Pull block fixes from Jens Axboe:

 - Fixes for the dio bounce buffer helpers: correct the alignment of
   bounced dio read bios to avoid a double unpin, handle huge zero
   folios in bio_free_folios(), and don't warn on the larger-order folio
   attempts in the greedy allocation path.

 - Try a slab allocation in bio_alloc_bioset() before falling back to
   the mempool, restoring the previous behavior for non-sleeping
   allocations from a cache-enabled bioset.

 - Serialize elevator changes for the same queue using the writer lock.

 - Fix a race in blk_time_get_ns() where a task preempted between
   setting PF_BLOCK_TS and the cached-timestamp reload could return 0.

 - blk-cgroup fix for leaks and the online flag on a radix_tree_insert()
   failure in blkg_create().

 - Free the copied pages when blk_rq_map_kern() fails after
   blk_rq_append_bio() rejects the bio.

 - Remove manually added partitions on loop device detach, fixing dead
   partition devices left behind and a subsequent LOOP_CONFIGURE -EBUSY

 - Bound the AIX partition lvd scan to the sector that was actually
   read.

 - Show the block operation in error injection rules (Jackie)

* tag 'block-7.2-20260717' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  block: fix aligning of bounced dio read bios
  block: handle huge zero folios in bio_free_folios
  block: try slab allocation in bio_alloc_bioset() before mempool
  block: show operation in error injection rules
  block: serialize elevator changes for the same queue using a writer lock
  block: free copied pages when blk_rq_map_kern() fails
  block: do not warn when doing greedy allocation in folio_alloc_greedy()
  partitions: aix: bound the lvd scan to one sector
  blk-cgroup: fix leaks and online flag on radix_tree_insert failure
  loop: remove manually added partitions on detach
  block: fix race in blk_time_get_ns() returning 0

Pull spi fixes from Mark Brown:
 "A couple of fairly routine driver fixes, nothing too remarkable"

* tag 'spi-fix-v7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
  spi: cadence-quadspi: Fix indirect write timeout when DMA read mode is enabled
  spi: dw-dma: Wait for controller idle before completing Tx

Pull regulator fix from Mark Brown:
 "One straightforward driver fix for some incorrectly described
  bitfields in the ltc3676 driver"

* tag 'regulator-fix-v7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
  regulator: ltc3676: Fix incorrect IRQSTAT bit offsets

Pull SCSI fixes from James Bottomley:
 "The biggest core change is the reliable wake fix for scsi_schedule_eh
  which is used by both libata and libsas which could otherwise cause
  error handler hangs due to rare races.

  All other fixes are in drivers (well except the export symbol removal)
  the next biggest being the target PR-OUT transportid parsing fix"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path
  scsi: elx: efct: Fix refcount leak in efct_hw_io_abort()
  scsi: elx: efct: Fix I/O leak on unsupported additional CDB
  scsi: core: wake eh reliably when using scsi_schedule_eh
  scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE
  scsi: target: Bound PR-OUT TransportID parsing to the received buffer
  scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup()
  scsi: sg: Report request-table problems when any status is set
  scsi: ufs: core: tracing: Do not dereference pointers in TP_printk()
  scsi: bfa: Reduce kernel stack usage in bfa_fcs_lport_fdmi_build_portattr_block()
  scsi: xen: scsiback: Free the command tag on the TMR submit-failure path
  scsi: xen: scsiback: Free unsubmitted command instead of double-putting it
  scsi: core: Remove export for scsi_device_from_queue()

Pull i2c fixes from Andi Shyti:
 "A handful of small fixes for host controller drivers.

  One patch also adds Wolfram Sang to CREDITS after more than a decade
  of work on I2C"

* tag 'i2c-fixes-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux:
  i2c: mediatek: fix WRRD for SoCs without auto_restart option
  i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource()
  i2c: spacemit: fix spurious IRQ handling returning IRQ_HANDLED
  i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ)
  i2c: imx: fix locked bus on SMBus block-read of 0 (atomic)
  CREDITS: Add Wolfram Sang

Pull ata fixes from Damien Le Moal:

 - Interrupt initialization and handling fixes for the Designware
   ahci_dwc driver (Rosen)

 - Avoid possible infinite loop when scanning completion in the
   Designware ahci_dwc driver (Rosen)

* tag 'ata-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:
  ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning
  ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts
  ata: sata_dwc_460ex: use platform_get_irq()
  ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered

Pull drm fixes from Daie Airlie:
 "Weekly drm fixes, there is amdgpu, xe and i915 and then a lot of
  scattered fixes.

