3sLgS7VXRKIo7unMQV3wpi
 P6RmREuaHIVdpYRy8IixCAImUQ7Xx3RF39hKgNZWzH53a6T7DUfMeaTLybpxiL4K
 TPE18wlBlzvRSjrypx/Ydj2i3ZMf9W08gbtAYXFmhIaIEHLLznvS
 =4ayZ
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQJIBAABCAAyFiEE9L57QeeUxqYDyoaDrQKIl8bklSUFAmksnfwUHHN3Ym95ZEBj
 aHJvbWl1bS5vcmcACgkQrQKIl8bklSUTnw//fd8PckAtIeH56BokFBoJq3Kd9R/x
 iymVIknVLq5L63K3EnXeNmbXKyQRSEKjv5ZXiG5AX7kw3BFtcLuOs6zIpLi5AdKq
 RgH+/R0Y6RAdHKH+oeIlCa51pysuWIvq1YPEH7gHXiZa+Usxk2BNS2wfopEUtZLj
 kOm9Hq5fZ+7Hmimw1iUoK9FnJwZYSzxcXSmfK2GLiyKRG/fnKXxEDUObOnAlb0PW
 OaLBJg/UoSIMoB6yTryOWb3h4Pv5mgx33Cui3iNHybEhaK6PA3jcGntRgM7tZMe6
 Ax09qiDaplcdEiN2KCnB8rIFBf/VWMbrWD9XFfk+4Jlh/kq/iYTsTxKjH33SQfIj
 qTVMpCzn9KmKYjIPT7UahSMuFIs6Pr5j94joeOZ7jnQtutiFJjsFhYZAoL2sDXcX
 ux2RjUSczetdUiekkq+Xtp0Unu7dgW0od+KrmPzpa2ZBU+WHGAk/umD6SsXFChmg
 OG86oCot6Oir5iAAyQVGmetkPqrwaGxNq8nI0U/IllaivIrRcgteYFknuLRzFhcE
 BbOkL8z42HHaxqWUgGLA+Gt+rhexaemF8yvXP2ZbVfmXR+ISPj+ocFifZ5+P7NGN
 3wosjIFVZ94gEM3/DIos4lE6vxoowcIOomfkFDIdFc92VrbDcgEmWoFNXSgU57kL
 kUVkAUWde/B+h8s=
 =FhN1
 -----END PGP SIGNATURE-----

Merge tag 'v6.19-rockchip-clk1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into clk-rockchip

Pull Rockchip clk driver updates from Heiko Stuebner:

 - SCMI clock-ids and max-clk-number removal from dt-binding on RK3568
 - Clock drivers for the new Rockchip SoCs RV1126B and RK3506

* tag 'v6.19-rockchip-clk1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip:
  clk: rockchip: Add clock and reset driver for RK3506
  dt-bindings: clock: rockchip: Add RK3506 clock and reset unit
  clk: rockchip: Add clock controller for the RV1126B
  dt-bindings: clock, reset: Add support for rv1126b
  clk: rockchip: Implement rockchip_clk_register_armclk_multi_pll()
  dt-bindings: clock: rk3568: Drop CLK_NR_CLKS define
  clk: rockchip: rk3568: Drop CLK_NR_CLKS usage
  dt-bindings: clock: rk3568: Add SCMI clock ids
2025-11-30 11:41:09 -08:00
Stephen Boyd
b5b9e93bbf Microchip clock updates for v6.19
This update includes:
 - PolarFire SoC clock driver updates to use regmaps instead of iomem
   addresses; with it, the reset control driver support for non-auxiliary
   bus probing was included as it now depends on the regmap registered
   by the clock controller driver
 - a cleanup patch for the LAN966X driver
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQTsZ8eserC1pmhwqDmejrg/N2X7/QUCaSC8JAAKCRCejrg/N2X7
 /VJKAQCIayI8cmVmk9G6rdNhwk/h0BxPticIp5kPcROOy5MffgEAolzmLq7bitkY
 /AkEzmYybLvD75T/mPpB2l+HSXoVIAM=
 =oIV5
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQJIBAABCAAyFiEE9L57QeeUxqYDyoaDrQKIl8bklSUFAmksnKsUHHN3Ym95ZEBj
 aHJvbWl1bS5vcmcACgkQrQKIl8bklSX94g//WgI47agitjb8GlCz+xuH3wE1uA/n
 dD9FgrfkpCVetaz8avQ+1ZzfEd5Rl9kt93sNjuB62OknDtq0MSdE7fsiZ5freC+j
 qTGFLuFuKKsdOJbcJFKfmYFMCfDwU9AEd6bLnOCA+2we6y5s6pk1YNYZy52zzpXX
 Lto3sXnwtBzYTMJ0G1nTD+BiJGjOwmC9+xZ6Ndpp4NqO5bd+1F7tZACJUQ/53lwF
 QVctv//5NqxQ+ZrCog7FyqY2SJIN0vJ57M6RCMAqdAyihnEh8r/U4H1YdB7tjYSd
 csl+vTdFSoGCdaxMMEAsUFqlQ+1PwpIg+LzCONCaVtSoN+jW6VgTfPnM1sbNpQjr
 CpC0FCuv58aM+vVsuIE10hUdu6ZRR/cJpwZk2u1xeCeuT1I1sqXfNfMd2P+hgrEP
 xoBZavClb3CksMX1GemK46aCVCpG8skJ7+QHTSG3pvkyS4iYgTOQyqXPt7mPFvD7
 M3nWer62YS+52+9ybC8vanRrE5/RLNxOMgUl0MV5pXy8EwLPmcp9FVAv0bl+RZHv
 Hqb4zGmngFmgQ3v9BOTZsvbfA7/3mG0KtYm2+MYURueObNezKDM64hbt8OTKTYYt
 nTAFCp+RCo7FwP2gWpvApaWhDr52rC+1BVwVb0/jSoqlSn7MNQiPbrUtQw6e0hrx
 pE0yo9s+g2ik3mo=
 =B8Ia
 -----END PGP SIGNATURE-----

