Commit graph

1,426,898 commits

Author SHA1 Message Date
Huiwen He
3065e6a4d3 drm/msm: fix missing NULL check after kcalloc in crashstate_get_bos()
The crashstate_get_bos() function allocates memory for `state->bos`
using kcalloc(), but the vmbind path does not check for allocation
failure before dereferencing it in the following drm_gpuvm_for_each_va()
loop. This could lead to a NULL pointer dereference if memory allocation
fails.

Fix this by wrapping the drm_gpuvm_for_each_va() loop with a NULL check
on state->bos, similar to the safety check in the non-vmbind path.

Fixes: af9aa6f316 ("drm/msm: Crashdump support for sparse")
Signed-off-by: Huiwen He <hehuiwen@kylinos.cn>
Patchwork: https://patchwork.freedesktop.org/patch/687556/
Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
2025-11-17 09:43:58 -08:00
Huiwen He
3099e0247e drm/msm: Fix NULL pointer dereference in crashstate_get_vm_logs()
crashstate_get_vm_logs() did not check the return value of
kmalloc_array(). In low-memory situations, kmalloc_array() may return
NULL, leading to a NULL pointer dereference when the function later
accesses state->vm_logs.

Fix this by checking the return value of kmalloc_array() and setting
state->nr_vm_logs to 0 if allocation fails.

Fixes: 9edc52967c ("drm/msm: Add VM logging for VM_BIND updates")
Signed-off-by: Huiwen He <hehuiwen@kylinos.cn>
Patchwork: https://patchwork.freedesktop.org/patch/687555/
Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
2025-11-17 09:43:58 -08:00
Hang Zhou
fd9862f726
spi: bcm63xx: fix premature CS deassertion on RX-only transactions
On BCM6358 (and also observed on BCM6368) the controller appears to
only generate as many SPI clocks as bytes that have been written into
the TX FIFO. For RX-only transfers the driver programs the transfer
length in SPI_MSG_CTL but does not write anything into the FIFO, so
chip select is deasserted early and the RX transfer segment is never
fully clocked in.

A concrete failing case is a three-transfer MAC address read from
SPI-NOR:
  - TX 0x03 (read command)
  - TX 3-byte address
  - RX 6 bytes (MAC)

In contrast, a two-transfer JEDEC-ID read (0x9f + 6-byte RX) works
because the driver uses prepend_len and writes dummy bytes into the
TX FIFO for the RX part.

Fix this by writing 0xff dummy bytes into the TX FIFO for RX-only
segments so that the number of bytes written to the FIFO matches the
total message length seen by the controller.

Fixes: b17de07606 ("spi/bcm63xx: work around inability to keep CS up")

Signed-off-by: Hang Zhou <929513338@qq.com>
Link: https://patch.msgid.link/tencent_7AC88FCB3076489A4A7E6C2163DF1ACF8D06@qq.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2025-11-17 17:29:50 +00:00
Rob Herring (Arm)
d8c8a575f5 kbuild: Ensure .dtbo targets are applied to a base .dtb
It is a requirement that DT overlays in the kernel are applied at build
time to a base DTB in order to validate they can be applied and to
validate them against the DT schemas. DT overlays on their own may be
incomplete and can't be validated.

Add a kbuild check so this doesn't have to be checked and fixed
periodically.

Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2025-11-17 11:27:52 -06:00
Geert Uytterhoeven
1b1f04d827 of/irq: Ignore interrupt parent for nodes without interrupts
The Devicetree Specification states:

    The root of the interrupt tree is determined when traversal of the
    interrupt tree reaches an interrupt controller node without an
    interrupts property and thus no explicit interrupt parent.

However, of_irq_init() gratuitously assumes that a node without
interrupts has an actual interrupt parent if it finds an
interrupt-parent property higher up in the device tree.  Hence when such
a property is present (e.g. in the root node), the root interrupt
controller may not be detected as such, causing a panic:

    OF: of_irq_init: children remain, but no parents
    Kernel panic - not syncing: No interrupt controller found.

Commit e91033621d ("of/irq: Use interrupts-extended to find
parent") already fixed a first part, by checking for the presence of an
interrupts-extended property.  Fix the second part by only calling
of_irq_find_parent() when an interrupts property is present.

Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/fbe6fc3657070fe2df7f0529043542b52b827449.1763116833.git.geert+renesas@glider.be
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2025-11-17 11:27:51 -06:00
Bartosz Golaszewski
96498e804c
spi: davinci: remove platform data header
There are no longer any board files including the DaVinci SPI platform
data header. Let's move the bits and pieces that are used in the driver
into the driver .c file itself and remove the header.

Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Link: https://patch.msgid.link/20251117-davinci-spi-v2-1-cd799d17f04a@linaro.org
Signed-off-by: Mark Brown <broonie@kernel.org>
2025-11-17 17:27:38 +00:00
Yuntao Wang
c7496597ad of/address: Remove the incorrect and misleading comment
The of_bus_default_match() function appears to have been copied from
of_bus_default_flags_match() with some modifications.

However, the comment was left unchanged and still describes the behavior
of of_bus_default_flags_match(), it is incorrect and misleading, remove it.

