summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2025-09-23clocksource/drivers/tegra186: Avoid 64-bit divisionArnd Bergmann
The newly added function causes a build failure on 32-bit targets with older compiler version such as gcc-10: arm-linux-gnueabi-ld: drivers/clocksource/timer-tegra186.o: in function `tegra186_wdt_get_timeleft': timer-tegra186.c:(.text+0x3c2): undefined reference to `__aeabi_uldivmod' The calculation can trivially be changed to avoid the division entirely, as USEC_PER_SEC is a multiple of 5. Change both such calculation for consistency, even though gcc apparently managed to optimize the other one properly already. [dlezcano : Fixed conflict with 20250614175556.922159-2-linux@roeck-us.net ] Fixes: 28c842c8b0f5 ("clocksource/drivers/timer-tegra186: Add WDIOC_GETTIMELEFT support") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org> Link: https://lore.kernel.org/r/20250620111939.3395525-1-arnd@kernel.org
2025-09-23clocksource/drivers/timer-tegra186: Simplify calculating timeleftGuenter Roeck
It is not necessary to use 64-bit operations to calculate the remaining watchdog timeout. Simplify to use 32-bit operations, and add comments explaining why there will be no overflow. Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org> Reviewed-by: Jon Hunter <jonathanh@nvidia.com> Cc: Pohsun Su <pohsuns@nvidia.com> Cc: Robert Lin <robelin@nvidia.com> Link: https://lore.kernel.org/r/20250614175556.922159-2-linux@roeck-us.net
2025-09-23clocksource/drivers/timer-tegra186: Avoid 64-bit divide operationGuenter Roeck
Building the driver on xtensa fails with tensa-linux-ld: drivers/clocksource/timer-tegra186.o: in function `tegra186_timer_remove': timer-tegra186.c:(.text+0x350): undefined reference to `__udivdi3' Avoid the problem by rearranging the offending code to avoid the 64-bit divide operation. Fixes: 28c842c8b0f5 ("clocksource/drivers/timer-tegra186: Add WDIOC_GETTIMELEFT support") Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org> Reviewed-by: Jon Hunter <jonathanh@nvidia.com> Cc: Pohsun Su <pohsuns@nvidia.com> Cc: Robert Lin <robelin@nvidia.com> Link: https://lore.kernel.org/r/20250614175556.922159-1-linux@roeck-us.net
2025-09-23of/irq: Export of_irq_count for modulesWill McVicker
Need to export `of_irq_count` in preparation for modularizing the Exynos MCT driver which uses this API for setting up the timer IRQs. Signed-off-by: Will McVicker <willmcvicker@google.com> Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org> Tested-by: Youngmin Nam <youngmin.nam@samsung.com> Reviewed-by: Linus Walleij <linus.walleij-QSEj5FYQhm4dnm+yROfE0A@public.gmane.org> Reviewed-by: Youngmin Nam <youngmin.nam@samsung.com> Acked-by: Rob Herring (Arm) <robh@kernel.org> Acked-by: Arnd Bergmann <arnd@arndb.de> Link: https://lore.kernel.org/r/20250620181719.1399856-2-willmcvicker@google.com
2025-09-23dt-bindings: timer: fsl,ftm-timer: use items for regFrank Li
The original txt binding doc is: reg : Specifies base physical address and size of the register sets for the clock event device and clock source device. And existed dts provide two reg MMIO spaces. So change to use items to descript reg property. Update examples. Fixes: 8fc30d8f8e86 ("dt-bindings: timer: fsl,ftm-timer: Convert to dtschema") Signed-off-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Link: https://lore.kernel.org/r/20250523141437.533643-1-Frank.Li@nxp.com
2025-09-23dt-bindings: timer: mediatek: add MT6572Max Shevchenko
Add a compatible string for timer on the MT6572 SoC. Signed-off-by: Max Shevchenko <wctrl@proton.me> Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Acked-by: Rob Herring (Arm) <robh@kernel.org> Link: https://lore.kernel.org/r/20250702-mt6572-v4-3-bde75b7ed445@proton.me
2025-09-23dt-bindings: timer: Convert faraday,fttmr010 to DT schemaRob Herring (Arm)
Convert the Faraday fttmr010 Timer binding to DT schema format. Adjust the compatible string values to match what's in use. The number of interrupts can also be anywhere from 1 to 8. The clock-names order was reversed compared to what's used. Signed-off-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Link: https://lore.kernel.org/r/20250611232621.1508116-1-robh@kernel.org
2025-09-23time/sched_clock: Export symbol for sched_clock register functionDaniel Lezcano
The timer drivers could be converted into modules. The different functions to register the clocksource or the clockevent are already exporting their symbols for modules but the sched_clock_register() function is missing. Export the symbols so the drivers using this function can be converted into modules. Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org> Reviewed-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: Carlos Llamas <cmllamas@google.com> Reviewed-by: Will McVicker <willmcvicker@google.com> Acked-by: John Stultz <jstultz@google.com> Link: https://lore.kernel.org/r/20250602151853.1942521-8-daniel.lezcano@linaro.org
2025-09-23clocksource/drivers/cs5535: Add module ownerDaniel Lezcano
The conversion to modules requires a correct handling of the module refcount in order to prevent to unload it if it is in use. That is especially true with the clockevents where there is no function to unregister them. The core time framework correctly handles the module refcount with the different clocksource and clockevents if the module owner is set. Add the module owner to make sure the core framework will prevent stupid things happening when the driver will be converted into a module. Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org> Reviewed-by: Will McVicker <willmcvicker@google.com> Link: https://lore.kernel.org/r/20250602151853.1942521-7-daniel.lezcano@linaro.org
