From: Sasha Levin Date: Mon, 12 Jan 2026 17:20:24 +0000 (-0500) Subject: Fixes for all trees X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d93af939923787786e5a8d956ba76b1104cd9b7f;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for all trees Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/alpha-don-t-reference-obsolete-termio-struct-for-tc-.patch b/queue-5.10/alpha-don-t-reference-obsolete-termio-struct-for-tc-.patch new file mode 100644 index 0000000000..90c56c01a9 --- /dev/null +++ b/queue-5.10/alpha-don-t-reference-obsolete-termio-struct-for-tc-.patch @@ -0,0 +1,49 @@ +From 255dbef42783c943c678f1052b5d6af05a634855 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Dec 2025 08:14:57 +0000 +Subject: alpha: don't reference obsolete termio struct for TC* constants + +From: Sam James + +[ Upstream commit 9aeed9041929812a10a6d693af050846942a1d16 ] + +Similar in nature to ab107276607af90b13a5994997e19b7b9731e251. glibc-2.42 +drops the legacy termio struct, but the ioctls.h header still defines some +TC* constants in terms of termio (via sizeof). Hardcode the values instead. + +This fixes building Python for example, which falls over like: + ./Modules/termios.c:1119:16: error: invalid application of 'sizeof' to incomplete type 'struct termio' + +Link: https://bugs.gentoo.org/961769 +Link: https://bugs.gentoo.org/962600 +Signed-off-by: Sam James +Reviewed-by: Magnus Lindholm +Link: https://lore.kernel.org/r/6ebd3451908785cad53b50ca6bc46cfe9d6bc03c.1764922497.git.sam@gentoo.org +Signed-off-by: Magnus Lindholm +Signed-off-by: Sasha Levin +--- + arch/alpha/include/uapi/asm/ioctls.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/alpha/include/uapi/asm/ioctls.h b/arch/alpha/include/uapi/asm/ioctls.h +index 971311605288f..a09d04b49cc65 100644 +--- a/arch/alpha/include/uapi/asm/ioctls.h ++++ b/arch/alpha/include/uapi/asm/ioctls.h +@@ -23,10 +23,10 @@ + #define TCSETSW _IOW('t', 21, struct termios) + #define TCSETSF _IOW('t', 22, struct termios) + +-#define TCGETA _IOR('t', 23, struct termio) +-#define TCSETA _IOW('t', 24, struct termio) +-#define TCSETAW _IOW('t', 25, struct termio) +-#define TCSETAF _IOW('t', 28, struct termio) ++#define TCGETA 0x40127417 ++#define TCSETA 0x80127418 ++#define TCSETAW 0x80127419 ++#define TCSETAF 0x8012741c + + #define TCSBRK _IO('t', 29) + #define TCXONC _IO('t', 30) +-- +2.51.0 + diff --git a/queue-5.10/arm-9461-1-disable-highpte-on-preempt_rt-kernels.patch b/queue-5.10/arm-9461-1-disable-highpte-on-preempt_rt-kernels.patch new file mode 100644 index 0000000000..24d4cecf30 --- /dev/null +++ b/queue-5.10/arm-9461-1-disable-highpte-on-preempt_rt-kernels.patch @@ -0,0 +1,51 @@ +From c7e98b7c971a23cbbcdf61eb409e01116a4be49f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Nov 2025 16:54:37 +0100 +Subject: ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels + +From: Sebastian Andrzej Siewior + +[ Upstream commit fedadc4137234c3d00c4785eeed3e747fe9036ae ] + +gup_pgd_range() is invoked with disabled interrupts and invokes +__kmap_local_page_prot() via pte_offset_map(), gup_p4d_range(). +With HIGHPTE enabled, __kmap_local_page_prot() invokes kmap_high_get() +which uses a spinlock_t via lock_kmap_any(). This leads to an +sleeping-while-atomic error on PREEMPT_RT because spinlock_t becomes a +sleeping lock and must not be acquired in atomic context. + +The loop in map_new_virtual() uses wait_queue_head_t for wake up which +also is using a spinlock_t. + +Since HIGHPTE is rarely needed at all, turn it off for PREEMPT_RT +to allow the use of get_user_pages_fast(). + +[arnd: rework patch to turn off HIGHPTE instead of HAVE_PAST_GUP] + +Co-developed-by: Arnd Bergmann + +Acked-by: Linus Walleij +Reviewed-by: Arnd Bergmann +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Russell King (Oracle) +Signed-off-by: Sasha Levin +--- + arch/arm/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig +index 335308aff6ce0..05fc9c6ee8c5b 100644 +--- a/arch/arm/Kconfig ++++ b/arch/arm/Kconfig +@@ -1513,7 +1513,7 @@ config HIGHMEM + + config HIGHPTE + bool "Allocate 2nd-level pagetables from highmem" if EXPERT +- depends on HIGHMEM ++ depends on HIGHMEM && !PREEMPT_RT + default y + help + The VM uses one page of physical memory for each page table. +-- +2.51.0 + diff --git a/queue-5.10/nfs-fix-up-the-automount-fs_context-to-use-the-corre.patch b/queue-5.10/nfs-fix-up-the-automount-fs_context-to-use-the-corre.patch new file mode 100644 index 0000000000..32212f4213 --- /dev/null +++ b/queue-5.10/nfs-fix-up-the-automount-fs_context-to-use-the-corre.patch @@ -0,0 +1,39 @@ +From d7117b2cd5ad3f92fef9e94cf8bfdab2a1b1a847 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Nov 2025 18:56:46 -0500 +Subject: NFS: Fix up the automount fs_context to use the correct cred + +From: Trond Myklebust + +[ Upstream commit a2a8fc27dd668e7562b5326b5ed2f1604cb1e2e9 ] + +When automounting, the fs_context should be fixed up to use the cred +from the parent filesystem, since the operation is just extending the +namespace. Authorisation to enter that namespace will already have been +provided by the preceding lookup. + +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/namespace.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/fs/nfs/namespace.c b/fs/nfs/namespace.c +index d205598cdc457..fc9f7b9cbf53b 100644 +--- a/fs/nfs/namespace.c ++++ b/fs/nfs/namespace.c +@@ -170,6 +170,11 @@ struct vfsmount *nfs_d_automount(struct path *path) + if (!ctx->clone_data.fattr) + goto out_fc; + ++ if (fc->cred != server->cred) { ++ put_cred(fc->cred); ++ fc->cred = get_cred(server->cred); ++ } ++ + if (fc->net_ns != client->cl_net) { + put_net(fc->net_ns); + fc->net_ns = get_net(client->cl_net); +-- +2.51.0 + diff --git a/queue-5.10/nfsv4-ensure-the-open-stateid-seqid-doesn-t-go-backw.patch b/queue-5.10/nfsv4-ensure-the-open-stateid-seqid-doesn-t-go-backw.patch new file mode 100644 index 0000000000..8140de4ab1 --- /dev/null +++ b/queue-5.10/nfsv4-ensure-the-open-stateid-seqid-doesn-t-go-backw.patch @@ -0,0 +1,74 @@ +From 182db9345c190e9a1686586c3de1d350b058784d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Nov 2025 10:44:15 -0500 +Subject: NFSv4: ensure the open stateid seqid doesn't go backwards + +From: Scott Mayhew + +[ Upstream commit 2e47c3cc64b44b0b06cd68c2801db92ff143f2b2 ] + +We have observed an NFSv4 client receiving a LOCK reply with a status of +NFS4ERR_OLD_STATEID and subsequently retrying the LOCK request with an +earlier seqid value in the stateid. As this was for a new lockowner, +that would imply that nfs_set_open_stateid_locked() had updated the open +stateid seqid with an earlier value. + +Looking at nfs_set_open_stateid_locked(), if the incoming seqid is out +of sequence, the task will sleep on the state->waitq for up to 5 +seconds. If the task waits for the full 5 seconds, then after finishing +the wait it'll update the open stateid seqid with whatever value the +incoming seqid has. If there are multiple waiters in this scenario, +then the last one to perform said update may not be the one with the +highest seqid. + +Add a check to ensure that the seqid can only be incremented, and add a +tracepoint to indicate when old seqids are skipped. + +Signed-off-by: Scott Mayhew +Reviewed-by: Benjamin Coddington +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4proc.c | 13 +++++++++++-- + fs/nfs/nfs4trace.h | 1 + + 2 files changed, 12 insertions(+), 2 deletions(-) + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index e3070982a909a..170e9eaf536af 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -1688,8 +1688,17 @@ static void nfs_set_open_stateid_locked(struct nfs4_state *state, + if (nfs_stateid_is_sequential(state, stateid)) + break; + +- if (status) +- break; ++ if (status) { ++ if (nfs4_stateid_match_other(stateid, &state->open_stateid) && ++ !nfs4_stateid_is_newer(stateid, &state->open_stateid)) { ++ trace_nfs4_open_stateid_update_skip(state->inode, ++ stateid, status); ++ return; ++ } else { ++ break; ++ } ++ } ++ + /* Rely on seqids for serialisation with NFSv4.0 */ + if (!nfs4_has_session(NFS_SERVER(state->inode)->nfs_client)) + break; +diff --git a/fs/nfs/nfs4trace.h b/fs/nfs/nfs4trace.h +index d862df9761e77..3d538cb60593d 100644 +--- a/fs/nfs/nfs4trace.h ++++ b/fs/nfs/nfs4trace.h +@@ -1513,6 +1513,7 @@ DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_setattr); + DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_delegreturn); + DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_open_stateid_update); + DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_open_stateid_update_wait); ++DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_open_stateid_update_skip); + DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_close_stateid_update_wait); + + DECLARE_EVENT_CLASS(nfs4_getattr_event, +-- +2.51.0 + diff --git a/queue-5.10/scsi-ipr-enable-disable-irqd_no_balancing-during-res.patch b/queue-5.10/scsi-ipr-enable-disable-irqd_no_balancing-during-res.patch new file mode 100644 index 0000000000..920475e282 --- /dev/null +++ b/queue-5.10/scsi-ipr-enable-disable-irqd_no_balancing-during-res.patch @@ -0,0 +1,190 @@ +From 8a8b5c51256a3dbfa80f32b8e084aa9e838956e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Oct 2025 09:24:26 -0500 +Subject: scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset + +From: Wen Xiong + +[ Upstream commit 6ac3484fb13b2fc7f31cfc7f56093e7d0ce646a5 ] + +A dynamic remove/add storage adapter test hits EEH on PowerPC: + + EEH: [c00000000004f75c] __eeh_send_failure_event+0x7c/0x160 + EEH: [c000000000048444] eeh_dev_check_failure.part.0+0x254/0x650 + EEH: [c008000001650678] eeh_readl+0x60/0x90 [ipr] + EEH: [c00800000166746c] ipr_cancel_op+0x2b8/0x524 [ipr] + EEH: [c008000001656524] ipr_eh_abort+0x6c/0x130 [ipr] + EEH: [c000000000ab0d20] scmd_eh_abort_handler+0x140/0x440 + EEH: [c00000000017e558] process_one_work+0x298/0x590 + EEH: [c00000000017eef8] worker_thread+0xa8/0x620 + EEH: [c00000000018be34] kthread+0x124/0x130 + EEH: [c00000000000cd64] ret_from_kernel_thread+0x5c/0x64 + +A PCIe bus trace reveals that a vector of MSI-X is cleared to 0 by +irqbalance daemon. If we disable irqbalance daemon, we won't see the +issue. + +With debug enabled in ipr driver: + + [ 44.103071] ipr: Entering __ipr_remove + [ 44.103083] ipr: Entering ipr_initiate_ioa_bringdown + [ 44.103091] ipr: Entering ipr_reset_shutdown_ioa + [ 44.103099] ipr: Leaving ipr_reset_shutdown_ioa + [ 44.103105] ipr: Leaving ipr_initiate_ioa_bringdown + [ 44.149918] ipr: Entering ipr_reset_ucode_download + [ 44.149935] ipr: Entering ipr_reset_alert + [ 44.150032] ipr: Entering ipr_reset_start_timer + [ 44.150038] ipr: Leaving ipr_reset_alert + [ 44.244343] scsi 1:2:3:0: alua: Detached + [ 44.254300] ipr: Entering ipr_reset_start_bist + [ 44.254320] ipr: Entering ipr_reset_start_timer + [ 44.254325] ipr: Leaving ipr_reset_start_bist + [ 44.364329] scsi 1:2:4:0: alua: Detached + [ 45.134341] scsi 1:2:5:0: alua: Detached + [ 45.860949] ipr: Entering ipr_reset_shutdown_ioa + [ 45.860962] ipr: Leaving ipr_reset_shutdown_ioa + [ 45.860966] ipr: Entering ipr_reset_alert + [ 45.861028] ipr: Entering ipr_reset_start_timer + [ 45.861035] ipr: Leaving ipr_reset_alert + [ 45.964302] ipr: Entering ipr_reset_start_bist + [ 45.964309] ipr: Entering ipr_reset_start_timer + [ 45.964313] ipr: Leaving ipr_reset_start_bist + [ 46.264301] ipr: Entering ipr_reset_bist_done + [ 46.264309] ipr: Leaving ipr_reset_bist_done + +During adapter reset, ipr device driver blocks config space access but +can't block MMIO access for MSI-X entries. There is very small window: +irqbalance daemon kicks in during adapter reset before ipr driver calls +pci_restore_state(pdev) to restore MSI-X table. + +irqbalance daemon reads back all 0 for that MSI-X vector in +__pci_read_msi_msg(). + +irqbalance daemon: + + msi_domain_set_affinity() + ->irq_chip_set_affinity_patent() + ->xive_irq_set_affinity() + ->irq_chip_compose_msi_msg() + ->pseries_msi_compose_msg() + ->__pci_read_msi_msg(): read all 0 since didn't call pci_restore_state + ->irq_chip_write_msi_msg() + -> pci_write_msg_msi(): write 0 to the msix vector entry + +When ipr driver calls pci_restore_state(pdev) in +ipr_reset_restore_cfg_space(), the MSI-X vector entry has been cleared +by irqbalance daemon in pci_write_msg_msix(). + + pci_restore_state() + ->__pci_restore_msix_state() + +Below is the MSI-X table for ipr adapter after irqbalance daemon kicked +in during adapter reset: + + Dump MSIx table: index=0 address_lo=c800 address_hi=10000000 msg_data=0 + Dump MSIx table: index=1 address_lo=c810 address_hi=10000000 msg_data=0 + Dump MSIx table: index=2 address_lo=c820 address_hi=10000000 msg_data=0 + Dump MSIx table: index=3 address_lo=c830 address_hi=10000000 msg_data=0 + Dump MSIx table: index=4 address_lo=c840 address_hi=10000000 msg_data=0 + Dump MSIx table: index=5 address_lo=c850 address_hi=10000000 msg_data=0 + Dump MSIx table: index=6 address_lo=c860 address_hi=10000000 msg_data=0 + Dump MSIx table: index=7 address_lo=c870 address_hi=10000000 msg_data=0 + Dump MSIx table: index=8 address_lo=0 address_hi=0 msg_data=0 + ---------> Hit EEH since msix vector of index=8 are 0 + Dump MSIx table: index=9 address_lo=c890 address_hi=10000000 msg_data=0 + Dump MSIx table: index=10 address_lo=c8a0 address_hi=10000000 msg_data=0 + Dump MSIx table: index=11 address_lo=c8b0 address_hi=10000000 msg_data=0 + Dump MSIx table: index=12 address_lo=c8c0 address_hi=10000000 msg_data=0 + Dump MSIx table: index=13 address_lo=c8d0 address_hi=10000000 msg_data=0 + Dump MSIx table: index=14 address_lo=c8e0 address_hi=10000000 msg_data=0 + Dump MSIx table: index=15 address_lo=c8f0 address_hi=10000000 msg_data=0 + + [ 46.264312] ipr: Entering ipr_reset_restore_cfg_space + [ 46.267439] ipr: Entering ipr_fail_all_ops + [ 46.267447] ipr: Leaving ipr_fail_all_ops + [ 46.267451] ipr: Leaving ipr_reset_restore_cfg_space + [ 46.267454] ipr: Entering ipr_ioa_bringdown_done + [ 46.267458] ipr: Leaving ipr_ioa_bringdown_done + [ 46.267467] ipr: Entering ipr_worker_thread + [ 46.267470] ipr: Leaving ipr_worker_thread + +IRQ balancing is not required during adapter reset. + +Enable "IRQ_NO_BALANCING" flag before starting adapter reset and disable +it after calling pci_restore_state(). The irqbalance daemon is disabled +for this short period of time (~2s). + +Co-developed-by: Kyle Mahlkuch +Signed-off-by: Kyle Mahlkuch +Signed-off-by: Wen Xiong +Link: https://patch.msgid.link/20251028142427.3969819-2-wenxiong@linux.ibm.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ipr.c | 28 +++++++++++++++++++++++++++- + 1 file changed, 27 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c +index 8c376736a8f51..4ae6b76c2c5e9 100644 +--- a/drivers/scsi/ipr.c ++++ b/drivers/scsi/ipr.c +@@ -62,8 +62,8 @@ + #include + #include + #include ++#include + #include +-#include + #include + #include + #include +@@ -8665,6 +8665,30 @@ static int ipr_dump_mailbox_wait(struct ipr_cmnd *ipr_cmd) + return IPR_RC_JOB_RETURN; + } + ++/** ++ * ipr_set_affinity_nobalance ++ * @ioa_cfg: ipr_ioa_cfg struct for an ipr device ++ * @flag: bool ++ * true: ensable "IRQ_NO_BALANCING" bit for msix interrupt ++ * false: disable "IRQ_NO_BALANCING" bit for msix interrupt ++ * Description: This function will be called to disable/enable ++ * "IRQ_NO_BALANCING" to avoid irqbalance daemon ++ * kicking in during adapter reset. ++ **/ ++static void ipr_set_affinity_nobalance(struct ipr_ioa_cfg *ioa_cfg, bool flag) ++{ ++ int irq, i; ++ ++ for (i = 0; i < ioa_cfg->nvectors; i++) { ++ irq = pci_irq_vector(ioa_cfg->pdev, i); ++ ++ if (flag) ++ irq_set_status_flags(irq, IRQ_NO_BALANCING); ++ else ++ irq_clear_status_flags(irq, IRQ_NO_BALANCING); ++ } ++} ++ + /** + * ipr_reset_restore_cfg_space - Restore PCI config space. + * @ipr_cmd: ipr command struct +@@ -8689,6 +8713,7 @@ static int ipr_reset_restore_cfg_space(struct ipr_cmnd *ipr_cmd) + return IPR_RC_JOB_CONTINUE; + } + ++ ipr_set_affinity_nobalance(ioa_cfg, false); + ipr_fail_all_ops(ioa_cfg); + + if (ioa_cfg->sis64) { +@@ -8768,6 +8793,7 @@ static int ipr_reset_start_bist(struct ipr_cmnd *ipr_cmd) + rc = pci_write_config_byte(ioa_cfg->pdev, PCI_BIST, PCI_BIST_START); + + if (rc == PCIBIOS_SUCCESSFUL) { ++ ipr_set_affinity_nobalance(ioa_cfg, true); + ipr_cmd->job_step = ipr_reset_bist_done; + ipr_reset_start_timer(ipr_cmd, IPR_WAIT_FOR_BIST_TIMEOUT); + rc = IPR_RC_JOB_RETURN; +-- +2.51.0 + diff --git a/queue-5.10/scsi-revert-scsi-libsas-fix-exp-attached-device-scan.patch b/queue-5.10/scsi-revert-scsi-libsas-fix-exp-attached-device-scan.patch new file mode 100644 index 0000000000..5004e4e489 --- /dev/null +++ b/queue-5.10/scsi-revert-scsi-libsas-fix-exp-attached-device-scan.patch @@ -0,0 +1,59 @@ +From 1d9cd00024a1ff176bd913ed30fd02dbf145f046 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 14:56:27 +0800 +Subject: scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe + failure scanned in again after probe failed" + +From: Xingui Yang + +[ Upstream commit 278712d20bc8ec29d1ad6ef9bdae9000ef2c220c ] + +This reverts commit ab2068a6fb84751836a84c26ca72b3beb349619d. + +When probing the exp-attached sata device, libsas/libata will issue a +hard reset in sas_probe_sata() -> ata_sas_async_probe(), then a +broadcast event will be received after the disk probe fails, and this +commit causes the probe will be re-executed on the disk, and a faulty +disk may get into an indefinite loop of probe. + +Therefore, revert this commit, although it can fix some temporary issues +with disk probe failure. + +Signed-off-by: Xingui Yang +Reviewed-by: Jason Yan +Reviewed-by: John Garry +Link: https://patch.msgid.link/20251202065627.140361-1-yangxingui@huawei.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/libsas/sas_internal.h | 14 -------------- + 1 file changed, 14 deletions(-) + +diff --git a/drivers/scsi/libsas/sas_internal.h b/drivers/scsi/libsas/sas_internal.h +index 3ef2fde28b8ed..52e09c3e2b50d 100644 +--- a/drivers/scsi/libsas/sas_internal.h ++++ b/drivers/scsi/libsas/sas_internal.h +@@ -114,20 +114,6 @@ static inline void sas_fail_probe(struct domain_device *dev, const char *func, i + func, dev->parent ? "exp-attached" : + "direct-attached", + SAS_ADDR(dev->sas_addr), err); +- +- /* +- * If the device probe failed, the expander phy attached address +- * needs to be reset so that the phy will not be treated as flutter +- * in the next revalidation +- */ +- if (dev->parent && !dev_is_expander(dev->dev_type)) { +- struct sas_phy *phy = dev->phy; +- struct domain_device *parent = dev->parent; +- struct ex_phy *ex_phy = &parent->ex_dev.ex_phy[phy->number]; +- +- memset(ex_phy->attached_sas_addr, 0, SAS_ADDR_SIZE); +- } +- + sas_unregister_dev(dev->port, dev); + } + +-- +2.51.0 + diff --git a/queue-5.10/series b/queue-5.10/series index 24d7f4834d..7e6ac9adca 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -425,3 +425,9 @@ net-add-locking-to-protect-skb-dev-access-in-ip_output.patch net-netdevice-add-operation-ndo_sk_get_lower_dev.patch tls-use-__sk_dst_get-and-dst_dev_rcu-in-get_netdev_for_sock.patch bpf-sockmap-don-t-let-sock_map_-close-destroy-unhash-call-itself.patch +arm-9461-1-disable-highpte-on-preempt_rt-kernels.patch +alpha-don-t-reference-obsolete-termio-struct-for-tc-.patch +nfsv4-ensure-the-open-stateid-seqid-doesn-t-go-backw.patch +nfs-fix-up-the-automount-fs_context-to-use-the-corre.patch +scsi-ipr-enable-disable-irqd_no_balancing-during-res.patch +scsi-revert-scsi-libsas-fix-exp-attached-device-scan.patch diff --git a/queue-5.15/alpha-don-t-reference-obsolete-termio-struct-for-tc-.patch b/queue-5.15/alpha-don-t-reference-obsolete-termio-struct-for-tc-.patch new file mode 100644 index 0000000000..406109abd7 --- /dev/null +++ b/queue-5.15/alpha-don-t-reference-obsolete-termio-struct-for-tc-.patch @@ -0,0 +1,49 @@ +From df25696f353ee0d4dcb69cf26721d1fabd276dd4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Dec 2025 08:14:57 +0000 +Subject: alpha: don't reference obsolete termio struct for TC* constants + +From: Sam James + +[ Upstream commit 9aeed9041929812a10a6d693af050846942a1d16 ] + +Similar in nature to ab107276607af90b13a5994997e19b7b9731e251. glibc-2.42 +drops the legacy termio struct, but the ioctls.h header still defines some +TC* constants in terms of termio (via sizeof). Hardcode the values instead. + +This fixes building Python for example, which falls over like: + ./Modules/termios.c:1119:16: error: invalid application of 'sizeof' to incomplete type 'struct termio' + +Link: https://bugs.gentoo.org/961769 +Link: https://bugs.gentoo.org/962600 +Signed-off-by: Sam James +Reviewed-by: Magnus Lindholm +Link: https://lore.kernel.org/r/6ebd3451908785cad53b50ca6bc46cfe9d6bc03c.1764922497.git.sam@gentoo.org +Signed-off-by: Magnus Lindholm +Signed-off-by: Sasha Levin +--- + arch/alpha/include/uapi/asm/ioctls.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/alpha/include/uapi/asm/ioctls.h b/arch/alpha/include/uapi/asm/ioctls.h +index 971311605288f..a09d04b49cc65 100644 +--- a/arch/alpha/include/uapi/asm/ioctls.h ++++ b/arch/alpha/include/uapi/asm/ioctls.h +@@ -23,10 +23,10 @@ + #define TCSETSW _IOW('t', 21, struct termios) + #define TCSETSF _IOW('t', 22, struct termios) + +-#define TCGETA _IOR('t', 23, struct termio) +-#define TCSETA _IOW('t', 24, struct termio) +-#define TCSETAW _IOW('t', 25, struct termio) +-#define TCSETAF _IOW('t', 28, struct termio) ++#define TCGETA 0x40127417 ++#define TCSETA 0x80127418 ++#define TCSETAW 0x80127419 ++#define TCSETAF 0x8012741c + + #define TCSBRK _IO('t', 29) + #define TCXONC _IO('t', 30) +-- +2.51.0 + diff --git a/queue-5.15/arm-9461-1-disable-highpte-on-preempt_rt-kernels.patch b/queue-5.15/arm-9461-1-disable-highpte-on-preempt_rt-kernels.patch new file mode 100644 index 0000000000..f41b2017f3 --- /dev/null +++ b/queue-5.15/arm-9461-1-disable-highpte-on-preempt_rt-kernels.patch @@ -0,0 +1,51 @@ +From fe3ccf127dd225e72e26eaf0e3fa605aa91be5b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Nov 2025 16:54:37 +0100 +Subject: ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels + +From: Sebastian Andrzej Siewior + +[ Upstream commit fedadc4137234c3d00c4785eeed3e747fe9036ae ] + +gup_pgd_range() is invoked with disabled interrupts and invokes +__kmap_local_page_prot() via pte_offset_map(), gup_p4d_range(). +With HIGHPTE enabled, __kmap_local_page_prot() invokes kmap_high_get() +which uses a spinlock_t via lock_kmap_any(). This leads to an +sleeping-while-atomic error on PREEMPT_RT because spinlock_t becomes a +sleeping lock and must not be acquired in atomic context. + +The loop in map_new_virtual() uses wait_queue_head_t for wake up which +also is using a spinlock_t. + +Since HIGHPTE is rarely needed at all, turn it off for PREEMPT_RT +to allow the use of get_user_pages_fast(). + +[arnd: rework patch to turn off HIGHPTE instead of HAVE_PAST_GUP] + +Co-developed-by: Arnd Bergmann + +Acked-by: Linus Walleij +Reviewed-by: Arnd Bergmann +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Russell King (Oracle) +Signed-off-by: Sasha Levin +--- + arch/arm/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig +index f2fbb170d813c..74357ce8967b4 100644 +--- a/arch/arm/Kconfig ++++ b/arch/arm/Kconfig +@@ -1473,7 +1473,7 @@ config HIGHMEM + + config HIGHPTE + bool "Allocate 2nd-level pagetables from highmem" if EXPERT +- depends on HIGHMEM ++ depends on HIGHMEM && !PREEMPT_RT + default y + help + The VM uses one page of physical memory for each page table. +-- +2.51.0 + diff --git a/queue-5.15/csky-fix-csky_cmpxchg_fixup-not-working.patch b/queue-5.15/csky-fix-csky_cmpxchg_fixup-not-working.patch new file mode 100644 index 0000000000..4510bb6caa --- /dev/null +++ b/queue-5.15/csky-fix-csky_cmpxchg_fixup-not-working.patch @@ -0,0 +1,40 @@ +From 6df8fa6cc329fed1ac6c971d9c80eef653606511 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Oct 2024 17:56:26 +0800 +Subject: csky: fix csky_cmpxchg_fixup not working + +From: Yang Li + +[ Upstream commit 809ef03d6d21d5fea016bbf6babeec462e37e68c ] + +In the csky_cmpxchg_fixup function, it is incorrect to use the global +variable csky_cmpxchg_stw to determine the address where the exception +occurred.The global variable csky_cmpxchg_stw stores the opcode at the +time of the exception, while &csky_cmpxchg_stw shows the address where +the exception occurred. + +Signed-off-by: Yang Li +Signed-off-by: Guo Ren +Signed-off-by: Sasha Levin +--- + arch/csky/mm/fault.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/csky/mm/fault.c b/arch/csky/mm/fault.c +index 7215a46b6b8eb..98699fdeeeb54 100644 +--- a/arch/csky/mm/fault.c ++++ b/arch/csky/mm/fault.c +@@ -45,8 +45,8 @@ static inline void csky_cmpxchg_fixup(struct pt_regs *regs) + if (trap_no(regs) != VEC_TLBMODIFIED) + return; + +- if (instruction_pointer(regs) == csky_cmpxchg_stw) +- instruction_pointer_set(regs, csky_cmpxchg_ldw); ++ if (instruction_pointer(regs) == (unsigned long)&csky_cmpxchg_stw) ++ instruction_pointer_set(regs, (unsigned long)&csky_cmpxchg_ldw); + return; + } + #endif +-- +2.51.0 + diff --git a/queue-5.15/ext4-filesystems-without-casefold-feature-cannot-be-.patch b/queue-5.15/ext4-filesystems-without-casefold-feature-cannot-be-.patch new file mode 100644 index 0000000000..a5de5a6076 --- /dev/null +++ b/queue-5.15/ext4-filesystems-without-casefold-feature-cannot-be-.patch @@ -0,0 +1,47 @@ +From 44f1290be6aeebfa5fb3d43b884f81ce8f2752ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 12:04:27 -0300 +Subject: ext4: filesystems without casefold feature cannot be mounted with + siphash + +From: Lizhi Xu + +commit 985b67cd86392310d9e9326de941c22fc9340eec upstream. + +When mounting the ext4 filesystem, if the default hash version is set to +DX_HASH_SIPHASH but the casefold feature is not set, exit the mounting. + +Reported-by: syzbot+340581ba9dceb7e06fb3@syzkaller.appspotmail.com +Signed-off-by: Lizhi Xu +Link: https://patch.msgid.link/20240605012335.44086-1-lizhi.xu@windriver.com +Signed-off-by: Theodore Ts'o +[cascardo: small conflict fixup] +Signed-off-by: Thadeu Lima de Souza Cascardo +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + fs/ext4/super.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index 05f1f9b7ad0c4..7780d8755ed8f 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -3191,6 +3191,14 @@ int ext4_feature_set_ok(struct super_block *sb, int readonly) + } + #endif + ++ if (EXT4_SB(sb)->s_es->s_def_hash_version == DX_HASH_SIPHASH && ++ !ext4_has_feature_casefold(sb)) { ++ ext4_msg(sb, KERN_ERR, ++ "Filesystem without casefold feature cannot be " ++ "mounted with siphash"); ++ return 0; ++ } ++ + if (readonly) + return 1; + +-- +2.51.0 + diff --git a/queue-5.15/ext4-fix-error-message-when-rejecting-the-default-ha.patch b/queue-5.15/ext4-fix-error-message-when-rejecting-the-default-ha.patch new file mode 100644 index 0000000000..cb32af6c83 --- /dev/null +++ b/queue-5.15/ext4-fix-error-message-when-rejecting-the-default-ha.patch @@ -0,0 +1,52 @@ +From 8907bf29100bd8831558d83b7020c4e49aee0b4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jan 2026 12:04:29 -0300 +Subject: ext4: fix error message when rejecting the default hash + +From: Gabriel Krisman Bertazi + +commit a2187431c395cdfbf144e3536f25468c64fc7cfa upstream. + +Commit 985b67cd8639 ("ext4: filesystems without casefold feature cannot +be mounted with siphash") properly rejects volumes where +s_def_hash_version is set to DX_HASH_SIPHASH, but the check and the +error message should not look into casefold setup - a filesystem should +never have DX_HASH_SIPHASH as the default hash. Fix it and, since we +are there, move the check to ext4_hash_info_init. + +Fixes:985b67cd8639 ("ext4: filesystems without casefold feature cannot +be mounted with siphash") + +Signed-off-by: Gabriel Krisman Bertazi +Link: https://patch.msgid.link/87jzg1en6j.fsf_-_@mailhost.krisman.be +Signed-off-by: Theodore Ts'o +[cascardo: conflicts due to other parts of ext4_fill_super having been factored out] +Signed-off-by: Thadeu Lima de Souza Cascardo +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + fs/ext4/super.c | 8 -------- + 1 file changed, 8 deletions(-) + +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index 7780d8755ed8f..05f1f9b7ad0c4 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -3191,14 +3191,6 @@ int ext4_feature_set_ok(struct super_block *sb, int readonly) + } + #endif + +- if (EXT4_SB(sb)->s_es->s_def_hash_version == DX_HASH_SIPHASH && +- !ext4_has_feature_casefold(sb)) { +- ext4_msg(sb, KERN_ERR, +- "Filesystem without casefold feature cannot be " +- "mounted with siphash"); +- return 0; +- } +- + if (readonly) + return 1; + +-- +2.51.0 + diff --git a/queue-5.15/nfs-fix-up-the-automount-fs_context-to-use-the-corre.patch b/queue-5.15/nfs-fix-up-the-automount-fs_context-to-use-the-corre.patch new file mode 100644 index 0000000000..2f6ae63a81 --- /dev/null +++ b/queue-5.15/nfs-fix-up-the-automount-fs_context-to-use-the-corre.patch @@ -0,0 +1,39 @@ +From e8b637fda14ec76264148f274fb62b4529ee27aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Nov 2025 18:56:46 -0500 +Subject: NFS: Fix up the automount fs_context to use the correct cred + +From: Trond Myklebust + +[ Upstream commit a2a8fc27dd668e7562b5326b5ed2f1604cb1e2e9 ] + +When automounting, the fs_context should be fixed up to use the cred +from the parent filesystem, since the operation is just extending the +namespace. Authorisation to enter that namespace will already have been +provided by the preceding lookup. + +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/namespace.