Merge tag 'clk-microchip-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into clk-microchip

Pull Microchip clk driver updates from Claudiu Beznea:

 - PolarFire SoC clock driver updates to use regmaps instead of iomem
   addresses; with it, the reset control driver support for non-auxiliary
   bus probing was included as it now depends on the regmap registered
   by the clock controller driver
 - A cleanup patch for the LAN966X clk driver

* tag 'clk-microchip-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux:
  reset: mpfs: add non-auxiliary bus probing
  clk: lan966x: remove unused dt-bindings include
  clk: microchip: mpfs: use regmap for clocks
  dt-bindings: clk: microchip: mpfs: remove first reg region
2025-11-30 11:35:42 -08:00
Nathan Chancellor
cf33f0b7df
clk: samsung: exynos-clkout: Assign .num before accessing .hws
Commit f316cdff8d ("clk: Annotate struct clk_hw_onecell_data with
__counted_by") annotated the hws member of 'struct clk_hw_onecell_data'
with __counted_by, which informs the bounds sanitizer (UBSAN_BOUNDS)
about the number of elements in .hws[], so that it can warn when .hws[]
is accessed out of bounds. As noted in that change, the __counted_by
member must be initialized with the number of elements before the first
array access happens, otherwise there will be a warning from each access
prior to the initialization because the number of elements is zero. This
occurs in exynos_clkout_probe() due to .num being assigned after .hws[]
has been accessed:

  UBSAN: array-index-out-of-bounds in drivers/clk/samsung/clk-exynos-clkout.c:178:18
  index 0 is out of range for type 'clk_hw *[*]'

Move the .num initialization to before the first access of .hws[],
clearing up the warning.

Cc: stable@vger.kernel.org
Fixes: f316cdff8d ("clk: Annotate struct clk_hw_onecell_data with __counted_by")
Reported-by: Jochen Sprickerhof <jochen@sprickerhof.de>
Closes: https://lore.kernel.org/aSIYDN5eyKFKoXKL@eldamar.lan/
Tested-by: Jochen Sprickerhof <jochen@sprickerhof.de>
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Reviewed-by: Kees Cook <kees@kernel.org>
Reviewed-by: Sam Protsenko <semen.protsenko@linaro.org>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
2025-11-30 11:34:00 -08:00
Linus Torvalds
e69c7c1751 - Have timekeeping aux clocks sysfs interface setup function return an
error code on failure instead of success
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmksJ6kACgkQEsHwGGHe
 VUqxARAAqEqj33/ErgPpytnpRkuJwGCGeSO879MMAoLTFpmALmoQZlqhA+WF1xYw
 T5QF7nGlBeW/GwFAVlm1riqI6iPk2iUZWczS9bq0wjtR0XNHReCqLGdRe+4DHEjb
 PtyXMrrQgq5FuvHaIkuSUxBKtyHn+KMObldxp2azpO8nfUubDSCCgw9aQfm2osHi
 JIldKOPdFKRv8uLnBBbI2A+6cFrqXr/ptAzx8C3hov7sN0jBODOitb7fNerEb+T4
 U5awKzpK3WzcilyrlEZMCFXRV5e3naTgnUDd8/7t9m0SA10K5oSIM1zggVLRWN8Z
 AA7XMpbRAl1S23GUVjSAM/vOMmaJJAuIMJ4ZXIKoTFVQJ3kenzY4GtDdObh05ID4
 971y0hXrko74Qq42oME4UHSKexcR4vIBwXC0J9g04EbtKQ/sm6uhoUlb2Xb/UfxR
 CPxzDqy1pFkjuMG49yu3JE2fUHOryiRcNUUgas2PBKjKG0KyZPcJWa/fRsk5LlLy
 oeUXx/hXOq6Nw0ydyzI7iJgAM5SbM4A5p/hxlWmQnfXJ2EQdmkORTmMkloaUvB7u
 vWaOd9I+D3iSzNaw4zP0kzgPRX70PCRn1qakT3zQ340c9vNT/lYQjRelK7gfYZF6
 HOBID2Pl3+pqUTfli6qxbXsgqH4hbCWSomDbY9t2AFK6h6K2l8Q=
 =CFYj
 -----END PGP SIGNATURE-----

Merge tag 'timers_urgent_for_v6.18_rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull timer fix from Borislav Petkov:

 - Have timekeeping aux clocks sysfs interface setup function return an
   error code on failure instead of success

* tag 'timers_urgent_for_v6.18_rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  timekeeping: Fix error code in tk_aux_sysfs_init()
2025-11-30 08:47:10 -08:00
Gao Xiang
80d0c27a0a erofs: get rid of raw bi_end_io() usage
These BIOs are actually harmless in practice, as they are all pseudo
BIOs and do not use advanced features like chaining.  Using the BIO
interface is a more friendly and unified approach for both bdev and
and file-backed I/Os (compared to awkward bvec interfaces).

Let's use bio_endio() instead.

Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
2025-11-30 23:55:13 +08:00
Gao Xiang
30e13e41a0 erofs: enable error reporting for z_erofs_fixup_insize()
Enable propagation of detailed errors to callers.

Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
2025-11-30 23:49:32 +08:00
Jens Axboe
c1536df942 Merge tag 'md-6.19-20251130' of gitolite.kernel.org:pub/scm/linux/kernel/git/mdraid/linux into for-6.19/block
Pull MD changes from Yu:

"- fix null-ptr-dereference regression for dm-raid0 (Yu Kuai)
 - fix IO hang for raid5 when array is broken with IO inflight (Yu Kuai)
 - remove legacy 1s delay to speed up system shutdown (Tarun Sahu)"

* tag 'md-6.19-20251130' of gitolite.kernel.org:pub/scm/linux/kernel/git/mdraid/linux:
  md: remove legacy 1s delay in md_notify_reboot
  md/raid5: fix IO hang when array is broken with IO inflight
  md: warn about updating super block failure
  md/raid0: fix NULL pointer dereference in create_strip_zones() for dm-raid
2025-11-30 06:31:01 -07:00
Jakub Kicinski
0177f0f078 linux-can-next-for-6.19-20251129
-----BEGIN PGP SIGNATURE-----
 
 iQFHBAABCgAxFiEEn/sM2K9nqF/8FWzzDHRl3/mQkZwFAmkq6lMTHG1rbEBwZW5n
 dXRyb25peC5kZQAKCRAMdGXf+ZCRnB5MCACOYwOjMZCD//lOb8Mj69EP4+Tm62iZ
 2eMvdNTiU+Af0LVXKBcLBgUWZWXNxirSX1hapIpIn54LQ4E8zw2rrBPwF6Krng7S
 pTH5+V5DaJjbKoW+0oPZRYXLoP1ItL2HvlLddwqeBtTkw6iQBMJisSpKsGwb4HTQ
 MEu35HMe/gnUYnS+U5dxYE+P+Qm1qELevefV+9y/i1cjnHLsydWoH/W0JeRSc8Bz
 rpgrpOPccIA1srGKrz3foAaUv8m2jNcJ3eikxqeqhhAVYmNzofT9cCR/MqVRXdPZ
 ajoQmZPkhohfuIh8rralt7u1dKUeEs5oV4HHzUcWhiWJSLT31y/cUIXM
 =FPTP
 -----END PGP SIGNATURE-----

Merge tag 'linux-can-next-for-6.19-20251129' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next

Marc Kleine-Budde says:

====================
pull-request: can-next 2025-11-29

The patch is by Oliver Hartkopp and fixes the compilation of the
CAN_RAW protocol if the CAN driver infrastructure is not enabled.

This problem was introduced in the current development cycle of
net-next.

* tag 'linux-can-next-for-6.19-20251129' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next:
  can: Kconfig: select CAN driver infrastructure by default
====================

Link: https://patch.msgid.link/20251129125036.467177-1-mkl@pengutronix.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-11-29 17:45:26 -08:00
Tarun Sahu
fdd0c6a649 md: remove legacy 1s delay in md_notify_reboot
During system shutdown, the md driver registered notifier function
(md_notify_reboot) currently imposes a hardcoded one-second delay.

This delay was introduced approximately 23 years ago and was likely
necessary for the hardware generation of that time. Proposing this
patch to make sure there are no known devices that need this delay.

Link: https://lore.kernel.org/linux-raid/20251121191422.2758555-1-tarunsahu@google.com
Signed-off-by: Tarun Sahu <tarunsahu@google.com>
Reviewed-by: Yu Kuai<yukuai@fnnas.com>
Signed-off-by: Yu Kuai <yukuai@fnnas.com>
2025-11-30 09:42:28 +08:00
Yu Kuai
a913d1f6a7 md/raid5: fix IO hang when array is broken with IO inflight
Following test can cause IO hang:

mdadm -CvR /dev/md0 -l10 -n4 /dev/sd[abcd] --assume-clean --chunk=64K --bitmap=none
sleep 5
echo 1 > /sys/block/sda/device/delete
echo 1 > /sys/block/sdb/device/delete
echo 1 > /sys/block/sdc/device/delete
echo 1 > /sys/block/sdd/device/delete

dd if=/dev/md0 of=/dev/null bs=8k count=1 iflag=direct

Root cause:

1) all disks removed, however all rdevs in the array is still in sync,
IO will be issued normally.

2) IO failure from sda, and set badblocks failed, sda will be faulty
and MD_SB_CHANGING_PENDING will be set.

3) error recovery try to recover this IO from other disks, IO will be
issued to sdb, sdc, and sdd.

4) IO failure from sdb, and set badblocks failed again, now array is
broken and will become read-only.

5) IO failure from sdc and sdd, however, stripe can't be handled anymore
because MD_SB_CHANGING_PENDING is set:

handle_stripe
 handle_stripe
 if (test_bit MD_SB_CHANGING_PENDING)
  set_bit STRIPE_HANDLE
  goto finish
  // skip handling failed stripe

release_stripe
 if (test_bit STRIPE_HANDLE)
  list_add_tail conf->hand_list

6) later raid5d can't handle failed stripe as well:

raid5d
 md_check_recovery
  md_update_sb
   if (!md_is_rdwr())
    // can't clear pending bit
    return
 if (test_bit MD_SB_CHANGING_PENDING)
  break;
  // can't handle failed stripe

Since MD_SB_CHANGING_PENDING can never be cleared for read-only array,
fix this problem by skip this checking for read-only array.

Link: https://lore.kernel.org/linux-raid/20251117085557.770572-3-yukuai@fnnas.com
Fixes: d87f064f58 ("md: never update metadata when array is read-only.")
Signed-off-by: Yu Kuai <yukuai@fnnas.com>
Reviewed-by: Li Nan <linan122@huawei.com>
2025-11-30 09:38:45 +08:00
Yu Kuai
8c9e376b9d md: warn about updating super block failure
Many personalities will handle IO error from daemon thread(like raid1d,
raid10d, raid5d), and sb will require to be clean before hanlding these
failed IO. However update sb can fail, for example array is broken by
IO failure, or user config sysfs api array_state.