2025-09-23clocksource/drivers/stm: Add module ownerDaniel Lezcano
The conversion to modules requires a correct handling of the module refcount in order to prevent to unload it if it is in use. That is especially true with the clockevents where there is no function to unregister them. The core time framework correctly handles the module refcount with the different clocksource and clockevents if the module owner is set. Add the module owner to make sure the core framework will prevent stupid things happening when the driver will be converted into a module. Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org> Reviewed-by: Will McVicker <willmcvicker@google.com> Link: https://lore.kernel.org/r/20250602151853.1942521-6-daniel.lezcano@linaro.org
2025-09-23clocksource/drivers/tegra186: Add module ownerDaniel Lezcano
The conversion to modules requires a correct handling of the module refcount in order to prevent to unload it if it is in use. That is especially true with the clockevents where there is no function to unregister them. The core time framework correctly handles the module refcount with the different clocksource and clockevents if the module owner is set. Add the module owner to make sure the core framework will prevent stupid things happening when the driver will be converted into a module. Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org> Reviewed-by: Will McVicker <willmcvicker@google.com> Link: https://lore.kernel.org/r/20250602151853.1942521-5-daniel.lezcano@linaro.org
2025-09-23clocksource/drivers/sun5i: Add module ownerDaniel Lezcano
The conversion to modules requires a correct handling of the module refcount in order to prevent to unload it if it is in use. That is especially true with the clockevents where there is no function to unregister them. The core time framework correctly handles the module refcount with the different clocksource and clockevents if the module owner is set. Add the module owner to make sure the core framework will prevent stupid things happening when the driver will be converted into a module. Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org> Reviewed-by: Will McVicker <willmcvicker@google.com> Acked-by: Chen-Yu Tsai <wens@csie.org> Link: https://lore.kernel.org/r/20250602151853.1942521-4-daniel.lezcano@linaro.org
2025-09-23clocksource/drivers/stm32-lp: Add module ownerDaniel Lezcano
The conversion to modules requires a correct handling of the module refcount in order to prevent to unload it if it is in use. That is especially true with the clockevents where there is no function to unregister them. The core time framework correctly handles the module refcount with the different clocksource and clockevents if the module owner is set. Add the module owner to make sure the core framework will prevent stupid things happening when the driver will be converted into a module. Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org> Reviewed-by: Will McVicker <willmcvicker@google.com> Link: https://lore.kernel.org/r/20250602151853.1942521-3-daniel.lezcano@linaro.org
2025-09-23dm-integrity: introduce integrity_kmap and integrity_kunmapMikulas Patocka
This abstraction will be used later, for the asynchronous hash interface. Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
2025-09-23dm-integrity: replace bvec_kmap_local with kmap_local_pageMikulas Patocka
Replace bvec_kmap_local with kmap_local_page - it will be needed for the upcoming patches that make kmap_local_page optional, depending on whether asynchronous hash interface is used or not. Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
2025-09-23dm-integrity: use internal variable for digestsizeMikulas Patocka
Instead of calling digestsize() each time the digestsize for the internal hash is needed, store the digestsize in a new field internal_hash_digestsize within struct dm_integrity_c once and use this value when needed. Signed-off-by: Harald Freudenberger <freude@linux.ibm.com> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
2025-09-23dm vdo: return error on corrupted metadata in start_restoring_volume functionsIvan Abramov
The return values of VDO_ASSERT calls that validate metadata are not acted upon. Return UDS_CORRUPT_DATA in case of an error. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: a4eb7e255517 ("dm vdo: implement the volume index") Signed-off-by: Ivan Abramov <i.abramov@mt-integration.ru> Reviewed-by: Matthew Sakai <msakai@redhat.com> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
2025-09-23dm vdo: Update code to use mem_is_zeroBruce Johnston
Remove function that would check if data was all zeroes. Use the built-in kernel function mem_is_zero() instead. Signed-off-by: Bruce Johnston <bjohnsto@redhat.com> Signed-off-by: Matthew Sakai <msakai@redhat.com> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
2025-09-23ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()Ma Ke
