summaryrefslogtreecommitdiff
path: root/include
AgeCommit message (Collapse)Author
2026-07-20fscrypt: Avoid dynamic allocation in fscrypt_get_devices()Eric Biggers
When a blk_crypto_key starts being used or is evicted, fs/crypto/ calls fscrypt_get_devices() to get the filesystem's list of block devices, then iterates over them and calls blk_crypto_config_supported(), blk_crypto_start_using_key(), or blk_crypto_evict_key() on each one. Currently, the block device pointers are placed in a dynamically allocated array. This dynamic allocation is problematic because: - It can fail, especially at the fscrypt_destroy_inline_crypt_key() call site when it's invoked for inode eviction under direct reclaim. - fscrypt_destroy_inline_crypt_key() doesn't handle the failure. It just zeroizes and frees the blk_crypto_key without calling blk_crypto_evict_key(). That causes a use-after-free. For now, let's fix this in the straightforward and easily-backportable way by switching to an on-stack array. Currently the fscrypt multi-device functionality is used only by f2fs, which has a hardcoded limit of 8 block devices. An on-stack array works fine for that. (Of course, this solution won't scale up to large number of block devices. For that we'd need a different solution, like moving the block device iteration into the filesystem. Or in the case of btrfs, which will only support blk-crypto-fallback, we should make it just call blk-crypto-fallback directly, so the block devices won't be needed.) Fixes: 22e9947a4b2b ("fscrypt: stop holding extra request_queue references") Cc: stable@vger.kernel.org Reported-by: Sashiko <sashiko-bot@kernel.org> Closes: https://sashiko.dev/#/patchset/20260713023708.9245-1-ebiggers%40kernel.org Reviewed-by: Christoph Hellwig <hch@lst.de> Link: https://patch.msgid.link/20260719055602.78828-1-ebiggers@kernel.org Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-07-20posix-cpu-timers: Avoid kernel-doc warningsRandy Dunlap
Use the struct keyword when describing a struct. Without that, the type defaults to function. Warning: ./include/linux/posix-timers_types.h:40 cannot understand function prototype: 'struct posix_cputimer_base' Warning: ./include/linux/posix-timers_types.h:55 cannot understand function prototype: 'struct posix_cputimers' Warning: ./include/linux/posix-timers_types.h:67 cannot understand function prototype: 'struct posix_cputimers_work' Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260720031236.3070575-2-rdunlap@infradead.org
2026-07-20posix-timers: Clean up kernel-doc warningsRandy Dunlap
Use the struct keyword when describing a struct. Add missing kernel-doc for @it_pid_type. Warning: ./include/linux/posix-timers.h:58 cannot understand function prototype: 'struct cpu_timer' Warning: ./include/linux/posix-timers.h:222 struct member 'it_pid_type' not described in 'k_itimer' Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260720031236.3070575-1-rdunlap@infradead.org
2026-07-20RDMA/mana_ib: Adopt robust udataKonstantin Taranov
Enable the uverbs robust udata interface in mana_ib by setting uverbs_robust_udata and converting the driver to the new udata handling model. Signed-off-by: Konstantin Taranov <kotaranov@microsoft.com> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-20RDMA/irdma: Use robust udata helper for QP creationJacob Moroni
Replace the manual udata input copy and validation during QP creation with the robust helper. The irdma driver is backwards compatible with the legacy i40iw userspace provider. The current create_qp ABI contains two 8 byte fields. The legacy i40iw ABI was the same but also contained two additional fields which were never actually used. Furthermore, the i40iw userspace provider never explicitly zero-initialized those extra fields, so there is a chance that existing binaries are passing non-zero garbage values down to the kernel. Previously, the irdma driver only copied out the first 16 bytes and did not have any check for the rest of the buffer being zero, so that additional garbage didn't matter. By switching to ib_copy_validate_udata_in(), we will now be checking to ensure that data beyond the kernel's definition of the request is all zero. In order to avoid breaking legacy binaries, we therefore need to increase the request structure size to cover those garbage fields. - Legacy binaries will continue to pass down a 32 byte request, with the driver copying the entire 32 bytes out but ignoring the second 16 bytes, just as before. - Newer binaries will pass down the normal 16 byte request. The ib_copy_validate_udata_in() call will allow this to succeed because we use user_compl_ctx as our minimum length (16 bytes). - If the request is ever extended, the new fields would be added after the "don't use" fields and would work as per the normal uAPI mechanism. Signed-off-by: Jacob Moroni <jmoroni@google.com> Link: https://patch.msgid.link/20260713171257.3131493-5-jmoroni@google.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-20RDMA/mlx5: Constify struct ib_frmr_pool_ops and dma_buf_attach_opsChristophe JAILLET
'struct ib_frmr_pool_ops' and 'struct dma_buf_attach_ops' are not modified in this driver. Constifying these structures moves some data to a read-only section, so increases overall security, especially when the structure holds some function pointers. While at it, change a '1' into a 'true' into the mlx5_ib_dmabuf_attach_ops structure. The 'allow_peer2peer' field is a bool and other usages of 'struct dma_buf_attach_ops' prefer using true/false. On a x86_64, with allmodconfig, as an example: Before: ====== text data bss dec hex filename 77631 10392 320 88343 15917 drivers/infiniband/hw/mlx5/mr.o After: ===== text data bss dec hex filename 77759 10264 320 88343 15917 drivers/infiniband/hw/mlx5/mr.o Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Link: https://patch.msgid.link/22f2263c04cc94e242cee712e6e6d82b86ac353d.1784017128.git.christophe.jaillet@wanadoo.fr Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-20PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systemsSteffen Persvold