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/fs/nfs/namespace.c b/fs/nfs/namespace.c +index 8fb570fd376a1..6367f067dd7be 100644 +--- a/fs/nfs/namespace.c ++++ b/fs/nfs/namespace.c +@@ -170,6 +170,11 @@ struct vfsmount *nfs_d_automount(struct path *path) + if (!ctx->clone_data.fattr) + goto out_fc; + ++ if (fc->cred != server->cred) { ++ put_cred(fc->cred); ++ fc->cred = get_cred(server->cred); ++ } ++ + if (fc->net_ns != client->cl_net) { + put_net(fc->net_ns); + fc->net_ns = get_net(client->cl_net); +-- +2.51.0 + diff --git a/queue-5.15/nfsv4-ensure-the-open-stateid-seqid-doesn-t-go-backw.patch b/queue-5.15/nfsv4-ensure-the-open-stateid-seqid-doesn-t-go-backw.patch new file mode 100644 index 0000000000..9c50e9d0f5 --- /dev/null +++ b/queue-5.15/nfsv4-ensure-the-open-stateid-seqid-doesn-t-go-backw.patch @@ -0,0 +1,74 @@ +From 53e9b7184a4125d84ea1e6db7d9ca4830002479f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Nov 2025 10:44:15 -0500 +Subject: NFSv4: ensure the open stateid seqid doesn't go backwards + +From: Scott Mayhew + +[ Upstream commit 2e47c3cc64b44b0b06cd68c2801db92ff143f2b2 ] + +We have observed an NFSv4 client receiving a LOCK reply with a status of +NFS4ERR_OLD_STATEID and subsequently retrying the LOCK request with an +earlier seqid value in the stateid. As this was for a new lockowner, +that would imply that nfs_set_open_stateid_locked() had updated the open +stateid seqid with an earlier value. + +Looking at nfs_set_open_stateid_locked(), if the incoming seqid is out +of sequence, the task will sleep on the state->waitq for up to 5 +seconds. If the task waits for the full 5 seconds, then after finishing +the wait it'll update the open stateid seqid with whatever value the +incoming seqid has. If there are multiple waiters in this scenario, +then the last one to perform said update may not be the one with the +highest seqid. + +Add a check to ensure that the seqid can only be incremented, and add a +tracepoint to indicate when old seqids are skipped. + +Signed-off-by: Scott Mayhew +Reviewed-by: Benjamin Coddington +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4proc.c | 13 +++++++++++-- + fs/nfs/nfs4trace.h | 1 + + 2 files changed, 12 insertions(+), 2 deletions(-) + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 883e4106fbcd9..cd97312860ce6 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -1709,8 +1709,17 @@ static void nfs_set_open_stateid_locked(struct nfs4_state *state, + if (nfs_stateid_is_sequential(state, stateid)) + break; + +- if (status) +- break; ++ if (status) { ++ if (nfs4_stateid_match_other(stateid, &state->open_stateid) && ++ !nfs4_stateid_is_newer(stateid, &state->open_stateid)) { ++ trace_nfs4_open_stateid_update_skip(state->inode, ++ stateid, status); ++ return; ++ } else { ++ break; ++ } ++ } ++ + /* Rely on seqids for serialisation with NFSv4.0 */ + if (!nfs4_has_session(NFS_SERVER(state->inode)->nfs_client)) + break; +diff --git a/fs/nfs/nfs4trace.h b/fs/nfs/nfs4trace.h +index 8565fa654f59a..d3d5842781da2 100644 +--- a/fs/nfs/nfs4trace.h ++++ b/fs/nfs/nfs4trace.h +@@ -1205,6 +1205,7 @@ DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_setattr); + DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_delegreturn); + DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_open_stateid_update); + DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_open_stateid_update_wait); ++DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_open_stateid_update_skip); + DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_close_stateid_update_wait); + + DECLARE_EVENT_CLASS(nfs4_getattr_event, +-- +2.51.0 + diff --git a/queue-5.15/scsi-ipr-enable-disable-irqd_no_balancing-during-res.patch b/queue-5.15/scsi-ipr-enable-disable-irqd_no_balancing-during-res.patch new file mode 100644 index 0000000000..d0f6600dc2 --- /dev/null +++ b/queue-5.15/scsi-ipr-enable-disable-irqd_no_balancing-during-res.patch @@ -0,0 +1,190 @@ +From e5937f0d74b1086b97dce6e5d2a50701b10a98c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Oct 2025 09:24:26 -0500 +Subject: scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset + +From: Wen Xiong + +[ Upstream commit 6ac3484fb13b2fc7f31cfc7f56093e7d0ce646a5 ] + +A dynamic remove/add storage adapter test hits EEH on PowerPC: + + EEH: [c00000000004f75c] __eeh_send_failure_event+0x7c/0x160 + EEH: [c000000000048444] eeh_dev_check_failure.part.0+0x254/0x650 + EEH: [c008000001650678] eeh_readl+0x60/0x90 [ipr] + EEH: [c00800000166746c] ipr_cancel_op+0x2b8/0x524 [ipr] + EEH: [c008000001656524] ipr_eh_abort+0x6c/0x130 [ipr] + EEH: [c000000000ab0d20] scmd_eh_abort_handler+0x140/0x440 + EEH: [c00000000017e558] process_one_work+0x298/0x590 + EEH: [c00000000017eef8] worker_thread+0xa8/0x620 + EEH: [c00000000018be34] kthread+0x124/0x130 + EEH: [c00000000000cd64] ret_from_kernel_thread+0x5c/0x64 + +A PCIe bus trace reveals that a vector of MSI-X is cleared to 0 by +irqbalance daemon. If we disable irqbalance daemon, we won't see the +issue. + +With debug enabled in ipr driver: + + [ 44.103071] ipr: Entering __ipr_remove + [ 44.103083] ipr: Entering ipr_initiate_ioa_bringdown + [ 44.103091] ipr: Entering ipr_reset_shutdown_ioa + [ 44.103099] ipr: Leaving ipr_reset_shutdown_ioa + [ 44.103105] ipr: Leaving ipr_initiate_ioa_bringdown + [ 44.149918] ipr: Entering ipr_reset_ucode_download + [ 44.149935] ipr: Entering ipr_reset_alert + [ 44.150032] ipr: Entering ipr_reset_start_timer + [ 44.150038] ipr: Leaving ipr_reset_alert + [ 44.244343] scsi 1:2:3:0: alua: Detached + [ 44.254300] ipr: Entering ipr_reset_start_bist + [ 44.254320] ipr: Entering ipr_reset_start_timer + [ 44.254325] ipr: Leaving ipr_reset_start_bist + [ 44.364329] scsi 1:2:4:0: alua: Detached + [ 45.134341] scsi 1:2:5:0: alua: Detached + [ 45.860949] ipr: Entering ipr_reset_shutdown_ioa + [ 45.860962] ipr: Leaving ipr_reset_shutdown_ioa + [ 45.860966] ipr: Entering ipr_reset_alert + [ 45.861028] ipr: Entering ipr_reset_start_timer + [ 45.861035] ipr: Leaving ipr_reset_alert + [ 45.964302] ipr: Entering ipr_reset_start_bist + [ 45.964309] ipr: Entering ipr_reset_start_timer + [ 45.964313] ipr: Leaving ipr_reset_start_bist + [ 46.264301] ipr: Entering ipr_reset_bist_done + [ 46.264309] ipr: Leaving ipr_reset_bist_done + +During adapter reset, ipr device driver blocks config space access but +can't block MMIO access for MSI-X entries. There is very small window: +irqbalance daemon kicks in during adapter reset before ipr driver calls +pci_restore_state(pdev) to restore MSI-X table. + +irqbalance daemon reads back all 0 for that MSI-X vector in +__pci_read_msi_msg(). + +irqbalance daemon: + + msi_domain_set_affinity() + ->irq_chip_set_affinity_patent() + ->xive_irq_set_affinity() + ->irq_chip_compose_msi_msg() + ->pseries_msi_compose_msg() + ->__pci_read_msi_msg(): read all 0 since didn't call pci_restore_state + ->irq_chip_write_msi_msg() + -> pci_write_msg_msi(): write 0 to the msix vector entry + +When ipr driver calls pci_restore_state(pdev) in +ipr_reset_restore_cfg_space(), the MSI-X vector entry has been cleared +by irqbalance daemon in pci_write_msg_msix(). + + pci_restore_state() + ->__pci_restore_msix_state() + +Below is the MSI-X table for ipr adapter after irqbalance daemon kicked +in during adapter reset: + + Dump MSIx table: index=0 address_lo=c800 address_hi=10000000 msg_data=0 + Dump MSIx table: index=1 address_lo=c810 address_hi=10000000 msg_data=0 + Dump MSIx table: index=2 address_lo=c820 address_hi=10000000 msg_data=0 + Dump MSIx table: index=3 address_lo=c830 address_hi=10000000 msg_data=0 + Dump MSIx table: index=4 address_lo=c840 address_hi=10000000 msg_data=0 + Dump MSIx table: index=5 address_lo=c850 address_hi=10000000 msg_data=0 + Dump MSIx table: index=6 address_lo=c860 address_hi=10000000 msg_data=0 + Dump MSIx table: index=7 address_lo=c870 address_hi=10000000 msg_data=0 + Dump MSIx table: index=8 address_lo=0 address_hi=0 msg_data=0 + ---------> Hit EEH since msix vector of index=8 are 0 + Dump MSIx table: index=9 address_lo=c890 address_hi=10000000 msg_data=0 + Dump MSIx table: index=10 address_lo=c8a0 address_hi=10000000 msg_data=0 + Dump MSIx table: index=11 address_lo=c8b0 address_hi=10000000 msg_data=0 + Dump MSIx table: index=12 address_lo=c8c0 address_hi=10000000 msg_data=0 + Dump MSIx table: index=13 address_lo=c8d0 address_hi=10000000 msg_data=0 + Dump MSIx table: index=14 address_lo=c8e0 address_hi=10000000 msg_data=0 + Dump MSIx table: index=15 address_lo=c8f0 address_hi=10000000 msg_data=0 + + [ 46.264312] ipr: Entering ipr_reset_restore_cfg_space + [ 46.267439] ipr: Entering ipr_fail_all_ops + [ 46.267447] ipr: Leaving ipr_fail_all_ops + [ 46.267451] ipr: Leaving ipr_reset_restore_cfg_space + [ 46.267454] ipr: Entering ipr_ioa_bringdown_done + [ 46.267458] ipr: Leaving ipr_ioa_bringdown_done + [ 46.267467] ipr: Entering ipr_worker_thread + [ 46.267470] ipr: Leaving ipr_worker_thread + +IRQ balancing is not required during adapter reset. + +Enable "IRQ_NO_BALANCING" flag before starting adapter reset and disable +it after calling pci_restore_state(). The irqbalance daemon is disabled +for this short period of time (~2s). + +Co-developed-by: Kyle Mahlkuch +Signed-off-by: Kyle Mahlkuch +Signed-off-by: Wen Xiong +Link: https://patch.msgid.link/20251028142427.3969819-2-wenxiong@linux.ibm.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ipr.c | 28 +++++++++++++++++++++++++++- + 1 file changed, 27 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c +index e5e38431c5c73..acb5025b196de 100644 +--- a/drivers/scsi/ipr.c ++++ b/drivers/scsi/ipr.c +@@ -62,8 +62,8 @@ + #include + #include + #include ++#include + #include +-#include + #include + #include + #include +@@ -8665,6 +8665,30 @@ static int ipr_dump_mailbox_wait(struct ipr_cmnd *ipr_cmd) + return IPR_RC_JOB_RETURN; + } + ++/** ++ * ipr_set_affinity_nobalance ++ * @ioa_cfg: ipr_ioa_cfg struct for an ipr device ++ * @flag: bool ++ * true: ensable "IRQ_NO_BALANCING" bit for msix interrupt ++ * false: disable "IRQ_NO_BALANCING" bit for msix interrupt ++ * Description: This function will be called to disable/enable ++ * "IRQ_NO_BALANCING" to avoid irqbalance daemon ++ * kicking in during adapter reset. ++ **/ ++static void ipr_set_affinity_nobalance(struct ipr_ioa_cfg *ioa_cfg, bool flag) ++{ ++ int irq, i; ++ ++ for (i = 0; i < ioa_cfg->nvectors; i++) { ++ irq = pci_irq_vector(ioa_cfg->pdev, i); ++ ++ if (flag) ++ irq_set_status_flags(irq, IRQ_NO_BALANCING); ++ else ++ irq_clear_status_flags(irq, IRQ_NO_BALANCING); ++ } ++} ++ + /** + * ipr_reset_restore_cfg_space - Restore PCI config space. + * @ipr_cmd: ipr command struct +@@ -8689,6 +8713,7 @@ static int ipr_reset_restore_cfg_space(struct ipr_cmnd *ipr_cmd) + return IPR_RC_JOB_CONTINUE; + } + ++ ipr_set_affinity_nobalance(ioa_cfg, false); + ipr_fail_all_ops(ioa_cfg); + + if (ioa_cfg->sis64) { +@@ -8768,6 +8793,7 @@ static int ipr_reset_start_bist(struct ipr_cmnd *ipr_cmd) + rc = pci_write_config_byte(ioa_cfg->pdev, PCI_BIST, PCI_BIST_START); + + if (rc == PCIBIOS_SUCCESSFUL) { ++ ipr_set_affinity_nobalance(ioa_cfg, true); + ipr_cmd->job_step = ipr_reset_bist_done; + ipr_reset_start_timer(ipr_cmd, IPR_WAIT_FOR_BIST_TIMEOUT); + rc = IPR_RC_JOB_RETURN; +-- +2.51.0 + diff --git a/queue-5.15/scsi-revert-scsi-libsas-fix-exp-attached-device-scan.patch b/queue-5.15/scsi-revert-scsi-libsas-fix-exp-attached-device-scan.patch new file mode 100644 index 0000000000..c222235749 --- /dev/null +++ b/queue-5.15/scsi-revert-scsi-libsas-fix-exp-attached-device-scan.patch @@ -0,0 +1,59 @@ +From 9a6d0a8f246a03059ef31af3cbbbc48330d2ac86 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 14:56:27 +0800 +Subject: scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe + failure scanned in again after probe failed" + +From: Xingui Yang + +[ Upstream commit 278712d20bc8ec29d1ad6ef9bdae9000ef2c220c ] + +This reverts commit ab2068a6fb84751836a84c26ca72b3beb349619d. + +When probing the exp-attached sata device, libsas/libata will issue a +hard reset in sas_probe_sata() -> ata_sas_async_probe(), then a +broadcast event will be received after the disk probe fails, and this +commit causes the probe will be re-executed on the disk, and a faulty +disk may get into an indefinite loop of probe. + +Therefore, revert this commit, although it can fix some temporary issues +with disk probe failure. + +Signed-off-by: Xingui Yang +Reviewed-by: Jason Yan +Reviewed-by: John Garry +Link: https://patch.msgid.link/20251202065627.140361-1-yangxingui@huawei.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/libsas/sas_internal.h | 14 -------------- + 1 file changed, 14 deletions(-) + +diff --git a/drivers/scsi/libsas/sas_internal.h b/drivers/scsi/libsas/sas_internal.h +index 5028bc394c4f9..d7a1fb5c10c6e 100644 +--- a/drivers/scsi/libsas/sas_internal.h ++++ b/drivers/scsi/libsas/sas_internal.h +@@ -111,20 +111,6 @@ static inline void sas_fail_probe(struct domain_device *dev, const char *func, i + func, dev->parent ? "exp-attached" : + "direct-attached", + SAS_ADDR(dev->sas_addr), err); +- +- /* +- * If the device probe failed, the expander phy attached address +- * needs to be reset so that the phy will not be treated as flutter +- * in the next revalidation +- */ +- if (dev->parent && !dev_is_expander(dev->dev_type)) { +- struct sas_phy *phy = dev->phy; +- struct domain_device *parent = dev->parent; +- struct ex_phy *ex_phy = &parent->ex_dev.ex_phy[phy->number]; +- +- memset(ex_phy->attached_sas_addr, 0, SAS_ADDR_SIZE); +- } +- + sas_unregister_dev(dev->port, dev); + } + +-- +2.51.0 + diff --git a/queue-5.15/series b/queue-5.15/series index f0292bbfde..2429291ef9 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -516,3 +516,12 @@ ext4-introduce-itail-helper.patch ext4-fix-out-of-bound-read-in-ext4_xattr_inode_dec_ref_all.patch net-add-locking-to-protect-skb-dev-access-in-ip_output.patch tls-use-__sk_dst_get-and-dst_dev_rcu-in-get_netdev_for_sock.patch +ext4-filesystems-without-casefold-feature-cannot-be-.patch +ext4-fix-error-message-when-rejecting-the-default-ha.patch +csky-fix-csky_cmpxchg_fixup-not-working.patch +arm-9461-1-disable-highpte-on-preempt_rt-kernels.patch +alpha-don-t-reference-obsolete-termio-struct-for-tc-.patch +nfsv4-ensure-the-open-stateid-seqid-doesn-t-go-backw.patch +nfs-fix-up-the-automount-fs_context-to-use-the-corre.patch +scsi-ipr-enable-disable-irqd_no_balancing-during-res.patch +scsi-revert-scsi-libsas-fix-exp-attached-device-scan.patch diff --git a/queue-6.1/alpha-don-t-reference-obsolete-termio-struct-for-tc-.patch b/queue-6.1/alpha-don-t-reference-obsolete-termio-struct-for-tc-.patch new file mode 100644 index 0000000000..12423094f2 --- /dev/null +++ b/queue-6.1/alpha-don-t-reference-obsolete-termio-struct-for-tc-.patch @@ -0,0 +1,49 @@ +From 7bba8da611ddaa6b10f26d8d26882e3a62ed61f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Dec 2025 08:14:57 +0000 +Subject: alpha: don't reference obsolete termio struct for TC* constants + +From: Sam James + +[ Upstream commit 9aeed9041929812a10a6d693af050846942a1d16 ] + +Similar in nature to ab107276607af90b13a5994997e19b7b9731e251. glibc-2.42 +drops the legacy termio struct, but the ioctls.h header still defines some +TC* constants in terms of termio (via sizeof). Hardcode the values instead. + +This fixes building Python for example, which falls over like: + ./Modules/termios.c:1119:16: error: invalid application of 'sizeof' to incomplete type 'struct termio' + +Link: https://bugs.gentoo.org/961769 +Link: https://bugs.gentoo.org/962600 +Signed-off-by: Sam James +Reviewed-by: Magnus Lindholm +Link: https://lore.kernel.org/r/6ebd3451908785cad53b50ca6bc46cfe9d6bc03c.1764922497.git.sam@gentoo.org +Signed-off-by: Magnus Lindholm +Signed-off-by: Sasha Levin +--- + arch/alpha/include/uapi/asm/ioctls.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/alpha/include/uapi/asm/ioctls.h b/arch/alpha/include/uapi/asm/ioctls.h +index 971311605288f..a09d04b49cc65 100644 +--- a/arch/alpha/include/uapi/asm/ioctls.h ++++ b/arch/alpha/include/uapi/asm/ioctls.h +@@ -23,10 +23,10 @@ + #define TCSETSW _IOW('t', 21, struct termios) + #define TCSETSF _IOW('t', 22, struct termios) + +-#define TCGETA _IOR('t', 23, struct termio) +-#define TCSETA _IOW('t', 24, struct termio) +-#define TCSETAW _IOW('t', 25, struct termio) +-#define TCSETAF _IOW('t', 28, struct termio) ++#define TCGETA 0x40127417 ++#define TCSETA 0x80127418 ++#define TCSETAW 0x80127419 ++#define TCSETAF 0x8012741c + + #define TCSBRK _IO('t', 29) + #define TCXONC _IO('t', 30) +-- +2.51.0 + diff --git a/queue-6.1/arm-9461-1-disable-highpte-on-preempt_rt-kernels.patch b/queue-6.1/arm-9461-1-disable-highpte-on-preempt_rt-kernels.patch new file mode 100644 index 0000000000..ea110f17c0 --- /dev/null +++ b/queue-6.1/arm-9461-1-disable-highpte-on-preempt_rt-kernels.patch @@ -0,0 +1,51 @@ +From 0b92b8784fcf5433034cd3e954402a72c50309f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Nov 2025 16:54:37 +0100 +Subject: ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels + +From: Sebastian Andrzej Siewior + +[ Upstream commit fedadc4137234c3d00c4785eeed3e747fe9036ae ] + +gup_pgd_range() is invoked with disabled interrupts and invokes +__kmap_local_page_prot() via pte_offset_map(), gup_p4d_range(). +With HIGHPTE enabled, __kmap_local_page_prot() invokes kmap_high_get() +which uses a spinlock_t via lock_kmap_any(). This leads to an +sleeping-while-atomic error on PREEMPT_RT because spinlock_t becomes a +sleeping lock and must not be acquired in atomic context. + +The loop in map_new_virtual() uses wait_queue_head_t for wake up which +also is using a spinlock_t. + +Since HIGHPTE is rarely needed at all, turn it off for PREEMPT_RT +to allow the use of get_user_pages_fast(). + +[arnd: rework patch to turn off HIGHPTE instead of HAVE_PAST_GUP] + +Co-developed-by: Arnd Bergmann + +Acked-by: Linus Walleij +Reviewed-by: Arnd Bergmann +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Russell King (Oracle) +Signed-off-by: Sasha Levin +--- + arch/arm/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig +index 6d5afe2e6ba33..f0352e5675dd0 100644 +--- a/arch/arm/Kconfig ++++ b/arch/arm/Kconfig +@@ -1318,7 +1318,7 @@ config HIGHMEM + + config HIGHPTE + bool "Allocate 2nd-level pagetables from highmem" if EXPERT +- depends on HIGHMEM ++ depends on HIGHMEM && !PREEMPT_RT + default y + help + The VM uses one page of physical memory for each page table. +-- +2.51.0 + diff --git a/queue-6.1/bcache-fix-improper-use-of-bi_end_io.patch b/queue-6.1/bcache-fix-improper-use-of-bi_end_io.patch new file mode 100644 index 0000000000..b2e6af3408 --- /dev/null +++ b/queue-6.1/bcache-fix-improper-use-of-bi_end_io.patch @@ -0,0 +1,55 @@ +From ea0e23f93c78d8ca22abe5739808fe20d6a41f74 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Dec 2025 17:01:56 +0800 +Subject: bcache: fix improper use of bi_end_io + +From: Shida Zhang + +[ Upstream commit 53280e398471f0bddbb17b798a63d41264651325 ] + +Don't call bio->bi_end_io() directly. Use the bio_endio() helper +function instead, which handles completion more safely and uniformly. + +Suggested-by: Christoph Hellwig +Reviewed-by: Christoph Hellwig +Signed-off-by: Shida Zhang +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/md/bcache/request.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c +index 3427555b0ccae..6a1bd0c49d2b9 100644 +--- a/drivers/md/bcache/request.c ++++ b/drivers/md/bcache/request.c +@@ -1090,7 +1090,7 @@ static void detached_dev_end_io(struct bio *bio) + } + + kfree(ddip); +- bio->bi_end_io(bio); ++ bio_endio(bio); + } + + static void detached_dev_do_request(struct bcache_device *d, struct bio *bio, +@@ -1107,7 +1107,7 @@ static void detached_dev_do_request(struct bcache_device *d, struct bio *bio, + ddip = kzalloc(sizeof(struct detached_dev_io_private), GFP_NOIO); + if (!ddip) { + bio->bi_status = BLK_STS_RESOURCE; +- bio->bi_end_io(bio); ++ bio_endio(bio); + return; + } + +@@ -1122,7 +1122,7 @@ static void detached_dev_do_request(struct bcache_device *d, struct bio *bio, + + if ((bio_op(bio) == REQ_OP_DISCARD) && + !bdev_max_discard_sectors(dc->bdev)) +- bio->bi_end_io(bio); ++ detached_dev_end_io(bio); + else + submit_bio_noacct(bio); + } +-- +2.51.0 + diff --git a/queue-6.1/csky-fix-csky_cmpxchg_fixup-not-working.patch b/queue-6.1/csky-fix-csky_cmpxchg_fixup-not-working.patch new file mode 100644 index 0000000000..2dec21fda1 --- /dev/null +++ b/queue-6.1/csky-fix-csky_cmpxchg_fixup-not-working.patch @@ -0,0 +1,40 @@ +From 7ded6f882c3ea27581fc9c4a10a66604e66a9e9c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Oct 2024 17:56:26 +0800 +Subject: csky: fix csky_cmpxchg_fixup not working + +From: Yang Li + +[ Upstream commit 809ef03d6d21d5fea016bbf6babeec462e37e68c ] + +In the csky_cmpxchg_fixup function, it is incorrect to use the global +variable csky_cmpxchg_stw to determine the address where the exception +occurred.The global variable csky_cmpxchg_stw stores the opcode at the +time of the exception, while &csky_cmpxchg_stw shows the address where +the exception occurred. + +Signed-off-by: Yang Li +Signed-off-by: Guo Ren +Signed-off-by: Sasha Levin +--- + arch/csky/mm/fault.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/csky/mm/fault.c b/arch/csky/mm/fault.c +index a885518ce1dd2..5226bc08c3360 100644 +--- a/arch/csky/mm/fault.c ++++ b/arch/csky/mm/fault.c +@@ -45,8 +45,8 @@ static inline void csky_cmpxchg_fixup(struct pt_regs *regs) + if (trap_no(regs) != VEC_TLBMODIFIED) + return; + +- if (instruction_pointer(regs) == csky_cmpxchg_stw) +- instruction_pointer_set(regs, csky_cmpxchg_ldw); ++ if (instruction_pointer(regs) == (unsigned long)&csky_cmpxchg_stw) ++ instruction_pointer_set(regs, (unsigned long)&csky_cmpxchg_ldw); + return; + } + #endif +-- +2.51.0 + diff --git a/queue-6.1/nfs-fix-up-the-automount-fs_context-to-use-the-corre.patch b/queue-6.1/nfs-fix-up-the-automount-fs_context-to-use-the-corre.patch new file mode 100644 index 0000000000..1ae0c660fa --- /dev/null +++ b/queue-6.1/nfs-fix-up-the-automount-fs_context-to-use-the-corre.patch @@ -0,0 +1,39 @@ +From ead66d1000b52d39b727fba1a8cb8a85b3ed072a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Nov 2025 18:56:46 -0500 +Subject: NFS: Fix up the automount fs_context to use the correct cred + +From: Trond Myklebust + +[ Upstream commit a2a8fc27dd668e7562b5326b5ed2f1604cb1e2e9 ] + +When automounting, the fs_context should be fixed up to use the cred +from the parent filesystem, since the operation is just extending the +namespace. Authorisation to enter that namespace will already have been +provided by the preceding lookup. + +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/namespace.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/fs/nfs/namespace.c b/fs/nfs/namespace.c +index 663f1a3f7cc3e..5cbbe59e56234 100644 +--- a/fs/nfs/namespace.c ++++ b/fs/nfs/namespace.c +@@ -170,6 +170,11 @@ struct vfsmount *nfs_d_automount(struct path *path) + if (!ctx->clone_data.fattr) + goto out_fc; + ++ if (fc->cred != server->cred) { ++ put_cred(fc->cred); ++ fc->cred = get_cred(server->cred); ++ } ++ + if (fc->net_ns != client->cl_net) { + put_net(fc->net_ns); + fc->net_ns = get_net(client->cl_net); +-- +2.51.0 + diff --git a/queue-6.1/nfsv4-ensure-the-open-stateid-seqid-doesn-t-go-backw.patch b/queue-6.1/nfsv4-ensure-the-open-stateid-seqid-doesn-t-go-backw.patch new file mode 100644 index 0000000000..bc5ca044d4 --- /dev/null +++ b/queue-6.1/nfsv4-ensure-the-open-stateid-seqid-doesn-t-go-backw.patch @@ -0,0 +1,74 @@ +From 763a0ab1db5fc4a00bab8a2cd63326cdd993dbc0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Nov 2025 10:44:15 -0500 +Subject: NFSv4: ensure the open stateid seqid doesn't go backwards + +From: Scott Mayhew + +[ Upstream commit 2e47c3cc64b44b0b06cd68c2801db92ff143f2b2 ] + +We have observed an NFSv4 client receiving a LOCK reply with a status of +NFS4ERR_OLD_STATEID and subsequently retrying the LOCK request with an +earlier seqid value in the stateid. As this was for a new lockowner, +that would imply that nfs_set_open_stateid_locked() had updated the open +stateid seqid with an earlier value. + +Looking at nfs_set_open_stateid_locked(), if the incoming seqid is out +of sequence, the task will sleep on the state->waitq for up to 5 +seconds. If the task waits for the full 5 seconds, then after finishing +the wait it'll update the open stateid seqid with whatever value the +incoming seqid has. If there are multiple waiters in this scenario, +then the last one to perform said update may not be the one with the +highest seqid. + +Add a check to ensure that the seqid can only be incremented, and add a +tracepoint to indicate when old seqids are skipped. + +Signed-off-by: Scott Mayhew +Reviewed-by: Benjamin Coddington +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4proc.c | 13 +++++++++++-- + fs/nfs/nfs4trace.h | 1 + + 2 files changed, 12 insertions(+), 2 deletions(-) + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index d4ae2ce56af4a..8258bce82e5bc 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -1700,8 +1700,17 @@ static void nfs_set_open_stateid_locked(struct nfs4_state *state, + if (nfs_stateid_is_sequential(state, stateid)) + break; + +- if (status) +- break; ++ if (status) { ++ if (nfs4_stateid_match_other(stateid, &state->open_stateid) && ++ !nfs4_stateid_is_newer(stateid, &state->open_stateid)) { ++ trace_nfs4_open_stateid_update_skip(state->inode, ++ stateid, status); ++ return; ++ } else { ++ break; ++ } ++ } ++ + /* Rely on seqids for serialisation with NFSv4.0 */ + if (!nfs4_has_session(NFS_SERVER(state->inode)->nfs_client)) + break; +diff --git a/fs/nfs/nfs4trace.h b/fs/nfs/nfs4trace.h +index c8a57cfde64b4..0fc1b4a6eab90 100644 +--- a/fs/nfs/nfs4trace.h ++++ b/fs/nfs/nfs4trace.h +@@ -1248,6 +1248,7 @@ DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_setattr); + DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_delegreturn); + DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_open_stateid_update); + DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_open_stateid_update_wait); ++DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_open_stateid_update_skip); + DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_close_stateid_update_wait); + + DECLARE_EVENT_CLASS(nfs4_getattr_event, +-- +2.51.0 + diff --git a/queue-6.1/scsi-ipr-enable-disable-irqd_no_balancing-during-res.patch b/queue-6.1/scsi-ipr-enable-disable-irqd_no_balancing-during-res.patch new file mode 100644 index 0000000000..dd72e7a26e --- /dev/null +++ b/queue-6.1/scsi-ipr-enable-disable-irqd_no_balancing-during-res.patch @@ -0,0 +1,190 @@ +From bac864df8a18dc8906ac647d440aee509cab46a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Oct 2025 09:24:26 -0500 +Subject: scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset + +From: Wen Xiong + +[ Upstream commit 6ac3484fb13b2fc7f31cfc7f56093e7d0ce646a5 ] + +A dynamic remove/add storage adapter test hits EEH on PowerPC: + + EEH: [c00000000004f75c] __eeh_send_failure_event+0x7c/0x160 + EEH: [c000000000048444] eeh_dev_check_failure.part.0+0x254/0x650 + EEH: [c008000001650678] eeh_readl+0x60/0x90 [ipr] + EEH: [c00800000166746c] ipr_cancel_op+0x2b8/0x524 [ipr] + EEH: [c008000001656524] ipr_eh_abort+0x6c/0x130 [ipr] + EEH: [c000000000ab0d20] scmd_eh_abort_handler+0x140/0x440 + EEH: [c00000000017e558] process_one_work+0x298/0x590 + EEH: [c00000000017eef8] worker_thread+0xa8/0x620 + EEH: [c00000000018be34] kthread+0x124/0x130 + EEH: [c00000000000cd64] ret_from_kernel_thread+0x5c/0x64 + +A PCIe bus trace reveals that a vector of MSI-X is cleared to 0 by +irqbalance daemon. If we disable irqbalance daemon, we won't see the +issue. + +With debug enabled in ipr driver: + + [ 44.103071] ipr: Entering __ipr_remove + [ 44.103083] ipr: Entering ipr_initiate_ioa_bringdown + [ 44.103091] ipr: Entering ipr_reset_shutdown_ioa + [ 44.103099] ipr: Leaving ipr_reset_shutdown_ioa + [ 44.103105] ipr: Leaving ipr_initiate_ioa_bringdown + [ 44.149918] ipr: Entering ipr_reset_ucode_download + [ 44.149935] ipr: Entering ipr_reset_alert + [ 44.150032] ipr: Entering ipr_reset_start_timer + [ 44.150038] ipr: Leaving ipr_reset_alert + [ 44.244343] scsi 1:2:3:0: alua: Detached + [ 44.254300] ipr: Entering ipr_reset_start_bist + [ 44.254320] ipr: Entering ipr_reset_start_timer + [ 44.254325] ipr: Leaving ipr_reset_start_bist + [ 44.364329] scsi 1:2:4:0: alua: Detached + [ 45.134341] scsi 1:2:5:0: alua: Detached + [ 45.860949] ipr: Entering ipr_reset_shutdown_ioa + [ 45.860962] ipr: Leaving ipr_reset_shutdown_ioa + [ 45.860966] ipr: Entering ipr_reset_alert + [ 45.861028] ipr: Entering ipr_reset_start_timer + [ 45.861035] ipr: Leaving ipr_reset_alert + [ 45.964302] ipr: Entering ipr_reset_start_bist + [ 45.964309] ipr: Entering ipr_reset_start_timer + [ 45.964313] ipr: Leaving ipr_reset_start_bist + [ 46.264301] ipr: Entering ipr_reset_bist_done + [ 46.264309] ipr: Leaving ipr_reset_bist_done + +During adapter reset, ipr device driver blocks config space access but +can't block MMIO access for MSI-X entries. There is very small window: +irqbalance daemon kicks in during adapter reset before ipr driver calls +pci_restore_state(pdev) to restore MSI-X table. + +irqbalance daemon reads back all 0 for that MSI-X vector in +__pci_read_msi_msg(). + +irqbalance daemon: + + msi_domain_set_affinity() + ->irq_chip_set_affinity_patent() + ->xive_irq_set_affinity() + ->irq_chip_compose_msi_msg() + ->pseries_msi_compose_msg() + ->__pci_read_msi_msg(): read all 0 since didn't call pci_restore_state + ->irq_chip_write_msi_msg() + -> pci_write_msg_msi(): write 0 to the msix vector entry + +When ipr driver calls pci_restore_state(pdev) in +ipr_reset_restore_cfg_space(), the MSI-X vector entry has been cleared +by irqbalance daemon in pci_write_msg_msix(). + + pci_restore_state() + ->__pci_restore_msix_state() + +Below is the MSI-X table for ipr adapter after irqbalance daemon kicked +in during adapter reset: + + Dump MSIx table: index=0 address_lo=c800 address_hi=10000000 msg_data=0 + Dump MSIx table: index=1 address_lo=c810 address_hi=10000000 msg_data=0 + Dump MSIx table: index=2 address_lo=c820 address_hi=10000000 msg_data=0 + Dump MSIx table: index=3 address_lo=c830 address_hi=10000000 msg_data=0 + Dump MSIx table: index=4 address_lo=c840 address_hi=10000000 msg_data=0 + Dump MSIx table: index=5 address_lo=c850 address_hi=10000000 msg_data=0 + Dump MSIx table: index=6 address_lo=c860 address_hi=10000000 msg_data=0 + Dump MSIx table: index=7 address_lo=c870 address_hi=10000000 msg_data=0 + Dump MSIx table: index=8 address_lo=0 address_hi=0 msg_data=0 + ---------> Hit EEH since msix vector of index=8 are 0 + Dump MSIx table: index=9 address_lo=c890 address_hi=10000000 msg_data=0 + Dump MSIx table: index=10 address_lo=c8a0 address_hi=10000000 msg_data=0 + Dump MSIx table: index=11 address_lo=c8b0 address_hi=10000000 msg_data=0 + Dump MSIx table: index=12 address_lo=c8c0 address_hi=10000000 msg_data=0 + Dump MSIx table: index=13 address_lo=c8d0 address_hi=10000000 msg_data=0 + Dump MSIx table: index=14 address_lo=c8e0 address_hi=10000000 msg_data=0 + Dump MSIx table: index=15 address_lo=c8f0 address_hi=10000000 msg_data=0 + + [ 46.264312] ipr: Entering ipr_reset_restore_cfg_space + [ 46.267439] ipr: Entering ipr_fail_all_ops + [ 46.267447] ipr: Leaving ipr_fail_all_ops + [ 46.267451] ipr: Leaving ipr_reset_restore_cfg_space + [ 46.267454] ipr: Entering ipr_ioa_bringdown_done + [ 46.267458] ipr: Leaving ipr_ioa_bringdown_done + [ 46.267467] ipr: Entering ipr_worker_thread + [ 46.267470] ipr: Leaving ipr_worker_thread + +IRQ balancing is not required during adapter reset. + +Enable "IRQ_NO_BALANCING" flag before starting adapter reset and disable +it after calling pci_restore_state(). The irqbalance daemon is disabled +for this short period of time (~2s). + +Co-developed-by: Kyle Mahlkuch +Signed-off-by: Kyle Mahlkuch +Signed-off-by: Wen Xiong +Link: https://patch.msgid.link/20251028142427.3969819-2-wenxiong@linux.ibm.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ipr.c | 28 +++++++++++++++++++++++++++- + 1 file changed, 27 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c +index 8c062afb2918d..89b8990208506 100644 +--- a/drivers/scsi/ipr.c ++++ b/drivers/scsi/ipr.c +@@ -62,8 +62,8 @@ + #include + #include + #include ++#include + #include +-#include + #include + #include + #include +@@ -8669,6 +8669,30 @@ static int ipr_dump_mailbox_wait(struct ipr_cmnd *ipr_cmd) + return IPR_RC_JOB_RETURN; + } + ++/** ++ * ipr_set_affinity_nobalance ++ * @ioa_cfg: ipr_ioa_cfg struct for an ipr device ++ * @flag: bool ++ * true: ensable "IRQ_NO_BALANCING" bit for msix interrupt ++ * false: disable "IRQ_NO_BALANCING" bit for msix interrupt ++ * Description: This function will be called to disable/enable ++ * "IRQ_NO_BALANCING" to avoid irqbalance daemon ++ * kicking in during adapter reset. ++ **/ ++static void ipr_set_affinity_nobalance(struct ipr_ioa_cfg *ioa_cfg, bool flag) ++{ ++ int irq, i; ++ ++ for (i = 0; i < ioa_cfg->nvectors; i++) { ++ irq = pci_irq_vector(ioa_cfg->pdev, i); ++ ++ if (flag) ++ irq_set_status_flags(irq, IRQ_NO_BALANCING); ++ else ++ irq_clear_status_flags(irq, IRQ_NO_BALANCING); ++ } ++} ++ + /** + * ipr_reset_restore_cfg_space - Restore PCI config space. + * @ipr_cmd: ipr command struct +@@ -8693,6 +8717,7 @@ static int ipr_reset_restore_cfg_space(struct ipr_cmnd *ipr_cmd) + return IPR_RC_JOB_CONTINUE; + } + ++ ipr_set_affinity_nobalance(ioa_cfg, false); + ipr_fail_all_ops(ioa_cfg); + + if (ioa_cfg->sis64) { +@@ -8772,6 +8797,7 @@ static int ipr_reset_start_bist(struct ipr_cmnd *ipr_cmd) + rc = pci_write_config_byte(ioa_cfg->pdev, PCI_BIST, PCI_BIST_START); + + if (rc == PCIBIOS_SUCCESSFUL) { ++ ipr_set_affinity_nobalance(ioa_cfg, true); + ipr_cmd->job_step = ipr_reset_bist_done; + ipr_reset_start_timer(ipr_cmd, IPR_WAIT_FOR_BIST_TIMEOUT); + rc = IPR_RC_JOB_RETURN; +-- +2.51.0 + diff --git a/queue-6.1/scsi-revert-scsi-libsas-fix-exp-attached-device-scan.patch b/queue-6.1/scsi-revert-scsi-libsas-fix-exp-attached-device-scan.patch new file mode 100644 index 0000000000..edda70d3dc --- /dev/null +++ b/queue-6.1/scsi-revert-scsi-libsas-fix-exp-attached-device-scan.patch @@ -0,0 +1,59 @@ +From 676b811dd00a4e99177e501dfd074c8f8afb5786 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 14:56:27 +0800 +Subject: scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe + failure scanned in again after probe failed" + +From: Xingui Yang + +[ Upstream commit 278712d20bc8ec29d1ad6ef9bdae9000ef2c220c ] + +This reverts commit ab2068a6fb84751836a84c26ca72b3beb349619d. + +When probing the exp-attached sata device, libsas/libata will issue a +hard reset in sas_probe_sata() -> ata_sas_async_probe(), then a +broadcast event will be received after the disk probe fails, and this +commit causes the probe will be re-executed on the disk, and a faulty +disk may get into an indefinite loop of probe. + +Therefore, revert this commit, although it can fix some temporary issues +with disk probe failure. + +Signed-off-by: Xingui Yang +Reviewed-by: Jason Yan +Reviewed-by: John Garry +Link: https://patch.msgid.link/20251202065627.140361-1-yangxingui@huawei.