  Looks about the right level for the new right.

  ttm:
   - Handle NULL pages and backup handles in ttm_pool_backup() correctly

  gpusvm:
   - Improve unmap and error handling on gpusvm

  udmabuf:
   - Always synchronize for CPU in begin_cpu_udmabuf

  xe:
   - Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOCK
   - Hold a dma-buf reference for imported BOs
   - Fix writable override for CRI
   - Fix VF CCS attach/detach race with in-flight BO moves
   - Fix WOPCM size for LNL+
   - Reset current_op in xe_pt_update_ops_init
   - Keep scheduler timeline name alive
   - Hold device ref until queue teardown completes
   - Disable display in admin only PF mode

  i915:
   - NV12 display fix for bigjoiner
   - clear watermark on plane disable
   - GT selftest fixes

  host1x:
   - Fix UAF

  amdxdna
   - Fix UAF
   - Reject more invalid amdxdna command submissions

  ivpu:
   - Fix wrong read
   - Handle invalid firmware log in ivpu

  panthor:
   - Fix error handling

  virtio:
   - Fix virtio deadlock
   - Fix invalid gem detach

  amdgpu:
   - DCN 4.2 fixes
   - NUTMEG fixes
   - 8K panel fix
   - Backlight fixes
   - UserQ fix
   - Fix bo->pin leaking in amdgpu_bo_create_reserved()
   - VFCT fixes
   - devcoredump fixes
   - Display fixes
   - SMU7 DPM fix
   - AC/DC fixes for SMU7 and SI
   - Queue reset fix
   - PCIe DPM fix
   - XHCI/GPU resume ordering fix
   - Pageflip timeout fix

  amdkfd:
   - Fix potential overflow in CWSR size calculation
   - DQM error clean up fixes

* tag 'drm-fixes-2026-07-18-1' of https://gitlab.freedesktop.org/drm/kernel: (61 commits)
  Revert "drm/amd/display: Restore 5s vbl offdelay for NV3x+ DGPUs"
  drm/amd/display: check GRPH_FLIP status before sending event
  drm/amd/display: consolidate DCN vblank/flip handling onto vupdate_no_lock
  drm/amd: Create a device link between APU display and XHCI devices
  drm/amd/display: wire DCN42B mcache programming callback
  drm/amd/display: set new_stream to NULL after release
  drm/amd/display: Force PWM backlight on Lenovo Legion 5 15ARH05
  drm/amdkfd: free MQD managers on DQM init failures
  drm/amdgpu/ttm: Consider concurrent VM flushes for buffer entities
  drm/amd/pm/smu7: Fix AC/DC switch notification
  drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge
  drm/amdgpu: always emit the job vm fence
  drm/amd/pm/si: Fix AC/DC switch notification
  drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized
  drm/amd/display: dce100: skip non-DP stream encoders for DP MST
  drm/amd/display: Set native cursor mode for disabled CRTCs
  drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X)
  drm/amd/display: fix __udivdi3 link error
  drm/amdgpu: Reserve space for IB contents in devcoredumps
  drm/amdgpu: Print vmid, pasid and more task info in devcoredump
  ...

amd-drm-fixes-7.2-2026-07-17:

amdgpu:
- DCN 4.2 fixes
- NUTMEG fixes
- 8K panel fix
- Backlight fixes
- UserQ fix
- Fix bo->pin leaking in amdgpu_bo_create_reserved()
- VFCT fixes
- devcoredump fixes
- Display fixes
- SMU7 DPM fix
- AC/DC fixes for SMU7 and SI
- Queue reset fix
- PCIe DPM fix
- XHCI/GPU resume ordering fix
- Pageflip timeout fix

amdkfd:
- Fix potential overflow in CWSR size calculation
- DQM error clean up fixes

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Alex Deucher <alexander.deucher@amd.com>
Link: https://patch.msgid.link/20260717215008.998399-1-alexander.deucher@amd.com

Now that proper fixes have been found, let's revert this workaround.