wcd934x_codec_parse_data() contains a device reference count leak in of_slim_get_device() where device_find_child() increases the reference count of the device but this reference is not properly decreased in the success path. Add put_device() in wcd934x_codec_parse_data() and add devm_add_action_or_reset() in the probe function, which ensures that the reference count of the device is correctly managed. Memory leak in regmap_init_slimbus() as the allocated regmap is not released when the device is removed. Using devm_regmap_init_slimbus() instead of regmap_init_slimbus() to ensure automatic regmap cleanup on device removal. Calling path: of_slim_get_device() -> of_find_slim_device() -> device_find_child(). As comment of device_find_child() says, 'NOTE: you will need to drop the reference with put_device() after use.'. Found by code review. Cc: stable@vger.kernel.org Fixes: a61f3b4f476e ("ASoC: wcd934x: add support to wcd9340/wcd9341 codec") Signed-off-by: Ma Ke <make24@iscas.ac.cn> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Link: https://patch.msgid.link/20250923065212.26660-1-make24@iscas.ac.cn Signed-off-by: Mark Brown <broonie@kernel.org>
2025-09-23spi: multi CS cleanup and controller CS limitMark Brown
Merge series from Jonas Gorski <jonas.gorski@gmail.com>: This series aims at cleaning up the current multi CS parts and removing the CS limit per controller that was introduced with the multi CS support. To do this, store the assigned chip selects per device in spi_device::num_chipselects, which allows us to use that instead of SPI_CS_CNT_MAX for most loops, as well as remove the check for SPI_INVALID_CS for any chip select. This should hopefully make it obvious that SPI_CS_CNT_MAX only limits accesses to arrays indexed by the number of chip selects of a device, not the controller, and we can remove the check for spi_controller::num_chipselects being less than SPI_CS_CNT_MAX in device registration (which was the wrong place to do that anyway). After having done that, we can reduce SPI_CS_CNT_MAX again to 4 without breaking devices on higher CS lines. Finally, rename SPI_CS_CNT_MAX to SPI_DEVICE_CNT_MAX to make it more clear that this limit only applies to devices, not controllers. There are still more issues left, but these can be addressed in future submissions: * The code allows multi-cs devices for any controller, as long as the device does not set parallel-memories. * No current spi controller driver handles logical chip selects other than the first one, and always use it, regardless what cs_index_mask says. * While most spi controllers should be able to handle devices that have multiple cs that just get enabled selectively, but not at the same time, there is no way to tell that to the core (ties into the above). * There is no parallel memories/multi cs flag for devices, so any implementing driver needs to check the device tree node, making it impossible to register these kind of devices via platform code.
2025-09-23Support reading Subsystem ID from Device TreeMark Brown
Merge series from Stefan Binding <sbinding@opensource.cirrus.com>: In PC systems using ACPI, the driver is able to read back an SSID from the _SUB property. This SSID uniquely identifies the system, which enables the driver to read the correct firmware and tuning for that system from linux-firmware. Currently there is no way of reading this property from device tree. Add an equivalent property in device tree to perform the same role.
2025-09-23clocksource/drivers/scx200: Add module ownerDaniel Lezcano
The conversion to modules requires a correct handling of the module refcount in order to prevent to unload it if it is in use. That is especially true with the clockevents where there is no function to unregister them. The core time framework correctly handles the module refcount with the different clocksource and clockevents if the module owner is set. Add the module owner to make sure the core framework will prevent stupid things happening when the driver will be converted into a module. Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org> Reviewed-by: Will McVicker <willmcvicker@google.com> Link: https://lore.kernel.org/r/20250602151853.1942521-2-daniel.lezcano@linaro.org
2025-09-23dt-bindings: embedded-controller: Add Lenovo Thinkpad T14s ECSebastian Reichel
Add binding for the EC found in the Thinkpad T14s Gen6 Snapdragon, which is based on the Qualcomm X1 Elite. Some of the system LEDs and extra keys are only accessible via the EC. Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Sebastian Reichel <sre@kernel.org> Acked-by: Rob Herring (Arm) <robh@kernel.org> Link: https://patch.msgid.link/20250918-thinkpad-t14s-ec-v5-1-ac0bc6382c5c@collabora.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2025-09-23Merge branch 'tcp-update-bind-bucket-state-on-port-release'Paolo Abeni
Jakub Sitnicki says: ==================== tcp: Update bind bucket state on port release TL;DR ----- This is another take on addressing the issue we already raised earlier [1]. This time around, instead of trying to relax the bind-conflict checks in connect(), we make an attempt to fix the tcp bind bucket state accounting. The goal of this patch set is to make the bind buckets return to "port reusable by ephemeral connections" state when all sockets blocking the port from reuse get unhashed. Changelog --------- Changes in v5: - Fix initial port-addr bucket state on saddr update with ip_dynaddr=1 - Add Kuniyuki's tag for tests - Link to v4: https://lore.kernel.org/r/20250913-update-bind-bucket-state-on-unhash-v4-0-33a567594df7@cloudflare.com Changes in v4: - Drop redundant sk_is_connect_bind helper doc comment - Link to v3: https://lore.kernel.org/r/20250910-update-bind-bucket-state-on-unhash-v3-0-023caaf4ae3c@cloudflare.com Changes in v3: - Move the flag from inet_flags to sk_userlocks (Kuniyuki) - Rename the flag from AUTOBIND to CONNECT_BIND to avoid a name clash (Kuniyuki) - Drop unreachable code for sk_state == TCP_NEW_SYN_RECV (Kuniyuki) - Move the helper to inet_hashtables where it's used - Reword patch 1 description for conciseness - Link to v2: https://lore.kernel.org/r/20250821-update-bind-bucket-state-on-unhash-v2-0-0c204543a522@cloudflare.com Changes in v2: - Rename the inet_sock flag from LAZY_BIND to AUTOBIND (Eric) - Clear the AUTOBIND flag on disconnect path (Eric) - Add a test to cover the disconnect case (Eric) - Link to RFC v1: https://lore.kernel.org/r/20250808-update-bind-bucket-state-on-unhash-v1-0-faf85099d61b@cloudflare.com Situation --------- We observe the following scenario in production: inet_bind_bucket state for port 54321 -------------------- (bucket doesn't exist) // Process A opens a long-lived connection: s1 = socket(AF_INET, SOCK_STREAM) s1.setsockopt(IP_BIND_ADDRESS_NO_PORT) s1.setsockopt(IP_LOCAL_PORT_RANGE, 54000..54500) s1.bind(192.0.2.10, 0) s1.connect(192.51.100.1, 443) tb->fastreuse = -1 tb->fastreuseport = -1 s1.getsockname() -> 192.0.2.10:54321 s1.send() s1.recv() // ... s1 stays open. // Process B opens a short-lived connection: s2 = socket(AF_INET, SOCK_STREAM) s2.setsockopt(SO_REUSEADDR) s2.bind(192.0.2.20, 0) tb->fastreuse = 0 tb->fastreuseport = 0 s2.connect(192.51.100.2, 53) s2.getsockname() -> 192.0.2.20:54321 s2.send() s2.recv() s2.close() // bucket remains in this // state even though port // was released by s2 tb->fastreuse = 0 tb->fastreuseport = 0 // Process A attempts to open another connection // when there is connection pressure from // 192.0.2.30:54000..54500 to 192.51.100.1:443. // Assume only port 54321 is still available. s3 = socket(AF_INET, SOCK_STREAM) s3.setsockopt(IP_BIND_ADDRESS_NO_PORT) s3.setsockopt(IP_LOCAL_PORT_RANGE, 54000..54500) s3.bind(192.0.2.30, 0) s3.connect(192.51.100.1, 443) -> EADDRNOTAVAIL (99) Problem ------- We end up in a state where Process A can't reuse ephemeral port 54321 for as long as there are sockets, like s1, that keep the bind bucket alive. The bucket does not return to "reusable" state even when all sockets which blocked it from reuse, like s2, are gone. The ephemeral port becomes available for use again only after all sockets bound to it are gone and the bind bucket is destroyed. Programs which behave like Process B in this scenario - that is, binding to an IP address without setting IP_BIND_ADDRESS_NO_PORT - might be considered poorly written. However, the reality is that such implementation is not actually uncommon. Trying to fix each and every such program is like playing whack-a-mole. For instance, it could be any software using Golang's net.Dialer with LocalAddr provided: dialer := &net.Dialer{ LocalAddr: &net.TCPAddr{IP: srcIP}, } conn, err := dialer.Dial("tcp4", dialTarget) Or even a ubiquitous tool like dig when using a specific local address: $ dig -b 127.1.1.1 +tcp +short example.com Hence, we are proposing a systematic fix in the network stack itself. Solution -------- Please see the description in patch 1. [1] https://lore.kernel.org/r/20250714-connect-port-search-harder-v3-0-b1a41f249865@cloudflare.com Reported-by: Lee Valentine <lvalentine@cloudflare.com> Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com> ==================== Link: https://patch.msgid.link/20250917-update-bind-bucket-state-on-unhash-v5-0-57168b661b47@cloudflare.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-09-23selftests/net: Test tcp port reuse after unbinding a socketJakub Sitnicki
Exercise the scenario described in detail in the cover letter: 1) socket A: connect() from ephemeral port X 2) socket B: explicitly bind() to port X 3) check that port X is now excluded from ephemeral ports 4) close socket B to release the port bind 5) socket C: connect() from ephemeral port X As well as a corner case to test that the connect-bind flag is cleared: 1) connect() from ephemeral port X 2) disconnect the socket with connect(AF_UNSPEC) 3) bind() it explicitly to port X 4) check that port X is now excluded from ephemeral ports Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com> Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com> Link: https://patch.msgid.link/20250917-update-bind-bucket-state-on-unhash-v5-2-57168b661b47@cloudflare.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-09-23tcp: Update bind bucket state on port releaseJakub Sitnicki
Today, once an inet_bind_bucket enters a state where fastreuse >= 0 or fastreuseport >= 0 after a socket is explicitly bound to a port, it remains in that state until all sockets are removed and the bucket is destroyed. In this state, the bucket is skipped during ephemeral port selection in connect(). For applications using a reduced ephemeral port range (IP_LOCAL_PORT_RANGE socket option), this can cause faster port exhaustion since blocked buckets are excluded from reuse. The reason the bucket state isn't updated on port release is unclear. Possibly a performance trade-off to avoid scanning bucket owners, or just an oversight. Fix it by recalculating the bucket state when a socket releases a port. To limit overhead, each inet_bind2_bucket stores its own (fastreuse, fastreuseport) state. On port release, only the relevant port-addr bucket is scanned, and the overall state is derived from these. Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com> Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20250917-update-bind-bucket-state-on-unhash-v5-1-57168b661b47@cloudflare.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-09-23can: dev: turn can_set_static_ctrlmode() into a non-inline functionVincent Mailhol