Signed-off-by: Yuntao Wang <yuntao.wang@linux.dev>
Fixes: 6e5773d52f ("of/address: Fix WARN when attempting translating non-translatable addresses")
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20251112143520.233870-11-yuntao.wang@linux.dev
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2025-11-17 11:24:51 -06:00
Rob Herring (Arm)
8b9ef71400 dt-bindings: dma: Convert apm,xgene-storm-dma to DT schema
Convert APM X-Gene Storm DMA binding to DT schema format. It's a
straight-forward conversion.

Link: https://patch.msgid.link/20251013213037.684981-1-robh@kernel.org
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2025-11-17 11:24:51 -06:00
Rob Herring (Arm)
a18b0c9248 dt-bindings: thermal: Drop db8500-thermal.txt
The binding is already defined in mfd/stericsson,db8500-prcmu.yaml and none
of 'the tripN.*' properties appear to be in use.

Acked-by: Conor Dooley <conor.dooley@microchip.com>
Link: https://patch.msgid.link/20251030195234.439141-1-robh@kernel.org
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2025-11-17 11:24:51 -06:00
Rob Herring (Arm)
91d1e3f0f2 dt-bindings: thermal: Convert brcm,sr-thermal to DT schema
Convert the brcm,sr-thermal binding to DT schema format. It's a
straight-forward conversion. "polling-delay", "thermal-sensors", and
"temperature" all apply to the thermal zones, not the sensor node.

Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://patch.msgid.link/20251013215810.783006-1-robh@kernel.org
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2025-11-17 11:24:51 -06:00
Rob Herring (Arm)
3c09ca88c6 dt-bindings: thermal: Convert amazon,al-thermal to DT schema
Convert amazon,al-thermal binding to DT schema format. It's a
straight-forward conversion.

Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://patch.msgid.link/20251013215820.783272-1-robh@kernel.org
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2025-11-17 11:24:51 -06:00
Christophe JAILLET
b012c2ac37 of: overlay: Avoid spurious error messages in of_overlay_remove()
Make of_overlay_remove() tolerate ovcs_id being 0 without logging an error.

Suggested-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://patch.msgid.link/f756e04e8bc239b33a0428c2dd055f202e214f0b.1761335298.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2025-11-17 11:24:51 -06:00
David Heidelberg
527bb3a747 docs: dt-bindings: Extend the ordering list with a blank newline before status
For better readability, it is recommended to insert a newline before the
'status' property. Adjust the examples accordingly.

Signed-off-by: David Heidelberg <david@ixit.cz>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://patch.msgid.link/20251023-docs-dt-newline-v1-1-1bf5e0040c0b@ixit.cz
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2025-11-17 11:24:50 -06:00
Rob Herring (Arm)
0b2333183a dt-bindings: Remove extra blank lines
Generally at most 1 blank line is the standard style for DT schema
files. Remove the few cases with more than 1 so that the yamllint check
for this can be enabled.

Acked-by: Lee Jones <lee@kernel.org>
Reviewed-by: Mathieu Poirier <mathieu.poirier@linaro.org> # remoteproc
Acked-by: Georgi Djakov <djakov@kernel.org>
Acked-by: Vinod Koul <vkoul@kernel.org>
Acked-by: Andi Shyti <andi.shyti@kernel.org>
Acked-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Acked-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Acked-by: Philipp Zabel <p.zabel@pengutronix.de>
Acked-by: Uwe Kleine-König <ukleinek@kernel.org> # for allwinner,sun4i-a10-pwm.yaml
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com> # mtd
Acked-by: Guenter Roeck <linux@roeck-us.net>
Acked-by: Mark Brown <broonie@kernel.org>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Acked-by: Manivannan Sadhasivam <mani@kernel.org> # For PCI controller bindings
Link: https://patch.msgid.link/20251023143957.2899600-1-robh@kernel.org
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2025-11-17 11:24:50 -06:00
Krzysztof Kozlowski
bcc357c8e0 dt-bindings: Update Krzysztof Kozlowski's email
Update Krzysztof Kozlowski's email address to kernel.org account to stay
reachable.

Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://patch.msgid.link/20251021095354.86455-2-krzysztof.kozlowski@linaro.org
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2025-11-17 11:24:50 -06:00
Rob Herring (Arm)
4827728f75 dt-bindings: nvmem: Convert brcm,ocotp to DT schema
Convert the brcm,ocotp binding to DT schema format. It's a
straight-forward conversion.

Link: https://patch.msgid.link/20251014152957.3782962-1-robh@kernel.org
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2025-11-17 11:24:50 -06:00
Ariel D'Alessandro
fbf97d6c1d dt-bindings: media: Convert MediaTek mt8173-mdp bindings to DT schema
Convert the existing text-based DT bindings for MediaTek MT8173 Media Data
Path to a DT schema.

Signed-off-by: Ariel D'Alessandro <ariel.dalessandro@collabora.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Link: https://patch.msgid.link/20251001183115.83111-1-ariel.dalessandro@collabora.com
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2025-11-17 11:24:50 -06:00
Rob Herring (Arm)
fc75109288 dt-bindings: arm: Add missing LGE SoC platforms
LGE LG131x SoCs have been in use for some time, but the root compatibles
have not been documented. Add them.