On 32-bit systems the config space is too large to ioremap in one go, so pci_ecam_create() maps each bus segment separately and relies on the ->add_bus callback (pci_ecam_add_bus) to populate the per-bus mapping in cfg->winp[]. pci_ecam_map_bus() then uses that mapping as the base for every config access. The generic ECAM ops (pci_generic_ecam_ops) already provide the ->add_bus and ->remove_bus callbacks, but the CAM (legacy) ops in pci-host-generic.c do not. As a result, on a 32-bit host using "pci-host-cam-generic" the per-bus mapping is never set up and the first config read dereferences a NULL base, crashing during bus enumeration: Unable to handle kernel NULL pointer dereference at virtual address 00000800 Oops [#1] CPU: 0 PID: 1 Comm: swapper Not tainted 6.9.7+ #43 Hardware name: Digilent Nexys-Video-A7 RV32 (DT) epc : pci_generic_config_read+0x40/0xb0 ra : pci_generic_config_read+0x2c/0xb0 [<c038db9c>] pci_generic_config_read+0x40/0xb0 [<c038da04>] pci_bus_read_config_dword+0x50/0xb0 [<c0391e94>] pci_bus_generic_read_dev_vendor_id+0x3c/0x1ec [<c039245c>] pci_scan_single_device+0xa4/0x11c [<c0392570>] pci_scan_slot+0x9c/0x23c [<c039388c>] pci_scan_child_bus_extend+0x58/0x2f4 [<c0393db0>] pci_scan_root_bus_bridge+0x64/0xe8 [<c0393e54>] pci_host_probe+0x20/0xc8 [<c03bc6f4>] pci_host_common_probe+0x144/0x1e4 Fix this by giving the CAM ops the same ->add_bus/->remove_bus callbacks. Since pci_ecam_add_bus() and pci_ecam_remove_bus() are static to ecam.c, move the CAM ops definition there as pci_generic_cam_ops (mirroring pci_generic_ecam_ops) and export it for pci-host-generic.c to reference. Fixes: 8fe55ef23387 ("PCI: Dynamically map ECAM regions") Signed-off-by: Steffen Persvold <spersvold@gmail.com> [mani: removed timestamp from log] Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260709122446.3151899-1-spersvold@gmail.com
2026-07-20drm/dp_tunnel: Add UHBR tunneling supportImre Deak
Add the DPCD registers and detection required to support UHBR link rates over Thunderbolt tunnels. Cc: dri-devel@lists.freedesktop.org Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com> Acked-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Signed-off-by: Imre Deak <imre.deak@intel.com> Link: https://patch.msgid.link/20260714152700.555527-2-imre.deak@intel.com
2026-07-20rv: Simplify hybrid automata monitors's clock variablesNam Cao
Hybrid automata monitors's clock variables have two different representations: - The invariant representation, which is the timestamp when the invariant expires - The guard representation, which is the timestamp when the clock is last reset This dual representation makes the logic quite difficult to follow (well, at least for me). It also complicates the monitors and the generation tool, as it requires conversion back and forth between the representation. Simplify by using the clock variables for a single purpose: storing the time stamp since the clock is last reset. This also allows simplifying rvgen, which will be done in a follow-up commit. Reviewed-by: Gabriele Monaco <gmonaco@redhat.com> Signed-off-by: Nam Cao <namcao@linutronix.de> Link: https://lore.kernel.org/r/c0f600dcbf3d8b487c944406851a39146f4d91fa.1781847583.git.namcao@linutronix.de Signed-off-by: Gabriele Monaco <gmonaco@redhat.com>
2026-07-20Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netPaolo Abeni
Cross-merge networking fixes after downstream PR (net-7.2-rc4). No conflicts. Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-20Merge tag 'swnode-7.3-rc1' of ↵Bartosz Golaszewski
https://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core into gpio/for-next software node: provide support for fw_devlink This series extends software node support to use fw_devlink and adds test coverage for the new behaviour. This is a stable tag for other trees to merge.
2026-07-19sched_ext: Hand over cgroups at sub-scheduler enable/disableTejun Heo
Sub-schedulers don't get cgroups yet: every task_group is inited on the root sched and the routing added by the previous patches always resolves to it. Add the handover: an enabling sub-scheduler takes over the cgroups in its subtree and a disabling one returns them to its parent. scx_cgroup_claim_subtree() runs while the sub enables, after the subtree's cgrp->scx_sched's are set and before any task is claimed. It inits each subtree task_group on the sub, exits it from the parent and updates tg->scx.sched. A failed ops.cgroup_init() unwinds the sub-side inits and aborts the enable with the parent untouched. Disabling reverses it with scx_cgroup_return_subtree(): exit each cgroup from the sub, then re-init it on the parent with the current tg->scx.* values, resyncing weight and bandwidth changes made while the sub had it. When a re-init fails, the parent is failed and the remaining task_groups still transfer uninited and get no cgroup ops - the same punting done for tasks. The dying parent's own disable moves them onward. The handover walks include dying but not yet offlined task_groups, the same as root's bulk walks: a removed cgroup keeps hosting scheduling events until its dying tasks finish their final context switches, and its ops.cgroup_exit() must follow the last of them. tg on/offlining is excluded through cgroup_lock(), so either ordering against an rmdir of a subtree cgroup delivers balanced init/exit pairs. Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-07-19sched_ext: Deliver cgroup ops to each task_group's schedTejun Heo
With sub-schedulers claiming cgroup subtrees, cgroup ops must be delivered to each task_group's sched rather than always to root. Add tg->scx.sched to track which sched initialized the task_group. It is set and cleared together with SCX_TG_INITED. Deliver the ops accordingly: - ops.cgroup_exit() goes to the sched whose ops.cgroup_init() it pairs with. - ops.cgroup_prep_move/move/cancel_move() go to the task's sched, and only for moves that don't re-home the task. A re-homing move is reported through the ops.exit_task/init_task() pair instead. The cgroups passed to the move ops can be outside the sched's inited set as the cpu controller can be coarser than the sub-scheduler topology. - Knobs of a cgroup belong to the parent, so ops.set_weight/idle/bandwidth() go to the parent task_group's sched. All task_groups currently resolve to the root sched, so no behavior changes until sub-schedulers start claiming cgroups. While at it, scx_cgroup_init() is restructured so both paths share the recording. Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-07-19cgroup: Add cgroup_task_notifier and task migration eventsTejun Heo