can_set_static_ctrlmode() is declared as a static inline. But it is only called in the probe function of the devices and so does not really benefit from any kind of optimization. Transform it into a "normal" function by moving it to drivers/net/can/dev/dev.c Signed-off-by: Vincent Mailhol <mailhol@kernel.org> Link: https://patch.msgid.link/20250923-can-fix-mtu-v3-2-581bde113f52@kernel.org Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2025-09-23can: annotate mtu accesses with READ_ONCE()Vincent Mailhol
As hinted in commit 501a90c94510 ("inet: protect against too small mtu values."), net_device->mtu is vulnerable to race conditions if it is written and read without holding the RTNL. At the moment, all the writes are done while the interface is down, either in the devices' probe() function or in can_changelink(). So there are no such issues yet. But upcoming changes will allow to modify the MTU while the CAN XL devices are up. In preparation to the introduction of CAN XL, annotate all the net_device->mtu accesses which are not yet guarded by the RTNL with a READ_ONCE(). Note that all the write accesses are already either guarded by the RTNL or are already annotated and thus need no changes. Signed-off-by: Vincent Mailhol <mailhol@kernel.org> Link: https://patch.msgid.link/20250923-can-fix-mtu-v3-1-581bde113f52@kernel.org Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2025-09-23drm/gud: fix accidentally deleted IS_ERR() checkRuben Wauters
During conversion of WARN_ON_ONCE to drm_WARN_ON_ONCE in commit 2d2f1dc74cfb ("drm: gud: replace WARN_ON/WARN_ON_ONCE with drm versions"), the IS_ERR check was accidentally removed, breaking the gud_connector_add_properties() function, as any valid pointer in state_val would produce an error. The warning was reported by kernel test robot, and is fixed in this patch. Fixes: 2d2f1dc74cfb ("drm: gud: replace WARN_ON/WARN_ON_ONCE with drm versions") Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/r/202509212215.c8v3RKmL-lkp@intel.com/ Signed-off-by: Ruben Wauters <rubenru09@aol.com> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Link: https://lore.kernel.org/r/20250922173836.5608-1-rubenru09@aol.com
2025-09-23erofs: avoid reading more for fragment mapsGao Xiang
Since all real encoded extents (directly handled by the decompression subsystem) have a sane, limited maximum decoded length (Z_EROFS_PCLUSTER_MAX_DSIZE), and the read-more policy is only applied if needed. However, it makes no sense to read more for non-encoded maps, such as fragment extents, since such extents can be huge (up to i_size) and there is no benefit to reading more at this layer. For normal images, it does not really matter, but for crafted images generated by syzbot, excessively large fragment extents can cause read-more to run for an overly long time. Reported-and-tested-by: syzbot+1a9af3ef3c84c5e14dcc@syzkaller.appspotmail.com Closes: https://lore.kernel.org/r/68c8583d.050a0220.2ff435.03a3.GAE@google.com Fixes: b44686c8391b ("erofs: fix large fragment handling") Fixes: b15b2e307c3a ("erofs: support on-disk compressed fragments data") Reviewed-by: Hongbo Li <lihongbo22@huawei.com> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
2025-09-23wifi: libertas: WQ_PERCPU added to alloc_workqueue usersMarco Crivellari
Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This change add a new WQ_PERCPU flag, to explicitly request the use of the per-CPU behavior. Both flags coexist for one release cycle to allow callers to transition their calls. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. All existing users have been updated accordingly. Suggested-by: Tejun Heo <tj@kernel.org> Signed-off-by: Marco Crivellari <marco.crivellari@suse.com> Link: https://patch.msgid.link/20250922102407.186660-2-marco.crivellari@suse.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-09-23drm/i915/ddi: Guard reg_val against a INVALID_TRANSCODERSuraj Kandpal
Currently we check if the encoder is INVALID or -1 and throw a WARN_ON but we still end up writing the temp value which will overflow and corrupt the whole programmed value. --v2 -Assign a bogus transcoder to master in case we get a INVALID TRANSCODER [Jani] Fixes: 6671c367a9bea ("drm/i915/tgl: Select master transcoder for MST stream") Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com> Reviewed-by: Jani Nikula <jani.nikula@intel.com> Link: https://lore.kernel.org/r/20250908042208.1011144-1-suraj.kandpal@intel.com (cherry picked from commit c8e8e9ab14a6ea926641d161768e1e3ef286a853) Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
2025-09-23drm/i915: set O_LARGEFILE in __create_shmem()Taotao Chen
Without O_LARGEFILE, file->f_op->write_iter calls generic_write_check_limits(), which enforces a 2GB (MAX_NON_LFS) limit, causing -EFBIG on large writes. In shmem_pwrite(), this error is later masked as -EIO due to the error handling order, leading to igt failures like gen9_exec_parse(bb-large). Set O_LARGEFILE in __create_shmem() to prevent -EFBIG on large writes. Reported-by: kernel test robot <oliver.sang@intel.com> Closes: https://lore.kernel.org/oe-lkp/202508081029.343192ec-lkp@intel.com Fixes: 048832a3f400 ("drm/i915: Refactor shmem_pwrite() to use kiocb and write_iter") Signed-off-by: Taotao Chen <chentaotao@didiglobal.com> Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com> Signed-off-by: Andi Shyti <andi.shyti@linux.intel.com> Link: https://lore.kernel.org/r/20250822030651.28099-1-chentaotao@didiglobal.com (cherry picked from commit e296a2266c572a7537e638b0dbbfc66d11df46f9) Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