Acked-by: Chanho Min <chanho.min@lge.com>
Link: https://patch.msgid.link/20251022181144.4147944-1-robh@kernel.org
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2025-11-17 11:24:50 -06:00
Rob Herring (Arm)
12466504ab dt-bindings: arm: Add missing AMD Seattle SoC platforms
AMD Seattle SoC has been in use for some time, but the root compatibles
have not been documented. Add them.

Link: https://patch.msgid.link/20251022181112.4147188-1-robh@kernel.org
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2025-11-17 11:24:50 -06:00
Rob Herring (Arm)
6ca388cb90 dt-bindings: arm: Add missing APM X-Gene SoC platforms
APM X-Gene SoCs have been in use for some time, but the root compatibles
have not been documented. Add them.

Link: https://patch.msgid.link/20251022181127.4147542-1-robh@kernel.org
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2025-11-17 11:24:50 -06:00
Rob Herring (Arm)
01585d7470 dt-bindings: Fix inconsistent quoting
yamllint has gained a new check which checks for inconsistent quoting
(mixed " and ' quotes within a file). Fix all the cases yamllint found
so we can enable the check (once the check is in a release). As single
quotes are (slightly) preferred, use them throughout the modified files
even if double quotes are mostly used.

Acked-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Acked-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Acked-by: Andrew Jeffery <andrew@codeconstruct.com.au>
Acked-by: Jassi Brar <jassisinghbrar@gmail.com>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Acked-by: Lee Jones <lee@kernel.org>
Acked-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Link: https://patch.msgid.link/20251015232015.846282-1-robh@kernel.org
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2025-11-17 11:24:50 -06:00
Rob Herring (Arm)
0b651695a3 dt-bindings: power: Convert Actions Owl SPS to DT schema
Convert the Actions S500/S700/S900 Smart Power System binding to DT
schema format. It's a straight-forward conversion.

Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
Link: https://patch.msgid.link/20251013215834.783501-1-robh@kernel.org
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2025-11-17 11:24:50 -06:00
Louis-Alexis Eyraud
85cc68691c dt-bindings: gpu: mali-bifrost: Add compatible for MT8365 SoC
Add a compatible for the MediaTek MT8365 SoC, that has an integrated
ARM Mali G52 MC1 GPU and compatible with arm,mali-bifrost.

Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Louis-Alexis Eyraud <louisalexis.eyraud@collabora.com>
Link: https://patch.msgid.link/20251021-mt8365-enable-gpu-v2-1-17e05cff2c86@collabora.com
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2025-11-17 11:24:50 -06:00
Niravkumar L Rabara
d2d3d76e74 MAINTAINERS: Change Altera socfpga-ecc-manager.yaml maintainer
Update Altera socfpga-ecc-manager dt bindings maintainer from
<matthew.gerlach@altera.com> to <niravkumarlaxmidas.rabara@altera.com>
as Matthew Gerlack is moving out of Altera.

Signed-off-by: Niravkumar L Rabara <niravkumarlaxmidas.rabara@altera.com>
Acked-by: Matthew Gerlach <matthew.gerlach@altera.com>
Link: https://patch.msgid.link/20251017083849.3213192-1-niravkumarlaxmidas.rabara@altera.com
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2025-11-17 11:24:50 -06:00
Wolfram Sang
3da115f9e0 dt-bindings: bus: don't check node names
Node names are already and properly checked by the core schema. No need
to do it again.

Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Link: https://patch.msgid.link/20251020060951.30776-7-wsa+renesas@sang-engineering.com
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2025-11-17 11:24:49 -06:00
Erick Setubal Bacurau
7b0f510376 dt-bindings: fix redundant quotes on fsl,imx6q-vdoa.yaml
Fix a dt-schema error: `fsl,imx6q-vdoa.yaml:19:12: [error] string value is
redundantly quoted with any quotes (quoted-strings)`

Signed-off-by: Erick Setubal Bacurau <erick.setubal@gmx.de>
Link: https://patch.msgid.link/20251020121145.190020-1-erick.setubal@gmx.de
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2025-11-17 11:24:49 -06:00
Marek Vasut
81d35c9f2e dt-bindings: interrupt-controller: fsl,irqsteer: Add i.MX95 support
Add compatible string "fsl,imx95-irqsteer" for the i.MX95 chip, which is
backward compatible with "fsl,imx-irqsteer".

Signed-off-by: Marek Vasut <marek.vasut@mailbox.org>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Link: https://patch.msgid.link/20251011170213.128907-38-marek.vasut@mailbox.org
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2025-11-17 11:24:49 -06:00
Rob Herring (Arm)
02fe7ca031 dt-bindings: arm: Convert Marvell AP80x System Controller to DT schema
Convert the Marvell AP80x System Controller binding to DT schema format.

There's not any specific compatible for the whole block which is a
separate problem, so just the child nodes are documented. Only the
pinctrl and clock child nodes need to be converted as the GPIO node
already has a schema.

Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://patch.msgid.link/20251014153040.3783896-1-robh@kernel.org
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2025-11-17 11:24:49 -06:00
Rob Herring (Arm)
45a8d350e7 dt-bindings: arm: Convert Marvell CP110 System Controller to DT schema
Convert the Marvell CP110 System Controller binding to DT schema
format.

There's not any specific compatible for the whole block which is a
separate problem, so just the child nodes are documented. Only the
pinctrl and clock child nodes need to be converted as the GPIO node
already has a schema.

Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://patch.msgid.link/20251022165509.3917655-2-robh@kernel.org
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2025-11-17 11:24:49 -06:00
Rob Herring (Arm)
e544bc7548 dt-bindings: bus: Convert cznic,moxtet to DT schema
Convert the cznic,moxtet binding to DT schema format. It's a
straight-forward conversion.

Reviewed-by: Marek Behún <kabel@kernel.org>
Link: https://patch.msgid.link/20251014153009.3783183-1-robh@kernel.org
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2025-11-17 11:24:49 -06:00
Linus Torvalds
e7c375b181 vfs-6.18-rc7.fixes
-----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCaRtBJwAKCRCRxhvAZXjc
 ou5CAQCJb5y2ULKklblICU1wR7Nr15WvTW7VVOcv44RJ22S3NgEAy4DLDBFBw8zC
 8e7Hp8gxbjsq8ZJmU088aobFcqbZOwk=
 =TAnu
 -----END PGP SIGNATURE-----

Merge tag 'vfs-6.18-rc7.fixes' of gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs

Pull vfs fixes from Christian Brauner:

 - Fix unitialized variable in statmount_string()

 - Fix hostfs mounting when passing host root during boot

 - Fix dynamic lookup to fail on cell lookup failure

 - Fix missing file type when reading bfs inodes from disk

 - Enforce checking of sb_min_blocksize() calls and update all callers
   accordingly

 - Restore write access before closing files opened by open_exec() in
   binfmt_misc

 - Always freeze efivarfs during suspend/hibernate cycles

 - Fix statmount()'s and listmount()'s grab_requested_mnt_ns() helper to
   actually allow mount namespace file descriptor in addition to mount
   namespace ids

 - Fix tmpfs remount when noswap is specified

 - Switch Landlock to iput_not_last() to remove false-positives from
   might_sleep() annotations in iput()

 - Remove dead node_to_mnt_ns() code

 - Ensure that per-queue kobjects are successfully created

* tag 'vfs-6.18-rc7.fixes' of gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs:
  landlock: fix splats from iput() after it started calling might_sleep()
  fs: add iput_not_last()
  shmem: fix tmpfs reconfiguration (remount) when noswap is set
  fs/namespace: correctly handle errors returned by grab_requested_mnt_ns
  power: always freeze efivarfs
  binfmt_misc: restore write access before closing files opened by open_exec()
  block: add __must_check attribute to sb_min_blocksize()
  virtio-fs: fix incorrect check for fsvq->kobj
  xfs: check the return value of sb_min_blocksize() in xfs_fs_fill_super
  isofs: check the return value of sb_min_blocksize() in isofs_fill_super
  exfat: check return value of sb_min_blocksize in exfat_read_boot_sector
  vfat: fix missing sb_min_blocksize() return value checks
  mnt: Remove dead code which might prevent from building
  bfs: Reconstruct file type when loading from disk
  afs: Fix dynamic lookup to fail on cell lookup failure
  hostfs: Fix only passing host root in boot stage with new mount
  fs: Fix uninitialized 'offp' in statmount_string()
2025-11-17 09:11:27 -08:00
Linus Torvalds
418592a040 sched_ext: Fixes for v6.18-rc6
Five fixes addressing PREEMPT_RT compatibility and locking issues. Three
 commits fix potential deadlocks and sleeps in atomic contexts on RT kernels by
 converting locks to raw spinlocks and ensuring IRQ work runs in hard-irq
 context. The remaining two fix unsafe locking in the debug dump path and a
 variable dereference typo.
 -----BEGIN PGP SIGNATURE-----
 
 iIQEABYKACwWIQTfIjM1kS57o3GsC/uxYfJx3gVYGQUCaRs/0w4cdGpAa2VybmVs
 Lm9yZwAKCRCxYfJx3gVYGRjVAQClymu/aOROE97FWD+JEsuNYIse5qkBEiAfJtWR
 D9pz7QD+IGyvvF51zVS1tM8eBVoO0AX2Xc6vY/rfY9p9RUfRKwo=
 =OwLv
 -----END PGP SIGNATURE-----

Merge tag 'sched_ext-for-6.18-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext

Pull sched_ext fixes from Tejun Heo:
 "Five fixes addressing PREEMPT_RT compatibility and locking issues.