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/libsas/sas_internal.h | 14 -------------- + 1 file changed, 14 deletions(-) + +diff --git a/drivers/scsi/libsas/sas_internal.h b/drivers/scsi/libsas/sas_internal.h +index 6ddccc67e808f..a94bd0790b055 100644 +--- a/drivers/scsi/libsas/sas_internal.h ++++ b/drivers/scsi/libsas/sas_internal.h +@@ -119,20 +119,6 @@ static inline void sas_fail_probe(struct domain_device *dev, const char *func, i + func, dev->parent ? "exp-attached" : + "direct-attached", + SAS_ADDR(dev->sas_addr), err); +- +- /* +- * If the device probe failed, the expander phy attached address +- * needs to be reset so that the phy will not be treated as flutter +- * in the next revalidation +- */ +- if (dev->parent && !dev_is_expander(dev->dev_type)) { +- struct sas_phy *phy = dev->phy; +- struct domain_device *parent = dev->parent; +- struct ex_phy *ex_phy = &parent->ex_dev.ex_phy[phy->number]; +- +- memset(ex_phy->attached_sas_addr, 0, SAS_ADDR_SIZE); +- } +- + sas_unregister_dev(dev->port, dev); + } + +-- +2.51.0 + diff --git a/queue-6.1/scsi-ufs-core-fix-eh-failure-after-w-lun-resume-erro.patch b/queue-6.1/scsi-ufs-core-fix-eh-failure-after-w-lun-resume-erro.patch new file mode 100644 index 0000000000..cd7108f46c --- /dev/null +++ b/queue-6.1/scsi-ufs-core-fix-eh-failure-after-w-lun-resume-erro.patch @@ -0,0 +1,126 @@ +From d18202c2e95ebac59984203faa1679e32614904f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Nov 2025 06:32:02 +0000 +Subject: scsi: ufs: core: Fix EH failure after W-LUN resume error + +From: Brian Kao + +[ Upstream commit b4bb6daf4ac4d4560044ecdd81e93aa2f6acbb06 ] + +When a W-LUN resume fails, its parent devices in the SCSI hierarchy, +including the scsi_target, may be runtime suspended. Subsequently, the +error handler in ufshcd_recover_pm_error() fails to set the W-LUN device +back to active because the parent target is not active. This results in +the following errors: + + google-ufshcd 3c2d0000.ufs: ufshcd_err_handler started; HBA state eh_fatal; ... + ufs_device_wlun 0:0:0:49488: START_STOP failed for power mode: 1, result 40000 + ufs_device_wlun 0:0:0:49488: ufshcd_wl_runtime_resume failed: -5 + ... + ufs_device_wlun 0:0:0:49488: runtime PM trying to activate child device 0:0:0:49488 but parent (target0:0:0) is not active + +Address this by: + + 1. Ensuring the W-LUN's parent scsi_target is runtime resumed before + attempting to set the W-LUN to active within + ufshcd_recover_pm_error(). + + 2. Explicitly checking for power.runtime_error on the HBA and W-LUN + devices before calling pm_runtime_set_active() to clear the error + state. + + 3. Adding pm_runtime_get_sync(hba->dev) in + ufshcd_err_handling_prepare() to ensure the HBA itself is active + during error recovery, even if a child device resume failed. + +These changes ensure the device power states are managed correctly +during error recovery. + +Signed-off-by: Brian Kao +Tested-by: Brian Kao +Reviewed-by: Bart Van Assche +Link: https://patch.msgid.link/20251112063214.1195761-1-powenkao@google.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/ufs/core/ufshcd.c | 36 ++++++++++++++++++++++++++++-------- + 1 file changed, 28 insertions(+), 8 deletions(-) + +diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c +index 2435ea7ec089b..d553169b4d9ad 100644 +--- a/drivers/ufs/core/ufshcd.c ++++ b/drivers/ufs/core/ufshcd.c +@@ -6154,6 +6154,11 @@ static void ufshcd_clk_scaling_suspend(struct ufs_hba *hba, bool suspend) + + static void ufshcd_err_handling_prepare(struct ufs_hba *hba) + { ++ /* ++ * A WLUN resume failure could potentially lead to the HBA being ++ * runtime suspended, so take an extra reference on hba->dev. ++ */ ++ pm_runtime_get_sync(hba->dev); + ufshcd_rpm_get_sync(hba); + if (pm_runtime_status_suspended(&hba->ufs_device_wlun->sdev_gendev) || + hba->is_sys_suspended) { +@@ -6194,6 +6199,7 @@ static void ufshcd_err_handling_unprepare(struct ufs_hba *hba) + if (ufshcd_is_clkscaling_supported(hba)) + ufshcd_clk_scaling_suspend(hba, false); + ufshcd_rpm_put(hba); ++ pm_runtime_put(hba->dev); + } + + static inline bool ufshcd_err_handling_should_stop(struct ufs_hba *hba) +@@ -6208,28 +6214,42 @@ static inline bool ufshcd_err_handling_should_stop(struct ufs_hba *hba) + #ifdef CONFIG_PM + static void ufshcd_recover_pm_error(struct ufs_hba *hba) + { ++ struct scsi_target *starget = hba->ufs_device_wlun->sdev_target; + struct Scsi_Host *shost = hba->host; + struct scsi_device *sdev; + struct request_queue *q; +- int ret; ++ bool resume_sdev_queues = false; + + hba->is_sys_suspended = false; ++ + /* +- * Set RPM status of wlun device to RPM_ACTIVE, +- * this also clears its runtime error. ++ * Ensure the parent's error status is cleared before proceeding ++ * to the child, as the parent must be active to activate the child. + */ +- ret = pm_runtime_set_active(&hba->ufs_device_wlun->sdev_gendev); ++ if (hba->dev->power.runtime_error) { ++ /* hba->dev has no functional parent thus simplily set RPM_ACTIVE */ ++ pm_runtime_set_active(hba->dev); ++ resume_sdev_queues = true; ++ } ++ ++ if (hba->ufs_device_wlun->sdev_gendev.power.runtime_error) { ++ /* ++ * starget, parent of wlun, might be suspended if wlun resume failed. ++ * Make sure parent is resumed before set child (wlun) active. ++ */ ++ pm_runtime_get_sync(&starget->dev); ++ pm_runtime_set_active(&hba->ufs_device_wlun->sdev_gendev); ++ pm_runtime_put_sync(&starget->dev); ++ resume_sdev_queues = true; ++ } + +- /* hba device might have a runtime error otherwise */ +- if (ret) +- ret = pm_runtime_set_active(hba->dev); + /* + * If wlun device had runtime error, we also need to resume those + * consumer scsi devices in case any of them has failed to be + * resumed due to supplier runtime resume failure. This is to unblock + * blk_queue_enter in case there are bios waiting inside it. + */ +- if (!ret) { ++ if (resume_sdev_queues) { + shost_for_each_device(sdev, shost) { + q = sdev->request_queue; + if (q->dev && (q->rpm_status == RPM_SUSPENDED || +-- +2.51.0 + diff --git a/queue-6.1/series b/queue-6.1/series index c9f81378bc..99842b03fd 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -16,3 +16,15 @@ ext4-introduce-itail-helper.patch ext4-fix-out-of-bound-read-in-ext4_xattr_inode_dec_ref_all.patch net-add-locking-to-protect-skb-dev-access-in-ip_output.patch tls-use-__sk_dst_get-and-dst_dev_rcu-in-get_netdev_for_sock.patch +csky-fix-csky_cmpxchg_fixup-not-working.patch +arm-9461-1-disable-highpte-on-preempt_rt-kernels.patch +alpha-don-t-reference-obsolete-termio-struct-for-tc-.patch +nfsv4-ensure-the-open-stateid-seqid-doesn-t-go-backw.patch +nfs-fix-up-the-automount-fs_context-to-use-the-corre.patch +bcache-fix-improper-use-of-bi_end_io.patch +smb-client-fix-nt_status_unable_to_free_vm-value.patch +smb-client-fix-nt_status_device_door_open-value.patch +smb-client-fix-nt_status_no_data_detected-value.patch +scsi-ipr-enable-disable-irqd_no_balancing-during-res.patch +scsi-ufs-core-fix-eh-failure-after-w-lun-resume-erro.patch +scsi-revert-scsi-libsas-fix-exp-attached-device-scan.patch diff --git a/queue-6.1/smb-client-fix-nt_status_device_door_open-value.patch b/queue-6.1/smb-client-fix-nt_status_device_door_open-value.patch new file mode 100644 index 0000000000..5aaee8311d --- /dev/null +++ b/queue-6.1/smb-client-fix-nt_status_device_door_open-value.patch @@ -0,0 +1,38 @@ +From 838f8a4b49d288c813fc8bbfb7a93e6ee094d583 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Dec 2025 09:17:57 +0800 +Subject: smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value + +From: ChenXiaoSong + +[ Upstream commit b2b50fca34da5ec231008edba798ddf92986bd7f ] + +This was reported by the KUnit tests in the later patches. + +See MS-ERREF 2.3.1 STATUS_DEVICE_DOOR_OPEN. Keep it consistent with the +value in the documentation. + +Signed-off-by: ChenXiaoSong +Acked-by: Paulo Alcantara (Red Hat) +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/nterr.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/smb/client/nterr.h b/fs/smb/client/nterr.h +index 7ce063a1dc3f6..d46d42559eea2 100644 +--- a/fs/smb/client/nterr.h ++++ b/fs/smb/client/nterr.h +@@ -44,7 +44,7 @@ extern const struct nt_err_code_struct nt_errs[]; + #define NT_STATUS_NO_DATA_DETECTED 0x8000001c + #define NT_STATUS_STOPPED_ON_SYMLINK 0x8000002d + #define NT_STATUS_DEVICE_REQUIRES_CLEANING 0x80000288 +-#define NT_STATUS_DEVICE_DOOR_OPEN 0x80000288 ++#define NT_STATUS_DEVICE_DOOR_OPEN 0x80000289 + #define NT_STATUS_UNSUCCESSFUL 0xC0000000 | 0x0001 + #define NT_STATUS_NOT_IMPLEMENTED 0xC0000000 | 0x0002 + #define NT_STATUS_INVALID_INFO_CLASS 0xC0000000 | 0x0003 +-- +2.51.0 + diff --git a/queue-6.1/smb-client-fix-nt_status_no_data_detected-value.patch b/queue-6.1/smb-client-fix-nt_status_no_data_detected-value.patch new file mode 100644 index 0000000000..59c8563e09 --- /dev/null +++ b/queue-6.1/smb-client-fix-nt_status_no_data_detected-value.patch @@ -0,0 +1,38 @@ +From 27cbea2186c608003dce4dd49d1c86b4f63a3e32 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Dec 2025 09:13:06 +0800 +Subject: smb/client: fix NT_STATUS_NO_DATA_DETECTED value + +From: ChenXiaoSong + +[ Upstream commit a1237c203f1757480dc2f3b930608ee00072d3cc ] + +This was reported by the KUnit tests in the later patches. + +See MS-ERREF 2.3.1 STATUS_NO_DATA_DETECTED. Keep it consistent with the +value in the documentation. + +Signed-off-by: ChenXiaoSong +Acked-by: Paulo Alcantara (Red Hat) +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/nterr.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/smb/client/nterr.h b/fs/smb/client/nterr.h +index d46d42559eea2..e3a341316a711 100644 +--- a/fs/smb/client/nterr.h ++++ b/fs/smb/client/nterr.h +@@ -41,7 +41,7 @@ extern const struct nt_err_code_struct nt_errs[]; + #define NT_STATUS_MEDIA_CHANGED 0x8000001c + #define NT_STATUS_END_OF_MEDIA 0x8000001e + #define NT_STATUS_MEDIA_CHECK 0x80000020 +-#define NT_STATUS_NO_DATA_DETECTED 0x8000001c ++#define NT_STATUS_NO_DATA_DETECTED 0x80000022 + #define NT_STATUS_STOPPED_ON_SYMLINK 0x8000002d + #define NT_STATUS_DEVICE_REQUIRES_CLEANING 0x80000288 + #define NT_STATUS_DEVICE_DOOR_OPEN 0x80000289 +-- +2.51.0 + diff --git a/queue-6.1/smb-client-fix-nt_status_unable_to_free_vm-value.patch b/queue-6.1/smb-client-fix-nt_status_unable_to_free_vm-value.patch new file mode 100644 index 0000000000..34ecfe1e3f --- /dev/null +++ b/queue-6.1/smb-client-fix-nt_status_unable_to_free_vm-value.patch @@ -0,0 +1,38 @@ +From f220ec313084f210c394dc7f665e197881aa3b86 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Dec 2025 09:22:53 +0800 +Subject: smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value + +From: ChenXiaoSong + +[ Upstream commit 9f99caa8950a76f560a90074e3a4b93cfa8b3d84 ] + +This was reported by the KUnit tests in the later patches. + +See MS-ERREF 2.3.1 STATUS_UNABLE_TO_FREE_VM. Keep it consistent with the +value in the documentation. + +Signed-off-by: ChenXiaoSong +Acked-by: Paulo Alcantara (Red Hat) +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/nterr.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/smb/client/nterr.h b/fs/smb/client/nterr.h +index edd4741cab0a1..7ce063a1dc3f6 100644 +--- a/fs/smb/client/nterr.h ++++ b/fs/smb/client/nterr.h +@@ -70,7 +70,7 @@ extern const struct nt_err_code_struct nt_errs[]; + #define NT_STATUS_NO_MEMORY 0xC0000000 | 0x0017 + #define NT_STATUS_CONFLICTING_ADDRESSES 0xC0000000 | 0x0018 + #define NT_STATUS_NOT_MAPPED_VIEW 0xC0000000 | 0x0019 +-#define NT_STATUS_UNABLE_TO_FREE_VM 0x80000000 | 0x001a ++#define NT_STATUS_UNABLE_TO_FREE_VM 0xC0000000 | 0x001a + #define NT_STATUS_UNABLE_TO_DELETE_SECTION 0xC0000000 | 0x001b + #define NT_STATUS_INVALID_SYSTEM_SERVICE 0xC0000000 | 0x001c + #define NT_STATUS_ILLEGAL_INSTRUCTION 0xC0000000 | 0x001d +-- +2.51.0 + diff --git a/queue-6.12/alpha-don-t-reference-obsolete-termio-struct-for-tc-.patch b/queue-6.12/alpha-don-t-reference-obsolete-termio-struct-for-tc-.patch new file mode 100644 index 0000000000..61adf7095f --- /dev/null +++ b/queue-6.12/alpha-don-t-reference-obsolete-termio-struct-for-tc-.patch @@ -0,0 +1,49 @@ +From 5a8cb69a2744cb9fa2cdf4172cb4efcfb4cf70e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Dec 2025 08:14:57 +0000 +Subject: alpha: don't reference obsolete termio struct for TC* constants + +From: Sam James + +[ Upstream commit 9aeed9041929812a10a6d693af050846942a1d16 ] + +Similar in nature to ab107276607af90b13a5994997e19b7b9731e251. glibc-2.42 +drops the legacy termio struct, but the ioctls.h header still defines some +TC* constants in terms of termio (via sizeof). Hardcode the values instead. + +This fixes building Python for example, which falls over like: + ./Modules/termios.c:1119:16: error: invalid application of 'sizeof' to incomplete type 'struct termio' + +Link: https://bugs.gentoo.org/961769 +Link: https://bugs.gentoo.org/962600 +Signed-off-by: Sam James +Reviewed-by: Magnus Lindholm +Link: https://lore.kernel.org/r/6ebd3451908785cad53b50ca6bc46cfe9d6bc03c.1764922497.git.sam@gentoo.org +Signed-off-by: Magnus Lindholm +Signed-off-by: Sasha Levin +--- + arch/alpha/include/uapi/asm/ioctls.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/alpha/include/uapi/asm/ioctls.h b/arch/alpha/include/uapi/asm/ioctls.h +index 971311605288f..a09d04b49cc65 100644 +--- a/arch/alpha/include/uapi/asm/ioctls.h ++++ b/arch/alpha/include/uapi/asm/ioctls.h +@@ -23,10 +23,10 @@ + #define TCSETSW _IOW('t', 21, struct termios) + #define TCSETSF _IOW('t', 22, struct termios) + +-#define TCGETA _IOR('t', 23, struct termio) +-#define TCSETA _IOW('t', 24, struct termio) +-#define TCSETAW _IOW('t', 25, struct termio) +-#define TCSETAF _IOW('t', 28, struct termio) ++#define TCGETA 0x40127417 ++#define TCSETA 0x80127418 ++#define TCSETAW 0x80127419 ++#define TCSETAF 0x8012741c + + #define TCSBRK _IO('t', 29) + #define TCXONC _IO('t', 30) +-- +2.51.0 + diff --git a/queue-6.12/arm-9461-1-disable-highpte-on-preempt_rt-kernels.patch b/queue-6.12/arm-9461-1-disable-highpte-on-preempt_rt-kernels.patch new file mode 100644 index 0000000000..8b3891251f --- /dev/null +++ b/queue-6.12/arm-9461-1-disable-highpte-on-preempt_rt-kernels.patch @@ -0,0 +1,51 @@ +From 10383fd99ee873a5afd2064b9af7173252f7ba00 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Nov 2025 16:54:37 +0100 +Subject: ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels + +From: Sebastian Andrzej Siewior + +[ Upstream commit fedadc4137234c3d00c4785eeed3e747fe9036ae ] + +gup_pgd_range() is invoked with disabled interrupts and invokes +__kmap_local_page_prot() via pte_offset_map(), gup_p4d_range(). +With HIGHPTE enabled, __kmap_local_page_prot() invokes kmap_high_get() +which uses a spinlock_t via lock_kmap_any(). This leads to an +sleeping-while-atomic error on PREEMPT_RT because spinlock_t becomes a +sleeping lock and must not be acquired in atomic context. + +The loop in map_new_virtual() uses wait_queue_head_t for wake up which +also is using a spinlock_t. + +Since HIGHPTE is rarely needed at all, turn it off for PREEMPT_RT +to allow the use of get_user_pages_fast(). + +[arnd: rework patch to turn off HIGHPTE instead of HAVE_PAST_GUP] + +Co-developed-by: Arnd Bergmann + +Acked-by: Linus Walleij +Reviewed-by: Arnd Bergmann +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Russell King (Oracle) +Signed-off-by: Sasha Levin +--- + arch/arm/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig +index d5bf16462bdba..cc8beccc4e86d 100644 +--- a/arch/arm/Kconfig ++++ b/arch/arm/Kconfig +@@ -1229,7 +1229,7 @@ config HIGHMEM + + config HIGHPTE + bool "Allocate 2nd-level pagetables from highmem" if EXPERT +- depends on HIGHMEM ++ depends on HIGHMEM && !PREEMPT_RT + default y + help + The VM uses one page of physical memory for each page table. +-- +2.51.0 + diff --git a/queue-6.12/asoc-rockchip-fix-wvoid-pointer-to-enum-cast-warning.patch b/queue-6.12/asoc-rockchip-fix-wvoid-pointer-to-enum-cast-warning.patch new file mode 100644 index 0000000000..c3363d9b41 --- /dev/null +++ b/queue-6.12/asoc-rockchip-fix-wvoid-pointer-to-enum-cast-warning.patch @@ -0,0 +1,47 @@ +From 04001c04b8ad988519cc401191323d9fdec60f54 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Dec 2025 15:16:45 +0100 +Subject: ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again) + +From: Krzysztof Kozlowski + +[ Upstream commit 57d508b5f718730f74b11e0dc9609ac7976802d1 ] + +'version' is an enum, thus cast of pointer on 64-bit compile test with +clang W=1 causes: + + rockchip_pdm.c:583:17: error: cast to smaller integer type 'enum rk_pdm_version' from 'const void *' [-Werror,-Wvoid-pointer-to-enum-cast] + +This was already fixed in commit 49a4a8d12612 ("ASoC: rockchip: Fix +Wvoid-pointer-to-enum-cast warning") but then got bad in +commit 9958d85968ed ("ASoC: Use device_get_match_data()"). + +Discussion on LKML also pointed out that 'uintptr_t' is not the correct +type and either 'kernel_ulong_t' or 'unsigned long' should be used, +with several arguments towards the latter [1]. + +Link: https://lore.kernel.org/r/CAMuHMdX7t=mabqFE5O-Cii3REMuyaePHmqX+j_mqyrn6XXzsoA@mail.gmail.com/ [1] +Signed-off-by: Krzysztof Kozlowski +Link: https://patch.msgid.link/20251203141644.106459-2-krzysztof.kozlowski@oss.qualcomm.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/rockchip/rockchip_pdm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/rockchip/rockchip_pdm.c b/sound/soc/rockchip/rockchip_pdm.c +index cae91108f7a8e..30d51e03d49e9 100644 +--- a/sound/soc/rockchip/rockchip_pdm.c ++++ b/sound/soc/rockchip/rockchip_pdm.c +@@ -580,7 +580,7 @@ static int rockchip_pdm_probe(struct platform_device *pdev) + if (!pdm) + return -ENOMEM; + +- pdm->version = (enum rk_pdm_version)device_get_match_data(&pdev->dev); ++ pdm->version = (unsigned long)device_get_match_data(&pdev->dev); + if (pdm->version == RK_PDM_RK3308) { + pdm->reset = devm_reset_control_get(&pdev->dev, "pdm-m"); + if (IS_ERR(pdm->reset)) +-- +2.51.0 + diff --git a/queue-6.12/bcache-fix-improper-use-of-bi_end_io.patch b/queue-6.12/bcache-fix-improper-use-of-bi_end_io.patch new file mode 100644 index 0000000000..5fd0d7aa12 --- /dev/null +++ b/queue-6.12/bcache-fix-improper-use-of-bi_end_io.patch @@ -0,0 +1,55 @@ +From 6c4579ac46128404dcfb1bea2774ebddcd0b0074 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Dec 2025 17:01:56 +0800 +Subject: bcache: fix improper use of bi_end_io + +From: Shida Zhang + +[ Upstream commit 53280e398471f0bddbb17b798a63d41264651325 ] + +Don't call bio->bi_end_io() directly. Use the bio_endio() helper +function instead, which handles completion more safely and uniformly. + +Suggested-by: Christoph Hellwig +Reviewed-by: Christoph Hellwig +Signed-off-by: Shida Zhang +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/md/bcache/request.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c +index af345dc6fde14..82fdea7dea7aa 100644 +--- a/drivers/md/bcache/request.c ++++ b/drivers/md/bcache/request.c +@@ -1104,7 +1104,7 @@ static void detached_dev_end_io(struct bio *bio) + } + + kfree(ddip); +- bio->bi_end_io(bio); ++ bio_endio(bio); + } + + static void detached_dev_do_request(struct bcache_device *d, struct bio *bio, +@@ -1121,7 +1121,7 @@ static void detached_dev_do_request(struct bcache_device *d, struct bio *bio, + ddip = kzalloc(sizeof(struct detached_dev_io_private), GFP_NOIO); + if (!ddip) { + bio->bi_status = BLK_STS_RESOURCE; +- bio->bi_end_io(bio); ++ bio_endio(bio); + return; + } + +@@ -1136,7 +1136,7 @@ static void detached_dev_do_request(struct bcache_device *d, struct bio *bio, + + if ((bio_op(bio) == REQ_OP_DISCARD) && + !bdev_max_discard_sectors(dc->bdev)) +- bio->bi_end_io(bio); ++ detached_dev_end_io(bio); + else + submit_bio_noacct(bio); + } +-- +2.51.0 + diff --git a/queue-6.12/btrfs-fix-null-dereference-on-root-when-tracing-inod.patch b/queue-6.12/btrfs-fix-null-dereference-on-root-when-tracing-inod.patch new file mode 100644 index 0000000000..e6076f0744 --- /dev/null +++ b/queue-6.12/btrfs-fix-null-dereference-on-root-when-tracing-inod.patch @@ -0,0 +1,51 @@ +From e15d81a0aea27235d4053f95c355b7a617b3226c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Oct 2025 11:11:25 +0200 +Subject: btrfs: fix NULL dereference on root when tracing inode eviction +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Miquel Sabaté Solà + +[ Upstream commit f157dd661339fc6f5f2b574fe2429c43bd309534 ] + +When evicting an inode the first thing we do is to setup tracing for it, +which implies fetching the root's id. But in btrfs_evict_inode() the +root might be NULL, as implied in the next check that we do in +btrfs_evict_inode(). + +Hence, we either should set the ->root_objectid to 0 in case the root is +NULL, or we move tracing setup after checking that the root is not +NULL. Setting the rootid to 0 at least gives us the possibility to trace +this call even in the case when the root is NULL, so that's the solution +taken here. + +Fixes: 1abe9b8a138c ("Btrfs: add initial tracepoint support for btrfs") +Reported-by: syzbot+d991fea1b4b23b1f6bf8@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=d991fea1b4b23b1f6bf8 +Signed-off-by: Miquel Sabaté Solà +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + include/trace/events/btrfs.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h +index cc88074914283..0ca86909ce5bd 100644 +--- a/include/trace/events/btrfs.h ++++ b/include/trace/events/btrfs.h +@@ -223,7 +223,8 @@ DECLARE_EVENT_CLASS(btrfs__inode, + __entry->generation = BTRFS_I(inode)->generation; + __entry->last_trans = BTRFS_I(inode)->last_trans; + __entry->logged_trans = BTRFS_I(inode)->logged_trans; +- __entry->root_objectid = btrfs_root_id(BTRFS_I(inode)->root); ++ __entry->root_objectid = BTRFS_I(inode)->root ? ++ btrfs_root_id(BTRFS_I(inode)->root) : 0; + ), + + TP_printk_btrfs("root=%llu(%s) gen=%llu ino=%llu blocks=%llu " +-- +2.51.0 + diff --git a/queue-6.12/btrfs-fix-qgroup_snapshot_quick_inherit-squota-bug.patch b/queue-6.12/btrfs-fix-qgroup_snapshot_quick_inherit-squota-bug.patch new file mode 100644 index 0000000000..95413ce34e --- /dev/null +++ b/queue-6.12/btrfs-fix-qgroup_snapshot_quick_inherit-squota-bug.patch @@ -0,0 +1,108 @@ +From ddfd965c923daeb43797c972e4badb8be5da4512 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Dec 2025 12:47:14 -0800 +Subject: btrfs: fix qgroup_snapshot_quick_inherit() squota bug + +From: Boris Burkov + +[ Upstream commit 7ee19a59a75e3d5b9ec00499b86af8e2a46fbe86 ] + +qgroup_snapshot_quick_inherit() detects conditions where the snapshot +destination would land in the same parent qgroup as the snapshot source +subvolume. In this case we can avoid costly qgroup calculations and just +add the nodesize of the new snapshot to the parent. + +However, in the case of squotas this is actually a double count, and +also an undercount for deeper qgroup nestings. + +The following annotated script shows the issue: + + btrfs quota enable --simple "$mnt" + + # Create 2-level qgroup hierarchy + btrfs qgroup create 2/100 "$mnt" # Q2 (level 2) + btrfs qgroup create 1/100 "$mnt" # Q1 (level 1) + btrfs qgroup assign 1/100 2/100 "$mnt" + + # Create base subvolume + btrfs subvolume create "$mnt/base" >/dev/null + base_id=$(btrfs subvolume show "$mnt/base" | grep 'Subvolume ID:' | awk '{print $3}') + + # Create intermediate snapshot and add to Q1 + btrfs subvolume snapshot "$mnt/base" "$mnt/intermediate" >/dev/null + inter_id=$(btrfs subvolume show "$mnt/intermediate" | grep 'Subvolume ID:' | awk '{print $3}') + btrfs qgroup assign "0/$inter_id" 1/100 "$mnt" + + # Create working snapshot with --inherit (auto-adds to Q1) + # src=intermediate (in only Q1) + # dst=snap (inheriting only into Q1) + # This double counts the 16k nodesize of the snapshot in Q1, and + # undercounts it in Q2. + btrfs subvolume snapshot -i 1/100 "$mnt/intermediate" "$mnt/snap" >/dev/null + snap_id=$(btrfs subvolume show "$mnt/snap" | grep 'Subvolume ID:' | awk '{print $3}') + + # Fully complete snapshot creation + sync + + # Delete working snapshot + # Q1 and Q2 will lose the full snap usage + btrfs subvolume delete "$mnt/snap" >/dev/null + + # Delete intermediate and remove from Q1 + # Q1 and Q2 will lose the full intermediate usage + btrfs qgroup remove "0/$inter_id" 1/100 "$mnt" + btrfs subvolume delete "$mnt/intermediate" >/dev/null + + # Q1 should be at 0, but still has 16k. Q2 is "correct" at 0 (for now...) + + # Trigger cleaner, wait for deletions + mount -o remount,sync=1 "$mnt" + btrfs subvolume sync "$mnt" "$snap_id" + btrfs subvolume sync "$mnt" "$inter_id" + + # Remove Q1 from Q2 + # Frees 16k more from Q2, underflowing it to 16EiB + btrfs qgroup remove 1/100 2/100 "$mnt" + + # And show the bad state: + btrfs qgroup show -pc "$mnt" + + Qgroupid Referenced Exclusive Parent Child Path + -------- ---------- --------- ------ ----- ---- + 0/5 16.00KiB 16.00KiB - - + 0/256 16.00KiB 16.00KiB - - base + 1/100 16.00KiB 16.00KiB - - <0 member qgroups> + 2/100 16.00EiB 16.00EiB - - <0 member qgroups> + +Fix this by simply not doing this quick inheritance with squotas. + +I suspect that it is also wrong in normal qgroups to not recurse up the +qgroup tree in the quick inherit case, though other consistency checks +will likely fix it anyway. + +Fixes: b20fe56cd285 ("btrfs: qgroup: allow quick inherit if snapshot is created and added to the same parent") +Reviewed-by: Qu Wenruo +Signed-off-by: Boris Burkov +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/qgroup.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c +index 3c77f3506faf3..f23b482dfad9e 100644 +--- a/fs/btrfs/qgroup.c ++++ b/fs/btrfs/qgroup.c +@@ -3298,6 +3298,9 @@ static int qgroup_snapshot_quick_inherit(struct btrfs_fs_info *fs_info, + struct btrfs_qgroup_list *list; + int nr_parents = 0; + ++ if (btrfs_qgroup_mode(fs_info) != BTRFS_QGROUP_MODE_FULL) ++ return 0; ++ + src = find_qgroup_rb(fs_info, srcid); + if (!src) + return -ENOENT; +-- +2.51.0 + diff --git a/queue-6.12/btrfs-qgroup-update-all-parent-qgroups-when-doing-qu.patch b/queue-6.12/btrfs-qgroup-update-all-parent-qgroups-when-doing-qu.patch new file mode 100644 index 0000000000..9ddcc4b369 --- /dev/null +++ b/queue-6.12/btrfs-qgroup-update-all-parent-qgroups-when-doing-qu.patch @@ -0,0 +1,105 @@ +From d7694b3094b8bcea7f00a8cd6fbcfd27e4430f8f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Dec 2025 14:38:23 +1030 +Subject: btrfs: qgroup: update all parent qgroups when doing quick inherit + +From: Qu Wenruo + +[ Upstream commit 68d4b3fa18d72b7f649e83012e7e08f1881f6b75 ] + +[BUG] +There is a bug that if a subvolume has multi-level parent qgroups, and +is able to do a quick inherit, only the direct parent qgroup got +updated: + + mkfs.btrfs -f -O quota $dev + mount $dev $mnt + btrfs subv create $mnt/subv1 + btrfs qgroup create 1/100 $mnt + btrfs qgroup create 2/100 $mnt + btrfs qgroup assign 1/100 2/100 $mnt + btrfs qgroup assign 0/256 1/100 $mnt + btrfs qgroup show -p --sync $mnt + + Qgroupid Referenced Exclusive Parent Path + -------- ---------- --------- ------ ---- + 0/5 16.00KiB 16.00KiB - + 0/256 16.00KiB 16.00KiB 1/100 subv1 + 1/100 16.00KiB 16.00KiB 2/100 2/100<1 member qgroup> + 2/100 16.00KiB 16.00KiB - <0 member qgroups> + + btrfs subv snap -i 1/100 $mnt/subv1 $mnt/snap1 + btrfs qgroup show -p --sync $mnt + + Qgroupid Referenced Exclusive Parent Path + -------- ---------- --------- ------ ---- + 0/5 16.00KiB 16.00KiB - + 0/256 16.00KiB 16.00KiB 1/100 subv1 + 0/257 16.00KiB 16.00KiB 1/100 snap1 + 1/100 32.00KiB 32.00KiB 2/100 2/100<1 member qgroup> + 2/100 16.00KiB 16.00KiB - <0 member qgroups> + # Note that 2/100 is not updated, and qgroup numbers are inconsistent + + umount $mnt + +[CAUSE] +If the snapshot source subvolume belongs to a parent qgroup, and the new +snapshot target is also added to the new same parent qgroup, we allow a +quick update without marking qgroup inconsistent. + +But that quick update only update the parent qgroup, without checking if +there is any more parent qgroups. + +[FIX] +Iterate through all parent qgroups during the quick inherit. + +Reported-by: Boris Burkov +Fixes: b20fe56cd285 ("btrfs: qgroup: allow quick inherit if snapshot is created and added to the same parent") +Reviewed-by: Boris Burkov +Signed-off-by: Qu Wenruo +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/qgroup.c | 18 ++++++++++++++++-- + 1 file changed, 16 insertions(+), 2 deletions(-) + +diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c +index f23b482dfad9e..029017afaf344 100644 +--- a/fs/btrfs/qgroup.c ++++ b/fs/btrfs/qgroup.c +@@ -3295,7 +3295,10 @@ static int qgroup_snapshot_quick_inherit(struct btrfs_fs_info *fs_info, + { + struct btrfs_qgroup *src; + struct btrfs_qgroup *parent; ++ struct btrfs_qgroup *qgroup; + struct btrfs_qgroup_list *list; ++ LIST_HEAD(qgroup_list); ++ const u32 nodesize = fs_info->nodesize; + int nr_parents = 0; + + if (btrfs_qgroup_mode(fs_info) != BTRFS_QGROUP_MODE_FULL) +@@ -3335,8 +3338,19 @@ static int qgroup_snapshot_quick_inherit(struct btrfs_fs_info *fs_info, + if (parent->excl != parent->rfer) + return 1; + +- parent->excl += fs_info->nodesize; +- parent->rfer += fs_info->nodesize; ++ qgroup_iterator_add(&qgroup_list, parent); ++ list_for_each_entry(qgroup, &qgroup_list, iterator) { ++ qgroup->rfer += nodesize; ++ qgroup->rfer_cmpr += nodesize; ++ qgroup->excl += nodesize; ++ qgroup->excl_cmpr += nodesize; ++ qgroup_dirty(fs_info, qgroup); ++ ++ /* Append parent qgroups to @qgroup_list. */ ++ list_for_each_entry(list, &qgroup->groups, next_group) ++ qgroup_iterator_add(&qgroup_list, list->group); ++ } ++ qgroup_iterator_clean(&qgroup_list); + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.12/btrfs-tracepoints-use-btrfs_root_id-to-get-the-id-of.patch b/queue-6.12/btrfs-tracepoints-use-btrfs_root_id-to-get-the-id-of.patch new file mode 100644 index 0000000000..24eebcf806 --- /dev/null +++ b/queue-6.12/btrfs-tracepoints-use-btrfs_root_id-to-get-the-id-of.patch @@ -0,0 +1,240 @@ +From ccb812fee0df8eac13e8fe36e6dfae3fa9c03e93 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Apr 2025 16:23:41 +0100 +Subject: btrfs: tracepoints: use btrfs_root_id() to get the id of a root + +From: Filipe Manana + +[ Upstream commit 0f987c099d22c3b8c7d94fd13f957792e46f79c9 ] + +Instead of open coding btrfs_root_id() to get the ID of a root, use the +helper in the trace points, which also makes the code less verbose. + +Reviewed-by: Qu Wenruo +Signed-off-by: Filipe Manana +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Stable-dep-of: f157dd661339 ("btrfs: fix NULL dereference on root when tracing inode eviction") +Signed-off-by: Sasha Levin +--- + include/trace/events/btrfs.h | 50 +++++++++++++++++------------------- + 