2025-09-23wifi: cfg80211: fix width unit in cfg80211_radio_chandef_valid()Ryder Lee
The original code used nl80211_chan_width_to_mhz(), which returns the width in MHz. However, the expected unit is KHz. Fixes: 510dba80ed66 ("wifi: cfg80211: add helper for checking if a chandef is valid on a radio") Signed-off-by: Ryder Lee <ryder.lee@mediatek.com> Link: https://patch.msgid.link/df54294e6c4ed0f3ceff6e818b710478ddfc62c0.1758579480.git.Ryder%20Lee%20ryder.lee@mediatek.com/ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-09-23Merge tag 'ath-next-20250922' of ↵Johannes Berg
git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath Jeff Johnson says: ================== ath.git patches for v6.18 Highlights for some specific drivers include: ath10k: Fix connection after GTK rekeying ath12k: Fix Issues in REO RX Queue Updates Handle inactivity STA kickout event And of course there is the usual set of cleanups and bug fixes across the entire family of "ath" drivers. ================== Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-09-23blk-mq: fix null-ptr-deref in blk_mq_free_tags() from error pathYu Kuai
blk_mq_free_tags() can be called after blk_mq_init_tags(), while tags->page_list is still not initialized, causing null-ptr-deref. Fix this problem by initializing tags->page_list at blk_mq_init_tags(), meanwhile, also free tags directly from error path because there is no srcu barrier. Fixes: ad0d05dbddc1 ("blk-mq: Defer freeing of tags page_list to SRCU callback") Reported-by: syzbot+5c5d41e80248d610221f@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68d1b079.a70a0220.1b52b.0000.GAE@google.com/ Signed-off-by: Yu Kuai <yukuai3@huawei.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-09-23btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot()Filipe Manana
After setting the BTRFS_ROOT_FORCE_COW flag on the root we are doing a full write barrier, smp_wmb(), but we don't need to, all we need is a smp_mb__after_atomic(). The use of the smp_wmb() is from the old days when we didn't use a bit and used instead an int field in the root to signal if cow is forced. After the int field was changed to a bit in the root's state (flags field), we forgot to update the memory barrier in create_pending_snapshot() to smp_mb__after_atomic(), but we did the change in commit_fs_roots() after clearing BTRFS_ROOT_FORCE_COW. That happened in commit 27cdeb7096b8 ("Btrfs: use bitfield instead of integer data type for the some variants in btrfs_root"). On the reader side, in should_cow_block(), we also use the counterpart smp_mb__before_atomic() which generates further confusion. So change the smp_wmb() to smp_mb__after_atomic(). In fact we don't even need any barrier at all since create_pending_snapshot() is called in the critical section of a transaction commit and therefore no one can concurrently join/attach the transaction, or start a new one, until the transaction is unblocked. By the time someone starts a new transaction and enters should_cow_block(), a lot of implicit memory barriers already took place by having acquired several locks such as fs_info->trans_lock and extent buffer locks on the root node at least. Nevertlheless, for consistency use smp_mb__after_atomic() after setting the force cow bit in create_pending_snapshot(). Signed-off-by: Filipe Manana <fdmanana@suse.com> Reviewed-by: David Sterba <dsterba@suse.com> Signed-off-by: David Sterba <dsterba@suse.com>
2025-09-23btrfs: add unlikely annotations to branches leading to transaction abortDavid Sterba
The unlikely() annotation is a static prediction hint that compiler may use to reorder code out of hot path. We use it elsewhere (namely tree-checker.c) for error branches that almost never happen. Transaction abort is one such error, the btrfs_abort_transaction() inlines code to check the state and print a warning, this ought to be out of the hot path. The most common pattern is when transaction abort is called after checking a return value and the control flow leads to a quick return. In other cases it may not be necessary to add unlikely() e.g. when the function returns anyway or the control flow is not changed noticeably. Reviewed-by: Filipe Manana <fdmanana@suse.com> Signed-off-by: David Sterba <dsterba@suse.com>
2025-09-23btrfs: add unlikely annotations to branches leading to EIODavid Sterba
The unlikely() annotation is a static prediction hint that compiler may use to reorder code out of hot path. We use it elsewhere (namely tree-checker.c) for error branches that almost never happen, where EIO is one of them. Reviewed-by: Filipe Manana <fdmanana@suse.com> Signed-off-by: David Sterba <dsterba@suse.com>
2025-09-23btrfs: add unlikely annotations to branches leading to EUCLEANDavid Sterba
The unlikely() annotation is a static prediction hint that compiler may use to reorder code out of hot path. We use it elsewhere (namely tree-checker.c) for error branches that almost never happen, where EUCLEAN (a corruption) is one of them. Reviewed-by: Filipe Manana <fdmanana@suse.com> Signed-off-by: David Sterba <dsterba@suse.com>
2025-09-23btrfs: more trivial BTRFS_PATH_AUTO_FREE conversionsSun YangKai