  Three commits fix potential deadlocks and sleeps in atomic contexts on
  RT kernels by converting locks to raw spinlocks and ensuring IRQ work
  runs in hard-irq context. The remaining two fix unsafe locking in the
  debug dump path and a variable dereference typo"

* tag 'sched_ext-for-6.18-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext:
  sched_ext: Use IRQ_WORK_INIT_HARD() to initialize rq->scx.kick_cpus_irq_work
  sched_ext: Fix possible deadlock in the deferred_irq_workfn()
  sched/ext: convert scx_tasks_lock to raw spinlock
  sched_ext: Fix unsafe locking in the scx_dump_state()
  sched_ext: Fix use of uninitialized variable in scx_bpf_cpuperf_set()
2025-11-17 09:01:22 -08:00
Ewan D. Milne
0a2c5495b6 nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()
nvme_fc_delete_assocation() waits for pending I/O to complete before
returning, and an error can cause ->ioerr_work to be queued after
cancel_work_sync() had been called.  Move the call to cancel_work_sync() to
be after nvme_fc_delete_association() to ensure ->ioerr_work is not running
when the nvme_fc_ctrl object is freed.  Otherwise the following can occur:

[ 1135.911754] list_del corruption, ff2d24c8093f31f8->next is NULL
[ 1135.917705] ------------[ cut here ]------------
[ 1135.922336] kernel BUG at lib/list_debug.c:52!
[ 1135.926784] Oops: invalid opcode: 0000 [#1] SMP NOPTI
[ 1135.931851] CPU: 48 UID: 0 PID: 726 Comm: kworker/u449:23 Kdump: loaded Not tainted 6.12.0 #1 PREEMPT(voluntary)
[ 1135.943490] Hardware name: Dell Inc. PowerEdge R660/0HGTK9, BIOS 2.5.4 01/16/2025
[ 1135.950969] Workqueue:  0x0 (nvme-wq)
[ 1135.954673] RIP: 0010:__list_del_entry_valid_or_report.cold+0xf/0x6f
[ 1135.961041] Code: c7 c7 98 68 72 94 e8 26 45 fe ff 0f 0b 48 c7 c7 70 68 72 94 e8 18 45 fe ff 0f 0b 48 89 fe 48 c7 c7 80 69 72 94 e8 07 45 fe ff <0f> 0b 48 89 d1 48 c7 c7 a0 6a 72 94 48 89 c2 e8 f3 44 fe ff 0f 0b
[ 1135.979788] RSP: 0018:ff579b19482d3e50 EFLAGS: 00010046
[ 1135.985015] RAX: 0000000000000033 RBX: ff2d24c8093f31f0 RCX: 0000000000000000
[ 1135.992148] RDX: 0000000000000000 RSI: ff2d24d6bfa1d0c0 RDI: ff2d24d6bfa1d0c0
[ 1135.999278] RBP: ff2d24c8093f31f8 R08: 0000000000000000 R09: ffffffff951e2b08
[ 1136.006413] R10: ffffffff95122ac8 R11: 0000000000000003 R12: ff2d24c78697c100
[ 1136.013546] R13: fffffffffffffff8 R14: 0000000000000000 R15: ff2d24c78697c0c0
[ 1136.020677] FS:  0000000000000000(0000) GS:ff2d24d6bfa00000(0000) knlGS:0000000000000000
[ 1136.028765] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1136.034510] CR2: 00007fd207f90b80 CR3: 000000163ea22003 CR4: 0000000000f73ef0
[ 1136.041641] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 1136.048776] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400
[ 1136.055910] PKRU: 55555554
[ 1136.058623] Call Trace:
[ 1136.061074]  <TASK>
[ 1136.063179]  ? show_trace_log_lvl+0x1b0/0x2f0
[ 1136.067540]  ? show_trace_log_lvl+0x1b0/0x2f0
[ 1136.071898]  ? move_linked_works+0x4a/0xa0
[ 1136.075998]  ? __list_del_entry_valid_or_report.cold+0xf/0x6f
[ 1136.081744]  ? __die_body.cold+0x8/0x12
[ 1136.085584]  ? die+0x2e/0x50
[ 1136.088469]  ? do_trap+0xca/0x110
[ 1136.091789]  ? do_error_trap+0x65/0x80
[ 1136.095543]  ? __list_del_entry_valid_or_report.cold+0xf/0x6f
[ 1136.101289]  ? exc_invalid_op+0x50/0x70
[ 1136.105127]  ? __list_del_entry_valid_or_report.cold+0xf/0x6f
[ 1136.110874]  ? asm_exc_invalid_op+0x1a/0x20
[ 1136.115059]  ? __list_del_entry_valid_or_report.cold+0xf/0x6f
[ 1136.120806]  move_linked_works+0x4a/0xa0
[ 1136.124733]  worker_thread+0x216/0x3a0
[ 1136.128485]  ? __pfx_worker_thread+0x10/0x10
[ 1136.132758]  kthread+0xfa/0x240
[ 1136.135904]  ? __pfx_kthread+0x10/0x10
[ 1136.139657]  ret_from_fork+0x31/0x50
[ 1136.143236]  ? __pfx_kthread+0x10/0x10
[ 1136.146988]  ret_from_fork_asm+0x1a/0x30
[ 1136.150915]  </TASK>

Fixes: 19fce0470f ("nvme-fc: avoid calling _nvme_fc_abort_outstanding_ios from interrupt context")
Cc: stable@vger.kernel.org
Tested-by: Marco Patalano <mpatalan@redhat.com>
Reviewed-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: Ewan D. Milne <emilne@redhat.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
2025-11-17 09:00:42 -08:00
Ewan D. Milne
ea3442efab nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl()
Now target is removed from nvme_fc_ctrl_free() which is the ctrl->ref
release handler. And even admin queue is unquiesced there, this way
is definitely wrong because the ctr->ref is grabbed when submitting
command.