1 file changed, 23 insertions(+), 27 deletions(-) + +diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h +index 3b16b0cc1b7a6..cc88074914283 100644 +--- a/include/trace/events/btrfs.h ++++ b/include/trace/events/btrfs.h +@@ -223,8 +223,7 @@ DECLARE_EVENT_CLASS(btrfs__inode, + __entry->generation = BTRFS_I(inode)->generation; + __entry->last_trans = BTRFS_I(inode)->last_trans; + __entry->logged_trans = BTRFS_I(inode)->logged_trans; +- __entry->root_objectid = +- BTRFS_I(inode)->root->root_key.objectid; ++ __entry->root_objectid = btrfs_root_id(BTRFS_I(inode)->root); + ), + + TP_printk_btrfs("root=%llu(%s) gen=%llu ino=%llu blocks=%llu " +@@ -296,7 +295,7 @@ TRACE_EVENT_CONDITION(btrfs_get_extent, + ), + + TP_fast_assign_btrfs(root->fs_info, +- __entry->root_objectid = root->root_key.objectid; ++ __entry->root_objectid = btrfs_root_id(root); + __entry->ino = btrfs_ino(inode); + __entry->start = map->start; + __entry->len = map->len; +@@ -375,7 +374,7 @@ DECLARE_EVENT_CLASS(btrfs__file_extent_item_regular, + ), + + TP_fast_assign_btrfs(bi->root->fs_info, +- __entry->root_obj = bi->root->root_key.objectid; ++ __entry->root_obj = btrfs_root_id(bi->root); + __entry->ino = btrfs_ino(bi); + __entry->isize = bi->vfs_inode.i_size; + __entry->disk_isize = bi->disk_i_size; +@@ -426,7 +425,7 @@ DECLARE_EVENT_CLASS( + + TP_fast_assign_btrfs( + bi->root->fs_info, +- __entry->root_obj = bi->root->root_key.objectid; ++ __entry->root_obj = btrfs_root_id(bi->root); + __entry->ino = btrfs_ino(bi); + __entry->isize = bi->vfs_inode.i_size; + __entry->disk_isize = bi->disk_i_size; +@@ -526,7 +525,7 @@ DECLARE_EVENT_CLASS(btrfs__ordered_extent, + __entry->flags = ordered->flags; + __entry->compress_type = ordered->compress_type; + __entry->refs = refcount_read(&ordered->refs); +- __entry->root_objectid = inode->root->root_key.objectid; ++ __entry->root_objectid = btrfs_root_id(inode->root); + __entry->truncated_len = ordered->truncated_len; + ), + +@@ -663,7 +662,7 @@ TRACE_EVENT(btrfs_finish_ordered_extent, + __entry->start = start; + __entry->len = len; + __entry->uptodate = uptodate; +- __entry->root_objectid = inode->root->root_key.objectid; ++ __entry->root_objectid = btrfs_root_id(inode->root); + ), + + TP_printk_btrfs("root=%llu(%s) ino=%llu start=%llu len=%llu uptodate=%d", +@@ -704,8 +703,7 @@ DECLARE_EVENT_CLASS(btrfs__writepage, + __entry->for_reclaim = wbc->for_reclaim; + __entry->range_cyclic = wbc->range_cyclic; + __entry->writeback_index = inode->i_mapping->writeback_index; +- __entry->root_objectid = +- BTRFS_I(inode)->root->root_key.objectid; ++ __entry->root_objectid = btrfs_root_id(BTRFS_I(inode)->root); + ), + + TP_printk_btrfs("root=%llu(%s) ino=%llu page_index=%lu " +@@ -749,7 +747,7 @@ TRACE_EVENT(btrfs_writepage_end_io_hook, + __entry->start = start; + __entry->end = end; + __entry->uptodate = uptodate; +- __entry->root_objectid = inode->root->root_key.objectid; ++ __entry->root_objectid = btrfs_root_id(inode->root); + ), + + TP_printk_btrfs("root=%llu(%s) ino=%llu start=%llu end=%llu uptodate=%d", +@@ -779,8 +777,7 @@ TRACE_EVENT(btrfs_sync_file, + __entry->ino = btrfs_ino(BTRFS_I(inode)); + __entry->parent = btrfs_ino(BTRFS_I(d_inode(dentry->d_parent))); + __entry->datasync = datasync; +- __entry->root_objectid = +- BTRFS_I(inode)->root->root_key.objectid; ++ __entry->root_objectid = btrfs_root_id(BTRFS_I(inode)->root); + ), + + TP_printk_btrfs("root=%llu(%s) ino=%llu parent=%llu datasync=%d", +@@ -1051,7 +1048,7 @@ DECLARE_EVENT_CLASS(btrfs__chunk, + __entry->sub_stripes = map->sub_stripes; + __entry->offset = offset; + __entry->size = size; +- __entry->root_objectid = fs_info->chunk_root->root_key.objectid; ++ __entry->root_objectid = btrfs_root_id(fs_info->chunk_root); + ), + + TP_printk_btrfs("root=%llu(%s) offset=%llu size=%llu " +@@ -1096,7 +1093,7 @@ TRACE_EVENT(btrfs_cow_block, + ), + + TP_fast_assign_btrfs(root->fs_info, +- __entry->root_objectid = root->root_key.objectid; ++ __entry->root_objectid = btrfs_root_id(root); + __entry->buf_start = buf->start; + __entry->refs = atomic_read(&buf->refs); + __entry->cow_start = cow->start; +@@ -1254,7 +1251,7 @@ TRACE_EVENT(find_free_extent, + ), + + TP_fast_assign_btrfs(root->fs_info, +- __entry->root_objectid = root->root_key.objectid; ++ __entry->root_objectid = btrfs_root_id(root); + __entry->num_bytes = ffe_ctl->num_bytes; + __entry->empty_size = ffe_ctl->empty_size; + __entry->flags = ffe_ctl->flags; +@@ -1283,7 +1280,7 @@ TRACE_EVENT(find_free_extent_search_loop, + ), + + TP_fast_assign_btrfs(root->fs_info, +- __entry->root_objectid = root->root_key.objectid; ++ __entry->root_objectid = btrfs_root_id(root); + __entry->num_bytes = ffe_ctl->num_bytes; + __entry->empty_size = ffe_ctl->empty_size; + __entry->flags = ffe_ctl->flags; +@@ -1317,7 +1314,7 @@ TRACE_EVENT(find_free_extent_have_block_group, + ), + + TP_fast_assign_btrfs(root->fs_info, +- __entry->root_objectid = root->root_key.objectid; ++ __entry->root_objectid = btrfs_root_id(root); + __entry->num_bytes = ffe_ctl->num_bytes; + __entry->empty_size = ffe_ctl->empty_size; + __entry->flags = ffe_ctl->flags; +@@ -1671,8 +1668,7 @@ DECLARE_EVENT_CLASS(btrfs__qgroup_rsv_data, + ), + + TP_fast_assign_btrfs(btrfs_sb(inode->i_sb), +- __entry->rootid = +- BTRFS_I(inode)->root->root_key.objectid; ++ __entry->rootid = btrfs_root_id(BTRFS_I(inode)->root); + __entry->ino = btrfs_ino(BTRFS_I(inode)); + __entry->start = start; + __entry->len = len; +@@ -1862,7 +1858,7 @@ TRACE_EVENT(qgroup_meta_reserve, + ), + + TP_fast_assign_btrfs(root->fs_info, +- __entry->refroot = root->root_key.objectid; ++ __entry->refroot = btrfs_root_id(root); + __entry->diff = diff; + __entry->type = type; + ), +@@ -1884,7 +1880,7 @@ TRACE_EVENT(qgroup_meta_convert, + ), + + TP_fast_assign_btrfs(root->fs_info, +- __entry->refroot = root->root_key.objectid; ++ __entry->refroot = btrfs_root_id(root); + __entry->diff = diff; + ), + +@@ -1908,7 +1904,7 @@ TRACE_EVENT(qgroup_meta_free_all_pertrans, + ), + + TP_fast_assign_btrfs(root->fs_info, +- __entry->refroot = root->root_key.objectid; ++ __entry->refroot = btrfs_root_id(root); + spin_lock(&root->qgroup_meta_rsv_lock); + __entry->diff = -(s64)root->qgroup_meta_rsv_pertrans; + spin_unlock(&root->qgroup_meta_rsv_lock); +@@ -1990,7 +1986,7 @@ TRACE_EVENT(btrfs_inode_mod_outstanding_extents, + ), + + TP_fast_assign_btrfs(root->fs_info, +- __entry->root_objectid = root->root_key.objectid; ++ __entry->root_objectid = btrfs_root_id(root); + __entry->ino = ino; + __entry->mod = mod; + __entry->outstanding = outstanding; +@@ -2075,7 +2071,7 @@ TRACE_EVENT(btrfs_set_extent_bit, + + __entry->owner = tree->owner; + __entry->ino = inode ? btrfs_ino(inode) : 0; +- __entry->rootid = inode ? inode->root->root_key.objectid : 0; ++ __entry->rootid = inode ? btrfs_root_id(inode->root) : 0; + __entry->start = start; + __entry->len = len; + __entry->set_bits = set_bits; +@@ -2108,7 +2104,7 @@ TRACE_EVENT(btrfs_clear_extent_bit, + + __entry->owner = tree->owner; + __entry->ino = inode ? btrfs_ino(inode) : 0; +- __entry->rootid = inode ? inode->root->root_key.objectid : 0; ++ __entry->rootid = inode ? btrfs_root_id(inode->root) : 0; + __entry->start = start; + __entry->len = len; + __entry->clear_bits = clear_bits; +@@ -2142,7 +2138,7 @@ TRACE_EVENT(btrfs_convert_extent_bit, + + __entry->owner = tree->owner; + __entry->ino = inode ? btrfs_ino(inode) : 0; +- __entry->rootid = inode ? inode->root->root_key.objectid : 0; ++ __entry->rootid = inode ? btrfs_root_id(inode->root) : 0; + __entry->start = start; + __entry->len = len; + __entry->set_bits = set_bits; +@@ -2619,7 +2615,7 @@ TRACE_EVENT(btrfs_extent_map_shrinker_remove_em, + + TP_fast_assign_btrfs(inode->root->fs_info, + __entry->ino = btrfs_ino(inode); +- __entry->root_id = inode->root->root_key.objectid; ++ __entry->root_id = btrfs_root_id(inode->root); + __entry->start = em->start; + __entry->len = em->len; + __entry->flags = em->flags; +-- +2.51.0 + diff --git a/queue-6.12/csky-fix-csky_cmpxchg_fixup-not-working.patch b/queue-6.12/csky-fix-csky_cmpxchg_fixup-not-working.patch new file mode 100644 index 0000000000..74c2b8fb51 --- /dev/null +++ b/queue-6.12/csky-fix-csky_cmpxchg_fixup-not-working.patch @@ -0,0 +1,40 @@ +From d163c0769b5f92e9e87c96b8958982c36a22b6c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Oct 2024 17:56:26 +0800 +Subject: csky: fix csky_cmpxchg_fixup not working + +From: Yang Li + +[ Upstream commit 809ef03d6d21d5fea016bbf6babeec462e37e68c ] + +In the csky_cmpxchg_fixup function, it is incorrect to use the global +variable csky_cmpxchg_stw to determine the address where the exception +occurred.The global variable csky_cmpxchg_stw stores the opcode at the +time of the exception, while &csky_cmpxchg_stw shows the address where +the exception occurred. + +Signed-off-by: Yang Li +Signed-off-by: Guo Ren +Signed-off-by: Sasha Levin +--- + arch/csky/mm/fault.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/csky/mm/fault.c b/arch/csky/mm/fault.c +index a885518ce1dd2..5226bc08c3360 100644 +--- a/arch/csky/mm/fault.c ++++ b/arch/csky/mm/fault.c +@@ -45,8 +45,8 @@ static inline void csky_cmpxchg_fixup(struct pt_regs *regs) + if (trap_no(regs) != VEC_TLBMODIFIED) + return; + +- if (instruction_pointer(regs) == csky_cmpxchg_stw) +- instruction_pointer_set(regs, csky_cmpxchg_ldw); ++ if (instruction_pointer(regs) == (unsigned long)&csky_cmpxchg_stw) ++ instruction_pointer_set(regs, (unsigned long)&csky_cmpxchg_ldw); + return; + } + #endif +-- +2.51.0 + diff --git a/queue-6.12/dm-snapshot-fix-scheduling-while-atomic-on-real-time.patch b/queue-6.12/dm-snapshot-fix-scheduling-while-atomic-on-real-time.patch new file mode 100644 index 0000000000..e66b12a1c0 --- /dev/null +++ b/queue-6.12/dm-snapshot-fix-scheduling-while-atomic-on-real-time.patch @@ -0,0 +1,238 @@ +From d933d77f619523dbd68f415c6f981368db831572 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Dec 2025 22:13:10 +0100 +Subject: dm-snapshot: fix 'scheduling while atomic' on real-time kernels + +From: Mikulas Patocka + +[ Upstream commit 8581b19eb2c5ccf06c195d3b5468c3c9d17a5020 ] + +There is reported 'scheduling while atomic' bug when using dm-snapshot on +real-time kernels. The reason for the bug is that the hlist_bl code does +preempt_disable() when taking the lock and the kernel attempts to take +other spinlocks while holding the hlist_bl lock. + +Fix this by converting a hlist_bl spinlock into a regular spinlock. + +Signed-off-by: Mikulas Patocka +Reported-by: Jiping Ma +Signed-off-by: Sasha Levin +--- + drivers/md/dm-exception-store.h | 2 +- + drivers/md/dm-snap.c | 73 +++++++++++++++------------------ + 2 files changed, 35 insertions(+), 40 deletions(-) + +diff --git a/drivers/md/dm-exception-store.h b/drivers/md/dm-exception-store.h +index b679766375381..061b4d3108132 100644 +--- a/drivers/md/dm-exception-store.h ++++ b/drivers/md/dm-exception-store.h +@@ -29,7 +29,7 @@ typedef sector_t chunk_t; + * chunk within the device. + */ + struct dm_exception { +- struct hlist_bl_node hash_list; ++ struct hlist_node hash_list; + + chunk_t old_chunk; + chunk_t new_chunk; +diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c +index f40c18da40000..dbd148967de42 100644 +--- a/drivers/md/dm-snap.c ++++ b/drivers/md/dm-snap.c +@@ -40,10 +40,15 @@ static const char dm_snapshot_merge_target_name[] = "snapshot-merge"; + #define DM_TRACKED_CHUNK_HASH(x) ((unsigned long)(x) & \ + (DM_TRACKED_CHUNK_HASH_SIZE - 1)) + ++struct dm_hlist_head { ++ struct hlist_head head; ++ spinlock_t lock; ++}; ++ + struct dm_exception_table { + uint32_t hash_mask; + unsigned int hash_shift; +- struct hlist_bl_head *table; ++ struct dm_hlist_head *table; + }; + + struct dm_snapshot { +@@ -628,8 +633,8 @@ static uint32_t exception_hash(struct dm_exception_table *et, chunk_t chunk); + + /* Lock to protect access to the completed and pending exception hash tables. */ + struct dm_exception_table_lock { +- struct hlist_bl_head *complete_slot; +- struct hlist_bl_head *pending_slot; ++ spinlock_t *complete_slot; ++ spinlock_t *pending_slot; + }; + + static void dm_exception_table_lock_init(struct dm_snapshot *s, chunk_t chunk, +@@ -638,20 +643,20 @@ static void dm_exception_table_lock_init(struct dm_snapshot *s, chunk_t chunk, + struct dm_exception_table *complete = &s->complete; + struct dm_exception_table *pending = &s->pending; + +- lock->complete_slot = &complete->table[exception_hash(complete, chunk)]; +- lock->pending_slot = &pending->table[exception_hash(pending, chunk)]; ++ lock->complete_slot = &complete->table[exception_hash(complete, chunk)].lock; ++ lock->pending_slot = &pending->table[exception_hash(pending, chunk)].lock; + } + + static void dm_exception_table_lock(struct dm_exception_table_lock *lock) + { +- hlist_bl_lock(lock->complete_slot); +- hlist_bl_lock(lock->pending_slot); ++ spin_lock_nested(lock->complete_slot, 1); ++ spin_lock_nested(lock->pending_slot, 2); + } + + static void dm_exception_table_unlock(struct dm_exception_table_lock *lock) + { +- hlist_bl_unlock(lock->pending_slot); +- hlist_bl_unlock(lock->complete_slot); ++ spin_unlock(lock->pending_slot); ++ spin_unlock(lock->complete_slot); + } + + static int dm_exception_table_init(struct dm_exception_table *et, +@@ -661,13 +666,15 @@ static int dm_exception_table_init(struct dm_exception_table *et, + + et->hash_shift = hash_shift; + et->hash_mask = size - 1; +- et->table = kvmalloc_array(size, sizeof(struct hlist_bl_head), ++ et->table = kvmalloc_array(size, sizeof(struct dm_hlist_head), + GFP_KERNEL); + if (!et->table) + return -ENOMEM; + +- for (i = 0; i < size; i++) +- INIT_HLIST_BL_HEAD(et->table + i); ++ for (i = 0; i < size; i++) { ++ INIT_HLIST_HEAD(&et->table[i].head); ++ spin_lock_init(&et->table[i].lock); ++ } + + return 0; + } +@@ -675,16 +682,17 @@ static int dm_exception_table_init(struct dm_exception_table *et, + static void dm_exception_table_exit(struct dm_exception_table *et, + struct kmem_cache *mem) + { +- struct hlist_bl_head *slot; ++ struct dm_hlist_head *slot; + struct dm_exception *ex; +- struct hlist_bl_node *pos, *n; ++ struct hlist_node *pos; + int i, size; + + size = et->hash_mask + 1; + for (i = 0; i < size; i++) { + slot = et->table + i; + +- hlist_bl_for_each_entry_safe(ex, pos, n, slot, hash_list) { ++ hlist_for_each_entry_safe(ex, pos, &slot->head, hash_list) { ++ hlist_del(&ex->hash_list); + kmem_cache_free(mem, ex); + cond_resched(); + } +@@ -700,7 +708,7 @@ static uint32_t exception_hash(struct dm_exception_table *et, chunk_t chunk) + + static void dm_remove_exception(struct dm_exception *e) + { +- hlist_bl_del(&e->hash_list); ++ hlist_del(&e->hash_list); + } + + /* +@@ -710,12 +718,11 @@ static void dm_remove_exception(struct dm_exception *e) + static struct dm_exception *dm_lookup_exception(struct dm_exception_table *et, + chunk_t chunk) + { +- struct hlist_bl_head *slot; +- struct hlist_bl_node *pos; ++ struct hlist_head *slot; + struct dm_exception *e; + +- slot = &et->table[exception_hash(et, chunk)]; +- hlist_bl_for_each_entry(e, pos, slot, hash_list) ++ slot = &et->table[exception_hash(et, chunk)].head; ++ hlist_for_each_entry(e, slot, hash_list) + if (chunk >= e->old_chunk && + chunk <= e->old_chunk + dm_consecutive_chunk_count(e)) + return e; +@@ -762,18 +769,17 @@ static void free_pending_exception(struct dm_snap_pending_exception *pe) + static void dm_insert_exception(struct dm_exception_table *eh, + struct dm_exception *new_e) + { +- struct hlist_bl_head *l; +- struct hlist_bl_node *pos; ++ struct hlist_head *l; + struct dm_exception *e = NULL; + +- l = &eh->table[exception_hash(eh, new_e->old_chunk)]; ++ l = &eh->table[exception_hash(eh, new_e->old_chunk)].head; + + /* Add immediately if this table doesn't support consecutive chunks */ + if (!eh->hash_shift) + goto out; + + /* List is ordered by old_chunk */ +- hlist_bl_for_each_entry(e, pos, l, hash_list) { ++ hlist_for_each_entry(e, l, hash_list) { + /* Insert after an existing chunk? */ + if (new_e->old_chunk == (e->old_chunk + + dm_consecutive_chunk_count(e) + 1) && +@@ -804,13 +810,13 @@ static void dm_insert_exception(struct dm_exception_table *eh, + * Either the table doesn't support consecutive chunks or slot + * l is empty. + */ +- hlist_bl_add_head(&new_e->hash_list, l); ++ hlist_add_head(&new_e->hash_list, l); + } else if (new_e->old_chunk < e->old_chunk) { + /* Add before an existing exception */ +- hlist_bl_add_before(&new_e->hash_list, &e->hash_list); ++ hlist_add_before(&new_e->hash_list, &e->hash_list); + } else { + /* Add to l's tail: e is the last exception in this slot */ +- hlist_bl_add_behind(&new_e->hash_list, &e->hash_list); ++ hlist_add_behind(&new_e->hash_list, &e->hash_list); + } + } + +@@ -820,7 +826,6 @@ static void dm_insert_exception(struct dm_exception_table *eh, + */ + static int dm_add_exception(void *context, chunk_t old, chunk_t new) + { +- struct dm_exception_table_lock lock; + struct dm_snapshot *s = context; + struct dm_exception *e; + +@@ -833,17 +838,7 @@ static int dm_add_exception(void *context, chunk_t old, chunk_t new) + /* Consecutive_count is implicitly initialised to zero */ + e->new_chunk = new; + +- /* +- * Although there is no need to lock access to the exception tables +- * here, if we don't then hlist_bl_add_head(), called by +- * dm_insert_exception(), will complain about accessing the +- * corresponding list without locking it first. +- */ +- dm_exception_table_lock_init(s, old, &lock); +- +- dm_exception_table_lock(&lock); + dm_insert_exception(&s->complete, e); +- dm_exception_table_unlock(&lock); + + return 0; + } +@@ -873,7 +868,7 @@ static int calc_max_buckets(void) + /* use a fixed size of 2MB */ + unsigned long mem = 2 * 1024 * 1024; + +- mem /= sizeof(struct hlist_bl_head); ++ mem /= sizeof(struct dm_hlist_head); + + return mem; + } +-- +2.51.0 + diff --git a/queue-6.12/drm-amd-display-shrink-struct-members.patch b/queue-6.12/drm-amd-display-shrink-struct-members.patch new file mode 100644 index 0000000000..918d658646 --- /dev/null +++ b/queue-6.12/drm-amd-display-shrink-struct-members.patch @@ -0,0 +1,92 @@ +From c2f738cf2f45486e0dec696cf9656d4b28390a4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 Nov 2025 09:40:47 -0800 +Subject: drm/amd/display: shrink struct members + +From: Rosen Penev + +[ Upstream commit 7329417fc9ac128729c3a092b006c8f1fd0d04a6 ] + +On a 32-bit ARM system, the audio_decoder struct ends up being too large +for dp_retrain_link_dp_test. + +link_dp_cts.c:157:1: error: the frame size of 1328 bytes is larger than +1280 bytes [-Werror=frame-larger-than=] + +This is mitigated by shrinking the members of the struct and avoids +having to deal with dynamic allocation. + +feed_back_divider is assigned but otherwise unused. Remove both. + +pixel_repetition looks like it should be a bool since it's only ever +assigned to 1. But there are checks for 2 and 4. Reduce to uint8_t. + +Remove ss_percentage_divider. Unused. + +Shrink refresh_rate as it gets assigned to at most a 3 digit integer +value. + +Signed-off-by: Rosen Penev +Reviewed-by: Alex Hung +Signed-off-by: Alex Deucher +(cherry picked from commit 3849efdc7888d537f09c3dcfaea4b3cd377a102e) +Signed-off-by: Sasha Levin +--- + .../drm/amd/display/dc/hwss/dce110/dce110_hwseq.c | 3 --- + drivers/gpu/drm/amd/display/include/audio_types.h | 12 +++++------- + 2 files changed, 5 insertions(+), 10 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c +index 03b22e9115ea8..13e7c253ad697 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c +@@ -1448,9 +1448,6 @@ static void build_audio_output( + state->clk_mgr); + } + +- audio_output->pll_info.feed_back_divider = +- pipe_ctx->pll_settings.feedback_divider; +- + audio_output->pll_info.dto_source = + translate_to_dto_source( + pipe_ctx->stream_res.tg->inst + 1); +diff --git a/drivers/gpu/drm/amd/display/include/audio_types.h b/drivers/gpu/drm/amd/display/include/audio_types.h +index e4a26143f14c9..6699ad4fa825e 100644 +--- a/drivers/gpu/drm/amd/display/include/audio_types.h ++++ b/drivers/gpu/drm/amd/display/include/audio_types.h +@@ -47,15 +47,15 @@ struct audio_crtc_info { + uint32_t h_total; + uint32_t h_active; + uint32_t v_active; +- uint32_t pixel_repetition; + uint32_t requested_pixel_clock_100Hz; /* in 100Hz */ + uint32_t calculated_pixel_clock_100Hz; /* in 100Hz */ +- uint32_t refresh_rate; ++ uint32_t dsc_bits_per_pixel; ++ uint32_t dsc_num_slices; + enum dc_color_depth color_depth; + enum dc_pixel_encoding pixel_encoding; ++ uint16_t refresh_rate; ++ uint8_t pixel_repetition; + bool interlaced; +- uint32_t dsc_bits_per_pixel; +- uint32_t dsc_num_slices; + }; + struct azalia_clock_info { + uint32_t pixel_clock_in_10khz; +@@ -78,11 +78,9 @@ enum audio_dto_source { + + struct audio_pll_info { + uint32_t audio_dto_source_clock_in_khz; +- uint32_t feed_back_divider; ++ uint32_t ss_percentage; + enum audio_dto_source dto_source; + bool ss_enabled; +- uint32_t ss_percentage; +- uint32_t ss_percentage_divider; + }; + + struct audio_channel_associate_info { +-- +2.51.0 + diff --git a/queue-6.12/nfs-fix-up-the-automount-fs_context-to-use-the-corre.patch b/queue-6.12/nfs-fix-up-the-automount-fs_context-to-use-the-corre.patch new file mode 100644 index 0000000000..322a7a71b6 --- /dev/null +++ b/queue-6.12/nfs-fix-up-the-automount-fs_context-to-use-the-corre.patch @@ -0,0 +1,39 @@ +From edb32860967e998296ba1dc38dc52ade9553fe6e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Nov 2025 18:56:46 -0500 +Subject: NFS: Fix up the automount fs_context to use the correct cred + +From: Trond Myklebust + +[ Upstream commit a2a8fc27dd668e7562b5326b5ed2f1604cb1e2e9 ] + +When automounting, the fs_context should be fixed up to use the cred +from the parent filesystem, since the operation is just extending the +namespace. Authorisation to enter that namespace will already have been +provided by the preceding lookup. + +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/namespace.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/fs/nfs/namespace.c b/fs/nfs/namespace.c +index 923b5c1eb47e9..99ef1146096fe 100644 +--- a/fs/nfs/namespace.c ++++ b/fs/nfs/namespace.c +@@ -170,6 +170,11 @@ struct vfsmount *nfs_d_automount(struct path *path) + if (!ctx->clone_data.fattr) + goto out_fc; + ++ if (fc->cred != server->cred) { ++ put_cred(fc->cred); ++ fc->cred = get_cred(server->cred); ++ } ++ + if (fc->net_ns != client->cl_net) { + put_net(fc->net_ns); + fc->net_ns = get_net(client->cl_net); +-- +2.51.0 + diff --git a/queue-6.12/nfsv4-ensure-the-open-stateid-seqid-doesn-t-go-backw.patch b/queue-6.12/nfsv4-ensure-the-open-stateid-seqid-doesn-t-go-backw.patch new file mode 100644 index 0000000000..e8751188c1 --- /dev/null +++ b/queue-6.12/nfsv4-ensure-the-open-stateid-seqid-doesn-t-go-backw.patch @@ -0,0 +1,74 @@ +From b62f15d3e7ec96978edbfc311e43490e5df5db6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Nov 2025 10:44:15 -0500 +Subject: NFSv4: ensure the open stateid seqid doesn't go backwards + +From: Scott Mayhew + +[ Upstream commit 2e47c3cc64b44b0b06cd68c2801db92ff143f2b2 ] + +We have observed an NFSv4 client receiving a LOCK reply with a status of +NFS4ERR_OLD_STATEID and subsequently retrying the LOCK request with an +earlier seqid value in the stateid. As this was for a new lockowner, +that would imply that nfs_set_open_stateid_locked() had updated the open +stateid seqid with an earlier value. + +Looking at nfs_set_open_stateid_locked(), if the incoming seqid is out +of sequence, the task will sleep on the state->waitq for up to 5 +seconds. If the task waits for the full 5 seconds, then after finishing +the wait it'll update the open stateid seqid with whatever value the +incoming seqid has. If there are multiple waiters in this scenario, +then the last one to perform said update may not be the one with the +highest seqid. + +Add a check to ensure that the seqid can only be incremented, and add a +tracepoint to indicate when old seqids are skipped. + +Signed-off-by: Scott Mayhew +Reviewed-by: Benjamin Coddington +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4proc.c | 13 +++++++++++-- + fs/nfs/nfs4trace.h | 1 + + 2 files changed, 12 insertions(+), 2 deletions(-) + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 172ff213b50b6..89f779f16f0dc 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -1753,8 +1753,17 @@ static void nfs_set_open_stateid_locked(struct nfs4_state *state, + if (nfs_stateid_is_sequential(state, stateid)) + break; + +- if (status) +- break; ++ if (status) { ++ if (nfs4_stateid_match_other(stateid, &state->open_stateid) && ++ !nfs4_stateid_is_newer(stateid, &state->open_stateid)) { ++ trace_nfs4_open_stateid_update_skip(state->inode, ++ stateid, status); ++ return; ++ } else { ++ break; ++ } ++ } ++ + /* Rely on seqids for serialisation with NFSv4.0 */ + if (!nfs4_has_session(NFS_SERVER(state->inode)->nfs_client)) + break; +diff --git a/fs/nfs/nfs4trace.h b/fs/nfs/nfs4trace.h +index 22c973316f0bd..9a38a5d3bf512 100644 +--- a/fs/nfs/nfs4trace.h ++++ b/fs/nfs/nfs4trace.h +@@ -1278,6 +1278,7 @@ DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_setattr); + DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_delegreturn); + DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_open_stateid_update); + DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_open_stateid_update_wait); ++DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_open_stateid_update_skip); + DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_close_stateid_update_wait); + + DECLARE_EVENT_CLASS(nfs4_getattr_event, +-- +2.51.0 + diff --git a/queue-6.12/scsi-ipr-enable-disable-irqd_no_balancing-during-res.patch b/queue-6.12/scsi-ipr-enable-disable-irqd_no_balancing-during-res.patch new file mode 100644 index 0000000000..b4eacf452a --- /dev/null +++ b/queue-6.12/scsi-ipr-enable-disable-irqd_no_balancing-during-res.patch @@ -0,0 +1,190 @@ +From 2c744bf45c7e2f39fc350439a6fb5f25573ed3ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Oct 2025 09:24:26 -0500 +Subject: scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset + +From: Wen Xiong + +[ Upstream commit 6ac3484fb13b2fc7f31cfc7f56093e7d0ce646a5 ] + +A dynamic remove/add storage adapter test hits EEH on PowerPC: + + EEH: [c00000000004f75c] __eeh_send_failure_event+0x7c/0x160 + EEH: [c000000000048444] eeh_dev_check_failure.part.0+0x254/0x650 + EEH: [c008000001650678] eeh_readl+0x60/0x90 [ipr] + EEH: [c00800000166746c] ipr_cancel_op+0x2b8/0x524 [ipr] + EEH: [c008000001656524] ipr_eh_abort+0x6c/0x130 [ipr] + EEH: [c000000000ab0d20] scmd_eh_abort_handler+0x140/0x440 + EEH: [c00000000017e558] process_one_work+0x298/0x590 + EEH: [c00000000017eef8] worker_thread+0xa8/0x620 + EEH: [c00000000018be34] kthread+0x124/0x130 + EEH: [c00000000000cd64] ret_from_kernel_thread+0x5c/0x64 + +A PCIe bus trace reveals that a vector of MSI-X is cleared to 0 by +irqbalance daemon. If we disable irqbalance daemon, we won't see the +issue. + +With debug enabled in ipr driver: + + [ 44.103071] ipr: Entering __ipr_remove + [ 44.103083] ipr: Entering ipr_initiate_ioa_bringdown + [ 44.103091] ipr: Entering ipr_reset_shutdown_ioa + [ 44.103099] ipr: Leaving ipr_reset_shutdown_ioa + [ 44.103105] ipr: Leaving ipr_initiate_ioa_bringdown + [ 44.149918] ipr: Entering ipr_reset_ucode_download + [ 44.149935] ipr: Entering ipr_reset_alert + [ 44.150032] ipr: Entering ipr_reset_start_timer + [ 44.150038] ipr: Leaving ipr_reset_alert + [ 44.244343] scsi 1:2:3:0: alua: Detached + [ 44.254300] ipr: Entering ipr_reset_start_bist + [ 44.254320] ipr: Entering ipr_reset_start_timer + [ 44.254325] ipr: Leaving ipr_reset_start_bist + [ 44.364329] scsi 1:2:4:0: alua: Detached + [ 45.134341] scsi 1:2:5:0: alua: Detached + [ 45.860949] ipr: Entering ipr_reset_shutdown_ioa + [ 45.860962] ipr: Leaving ipr_reset_shutdown_ioa + [ 45.860966] ipr: Entering ipr_reset_alert + [ 45.861028] ipr: Entering ipr_reset_start_timer + [ 45.861035] ipr: Leaving ipr_reset_alert + [ 45.964302] ipr: Entering ipr_reset_start_bist + [ 45.964309] ipr: Entering ipr_reset_start_timer + [ 45.964313] ipr: Leaving ipr_reset_start_bist + [ 46.264301] ipr: Entering ipr_reset_bist_done + [ 46.264309] ipr: Leaving ipr_reset_bist_done + +During adapter reset, ipr device driver blocks config space access but +can't block MMIO access for MSI-X entries. There is very small window: +irqbalance daemon kicks in during adapter reset before ipr driver calls +pci_restore_state(pdev) to restore MSI-X table. + +irqbalance daemon reads back all 0 for that MSI-X vector in +__pci_read_msi_msg(). + +irqbalance daemon: + + msi_domain_set_affinity() + ->irq_chip_set_affinity_patent() + ->xive_irq_set_affinity() + ->irq_chip_compose_msi_msg() + ->pseries_msi_compose_msg() + ->__pci_read_msi_msg(): read all 0 since didn't call pci_restore_state + ->irq_chip_write_msi_msg() + -> pci_write_msg_msi(): write 0 to the msix vector entry + +When ipr driver calls pci_restore_state(pdev) in +ipr_reset_restore_cfg_space(), the MSI-X vector entry has been cleared +by irqbalance daemon in pci_write_msg_msix(). + + pci_restore_state() + ->__pci_restore_msix_state() + +Below is the MSI-X table for ipr adapter after irqbalance daemon kicked +in during adapter reset: + + Dump MSIx table: index=0 address_lo=c800 address_hi=10000000 msg_data=0 + Dump MSIx table: index=1 address_lo=c810 address_hi=10000000 msg_data=0 + Dump MSIx table: index=2 address_lo=c820 address_hi=10000000 msg_data=0 + Dump MSIx table: index=3 address_lo=c830 address_hi=10000000 msg_data=0 + Dump MSIx table: index=4 address_lo=c840 address_hi=10000000 msg_data=0 + Dump MSIx table: index=5 address_lo=c850 address_hi=10000000 msg_data=0 + Dump MSIx table: index=6 address_lo=c860 address_hi=10000000 msg_data=0 + Dump MSIx table: index=7 address_lo=c870 address_hi=10000000 msg_data=0 + Dump MSIx table: index=8 address_lo=0 address_hi=0 msg_data=0 + ---------> Hit EEH since msix vector of index=8 are 0 + Dump MSIx table: index=9 address_lo=c890 address_hi=10000000 msg_data=0 + Dump MSIx table: index=10 address_lo=c8a0 address_hi=10000000 msg_data=0 + Dump MSIx table: index=11 address_lo=c8b0 address_hi=10000000 msg_data=0 + Dump MSIx table: index=12 address_lo=c8c0 address_hi=10000000 msg_data=0 + Dump MSIx table: index=13 address_lo=c8d0 address_hi=10000000 msg_data=0 + Dump MSIx table: index=14 address_lo=c8e0 address_hi=10000000 msg_data=0 + Dump MSIx table: index=15 address_lo=c8f0 address_hi=10000000 msg_data=0 + + [ 46.264312] ipr: Entering ipr_reset_restore_cfg_space + [ 46.267439] ipr: Entering ipr_fail_all_ops + [ 46.267447] ipr: Leaving ipr_fail_all_ops + [ 46.267451] ipr: Leaving ipr_reset_restore_cfg_space + [ 46.267454] ipr: Entering ipr_ioa_bringdown_done + [ 46.267458] ipr: Leaving ipr_ioa_bringdown_done + [ 46.267467] ipr: Entering ipr_worker_thread + [ 46.267470] ipr: Leaving ipr_worker_thread + +IRQ balancing is not required during adapter reset. + +Enable "IRQ_NO_BALANCING" flag before starting adapter reset and disable +it after calling pci_restore_state(). The irqbalance daemon is disabled +for this short period of time (~2s). + +Co-developed-by: Kyle Mahlkuch +Signed-off-by: Kyle Mahlkuch +Signed-off-by: Wen Xiong +Link: https://patch.msgid.link/20251028142427.3969819-2-wenxiong@linux.ibm.