Trivial pattern for the auto freeing with goto -> return conversions if possible. The following cases are considered trivial in this patch: 1. Cases where there are no operations between btrfs_free_path() and the function returns. 2. Cases where only simple cleanup operations (such as kfree(), kvfree(), clear_bit(), and fs_path_free()) are present between btrfs_free_path() and the function return. Signed-off-by: Sun YangKai <sunk67188@gmail.com> Reviewed-by: David Sterba <dsterba@suse.com> Signed-off-by: David Sterba <dsterba@suse.com>
2025-09-23btrfs: zoned: don't fail mount needlessly due to too many active zonesJohannes Thumshirn
Previously BTRFS did not look at a device's reported max_open_zones limit, but starting with commit 04147d8394e8 ("btrfs: zoned: limit active zones to max_open_zones"), zoned BTRFS limited the number of concurrently used block-groups to the number of max_open_zones a device reported, if it hadn't already reported a number of max_active_zones. Starting with commit 04147d8394e8 the number of open zones is treated the same way as active zones. But this leads to mount failures on filesystems which have been used before 04147d8394e8 because too many zones are in an open state. Ignore the new limitations on these filesystems, so zones can be finished or evacuated. Reported-by: Yuwei Han <hrx@bupt.moe> Link: https://lore.kernel.org/all/2F48A90AF7DDF380+1790bcfd-cb6f-456b-870d-7982f21b5eae@bupt.moe/ Fixes: 04147d8394e8 ("btrfs: zoned: limit active zones to max_open_zones") Reviewed-by: Naohiro Aota <naohiro.aota@wdc.com> Signed-off-by: Johannes Thumshirn <johannes.thumshirn@wdc.com> Signed-off-by: David Sterba <dsterba@suse.com>
2025-09-23btrfs: use kmalloc_array() for open-coded arithmetic in kmalloc()Miquel Sabaté Solà
As pointed out in the documentation, calling 'kmalloc' with open-coded arithmetic can lead to unfortunate overflows and this particular way of using it has been deprecated. Instead, it's preferred to use 'kmalloc_array' in cases where it might apply so an overflow check is performed. Note this is an API cleanup and is not fixing any overflows because in all cases the multipliers are bounded small numbers derived from number of items in leaves/nodes. Signed-off-by: Miquel Sabaté Solà <mssola@mssola.com> Reviewed-by: David Sterba <dsterba@suse.com> Signed-off-by: David Sterba <dsterba@suse.com>
2025-09-23btrfs: enable experimental bs > ps supportQu Wenruo
With all the preparation patches, we're able to finally enable btrfs block size (sector size) larger than page size support and give it a full fstests run. And obviously this new feature is hidden behind experimental flags, and should not be considered as a core feature yet as btrfs' default block size is still 4K. But this is still a feature that will shine in the future where 16K block sized device are widely adopted. For now there are some features explicitly disabled: - Direct IO This is the most complex part to support, the root reason is we can not control the pages of iov iter passed in. User space programs can only ensure the virtual addresses are contiguous, but have no control on their physical addresses. Our bs > ps support heavily relies on large folios, and direct IO memory can easily break it. So direct IO is disabled and will always fall back to buffered IO. - RAID56 In theory we can convert RAID56 to use large folios, but it will need to be converted back to page based if we want to support direct IO in the future. So just reject it for now. - Encoded send - Encoded read Both are utilizing btrfs_encoded_read_regular_fill_pages(), and send is utilizing vmallocated memory. Unfortunately for vmallocated memory we can not guarantee the minimal folio order. For send, it will just always fallback to regular writes, which reads from page cache and will follow the existing folio order requirement. - Encoded write Encoded write itself is allocating pages by themselves, and we can easily change it to follow the minimal order. But since encoded read is already disabled, there is no need to only enable encoded write. Finally just like what we did for bs < ps support in the past, add a warning message for bs > ps mounts. Signed-off-by: Qu Wenruo <wqu@suse.com> Reviewed-by: David Sterba <dsterba@suse.com> Signed-off-by: David Sterba <dsterba@suse.com>
2025-09-23btrfs: add extra ASSERT()s to catch unaligned biosQu Wenruo
Btrfs uses btrfs_bio to handle read/write of logical address, for the incoming bs > ps support, btrfs has extra requirements: - One folio must contain at least one fs block - No fs block can cross folio boundaries This requirement is not hard to maintain, thanks to the address space's minimal folio order. But not all btrfs bios are generated through address space, e.g. compression and scrub. To catch possible unaligned bios, introduce a helper, assert_bbio_alginment(), for each btrfs_bio in btrfs_submit_bbio(). This will check the following things: - bv_offset is aligned to block size - bv_len is aligned to block size With a btrfs bio passing above checks, unless it's empty it will ensure the requirements for bs > ps support. Signed-off-by: Qu Wenruo <wqu@suse.com> Reviewed-by: David Sterba <dsterba@suse.com> Signed-off-by: David Sterba <dsterba@suse.com>
2025-09-23btrfs: fix symbolic link reading when bs > psQu Wenruo