A subsystem can attach to the cgroup hierarchy itself, independent of which controllers are enabled where - BPF hooks already behave this way and sched_ext sub-schedulers do too. Controller callbacks can't track task migrations for them: sched_ext must re-home a task whose migration crosses a sub-scheduler boundary, but the cpu controller's attach callbacks fire only when the task_group changes and miss moves whenever the controller topology is coarser than the sub-scheduler topology. Add cgroup_task_notifier with per-task migration events mirroring the can_attach/attach/cancel_attach phases so that a consumer which prepares per-task state can also veto a migration: CGROUP_TASK_MIGRATING fires pre-commit, CGROUP_TASK_MIGRATED post-commit and CGROUP_TASK_MIGRATE_CANCELED unwinds a failed migration. Only migrations that change a task's dfl cgroup are reported. Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-07-19lib/crypto: aes: Add XTS supportEric Biggers
Add support for AES-XTS to the crypto library. This will be used to provide a streamlined implementation of the "xts(aes)" crypto_skcipher algorithm. I'm also planning to use this directly in fscrypt and blk-crypto-fallback. As usual, the architecture-optimized AES-XTS code will be migrated into the library as well (using the hooks provided in this commit), eliminating lots of repetitive boilerplate code. Compared to direct implementation of "xts(aes)", I've also eliminated the requirement for architectures to implement ciphertext stealing, as the library just handles it portably instead. That will simplify things considerably. Initial test coverage is provided by the crypto_skcipher support added in a later commit. I'm planning a KUnit test suite as well. Link: https://patch.msgid.link/20260715221153.246410-6-ebiggers@kernel.org Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-07-19lib/crypto: aes: Add CTR and XCTR supportEric Biggers
Add support for AES-CTR and AES-XCTR to the crypto library. These will be used to provide streamlined implementations of the "ctr(aes)" and "xctr(aes)" crypto_skcipher algorithms. Most users of "ctr(aes)" will also be able to switch to the library, which as usual will be simpler and faster, e.g.: - net/mac80211/fils_aead.c - net/mac802154/llsec.c As usual, the architecture-optimized AES-CTR and AES-XCTR code will be migrated into the library as well (using the hooks provided in this commit), eliminating lots of repetitive boilerplate code. This is also a prerequisite for supporting AES-GCM, AES-CCM, and AES-HCTR2 in the crypto library. Initial test coverage is provided by the crypto_skcipher support added in a later commit. I'm planning a KUnit test suite as well. Reviewed-by: Thomas Huth <thuth@redhat.com> Link: https://patch.msgid.link/20260715221153.246410-5-ebiggers@kernel.org Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-07-19lib/crypto: aes: Add CBC and CBC-CTS supportEric Biggers
Add support for AES-CBC and AES-CBC-CTS to the crypto library. These will be used to provide streamlined implementations of the "cbc(aes)" and "cts(cbc(aes))" crypto_skcipher algorithms. Most users of these crypto_skcipher algorithms will also be able to switch to the library, which as usual will be simpler and faster, e.g.: - block/blk-crypto-fallback.c (for AES-128-CBC-ESSIV) - fs/crypto/crypto.c (for AES-128-CBC-ESSIV) - fs/crypto/fname.c (for AES-256-CTS and AES-128-CBC) - kernel/bpf/crypto.c - net/ceph/crypto.c - security/keys/encrypted-keys/encrypted.c As usual, the architecture-optimized AES-CBC and AES-CBC-CTS code will be migrated into the library as well (using the hooks provided in this commit), eliminating lots of repetitive boilerplate code. Initial test coverage is provided by the crypto_skcipher support added in a later commit. I'm planning a KUnit test suite as well. Reviewed-by: Thomas Huth <thuth@redhat.com> Link: https://patch.msgid.link/20260715221153.246410-4-ebiggers@kernel.org Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-07-19lib/crypto: aes: Add ECB supportEric Biggers
Add support for AES-ECB to the crypto library. This will be used to provide a streamlined implementation of the "ecb(aes)" crypto_skcipher algorithm. fs/crypto/keysetup_v1.c will also use aes_ecb_encrypt() directly. As usual, the architecture-optimized AES-ECB code will be migrated into the library as well (using the hooks provided in this commit), eliminating lots of repetitive boilerplate code. ECB is obsolete of course, but we need this for parity with the traditional API and to support some odd users of ECB in the kernel. Initial test coverage is provided by the crypto_skcipher support added in a later commit. I'm planning a KUnit test suite as well. Create a documentation file libcrypto-unauth-encryption.rst to hold the documentation for this and other unauthenticated encryption modes. Reviewed-by: Thomas Huth <thuth@redhat.com> Link: https://patch.msgid.link/20260715221153.246410-3-ebiggers@kernel.org Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-07-19crypto: xts - Split out __xts_verify_key() helperEric Biggers
Make the AES-XTS key verification code callable by the crypto library by splitting out a helper function that doesn't use crypto_skcipher. Reviewed-by: Thomas Huth <thuth@redhat.com> Link: https://patch.msgid.link/20260715221153.246410-2-ebiggers@kernel.org Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-07-19bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insnLeon Hwang
The BPF_MOV64_PERCPU_REG insn requires JIT to emit native code to for 'dst_reg = src_reg + <percpu_base_off>'. However, the interpreter ignores the 'off' at its ALU64_MOV_X label. The 'off' indicates the insn is BPF_MOV64_PERCPU_REG insn. Then, when the interpreter loads memory from the register, it will hit a page fault. [ 2.545572] BUG: unable to handle page fault for address: ffffffffacaaf034 [ 2.546485] #PF: supervisor read access in kernel mode [ 2.547167] #PF: error_code(0x0000) - not-present page [ 2.547850] PGD 134e63067 P4D 134e63067 PUD 134e64063 PMD 10021c063 PTE 800ffffeca550062 [ 2.548912] Oops: Oops: 0000 [#1] SMP PTI Set jit_required as true in order to disallow interpreter fallback in core.c::__bpf_prog_select_runtime(), if any BPF_ADDR_PERCPU insn is patched to the prog. BTW, rename the helper bpf_map_supports_cpu_flags() to bpf_map_is_percpu_map(). Fixes: 7bdbf7446305 ("bpf: add special internal-only MOV instruction to resolve per-CPU addrs") Signed-off-by: Leon Hwang <leon.hwang@linux.dev> Link: https://lore.kernel.org/bpf/20260715141122.15783-4-leon.hwang@linux.dev Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-18Merge tag 'scsi-fixes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "The biggest core change is the reliable wake fix for scsi_schedule_eh which is used by both libata and libsas which could otherwise cause error handler hangs due to rare races. All other fixes are in drivers (well except the export symbol removal) the next biggest being the target PR-OUT transportid parsing fix" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path scsi: elx: efct: Fix refcount leak in efct_hw_io_abort() scsi: elx: efct: Fix I/O leak on unsupported additional CDB scsi: core: wake eh reliably when using scsi_schedule_eh scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE scsi: target: Bound PR-OUT TransportID parsing to the received buffer scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() scsi: sg: Report request-table problems when any status is set scsi: ufs: core: tracing: Do not dereference pointers in TP_printk() scsi: bfa: Reduce kernel stack usage in bfa_fcs_lport_fdmi_build_portattr_block() scsi: xen: scsiback: Free the command tag on the TMR submit-failure path scsi: xen: scsiback: Free unsubmitted command instead of double-putting it scsi: core: Remove export for scsi_device_from_queue()
2026-07-17Merge branch 'for-7.2-fixes' into for-7.3Tejun Heo
Pull to receive: 477869bfafea ("sched_ext: Reject setting disallow from init_task outside the enable path") 5f8b69642d18 ("sched_ext: Take cgroup_lock() first in scx_cgroup_lock()") 8c13364db9c9 ("sched_ext: Skip sub-disable teardown for never-linked sub-schedulers") 5cdc92859809 ("sched_ext: Don't enable non-ext tasks in the sub-sched task loops") as dependencies for the upcoming cgroup migration patchset and to resolve the conflicts with the ext.c/sub.c split on for-7.3. 5f8b69642d18 comments scx_cgroup_lock() which for-7.3 exported for sub.c. Resolved by keeping the exported version with the comment. 8c13364db9c9 and 5cdc92859809 patch the pre-split sub-sched enable and disable paths in ext.c which for-7.3 moved to sub.c. Resolved by applying the never-linked teardown skip and the class gates to sub.c. Signed-off-by: Tejun Heo <tj@kernel.org>
2026-07-17sched_ext: Reject setting disallow from init_task outside the enable pathTejun Heo
The p->scx.disallow revert assumes the root enable path, where the switching loop reads the reverted policy right afterwards and leaves the task off SCX. The sub-scheduler disable path also reaches it when re-initializing the returned tasks on a root parent. Nothing reads the policy there: the task is enabled on root anyway and keeps running on the ext class with a silently rewritten policy. Kill the sched instead, matching the fork and non-root branches, and update the disallow documentation, which equated !fork with the load path and pointed at a stale debugfs path for nr_rejected. Fixes: 337ec00b1d9c ("sched_ext: Implement cgroup sub-sched enabling and disabling") Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-07-18ata: libata-eh: make ata_eh_qc_complete() and ata_eh_qc_retry() staticDamien Le Moal
The functions ata_eh_qc_complete() and ata_eh_qc_retry() are used only in libata-eh.c. So remove the declaration of these functions from include/linux/libata.h and define them as static. While at it, add a missing blank line between variable declaration and code in these two functions. No functional changes intended. Signed-off-by: Damien Le Moal <dlemoal@kernel.org> Reviewed-by: Niklas Cassel <cassel@kernel.org>
2026-07-18ata: libata-scsi: add support for the REMOVE ELEMENT AND MODIFY ZONES commandDamien Le Moal
Define the translation for the REMOVE ELEMENT AND MODIFY ZONES command (SERVICE ACTION IN command with service action SAI_REMOVE_ELEMENT_AND_MODIFY_ZONES) into the ATA command ATA_CMD_REMOVE_ELEMENT_AND_MODIFY_ZONES with the new function ata_scsi_remove_element_and_modify_zones_xlat() The array of supported commands ata_supported_cmds is modified to add a new entry for this command. ata_scsi_cmd_is_supported() is also modify to correctly handle this new entry depending on the target device flag ATA_DFLAG_DEPOP being set, and the target device being a ZAC zoned device. Signed-off-by: Damien Le Moal <dlemoal@kernel.org> Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> Reviewed-by: Hannes Reinecke <hare@kernel.org>
2026-07-18ata: libata-scsi: add support for the RESTORE ELEMENTS AND REBUILD commandDamien Le Moal
Define the translation for the RESTORE ELEMENTS AND REBUILD command (SERVICE ACTION IN command with service action SAI_RESTORE_ELEMENTS_AND_REBUILD) into the ATA command ATA_CMD_RESTORE_ELEMENTS_AND_REBUILD with the new function ata_scsi_restore_elements_and_rebuild_xlat() The array of supported commands ata_supported_cmds is modified to add a new entry for this command. ata_scsi_cmd_is_supported() is also modify to correctly handle this new entry depending on the target device flag ATA_DFLAG_DEPOP_RESTORE being set. The ATA command completion is handled using the function ata_scsi_depop_ua_cap_changed_complete() so that on a successful completion, a UNIT ATTENTION with the additional sense code set to CAPACITY DATA HAS CHANGED is raised. Signed-off-by: Damien Le Moal <dlemoal@kernel.org> Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> Reviewed-by: Hannes Reinecke <hare@kernel.org>
2026-07-18ata: libata-scsi: add support for the REMOVE ELEMENT AND TRUNCATE commandDamien Le Moal
Define the translation for the REMOVE ELEMENT AND TRUNCATE command (SERVICE ACTION IN command with service action SAI_REMOVE_ELEMENT_AND_TRUNCATE) into the ATA command ATA_CMD_REMOVE_ELEMENT_AND_TRUNCATE with the new function ata_scsi_remove_element_and_truncate_xlat() The array of supported commands ata_supported_cmds is modified to add a new entry for this command. ata_scsi_cmd_is_supported() is also modify to correctly handle this new entry depending on the target device flag ATA_DFLAG_DEPOP being set. The ATA command completion is handled using the function ata_scsi_depop_ua_cap_changed_complete() so that on a successful completion, a UNIT ATTENTION with the additional sense code set to CAPACITY DATA HAS CHANGED is raised. Signed-off-by: Damien Le Moal <dlemoal@kernel.org> Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> Reviewed-by: Hannes Reinecke <hare@kernel.org>
2026-07-18ata: libata-scsi: add support for the GET PHYSICAL ELEMENT STATUS commandDamien Le Moal