This patch adds warning if updating sb failed first, in case this will
be related to IO hang.

Link: https://lore.kernel.org/linux-raid/20251117085557.770572-2-yukuai@fnnas.com
Signed-off-by: Yu Kuai <yukuai@fnnas.com>
Reviewed-by: Li Nan <linan122@huawei.com>
2025-11-30 09:38:22 +08:00
Yu Kuai
46f21952c4 md/raid0: fix NULL pointer dereference in create_strip_zones() for dm-raid
Commit 2107457e31 ("md/raid0: Move queue limit setup before r0conf
initialization") dereference mddev->gendisk unconditionally, which is
NULL for dm-raid.

Fix this problem by reverting to old codes for dm-raid.

Link: https://lore.kernel.org/linux-raid/20251116021816.107648-1-yukuai@fnnas.com
Fixes: 2107457e31 ("md/raid0: Move queue limit setup before r0conf initialization")
Reported-and-tested-by: Changhui Zhong <czhong@redhat.com>
Closes: https://lore.kernel.org/all/CAGVVp+VqVnvGeneUoTbYvBv2cw6GwQRrR3B-iQ-_9rVfyumoKA@mail.gmail.com/
Signed-off-by: Yu Kuai <yukuai@fnnas.com>
Reviewed-by: Xiao Ni <xni@redhat.com>
Reviewed-by: Li Nan <linan122@huawei.com>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
2025-11-30 09:36:50 +08:00
Linus Torvalds
6bda50f433 Fix TLB unification for cores with more than 64 TLB entries
-----BEGIN PGP SIGNATURE-----
 
 iQJOBAABCAA4FiEEbt46xwy6kEcDOXoUeZbBVTGwZHAFAmkrXGMaHHRzYm9nZW5k
 QGFscGhhLmZyYW5rZW4uZGUACgkQeZbBVTGwZHAZ3w/5Adn6Wb0zk1MAtreYjumI
 VzERvDnfCqJE4SjJf11Fhe1TvT7RLElIUU612ILdPh5OCL0zyPT0PtvX6LlvLCzQ
 YRTCXXFtybi57rvPtlDIBh0bXcsQskAoGPExMzBJ6Re5oeeyI7qM5P9BV4eYsQD4
 tEM0RZKB0oPeUZ0p7Hq7F2xo1ZcJqFn14zAbf6ADHp+Xj1Kdal0FStTcLDMNdaKV
 QSZqxD26DZ7dCO9fEbDOO7Y/gdpLhPrN8q6rAexGlNwSFAqWWZ/1bY1a2b+oxcVN
 IyRqxhWwX6HTAzSab7VO/orT6HRCH3X50K7rXwEMGFhAjnyEcqRBhOiRDYtEJg87
 AamDQ2IPCkzeIi8UVnzoWDtszcSPs5eFW5LTBdhDCLCkt+UTnU0bi34jS/K6LCpJ
 HiQ7BbjM36nwqo8goe5Udz9KOcwZLW1+5DaSPT0yazZyxbUqp2lrKrk8Ie6SDIxt
 QLzDxAlN56lrxfd8MVDOWIrtf9LYcfdxwHsrT937Fwl/eCg+OdicTsGBfTlHHBDE
 pxTYDIu74lluAyyk1TqSBoeO/qqXLBIs4EIu5IjEqZ/SQmAPxFvP5l5mj38Uz3uP
 f99jxtUSsc2dttmkAMrTtrdouYoYaaA2XbGFkE0JJYVGWLO8oyrEagGn5OClfdqQ
 7jct1es16BKK85NWr8aUvu0=
 =8cjZ
 -----END PGP SIGNATURE-----

Merge tag 'mips-fixes_6.18_2' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux

Pull MIPS fix from Thomas Bogendoerfer:
 "Fix TLB unification for cores with more than 64 TLB entries"

* tag 'mips-fixes_6.18_2' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux:
  MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow
2025-11-29 15:15:14 -08:00
Trond Myklebust
a2a8fc27dd NFS: Fix up the automount fs_context to use the correct cred
When automounting, the fs_context should be fixed up to use the cred
from the parent filesystem, since the operation is just extending the
namespace. Authorisation to enter that namespace will already have been
provided by the preceding lookup.

Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2025-11-29 17:23:03 -05:00
Trond Myklebust
2b092175f5 NFS: Fix inheritance of the block sizes when automounting
Only inherit the block sizes that were actually specified as mount
parameters for the parent mount.

Fixes: 62a55d088c ("NFS: Additional refactoring for fs_context conversion")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2025-11-29 17:23:03 -05:00
Trond Myklebust
8675c69816 NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags
When a filesystem is being automounted, it needs to preserve the
user-set superblock mount options, such as the "ro" flag.

Reported-by: Li Lingfeng <lilingfeng3@huawei.com>
Link: https://lore.kernel.org/all/20240604112636.236517-3-lilingfeng@huaweicloud.com/
Fixes: f2aedb713c ("NFS: Add fs_context support.")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2025-11-29 17:22:48 -05:00
Trond Myklebust
d4a26d34f1 Revert "nfs: ignore SB_RDONLY when mounting nfs"
This reverts commit 52cb7f8f17.

Silently ignoring the "ro" and "rw" mount options causes user confusion,
and regressions.