And Marco observed that nvme_fc_ctrl_free() can be called from request
completion code path, and trigger kernel warning since request completes
from softirq context.

Fix the issue by moveing target removal into nvme_fc_delete_ctrl(),
which is also aligned with nvme-tcp and nvme-rdma.

Patch originally proposed by Ming Lei, then modified to move the tagset
removal down to after nvme_fc_delete_association() after further testing.

Cc: Marco Patalano <mpatalan@redhat.com>
Cc: Ewan Milne <emilne@redhat.com>
Cc: James Smart <james.smart@broadcom.com>
Cc: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Cc: stable@vger.kernel.org
Tested-by: Marco Patalano <mpatalan@redhat.com>
Reviewed-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: Ewan D. Milne <emilne@redhat.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
2025-11-17 09:00:42 -08:00
Linus Torvalds
e97c61885b Mostly small misc fixes, here they are sorted by sub-subsystem:
ECC fixes:
 - Realtek Kconfig fix
 
 SPI NAND fixes:
 - Remove unexistent QE bit on FMSH FM25S01A
 
 Raw NAND fixes:
 - Prevent DMA device NULL pointer dereference in Cadence driver
 
 MTD devices fixes:
 - Possible integer overflow in read/write ioctls
 - Fix the IRQ handler pointer in the onenand driver, even if in practice
   it is never dereferenced.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCAAdFiEE9HuaYnbmDhq/XIDIJWrqGEe9VoQFAmkbAdgACgkQJWrqGEe9
 VoShnAf9E5CJjYfrohe68WBTlAjUKRHMM+zMpHNoWklChm1wAtH7Od0QuxbL/ZKn
 IqYdt22TK+OmpcsKFbuOpW4muWZZANrjN1yNTcCAQcSfuTc7vUVdQaPWJjVhGPot
 Dar439rQ0wc1QWxQt+lxcCgyYA4p7usdzcKredNJJkP7el74+nM7+CGcl5lndOos
 ztevCoXreOskol+aWzBJWP+RXcUBR5bAQc1V7kQNUaaVH11zW5bm8C+8U6jNGD7X
 YlDTXvAemumDysugU8JXO2weKVXgXxUcm6xi7dFM7S1crmskEryAjJKPP6Z7vImL
 AYZRlFt8VeNIzEO9OvXRDET7C9IajQ==
 =/SoB
 -----END PGP SIGNATURE-----

Merge tag 'mtd/fixes-for-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux

Pull MTD fixes from Miquel Raynal:
 "Mostly small misc fixes, here they are sorted by sub-subsystem:

  ECC fixes:
   - Realtek Kconfig fix

  SPI NAND fixes:
   - Remove nonexistent QE bit on FMSH FM25S01A

  Raw NAND fixes:
   - Prevent DMA device NULL pointer dereference in Cadence driver

  MTD device fixes:
   - Possible integer overflow in read/write ioctls
   - Fix the IRQ handler pointer in the onenand driver, even if in
     practice it is never dereferenced.

* tag 'mtd/fixes-for-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux:
  mtd: onenand: Pass correct pointer to IRQ handler
  mtd: spinand: fmsh: remove QE bit for FM25S01A flash
  mtd: rawnand: cadence: fix DMA device NULL pointer dereference
  mtd: rawnand: realtek: Make rtl_ecc_engine_ops const
  mtd: nand: MTD_NAND_ECC_REALTEK should depend on HAS_DMA
  mtd: nand: realtek-ecc: Fix a IS_ERR() vs NULL bug in probe
  mtdchar: fix integer overflow in read/write ioctls
2025-11-17 08:57:21 -08:00
Alexander Stein
517d066dc0 MAINTAINERS: Add entry for TQ-Systems AM335 device trees
This includes the TQMa335x series and the corresponding mainboard MBa335x.

Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Link: https://lore.kernel.org/r/20250826140853.2570528-5-alexander.stein@ew.tq-group.com
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
2025-11-17 08:53:39 -08:00
Parvathi Pudi
393f40ef96 ARM: multi_v7_defconfig: Enable TI PRU Ethernet driver
The Programmable Real-time Unit and Industrial Communication Subsystem
Megabit (ICSSM) is a microcontroller subsystem in TI SoCs such as
AM57x, AM437x, and AM335x. It provides real-time processing
capabilities for industrial communication and custom peripheral interfaces.

Currently, EVMs based on AM57x, AM437x, and AM335x use the ICSSM driver
for PRU-based Ethernet functionality.

This patch enables TI_PRUSS and TI_PRUETH as a module for TI SoCs.

Signed-off-by: Parvathi Pudi <parvathi@couthit.com>
Link: https://lore.kernel.org/r/20251103125451.1679404-1-parvathi@couthit.com
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
2025-11-17 08:53:20 -08:00
Dave Jiang
68f4a852e1 cxl/test: Add support for acpi extended linear cache
Add the mock wrappers for hmat_get_extended_linear_cache_size() in order
to emulate the ACPI helper function for the regions that are mock'd by
cxl_test.

Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Tested-by: Alison Schofield <alison.schofield@intel.com>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Reviewed-by: Fabio M. De Francesco <fabio.m.de.francesco@linux.intel.com>
Link: https://patch.msgid.link/20251117144611.903692-4-dave.jiang@intel.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2025-11-17 09:46:44 -07:00
Dave Jiang
4b1c0466c8 cxl/test: Add cxl_test CFMWS support for extended linear cache
Add a module parameter to allow activation of extended linear cache
on the auto region for cxl_test. The current platform implementation
for extended linear cache is 1:1 of DRAM and CXL memory. A CFMWS is
created with the size of both memory together where DRAM takes the
first part of the memory range and CXL covers the second part. The
current CXL auto region on cxl_test consists of 2 256M devices that
creates a 512M region. The new extended linear cache setup will have
512M DRAM and 512M CXL memory for a total of 1G CFMWS. The hardware
decoders must have their starting offset moved to after the DRAM region
to handle the CXL regions.

[ dj: Fixup commenting style. (Jonathan) ]

Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Tested-by: Alison Schofield <alison.schofield@intel.com>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Reviewed-by: Fabio M. De Francesco <fabio.m.de.francesco@linux.intel.com>
Link: https://patch.msgid.link/20251117144611.903692-3-dave.jiang@intel.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2025-11-17 09:46:42 -07:00
Dave Jiang
fa59c35167 cxl/test: Standardize CXL auto region size
Create a global define for the size of the mock CXL auto region used
in cxl_test. Remove the declared size in mock_init_hdm_decoder()
function.

Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Tested-by: Alison Schofield <alison.schofield@intel.com>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Reviewed-by: Fabio M. De Francesco <fabio.m.de.francesco@linux.intel.com>
Link: https://patch.msgid.link/20251117144611.903692-2-dave.jiang@intel.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2025-11-17 09:44:38 -07:00
Damien Le Moal
ade260ca85 Documentation: admin-guide: blockdev: update zloop parameters
In Documentation/admin-guide/blockdev/zoned_loop.rst, add the
description of the zone_append and ordered_zone_append configuration
arguments of zloop "add" command (device creation).

Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-11-17 09:40:09 -07:00
Damien Le Moal
fcc6eaa3a0 zloop: introduce the ordered_zone_append configuration parameter
The zone append operation processing for zloop devices is similar to any
other command, that is, the operation is processed as a command work
item, without any special serialization between the work items (beside
the zone mutex for mutually exclusive code sections).

This processing is fine and gives excellent performance. However, it has
a side effect: zone append operation are very often reordered and
processed in a sequence that is very different from their issuing order
by the user. This effect is very visible using an XFS file system on top
of a zloop device. A simple file write leads to many file extents as the
data writes using zone append are reordered and so result in the
physical order being different than the file logical order.
E.g. executing:

$ dd if=/dev/zero of=/mnt/test bs=1M count=10 && sync
$ xfs_bmap /mnt/test
/mnt/test:
	0: [0..4095]: 2162688..2166783
	1: [4096..6143]: 2168832..2170879
	2: [6144..8191]: 2166784..2168831
	3: [8192..10239]: 2170880..2172927
	4: [10240..12287]: 2174976..2177023
	5: [12288..14335]: 2172928..2174975
	6: [14336..20479]: 2177024..2183167

For 10 IOs, 6 extents are created.

This is fine and actually allows to exercise XFS zone garbage collection
very well. However, this also makes debugging/working on XFS data
placement harder as the underlying device will most of the time reorder
IOs, resulting in many file extents.

Allow a user to mitigate this with the new ordered_zone_append
configuration parameter. For a zloop device created with this parameter
specified, the sector of a zone append command is set early, when the
command is submitted by the block layer with the zloop_queue_rq()
function, instead of in the zloop_rw() function which is exectued later
in the command work item context. This change ensures that more often
than not, zone append operations data end up being written in the same
order as the command submission by the user.

In the case of XFS, this leads to far less file data extents. E.g., for
the previous example, we get a single file data extent for the written
file.

$ dd if=/dev/zero of=/mnt/test bs=1M count=10 && sync
$ xfs_bmap /mnt/test
/mnt/test:
	0: [0..20479]: 2162688..2183167

Since we cannot use a mutex in the context of the zloop_queue_rq()
function to atomically set a zone append operation sector to the target
zone write pointer location and increment that the write pointer, a new
per-zone spinlock is introduced to protect a zone write pointer access
and modifications. To check a zone write pointer location and set a zone
append operation target sector to that value, the function
zloop_set_zone_append_sector() is introduced and called from
zloop_queue_rq().

Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-11-17 09:40:09 -07:00
Damien Le Moal
9236c5fdd5 zloop: introduce the zone_append configuration parameter
A zloop zoned block device declares to the block layer that it supports
zone append operations. That is, a zloop device ressembles an NVMe ZNS
devices supporting zone append.

This native support is fine but it does not allow exercising the block
layer zone write plugging emulation of zone append, as is done with SCSI
or ATA SMR HDDs.