Define the translation for the GET PHYSICAL ELEMENT STATUS command (SERVICE ACTION IN command with service action SAI_GET_PHYSICAL_ELEMENT_STATUS) into the ATA command ATA_CMD_GET_PHYS_ELEMENT_STATUS with the new function ata_scsi_get_phys_element_status_xlat(). The reply of this function also needs translation from little endian to big endian. This is done with the completion callback ata_scsi_get_phys_element_status_complete(). The array of supported commands ata_supported_cmds is modified to add a new entry for this command. ata_scsi_cmd_is_supported() is also modified to correctly handle this new entry depending on the target device flag ATA_DFLAG_DEPOP being set. Signed-off-by: Damien Le Moal <dlemoal@kernel.org> Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> Reviewed-by: Hannes Reinecke <hare@kernel.org>
2026-07-18ata: libata-core: detect support for depopulation capabilitiesDamien Le Moal
Introduce the device flags ATA_DFLAG_DEPOP to indicate support by a device for the basic commands of the storage element depopulation feature set, that is, the GET PHYSICAL ELEMENT STATUS and REMOVE ELEMENT AND TRUNCATE commands. The device flag ATA_DFLAG_DEPOP_RESTORE flag is introduced to indicate support for the RESTORE ELEMENTS AND REBUILD command. Both flags are obtained from the command support bits of the qword at bytes 152 to 159 of the supported capabilities log page. For ZAC devices, the device flag ATA_DFLAG_DEPOP_MODIFY is introduced to indicate support for the REMOVE ELEMENT AND MODIFY ZONES command. This support is indicated by the REMOVE ELEMENT AND MODIFY ZONES SUPPORTED bit in the qword at byte 8 to 15 of the zoned device information log page. The function ata_dev_config_depop() is introduced to set these flags based on the content of the supported capabilities log and zoned device information log. As per the ACS specifications, NCQ autosense support is also mandatory if these flags are set. Signed-off-by: Damien Le Moal <dlemoal@kernel.org> Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> Reviewed-by: Hannes Reinecke <hare@kernel.org>
2026-07-18ata: libata: improve the definition of device flagsDamien Le Moal
The flags field of struct ata_device has the unsigned long type. Define all the ATA_DFLAG_XXX flags using a 1UL bit shift to match this type, thus avoiding flags to become signed values (e.g. for bit 31 flag). To avoid all other values defined in the same enum as the ATA_DFLAG_XXX flags to implicitly also become unsigned long values, move the device flags definition to a separate enum. Signed-off-by: Damien Le Moal <dlemoal@kernel.org> Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-18scsi: define depopulation capabilities related service actionsDamien Le Moal
Add to include/scsi/scsi_proto.h the definition of the four service actions of the SERVICE ACTION IN (16) command for the storage element depopulation and restoration capabilities, as defined in the SBC5 and ZBC2 specifications. These are: - SAI_GET_PHYSICAL_ELEMENT_STATUS (GET PHYSICAL ELEMENT STATUS command) - SAI_REMOVE_ELEMENT_AND_TRUNCATE (REMOVE ELEMENT AND TRUNCATE command) - SAI_RESTORE_ELEMENTS_AND_REBUILD (RESTORE ELEMENTS AND REBUILD command) - SAI_REMOVE_ELEMENT_AND_MODIFY_ZONES (REMOVE ELEMENT AND MODIFY ZONES command) The physical element types and physical element health values reported by the GET PHYSICAL ELEMENT STATUS command are also defined. Signed-off-by: Damien Le Moal <dlemoal@kernel.org> Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> Reviewed-by: Hannes Reinecke <hare@kernel.org>
2026-07-17Merge tag 'drm-fixes-2026-07-18-1' of https://gitlab.freedesktop.org/drm/kernelLinus Torvalds
Pull drm fixes from Daie Airlie: "Weekly drm fixes, there is amdgpu, xe and i915 and then a lot of scattered fixes. Looks about the right level for the new right. ttm: - Handle NULL pages and backup handles in ttm_pool_backup() correctly gpusvm: - Improve unmap and error handling on gpusvm udmabuf: - Always synchronize for CPU in begin_cpu_udmabuf xe: - Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOCK - Hold a dma-buf reference for imported BOs - Fix writable override for CRI - Fix VF CCS attach/detach race with in-flight BO moves - Fix WOPCM size for LNL+ - Reset current_op in xe_pt_update_ops_init - Keep scheduler timeline name alive - Hold device ref until queue teardown completes - Disable display in admin only PF mode i915: - NV12 display fix for bigjoiner - clear watermark on plane disable - GT selftest fixes host1x: - Fix UAF amdxdna - Fix UAF - Reject more invalid amdxdna command submissions ivpu: - Fix wrong read - Handle invalid firmware log in ivpu panthor: - Fix error handling virtio: - Fix virtio deadlock - Fix invalid gem detach amdgpu: - DCN 4.2 fixes - NUTMEG fixes - 8K panel fix - Backlight fixes - UserQ fix - Fix bo->pin leaking in amdgpu_bo_create_reserved() - VFCT fixes - devcoredump fixes - Display fixes - SMU7 DPM fix - AC/DC fixes for SMU7 and SI - Queue reset fix - PCIe DPM fix - XHCI/GPU resume ordering fix - Pageflip timeout fix amdkfd: - Fix potential overflow in CWSR size calculation - DQM error clean up fixes * tag 'drm-fixes-2026-07-18-1' of https://gitlab.freedesktop.org/drm/kernel: (61 commits) Revert "drm/amd/display: Restore 5s vbl offdelay for NV3x+ DGPUs" drm/amd/display: check GRPH_FLIP status before sending event drm/amd/display: consolidate DCN vblank/flip handling onto vupdate_no_lock drm/amd: Create a device link between APU display and XHCI devices drm/amd/display: wire DCN42B mcache programming callback drm/amd/display: set new_stream to NULL after release drm/amd/display: Force PWM backlight on Lenovo Legion 5 15ARH05 drm/amdkfd: free MQD managers on DQM init failures drm/amdgpu/ttm: Consider concurrent VM flushes for buffer entities drm/amd/pm/smu7: Fix AC/DC switch notification drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge drm/amdgpu: always emit the job vm fence drm/amd/pm/si: Fix AC/DC switch notification drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized drm/amd/display: dce100: skip non-DP stream encoders for DP MST drm/amd/display: Set native cursor mode for disabled CRTCs drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) drm/amd/display: fix __udivdi3 link error drm/amdgpu: Reserve space for IB contents in devcoredumps drm/amdgpu: Print vmid, pasid and more task info in devcoredump ...