Reported-by: Alkis Georgopoulos<alkisg@gmail.com>
Cc: Li Lingfeng <lilingfeng3@huawei.com>
Fixes: 52cb7f8f17 ("nfs: ignore SB_RDONLY when mounting nfs")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2025-11-29 17:22:39 -05:00
Trond Myklebust
d216b698d4 Revert "nfs: clear SB_RDONLY before getting superblock"
This reverts commit 8cd9b78594.

Silently ignoring the "ro" and "rw" mount options causes user confusion,
and regressions.

Reported-by: Alkis Georgopoulos<alkisg@gmail.com>
Cc: Li Lingfeng <lilingfeng3@huawei.com>
Fixes: 8cd9b78594 ("nfs: clear SB_RDONLY before getting superblock")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2025-11-29 17:22:32 -05:00
Trond Myklebust
400fa37afb Revert "nfs: ignore SB_RDONLY when remounting nfs"
This reverts commit 80c4de6ab4.

Silently ignoring the "ro" and "rw" mount options causes user confusion,
and regressions.

Reported-by: Alkis Georgopoulos<alkisg@gmail.com>
Cc: Li Lingfeng <lilingfeng3@huawei.com>
Fixes: 80c4de6ab4 ("nfs: ignore SB_RDONLY when remounting nfs")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2025-11-29 17:19:01 -05:00
Shi Hao
9086cac895 scsi: qla4xxx: Use time conversion macros
Replace the raw use of 500 value in schedule_timeout() function with
msecs_to_jiffies() to ensure intended value across different kernel
configurations regardless of HZ value.

Signed-off-by: Shi Hao <i.shihao.999@gmail.com>
Link: https://patch.msgid.link/20251117200949.42557-1-i.shihao.999@gmail.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-11-29 16:37:44 -05:00
Alexandru Gagniuc
641092c1bc remoteproc: qcom_q6v5_wcss: use optional reset for wcss_q6_bcr_reset
The "wcss_q6_bcr_reset" is not used on IPQ8074, and IPQ6018. Use
devm_reset_control_get_optional_exclusive() for this reset so that
probe() does not fail on platforms where it is not used.

Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>
Link: https://lore.kernel.org/r/20251129013207.3981517-2-mr.nuke.me@gmail.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2025-11-29 15:20:23 -06:00
Alexandru Gagniuc
7e81fa8d80 remoteproc: qcom_q6v5_wcss: fix parsing of qcom,halt-regs
The "qcom,halt-regs" consists of a phandle reference followed by the
three offsets within syscon for halt registers. Thus, we need to
request 4 integers from of_property_read_variable_u32_array(), with
the halt_reg ofsets at indexes 1, 2, and 3. Offset 0 is the phandle.

With MAX_HALT_REG at 3, of_property_read_variable_u32_array() returns
-EOVERFLOW, causing .probe() to fail.

Increase MAX_HALT_REG to 4, and update the indexes accordingly.

Fixes: 0af65b9b91 ("remoteproc: qcom: wcss: Add non pas wcss Q6 support for QCS404")
Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>
Link: https://lore.kernel.org/r/20251129013207.3981517-1-mr.nuke.me@gmail.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2025-11-29 15:19:45 -06:00
Jarkko Sakkinen
62cd5d480b KEYS: trusted: Fix a memory leak in tpm2_load_cmd
'tpm2_load_cmd' allocates a tempoary blob indirectly via 'tpm2_key_decode'
but it is not freed in the failure paths. Address this by wrapping the blob
into with a cleanup helper.

Cc: stable@vger.kernel.org # v5.13+
Fixes: f221974525 ("security: keys: trusted: use ASN.1 TPM2 key format for the blobs")
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
2025-11-29 22:57:30 +02:00
Jarkko Sakkinen
127fa2ae9e KEYS: trusted: Replace a redundant instance of tpm2_hash_map
'trusted_tpm2' duplicates 'tpm2_hash_map' originally part of the TPN
driver, which is suboptimal.

Implement and export `tpm2_find_hash_alg()` in the driver, and substitute
the redundant code in 'trusted_tpm2' with a call to the new function.

Reviewed-by: Jonathan McDowell <noodles@meta.com>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
2025-11-29 22:57:30 +02:00
Wen Xiong
eaea513077 scsi: qla2xxx: Enable/disable IRQD_NO_BALANCING during reset
A dynamic remove/add storage adapter test hits EEH on PowerPC:

  EEH: [c00000000004f77c] __eeh_send_failure_event+0x7c/0x160
  EEH: [c000000000048464] eeh_dev_check_failure.part.0+0x254/0x660
  EEH: [c000000000934e0c] __pci_read_msi_msg+0x1ac/0x280
  EEH: [c000000000100f68] pseries_msi_compose_msg+0x28/0x40
  EEH: [c00000000020e1cc] irq_chip_compose_msi_msg+0x5c/0x90
  EEH: [c000000000214b1c] msi_domain_set_affinity+0xbc/0x100
  EEH: [c000000000206be4] irq_do_set_affinity+0x214/0x2c0
  EEH: [c000000000206e04] irq_set_affinity_locked+0x174/0x230
  EEH: [c000000000207044] irq_set_affinity+0x64/0xa0
  EEH: [c000000000212890] write_irq_affinity.constprop.0.isra.0+0x130/0x150
  EEH: [c00000000068868c] proc_reg_write+0xfc/0x160
  EEH: [c0000000005adb48] vfs_write+0xf8/0x4e0
  EEH: [c0000000005ae234] ksys_write+0x84/0x140
  EEH: [c00000000002e994] system_call_exception+0x164/0x310
  EEH: [c00000000000bfe8] system_call_vectored_common+0xe8/0x278

The irqbalance daemon kicks in before invoking qla2xxx->slot_reset
during the EEH recovery process.

  irqbalance daemon
  ->irq_set_affinity()
  ->msi_domain_set_affinity()
  ->irq_chip_set_affiinity_parent()
  ->xive_irq_set_affinity()
  ->pseries_msi_compose_ms()
  ->__pci_read_msi_msg()
  ->irq_chip_compose_msi_msg()

In __pci_read_msi_msg(), the first MSI-X vector is set to all F by the
irqbalance daemon.  pci_write_msg_msix: index=0, lo=ffffffff hi=fffffff

IRQ balancing is not required during adapter reset.