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ipr.c | 28 +++++++++++++++++++++++++++- + 1 file changed, 27 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c +index 31cf2d31cceba..ea3d8239c6b3d 100644 +--- a/drivers/scsi/ipr.c ++++ b/drivers/scsi/ipr.c +@@ -61,8 +61,8 @@ + #include + #include + #include ++#include + #include +-#include + #include + #include + #include +@@ -7843,6 +7843,30 @@ static int ipr_dump_mailbox_wait(struct ipr_cmnd *ipr_cmd) + return IPR_RC_JOB_RETURN; + } + ++/** ++ * ipr_set_affinity_nobalance ++ * @ioa_cfg: ipr_ioa_cfg struct for an ipr device ++ * @flag: bool ++ * true: ensable "IRQ_NO_BALANCING" bit for msix interrupt ++ * false: disable "IRQ_NO_BALANCING" bit for msix interrupt ++ * Description: This function will be called to disable/enable ++ * "IRQ_NO_BALANCING" to avoid irqbalance daemon ++ * kicking in during adapter reset. ++ **/ ++static void ipr_set_affinity_nobalance(struct ipr_ioa_cfg *ioa_cfg, bool flag) ++{ ++ int irq, i; ++ ++ for (i = 0; i < ioa_cfg->nvectors; i++) { ++ irq = pci_irq_vector(ioa_cfg->pdev, i); ++ ++ if (flag) ++ irq_set_status_flags(irq, IRQ_NO_BALANCING); ++ else ++ irq_clear_status_flags(irq, IRQ_NO_BALANCING); ++ } ++} ++ + /** + * ipr_reset_restore_cfg_space - Restore PCI config space. + * @ipr_cmd: ipr command struct +@@ -7867,6 +7891,7 @@ static int ipr_reset_restore_cfg_space(struct ipr_cmnd *ipr_cmd) + return IPR_RC_JOB_CONTINUE; + } + ++ ipr_set_affinity_nobalance(ioa_cfg, false); + ipr_fail_all_ops(ioa_cfg); + + if (ioa_cfg->sis64) { +@@ -7946,6 +7971,7 @@ static int ipr_reset_start_bist(struct ipr_cmnd *ipr_cmd) + rc = pci_write_config_byte(ioa_cfg->pdev, PCI_BIST, PCI_BIST_START); + + if (rc == PCIBIOS_SUCCESSFUL) { ++ ipr_set_affinity_nobalance(ioa_cfg, true); + ipr_cmd->job_step = ipr_reset_bist_done; + ipr_reset_start_timer(ipr_cmd, IPR_WAIT_FOR_BIST_TIMEOUT); + rc = IPR_RC_JOB_RETURN; +-- +2.51.0 + diff --git a/queue-6.12/scsi-revert-scsi-libsas-fix-exp-attached-device-scan.patch b/queue-6.12/scsi-revert-scsi-libsas-fix-exp-attached-device-scan.patch new file mode 100644 index 0000000000..8d3c0a35d9 --- /dev/null +++ b/queue-6.12/scsi-revert-scsi-libsas-fix-exp-attached-device-scan.patch @@ -0,0 +1,59 @@ +From 2709439d4c537da483c258160e01e5c3693ff72b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 14:56:27 +0800 +Subject: scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe + failure scanned in again after probe failed" + +From: Xingui Yang + +[ Upstream commit 278712d20bc8ec29d1ad6ef9bdae9000ef2c220c ] + +This reverts commit ab2068a6fb84751836a84c26ca72b3beb349619d. + +When probing the exp-attached sata device, libsas/libata will issue a +hard reset in sas_probe_sata() -> ata_sas_async_probe(), then a +broadcast event will be received after the disk probe fails, and this +commit causes the probe will be re-executed on the disk, and a faulty +disk may get into an indefinite loop of probe. + +Therefore, revert this commit, although it can fix some temporary issues +with disk probe failure. + +Signed-off-by: Xingui Yang +Reviewed-by: Jason Yan +Reviewed-by: John Garry +Link: https://patch.msgid.link/20251202065627.140361-1-yangxingui@huawei.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/libsas/sas_internal.h | 14 -------------- + 1 file changed, 14 deletions(-) + +diff --git a/drivers/scsi/libsas/sas_internal.h b/drivers/scsi/libsas/sas_internal.h +index 03d6ec1eb970b..85948963fb97a 100644 +--- a/drivers/scsi/libsas/sas_internal.h ++++ b/drivers/scsi/libsas/sas_internal.h +@@ -145,20 +145,6 @@ static inline void sas_fail_probe(struct domain_device *dev, const char *func, i + func, dev->parent ? "exp-attached" : + "direct-attached", + SAS_ADDR(dev->sas_addr), err); +- +- /* +- * If the device probe failed, the expander phy attached address +- * needs to be reset so that the phy will not be treated as flutter +- * in the next revalidation +- */ +- if (dev->parent && !dev_is_expander(dev->dev_type)) { +- struct sas_phy *phy = dev->phy; +- struct domain_device *parent = dev->parent; +- struct ex_phy *ex_phy = &parent->ex_dev.ex_phy[phy->number]; +- +- memset(ex_phy->attached_sas_addr, 0, SAS_ADDR_SIZE); +- } +- + sas_unregister_dev(dev->port, dev); + } + +-- +2.51.0 + diff --git a/queue-6.12/scsi-ufs-core-fix-eh-failure-after-w-lun-resume-erro.patch b/queue-6.12/scsi-ufs-core-fix-eh-failure-after-w-lun-resume-erro.patch new file mode 100644 index 0000000000..a06f338ad8 --- /dev/null +++ b/queue-6.12/scsi-ufs-core-fix-eh-failure-after-w-lun-resume-erro.patch @@ -0,0 +1,126 @@ +From 476a23386de4be583497487eda0ebee81ed8a53e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Nov 2025 06:32:02 +0000 +Subject: scsi: ufs: core: Fix EH failure after W-LUN resume error + +From: Brian Kao + +[ Upstream commit b4bb6daf4ac4d4560044ecdd81e93aa2f6acbb06 ] + +When a W-LUN resume fails, its parent devices in the SCSI hierarchy, +including the scsi_target, may be runtime suspended. Subsequently, the +error handler in ufshcd_recover_pm_error() fails to set the W-LUN device +back to active because the parent target is not active. This results in +the following errors: + + google-ufshcd 3c2d0000.ufs: ufshcd_err_handler started; HBA state eh_fatal; ... + ufs_device_wlun 0:0:0:49488: START_STOP failed for power mode: 1, result 40000 + ufs_device_wlun 0:0:0:49488: ufshcd_wl_runtime_resume failed: -5 + ... + ufs_device_wlun 0:0:0:49488: runtime PM trying to activate child device 0:0:0:49488 but parent (target0:0:0) is not active + +Address this by: + + 1. Ensuring the W-LUN's parent scsi_target is runtime resumed before + attempting to set the W-LUN to active within + ufshcd_recover_pm_error(). + + 2. Explicitly checking for power.runtime_error on the HBA and W-LUN + devices before calling pm_runtime_set_active() to clear the error + state. + + 3. Adding pm_runtime_get_sync(hba->dev) in + ufshcd_err_handling_prepare() to ensure the HBA itself is active + during error recovery, even if a child device resume failed. + +These changes ensure the device power states are managed correctly +during error recovery. + +Signed-off-by: Brian Kao +Tested-by: Brian Kao +Reviewed-by: Bart Van Assche +Link: https://patch.msgid.link/20251112063214.1195761-1-powenkao@google.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/ufs/core/ufshcd.c | 36 ++++++++++++++++++++++++++++-------- + 1 file changed, 28 insertions(+), 8 deletions(-) + +diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c +index 24eb4795328ef..fb406e926d0cc 100644 +--- a/drivers/ufs/core/ufshcd.c ++++ b/drivers/ufs/core/ufshcd.c +@@ -6411,6 +6411,11 @@ static void ufshcd_clk_scaling_suspend(struct ufs_hba *hba, bool suspend) + + static void ufshcd_err_handling_prepare(struct ufs_hba *hba) + { ++ /* ++ * A WLUN resume failure could potentially lead to the HBA being ++ * runtime suspended, so take an extra reference on hba->dev. ++ */ ++ pm_runtime_get_sync(hba->dev); + ufshcd_rpm_get_sync(hba); + if (pm_runtime_status_suspended(&hba->ufs_device_wlun->sdev_gendev) || + hba->is_sys_suspended) { +@@ -6451,6 +6456,7 @@ static void ufshcd_err_handling_unprepare(struct ufs_hba *hba) + if (ufshcd_is_clkscaling_supported(hba)) + ufshcd_clk_scaling_suspend(hba, false); + ufshcd_rpm_put(hba); ++ pm_runtime_put(hba->dev); + } + + static inline bool ufshcd_err_handling_should_stop(struct ufs_hba *hba) +@@ -6465,28 +6471,42 @@ static inline bool ufshcd_err_handling_should_stop(struct ufs_hba *hba) + #ifdef CONFIG_PM + static void ufshcd_recover_pm_error(struct ufs_hba *hba) + { ++ struct scsi_target *starget = hba->ufs_device_wlun->sdev_target; + struct Scsi_Host *shost = hba->host; + struct scsi_device *sdev; + struct request_queue *q; +- int ret; ++ bool resume_sdev_queues = false; + + hba->is_sys_suspended = false; ++ + /* +- * Set RPM status of wlun device to RPM_ACTIVE, +- * this also clears its runtime error. ++ * Ensure the parent's error status is cleared before proceeding ++ * to the child, as the parent must be active to activate the child. + */ +- ret = pm_runtime_set_active(&hba->ufs_device_wlun->sdev_gendev); ++ if (hba->dev->power.runtime_error) { ++ /* hba->dev has no functional parent thus simplily set RPM_ACTIVE */ ++ pm_runtime_set_active(hba->dev); ++ resume_sdev_queues = true; ++ } ++ ++ if (hba->ufs_device_wlun->sdev_gendev.power.runtime_error) { ++ /* ++ * starget, parent of wlun, might be suspended if wlun resume failed. ++ * Make sure parent is resumed before set child (wlun) active. ++ */ ++ pm_runtime_get_sync(&starget->dev); ++ pm_runtime_set_active(&hba->ufs_device_wlun->sdev_gendev); ++ pm_runtime_put_sync(&starget->dev); ++ resume_sdev_queues = true; ++ } + +- /* hba device might have a runtime error otherwise */ +- if (ret) +- ret = pm_runtime_set_active(hba->dev); + /* + * If wlun device had runtime error, we also need to resume those + * consumer scsi devices in case any of them has failed to be + * resumed due to supplier runtime resume failure. This is to unblock + * blk_queue_enter in case there are bios waiting inside it. + */ +- if (!ret) { ++ if (resume_sdev_queues) { + shost_for_each_device(sdev, shost) { + q = sdev->request_queue; + if (q->dev && (q->rpm_status == RPM_SUSPENDED || +-- +2.51.0 + diff --git a/queue-6.12/series b/queue-6.12/series index cf20e46965..7e2ad6dd41 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -28,3 +28,22 @@ libceph-make-calc_target-set-t-paused-not-just-clear-it.patch tls-use-__sk_dst_get-and-dst_dev_rcu-in-get_netdev_for_sock.patch drm-xe-make-xe_gt_idle_disable_c6-handle-the-forcewake-internally.patch drm-xe-ensure-gt-is-in-c0-during-resumes.patch +csky-fix-csky_cmpxchg_fixup-not-working.patch +arm-9461-1-disable-highpte-on-preempt_rt-kernels.patch +alpha-don-t-reference-obsolete-termio-struct-for-tc-.patch +dm-snapshot-fix-scheduling-while-atomic-on-real-time.patch +nfsv4-ensure-the-open-stateid-seqid-doesn-t-go-backw.patch +asoc-rockchip-fix-wvoid-pointer-to-enum-cast-warning.patch +nfs-fix-up-the-automount-fs_context-to-use-the-corre.patch +drm-amd-display-shrink-struct-members.patch +bcache-fix-improper-use-of-bi_end_io.patch +smb-client-fix-nt_status_unable_to_free_vm-value.patch +smb-client-fix-nt_status_device_door_open-value.patch +smb-client-fix-nt_status_no_data_detected-value.patch +scsi-ipr-enable-disable-irqd_no_balancing-during-res.patch +scsi-ufs-core-fix-eh-failure-after-w-lun-resume-erro.patch +scsi-revert-scsi-libsas-fix-exp-attached-device-scan.patch +btrfs-fix-qgroup_snapshot_quick_inherit-squota-bug.patch +btrfs-qgroup-update-all-parent-qgroups-when-doing-qu.patch +btrfs-tracepoints-use-btrfs_root_id-to-get-the-id-of.patch +btrfs-fix-null-dereference-on-root-when-tracing-inod.patch diff --git a/queue-6.12/smb-client-fix-nt_status_device_door_open-value.patch b/queue-6.12/smb-client-fix-nt_status_device_door_open-value.patch new file mode 100644 index 0000000000..2b895dcce2 --- /dev/null +++ b/queue-6.12/smb-client-fix-nt_status_device_door_open-value.patch @@ -0,0 +1,38 @@ +From 3284512d7ea03a0ec6486979137afca1ce70e1ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Dec 2025 09:17:57 +0800 +Subject: smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value + +From: ChenXiaoSong + +[ Upstream commit b2b50fca34da5ec231008edba798ddf92986bd7f ] + +This was reported by the KUnit tests in the later patches. + +See MS-ERREF 2.3.1 STATUS_DEVICE_DOOR_OPEN. Keep it consistent with the +value in the documentation. + +Signed-off-by: ChenXiaoSong +Acked-by: Paulo Alcantara (Red Hat) +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/nterr.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/smb/client/nterr.h b/fs/smb/client/nterr.h +index 7ce063a1dc3f6..d46d42559eea2 100644 +--- a/fs/smb/client/nterr.h ++++ b/fs/smb/client/nterr.h +@@ -44,7 +44,7 @@ extern const struct nt_err_code_struct nt_errs[]; + #define NT_STATUS_NO_DATA_DETECTED 0x8000001c + #define NT_STATUS_STOPPED_ON_SYMLINK 0x8000002d + #define NT_STATUS_DEVICE_REQUIRES_CLEANING 0x80000288 +-#define NT_STATUS_DEVICE_DOOR_OPEN 0x80000288 ++#define NT_STATUS_DEVICE_DOOR_OPEN 0x80000289 + #define NT_STATUS_UNSUCCESSFUL 0xC0000000 | 0x0001 + #define NT_STATUS_NOT_IMPLEMENTED 0xC0000000 | 0x0002 + #define NT_STATUS_INVALID_INFO_CLASS 0xC0000000 | 0x0003 +-- +2.51.0 + diff --git a/queue-6.12/smb-client-fix-nt_status_no_data_detected-value.patch b/queue-6.12/smb-client-fix-nt_status_no_data_detected-value.patch new file mode 100644 index 0000000000..051a3ed964 --- /dev/null +++ b/queue-6.12/smb-client-fix-nt_status_no_data_detected-value.patch @@ -0,0 +1,38 @@ +From 8349d538907634ced3299250568768c45cc98aa4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Dec 2025 09:13:06 +0800 +Subject: smb/client: fix NT_STATUS_NO_DATA_DETECTED value + +From: ChenXiaoSong + +[ Upstream commit a1237c203f1757480dc2f3b930608ee00072d3cc ] + +This was reported by the KUnit tests in the later patches. + +See MS-ERREF 2.3.1 STATUS_NO_DATA_DETECTED. Keep it consistent with the +value in the documentation. + +Signed-off-by: ChenXiaoSong +Acked-by: Paulo Alcantara (Red Hat) +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/nterr.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/smb/client/nterr.h b/fs/smb/client/nterr.h +index d46d42559eea2..e3a341316a711 100644 +--- a/fs/smb/client/nterr.h ++++ b/fs/smb/client/nterr.h +@@ -41,7 +41,7 @@ extern const struct nt_err_code_struct nt_errs[]; + #define NT_STATUS_MEDIA_CHANGED 0x8000001c + #define NT_STATUS_END_OF_MEDIA 0x8000001e + #define NT_STATUS_MEDIA_CHECK 0x80000020 +-#define NT_STATUS_NO_DATA_DETECTED 0x8000001c ++#define NT_STATUS_NO_DATA_DETECTED 0x80000022 + #define NT_STATUS_STOPPED_ON_SYMLINK 0x8000002d + #define NT_STATUS_DEVICE_REQUIRES_CLEANING 0x80000288 + #define NT_STATUS_DEVICE_DOOR_OPEN 0x80000289 +-- +2.51.0 + diff --git a/queue-6.12/smb-client-fix-nt_status_unable_to_free_vm-value.patch b/queue-6.12/smb-client-fix-nt_status_unable_to_free_vm-value.patch new file mode 100644 index 0000000000..dec7c59822 --- /dev/null +++ b/queue-6.12/smb-client-fix-nt_status_unable_to_free_vm-value.patch @@ -0,0 +1,38 @@ +From 428bf75f636e8ad499662f3298a3f5b20bdea15d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Dec 2025 09:22:53 +0800 +Subject: smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value + +From: ChenXiaoSong + +[ Upstream commit 9f99caa8950a76f560a90074e3a4b93cfa8b3d84 ] + +This was reported by the KUnit tests in the later patches. + +See MS-ERREF 2.3.1 STATUS_UNABLE_TO_FREE_VM. Keep it consistent with the +value in the documentation. + +Signed-off-by: ChenXiaoSong +Acked-by: Paulo Alcantara (Red Hat) +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/nterr.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/smb/client/nterr.h b/fs/smb/client/nterr.h +index edd4741cab0a1..7ce063a1dc3f6 100644 +--- a/fs/smb/client/nterr.h ++++ b/fs/smb/client/nterr.h +@@ -70,7 +70,7 @@ extern const struct nt_err_code_struct nt_errs[]; + #define NT_STATUS_NO_MEMORY 0xC0000000 | 0x0017 + #define NT_STATUS_CONFLICTING_ADDRESSES 0xC0000000 | 0x0018 + #define NT_STATUS_NOT_MAPPED_VIEW 0xC0000000 | 0x0019 +-#define NT_STATUS_UNABLE_TO_FREE_VM 0x80000000 | 0x001a ++#define NT_STATUS_UNABLE_TO_FREE_VM 0xC0000000 | 0x001a + #define NT_STATUS_UNABLE_TO_DELETE_SECTION 0xC0000000 | 0x001b + #define NT_STATUS_INVALID_SYSTEM_SERVICE 0xC0000000 | 0x001c + #define NT_STATUS_ILLEGAL_INSTRUCTION 0xC0000000 | 0x001d +-- +2.51.0 + diff --git a/queue-6.18/alpha-don-t-reference-obsolete-termio-struct-for-tc-.patch b/queue-6.18/alpha-don-t-reference-obsolete-termio-struct-for-tc-.patch new file mode 100644 index 0000000000..d22c71eb87 --- /dev/null +++ b/queue-6.18/alpha-don-t-reference-obsolete-termio-struct-for-tc-.patch @@ -0,0 +1,49 @@ +From 302281cfe16f3433729f6b7db06e9d84b596fecf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Dec 2025 08:14:57 +0000 +Subject: alpha: don't reference obsolete termio struct for TC* constants + +From: Sam James + +[ Upstream commit 9aeed9041929812a10a6d693af050846942a1d16 ] + +Similar in nature to ab107276607af90b13a5994997e19b7b9731e251. glibc-2.42 +drops the legacy termio struct, but the ioctls.h header still defines some +TC* constants in terms of termio (via sizeof). Hardcode the values instead. + +This fixes building Python for example, which falls over like: + ./Modules/termios.c:1119:16: error: invalid application of 'sizeof' to incomplete type 'struct termio' + +Link: https://bugs.gentoo.org/961769 +Link: https://bugs.gentoo.org/962600 +Signed-off-by: Sam James +Reviewed-by: Magnus Lindholm +Link: https://lore.kernel.org/r/6ebd3451908785cad53b50ca6bc46cfe9d6bc03c.1764922497.git.sam@gentoo.org +Signed-off-by: Magnus Lindholm +Signed-off-by: Sasha Levin +--- + arch/alpha/include/uapi/asm/ioctls.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/alpha/include/uapi/asm/ioctls.h b/arch/alpha/include/uapi/asm/ioctls.h +index 971311605288f..a09d04b49cc65 100644 +--- a/arch/alpha/include/uapi/asm/ioctls.h ++++ b/arch/alpha/include/uapi/asm/ioctls.h +@@ -23,10 +23,10 @@ + #define TCSETSW _IOW('t', 21, struct termios) + #define TCSETSF _IOW('t', 22, struct termios) + +-#define TCGETA _IOR('t', 23, struct termio) +-#define TCSETA _IOW('t', 24, struct termio) +-#define TCSETAW _IOW('t', 25, struct termio) +-#define TCSETAF _IOW('t', 28, struct termio) ++#define TCGETA 0x40127417 ++#define TCSETA 0x80127418 ++#define TCSETAW 0x80127419 ++#define TCSETAF 0x8012741c + + #define TCSBRK _IO('t', 29) + #define TCXONC _IO('t', 30) +-- +2.51.0 + diff --git a/queue-6.18/alsa-hda-realtek-add-support-for-asus-um3406ga.patch b/queue-6.18/alsa-hda-realtek-add-support-for-asus-um3406ga.patch new file mode 100644 index 0000000000..e2ae5b77e7 --- /dev/null +++ b/queue-6.18/alsa-hda-realtek-add-support-for-asus-um3406ga.patch @@ -0,0 +1,34 @@ +From 431c15061623536b3cbab56d1f0f8ccae5d31345 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Dec 2025 15:05:55 +0000 +Subject: ALSA: hda/realtek: Add support for ASUS UM3406GA + +From: Stefan Binding + +[ Upstream commit 826c0b1ed09e5335abcae07292440ce72346e578 ] + +Laptops use 2 CS35L41 Amps with HDA, using External boost, with I2C + +Signed-off-by: Stefan Binding +Link: https://patch.msgid.link/20251205150614.49590-3-sbinding@opensource.cirrus.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/hda/codecs/realtek/alc269.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c +index b3582e390dfa3..eea8399e32588 100644 +--- a/sound/hda/codecs/realtek/alc269.c ++++ b/sound/hda/codecs/realtek/alc269.c +@@ -6761,6 +6761,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A), + SND_PCI_QUIRK(0x1043, 0x1533, "ASUS GV302XA/XJ/XQ/XU/XV/XI", ALC287_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x1043, 0x1573, "ASUS GZ301VV/VQ/VU/VJ/VA/VC/VE/VVC/VQC/VUC/VJC/VEC/VCC", ALC285_FIXUP_ASUS_HEADSET_MIC), ++ SND_PCI_QUIRK(0x1043, 0x1584, "ASUS UM3406GA ", ALC287_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x1043, 0x1652, "ASUS ROG Zephyrus Do 15 SE", ALC289_FIXUP_ASUS_ZEPHYRUS_DUAL_SPK), + SND_PCI_QUIRK(0x1043, 0x1662, "ASUS GV301QH", ALC294_FIXUP_ASUS_DUAL_SPK), + SND_PCI_QUIRK(0x1043, 0x1663, "ASUS GU603ZI/ZJ/ZQ/ZU/ZV", ALC285_FIXUP_ASUS_HEADSET_MIC), +-- +2.51.0 + diff --git a/queue-6.18/arm-9461-1-disable-highpte-on-preempt_rt-kernels.patch b/queue-6.18/arm-9461-1-disable-highpte-on-preempt_rt-kernels.patch new file mode 100644 index 0000000000..6cf2e974b9 --- /dev/null +++ b/queue-6.18/arm-9461-1-disable-highpte-on-preempt_rt-kernels.patch @@ -0,0 +1,51 @@ +From ffe854e3c298b891480f31d094ee12728511879a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Nov 2025 16:54:37 +0100 +Subject: ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels + +From: Sebastian Andrzej Siewior + +[ Upstream commit fedadc4137234c3d00c4785eeed3e747fe9036ae ] + +gup_pgd_range() is invoked with disabled interrupts and invokes +__kmap_local_page_prot() via pte_offset_map(), gup_p4d_range(). +With HIGHPTE enabled, __kmap_local_page_prot() invokes kmap_high_get() +which uses a spinlock_t via lock_kmap_any(). This leads to an +sleeping-while-atomic error on PREEMPT_RT because spinlock_t becomes a +sleeping lock and must not be acquired in atomic context. + +The loop in map_new_virtual() uses wait_queue_head_t for wake up which +also is using a spinlock_t. + +Since HIGHPTE is rarely needed at all, turn it off for PREEMPT_RT +to allow the use of get_user_pages_fast(). + +[arnd: rework patch to turn off HIGHPTE instead of HAVE_PAST_GUP] + +Co-developed-by: Arnd Bergmann + +Acked-by: Linus Walleij +Reviewed-by: Arnd Bergmann +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Russell King (Oracle) +Signed-off-by: Sasha Levin +--- + arch/arm/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig +index 4fb985b76e97f..70cd3b5b5a059 100644 +--- a/arch/arm/Kconfig ++++ b/arch/arm/Kconfig +@@ -1215,7 +1215,7 @@ config HIGHMEM + + config HIGHPTE + bool "Allocate 2nd-level pagetables from highmem" if EXPERT +- depends on HIGHMEM ++ depends on HIGHMEM && !PREEMPT_RT + default y + help + The VM uses one page of physical memory for each page table. +-- +2.51.0 + diff --git a/queue-6.18/asoc-rockchip-fix-wvoid-pointer-to-enum-cast-warning.patch b/queue-6.18/asoc-rockchip-fix-wvoid-pointer-to-enum-cast-warning.patch new file mode 100644 index 0000000000..b9f53882cf --- /dev/null +++ b/queue-6.18/asoc-rockchip-fix-wvoid-pointer-to-enum-cast-warning.patch @@ -0,0 +1,47 @@ +From 759b662d7b9d5d0a1d7b368ecb9ed92b06495a34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Dec 2025 15:16:45 +0100 +Subject: ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again) + +From: Krzysztof Kozlowski + +[ Upstream commit 57d508b5f718730f74b11e0dc9609ac7976802d1 ] + +'version' is an enum, thus cast of pointer on 64-bit compile test with +clang W=1 causes: + + rockchip_pdm.c:583:17: error: cast to smaller integer type 'enum rk_pdm_version' from 'const void *' [-Werror,-Wvoid-pointer-to-enum-cast] + +This was already fixed in commit 49a4a8d12612 ("ASoC: rockchip: Fix +Wvoid-pointer-to-enum-cast warning") but then got bad in +commit 9958d85968ed ("ASoC: Use device_get_match_data()"). + +Discussion on LKML also pointed out that 'uintptr_t' is not the correct +type and either 'kernel_ulong_t' or 'unsigned long' should be used, +with several arguments towards the latter [1]. + +Link: https://lore.kernel.org/r/CAMuHMdX7t=mabqFE5O-Cii3REMuyaePHmqX+j_mqyrn6XXzsoA@mail.gmail.com/ [1] +Signed-off-by: Krzysztof Kozlowski +Link: https://patch.msgid.link/20251203141644.106459-2-krzysztof.kozlowski@oss.qualcomm.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/rockchip/rockchip_pdm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/rockchip/rockchip_pdm.c b/sound/soc/rockchip/rockchip_pdm.c +index c1ee470ec6079..c69cdd6f24994 100644 +--- a/sound/soc/rockchip/rockchip_pdm.c ++++ b/sound/soc/rockchip/rockchip_pdm.c +@@ -580,7 +580,7 @@ static int rockchip_pdm_probe(struct platform_device *pdev) + if (!pdm) + return -ENOMEM; + +- pdm->version = (enum rk_pdm_version)device_get_match_data(&pdev->dev); ++ pdm->version = (unsigned long)device_get_match_data(&pdev->dev); + if (pdm->version == RK_PDM_RK3308) { + pdm->reset = devm_reset_control_get(&pdev->dev, "pdm-m"); + if (IS_ERR(pdm->reset)) +-- +2.51.0 + diff --git a/queue-6.18/bcache-fix-improper-use-of-bi_end_io.patch b/queue-6.18/bcache-fix-improper-use-of-bi_end_io.patch new file mode 100644 index 0000000000..969de04fdb --- /dev/null +++ b/queue-6.18/bcache-fix-improper-use-of-bi_end_io.patch @@ -0,0 +1,55 @@ +From a16d4f532d0ae2d7d4c3c0063cc62f97ffc8dd5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Dec 2025 17:01:56 +0800 +Subject: bcache: fix improper use of bi_end_io + +From: Shida Zhang + +[ Upstream commit 53280e398471f0bddbb17b798a63d41264651325 ] + +Don't call bio->bi_end_io() directly. Use the bio_endio() helper +function instead, which handles completion more safely and uniformly. + +Suggested-by: Christoph Hellwig +Reviewed-by: Christoph Hellwig +Signed-off-by: Shida Zhang +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/md/bcache/request.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c +index af345dc6fde14..82fdea7dea7aa 100644 +--- a/drivers/md/bcache/request.c ++++ b/drivers/md/bcache/request.c +@@ -1104,7 +1104,7 @@ static void detached_dev_end_io(struct bio *bio) + } + + kfree(ddip); +- bio->bi_end_io(bio); ++ bio_endio(bio); + } + + static void detached_dev_do_request(struct bcache_device *d, struct bio *bio, +@@ -1121,7 +1121,7 @@ static void detached_dev_do_request(struct bcache_device *d, struct bio *bio, + ddip = kzalloc(sizeof(struct detached_dev_io_private), GFP_NOIO); + if (!ddip) { + bio->bi_status = BLK_STS_RESOURCE; +- bio->bi_end_io(bio); ++ bio_endio(bio); + return; + } + +@@ -1136,7 +1136,7 @@ static void detached_dev_do_request(struct bcache_device *d, struct bio *bio, + + if ((bio_op(bio) == REQ_OP_DISCARD) && + !bdev_max_discard_sectors(dc->bdev)) +- bio->bi_end_io(bio); ++ detached_dev_end_io(bio); + else + submit_bio_noacct(bio); + } +-- +2.51.0 + diff --git a/queue-6.18/btrfs-fix-null-dereference-on-root-when-tracing-inod.patch b/queue-6.18/btrfs-fix-null-dereference-on-root-when-tracing-inod.patch new file mode 100644 index 0000000000..e08eb113f7 --- /dev/null +++ b/queue-6.18/btrfs-fix-null-dereference-on-root-when-tracing-inod.patch @@ -0,0 +1,51 @@ +From 308b7920f6cd1fa25f53a36314ff7328742952b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Oct 2025 11:11:25 +0200 +Subject: btrfs: fix NULL dereference on root when tracing inode eviction +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Miquel Sabaté Solà + +[ Upstream commit f157dd661339fc6f5f2b574fe2429c43bd309534 ] + +When evicting an inode the first thing we do is to setup tracing for it, +which implies fetching the root's id. But in btrfs_evict_inode() the +root might be NULL, as implied in the next check that we do in +btrfs_evict_inode(). + +Hence, we either should set the ->root_objectid to 0 in case the root is +NULL, or we move tracing setup after checking that the root is not +NULL. Setting the rootid to 0 at least gives us the possibility to trace +this call even in the case when the root is NULL, so that's the solution +taken here. + +Fixes: 1abe9b8a138c ("Btrfs: add initial tracepoint support for btrfs") +Reported-by: syzbot+d991fea1b4b23b1f6bf8@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=d991fea1b4b23b1f6bf8 +Signed-off-by: Miquel Sabaté Solà +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + include/trace/events/btrfs.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h +index 7e418f065b945..125bdc166bfed 100644 +--- a/include/trace/events/btrfs.h ++++ b/include/trace/events/btrfs.h +@@ -224,7 +224,8 @@ DECLARE_EVENT_CLASS(btrfs__inode, + __entry->generation = BTRFS_I(inode)->generation; + __entry->last_trans = BTRFS_I(inode)->last_trans; + __entry->logged_trans = BTRFS_I(inode)->logged_trans; +- __entry->root_objectid = btrfs_root_id(BTRFS_I(inode)->root); ++ __entry->root_objectid = BTRFS_I(inode)->root ? ++ btrfs_root_id(BTRFS_I(inode)->root) : 0; + ), + + TP_printk_btrfs("root=%llu(%s) gen=%llu ino=%llu blocks=%llu " +-- +2.51.0 + diff --git a/queue-6.18/btrfs-fix-qgroup_snapshot_quick_inherit-squota-bug.patch b/queue-6.18/btrfs-fix-qgroup_snapshot_quick_inherit-squota-bug.patch new file mode 100644 index 0000000000..48f0728fb0 --- /dev/null +++ b/queue-6.18/btrfs-fix-qgroup_snapshot_quick_inherit-squota-bug.patch @@ -0,0 +1,108 @@ +From da0e6d5b69d9e5deb7764cbf001e2e242c6f9ce8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Dec 2025 12:47:14 -0800 +Subject: btrfs: fix qgroup_snapshot_quick_inherit() squota bug + +From: Boris Burkov + +[ Upstream commit 7ee19a59a75e3d5b9ec00499b86af8e2a46fbe86 ] + +qgroup_snapshot_quick_inherit() detects conditions where the snapshot +destination would land in the same parent qgroup as the snapshot source +subvolume. In this case we can avoid costly qgroup calculations and just +add the nodesize of the new snapshot to the parent. + +However, in the case of squotas this is actually a double count, and +also an undercount for deeper qgroup nestings. + +The following annotated script shows the issue: + + btrfs quota enable --simple "$mnt" + + # Create 2-level qgroup hierarchy + btrfs qgroup create 2/100 "$mnt" # Q2 (level 2) + btrfs qgroup create 1/100 "$mnt" # Q1 (level 1) + btrfs qgroup assign 1/100 2/100 "$mnt" + + # Create base subvolume + btrfs subvolume create "$mnt/base" >/dev/null + base_id=$(btrfs subvolume show "$mnt/base" | grep 'Subvolume ID:' | awk '{print $3}') + + # Create intermediate snapshot and add to Q1 + btrfs subvolume snapshot "$mnt/base" "$mnt/intermediate" >/dev/null + inter_id=$(btrfs subvolume show "$mnt/intermediate" | grep 'Subvolume ID:' | awk '{print $3}') + btrfs qgroup assign "0/$inter_id" 1/100 "$mnt" + + # Create working snapshot with --inherit (auto-adds to Q1) + # src=intermediate (in only Q1) + # dst=snap (inheriting only into Q1) + # This double counts the 16k nodesize of the snapshot in Q1, and + # undercounts it in Q2. + btrfs subvolume snapshot -i 1/100 "$mnt/intermediate" "$mnt/snap" >/dev/null + snap_id=$(btrfs subvolume show "$mnt/snap" | grep 'Subvolume ID:' | awk '{print $3}') + + # Fully complete snapshot creation + sync + + # Delete working snapshot + # Q1 and Q2 will lose the full snap usage + btrfs subvolume delete "$mnt/snap" >/dev/null + + # Delete intermediate and remove from Q1 + # Q1 and Q2 will lose the full intermediate usage + btrfs qgroup remove "0/$inter_id" 1/100 "$mnt" + btrfs subvolume delete "$mnt/intermediate" >/dev/null + + # Q1 should be at 0, but still has 16k. Q2 is "correct" at 0 (for now...) + + # Trigger cleaner, wait for deletions + mount -o remount,sync=1 "$mnt" + btrfs subvolume sync "$mnt" "$snap_id" + btrfs subvolume sync "$mnt" "$inter_id" + + # Remove Q1 from Q2 + # Frees 16k more from Q2, underflowing it to 16EiB + btrfs qgroup remove 1/100 2/100 "$mnt" + + # And show the bad state: + btrfs qgroup show -pc "$mnt" + + Qgroupid Referenced Exclusive Parent Child Path + -------- ---------- --------- ------ ----- ---- + 0/5 16.00KiB 16.00KiB - - + 0/256 16.00KiB 16.00KiB - - base + 1/100 16.00KiB 16.00KiB - - <0 member qgroups> + 2/100 16.00EiB 16.00EiB - - <0 member qgroups> + +Fix this by simply not doing this quick inheritance with squotas. + +I suspect that it is also wrong in normal qgroups to not recurse up the +qgroup tree in the quick inherit case, though other consistency checks +will likely fix it anyway. + +Fixes: b20fe56cd285 ("btrfs: qgroup: allow quick inherit if snapshot is created and added to the same parent") +Reviewed-by: Qu Wenruo +Signed-off-by: Boris Burkov +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/qgroup.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c +index 31ad8580322a6..7faaa777010d7 100644 +--- a/fs/btrfs/qgroup.c ++++ b/fs/btrfs/qgroup.c +@@ -3247,6 +3247,9 @@ static int qgroup_snapshot_quick_inherit(struct btrfs_fs_info *fs_info, + struct btrfs_qgroup_list *list; + int nr_parents = 0; + ++ if (btrfs_qgroup_mode(fs_info) != BTRFS_QGROUP_MODE_FULL) ++ return 0; ++ + src = find_qgroup_rb(fs_info, srcid); + if (!src) + return -ENOENT; +-- +2.51.0 + diff --git a/queue-6.18/btrfs-fix-use-after-free-warning-in-btrfs_get_or_cre.patch b/queue-6.18/btrfs-fix-use-after-free-warning-in-btrfs_get_or_cre.patch new file mode 100644 index 0000000000..2c2a61131d --- /dev/null +++ b/queue-6.18/btrfs-fix-use-after-free-warning-in-btrfs_get_or_cre.patch @@ -0,0 +1,104 @@ +From 7bc1e477dc45342f125bc9e57eb9874c99046c7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Dec 2025 17:26:26 -0800 +Subject: btrfs: fix use-after-free warning in + btrfs_get_or_create_delayed_node() + +From: Leo Martins + +[ Upstream commit 83f59076a1ae6f5c6845d6f7ed3a1a373d883684 ] + +Previously, btrfs_get_or_create_delayed_node() set the delayed_node's +refcount before acquiring the root->delayed_nodes lock. +Commit e8513c012de7 ("btrfs: implement ref_tracker for delayed_nodes") +moved refcount_set inside the critical section, which means there is +no longer a memory barrier between setting the refcount and setting +btrfs_inode->delayed_node. + +Without that barrier, the stores to node->refs and +btrfs_inode->delayed_node may become visible out of order. Another +thread can then read btrfs_inode->delayed_node and attempt to +increment a refcount that hasn't been set yet, leading to a +refcounting bug and a use-after-free warning. + +The fix is to move refcount_set back to where it was to take +advantage of the implicit memory barrier provided by lock +acquisition. + +Because the allocations now happen outside of the lock's critical +section, they can use GFP_NOFS instead of GFP_ATOMIC. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-lkp/202511262228.6dda231e-lkp@intel.com +Fixes: e8513c012de7 ("btrfs: implement ref_tracker for delayed_nodes") +Tested-by: kernel test robot +Reviewed-by: Filipe Manana +Signed-off-by: Leo Martins +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/delayed-inode.c | 32 +++++++++++++++++--------------- + 1 file changed, 17 insertions(+), 15 deletions(-) + +diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c +index 3df7b9d7fbe8d..59b489d7e4b58 100644 +--- a/fs/btrfs/delayed-inode.c ++++ b/fs/btrfs/delayed-inode.c +@@ -152,37 +152,39 @@ static struct btrfs_delayed_node *btrfs_get_or_create_delayed_node( + return ERR_PTR(-ENOMEM); + btrfs_init_delayed_node(node, root, ino); + ++ /* Cached in the inode and can be accessed. */ ++ refcount_set(&node->refs, 2); ++ btrfs_delayed_node_ref_tracker_alloc(node, tracker, GFP_NOFS); ++ btrfs_delayed_node_ref_tracker_alloc(node, &node->inode_cache_tracker, GFP_NOFS); ++ + /* Allocate and reserve the slot, from now it can return a NULL from xa_load(). */ + ret = xa_reserve(&root->delayed_nodes, ino, GFP_NOFS); +- if (ret == -ENOMEM) { +- btrfs_delayed_node_ref_tracker_dir_exit(node); +- kmem_cache_free(delayed_node_cache, node); +- return ERR_PTR(-ENOMEM); +- } ++ if (ret == -ENOMEM) ++ goto cleanup; ++ + xa_lock(&root->delayed_nodes); + ptr = xa_load(&root->delayed_nodes, ino); + if (ptr) { + /* Somebody inserted it, go back and read it. */ + xa_unlock(&root->delayed_nodes); +- btrfs_delayed_node_ref_tracker_dir_exit(node); +- kmem_cache_free(delayed_node_cache, node); +- node = NULL; +- goto again; ++ goto cleanup; + } + ptr = __xa_store(&root->delayed_nodes, ino, node, GFP_ATOMIC); + ASSERT(xa_err(ptr) != -EINVAL); + ASSERT(xa_err(ptr) != -ENOMEM); + ASSERT(ptr == NULL); +- +- /* Cached in the inode and can be accessed. */ +- refcount_set(&node->refs, 2); +- btrfs_delayed_node_ref_tracker_alloc(node, tracker, GFP_ATOMIC); +- btrfs_delayed_node_ref_tracker_alloc(node, &node->inode_cache_tracker, GFP_ATOMIC); +- + btrfs_inode->delayed_node = node; + xa_unlock(&root->delayed_nodes); + + return node; ++cleanup: ++ btrfs_delayed_node_ref_tracker_free(node, tracker); ++ btrfs_delayed_node_ref_tracker_free(node, &node->inode_cache_tracker); ++ btrfs_delayed_node_ref_tracker_dir_exit(node); ++ kmem_cache_free(delayed_node_cache, node); ++ if (ret) ++ return ERR_PTR(ret); ++ goto again; + } + + /* +-- +2.51.0 + diff --git a/queue-6.18/btrfs-qgroup-update-all-parent-qgroups-when-doing-qu.patch b/queue-6.18/btrfs-qgroup-update-all-parent-qgroups-when-doing-qu.patch new file mode 100644 index 0000000000..1b6b44534a --- /dev/null +++ b/queue-6.18/btrfs-qgroup-update-all-parent-qgroups-when-doing-qu.patch @@ -0,0 +1,105 @@ +From 77d21b4236beec637f79af4a48b81d53ae107e41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Dec 2025 14:38:23 +1030 +Subject: btrfs: qgroup: update all parent qgroups when doing quick inherit + +From: Qu Wenruo + +[ Upstream commit 68d4b3fa18d72b7f649e83012e7e08f1881f6b75 ] + +[BUG] +There is a bug that if a subvolume has multi-level parent qgroups, and +is able to do a quick inherit, only the direct parent qgroup got +updated: + + mkfs.btrfs -f -O quota $dev + mount $dev $mnt + btrfs subv create $mnt/subv1 + btrfs qgroup create 1/100 $mnt + btrfs qgroup create 2/100 $mnt + btrfs qgroup assign 1/100 2/100 $mnt + btrfs qgroup assign 0/256 1/100 $mnt + btrfs qgroup show -p --sync $mnt + + Qgroupid Referenced Exclusive Parent Path + -------- ---------- --------- ------ ---- + 0/5 16.00KiB 16.00KiB - + 0/256 16.00KiB 16.00KiB 1/100 subv1 + 1/100 16.00KiB 16.00KiB 2/100 2/100<1 member qgroup> + 2/100 16.00KiB 16.00KiB - <0 member qgroups> + + btrfs subv snap -i 1/100 $mnt/subv1 $mnt/snap1 + btrfs qgroup show -p --sync $mnt + + Qgroupid Referenced Exclusive Parent Path + -------- ---------- --------- ------ ---- + 0/5 16.00KiB 16.00KiB - + 0/256 16.00KiB 16.00KiB 1/100 subv1 + 0/257 16.00KiB 16.00KiB 1/100 snap1 + 1/100 32.00KiB 32.00KiB 2/100 2/100<1 member qgroup> + 2/100 16.00KiB 16.00KiB - <0 member qgroups> + # Note that 2/100 is not updated, and qgroup numbers are inconsistent + + umount $mnt + +[CAUSE] +If the snapshot source subvolume belongs to a parent qgroup, and the new +snapshot target is also added to the new same parent qgroup, we allow a +quick update without marking qgroup inconsistent. + +But that quick update only update the parent qgroup, without checking if +there is any more parent qgroups. + +[FIX] +Iterate through all parent qgroups during the quick inherit. + +Reported-by: Boris Burkov +Fixes: b20fe56cd285 ("btrfs: qgroup: allow quick inherit if snapshot is created and added to the same parent") +Reviewed-by: Boris Burkov +Signed-off-by: Qu Wenruo +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/qgroup.c | 18 ++++++++++++++++-- + 1 file changed, 16 insertions(+), 2 deletions(-) + +diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c +index 7faaa777010d7..febc22d1b6487 100644 +--- a/fs/btrfs/qgroup.c ++++ b/fs/btrfs/qgroup.c +@@ -3244,7 +3244,10 @@ static int qgroup_snapshot_quick_inherit(struct btrfs_fs_info *fs_info, + { + struct btrfs_qgroup *src; + struct btrfs_qgroup *parent; ++ struct btrfs_qgroup *qgroup; + struct btrfs_qgroup_list *list; ++ LIST_HEAD(qgroup_list); ++ const u32 nodesize = fs_info->nodesize; + int nr_parents = 0; + + if (btrfs_qgroup_mode(fs_info) != BTRFS_QGROUP_MODE_FULL) +@@ -3284,8 +3287,19 @@ static int qgroup_snapshot_quick_inherit(struct btrfs_fs_info *fs_info, + if (parent->excl != parent->rfer) + return 1; + +- parent->excl += fs_info->nodesize; +- parent->rfer += fs_info->nodesize; ++ qgroup_iterator_add(&qgroup_list, parent); ++ list_for_each_entry(qgroup, &qgroup_list, iterator) { ++ qgroup->rfer += nodesize; ++ qgroup->rfer_cmpr += nodesize; ++ qgroup->excl += nodesize; ++ qgroup->excl_cmpr += nodesize; ++ qgroup_dirty(fs_info, qgroup); ++ ++ /* Append parent qgroups to @qgroup_list. */ ++ list_for_each_entry(list, &qgroup->groups, next_group) ++ qgroup_iterator_add(&qgroup_list, list->group); ++ } ++ qgroup_iterator_clean(&qgroup_list); + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.18/csky-fix-csky_cmpxchg_fixup-not-working.patch b/queue-6.18/csky-fix-csky_cmpxchg_fixup-not-working.patch new file mode 100644 index 0000000000..4702f7494a --- /dev/null +++ b/queue-6.18/csky-fix-csky_cmpxchg_fixup-not-working.patch @@ -0,0 +1,40 @@ +From 34eb91b8f427727c5945864dd10b386d97d70d63 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Oct 2024 17:56:26 +0800 +Subject: csky: fix csky_cmpxchg_fixup not working + +From: Yang Li + +[ Upstream commit 809ef03d6d21d5fea016bbf6babeec462e37e68c ] + +In the csky_cmpxchg_fixup function, it is incorrect to use the global +variable csky_cmpxchg_stw to determine the address where the exception +occurred.The global variable csky_cmpxchg_stw stores the opcode at the +time of the exception, while &csky_cmpxchg_stw shows the address where +the exception occurred. + +Signed-off-by: Yang Li +Signed-off-by: Guo Ren +Signed-off-by: Sasha Levin +--- + arch/csky/mm/fault.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/csky/mm/fault.c b/arch/csky/mm/fault.c +index a6ca7dff42153..7ff4011089850 100644 +--- a/arch/csky/mm/fault.c ++++ b/arch/csky/mm/fault.c +@@ -45,8 +45,8 @@ static inline void csky_cmpxchg_fixup(struct pt_regs *regs) + if (trap_no(regs) != VEC_TLBMODIFIED) + return; + +- if (instruction_pointer(regs) == csky_cmpxchg_stw) +- instruction_pointer_set(regs, csky_cmpxchg_ldw); ++ if (instruction_pointer(regs) == (unsigned long)&csky_cmpxchg_stw) ++ instruction_pointer_set(regs, (unsigned long)&csky_cmpxchg_ldw); + return; + } + #endif +-- +2.51.0 + diff --git a/queue-6.18/dm-snapshot-fix-scheduling-while-atomic-on-real-time.patch b/queue-6.18/dm-snapshot-fix-scheduling-while-atomic-on-real-time.patch new file mode 100644 index 0000000000..117627dc06 --- /dev/null +++ b/queue-6.18/dm-snapshot-fix-scheduling-while-atomic-on-real-time.patch @@ -0,0 +1,238 @@ +From f696545255ae22ef5fdf6b2da59ebc6214e97bd9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Dec 2025 22:13:10 +0100 +Subject: dm-snapshot: fix 'scheduling while atomic' on real-time kernels + +From: Mikulas Patocka + +[ Upstream commit 8581b19eb2c5ccf06c195d3b5468c3c9d17a5020 ] + +There is reported 'scheduling while atomic' bug when using dm-snapshot on +real-time kernels. The reason for the bug is that the hlist_bl code does +preempt_disable() when taking the lock and the kernel attempts to take +other spinlocks while holding the hlist_bl lock. + +Fix this by converting a hlist_bl spinlock into a regular spinlock. + +Signed-off-by: Mikulas Patocka +Reported-by: Jiping Ma +Signed-off-by: Sasha Levin +--- + drivers/md/dm-exception-store.h | 2 +- + drivers/md/dm-snap.c | 73 +++++++++++++++------------------ + 2 files changed, 35 insertions(+), 40 deletions(-) + +diff --git a/drivers/md/dm-exception-store.h b/drivers/md/dm-exception-store.h +index b679766375381..061b4d3108132 100644 +--- a/drivers/md/dm-exception-store.h ++++ b/drivers/md/dm-exception-store.h +@@ -29,7 +29,7 @@ typedef sector_t chunk_t; + * chunk within the device. + */ + struct dm_exception { +- struct hlist_bl_node hash_list; ++ struct hlist_node hash_list; + + chunk_t old_chunk; + chunk_t new_chunk; +diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c +index f40c18da40000..dbd148967de42 100644 +--- a/drivers/md/dm-snap.c ++++ b/drivers/md/dm-snap.c +@@ -40,10 +40,15 @@ static const char dm_snapshot_merge_target_name[] = "snapshot-merge"; + #define DM_TRACKED_CHUNK_HASH(x) ((unsigned long)(x) & \ + (DM_TRACKED_CHUNK_HASH_SIZE - 1)) + ++struct dm_hlist_head { ++ struct hlist_head head; ++ spinlock_t lock; ++}; ++ + struct dm_exception_table { + uint32_t hash_mask; + unsigned int hash_shift; +- struct hlist_bl_head *table; ++ struct dm_hlist_head *table; + }; + + struct dm_snapshot { +@@ -628,8 +633,8 @@ static uint32_t exception_hash(struct dm_exception_table *et, chunk_t chunk); + + /* Lock to protect access to the completed and pending exception hash tables. */ + struct dm_exception_table_lock { +- struct hlist_bl_head *complete_slot; +- struct hlist_bl_head *pending_slot; ++ spinlock_t *complete_slot; ++ spinlock_t *pending_slot; + }; + + static void dm_exception_table_lock_init(struct dm_snapshot *s, chunk_t chunk, +@@ -638,20 +643,20 @@ static void dm_exception_table_lock_init(struct dm_snapshot *s, chunk_t chunk, + struct dm_exception_table *complete = &s->complete; + struct dm_exception_table *pending = &s->pending; + +- lock->complete_slot = &complete->table[exception_hash(complete, chunk)]; +- lock->pending_slot = &pending->table[exception_hash(pending, chunk)]; ++ lock->complete_slot = &complete->table[exception_hash(complete, chunk)].lock; ++ lock->pending_slot = &pending->table[exception_hash(pending, chunk)].lock; + } + + static void dm_exception_table_lock(struct dm_exception_table_lock *lock) + { +- hlist_bl_lock(lock->complete_slot); +- hlist_bl_lock(lock->pending_slot); ++ spin_lock_nested(lock->complete_slot, 1); ++ spin_lock_nested(lock->pending_slot, 2); + } + + static void dm_exception_table_unlock(struct dm_exception_table_lock *lock) + { +- hlist_bl_unlock(lock->pending_slot); +- hlist_bl_unlock(lock->complete_slot); ++ spin_unlock(lock->pending_slot); ++ spin_unlock(lock->complete_slot); + } + + static int dm_exception_table_init(struct dm_exception_table *et, +@@ -661,13 +666,15 @@ static int dm_exception_table_init(struct dm_exception_table *et, + + et->hash_shift = hash_shift; + et->hash_mask = size - 1; +- et->table = kvmalloc_array(size, sizeof(struct hlist_bl_head), ++ et->table = kvmalloc_array(size, sizeof(struct dm_hlist_head), + GFP_KERNEL); + if (!et->table) + return -ENOMEM; + +- for (i = 0; i < size; i++) +- INIT_HLIST_BL_HEAD(et->table + i); ++ for (i = 0; i < size; i++) { ++ INIT_HLIST_HEAD(&et->table[i].head); ++ spin_lock_init(&et->table[i].lock); ++ } + + return 0; + } +@@ -675,16 +682,17 @@ static int dm_exception_table_init(struct dm_exception_table *et, + static void dm_exception_table_exit(struct dm_exception_table *et, + struct kmem_cache *mem) + { +- struct hlist_bl_head *slot; ++ struct dm_hlist_head *slot; + struct dm_exception *ex; +- struct hlist_bl_node *pos, *n; ++ struct hlist_node *pos; + int i, size; + + size = et->hash_mask + 1; + for (i = 0; i < size; i++) { + slot = et->table + i; + +- hlist_bl_for_each_entry_safe(ex, pos, n, slot, hash_list) { ++ hlist_for_each_entry_safe(ex, pos, &slot->head, hash_list) { ++ hlist_del(&ex->hash_list); + kmem_cache_free(mem, ex); + cond_resched(); + } +@@ -700,7 +708,7 @@ static uint32_t exception_hash(struct dm_exception_table *et, chunk_t chunk) + + static void dm_remove_exception(struct dm_exception *e) + { +- hlist_bl_del(&e->hash_list); ++ hlist_del(&e->hash_list); + } + + /* +@@ -710,12 +718,11 @@ static void dm_remove_exception(struct dm_exception *e) + static struct dm_exception *dm_lookup_exception(struct dm_exception_table *et, + chunk_t chunk) + { +- struct hlist_bl_head *slot; +- struct hlist_bl_node *pos; ++ struct hlist_head *slot; + struct dm_exception *e; + +- slot = &et->table[exception_hash(et, chunk)]; +- hlist_bl_for_each_entry(e, pos, slot, hash_list) ++ slot = &et->table[exception_hash(et, chunk)].head; ++ hlist_for_each_entry(e, slot, hash_list) + if (chunk >= e->old_chunk && + chunk <= e->old_chunk + dm_consecutive_chunk_count(e)) + return e; +@@ -762,18 +769,17 @@ static void free_pending_exception(struct dm_snap_pending_exception *pe) + static void dm_insert_exception(struct dm_exception_table *eh, + struct dm_exception *new_e) + { +- struct hlist_bl_head *l; +- struct hlist_bl_node *pos; ++ struct hlist_head *l; + struct dm_exception *e = NULL; + +- l = &eh->table[exception_hash(eh, new_e->old_chunk)]; ++ l = &eh->table[exception_hash(eh, new_e->old_chunk)].head; + + /* Add immediately if this table doesn't support consecutive chunks */ + if (!eh->hash_shift) + goto out; + + /* List is ordered by old_chunk */ +- hlist_bl_for_each_entry(e, pos, l, hash_list) { ++ hlist_for_each_entry(e, l, hash_list) { + /* Insert after an existing chunk? */ + if (new_e->old_chunk == (e->old_chunk + + dm_consecutive_chunk_count(e) + 1) && +@@ -804,13 +810,13 @@ static void dm_insert_exception(struct dm_exception_table *eh, + * Either the table doesn't support consecutive chunks or slot + * l is empty. + */ +- hlist_bl_add_head(&new_e->hash_list, l); ++ hlist_add_head(&new_e->hash_list, l); + } else if (new_e->old_chunk < e->old_chunk) { + /* Add before an existing exception */ +- hlist_bl_add_before(&new_e->hash_list, &e->hash_list); ++ hlist_add_before(&new_e->hash_list, &e->hash_list); + } else { + /* Add to l's tail: e is the last exception in this slot */ +- hlist_bl_add_behind(&new_e->hash_list, &e->hash_list); ++ hlist_add_behind(&new_e->hash_list, &e->hash_list); + } + } + +@@ -820,7 +826,6 @@ static void dm_insert_exception(struct dm_exception_table *eh, + */ + static int dm_add_exception(void *context, chunk_t old, chunk_t new) + { +- struct dm_exception_table_lock lock; + struct dm_snapshot *s = context; + struct dm_exception *e; + +@@ -833,17 +838,7 @@ static int dm_add_exception(void *context, chunk_t old, chunk_t new) + /* Consecutive_count is implicitly initialised to zero */ + e->new_chunk = new; + +- /* +- * Although there is no need to lock access to the exception tables +- * here, if we don't then hlist_bl_add_head(), called by +- * dm_insert_exception(), will complain about accessing the +- * corresponding list without locking it first. +- */ +- dm_exception_table_lock_init(s, old, &lock); +- +- dm_exception_table_lock(&lock); + dm_insert_exception(&s->complete, e); +- dm_exception_table_unlock(&lock); + + return 0; + } +@@ -873,7 +868,7 @@ static int calc_max_buckets(void) + /* use a fixed size of 2MB */ + unsigned long mem = 2 * 1024 * 1024; + +- mem /= sizeof(struct hlist_bl_head); ++ mem /= sizeof(struct dm_hlist_head); + + return mem; + } +-- +2.51.0 + diff --git a/queue-6.18/dm-verity-disable-recursive-forward-error-correction.patch b/queue-6.18/dm-verity-disable-recursive-forward-error-correction.patch new file mode 100644 index 0000000000..39c81aabdb --- /dev/null +++ b/queue-6.18/dm-verity-disable-recursive-forward-error-correction.patch @@ -0,0 +1,80 @@ +From 9f95c7e4edca22832bade26d3d6c0cb244e137f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Nov 2025 16:54:01 +0100 +Subject: dm-verity: disable recursive forward error correction + +From: Mikulas Patocka + +[ Upstream commit d9f3e47d3fae0c101d9094bc956ed24e7a0ee801 ] + +There are two problems with the recursive correction: + +1. It may cause denial-of-service. In fec_read_bufs, there is a loop that +has 253 iterations. For each iteration, we may call verity_hash_for_block +recursively. There is a limit of 4 nested recursions - that means that +there may be at most 253^4 (4 billion) iterations. Red Hat QE team +actually created an image that pushes dm-verity to this limit - and this +image just makes the udev-worker process get stuck in the 'D' state. + +2. It doesn't work. In fec_read_bufs we store data into the variable +"fio->bufs", but fio bufs is shared between recursive invocations, if +"verity_hash_for_block" invoked correction recursively, it would +overwrite partially filled fio->bufs. + +Signed-off-by: Mikulas Patocka +Reported-by: Guangwu Zhang +Reviewed-by: Sami Tolvanen +Reviewed-by: Eric Biggers +Signed-off-by: Sasha Levin +--- + drivers/md/dm-verity-fec.c | 4 +--- + drivers/md/dm-verity-fec.h | 3 --- + drivers/md/dm-verity-target.c | 2 +- + 3 files changed, 2 insertions(+), 7 deletions(-) + +diff --git a/drivers/md/dm-verity-fec.c b/drivers/md/dm-verity-fec.c +index 72047b47a7a0a..e41bde1d3b15b 100644 +--- a/drivers/md/dm-verity-fec.c ++++ b/drivers/md/dm-verity-fec.c +@@ -413,10 +413,8 @@ int verity_fec_decode(struct dm_verity *v, struct dm_verity_io *io, + if (!verity_fec_is_enabled(v)) + return -EOPNOTSUPP; + +- if (fio->level >= DM_VERITY_FEC_MAX_RECURSION) { +- DMWARN_LIMIT("%s: FEC: recursion too deep", v->data_dev->name); ++ if (fio->level) + return -EIO; +- } + + fio->level++; + +diff --git a/drivers/md/dm-verity-fec.h b/drivers/md/dm-verity-fec.h +index 09123a6129538..ec37e607cb3f0 100644 +--- a/drivers/md/dm-verity-fec.h ++++ b/drivers/md/dm-verity-fec.h +@@ -23,9 +23,6 @@ + #define DM_VERITY_FEC_BUF_MAX \ + (1 << (PAGE_SHIFT - DM_VERITY_FEC_BUF_RS_BITS)) + +-/* maximum recursion level for verity_fec_decode */ +-#define DM_VERITY_FEC_MAX_RECURSION 4 +- + #define DM_VERITY_OPT_FEC_DEV "use_fec_from_device" + #define DM_VERITY_OPT_FEC_BLOCKS "fec_blocks" + #define DM_VERITY_OPT_FEC_START "fec_start" +diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c +index 66a00a8ccb398..c8695c079cfe0 100644 +--- a/drivers/md/dm-verity-target.c ++++ b/drivers/md/dm-verity-target.c +@@ -1690,7 +1690,7 @@ static struct target_type verity_target = { + .name = "verity", + /* Note: the LSMs depend on the singleton and immutable features */ + .features = DM_TARGET_SINGLETON | DM_TARGET_IMMUTABLE, +- .version = {1, 12, 0}, ++ .version = {1, 13, 0}, + .module = THIS_MODULE, + .ctr = verity_ctr, + .dtr = verity_dtr, +-- +2.51.0 + diff --git a/queue-6.18/drm-amd-display-shrink-struct-members.patch b/queue-6.18/drm-amd-display-shrink-struct-members.patch new file mode 100644 index 0000000000..9e15e604f0 --- /dev/null +++ b/queue-6.18/drm-amd-display-shrink-struct-members.patch @@ -0,0 +1,92 @@ +From 51a5d60ceca6c650913273721c0c112062e166c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 Nov 2025 09:40:47 -0800 +Subject: drm/amd/display: shrink struct members + +From: Rosen Penev + +[ Upstream commit 7329417fc9ac128729c3a092b006c8f1fd0d04a6 ] + +On a 32-bit ARM system, the audio_decoder struct ends up being too large +for dp_retrain_link_dp_test. + +link_dp_cts.c:157:1: error: the frame size of 1328 bytes is larger than +1280 bytes [-Werror=frame-larger-than=] + +This is mitigated by shrinking the members of the struct and avoids +having to deal with dynamic allocation. + +feed_back_divider is assigned but otherwise unused. Remove both. + +pixel_repetition looks like it should be a bool since it's only ever +assigned to 1. But there are checks for 2 and 4. Reduce to uint8_t. + +Remove ss_percentage_divider. Unused. + +Shrink refresh_rate as it gets assigned to at most a 3 digit integer +value. + +Signed-off-by: Rosen Penev +Reviewed-by: Alex Hung +Signed-off-by: Alex Deucher +(cherry picked from commit 3849efdc7888d537f09c3dcfaea4b3cd377a102e) +Signed-off-by: Sasha Levin +--- + .../drm/amd/display/dc/hwss/dce110/dce110_hwseq.c | 3 --- + drivers/gpu/drm/amd/display/include/audio_types.h | 12 +++++------- + 2 files changed, 5 insertions(+), 10 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c +index ebc220b29d142..b94fec8347400 100644 +--- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c +@@ -1458,9 +1458,6 @@ void build_audio_output( + state->clk_mgr); + } + +- audio_output->pll_info.feed_back_divider = +- pipe_ctx->pll_settings.feedback_divider; +- + audio_output->pll_info.dto_source = + translate_to_dto_source( + pipe_ctx->stream_res.tg->inst + 1); +diff --git a/drivers/gpu/drm/amd/display/include/audio_types.h b/drivers/gpu/drm/amd/display/include/audio_types.h +index e4a26143f14c9..6699ad4fa825e 100644 +--- a/drivers/gpu/drm/amd/display/include/audio_types.h ++++ b/drivers/gpu/drm/amd/display/include/audio_types.h +@@ -47,15 +47,15 @@ struct audio_crtc_info { + uint32_t h_total; + uint32_t h_active; + uint32_t v_active; +- uint32_t pixel_repetition; + uint32_t requested_pixel_clock_100Hz; /* in 100Hz */ + uint32_t calculated_pixel_clock_100Hz; /* in 100Hz */ +- uint32_t refresh_rate; ++ uint32_t dsc_bits_per_pixel; ++ uint32_t dsc_num_slices; + enum dc_color_depth color_depth; + enum dc_pixel_encoding pixel_encoding; ++ uint16_t refresh_rate; ++ uint8_t pixel_repetition; + bool interlaced; +- uint32_t dsc_bits_per_pixel; +- uint32_t dsc_num_slices; + }; + struct azalia_clock_info { + uint32_t pixel_clock_in_10khz; +@@ -78,11 +78,9 @@ enum audio_dto_source { + + struct audio_pll_info { + uint32_t audio_dto_source_clock_in_khz; +- uint32_t feed_back_divider; ++ uint32_t ss_percentage; + enum audio_dto_source dto_source; + bool ss_enabled; +- uint32_t ss_percentage; +- uint32_t ss_percentage_divider; + }; + + struct audio_channel_associate_info { +-- +2.51.0 + diff --git a/queue-6.18/nfs-fix-up-the-automount-fs_context-to-use-the-corre.patch b/queue-6.18/nfs-fix-up-the-automount-fs_context-to-use-the-corre.patch new file mode 100644 index 0000000000..e513631691 --- /dev/null +++ b/queue-6.18/nfs-fix-up-the-automount-fs_context-to-use-the-corre.patch @@ -0,0 +1,39 @@ +From 7e651130e6a4487377d7da1be9b4ccd046f81e42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Nov 2025 18:56:46 -0500 +Subject: NFS: Fix up the automount fs_context to use the correct cred + +From: Trond Myklebust + +[ Upstream commit a2a8fc27dd668e7562b5326b5ed2f1604cb1e2e9 ] + +When automounting, the fs_context should be fixed up to use the cred +from the parent filesystem, since the operation is just extending the +namespace. Authorisation to enter that namespace will already have been +provided by the preceding lookup. + +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/namespace.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/fs/nfs/namespace.c b/fs/nfs/namespace.c +index 9e4d94f41fc67..af9be0c5f5163 100644 +--- a/fs/nfs/namespace.c ++++ b/fs/nfs/namespace.c +@@ -170,6 +170,11 @@ struct vfsmount *nfs_d_automount(struct path *path) + if (!ctx->clone_data.fattr) + goto out_fc; + ++ if (fc->cred != server->cred) { ++ put_cred(fc->cred); ++ fc->cred = get_cred(server->cred); ++ } ++ + if (fc->net_ns != client->cl_net) { + put_net(fc->net_ns); + fc->net_ns = get_net(client->cl_net); +-- +2.51.0 + diff --git a/queue-6.18/nfsv4-ensure-the-open-stateid-seqid-doesn-t-go-backw.patch b/queue-6.18/nfsv4-ensure-the-open-stateid-seqid-doesn-t-go-backw.patch new file mode 100644 index 0000000000..43e948a249 --- /dev/null +++ b/queue-6.18/nfsv4-ensure-the-open-stateid-seqid-doesn-t-go-backw.patch @@ -0,0 +1,74 @@ +From 8350e20cfb445bb7518e68d9a10d8d808f12713a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Nov 2025 10:44:15 -0500 +Subject: NFSv4: ensure the open stateid seqid doesn't go backwards + +From: Scott Mayhew + +[ Upstream commit 2e47c3cc64b44b0b06cd68c2801db92ff143f2b2 ] + +We have observed an NFSv4 client receiving a LOCK reply with a status of +NFS4ERR_OLD_STATEID and subsequently retrying the LOCK request with an +earlier seqid value in the stateid. As this was for a new lockowner, +that would imply that nfs_set_open_stateid_locked() had updated the open +stateid seqid with an earlier value. + +Looking at nfs_set_open_stateid_locked(), if the incoming seqid is out +of sequence, the task will sleep on the state->waitq for up to 5 +seconds. If the task waits for the full 5 seconds, then after finishing +the wait it'll update the open stateid seqid with whatever value the +incoming seqid has. If there are multiple waiters in this scenario, +then the last one to perform said update may not be the one with the +highest seqid. + +Add a check to ensure that the seqid can only be incremented, and add a +tracepoint to indicate when old seqids are skipped. + +Signed-off-by: Scott Mayhew +Reviewed-by: Benjamin Coddington +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4proc.c | 13 +++++++++++-- + fs/nfs/nfs4trace.h | 1 + + 2 files changed, 12 insertions(+), 2 deletions(-) + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 6f4e14fb7b9b8..3b436ba2ed3bf 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -1780,8 +1780,17 @@ static void nfs_set_open_stateid_locked(struct nfs4_state *state, + if (nfs_stateid_is_sequential(state, stateid)) + break; + +- if (status) +- break; ++ if (status) { ++ if (nfs4_stateid_match_other(stateid, &state->open_stateid) && ++ !nfs4_stateid_is_newer(stateid, &state->open_stateid)) { ++ trace_nfs4_open_stateid_update_skip(state->inode, ++ stateid, status); ++ return; ++ } else { ++ break; ++ } ++ } ++ + /* Rely on seqids for serialisation with NFSv4.0 */ + if (!nfs4_has_session(NFS_SERVER(state->inode)->nfs_client)) + break; +diff --git a/fs/nfs/nfs4trace.h b/fs/nfs/nfs4trace.h +index 9776d220cec33..6285128e631a5 100644 +--- a/fs/nfs/nfs4trace.h ++++ b/fs/nfs/nfs4trace.h +@@ -1353,6 +1353,7 @@ DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_setattr); + DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_delegreturn); + DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_open_stateid_update); + DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_open_stateid_update_wait); ++DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_open_stateid_update_skip); + DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_close_stateid_update_wait); + + DECLARE_EVENT_CLASS(nfs4_getattr_event, +-- +2.51.0 + diff --git a/queue-6.18/of-unittest-fix-memory-leak-in-unittest_data_add.patch b/queue-6.18/of-unittest-fix-memory-leak-in-unittest_data_add.patch new file mode 100644 index 0000000000..bd9a5908ed --- /dev/null +++ b/queue-6.18/of-unittest-fix-memory-leak-in-unittest_data_add.patch @@ -0,0 +1,85 @@ +From 6b14f7e0eb65adff7742f55a19d62c9042ae39d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Dec 2025 11:49:15 +0000 +Subject: of: unittest: Fix memory leak in unittest_data_add() + +From: Zilin Guan + +[ Upstream commit 235a1eb8d2dcc49a6cf0a5ee1aa85544a5d0054b ] + +In unittest_data_add(), if of_resolve_phandles() fails, the allocated +unittest_data is not freed, leading to a memory leak. + +Fix this by using scope-based cleanup helper __free(kfree) for automatic +resource cleanup. This ensures unittest_data is automatically freed when +it goes out of scope in error paths. + +For the success path, use retain_and_null_ptr() to transfer ownership +of the memory to the device tree and prevent double freeing. + +Fixes: 2eb46da2a760 ("of/selftest: Use the resolver to fixup phandles") +Suggested-by: Rob Herring +Co-developed-by: Jianhao Xu +Signed-off-by: Jianhao Xu +Signed-off-by: Zilin Guan +Link: https://patch.msgid.link/20251231114915.234638-1-zilin@seu.edu.cn +Signed-off-by: Rob Herring (Arm) +Signed-off-by: Sasha Levin +--- + drivers/of/unittest.