linux-stable.git/Documentation/admin-guide/device-mapper, branch master

dm-integrity: replace forgeable discard filler with a keyed sector marker

2026-08-03T15:46:40+00:00

The discard-block check in dm_integrity_rw_tag() treats a stored tag
of all 0xf6 bytes (DISCARD_FILLER) as proof a block was discarded and
skips HMAC verification. allow_discards is only accepted in
dm-integrity's standalone mode. An attacker with raw write access to
the backing device, but without the integrity key, can stamp any block
with an all-0xf6 tag and have it served as authentic.

Add a new "allow_discards_keyed" target argument that marks discarded
blocks with a keyed checksum of (salt || sector) instead, computed by
integrity_discard_checksum().

Fixes: 84597a44a9d8 ("dm integrity: add optional discard support")
Co-developed-by: Jo Van Bulck 
Signed-off-by: Jo Van Bulck 
Signed-off-by: Shukai Ni 
Signed-off-by: Mikulas Patocka

docs: device-mapper: dm-inlinecrypt: fix 'bellow' spelling

2026-07-28T09:06:50+00:00

Fix spelling error reported by codespell: bellow -> below.
No functional change.

Signed-off-by: shaikh.kamal 
Signed-off-by: Mikulas Patocka

dm-inlinecrypt: add support for hardware-wrapped keys

2026-05-25T15:56:56+00:00

Add support for hardware-wrapped encryption keys to the
dm-inlinecrypt target.

Introduce a new optional argument  to indicate
whether the provided key is a raw key or a hardware-wrapped
key. Based on this flag, the appropriate blk-crypto key type
is selected when initializing the key.

This allows dm-inlinecrypt to work with hardware that requires
keys to be wrapped and managed by the underlying inline
encryption engine.

Update the target argument parsing accordingly and pass the
key type to blk_crypto_init_key(). Documentation is also
updated to reflect the new parameter and usage.

Signed-off-by: Linlin Zhang 
Signed-off-by: Mikulas Patocka 
Fixes: e7f57d2c47e2 ("dm-inlinecrypt: add target for inline block device encryption")

dm: add documentation for dm-inlinecrypt target

2026-05-18T12:26:27+00:00

This adds the admin-guide documentation for dm-inlinecrypt.

dm-inlinecrypt.rst is the guide to using dm-inlinecrypt.

Signed-off-by: Linlin Zhang 
Signed-off-by: Randy Dunlap 
Signed-off-by: Mikulas Patocka

dm-verity-fec: improve documentation for Forward Error Correction

2026-03-09T14:11:50+00:00

Update verity.rst to add a dedicated section about FEC and improve the
documentation for the FEC-related parameters.

Signed-off-by: Eric Biggers 
Signed-off-by: Mikulas Patocka

Merge tag 'for-7.0/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm

2026-02-12T01:04:21+00:00

Pull device mapper updates from Mikulas Patocka:

 - dm-verity:
     - various optimizations and fixes related to forward error correction
     - add a .dm-verity keyring

 - dm-integrity: fix bugs with growing a device in bitmap mode

 - dm-mpath:
     - fix leaking fake timeout requests
     - fix UAF bug caused by stale rq->bio
     - fix minor bugs in device creation

 - dm-core:
     - fix a bug related to blkg association
     - avoid unnecessary blk-crypto work on invalid keys

 - dm-bufio:
     - dm-bufio cleanup and optimization (reducing hash table lookups)

 - various other minor fixes and cleanups

* tag 'for-7.0/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: (35 commits)
  dm mpath: make pg_init_delay_msecs settable
  Revert "dm: fix a race condition in retrieve_deps"
  dm mpath: Add missing dm_put_device when failing to get scsi dh name
  dm vdo encodings: clean up header and version functions
  dm: use bio_clone_blkg_association
  dm: fix excessive blk-crypto operations for invalid keys
  dm-verity: fix section mismatch error
  dm-unstripe: fix mapping bug when there are multiple targets in a table
  dm-integrity: fix recalculation in bitmap mode
  dm-bufio: avoid redundant buffer_tree lookups
  dm-bufio: merge cache_put() into cache_put_and_wake()
  selftests: add dm-verity keyring selftests
  dm-verity: add dm-verity keyring
  dm: clear cloned request bio pointer when last clone bio completes
  dm-verity: fix up various workqueue-related comments
  dm-verity: switch to bio_advance_iter_single()
  dm-verity: consolidate the BH and normal work structs
  dm: add WQ_PERCPU to alloc_workqueue users
  dm-integrity: fix a typo in the code for write/discard race
  dm: use READ_ONCE in dm_blk_report_zones
  ...

Documentation: use a source-read extension for the index link boilerplate

2026-01-23T18:59:34+00:00

The root document usually has a special :ref:`genindex` link to the
generated index. This is also the case for Documentation/index.rst. The
other index.rst files deeper in the directory hierarchy usually don't.

For SPHINXDIRS builds, the root document isn't Documentation/index.rst,
but some other index.rst in the hierarchy. Currently they have a
".. only::" block to add the index link when doing SPHINXDIRS html
builds.

This is obviously very tedious and repetitive. The link is also added to
all index.rst files in the hierarchy for SPHINXDIRS builds, not just the
root document.

Put the boilerplate in a sphinx-includes/subproject-index.rst file, and
include it at the end of the root document for subproject builds in an
ad-hoc source-read extension defined in conf.py.

For now, keep having the boilerplate in translations, because this
approach currently doesn't cover translated index link headers.

Cc: Jonathan Corbet 
Cc: Mauro Carvalho Chehab 
Cc: Randy Dunlap 
Signed-off-by: Jani Nikula 
Tested-by: Mauro Carvalho Chehab 
Reviewed-by: Mauro Carvalho Chehab 
[jc: did s/doctree/kern_doc_dir/ ]
Signed-off-by: Jonathan Corbet 
Message-ID: <20260123143149.2024303-1-jani.nikula@intel.com>

dm-raid: fix typo in documentation

2026-01-02T14:03:53+00:00

Signed-off-by: Akiyoshi Kurita 
Signed-off-by: Mikulas Patocka

dm raid: add documentation for takeover/reshape raid1 -> raid5 table line examples

2025-12-10T18:28:22+00:00

Also enhance possible takeover/reshape information and do some reformatting.

Signed-off-by: Heinz Mauelshagen 
Signed-off-by: Mikulas Patocka

dm verity fec: Expose corrected block count via status

2025-11-18T17:24:26+00:00

Enhance visibility into dm-verity Forward Error Correction (FEC)
activity. While FEC can correct on-disk corruptions, the number of
successful correction events is not readily exposed through a standard
interface.

This change integrates FEC statistics into the verity target's
.status handler for STATUSTYPE_INFO. The info output now
includes count of corrected block by FEC.

The counter is a per-device instance atomic64_t, maintained within
the struct dm_verity_fec, tracking blocks successfully repaired by FEC
on this specific device instance since it was created.

This approach aligns with the standard Device Mapper mechanism for
targets to report runtime information, as used by other targets like
dm-integrity.

This patch also updates Documentation/admin-guide/device-mapper/verity.rst
to reflect the new status information.

Tested:
  Induced single-bit errors on a block device protected by dm-verity
  with FEC on android phone. Confirmed 'dmctl status ' on Android
  reports an incrementing 'fec_corrected_blocks' count after the
  corrupted blocks were accessed.

Signed-off-by: Shubhankar Mishra 
Signed-off-by: Mikulas Patocka