Introduce the zone_append configuration parameter to allow creating a
zloop device without native support for zone append, thus relying on the
block layer zone append emulation. If not specified, zone append support
is enabled by default. Otherwise, a value of 0 disables native zone
append and a value of 1 enables it.

Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-11-17 09:40:09 -07:00
Damien Le Moal
e3a96ca904 zloop: simplify checks for writes to sequential zones
The function zloop_rw() already checks early that a request is fully
contained within the target zone. So this check does not need to be done
again for regular writes to sequential zones. Furthermore, since zone
append operations are always directed to the zone write pointer
location, we do not need to check for their alignment to that value
after setting it. So turn the "if" checking the write pointer alignment
into an "else if".

While at it, improve the comment describing the write pointer
modification and how this value is corrected in case of error.

Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-11-17 09:40:09 -07:00
Damien Le Moal
cf28f6f923 zloop: fail zone append operations that are targeting full zones
zloop_rw() will fail any regular write operation that targets a full
sequential zone. The check for this is indirect and achieved by checking
the write pointer alignment of the write operation. But this check is
ineffective for zone append operations since these are alwasy
automatically directed at a zone write pointer.

Prevent zone append operations from being executed in a full zone with
an explicit check of the zone condition.

Fixes: eb0570c7df ("block: new zoned loop block device driver")
Cc: stable@vger.kernel.org
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-11-17 09:40:09 -07:00
Damien Le Moal
866d65745b zloop: make the write pointer of full zones invalid
The write pointer of zones that are in the full condition is always
invalid. Reflect that fact by setting the write pointer of full zones
to ULLONG_MAX.

Fixes: eb0570c7df ("block: new zoned loop block device driver")
Cc: stable@vger.kernel.org
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-11-17 09:40:09 -07:00
Guenter Roeck
6483faa393 block/blk-throttle: Remove throtl_slice from struct throtl_data
throtl_slice is now a constant. Remove the variable and use the constant
directly where needed.

Cc: Yu Kuai <yukuai@kernel.org>
Cc: Tejun Heo <tj@kernel.org>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Khazhismel Kumykov <khazhy@google.com>
Reviewed-by: Yu Kuai <yukuai@fnnas.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-11-17 09:39:48 -07:00
Guenter Roeck
20d0b359c7 block/blk-throttle: drop unneeded blk_stat_enable_accounting
After the removal of CONFIG_BLK_DEV_THROTTLING_LOW, it is no longer
necessary to enable block accounting, so remove the call to
blk_stat_enable_accounting(). With that, the track_bio_latency variable
is no longer used and can be deleted from struct throtl_data. Also,
including blk-stat.h is no longer necessary.

Fixes: bf20ab538c ("blk-throttle: remove CONFIG_BLK_DEV_THROTTLING_LOW")
Cc: Yu Kuai <yukuai@kernel.org>
Cc: Tejun Heo <tj@kernel.org>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Khazhismel Kumykov <khazhy@google.com>
Reviewed-by: Yu Kuai <yukuai@fnnas.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-11-17 09:39:48 -07:00
Guenter Roeck
f76581f9f1 block/blk-throttle: Fix throttle slice time for SSDs
Commit d61fcfa4bb ("blk-throttle: choose a small throtl_slice for SSD")
introduced device type specific throttle slices if BLK_DEV_THROTTLING_LOW
was enabled. Commit bf20ab538c ("blk-throttle: remove
CONFIG_BLK_DEV_THROTTLING_LOW") removed support for BLK_DEV_THROTTLING_LOW,
but left the device type specific throttle slices in place. This
effectively changed throttling behavior on systems with SSD which now use
a different and non-configurable slice time compared to non-SSD devices.
Practical impact is that throughput tests with low configured throttle
values (65536 bps) experience less than expected throughput on SSDs,
presumably due to rounding errors associated with the small throttle slice
time used for those devices. The same tests pass when setting the throttle
values to 65536 * 4 = 262144 bps.

The original code sets the throttle slice time to DFL_THROTL_SLICE_HD if
CONFIG_BLK_DEV_THROTTLING_LOW is disabled. Restore that code to fix the
problem. With that, DFL_THROTL_SLICE_SSD is no longer necessary. Revert to
the original code and re-introduce DFL_THROTL_SLICE to replace both
DFL_THROTL_SLICE_HD and DFL_THROTL_SLICE_SSD. This effectively reverts
commit d61fcfa4bb ("blk-throttle: choose a small throtl_slice for SSD").

While at it, also remove MAX_THROTL_SLICE since it is not used anymore.

Fixes: bf20ab538c ("blk-throttle: remove CONFIG_BLK_DEV_THROTTLING_LOW")
Cc: Yu Kuai <yukuai@kernel.org>
Cc: Tejun Heo <tj@kernel.org>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Khazhismel Kumykov <khazhy@google.com>
Reviewed-by: Yu Kuai <yukuai@fnnas.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-11-17 09:39:48 -07:00
Keith Busch
2516c246d0 block: consider discard merge last
If the next discard range is contiguous with the current range being
considered, it's cheaper to expand the current range than to append an
additional bio.

Signed-off-by: Keith Busch <kbusch@kernel.org>
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-11-17 09:39:36 -07:00