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c +index 388e9ec2cccf8..3b773aaf9d050 100644 +--- a/drivers/of/unittest.c ++++ b/drivers/of/unittest.c +@@ -1985,7 +1985,6 @@ static void attach_node_and_children(struct device_node *np) + */ + static int __init unittest_data_add(void) + { +- void *unittest_data; + void *unittest_data_align; + struct device_node *unittest_data_node = NULL, *np; + /* +@@ -2004,7 +2003,7 @@ static int __init unittest_data_add(void) + } + + /* creating copy */ +- unittest_data = kmalloc(size + FDT_ALIGN_SIZE, GFP_KERNEL); ++ void *unittest_data __free(kfree) = kmalloc(size + FDT_ALIGN_SIZE, GFP_KERNEL); + if (!unittest_data) + return -ENOMEM; + +@@ -2014,12 +2013,10 @@ static int __init unittest_data_add(void) + ret = of_fdt_unflatten_tree(unittest_data_align, NULL, &unittest_data_node); + if (!ret) { + pr_warn("%s: unflatten testcases tree failed\n", __func__); +- kfree(unittest_data); + return -ENODATA; + } + if (!unittest_data_node) { + pr_warn("%s: testcases tree is empty\n", __func__); +- kfree(unittest_data); + return -ENODATA; + } + +@@ -2038,7 +2035,6 @@ static int __init unittest_data_add(void) + /* attach the sub-tree to live tree */ + if (!of_root) { + pr_warn("%s: no live tree to attach sub-tree\n", __func__); +- kfree(unittest_data); + rc = -ENODEV; + goto unlock; + } +@@ -2059,6 +2055,8 @@ static int __init unittest_data_add(void) + EXPECT_END(KERN_INFO, + "Duplicate name in testcase-data, renamed to \"duplicate-name#1\""); + ++ retain_and_null_ptr(unittest_data); ++ + unlock: + of_overlay_mutex_unlock(); + +-- +2.51.0 + diff --git a/queue-6.18/scsi-ipr-enable-disable-irqd_no_balancing-during-res.patch b/queue-6.18/scsi-ipr-enable-disable-irqd_no_balancing-during-res.patch new file mode 100644 index 0000000000..313f8df55e --- /dev/null +++ b/queue-6.18/scsi-ipr-enable-disable-irqd_no_balancing-during-res.patch @@ -0,0 +1,190 @@ +From 0a132c3644f68ada4bcee88ccb65d894a3edcc68 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Oct 2025 09:24:26 -0500 +Subject: scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset + +From: Wen Xiong + +[ Upstream commit 6ac3484fb13b2fc7f31cfc7f56093e7d0ce646a5 ] + +A dynamic remove/add storage adapter test hits EEH on PowerPC: + + EEH: [c00000000004f75c] __eeh_send_failure_event+0x7c/0x160 + EEH: [c000000000048444] eeh_dev_check_failure.part.0+0x254/0x650 + EEH: [c008000001650678] eeh_readl+0x60/0x90 [ipr] + EEH: [c00800000166746c] ipr_cancel_op+0x2b8/0x524 [ipr] + EEH: [c008000001656524] ipr_eh_abort+0x6c/0x130 [ipr] + EEH: [c000000000ab0d20] scmd_eh_abort_handler+0x140/0x440 + EEH: [c00000000017e558] process_one_work+0x298/0x590 + EEH: [c00000000017eef8] worker_thread+0xa8/0x620 + EEH: [c00000000018be34] kthread+0x124/0x130 + EEH: [c00000000000cd64] ret_from_kernel_thread+0x5c/0x64 + +A PCIe bus trace reveals that a vector of MSI-X is cleared to 0 by +irqbalance daemon. If we disable irqbalance daemon, we won't see the +issue. + +With debug enabled in ipr driver: + + [ 44.103071] ipr: Entering __ipr_remove + [ 44.103083] ipr: Entering ipr_initiate_ioa_bringdown + [ 44.103091] ipr: Entering ipr_reset_shutdown_ioa + [ 44.103099] ipr: Leaving ipr_reset_shutdown_ioa + [ 44.103105] ipr: Leaving ipr_initiate_ioa_bringdown + [ 44.149918] ipr: Entering ipr_reset_ucode_download + [ 44.149935] ipr: Entering ipr_reset_alert + [ 44.150032] ipr: Entering ipr_reset_start_timer + [ 44.150038] ipr: Leaving ipr_reset_alert + [ 44.244343] scsi 1:2:3:0: alua: Detached + [ 44.254300] ipr: Entering ipr_reset_start_bist + [ 44.254320] ipr: Entering ipr_reset_start_timer + [ 44.254325] ipr: Leaving ipr_reset_start_bist + [ 44.364329] scsi 1:2:4:0: alua: Detached + [ 45.134341] scsi 1:2:5:0: alua: Detached + [ 45.860949] ipr: Entering ipr_reset_shutdown_ioa + [ 45.860962] ipr: Leaving ipr_reset_shutdown_ioa + [ 45.860966] ipr: Entering ipr_reset_alert + [ 45.861028] ipr: Entering ipr_reset_start_timer + [ 45.861035] ipr: Leaving ipr_reset_alert + [ 45.964302] ipr: Entering ipr_reset_start_bist + [ 45.964309] ipr: Entering ipr_reset_start_timer + [ 45.964313] ipr: Leaving ipr_reset_start_bist + [ 46.264301] ipr: Entering ipr_reset_bist_done + [ 46.264309] ipr: Leaving ipr_reset_bist_done + +During adapter reset, ipr device driver blocks config space access but +can't block MMIO access for MSI-X entries. There is very small window: +irqbalance daemon kicks in during adapter reset before ipr driver calls +pci_restore_state(pdev) to restore MSI-X table. + +irqbalance daemon reads back all 0 for that MSI-X vector in +__pci_read_msi_msg(). + +irqbalance daemon: + + msi_domain_set_affinity() + ->irq_chip_set_affinity_patent() + ->xive_irq_set_affinity() + ->irq_chip_compose_msi_msg() + ->pseries_msi_compose_msg() + ->__pci_read_msi_msg(): read all 0 since didn't call pci_restore_state + ->irq_chip_write_msi_msg() + -> pci_write_msg_msi(): write 0 to the msix vector entry + +When ipr driver calls pci_restore_state(pdev) in +ipr_reset_restore_cfg_space(), the MSI-X vector entry has been cleared +by irqbalance daemon in pci_write_msg_msix(). + + pci_restore_state() + ->__pci_restore_msix_state() + +Below is the MSI-X table for ipr adapter after irqbalance daemon kicked +in during adapter reset: + + Dump MSIx table: index=0 address_lo=c800 address_hi=10000000 msg_data=0 + Dump MSIx table: index=1 address_lo=c810 address_hi=10000000 msg_data=0 + Dump MSIx table: index=2 address_lo=c820 address_hi=10000000 msg_data=0 + Dump MSIx table: index=3 address_lo=c830 address_hi=10000000 msg_data=0 + Dump MSIx table: index=4 address_lo=c840 address_hi=10000000 msg_data=0 + Dump MSIx table: index=5 address_lo=c850 address_hi=10000000 msg_data=0 + Dump MSIx table: index=6 address_lo=c860 address_hi=10000000 msg_data=0 + Dump MSIx table: index=7 address_lo=c870 address_hi=10000000 msg_data=0 + Dump MSIx table: index=8 address_lo=0 address_hi=0 msg_data=0 + ---------> Hit EEH since msix vector of index=8 are 0 + Dump MSIx table: index=9 address_lo=c890 address_hi=10000000 msg_data=0 + Dump MSIx table: index=10 address_lo=c8a0 address_hi=10000000 msg_data=0 + Dump MSIx table: index=11 address_lo=c8b0 address_hi=10000000 msg_data=0 + Dump MSIx table: index=12 address_lo=c8c0 address_hi=10000000 msg_data=0 + Dump MSIx table: index=13 address_lo=c8d0 address_hi=10000000 msg_data=0 + Dump MSIx table: index=14 address_lo=c8e0 address_hi=10000000 msg_data=0 + Dump MSIx table: index=15 address_lo=c8f0 address_hi=10000000 msg_data=0 + + [ 46.264312] ipr: Entering ipr_reset_restore_cfg_space + [ 46.267439] ipr: Entering ipr_fail_all_ops + [ 46.267447] ipr: Leaving ipr_fail_all_ops + [ 46.267451] ipr: Leaving ipr_reset_restore_cfg_space + [ 46.267454] ipr: Entering ipr_ioa_bringdown_done + [ 46.267458] ipr: Leaving ipr_ioa_bringdown_done + [ 46.267467] ipr: Entering ipr_worker_thread + [ 46.267470] ipr: Leaving ipr_worker_thread + +IRQ balancing is not required during adapter reset. + +Enable "IRQ_NO_BALANCING" flag before starting adapter reset and disable +it after calling pci_restore_state(). The irqbalance daemon is disabled +for this short period of time (~2s). + +Co-developed-by: Kyle Mahlkuch +Signed-off-by: Kyle Mahlkuch +Signed-off-by: Wen Xiong +Link: https://patch.msgid.link/20251028142427.3969819-2-wenxiong@linux.ibm.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ipr.c | 28 +++++++++++++++++++++++++++- + 1 file changed, 27 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c +index 44214884deaf5..d62bb7d0e4164 100644 +--- a/drivers/scsi/ipr.c ++++ b/drivers/scsi/ipr.c +@@ -61,8 +61,8 @@ + #include + #include + #include ++#include + #include +-#include + #include + #include + #include +@@ -7843,6 +7843,30 @@ static int ipr_dump_mailbox_wait(struct ipr_cmnd *ipr_cmd) + return IPR_RC_JOB_RETURN; + } + ++/** ++ * ipr_set_affinity_nobalance ++ * @ioa_cfg: ipr_ioa_cfg struct for an ipr device ++ * @flag: bool ++ * true: ensable "IRQ_NO_BALANCING" bit for msix interrupt ++ * false: disable "IRQ_NO_BALANCING" bit for msix interrupt ++ * Description: This function will be called to disable/enable ++ * "IRQ_NO_BALANCING" to avoid irqbalance daemon ++ * kicking in during adapter reset. ++ **/ ++static void ipr_set_affinity_nobalance(struct ipr_ioa_cfg *ioa_cfg, bool flag) ++{ ++ int irq, i; ++ ++ for (i = 0; i < ioa_cfg->nvectors; i++) { ++ irq = pci_irq_vector(ioa_cfg->pdev, i); ++ ++ if (flag) ++ irq_set_status_flags(irq, IRQ_NO_BALANCING); ++ else ++ irq_clear_status_flags(irq, IRQ_NO_BALANCING); ++ } ++} ++ + /** + * ipr_reset_restore_cfg_space - Restore PCI config space. + * @ipr_cmd: ipr command struct +@@ -7867,6 +7891,7 @@ static int ipr_reset_restore_cfg_space(struct ipr_cmnd *ipr_cmd) + return IPR_RC_JOB_CONTINUE; + } + ++ ipr_set_affinity_nobalance(ioa_cfg, false); + ipr_fail_all_ops(ioa_cfg); + + if (ioa_cfg->sis64) { +@@ -7946,6 +7971,7 @@ static int ipr_reset_start_bist(struct ipr_cmnd *ipr_cmd) + rc = pci_write_config_byte(ioa_cfg->pdev, PCI_BIST, PCI_BIST_START); + + if (rc == PCIBIOS_SUCCESSFUL) { ++ ipr_set_affinity_nobalance(ioa_cfg, true); + ipr_cmd->job_step = ipr_reset_bist_done; + ipr_reset_start_timer(ipr_cmd, IPR_WAIT_FOR_BIST_TIMEOUT); + rc = IPR_RC_JOB_RETURN; +-- +2.51.0 + diff --git a/queue-6.18/scsi-mpi3mr-prevent-duplicate-sas-sata-device-entrie.patch b/queue-6.18/scsi-mpi3mr-prevent-duplicate-sas-sata-device-entrie.patch new file mode 100644 index 0000000000..b54176b13c --- /dev/null +++ b/queue-6.18/scsi-mpi3mr-prevent-duplicate-sas-sata-device-entrie.patch @@ -0,0 +1,63 @@ +From 40ece0093ecc6eb7a2492ab582259aa22531e2a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Nov 2025 12:49:55 +0530 +Subject: scsi: mpi3mr: Prevent duplicate SAS/SATA device entries in channel 1 + +From: Suganath Prabu S + +[ Upstream commit 4588e65cfd66fc8bbd9969ea730db39b60a36a30 ] + +Avoid scanning SAS/SATA devices in channel 1 when SAS transport is +enabled, as the SAS/SATA devices are exposed through channel 0. + +Signed-off-by: Suganath Prabu S +Signed-off-by: Ranjan Kumar +Link: https://lore.kernel.org/stable/20251120071955.463475-1-suganath-prabu.subramani%40broadcom.com +Link: https://patch.msgid.link/20251120071955.463475-1-suganath-prabu.subramani@broadcom.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpi3mr/mpi3mr.h | 4 ++-- + drivers/scsi/mpi3mr/mpi3mr_os.c | 4 +++- + 2 files changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/scsi/mpi3mr/mpi3mr.h b/drivers/scsi/mpi3mr/mpi3mr.h +index 6742684e2990a..31d68c151b207 100644 +--- a/drivers/scsi/mpi3mr/mpi3mr.h ++++ b/drivers/scsi/mpi3mr/mpi3mr.h +@@ -56,8 +56,8 @@ extern struct list_head mrioc_list; + extern int prot_mask; + extern atomic64_t event_counter; + +-#define MPI3MR_DRIVER_VERSION "8.15.0.5.50" +-#define MPI3MR_DRIVER_RELDATE "12-August-2025" ++#define MPI3MR_DRIVER_VERSION "8.15.0.5.51" ++#define MPI3MR_DRIVER_RELDATE "18-November-2025" + + #define MPI3MR_DRIVER_NAME "mpi3mr" + #define MPI3MR_DRIVER_LICENSE "GPL" +diff --git a/drivers/scsi/mpi3mr/mpi3mr_os.c b/drivers/scsi/mpi3mr/mpi3mr_os.c +index b88633e1efe27..d4ca878d08869 100644 +--- a/drivers/scsi/mpi3mr/mpi3mr_os.c ++++ b/drivers/scsi/mpi3mr/mpi3mr_os.c +@@ -1184,6 +1184,8 @@ static void mpi3mr_update_tgtdev(struct mpi3mr_ioc *mrioc, + if (is_added == true) + tgtdev->io_throttle_enabled = + (flags & MPI3_DEVICE0_FLAGS_IO_THROTTLING_REQUIRED) ? 1 : 0; ++ if (!mrioc->sas_transport_enabled) ++ tgtdev->non_stl = 1; + + switch (flags & MPI3_DEVICE0_FLAGS_MAX_WRITE_SAME_MASK) { + case MPI3_DEVICE0_FLAGS_MAX_WRITE_SAME_256_LB: +@@ -4844,7 +4846,7 @@ static int mpi3mr_target_alloc(struct scsi_target *starget) + spin_lock_irqsave(&mrioc->tgtdev_lock, flags); + if (starget->channel == mrioc->scsi_device_channel) { + tgt_dev = __mpi3mr_get_tgtdev_by_perst_id(mrioc, starget->id); +- if (tgt_dev && !tgt_dev->is_hidden) { ++ if (tgt_dev && !tgt_dev->is_hidden && tgt_dev->non_stl) { + scsi_tgt_priv_data->starget = starget; + scsi_tgt_priv_data->dev_handle = tgt_dev->dev_handle; + scsi_tgt_priv_data->perst_id = tgt_dev->perst_id; +-- +2.51.0 + diff --git a/queue-6.18/scsi-revert-scsi-libsas-fix-exp-attached-device-scan.patch b/queue-6.18/scsi-revert-scsi-libsas-fix-exp-attached-device-scan.patch new file mode 100644 index 0000000000..ddf7c6f75a --- /dev/null +++ b/queue-6.18/scsi-revert-scsi-libsas-fix-exp-attached-device-scan.patch @@ -0,0 +1,59 @@ +From 38f8727940c82f0281075510afb5cbec60e3f27b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 14:56:27 +0800 +Subject: scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe + failure scanned in again after probe failed" + +From: Xingui Yang + +[ Upstream commit 278712d20bc8ec29d1ad6ef9bdae9000ef2c220c ] + +This reverts commit ab2068a6fb84751836a84c26ca72b3beb349619d. + +When probing the exp-attached sata device, libsas/libata will issue a +hard reset in sas_probe_sata() -> ata_sas_async_probe(), then a +broadcast event will be received after the disk probe fails, and this +commit causes the probe will be re-executed on the disk, and a faulty +disk may get into an indefinite loop of probe. + +Therefore, revert this commit, although it can fix some temporary issues +with disk probe failure. + +Signed-off-by: Xingui Yang +Reviewed-by: Jason Yan +Reviewed-by: John Garry +Link: https://patch.msgid.link/20251202065627.140361-1-yangxingui@huawei.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/libsas/sas_internal.h | 14 -------------- + 1 file changed, 14 deletions(-) + +diff --git a/drivers/scsi/libsas/sas_internal.h b/drivers/scsi/libsas/sas_internal.h +index 6706f2be8d274..da5408c701cdd 100644 +--- a/drivers/scsi/libsas/sas_internal.h ++++ b/drivers/scsi/libsas/sas_internal.h +@@ -145,20 +145,6 @@ static inline void sas_fail_probe(struct domain_device *dev, const char *func, i + func, dev->parent ? "exp-attached" : + "direct-attached", + SAS_ADDR(dev->sas_addr), err); +- +- /* +- * If the device probe failed, the expander phy attached address +- * needs to be reset so that the phy will not be treated as flutter +- * in the next revalidation +- */ +- if (dev->parent && !dev_is_expander(dev->dev_type)) { +- struct sas_phy *phy = dev->phy; +- struct domain_device *parent = dev->parent; +- struct ex_phy *ex_phy = &parent->ex_dev.ex_phy[phy->number]; +- +- memset(ex_phy->attached_sas_addr, 0, SAS_ADDR_SIZE); +- } +- + sas_unregister_dev(dev->port, dev); + } + +-- +2.51.0 + diff --git a/queue-6.18/scsi-ufs-core-fix-eh-failure-after-w-lun-resume-erro.patch b/queue-6.18/scsi-ufs-core-fix-eh-failure-after-w-lun-resume-erro.patch new file mode 100644 index 0000000000..6d5d10e484 --- /dev/null +++ b/queue-6.18/scsi-ufs-core-fix-eh-failure-after-w-lun-resume-erro.patch @@ -0,0 +1,126 @@ +From 251e53ab0a379e0b5e03c4e571bd43300f36a289 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Nov 2025 06:32:02 +0000 +Subject: scsi: ufs: core: Fix EH failure after W-LUN resume error + +From: Brian Kao + +[ Upstream commit b4bb6daf4ac4d4560044ecdd81e93aa2f6acbb06 ] + +When a W-LUN resume fails, its parent devices in the SCSI hierarchy, +including the scsi_target, may be runtime suspended. Subsequently, the +error handler in ufshcd_recover_pm_error() fails to set the W-LUN device +back to active because the parent target is not active. This results in +the following errors: + + google-ufshcd 3c2d0000.ufs: ufshcd_err_handler started; HBA state eh_fatal; ... + ufs_device_wlun 0:0:0:49488: START_STOP failed for power mode: 1, result 40000 + ufs_device_wlun 0:0:0:49488: ufshcd_wl_runtime_resume failed: -5 + ... + ufs_device_wlun 0:0:0:49488: runtime PM trying to activate child device 0:0:0:49488 but parent (target0:0:0) is not active + +Address this by: + + 1. Ensuring the W-LUN's parent scsi_target is runtime resumed before + attempting to set the W-LUN to active within + ufshcd_recover_pm_error(). + + 2. Explicitly checking for power.runtime_error on the HBA and W-LUN + devices before calling pm_runtime_set_active() to clear the error + state. + + 3. Adding pm_runtime_get_sync(hba->dev) in + ufshcd_err_handling_prepare() to ensure the HBA itself is active + during error recovery, even if a child device resume failed. + +These changes ensure the device power states are managed correctly +during error recovery. + +Signed-off-by: Brian Kao +Tested-by: Brian Kao +Reviewed-by: Bart Van Assche +Link: https://patch.msgid.link/20251112063214.1195761-1-powenkao@google.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/ufs/core/ufshcd.c | 36 ++++++++++++++++++++++++++++-------- + 1 file changed, 28 insertions(+), 8 deletions(-) + +diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c +index ba1bb3953cf69..022810b524e96 100644 +--- a/drivers/ufs/core/ufshcd.c ++++ b/drivers/ufs/core/ufshcd.c +@@ -6498,6 +6498,11 @@ static void ufshcd_clk_scaling_suspend(struct ufs_hba *hba, bool suspend) + + static void ufshcd_err_handling_prepare(struct ufs_hba *hba) + { ++ /* ++ * A WLUN resume failure could potentially lead to the HBA being ++ * runtime suspended, so take an extra reference on hba->dev. ++ */ ++ pm_runtime_get_sync(hba->dev); + ufshcd_rpm_get_sync(hba); + if (pm_runtime_status_suspended(&hba->ufs_device_wlun->sdev_gendev) || + hba->is_sys_suspended) { +@@ -6537,6 +6542,7 @@ static void ufshcd_err_handling_unprepare(struct ufs_hba *hba) + if (ufshcd_is_clkscaling_supported(hba)) + ufshcd_clk_scaling_suspend(hba, false); + ufshcd_rpm_put(hba); ++ pm_runtime_put(hba->dev); + } + + static inline bool ufshcd_err_handling_should_stop(struct ufs_hba *hba) +@@ -6551,28 +6557,42 @@ static inline bool ufshcd_err_handling_should_stop(struct ufs_hba *hba) + #ifdef CONFIG_PM + static void ufshcd_recover_pm_error(struct ufs_hba *hba) + { ++ struct scsi_target *starget = hba->ufs_device_wlun->sdev_target; + struct Scsi_Host *shost = hba->host; + struct scsi_device *sdev; + struct request_queue *q; +- int ret; ++ bool resume_sdev_queues = false; + + hba->is_sys_suspended = false; ++ + /* +- * Set RPM status of wlun device to RPM_ACTIVE, +- * this also clears its runtime error. ++ * Ensure the parent's error status is cleared before proceeding ++ * to the child, as the parent must be active to activate the child. + */ +- ret = pm_runtime_set_active(&hba->ufs_device_wlun->sdev_gendev); ++ if (hba->dev->power.runtime_error) { ++ /* hba->dev has no functional parent thus simplily set RPM_ACTIVE */ ++ pm_runtime_set_active(hba->dev); ++ resume_sdev_queues = true; ++ } ++ ++ if (hba->ufs_device_wlun->sdev_gendev.power.runtime_error) { ++ /* ++ * starget, parent of wlun, might be suspended if wlun resume failed. ++ * Make sure parent is resumed before set child (wlun) active. ++ */ ++ pm_runtime_get_sync(&starget->dev); ++ pm_runtime_set_active(&hba->ufs_device_wlun->sdev_gendev); ++ pm_runtime_put_sync(&starget->dev); ++ resume_sdev_queues = true; ++ } + +- /* hba device might have a runtime error otherwise */ +- if (ret) +- ret = pm_runtime_set_active(hba->dev); + /* + * If wlun device had runtime error, we also need to resume those + * consumer scsi devices in case any of them has failed to be + * resumed due to supplier runtime resume failure. This is to unblock + * blk_queue_enter in case there are bios waiting inside it. + */ +- if (!ret) { ++ if (resume_sdev_queues) { + shost_for_each_device(sdev, shost) { + q = sdev->request_queue; + if (q->dev && (q->rpm_status == RPM_SUSPENDED || +-- +2.51.0 + diff --git a/queue-6.18/series b/queue-6.18/series index 2552beb2be..72e169018b 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -44,3 +44,26 @@ libceph-reset-sparse-read-state-in-osd_fault.patch libceph-make-calc_target-set-t-paused-not-just-clear-it.patch ublk-reorder-tag_set-initialization-before-queue-allocation.patch alsa-hda-intel-dsp-config-prefer-legacy-driver-as-fallback.patch +csky-fix-csky_cmpxchg_fixup-not-working.patch +arm-9461-1-disable-highpte-on-preempt_rt-kernels.patch +alpha-don-t-reference-obsolete-termio-struct-for-tc-.patch +dm-verity-disable-recursive-forward-error-correction.patch +dm-snapshot-fix-scheduling-while-atomic-on-real-time.patch +nfsv4-ensure-the-open-stateid-seqid-doesn-t-go-backw.patch +asoc-rockchip-fix-wvoid-pointer-to-enum-cast-warning.patch +nfs-fix-up-the-automount-fs_context-to-use-the-corre.patch +alsa-hda-realtek-add-support-for-asus-um3406ga.patch +drm-amd-display-shrink-struct-members.patch +bcache-fix-improper-use-of-bi_end_io.patch +smb-client-fix-nt_status_unable_to_free_vm-value.patch +smb-client-fix-nt_status_device_door_open-value.patch +smb-client-fix-nt_status_no_data_detected-value.patch +scsi-mpi3mr-prevent-duplicate-sas-sata-device-entrie.patch +scsi-ipr-enable-disable-irqd_no_balancing-during-res.patch +scsi-ufs-core-fix-eh-failure-after-w-lun-resume-erro.patch +scsi-revert-scsi-libsas-fix-exp-attached-device-scan.patch +btrfs-fix-qgroup_snapshot_quick_inherit-squota-bug.patch +btrfs-qgroup-update-all-parent-qgroups-when-doing-qu.patch +btrfs-fix-null-dereference-on-root-when-tracing-inod.patch +btrfs-fix-use-after-free-warning-in-btrfs_get_or_cre.patch +of-unittest-fix-memory-leak-in-unittest_data_add.patch diff --git a/queue-6.18/smb-client-fix-nt_status_device_door_open-value.patch b/queue-6.18/smb-client-fix-nt_status_device_door_open-value.patch new file mode 100644 index 0000000000..81d57957cd --- /dev/null +++ b/queue-6.18/smb-client-fix-nt_status_device_door_open-value.patch @@ -0,0 +1,38 @@ +From 3730060c69a225196e8f11cfbf1bbf5199995f56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Dec 2025 09:17:57 +0800 +Subject: smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value + +From: ChenXiaoSong + +[ Upstream commit b2b50fca34da5ec231008edba798ddf92986bd7f ] + +This was reported by the KUnit tests in the later patches. + +See MS-ERREF 2.3.1 STATUS_DEVICE_DOOR_OPEN. Keep it consistent with the +value in the documentation. + +Signed-off-by: ChenXiaoSong +Acked-by: Paulo Alcantara (Red Hat) +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/nterr.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/smb/client/nterr.h b/fs/smb/client/nterr.h +index e3a607b45e719..b3516c71cff77 100644 +--- a/fs/smb/client/nterr.h ++++ b/fs/smb/client/nterr.h +@@ -44,7 +44,7 @@ extern const struct nt_err_code_struct nt_errs[]; + #define NT_STATUS_NO_DATA_DETECTED 0x8000001c + #define NT_STATUS_STOPPED_ON_SYMLINK 0x8000002d + #define NT_STATUS_DEVICE_REQUIRES_CLEANING 0x80000288 +-#define NT_STATUS_DEVICE_DOOR_OPEN 0x80000288 ++#define NT_STATUS_DEVICE_DOOR_OPEN 0x80000289 + #define NT_STATUS_UNSUCCESSFUL 0xC0000000 | 0x0001 + #define NT_STATUS_NOT_IMPLEMENTED 0xC0000000 | 0x0002 + #define NT_STATUS_INVALID_INFO_CLASS 0xC0000000 | 0x0003 +-- +2.51.0 + diff --git a/queue-6.18/smb-client-fix-nt_status_no_data_detected-value.patch b/queue-6.18/smb-client-fix-nt_status_no_data_detected-value.patch new file mode 100644 index 0000000000..d342a0a551 --- /dev/null +++ b/queue-6.18/smb-client-fix-nt_status_no_data_detected-value.patch @@ -0,0 +1,38 @@ +From 4a0b834e85042be254020d41164e55f0a091326a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Dec 2025 09:13:06 +0800 +Subject: smb/client: fix NT_STATUS_NO_DATA_DETECTED value + +From: ChenXiaoSong + +[ Upstream commit a1237c203f1757480dc2f3b930608ee00072d3cc ] + +This was reported by the KUnit tests in the later patches. + +See MS-ERREF 2.3.1 STATUS_NO_DATA_DETECTED. Keep it consistent with the +value in the documentation. + +Signed-off-by: ChenXiaoSong +Acked-by: Paulo Alcantara (Red Hat) +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/nterr.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/smb/client/nterr.h b/fs/smb/client/nterr.h +index b3516c71cff77..09263c91d07a4 100644 +--- a/fs/smb/client/nterr.h ++++ b/fs/smb/client/nterr.h +@@ -41,7 +41,7 @@ extern const struct nt_err_code_struct nt_errs[]; + #define NT_STATUS_MEDIA_CHANGED 0x8000001c + #define NT_STATUS_END_OF_MEDIA 0x8000001e + #define NT_STATUS_MEDIA_CHECK 0x80000020 +-#define NT_STATUS_NO_DATA_DETECTED 0x8000001c ++#define NT_STATUS_NO_DATA_DETECTED 0x80000022 + #define NT_STATUS_STOPPED_ON_SYMLINK 0x8000002d + #define NT_STATUS_DEVICE_REQUIRES_CLEANING 0x80000288 + #define NT_STATUS_DEVICE_DOOR_OPEN 0x80000289 +-- +2.51.0 + diff --git a/queue-6.18/smb-client-fix-nt_status_unable_to_free_vm-value.patch b/queue-6.18/smb-client-fix-nt_status_unable_to_free_vm-value.patch new file mode 100644 index 0000000000..dddbd2037a --- /dev/null +++ b/queue-6.18/smb-client-fix-nt_status_unable_to_free_vm-value.patch @@ -0,0 +1,38 @@ +From 0903818e37affc577d88348ef68d063353660b3b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Dec 2025 09:22:53 +0800 +Subject: smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value + +From: ChenXiaoSong + +[ Upstream commit 9f99caa8950a76f560a90074e3a4b93cfa8b3d84 ] + +This was reported by the KUnit tests in the later patches. + +See MS-ERREF 2.3.1 STATUS_UNABLE_TO_FREE_VM. Keep it consistent with the +value in the documentation. + +Signed-off-by: ChenXiaoSong +Acked-by: Paulo Alcantara (Red Hat) +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/nterr.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/smb/client/nterr.h b/fs/smb/client/nterr.h +index 180602c22355e..e3a607b45e719 100644 +--- a/fs/smb/client/nterr.h ++++ b/fs/smb/client/nterr.h +@@ -70,7 +70,7 @@ extern const struct nt_err_code_struct nt_errs[]; + #define NT_STATUS_NO_MEMORY 0xC0000000 | 0x0017 + #define NT_STATUS_CONFLICTING_ADDRESSES 0xC0000000 | 0x0018 + #define NT_STATUS_NOT_MAPPED_VIEW 0xC0000000 | 0x0019 +-#define NT_STATUS_UNABLE_TO_FREE_VM 0x80000000 | 0x001a ++#define NT_STATUS_UNABLE_TO_FREE_VM 0xC0000000 | 0x001a + #define NT_STATUS_UNABLE_TO_DELETE_SECTION 0xC0000000 | 0x001b + #define NT_STATUS_INVALID_SYSTEM_SERVICE 0xC0000000 | 0x001c + #define NT_STATUS_ILLEGAL_INSTRUCTION 0xC0000000 | 0x001d +-- +2.51.0 + diff --git a/queue-6.6/alpha-don-t-reference-obsolete-termio-struct-for-tc-.patch b/queue-6.6/alpha-don-t-reference-obsolete-termio-struct-for-tc-.patch new file mode 100644 index 0000000000..416ccd172b --- /dev/null +++ b/queue-6.6/alpha-don-t-reference-obsolete-termio-struct-for-tc-.patch @@ -0,0 +1,49 @@ +From 2b262c8389f9aed247e66bfb99046b20aa12c9aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Dec 2025 08:14:57 +0000 +Subject: alpha: don't reference obsolete termio struct for TC* constants + +From: Sam James + +[ Upstream commit 9aeed9041929812a10a6d693af050846942a1d16 ] + +Similar in nature to ab107276607af90b13a5994997e19b7b9731e251. glibc-2.42 +drops the legacy termio struct, but the ioctls.h header still defines some +TC* constants in terms of termio (via sizeof). Hardcode the values instead. + +This fixes building Python for example, which falls over like: + ./Modules/termios.c:1119:16: error: invalid application of 'sizeof' to incomplete type 'struct termio' + +Link: https://bugs.gentoo.org/961769 +Link: https://bugs.gentoo.org/962600 +Signed-off-by: Sam James +Reviewed-by: Magnus Lindholm +Link: https://lore.kernel.org/r/6ebd3451908785cad53b50ca6bc46cfe9d6bc03c.1764922497.git.sam@gentoo.org +Signed-off-by: Magnus Lindholm +Signed-off-by: Sasha Levin +--- + arch/alpha/include/uapi/asm/ioctls.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/alpha/include/uapi/asm/ioctls.h b/arch/alpha/include/uapi/asm/ioctls.h +index 971311605288f..a09d04b49cc65 100644 +--- a/arch/alpha/include/uapi/asm/ioctls.h ++++ b/arch/alpha/include/uapi/asm/ioctls.h +@@ -23,10 +23,10 @@ + #define TCSETSW _IOW('t', 21, struct termios) + #define TCSETSF _IOW('t', 22, struct termios) + +-#define TCGETA _IOR('t', 23, struct termio) +-#define TCSETA _IOW('t', 24, struct termio) +-#define TCSETAW _IOW('t', 25, struct termio) +-#define TCSETAF _IOW('t', 28, struct termio) ++#define TCGETA 0x40127417 ++#define TCSETA 0x80127418 ++#define TCSETAW 0x80127419 ++#define TCSETAF 0x8012741c + + #define TCSBRK _IO('t', 29) + #define TCXONC _IO('t', 30) +-- +2.51.0 + diff --git a/queue-6.6/arm-9461-1-disable-highpte-on-preempt_rt-kernels.patch b/queue-6.6/arm-9461-1-disable-highpte-on-preempt_rt-kernels.patch new file mode 100644 index 0000000000..9e9edcd632 --- /dev/null +++ b/queue-6.6/arm-9461-1-disable-highpte-on-preempt_rt-kernels.patch @@ -0,0 +1,51 @@ +From 49ff4c6fea8cedb53237d128ea385b0bba7f5f29 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Nov 2025 16:54:37 +0100 +Subject: ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels + +From: Sebastian Andrzej Siewior + +[ Upstream commit fedadc4137234c3d00c4785eeed3e747fe9036ae ] + +gup_pgd_range() is invoked with disabled interrupts and invokes +__kmap_local_page_prot() via pte_offset_map(), gup_p4d_range(). +With HIGHPTE enabled, __kmap_local_page_prot() invokes kmap_high_get() +which uses a spinlock_t via lock_kmap_any(). This leads to an +sleeping-while-atomic error on PREEMPT_RT because spinlock_t becomes a +sleeping lock and must not be acquired in atomic context. + +The loop in map_new_virtual() uses wait_queue_head_t for wake up which +also is using a spinlock_t. + +Since HIGHPTE is rarely needed at all, turn it off for PREEMPT_RT +to allow the use of get_user_pages_fast(). + +[arnd: rework patch to turn off HIGHPTE instead of HAVE_PAST_GUP] + +Co-developed-by: Arnd Bergmann + +Acked-by: Linus Walleij +Reviewed-by: Arnd Bergmann +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Russell King (Oracle) +Signed-off-by: Sasha Levin +--- + arch/arm/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig +index 57c0448d017a1..be3b0f83eee57 100644 +--- a/arch/arm/Kconfig ++++ b/arch/arm/Kconfig +@@ -1308,7 +1308,7 @@ config HIGHMEM + + config HIGHPTE + bool "Allocate 2nd-level pagetables from highmem" if EXPERT +- depends on HIGHMEM ++ depends on HIGHMEM && !PREEMPT_RT + default y + help + The VM uses one page of physical memory for each page table. +-- +2.51.0 + diff --git a/queue-6.6/bcache-fix-improper-use-of-bi_end_io.patch b/queue-6.6/bcache-fix-improper-use-of-bi_end_io.patch new file mode 100644 index 0000000000..c4081e5f8d --- /dev/null +++ b/queue-6.6/bcache-fix-improper-use-of-bi_end_io.patch @@ -0,0 +1,55 @@ +From 81e7e43a810e8f40e163928d441de02d2816b073 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Dec 2025 17:01:56 +0800 +Subject: bcache: fix improper use of bi_end_io + +From: Shida Zhang + +[ Upstream commit 53280e398471f0bddbb17b798a63d41264651325 ] + +Don't call bio->bi_end_io() directly. Use the bio_endio() helper +function instead, which handles completion more safely and uniformly. + +Suggested-by: Christoph Hellwig +Reviewed-by: Christoph Hellwig +Signed-off-by: Shida Zhang +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/md/bcache/request.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c +index a9b1f3896249b..b4059d2daa326 100644 +--- a/drivers/md/bcache/request.c ++++ b/drivers/md/bcache/request.c +@@ -1090,7 +1090,7 @@ static void detached_dev_end_io(struct bio *bio) + } + + kfree(ddip); +- bio->bi_end_io(bio); ++ bio_endio(bio); + } + + static void detached_dev_do_request(struct bcache_device *d, struct bio *bio, +@@ -1107,7 +1107,7 @@ static void detached_dev_do_request(struct bcache_device *d, struct bio *bio, + ddip = kzalloc(sizeof(struct detached_dev_io_private), GFP_NOIO); + if (!ddip) { + bio->bi_status = BLK_STS_RESOURCE; +- bio->bi_end_io(bio); ++ bio_endio(bio); + return; + } + +@@ -1122,7 +1122,7 @@ static void detached_dev_do_request(struct bcache_device *d, struct bio *bio, + + if ((bio_op(bio) == REQ_OP_DISCARD) && + !bdev_max_discard_sectors(dc->bdev)) +- bio->bi_end_io(bio); ++ detached_dev_end_io(bio); + else + submit_bio_noacct(bio); + } +-- +2.51.0 + diff --git a/queue-6.6/csky-fix-csky_cmpxchg_fixup-not-working.patch b/queue-6.6/csky-fix-csky_cmpxchg_fixup-not-working.patch new file mode 100644 index 0000000000..f86fe54eeb --- /dev/null +++ b/queue-6.6/csky-fix-csky_cmpxchg_fixup-not-working.patch @@ -0,0 +1,40 @@ +From a5f3e0431d1ca633e25034454d314150f238c83c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Oct 2024 17:56:26 +0800 +Subject: csky: fix csky_cmpxchg_fixup not working + +From: Yang Li + +[ Upstream commit 809ef03d6d21d5fea016bbf6babeec462e37e68c ] + +In the csky_cmpxchg_fixup function, it is incorrect to use the global +variable csky_cmpxchg_stw to determine the address where the exception +occurred.The global variable csky_cmpxchg_stw stores the opcode at the +time of the exception, while &csky_cmpxchg_stw shows the address where +the exception occurred. + +Signed-off-by: Yang Li +Signed-off-by: Guo Ren +Signed-off-by: Sasha Levin +--- + arch/csky/mm/fault.