2026-07-17drm/amd/display: Force PWM backlight on Lenovo Legion 5 15ARH05Alessandro Rinaldi
The Lenovo Legion 5 15ARH05 (Renoir) ships a BOE 0x08DF eDP panel that advertises AUX/DPCD backlight control, so amdgpu's automatic detection (amdgpu_backlight == -1) selects AUX. On this panel the AUX backlight path has no effect: brightness writes are accepted but the panel level never changes, the display is stuck at a fixed brightness and max_brightness is reported as a bogus 511000. As a result neither the desktop brightness slider nor the brightness hotkeys do anything. Forcing PWM backlight (amdgpu.backlight=0) restores working control: max_brightness becomes 65535 and the level tracks writes. This has long been applied by users as a manual kernel-parameter workaround. Extend the generic panel backlight quirk with a force_pwm flag, add an entry for the Legion 5 15ARH05 / BOE 0x08DF panel, and have amdgpu disable AUX backlight (use PWM) when the quirk matches and the user lets the driver auto-select the backlight type. Signed-off-by: Alessandro Rinaldi <ale@alerinaldi.it> Tested-by: Alessandro Rinaldi <ale@alerinaldi.it> Reviewed-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 81b39f43e7e53589491e2eef6bad5389626b4b9c) Cc: stable@vger.kernel.org
2026-07-17Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 7.2-rc4Kumar Kartikeya Dwivedi
Cross-merge BPF and other fixes after downstream PR. Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-17Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpfLinus Torvalds
Pull bpf fixes from Kumar Kartikeya Dwivedi: - Fix a UAF in socket clone early bailout paths (Matt Bobrowski) - Reject unhashed UDP sockets on sockmap update to prevent refcount leaks (Michal Luczaj) - Account for receive queue data in FIONREAD on sockmap sockets without a verdict program (Mattia Meleleo) - Reject negative constant offsets for verifier buffer pointers (Sun Jian) - Fix for tracing of kfuncs with implicit arguments (Ihor Solodrai) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: selftests/bpf: Cover tracing implicit kfunc args bpf: Fix tracing of kfuncs with implicit args selftests/bpf: Cover negative buffer pointer offsets bpf: Reject negative const offsets for buffer pointers selftests/bpf: Test FIONREAD on a sockmap socket without a verdict program bpf, sockmap: Account for receive queue in FIONREAD without a verdict program selftests/bpf: Fail unbound UDP on sockmap update selftests/bpf: Adapt sockmap update error handling bpf, sockmap: Reject unhashed UDP sockets on sockmap update selftests/bpf: Ensure UDP sockets are bound bpf: Fix UAF in sock clone early bailouts
2026-07-17Merge tag 'net-7.2-rc4' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from Wireless, IPsec, Netfilter and Bluetooth. Current release - new code bugs: - netfilter: flowtable: use correct direction to set up tunnel route Previous releases - regressions: - wifi: - mac80211: - free AP_VLAN bc_buf SKBs outside IRQ lock - defer link RX stats percpu free to RCU - fix double free on alloc failure - cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock - ipv4: free fib_alias with kfree_rcu() on insert error path - sched: act_tunnel_key: Defer dst_release to RCU callback - xfrm: fix sk_dst_cache double-free in xfrm_user_policy() - bluetooth: fix locking in unpair_device/disconnect_sync - can: add locking for raw flags bitfield - openvswitch: reject oversized nested action attrs - eth: - bnxt_en: handle partially initialized auxiliary devices - ppp: defer channel free to an RCU grace period to fix UAF Previous releases - always broken: - netfilter: xt_nat: reject unsupported target families - wifi: - brcmfmac: fix heap overflow on a short auth frame - cfg80211: add missing FTM API validation - xfrm: - reject optional IPTFS templates in outbound policies - policy: preallocate inexact bins before xfrm_hash_rebuild reinsert - bluetooth: revalidate LOAD_CONN_PARAM queued update - can: fix lockless bound/ifindex race and silent RX_SETUP failure - eth: mlx5: free mlx5_st_idx_data on final dealloc" * tag 'net-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (108 commits) mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n llc: fix SAP refcount leak when creating incoming sockets selftests: netconsole: only restore MAC when it changed on resume bnxt_en: Handle partially initialized auxiliary devices sctp: fix auth_hmacs array size in struct sctp_cookie net/sched: act_tunnel_key: Defer dst_release to RCU callback dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() tcp: fix TIME_WAIT socket reference leak on PSP policy failure net/mlx5: free mlx5_st_idx_data on final dealloc can: isotp: serialize TX state transitions under so->rx_lock can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER can: isotp: use unconditional synchronize_rcu() in isotp_release() can: bcm: track a single source interface for ANYDEV timeout/throttle ops can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() can: bcm: fix stale rx/tx ops after device removal can: bcm: add missing device refcount for CAN filter removal can: bcm: validate frame length in bcm_rx_setup() for RTR replies can: bcm: extend bcm_tx_lock usage for data and timer updates can: bcm: add missing rcu list annotations and operations can: bcm: fix CAN frame rx/tx statistics ...
2026-07-17drm/ttm/pool: back up at native page orderMatthew Brost
ttm_pool_split_for_swap() unconditionally splits high-order pool pages into order-0 pages before backup, so every compound the shrinker touches is shattered even when the rest of the system would prefer it stay intact. Under sustained kswapd pressure this fragments memory enough to drive other parts of MM into recovery loops. Back up each compound at its native order instead. In ttm_pool_backup(), hand the full compound to the new ttm_backup_backup_folio(), which backs up subpages to a contiguous range of shmem indices and returns the base handle plus the number of subpages actually backed up (@nr_backed). On full success, free the compound once at its native order -- no split_page(), no per-4K refcount juggling. A per-folio backup can't be made fully atomic under memory pressure: ttm_backup_backup_folio() must allocate shmem folios before source subpages can be released, so under true OOM any subpage may fail while the rest of the compound is still live. Two mechanisms handle this without regressing reclaim behaviour: - alloc_gfp gets __GFP_NOMEMALLOC whenever order > 0 (cleared again for order-0), so a high-order backup fails fast with -ENOMEM instead of draining kernel reserves, leaving them for other allocations under the same pressure. - If ttm_backup_backup_folio() still returns a short @nr_backed with a valid handle for the successfully-backed prefix, split the source compound with ttm_pool_split_for_swap(), free the prefix as order-0 pages (already safely in shmem), and retry the remaining subpages at order 0, where __GFP_NOMEMALLOC is cleared and reserves may be used as a last resort. This preserves the original split-on-OOM fallback while keeping the common case fragmentation-free, and preserves the "partial backup is allowed" contract (shrunken is incremented per subpage backed up). The restore-side leftover-page split in ttm_pool_restore_commit() is