Enable "IRQ_NO_BALANCING" bit before starting adapter reset and disable
it calling pci_restore_state(). The irqbalance daemon is disabled for
this short period of time (~2s).

Co-developed-by: Kyle Mahlkuch <Kyle.Mahlkuch@ibm.com>
Signed-off-by: Kyle Mahlkuch <Kyle.Mahlkuch@ibm.com>
Signed-off-by: Wen Xiong <wenxiong@linux.ibm.com>
Link: https://patch.msgid.link/20251028142427.3969819-3-wenxiong@linux.ibm.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-11-29 15:56:18 -05:00
Wen Xiong
6ac3484fb1 scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset
A dynamic remove/add storage adapter test hits EEH on PowerPC:

  EEH: [c00000000004f75c] __eeh_send_failure_event+0x7c/0x160
  EEH: [c000000000048444] eeh_dev_check_failure.part.0+0x254/0x650
  EEH: [c008000001650678] eeh_readl+0x60/0x90 [ipr]
  EEH: [c00800000166746c] ipr_cancel_op+0x2b8/0x524 [ipr]
  EEH: [c008000001656524] ipr_eh_abort+0x6c/0x130 [ipr]
  EEH: [c000000000ab0d20] scmd_eh_abort_handler+0x140/0x440
  EEH: [c00000000017e558] process_one_work+0x298/0x590
  EEH: [c00000000017eef8] worker_thread+0xa8/0x620
  EEH: [c00000000018be34] kthread+0x124/0x130
  EEH: [c00000000000cd64] ret_from_kernel_thread+0x5c/0x64

A PCIe bus trace reveals that a vector of MSI-X is cleared to 0 by
irqbalance daemon. If we disable irqbalance daemon, we won't see the
issue.

With debug enabled in ipr driver:

  [   44.103071] ipr: Entering __ipr_remove
  [   44.103083] ipr: Entering ipr_initiate_ioa_bringdown
  [   44.103091] ipr: Entering ipr_reset_shutdown_ioa
  [   44.103099] ipr: Leaving ipr_reset_shutdown_ioa
  [   44.103105] ipr: Leaving ipr_initiate_ioa_bringdown
  [   44.149918] ipr: Entering ipr_reset_ucode_download
  [   44.149935] ipr: Entering ipr_reset_alert
  [   44.150032] ipr: Entering ipr_reset_start_timer
  [   44.150038] ipr: Leaving ipr_reset_alert
  [   44.244343] scsi 1:2:3:0: alua: Detached
  [   44.254300] ipr: Entering ipr_reset_start_bist
  [   44.254320] ipr: Entering ipr_reset_start_timer
  [   44.254325] ipr: Leaving ipr_reset_start_bist
  [   44.364329] scsi 1:2:4:0: alua: Detached
  [   45.134341] scsi 1:2:5:0: alua: Detached
  [   45.860949] ipr: Entering ipr_reset_shutdown_ioa
  [   45.860962] ipr: Leaving ipr_reset_shutdown_ioa
  [   45.860966] ipr: Entering ipr_reset_alert
  [   45.861028] ipr: Entering ipr_reset_start_timer
  [   45.861035] ipr: Leaving ipr_reset_alert
  [   45.964302] ipr: Entering ipr_reset_start_bist
  [   45.964309] ipr: Entering ipr_reset_start_timer
  [   45.964313] ipr: Leaving ipr_reset_start_bist
  [   46.264301] ipr: Entering ipr_reset_bist_done
  [   46.264309] ipr: Leaving ipr_reset_bist_done

During adapter reset, ipr device driver blocks config space access but
can't block MMIO access for MSI-X entries.  There is very small window:
irqbalance daemon kicks in during adapter reset before ipr driver calls
pci_restore_state(pdev) to restore MSI-X table.

irqbalance daemon reads back all 0 for that MSI-X vector in
__pci_read_msi_msg().

irqbalance daemon:

  msi_domain_set_affinity()
  ->irq_chip_set_affinity_patent()
  ->xive_irq_set_affinity()
  ->irq_chip_compose_msi_msg()
    ->pseries_msi_compose_msg()
    ->__pci_read_msi_msg(): read all 0 since didn't call pci_restore_state
  ->irq_chip_write_msi_msg()
    -> pci_write_msg_msi(): write 0 to the msix vector entry

When ipr driver calls pci_restore_state(pdev) in
ipr_reset_restore_cfg_space(), the MSI-X vector entry has been cleared
by irqbalance daemon in pci_write_msg_msix().

  pci_restore_state()
  ->__pci_restore_msix_state()

Below is the MSI-X table for ipr adapter after irqbalance daemon kicked
in during adapter reset:

  Dump MSIx table: index=0 address_lo=c800 address_hi=10000000 msg_data=0
  Dump MSIx table: index=1 address_lo=c810 address_hi=10000000 msg_data=0
  Dump MSIx table: index=2 address_lo=c820 address_hi=10000000 msg_data=0
  Dump MSIx table: index=3 address_lo=c830 address_hi=10000000 msg_data=0
  Dump MSIx table: index=4 address_lo=c840 address_hi=10000000 msg_data=0
  Dump MSIx table: index=5 address_lo=c850 address_hi=10000000 msg_data=0
  Dump MSIx table: index=6 address_lo=c860 address_hi=10000000 msg_data=0
  Dump MSIx table: index=7 address_lo=c870 address_hi=10000000 msg_data=0
  Dump MSIx table: index=8 address_lo=0 address_hi=0 msg_data=0
  ---------> Hit EEH since msix vector of index=8 are 0
  Dump MSIx table: index=9 address_lo=c890 address_hi=10000000 msg_data=0
  Dump MSIx table: index=10 address_lo=c8a0 address_hi=10000000 msg_data=0
  Dump MSIx table: index=11 address_lo=c8b0 address_hi=10000000 msg_data=0
  Dump MSIx table: index=12 address_lo=c8c0 address_hi=10000000 msg_data=0
  Dump MSIx table: index=13 address_lo=c8d0 address_hi=10000000 msg_data=0
  Dump MSIx table: index=14 address_lo=c8e0 address_hi=10000000 msg_data=0
  Dump MSIx table: index=15 address_lo=c8f0 address_hi=10000000 msg_data=0

  [   46.264312] ipr: Entering ipr_reset_restore_cfg_space
  [   46.267439] ipr: Entering ipr_fail_all_ops
  [   46.267447] ipr: Leaving ipr_fail_all_ops
  [   46.267451] ipr: Leaving ipr_reset_restore_cfg_space
  [   46.267454] ipr: Entering ipr_ioa_bringdown_done
  [   46.267458] ipr: Leaving ipr_ioa_bringdown_done
  [   46.267467] ipr: Entering ipr_worker_thread
  [   46.267470] ipr: Leaving ipr_worker_thread

IRQ balancing is not required during adapter reset.

Enable "IRQ_NO_BALANCING" flag before starting adapter reset and disable
it after calling pci_restore_state(). The irqbalance daemon is disabled
for this short period of time (~2s).

Co-developed-by: Kyle Mahlkuch <Kyle.Mahlkuch@ibm.com>
Signed-off-by: Kyle Mahlkuch <Kyle.Mahlkuch@ibm.com>
Signed-off-by: Wen Xiong <wenxiong@linux.ibm.com>
Link: https://patch.msgid.link/20251028142427.3969819-2-wenxiong@linux.ibm.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-11-29 15:56:18 -05:00
Duoming Zhou
ab58153ec6 scsi: imm: Fix use-after-free bug caused by unfinished delayed work
The delayed work item 'imm_tq' is initialized in imm_attach() and
scheduled via imm_queuecommand() for processing SCSI commands.  When the
IMM parallel port SCSI host adapter is detached through imm_detach(),
the imm_struct device instance is deallocated.

However, the delayed work might still be pending or executing
when imm_detach() is called, leading to use-after-free bugs
when the work function imm_interrupt() accesses the already
freed imm_struct memory.

The race condition can occur as follows:

CPU 0(detach thread)   | CPU 1
                       | imm_queuecommand()
                       |   imm_queuecommand_lck()
imm_detach()           |     schedule_delayed_work()
  kfree(dev) //FREE    | imm_interrupt()
                       |   dev = container_of(...) //USE
                           dev-> //USE

Add disable_delayed_work_sync() in imm_detach() to guarantee proper
cancellation of the delayed work item before imm_struct is deallocated.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Link: https://patch.msgid.link/20251028100149.40721-1-duoming@zju.edu.cn
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-11-29 15:42:17 -05:00
Heiko Carstens
971bb08704 scsi: target: sbp: Remove KMSG_COMPONENT macro
The KMSG_COMPONENT macro is a leftover of the s390 specific "kernel
message catalog" from 2008 [1] which never made it upstream.

The macro was added to s390 code to allow for an out-of-tree patch which
used this to generate unique message ids. Also this out-of-tree doesn't
exist anymore.

The pattern of how the KMSG_COMPONENT is used was partially also used
for non s390 specific code, for whatever reasons.

Remove the macro in order to get rid of a pointless indirection.

[1] https://lwn.net/Articles/292650/

Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Link: https://patch.msgid.link/20251126144027.2213895-1-hca@linux.ibm.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-11-29 15:27:33 -05:00
Namhyung Kim
267c2e633a perf trace: Skip internal syscall arguments
Recent changes in the linux-next kernel will add new field for syscalls
to have contents in the userspace like below.

  # cat /sys/kernel/tracing/events/syscalls/sys_enter_write/format
  name: sys_enter_write
  ID: 758
  format:
          field:unsigned short common_type;       offset:0;       size:2; signed:0;
          field:unsigned char common_flags;       offset:2;       size:1; signed:0;
          field:unsigned char common_preempt_count;       offset:3;       size:1; signed:0;
          field:int common_pid;   offset:4;       size:4; signed:1;

          field:int __syscall_nr; offset:8;       size:4; signed:1;
          field:unsigned int fd;  offset:16;      size:8; signed:0;
          field:const char * buf; offset:24;      size:8; signed:0;
          field:size_t count;     offset:32;      size:8; signed:0;
          field:__data_loc char[] __buf_val;      offset:40;      size:4; signed:0;

  print fmt: "fd: 0x%08lx, buf: 0x%08lx (%s), count: 0x%08lx", ((unsigned long)(REC->fd)),
             ((unsigned long)(REC->buf)), __print_dynamic_array(__buf_val, 1),
             ((unsigned long)(REC->count))

We have a different way to handle those arguments and this change
confuses perf trace then make some tests failing.  Fix it by skipping
the new fields that have "__data_loc char[]" type.

Maybe we can switch to this instead of the BPF augmentation later.