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/csky/mm/fault.c b/arch/csky/mm/fault.c +index a885518ce1dd2..5226bc08c3360 100644 +--- a/arch/csky/mm/fault.c ++++ b/arch/csky/mm/fault.c +@@ -45,8 +45,8 @@ static inline void csky_cmpxchg_fixup(struct pt_regs *regs) + if (trap_no(regs) != VEC_TLBMODIFIED) + return; + +- if (instruction_pointer(regs) == csky_cmpxchg_stw) +- instruction_pointer_set(regs, csky_cmpxchg_ldw); ++ if (instruction_pointer(regs) == (unsigned long)&csky_cmpxchg_stw) ++ instruction_pointer_set(regs, (unsigned long)&csky_cmpxchg_ldw); + return; + } + #endif +-- +2.51.0 + diff --git a/queue-6.6/dm-snapshot-fix-scheduling-while-atomic-on-real-time.patch b/queue-6.6/dm-snapshot-fix-scheduling-while-atomic-on-real-time.patch new file mode 100644 index 0000000000..52998ffd98 --- /dev/null +++ b/queue-6.6/dm-snapshot-fix-scheduling-while-atomic-on-real-time.patch @@ -0,0 +1,238 @@ +From 87e45f417bee62bfcad64e4b7cba8b0b7361762d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Dec 2025 22:13:10 +0100 +Subject: dm-snapshot: fix 'scheduling while atomic' on real-time kernels + +From: Mikulas Patocka + +[ Upstream commit 8581b19eb2c5ccf06c195d3b5468c3c9d17a5020 ] + +There is reported 'scheduling while atomic' bug when using dm-snapshot on +real-time kernels. The reason for the bug is that the hlist_bl code does +preempt_disable() when taking the lock and the kernel attempts to take +other spinlocks while holding the hlist_bl lock. + +Fix this by converting a hlist_bl spinlock into a regular spinlock. + +Signed-off-by: Mikulas Patocka +Reported-by: Jiping Ma +Signed-off-by: Sasha Levin +--- + drivers/md/dm-exception-store.h | 2 +- + drivers/md/dm-snap.c | 73 +++++++++++++++------------------ + 2 files changed, 35 insertions(+), 40 deletions(-) + +diff --git a/drivers/md/dm-exception-store.h b/drivers/md/dm-exception-store.h +index b679766375381..061b4d3108132 100644 +--- a/drivers/md/dm-exception-store.h ++++ b/drivers/md/dm-exception-store.h +@@ -29,7 +29,7 @@ typedef sector_t chunk_t; + * chunk within the device. + */ + struct dm_exception { +- struct hlist_bl_node hash_list; ++ struct hlist_node hash_list; + + chunk_t old_chunk; + chunk_t new_chunk; +diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c +index 0ace06d1bee38..dcffa3441a662 100644 +--- a/drivers/md/dm-snap.c ++++ b/drivers/md/dm-snap.c +@@ -40,10 +40,15 @@ static const char dm_snapshot_merge_target_name[] = "snapshot-merge"; + #define DM_TRACKED_CHUNK_HASH(x) ((unsigned long)(x) & \ + (DM_TRACKED_CHUNK_HASH_SIZE - 1)) + ++struct dm_hlist_head { ++ struct hlist_head head; ++ spinlock_t lock; ++}; ++ + struct dm_exception_table { + uint32_t hash_mask; + unsigned int hash_shift; +- struct hlist_bl_head *table; ++ struct dm_hlist_head *table; + }; + + struct dm_snapshot { +@@ -628,8 +633,8 @@ static uint32_t exception_hash(struct dm_exception_table *et, chunk_t chunk); + + /* Lock to protect access to the completed and pending exception hash tables. */ + struct dm_exception_table_lock { +- struct hlist_bl_head *complete_slot; +- struct hlist_bl_head *pending_slot; ++ spinlock_t *complete_slot; ++ spinlock_t *pending_slot; + }; + + static void dm_exception_table_lock_init(struct dm_snapshot *s, chunk_t chunk, +@@ -638,20 +643,20 @@ static void dm_exception_table_lock_init(struct dm_snapshot *s, chunk_t chunk, + struct dm_exception_table *complete = &s->complete; + struct dm_exception_table *pending = &s->pending; + +- lock->complete_slot = &complete->table[exception_hash(complete, chunk)]; +- lock->pending_slot = &pending->table[exception_hash(pending, chunk)]; ++ lock->complete_slot = &complete->table[exception_hash(complete, chunk)].lock; ++ lock->pending_slot = &pending->table[exception_hash(pending, chunk)].lock; + } + + static void dm_exception_table_lock(struct dm_exception_table_lock *lock) + { +- hlist_bl_lock(lock->complete_slot); +- hlist_bl_lock(lock->pending_slot); ++ spin_lock_nested(lock->complete_slot, 1); ++ spin_lock_nested(lock->pending_slot, 2); + } + + static void dm_exception_table_unlock(struct dm_exception_table_lock *lock) + { +- hlist_bl_unlock(lock->pending_slot); +- hlist_bl_unlock(lock->complete_slot); ++ spin_unlock(lock->pending_slot); ++ spin_unlock(lock->complete_slot); + } + + static int dm_exception_table_init(struct dm_exception_table *et, +@@ -661,13 +666,15 @@ static int dm_exception_table_init(struct dm_exception_table *et, + + et->hash_shift = hash_shift; + et->hash_mask = size - 1; +- et->table = kvmalloc_array(size, sizeof(struct hlist_bl_head), ++ et->table = kvmalloc_array(size, sizeof(struct dm_hlist_head), + GFP_KERNEL); + if (!et->table) + return -ENOMEM; + +- for (i = 0; i < size; i++) +- INIT_HLIST_BL_HEAD(et->table + i); ++ for (i = 0; i < size; i++) { ++ INIT_HLIST_HEAD(&et->table[i].head); ++ spin_lock_init(&et->table[i].lock); ++ } + + return 0; + } +@@ -675,16 +682,17 @@ static int dm_exception_table_init(struct dm_exception_table *et, + static void dm_exception_table_exit(struct dm_exception_table *et, + struct kmem_cache *mem) + { +- struct hlist_bl_head *slot; ++ struct dm_hlist_head *slot; + struct dm_exception *ex; +- struct hlist_bl_node *pos, *n; ++ struct hlist_node *pos; + int i, size; + + size = et->hash_mask + 1; + for (i = 0; i < size; i++) { + slot = et->table + i; + +- hlist_bl_for_each_entry_safe(ex, pos, n, slot, hash_list) { ++ hlist_for_each_entry_safe(ex, pos, &slot->head, hash_list) { ++ hlist_del(&ex->hash_list); + kmem_cache_free(mem, ex); + cond_resched(); + } +@@ -700,7 +708,7 @@ static uint32_t exception_hash(struct dm_exception_table *et, chunk_t chunk) + + static void dm_remove_exception(struct dm_exception *e) + { +- hlist_bl_del(&e->hash_list); ++ hlist_del(&e->hash_list); + } + + /* +@@ -710,12 +718,11 @@ static void dm_remove_exception(struct dm_exception *e) + static struct dm_exception *dm_lookup_exception(struct dm_exception_table *et, + chunk_t chunk) + { +- struct hlist_bl_head *slot; +- struct hlist_bl_node *pos; ++ struct hlist_head *slot; + struct dm_exception *e; + +- slot = &et->table[exception_hash(et, chunk)]; +- hlist_bl_for_each_entry(e, pos, slot, hash_list) ++ slot = &et->table[exception_hash(et, chunk)].head; ++ hlist_for_each_entry(e, slot, hash_list) + if (chunk >= e->old_chunk && + chunk <= e->old_chunk + dm_consecutive_chunk_count(e)) + return e; +@@ -762,18 +769,17 @@ static void free_pending_exception(struct dm_snap_pending_exception *pe) + static void dm_insert_exception(struct dm_exception_table *eh, + struct dm_exception *new_e) + { +- struct hlist_bl_head *l; +- struct hlist_bl_node *pos; ++ struct hlist_head *l; + struct dm_exception *e = NULL; + +- l = &eh->table[exception_hash(eh, new_e->old_chunk)]; ++ l = &eh->table[exception_hash(eh, new_e->old_chunk)].head; + + /* Add immediately if this table doesn't support consecutive chunks */ + if (!eh->hash_shift) + goto out; + + /* List is ordered by old_chunk */ +- hlist_bl_for_each_entry(e, pos, l, hash_list) { ++ hlist_for_each_entry(e, l, hash_list) { + /* Insert after an existing chunk? */ + if (new_e->old_chunk == (e->old_chunk + + dm_consecutive_chunk_count(e) + 1) && +@@ -804,13 +810,13 @@ static void dm_insert_exception(struct dm_exception_table *eh, + * Either the table doesn't support consecutive chunks or slot + * l is empty. + */ +- hlist_bl_add_head(&new_e->hash_list, l); ++ hlist_add_head(&new_e->hash_list, l); + } else if (new_e->old_chunk < e->old_chunk) { + /* Add before an existing exception */ +- hlist_bl_add_before(&new_e->hash_list, &e->hash_list); ++ hlist_add_before(&new_e->hash_list, &e->hash_list); + } else { + /* Add to l's tail: e is the last exception in this slot */ +- hlist_bl_add_behind(&new_e->hash_list, &e->hash_list); ++ hlist_add_behind(&new_e->hash_list, &e->hash_list); + } + } + +@@ -820,7 +826,6 @@ static void dm_insert_exception(struct dm_exception_table *eh, + */ + static int dm_add_exception(void *context, chunk_t old, chunk_t new) + { +- struct dm_exception_table_lock lock; + struct dm_snapshot *s = context; + struct dm_exception *e; + +@@ -833,17 +838,7 @@ static int dm_add_exception(void *context, chunk_t old, chunk_t new) + /* Consecutive_count is implicitly initialised to zero */ + e->new_chunk = new; + +- /* +- * Although there is no need to lock access to the exception tables +- * here, if we don't then hlist_bl_add_head(), called by +- * dm_insert_exception(), will complain about accessing the +- * corresponding list without locking it first. +- */ +- dm_exception_table_lock_init(s, old, &lock); +- +- dm_exception_table_lock(&lock); + dm_insert_exception(&s->complete, e); +- dm_exception_table_unlock(&lock); + + return 0; + } +@@ -873,7 +868,7 @@ static int calc_max_buckets(void) + /* use a fixed size of 2MB */ + unsigned long mem = 2 * 1024 * 1024; + +- mem /= sizeof(struct hlist_bl_head); ++ mem /= sizeof(struct dm_hlist_head); + + return mem; + } +-- +2.51.0 + diff --git a/queue-6.6/nfs-fix-up-the-automount-fs_context-to-use-the-corre.patch b/queue-6.6/nfs-fix-up-the-automount-fs_context-to-use-the-corre.patch new file mode 100644 index 0000000000..0542ba71dd --- /dev/null +++ b/queue-6.6/nfs-fix-up-the-automount-fs_context-to-use-the-corre.patch @@ -0,0 +1,39 @@ +From 2dee4178d9a0743458f5a69aae661cdb1ae4c6be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Nov 2025 18:56:46 -0500 +Subject: NFS: Fix up the automount fs_context to use the correct cred + +From: Trond Myklebust + +[ Upstream commit a2a8fc27dd668e7562b5326b5ed2f1604cb1e2e9 ] + +When automounting, the fs_context should be fixed up to use the cred +from the parent filesystem, since the operation is just extending the +namespace. Authorisation to enter that namespace will already have been +provided by the preceding lookup. + +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/namespace.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/fs/nfs/namespace.c b/fs/nfs/namespace.c +index 923b5c1eb47e9..99ef1146096fe 100644 +--- a/fs/nfs/namespace.c ++++ b/fs/nfs/namespace.c +@@ -170,6 +170,11 @@ struct vfsmount *nfs_d_automount(struct path *path) + if (!ctx->clone_data.fattr) + goto out_fc; + ++ if (fc->cred != server->cred) { ++ put_cred(fc->cred); ++ fc->cred = get_cred(server->cred); ++ } ++ + if (fc->net_ns != client->cl_net) { + put_net(fc->net_ns); + fc->net_ns = get_net(client->cl_net); +-- +2.51.0 + diff --git a/queue-6.6/nfsv4-ensure-the-open-stateid-seqid-doesn-t-go-backw.patch b/queue-6.6/nfsv4-ensure-the-open-stateid-seqid-doesn-t-go-backw.patch new file mode 100644 index 0000000000..284304a87b --- /dev/null +++ b/queue-6.6/nfsv4-ensure-the-open-stateid-seqid-doesn-t-go-backw.patch @@ -0,0 +1,74 @@ +From 14c9e290a1d92f00c6018327229fbfb3eb448b00 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Nov 2025 10:44:15 -0500 +Subject: NFSv4: ensure the open stateid seqid doesn't go backwards + +From: Scott Mayhew + +[ Upstream commit 2e47c3cc64b44b0b06cd68c2801db92ff143f2b2 ] + +We have observed an NFSv4 client receiving a LOCK reply with a status of +NFS4ERR_OLD_STATEID and subsequently retrying the LOCK request with an +earlier seqid value in the stateid. As this was for a new lockowner, +that would imply that nfs_set_open_stateid_locked() had updated the open +stateid seqid with an earlier value. + +Looking at nfs_set_open_stateid_locked(), if the incoming seqid is out +of sequence, the task will sleep on the state->waitq for up to 5 +seconds. If the task waits for the full 5 seconds, then after finishing +the wait it'll update the open stateid seqid with whatever value the +incoming seqid has. If there are multiple waiters in this scenario, +then the last one to perform said update may not be the one with the +highest seqid. + +Add a check to ensure that the seqid can only be incremented, and add a +tracepoint to indicate when old seqids are skipped. + +Signed-off-by: Scott Mayhew +Reviewed-by: Benjamin Coddington +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4proc.c | 13 +++++++++++-- + fs/nfs/nfs4trace.h | 1 + + 2 files changed, 12 insertions(+), 2 deletions(-) + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index a0a71a163ffed..fe6986939bc90 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -1700,8 +1700,17 @@ static void nfs_set_open_stateid_locked(struct nfs4_state *state, + if (nfs_stateid_is_sequential(state, stateid)) + break; + +- if (status) +- break; ++ if (status) { ++ if (nfs4_stateid_match_other(stateid, &state->open_stateid) && ++ !nfs4_stateid_is_newer(stateid, &state->open_stateid)) { ++ trace_nfs4_open_stateid_update_skip(state->inode, ++ stateid, status); ++ return; ++ } else { ++ break; ++ } ++ } ++ + /* Rely on seqids for serialisation with NFSv4.0 */ + if (!nfs4_has_session(NFS_SERVER(state->inode)->nfs_client)) + break; +diff --git a/fs/nfs/nfs4trace.h b/fs/nfs/nfs4trace.h +index d27919d7241d3..52a985ebe2b1d 100644 +--- a/fs/nfs/nfs4trace.h ++++ b/fs/nfs/nfs4trace.h +@@ -1248,6 +1248,7 @@ DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_setattr); + DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_delegreturn); + DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_open_stateid_update); + DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_open_stateid_update_wait); ++DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_open_stateid_update_skip); + DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_close_stateid_update_wait); + + DECLARE_EVENT_CLASS(nfs4_getattr_event, +-- +2.51.0 + diff --git a/queue-6.6/scsi-ipr-enable-disable-irqd_no_balancing-during-res.patch b/queue-6.6/scsi-ipr-enable-disable-irqd_no_balancing-during-res.patch new file mode 100644 index 0000000000..80a4d6fbb9 --- /dev/null +++ b/queue-6.6/scsi-ipr-enable-disable-irqd_no_balancing-during-res.patch @@ -0,0 +1,190 @@ +From 2fafe849fdd308f8c60e1a447b3be380b799b6d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Oct 2025 09:24:26 -0500 +Subject: scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset + +From: Wen Xiong + +[ Upstream commit 6ac3484fb13b2fc7f31cfc7f56093e7d0ce646a5 ] + +A dynamic remove/add storage adapter test hits EEH on PowerPC: + + EEH: [c00000000004f75c] __eeh_send_failure_event+0x7c/0x160 + EEH: [c000000000048444] eeh_dev_check_failure.part.0+0x254/0x650 + EEH: [c008000001650678] eeh_readl+0x60/0x90 [ipr] + EEH: [c00800000166746c] ipr_cancel_op+0x2b8/0x524 [ipr] + EEH: [c008000001656524] ipr_eh_abort+0x6c/0x130 [ipr] + EEH: [c000000000ab0d20] scmd_eh_abort_handler+0x140/0x440 + EEH: [c00000000017e558] process_one_work+0x298/0x590 + EEH: [c00000000017eef8] worker_thread+0xa8/0x620 + EEH: [c00000000018be34] kthread+0x124/0x130 + EEH: [c00000000000cd64] ret_from_kernel_thread+0x5c/0x64 + +A PCIe bus trace reveals that a vector of MSI-X is cleared to 0 by +irqbalance daemon. If we disable irqbalance daemon, we won't see the +issue. + +With debug enabled in ipr driver: + + [ 44.103071] ipr: Entering __ipr_remove + [ 44.103083] ipr: Entering ipr_initiate_ioa_bringdown + [ 44.103091] ipr: Entering ipr_reset_shutdown_ioa + [ 44.103099] ipr: Leaving ipr_reset_shutdown_ioa + [ 44.103105] ipr: Leaving ipr_initiate_ioa_bringdown + [ 44.149918] ipr: Entering ipr_reset_ucode_download + [ 44.149935] ipr: Entering ipr_reset_alert + [ 44.150032] ipr: Entering ipr_reset_start_timer + [ 44.150038] ipr: Leaving ipr_reset_alert + [ 44.244343] scsi 1:2:3:0: alua: Detached + [ 44.254300] ipr: Entering ipr_reset_start_bist + [ 44.254320] ipr: Entering ipr_reset_start_timer + [ 44.254325] ipr: Leaving ipr_reset_start_bist + [ 44.364329] scsi 1:2:4:0: alua: Detached + [ 45.134341] scsi 1:2:5:0: alua: Detached + [ 45.860949] ipr: Entering ipr_reset_shutdown_ioa + [ 45.860962] ipr: Leaving ipr_reset_shutdown_ioa + [ 45.860966] ipr: Entering ipr_reset_alert + [ 45.861028] ipr: Entering ipr_reset_start_timer + [ 45.861035] ipr: Leaving ipr_reset_alert + [ 45.964302] ipr: Entering ipr_reset_start_bist + [ 45.964309] ipr: Entering ipr_reset_start_timer + [ 45.964313] ipr: Leaving ipr_reset_start_bist + [ 46.264301] ipr: Entering ipr_reset_bist_done + [ 46.264309] ipr: Leaving ipr_reset_bist_done + +During adapter reset, ipr device driver blocks config space access but +can't block MMIO access for MSI-X entries. There is very small window: +irqbalance daemon kicks in during adapter reset before ipr driver calls +pci_restore_state(pdev) to restore MSI-X table. + +irqbalance daemon reads back all 0 for that MSI-X vector in +__pci_read_msi_msg(). + +irqbalance daemon: + + msi_domain_set_affinity() + ->irq_chip_set_affinity_patent() + ->xive_irq_set_affinity() + ->irq_chip_compose_msi_msg() + ->pseries_msi_compose_msg() + ->__pci_read_msi_msg(): read all 0 since didn't call pci_restore_state + ->irq_chip_write_msi_msg() + -> pci_write_msg_msi(): write 0 to the msix vector entry + +When ipr driver calls pci_restore_state(pdev) in +ipr_reset_restore_cfg_space(), the MSI-X vector entry has been cleared +by irqbalance daemon in pci_write_msg_msix(). + + pci_restore_state() + ->__pci_restore_msix_state() + +Below is the MSI-X table for ipr adapter after irqbalance daemon kicked +in during adapter reset: + + Dump MSIx table: index=0 address_lo=c800 address_hi=10000000 msg_data=0 + Dump MSIx table: index=1 address_lo=c810 address_hi=10000000 msg_data=0 + Dump MSIx table: index=2 address_lo=c820 address_hi=10000000 msg_data=0 + Dump MSIx table: index=3 address_lo=c830 address_hi=10000000 msg_data=0 + Dump MSIx table: index=4 address_lo=c840 address_hi=10000000 msg_data=0 + Dump MSIx table: index=5 address_lo=c850 address_hi=10000000 msg_data=0 + Dump MSIx table: index=6 address_lo=c860 address_hi=10000000 msg_data=0 + Dump MSIx table: index=7 address_lo=c870 address_hi=10000000 msg_data=0 + Dump MSIx table: index=8 address_lo=0 address_hi=0 msg_data=0 + ---------> Hit EEH since msix vector of index=8 are 0 + Dump MSIx table: index=9 address_lo=c890 address_hi=10000000 msg_data=0 + Dump MSIx table: index=10 address_lo=c8a0 address_hi=10000000 msg_data=0 + Dump MSIx table: index=11 address_lo=c8b0 address_hi=10000000 msg_data=0 + Dump MSIx table: index=12 address_lo=c8c0 address_hi=10000000 msg_data=0 + Dump MSIx table: index=13 address_lo=c8d0 address_hi=10000000 msg_data=0 + Dump MSIx table: index=14 address_lo=c8e0 address_hi=10000000 msg_data=0 + Dump MSIx table: index=15 address_lo=c8f0 address_hi=10000000 msg_data=0 + + [ 46.264312] ipr: Entering ipr_reset_restore_cfg_space + [ 46.267439] ipr: Entering ipr_fail_all_ops + [ 46.267447] ipr: Leaving ipr_fail_all_ops + [ 46.267451] ipr: Leaving ipr_reset_restore_cfg_space + [ 46.267454] ipr: Entering ipr_ioa_bringdown_done + [ 46.267458] ipr: Leaving ipr_ioa_bringdown_done + [ 46.267467] ipr: Entering ipr_worker_thread + [ 46.267470] ipr: Leaving ipr_worker_thread + +IRQ balancing is not required during adapter reset. + +Enable "IRQ_NO_BALANCING" flag before starting adapter reset and disable +it after calling pci_restore_state(). The irqbalance daemon is disabled +for this short period of time (~2s). + +Co-developed-by: Kyle Mahlkuch +Signed-off-by: Kyle Mahlkuch +Signed-off-by: Wen Xiong +Link: https://patch.msgid.link/20251028142427.3969819-2-wenxiong@linux.ibm.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ipr.c | 28 +++++++++++++++++++++++++++- + 1 file changed, 27 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c +index 4e13797b2a4ab..5cda5b3f0020c 100644 +--- a/drivers/scsi/ipr.c ++++ b/drivers/scsi/ipr.c +@@ -61,8 +61,8 @@ + #include + #include + #include ++#include + #include +-#include + #include + #include + #include +@@ -7892,6 +7892,30 @@ static int ipr_dump_mailbox_wait(struct ipr_cmnd *ipr_cmd) + return IPR_RC_JOB_RETURN; + } + ++/** ++ * ipr_set_affinity_nobalance ++ * @ioa_cfg: ipr_ioa_cfg struct for an ipr device ++ * @flag: bool ++ * true: ensable "IRQ_NO_BALANCING" bit for msix interrupt ++ * false: disable "IRQ_NO_BALANCING" bit for msix interrupt ++ * Description: This function will be called to disable/enable ++ * "IRQ_NO_BALANCING" to avoid irqbalance daemon ++ * kicking in during adapter reset. ++ **/ ++static void ipr_set_affinity_nobalance(struct ipr_ioa_cfg *ioa_cfg, bool flag) ++{ ++ int irq, i; ++ ++ for (i = 0; i < ioa_cfg->nvectors; i++) { ++ irq = pci_irq_vector(ioa_cfg->pdev, i); ++ ++ if (flag) ++ irq_set_status_flags(irq, IRQ_NO_BALANCING); ++ else ++ irq_clear_status_flags(irq, IRQ_NO_BALANCING); ++ } ++} ++ + /** + * ipr_reset_restore_cfg_space - Restore PCI config space. + * @ipr_cmd: ipr command struct +@@ -7916,6 +7940,7 @@ static int ipr_reset_restore_cfg_space(struct ipr_cmnd *ipr_cmd) + return IPR_RC_JOB_CONTINUE; + } + ++ ipr_set_affinity_nobalance(ioa_cfg, false); + ipr_fail_all_ops(ioa_cfg); + + if (ioa_cfg->sis64) { +@@ -7995,6 +8020,7 @@ static int ipr_reset_start_bist(struct ipr_cmnd *ipr_cmd) + rc = pci_write_config_byte(ioa_cfg->pdev, PCI_BIST, PCI_BIST_START); + + if (rc == PCIBIOS_SUCCESSFUL) { ++ ipr_set_affinity_nobalance(ioa_cfg, true); + ipr_cmd->job_step = ipr_reset_bist_done; + ipr_reset_start_timer(ipr_cmd, IPR_WAIT_FOR_BIST_TIMEOUT); + rc = IPR_RC_JOB_RETURN; +-- +2.51.0 + diff --git a/queue-6.6/scsi-revert-scsi-libsas-fix-exp-attached-device-scan.patch b/queue-6.6/scsi-revert-scsi-libsas-fix-exp-attached-device-scan.patch new file mode 100644 index 0000000000..aa20856752 --- /dev/null +++ b/queue-6.6/scsi-revert-scsi-libsas-fix-exp-attached-device-scan.patch @@ -0,0 +1,59 @@ +From 0515dc7d00d23db6b0a02677456272225b8f2e72 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Dec 2025 14:56:27 +0800 +Subject: scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe + failure scanned in again after probe failed" + +From: Xingui Yang + +[ Upstream commit 278712d20bc8ec29d1ad6ef9bdae9000ef2c220c ] + +This reverts commit ab2068a6fb84751836a84c26ca72b3beb349619d. + +When probing the exp-attached sata device, libsas/libata will issue a +hard reset in sas_probe_sata() -> ata_sas_async_probe(), then a +broadcast event will be received after the disk probe fails, and this +commit causes the probe will be re-executed on the disk, and a faulty +disk may get into an indefinite loop of probe. + +Therefore, revert this commit, although it can fix some temporary issues +with disk probe failure. + +Signed-off-by: Xingui Yang +Reviewed-by: Jason Yan +Reviewed-by: John Garry +Link: https://patch.msgid.link/20251202065627.140361-1-yangxingui@huawei.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/libsas/sas_internal.h | 14 -------------- + 1 file changed, 14 deletions(-) + +diff --git a/drivers/scsi/libsas/sas_internal.h b/drivers/scsi/libsas/sas_internal.h +index 277e45fed85d6..a6dc7dc07fce3 100644 +--- a/drivers/scsi/libsas/sas_internal.h ++++ b/drivers/scsi/libsas/sas_internal.h +@@ -133,20 +133,6 @@ static inline void sas_fail_probe(struct domain_device *dev, const char *func, i + func, dev->parent ? "exp-attached" : + "direct-attached", + SAS_ADDR(dev->sas_addr), err); +- +- /* +- * If the device probe failed, the expander phy attached address +- * needs to be reset so that the phy will not be treated as flutter +- * in the next revalidation +- */ +- if (dev->parent && !dev_is_expander(dev->dev_type)) { +- struct sas_phy *phy = dev->phy; +- struct domain_device *parent = dev->parent; +- struct ex_phy *ex_phy = &parent->ex_dev.ex_phy[phy->number]; +- +- memset(ex_phy->attached_sas_addr, 0, SAS_ADDR_SIZE); +- } +- + sas_unregister_dev(dev->port, dev); + } + +-- +2.51.0 + diff --git a/queue-6.6/scsi-ufs-core-fix-eh-failure-after-w-lun-resume-erro.patch b/queue-6.6/scsi-ufs-core-fix-eh-failure-after-w-lun-resume-erro.patch new file mode 100644 index 0000000000..a200c71296 --- /dev/null +++ b/queue-6.6/scsi-ufs-core-fix-eh-failure-after-w-lun-resume-erro.patch @@ -0,0 +1,126 @@ +From 3efdc3147e63b5e655c3abab6b8da2b2a7a1adf1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Nov 2025 06:32:02 +0000 +Subject: scsi: ufs: core: Fix EH failure after W-LUN resume error + +From: Brian Kao + +[ Upstream commit b4bb6daf4ac4d4560044ecdd81e93aa2f6acbb06 ] + +When a W-LUN resume fails, its parent devices in the SCSI hierarchy, +including the scsi_target, may be runtime suspended. Subsequently, the +error handler in ufshcd_recover_pm_error() fails to set the W-LUN device +back to active because the parent target is not active. This results in +the following errors: + + google-ufshcd 3c2d0000.ufs: ufshcd_err_handler started; HBA state eh_fatal; ... + ufs_device_wlun 0:0:0:49488: START_STOP failed for power mode: 1, result 40000 + ufs_device_wlun 0:0:0:49488: ufshcd_wl_runtime_resume failed: -5 + ... + ufs_device_wlun 0:0:0:49488: runtime PM trying to activate child device 0:0:0:49488 but parent (target0:0:0) is not active + +Address this by: + + 1. Ensuring the W-LUN's parent scsi_target is runtime resumed before + attempting to set the W-LUN to active within + ufshcd_recover_pm_error(). + + 2. Explicitly checking for power.runtime_error on the HBA and W-LUN + devices before calling pm_runtime_set_active() to clear the error + state. + + 3. Adding pm_runtime_get_sync(hba->dev) in + ufshcd_err_handling_prepare() to ensure the HBA itself is active + during error recovery, even if a child device resume failed. + +These changes ensure the device power states are managed correctly +during error recovery. + +Signed-off-by: Brian Kao +Tested-by: Brian Kao +Reviewed-by: Bart Van Assche +Link: https://patch.msgid.link/20251112063214.1195761-1-powenkao@google.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/ufs/core/ufshcd.c | 36 ++++++++++++++++++++++++++++-------- + 1 file changed, 28 insertions(+), 8 deletions(-) + +diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c +index 50d8a816d943a..9f53ee92486dc 100644 +--- a/drivers/ufs/core/ufshcd.c ++++ b/drivers/ufs/core/ufshcd.c +@@ -6383,6 +6383,11 @@ static void ufshcd_clk_scaling_suspend(struct ufs_hba *hba, bool suspend) + + static void ufshcd_err_handling_prepare(struct ufs_hba *hba) + { ++ /* ++ * A WLUN resume failure could potentially lead to the HBA being ++ * runtime suspended, so take an extra reference on hba->dev. ++ */ ++ pm_runtime_get_sync(hba->dev); + ufshcd_rpm_get_sync(hba); + if (pm_runtime_status_suspended(&hba->ufs_device_wlun->sdev_gendev) || + hba->is_sys_suspended) { +@@ -6423,6 +6428,7 @@ static void ufshcd_err_handling_unprepare(struct ufs_hba *hba) + if (ufshcd_is_clkscaling_supported(hba)) + ufshcd_clk_scaling_suspend(hba, false); + ufshcd_rpm_put(hba); ++ pm_runtime_put(hba->dev); + } + + static inline bool ufshcd_err_handling_should_stop(struct ufs_hba *hba) +@@ -6437,28 +6443,42 @@ static inline bool ufshcd_err_handling_should_stop(struct ufs_hba *hba) + #ifdef CONFIG_PM + static void ufshcd_recover_pm_error(struct ufs_hba *hba) + { ++ struct scsi_target *starget = hba->ufs_device_wlun->sdev_target; + struct Scsi_Host *shost = hba->host; + struct scsi_device *sdev; + struct request_queue *q; +- int ret; ++ bool resume_sdev_queues = false; + + hba->is_sys_suspended = false; ++ + /* +- * Set RPM status of wlun device to RPM_ACTIVE, +- * this also clears its runtime error. ++ * Ensure the parent's error status is cleared before proceeding ++ * to the child, as the parent must be active to activate the child. + */ +- ret = pm_runtime_set_active(&hba->ufs_device_wlun->sdev_gendev); ++ if (hba->dev->power.runtime_error) { ++ /* hba->dev has no functional parent thus simplily set RPM_ACTIVE */ ++ pm_runtime_set_active(hba->dev); ++ resume_sdev_queues = true; ++ } ++ ++ if (hba->ufs_device_wlun->sdev_gendev.power.runtime_error) { ++ /* ++ * starget, parent of wlun, might be suspended if wlun resume failed. ++ * Make sure parent is resumed before set child (wlun) active. ++ */ ++ pm_runtime_get_sync(&starget->dev); ++ pm_runtime_set_active(&hba->ufs_device_wlun->sdev_gendev); ++ pm_runtime_put_sync(&starget->dev); ++ resume_sdev_queues = true; ++ } + +- /* hba device might have a runtime error otherwise */ +- if (ret) +- ret = pm_runtime_set_active(hba->dev); + /* + * If wlun device had runtime error, we also need to resume those + * consumer scsi devices in case any of them has failed to be + * resumed due to supplier runtime resume failure. This is to unblock + * blk_queue_enter in case there are bios waiting inside it. + */ +- if (!ret) { ++ if (resume_sdev_queues) { + shost_for_each_device(sdev, shost) { + q = sdev->request_queue; + if (q->dev && (q->rpm_status == RPM_SUSPENDED || +-- +2.51.0 + diff --git a/queue-6.6/series b/queue-6.6/series index d10c8410f9..137d9477dd 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -25,3 +25,16 @@ nfsd-fix-nfsv3-atomicity-bugs-in-nfsd_setattr.patch nfsd-set-security-label-during-create-operations.patch nfsd-nfsv4-file-creation-neglects-setting-acl.patch tls-use-__sk_dst_get-and-dst_dev_rcu-in-get_netdev_for_sock.patch +csky-fix-csky_cmpxchg_fixup-not-working.patch +arm-9461-1-disable-highpte-on-preempt_rt-kernels.patch +alpha-don-t-reference-obsolete-termio-struct-for-tc-.patch +dm-snapshot-fix-scheduling-while-atomic-on-real-time.patch +nfsv4-ensure-the-open-stateid-seqid-doesn-t-go-backw.patch +nfs-fix-up-the-automount-fs_context-to-use-the-corre.patch +bcache-fix-improper-use-of-bi_end_io.patch +smb-client-fix-nt_status_unable_to_free_vm-value.patch +smb-client-fix-nt_status_device_door_open-value.patch +smb-client-fix-nt_status_no_data_detected-value.patch +scsi-ipr-enable-disable-irqd_no_balancing-during-res.patch +scsi-ufs-core-fix-eh-failure-after-w-lun-resume-erro.patch +scsi-revert-scsi-libsas-fix-exp-attached-device-scan.patch diff --git a/queue-6.6/smb-client-fix-nt_status_device_door_open-value.patch b/queue-6.6/smb-client-fix-nt_status_device_door_open-value.patch new file mode 100644 index 0000000000..7e3dddd1a5 --- /dev/null +++ b/queue-6.6/smb-client-fix-nt_status_device_door_open-value.patch @@ -0,0 +1,38 @@ +From bb95e70e78ed1cd6eb9df4e30fec3573ed3d3c75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Dec 2025 09:17:57 +0800 +Subject: smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value + +From: ChenXiaoSong + +[ Upstream commit b2b50fca34da5ec231008edba798ddf92986bd7f ] + +This was reported by the KUnit tests in the later patches. + +See MS-ERREF 2.3.1 STATUS_DEVICE_DOOR_OPEN. Keep it consistent with the +value in the documentation. + +Signed-off-by: ChenXiaoSong +Acked-by: Paulo Alcantara (Red Hat) +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/nterr.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/smb/client/nterr.h b/fs/smb/client/nterr.h +index 7ce063a1dc3f6..d46d42559eea2 100644 +--- a/fs/smb/client/nterr.h ++++ b/fs/smb/client/nterr.h +@@ -44,7 +44,7 @@ extern const struct nt_err_code_struct nt_errs[]; + #define NT_STATUS_NO_DATA_DETECTED 0x8000001c + #define NT_STATUS_STOPPED_ON_SYMLINK 0x8000002d + #define NT_STATUS_DEVICE_REQUIRES_CLEANING 0x80000288 +-#define NT_STATUS_DEVICE_DOOR_OPEN 0x80000288 ++#define NT_STATUS_DEVICE_DOOR_OPEN 0x80000289 + #define NT_STATUS_UNSUCCESSFUL 0xC0000000 | 0x0001 + #define NT_STATUS_NOT_IMPLEMENTED 0xC0000000 | 0x0002 + #define NT_STATUS_INVALID_INFO_CLASS 0xC0000000 | 0x0003 +-- +2.51.0 + diff --git a/queue-6.6/smb-client-fix-nt_status_no_data_detected-value.patch b/queue-6.6/smb-client-fix-nt_status_no_data_detected-value.patch new file mode 100644 index 0000000000..630152c71e --- /dev/null +++ b/queue-6.6/smb-client-fix-nt_status_no_data_detected-value.patch @@ -0,0 +1,38 @@ +From 789b60772ba2ed339acc78335bb38582c06e69f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Dec 2025 09:13:06 +0800 +Subject: smb/client: fix NT_STATUS_NO_DATA_DETECTED value + +From: ChenXiaoSong + +[ Upstream commit a1237c203f1757480dc2f3b930608ee00072d3cc ] + +This was reported by the KUnit tests in the later patches. + +See MS-ERREF 2.3.1 STATUS_NO_DATA_DETECTED. Keep it consistent with the +value in the documentation. + +Signed-off-by: ChenXiaoSong +Acked-by: Paulo Alcantara (Red Hat) +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/nterr.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/smb/client/nterr.h b/fs/smb/client/nterr.h +index d46d42559eea2..e3a341316a711 100644 +--- a/fs/smb/client/nterr.h ++++ b/fs/smb/client/nterr.h +@@ -41,7 +41,7 @@ extern const struct nt_err_code_struct nt_errs[]; + #define NT_STATUS_MEDIA_CHANGED 0x8000001c + #define NT_STATUS_END_OF_MEDIA 0x8000001e + #define NT_STATUS_MEDIA_CHECK 0x80000020 +-#define NT_STATUS_NO_DATA_DETECTED 0x8000001c ++#define NT_STATUS_NO_DATA_DETECTED 0x80000022 + #define NT_STATUS_STOPPED_ON_SYMLINK 0x8000002d + #define NT_STATUS_DEVICE_REQUIRES_CLEANING 0x80000288 + #define NT_STATUS_DEVICE_DOOR_OPEN 0x80000289 +-- +2.51.0 + diff --git a/queue-6.6/smb-client-fix-nt_status_unable_to_free_vm-value.patch b/queue-6.6/smb-client-fix-nt_status_unable_to_free_vm-value.patch new file mode 100644 index 0000000000..a8bc308f2b --- /dev/null +++ b/queue-6.6/smb-client-fix-nt_status_unable_to_free_vm-value.patch @@ -0,0 +1,38 @@ +From de68f0124e91bd35a241b88c3a809b7170c194f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Dec 2025 09:22:53 +0800 +Subject: smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value + +From: ChenXiaoSong + +[ Upstream commit 9f99caa8950a76f560a90074e3a4b93cfa8b3d84 ] + +This was reported by the KUnit tests in the later patches. + +See MS-ERREF 2.3.1 STATUS_UNABLE_TO_FREE_VM. Keep it consistent with the +value in the documentation. + +Signed-off-by: ChenXiaoSong +Acked-by: Paulo Alcantara (Red Hat) +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/nterr.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/smb/client/nterr.h b/fs/smb/client/nterr.h +index edd4741cab0a1..7ce063a1dc3f6 100644 +--- a/fs/smb/client/nterr.h ++++ b/fs/smb/client/nterr.h +@@ -70,7 +70,7 @@ extern const struct nt_err_code_struct nt_errs[]; + #define NT_STATUS_NO_MEMORY 0xC0000000 | 0x0017 + #define NT_STATUS_CONFLICTING_ADDRESSES 0xC0000000 | 0x0018 + #define NT_STATUS_NOT_MAPPED_VIEW 0xC0000000 | 0x0019 +-#define NT_STATUS_UNABLE_TO_FREE_VM 0x80000000 | 0x001a ++#define NT_STATUS_UNABLE_TO_FREE_VM 0xC0000000 | 0x001a + #define NT_STATUS_UNABLE_TO_DELETE_SECTION 0xC0000000 | 0x001b + #define NT_STATUS_INVALID_SYSTEM_SERVICE 0xC0000000 | 0x001c + #define NT_STATUS_ILLEGAL_INSTRUCTION 0xC0000000 | 0x001d +-- +2.51.0 +