left as-is: it's unreachable in practice and not worth complicating the restore state machine to avoid. Testing: the existing backup_fault_inject point only truncated tt->num_pages, which never exercised the reactive split path above since it never left a compound partially backed up. Wire fault injection into ttm_backup_backup_folio() itself: past the first subpage of a compound, synthesize a -ENOMEM in place of shmem_read_folio_gfp() when should_fail() trips, producing the same short @nr_pages_backed a real failure would and forcing ttm_pool_backup() through the split-and-retry path. The fault_attr stays private to ttm_pool.c; ttm_backup.c reaches it through ttm_backup_fault_inject_folio(), declared in ttm_pool_internal.h. While converting the writeback branch to operate on the whole folio, the unlock condition after shmem_writeout() also changed from `if (ret)` to `if (ret == AOP_WRITEPAGE_ACTIVATE)`, matching the actual contract: shmem_writeout()/swap_writeout() only leave the folio locked when returning AOP_WRITEPAGE_ACTIVATE; any other return (including a hard error from arch_prepare_to_swap()) means the folio was already unlocked internally. The old `if (ret)` check would have double- unlocked in that hard-error case. Cc: Christian Koenig <christian.koenig@amd.com> Cc: Huang Rui <ray.huang@amd.com> Cc: Matthew Auld <matthew.auld@intel.com> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Cc: Maxime Ripard <mripard@kernel.org> Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: David Airlie <airlied@gmail.com> Cc: Simona Vetter <simona@ffwll.ch> Cc: dri-devel@lists.freedesktop.org Cc: linux-kernel@vger.kernel.org Cc: stable@vger.kernel.org Fixes: b63d715b8090 ("drm/ttm/pool, drm/ttm/tt: Provide a helper to shrink pages") Suggested-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Link: https://patch.msgid.link/20260716201358.4086085-1-matthew.brost@intel.com
2026-07-17Merge tag 'soc-fixes-7.2-1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC fixes from Arnd Bergmann: "There are only three devicetree fixes this time: one critical memory corruption fix for Renesas and three minor corrections for Tegra. The MAINTAINERS file is updated for a new maintainer of the CIX platform and two address changes. The rest is all driver fixes, mostly firmware: - multiple runtime issues in ARM SCMI and FF-A firmware code, dealing with error handling for corner cases in firmware. - multiple fixes for reset drivers, dealing with individual platform specific mistakes and more error handling - minor build and runtime fixes for the Tegra SoC drivers" * tag 'soc-fixes-7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: arm64: dts: renesas: ironhide: Describe inline ECC carveouts MAINTAINERS: Update maintainer and git tree for CIX SoC ARM: Don't let ARMv5 platforms select USE_OF MAINTAINERS: Update SpacemiT SoC git tree repository firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context firmware: arm_scmi: Use 64-bit division for clock rate rounding reset: imx7: Correct polarity of MIPI CSI resets on i.MX8MQ reset: sunxi: fix memory region leak on ioremap failure dt-bindings: reset: altr: add COMBOPHY_RESET for Agilex5 reset: spacemit: k3: fix USB2 ahb reset firmware: arm_scmi: Grammar s/may needed/may be needed/ firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits arm64: tegra: Fix CPU1 node unit-address on Tegra264 arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234 MAINTAINERS: .mailmap: update Jens Wiklander's email address soc/tegra: fuse: Fix spurious straps warning on SMCCC platforms soc/tegra: pmc: fix #ifdef block in header drm/tegra: Fix a strange error handling path arm64: tegra: Remove fallback compatible for GPCDMA
2026-07-17mtd: nand-omap2: Move omap_nand_ids[] to raw nand driverUwe Kleine-König (The Capable Hub)
Defining a static array in a header results in each .c file that includes the header (here: drivers/memory/omap-gpmc.c and drivers/mtd/nand/raw/omap2.c) to contain a copy of that array when compiled to an object file. With sizeof(struct of_device_id[3]) ≥ 588 having omap_nand_ids[] twice just to do two string comparisons is quite some bloat. So move omap_nand_ids[] to the nand driver which actually needs that array for its module meta data and do the compatible check by hand. bloat-o-meter reports for drivers/memory/omap-gpmc.o (ARCH=arm): add/remove: 1/2 grow/shrink: 1/0 up/down: 28/-588 (-560) Function old new delta gpmc_probe_generic_child 2108 2136 +28 omap_nand_ids 588 - -588 Total: Before=18114, After=17554, chg -3.09% (drivers/mtd/nand/raw/omap2.o doesn't change). This allows to drop <linux/mod_devicetable.h> from include/linux/platform_data/mtd-nand-omap2.h (which is my original motivation for this change). Note that this header isn't needed in the two drivers because omap-gpmc.c doesn't use any device id struct and for the nand driver omap2.c of_device_id is already provided via <linux/platform_device.h>. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-07-17mtd: rawnand: qcom: Make has_onfi_read_op separate from qpic_version2Stephan Gerhold
QPIC v1.5 requires using the OP_PAGE_READ_ONFI_READ command, but is missing the rest of the hardware changes that are currently covered by the QPIC v2 (qpic_version2) check in the driver. Split that into an extra has_onfi_read_op feature flag so it can be separately enabled. No functional change. Reviewed-by: Manivannan Sadhasivam <mani@kernel.org> Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-07-17greybus: Drop #include of <linux/mod_devicetable.h>Uwe Kleine-König (The Capable Hub)
The header itself also includes <linux/types.h> and additional to that doesn't make use of any symbol defined (transitively) by <linux/mod_devicetable.h>. Also the .c files that include that header don't need it (there is no direct include, only via <linux/greybus.h>): $ git grep -l greybus\\.h | xargs grep -E "\<(acpi_device_id|amba_id|ap_device_id|apr_device_id|auxiliary_device_id|bcma_device_id|ccw_device_id|cdx_device_id|coreboot_device_id|css_device_id|dfl_device_id|dmi_(device|system)_id|eisa_device_id|fsl_mc_device_id|hda_device_id|hid_device_id|hv_vmbus_device_id|i2c_device_id|i3c_device_id|ieee1394_device_id|input_device_id|ipack_device_id|isapnp_device_id|ishtp_device_id|mcb_device_id|mdio_device_id|mei_cl_device_id|mhi_device_id|mips_cdmm_device_id|of_device_id|parisc_device_id|pci_device_id|pci_epf_device_id|pcmcia_device_id|platform_device_id|pnp_(card_)?device_id|rio_device_id|rpmsg_device_id|sdio_device_id|sdw_device_id|serio_device_id|slim_device_id|spi_device_id|spmi_device_id|ssam_device_id|ssb_device_id|tb_service_id|tee_client_device_id|typec_device_id|ulpi_device_id|usb_device_id|vchiq_device_id|virtio_device_id|wmi_device_id|x86_(cpu|device)_id|zorro_device_id|cpu_feature)\>" drivers/greybus/es2.c:static const struct usb_device_id id_table[] = { drivers/greybus/es2.c: const struct usb_device_id *id) drivers/greybus/gb-beagleplay.c:static const struct of_device_id gb_beagleplay_of_match[] = { drivers/staging/greybus/arche-platform.c:static const struct of_device_id arche_platform_of_match[] = { drivers/greybus/es2.c includes <linux/usb.h>, drivers/greybus/gb-beagleplay.c includes <linux/serdev.h> which provides of_device_id via <linux/device.h>, similar drivers/staging/greybus/arche-platform.c includes <linux/platform_device.h> which also provides of_device_id. So the #include can go away without further adaption. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Link: https://patch.msgid.link/80964227feede2d8f1978f13f4219fcf9e63d8d0.1783354012.git.u.kleine-koenig@baylibre.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17misc: amd-sbi: Add SBTSI ioctl register transfer interfacePrathima