Reviewed-by: Howard Chu <howardchu95@gmail.com>
Tested-by: Thomas Richter <tmricht@linux.ibm.com>
Tested-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Howard Chu <howardchu95@gmail.com>
Reported-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2025-11-29 12:23:37 -08:00
Miao Li
c131c9bf98 scsi: core: Correct documentation for scsi_device_quiesce()
If scsi_device_quiesce() returns zero, the function executed successfully.

Signed-off-by: Miao Li <limiao@kylinos.cn>
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Link: https://patch.msgid.link/20251124075444.32699-1-limiao870622@163.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-11-29 15:20:15 -05:00
Dan Carpenter
cda5dc12eb remoteproc: qcom_wcnss: Fix NULL vs IS_ERR() bug in wcnss_alloc_memory_region()
The devm_ioremap_resource_wc() function never returns NULL, it returns
error pointers.  Update the checking to match.

Fixes: c70b9d5fdc ("remoteproc: qcom: Use of_reserved_mem_region_* functions for "memory-region"")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://lore.kernel.org/r/09a43da41ee277a80a3265348831e747f7b62620.1764427595.git.dan.carpenter@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2025-11-29 14:18:23 -06:00
Dan Carpenter
cb200e41ed remoteproc: qcom: q6v5: Fix NULL vs IS_ERR() bug in q6v5_alloc_memory_region()
The devm_ioremap_resource_wc() function never returns NULL, it returns
error pointers.  Update the checking to match.

Fixes: c70b9d5fdc ("remoteproc: qcom: Use of_reserved_mem_region_* functions for "memory-region"")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://lore.kernel.org/r/674b32a78563282adeaf3cdf941314a0b8181026.1764427595.git.dan.carpenter@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2025-11-29 14:18:23 -06:00
Dan Carpenter
e7839f773e remoteproc: qcom: pas: Fix a couple NULL vs IS_ERR() bugs
The devm_ioremap_resource_wc() function never returns NULL, it returns
error pointers.  Update the checking to match.

Fixes: c70b9d5fdc ("remoteproc: qcom: Use of_reserved_mem_region_* functions for "memory-region"")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://lore.kernel.org/r/0599691acc394d9390da8fa0b5de3399b132b187.1764427595.git.dan.carpenter@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2025-11-29 14:18:23 -06:00
Dan Carpenter
5e6fee736e remoteproc: qcom_q6v5_adsp: Fix a NULL vs IS_ERR() check in adsp_alloc_memory_region()
The devm_ioremap_resource_wc() function never returns NULL, it returns
error pointers.  Update the check to match.

Fixes: c70b9d5fdc ("remoteproc: qcom: Use of_reserved_mem_region_* functions for "memory-region"")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://lore.kernel.org/r/6d6b1b0fb6a61b5155a640507217fd7e658858cf.1764427595.git.dan.carpenter@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2025-11-29 14:18:23 -06:00
Suganath Prabu S
4588e65cfd scsi: mpi3mr: Prevent duplicate SAS/SATA device entries in channel 1
Avoid scanning SAS/SATA devices in channel 1 when SAS transport is
enabled, as the SAS/SATA devices are exposed through channel 0.

Signed-off-by: Suganath Prabu S <suganath-prabu.subramani@broadcom.com>
Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com>
Link: https://lore.kernel.org/stable/20251120071955.463475-1-suganath-prabu.subramani%40broadcom.com
Link: https://patch.msgid.link/20251120071955.463475-1-suganath-prabu.subramani@broadcom.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-11-29 15:08:41 -05:00
Andrey Vatoropin
5053eab38a scsi: target: Reset t_task_cdb pointer in error case
If allocation of cmd->t_task_cdb fails, it remains NULL but is later
dereferenced in the 'err' path.

In case of error, reset NULL t_task_cdb value to point at the default
fixed-size buffer.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 9e95fb805d ("scsi: target: Fix NULL pointer dereference")
Cc: stable@vger.kernel.org
Signed-off-by: Andrey Vatoropin <a.vatoropin@crpt.ru>
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Link: https://patch.msgid.link/20251118084014.324940-1-a.vatoropin@crpt.ru
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-11-29 15:06:12 -05:00
Brian Kao
b4bb6daf4a scsi: ufs: core: Fix EH failure after W-LUN resume error
When a W-LUN resume fails, its parent devices in the SCSI hierarchy,
including the scsi_target, may be runtime suspended. Subsequently, the
error handler in ufshcd_recover_pm_error() fails to set the W-LUN device
back to active because the parent target is not active.  This results in
the following errors:

  google-ufshcd 3c2d0000.ufs: ufshcd_err_handler started; HBA state eh_fatal; ...
  ufs_device_wlun 0:0:0:49488: START_STOP failed for power mode: 1, result 40000
  ufs_device_wlun 0:0:0:49488: ufshcd_wl_runtime_resume failed: -5
  ...
  ufs_device_wlun 0:0:0:49488: runtime PM trying to activate child device 0:0:0:49488 but parent (target0:0:0) is not active

Address this by:

 1. Ensuring the W-LUN's parent scsi_target is runtime resumed before
    attempting to set the W-LUN to active within
    ufshcd_recover_pm_error().

 2. Explicitly checking for power.runtime_error on the HBA and W-LUN
    devices before calling pm_runtime_set_active() to clear the error
    state.

 3. Adding pm_runtime_get_sync(hba->dev) in
    ufshcd_err_handling_prepare() to ensure the HBA itself is active
    during error recovery, even if a child device resume failed.

These changes ensure the device power states are managed correctly
during error recovery.

Signed-off-by: Brian Kao <powenkao@google.com>
Tested-by: Brian Kao <powenkao@google.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/20251112063214.1195761-1-powenkao@google.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-11-29 14:58:38 -05:00