[BUG DURING BS > PS TEST] When running the following script on a btrfs whose block size is larger than page size, e.g. 8K block size and 4K page size, it will trigger a kernel BUG: # mkfs.btrfs -s 8k $dev # mount $dev $mnt # mkdir $mnt/dir # ln -s dir $mnt/link # ls $mnt/link The call trace looks like this: BTRFS warning (device dm-2): support for block size 8192 with page size 4096 is experimental, some features may be missing BTRFS info (device dm-2): checking UUID tree BTRFS info (device dm-2): enabling ssd optimizations BTRFS info (device dm-2): enabling free space tree ------------[ cut here ]------------ kernel BUG at /home/adam/linux/include/linux/highmem.h:275! Oops: invalid opcode: 0000 [#1] SMP CPU: 8 UID: 0 PID: 667 Comm: ls Tainted: G OE 6.17.0-rc4-custom+ #283 PREEMPT(full) Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022 RIP: 0010:zero_user_segments.constprop.0+0xdc/0xe0 [btrfs] Call Trace: <TASK> btrfs_get_extent.cold+0x85/0x101 [btrfs 7453c70c03e631c8d8bfdd4264fa62d3e238da6f] btrfs_do_readpage+0x244/0x750 [btrfs 7453c70c03e631c8d8bfdd4264fa62d3e238da6f] btrfs_read_folio+0x9c/0x100 [btrfs 7453c70c03e631c8d8bfdd4264fa62d3e238da6f] filemap_read_folio+0x37/0xe0 do_read_cache_folio+0x94/0x3e0 __page_get_link.isra.0+0x20/0x90 page_get_link+0x16/0x40 step_into+0x69b/0x830 path_lookupat+0xa7/0x170 filename_lookup+0xf7/0x200 ? set_ptes.isra.0+0x36/0x70 vfs_statx+0x7a/0x160 do_statx+0x63/0xa0 __x64_sys_statx+0x90/0xe0 do_syscall_64+0x82/0xae0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 </TASK> Please note bs > ps support is still under development and the enablement patch is not even in btrfs development branch. [CAUSE] Btrfs reuses its data folio read path to handle symbolic links, as the symbolic link target is stored as an inline data extent. But for newly created inodes, btrfs only set the minimal order if the target inode is a regular file. Thus for above newly created symbolic link, it doesn't properly respect the minimal folio order, and triggered the above crash. [FIX] Call btrfs_set_inode_mapping_order() unconditionally inside btrfs_create_new_inode(). For symbolic links this will fix the crash as now the folio will meet the minimal order. For regular files this brings no change. For directory/bdev/char and all the other types of inodes, they won't go through the data read path, thus no effect either. Fixes: cc38d178ff33 ("btrfs: enable large data folio support under CONFIG_BTRFS_EXPERIMENTAL") Signed-off-by: Qu Wenruo <wqu@suse.com> Signed-off-by: David Sterba <dsterba@suse.com>
2025-09-23btrfs: prepare scrub to support bs > ps casesQu Wenruo
This involves: - Migrate scrub_stripe::pages[] to folios[] - Use btrfs_alloc_folio_array() and folio_put() to alloc above array. - Migrate scrub_stripe_get_kaddr() and scrub_stripe_get_paddr() to use folio interfaces - Migrate raid56_parity_cache_data_pages() to raid56_parity_cache_data_folios() Since scrub is the only caller still using pages. This helper will copy the folio array contents into rbio::stripe_pages, with sector uptodate flags updated. And a new ASSERT() to make sure bs > ps cases will not hit this path. Since most scrub code is based on kaddr/paddr, the migration itself is pretty straightforward. And since we're here, also move the loop to set the stripe_sectors[].uptodate out of the copy loop. As we always mark all the sectors as uptodate for the data stripe, it's easier to do in one go, other than doing it inside the copy loop. Signed-off-by: Qu Wenruo <wqu@suse.com> Signed-off-by: David Sterba <dsterba@suse.com>
2025-09-23btrfs: prepare zlib to support bs > ps casesQu Wenruo
This involves converting the following functions to use correct folio sizes/shifts: - zlib_compress_folios() - zlib_decompress_bio() There is a special handling for s390 hardware acceleration. With bs > ps cases, we can go with 16K block size on s390 (which uses fixed 4K page size). In that case we do not need to do the buffer copy as our folio is large enough for hardware acceleration. So factor out the s390 specific and folio size check into a helper, need_special_buffer(). Signed-off-by: Qu Wenruo <wqu@suse.com> Reviewed-by: David Sterba <dsterba@suse.com> Signed-off-by: David Sterba <dsterba@suse.com>
2025-09-23btrfs: prepare lzo to support bs > ps casesQu Wenruo
This involves converting the following functions to use correct folio sizes/shifts: - copy_compress_data_to_page() - lzo_compress_folios() - lzo_decompress_bio() Just like zstd, lzo has some extra incorrect usage of kmap_local_folio() that the offset is always 0. This will not handle HIGHMEM large folios correctly, but those cases are already rejected explicitly so it should not cause problems when bs > ps support is enabled. Signed-off-by: Qu Wenruo <wqu@suse.com> Reviewed-by: David Sterba <dsterba@suse.com> Signed-off-by: David Sterba <dsterba@suse.com>
2025-09-23btrfs: prepare zstd to support bs > ps casesQu Wenruo
This involves converting the following functions to use proper folio sizes/shifts: - zstd_compress_folios() - zstd_decompress_bio() The function zstd_decompress() is already using block size correctly without using page size, thus it needs no modification. And since zstd compression is calling kmap_local_folio(), the existing code cannot handle large folios with HIGHMEM, as kmap_local_folio() requires us to handle one page range each time. I do not really think it's worth to spend time on some feature that will be deprecated eventually. So here just add an extra explicit rejection for bs > ps with HIGHMEM feature enabled kernels. Signed-off-by: Qu Wenruo <wqu@suse.com> Reviewed-by: David Sterba <dsterba@suse.com> Signed-off-by: David Sterba <dsterba@suse.com>