This reverts commit a1fc7bf6677eb547167cb72b3bcafdc34b976692.

Tested-by: Mario Limonciello (AMD) <superm1@kernel.org>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Signed-off-by: Leo Li <sunpeng.li@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit f64a9be5653689ff43e148cd8a6483077488c8e5)
Cc: stable@vger.kernel.org # 8382cd234981: drm/amd/display: consolidate DCN vblank/flip handling onto vupdate_no_lock
Cc: stable@vger.kernel.org # 48ab86360af1: drm/amd/display: check GRPH_FLIP status before sending event
Cc: stable@vger.kernel.org

[Why]

After unifying DCN interrupt sources under VUPDATE_NO_LOCK, we have two
remaining issues to clean up:

1. On DCN, flip completion is now delivered from VUPDATE_NO_LOCK
   (dm_crtc_high_irq_handler) instead of GRPH_PFLIP. But VUPDATE_NO_LOCK
   fires every frame, regardless of whether a flip has latched.

2. There is a window during commit where a flip is armed (pflip_status =
   SUBMITTED) but not yet programmed into HW. If the VUPDATE_NO_LOCK
   fires in that window, its handler would deliver a flip event to
   userspace before HW has latched to it. If userspace then renders to
   what it believes is now the back buffer (but HW is still latched to
   it!), it will cause display corruption. This issue seemed to have
   been introduced by:
   commit 1159898a88db ("drm/amd/display: Handle commit plane with no FB.")
   Enabling replay or psr extended the duration of this window, and
   hence made corruption more likely to be observed.

[How]

* Move acrtc->event/pflip_status arming to after
  update_planes_and_stream_adapter() has programmed the flip into HW.
  This closes the window where pflip_status is SUBMITTED but the flip is
  not yet programmed.

* Add dc_get_flip_pending_on_otg(), which reads the HUBP flip-pending
  status straight from HW for the pipe(s) bound to an OTG instance. It
  is keyed only by otg_inst and does not take or mutate a
  dc_plane_state, so it is safe to call from the OTG interrupt handler
  without racing a concurrent commit that may be modifying plane state.

* Optimistically query for flip-pending after programming, in the event
  that HW latched to the new fb between programming start and arming
  event. If it latched, send the vblank event immediately, rather than
  wait for the next vblank IRQ.

* In the VUPDATE_NO_LOCK handler, only deliver flip completion once
  dc_get_flip_pending_on_otg() reports the flip is no longer pending.
  Otherwise leave the flip armed and retry on the next vupdate.

* For DCE, maintain the existing behavior of arming flips before
  programming, and relying on GRPH_FLIP to fire at HW latch.

v2:
* Drop flip_programmed completion object, instead move
  event/pflip_status arming after programming.
* For DCN, optimistically query for flip pending immediately after
  programming, and if it latched, send event right away.

v3:
* Fix event timestamps on optimistic flip latch detection, where it's
  possible for it to run *before* the vupdate IRQ updates the timestamp.
* Add more docstrings for DCN vblank handling.
* Clean up if conditions in dm_arm_vblank_event().
* Code style cleanup on braces surrounding multi-line statements.

Fixes: 9b47278cec98 ("drm/amd/display: temp w/a for dGPU to enter idle optimizations")
Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/3787
Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/4141
Assisted-by: Copilot:claude-opus-4.8
Tested-by: Mario Limonciello (AMD) <superm1@kernel.org>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Signed-off-by: Leo Li <sunpeng.li@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit f64a9be5653689ff43e148cd8a6483077488c8e5)
Cc: stable@vger.kernel.org # 8382cd234981: drm/amd/display: consolidate DCN vblank/flip handling onto vupdate_no_lock
Cc: stable@vger.kernel.org