Implement IOCTL interface for SB-TSI driver to enable userspace access to TSI register read/write operations through the AMD Advanced Platform Management Link (APML) protocol. Add an ioctl command (SBTSI_IOCTL_REG_XFER_CMD) that accepts a register address, data byte, and direction flag. The mutex is taken on the ioctl path here; the hwmon path is placed under the same lock in the next patch, which completes serialization between the hwmon and ioctl paths. Reviewed-by: Akshay Gupta <Akshay.Gupta@amd.com> Signed-off-by: Prathima <Prathima.Lk@amd.com> Link: https://patch.msgid.link/20260710111642.850022-7-Akshay.Gupta@amd.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17misc: amd-sbi: Add support for SB-TSI over I3CPrathima
AMD SB-TSI temperature sensors can be accessed over both I2C and I3C buses depending on the platform configuration. Extend the SB-TSI driver to support both I2C and I3C bus interfaces by selecting the appropriate transport based on the probed bus type. The driver maintains backward compatibility with existing I2C deployments while enabling support for systems using the I3C bus. Register both I2C and I3C drivers using module_i3c_i2c_driver() and update the Kconfig dependency from I2C to I3C_OR_I2C. Reviewed-by: Akshay Gupta <Akshay.Gupta@amd.com> Signed-off-by: Prathima <Prathima.Lk@amd.com> Link: https://patch.msgid.link/20260710111642.850022-6-Akshay.Gupta@amd.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17misc: amd-sbi: Consolidate Common SBTSI Probe PathPrathima
Refactor shared probe procedures into sbtsi_probe_common() to ensure that I2C and I3C probes focus solely on bus-specific allocation and device configuration. The utility function reads the configuration register via sbtsi_xfer(), initializes ext_range_mode and read_order, assigns the driver data, and registers the hwmon auxiliary device. Routing register access through sbtsi_xfer() keeps the probe path bus-agnostic, so no transfer logic has to be duplicated when SB-TSI over I3C support is added in a later patch. Reviewed-by: Akshay Gupta <Akshay.Gupta@amd.com> Signed-off-by: Prathima <Prathima.Lk@amd.com> Link: https://patch.msgid.link/20260710111642.850022-5-Akshay.Gupta@amd.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17hwmon/misc: amd-sbi: Move sbtsi register transfer to core abstractionPrathima
Move the I2C read/write byte operations from the sbtsi hwmon driver into a common sbtsi_xfer() function in tsi-core.c. This decouples the hwmon sensor driver from the underlying bus transport, preparing for I3C support in a subsequent patch. This patch does not introduce any functional changes. The updates are limited to code organization/cleanup and should not affect the runtime behavior of the driver Reviewed-by: Akshay Gupta <Akshay.Gupta@amd.com> Signed-off-by: Prathima <Prathima.Lk@amd.com> Acked-by: Guenter Roeck <linux@roeck-us.net> Link: https://patch.msgid.link/20260710111642.850022-4-Akshay.Gupta@amd.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17hwmon/misc: amd-sbi: Move core sbtsi support from hwmon to miscPrathima
Move SBTSI(Side-Band Temperature Sensor Interface) core functionality out of the hwmon-only path and into drivers/misc/amd-sbi so it can be reused by non-hwmon consumers. I2C probe parsing is moved from drivers/hwmon/sbtsi_temp.c into drivers/misc/amd-sbi/tsi.c under CONFIG_AMD_SBTSI. The core driver stores struct sbtsi_data on the bus device and registers an auxiliary device amd-sbtsi.temp-sensor.<addr> per target. The current hwmon temp sensor will now require the CONFIG_AMD_SBTSI configuration as a new dependency. This split prepares the driver for additional interfaces while keeping hwmon support in hwmon subsystem on top of common SBTSI core logic. Add platform dependencies to clarify this driver is intended to run on the BMC and not on the managed node. Reviewed-by: Akshay Gupta <Akshay.Gupta@amd.com> Signed-off-by: Prathima <Prathima.Lk@amd.com> Acked-by: Guenter Roeck <linux@roeck-us.net> Link: https://patch.msgid.link/20260710111642.850022-2-Akshay.Gupta@amd.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17issei: initial driver skeletonAlexander Usyskin
The ISSEI (Intel Silicon Security Engine Interface) subsystem provides a communication channel between the host and the Silicon Security Engine. Prepare basic driver functions and character device for user-space communication. Add DMA access routines for ISSEI HECI devices. Add of DMA-related structures and implementation of routines for setting up DMA, as well as reading and writing DMA buffers. Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com> Co-developed-by: Vitaly Lubart <lubvital@gmail.com> Signed-off-by: Vitaly Lubart <lubvital@gmail.com> Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com> Link: https://patch.msgid.link/20260513-issei-for-upstream-v1-1-f590038678f9@intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17net: phy: at803x: Use a helper to check for phy reset existenceMaxime Chevallier
The at803x family of devices are subjected to an errata that requires hard-reseting the PHY upon link change. That can only work if there's a physical reset line wired to the PHY, which the driver checks by looking if there's a reset GPIO configured for the MDIO device. The reset may however be controlled through a reset controller, which isn't accounted for in the errata handling. Besides that, PHY drivers aren't expected to directly access the mdiodev's resources directly, let's therefore wrap this with a phylib helper, that uses a similar mdio helper to check for reset existence. This was found in preparation for bus-level resource management for better mdio scan support. Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de> Link: https://patch.msgid.link/20260715101355.88536-1-maxime.chevallier@bootlin.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17Merge patch series "software node: provide support for fw_devlink"Danilo Krummrich
Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> says: Currently only devicetree systems have their devices' probe ordered against their suppliers automatically by fw_devlink. Software nodes have lately been used extensively treewide to describe references to resource suppliers: most notably, the GPIO subsystem uses it in many places. Now that the conversion of "dangling" GPIO chip software nodes to using real links is almost done, it makes sense to ensure no needless probe deferrals by implementing the add_links() callback from the fwnode interface. This series extends software node support to use fw_devlink and adds test coverage for the new behaviour. Caveats: a supplier software node must be registered before the consumer device is added, If the swnode is registered after the consumer was added, add_links() has already run and set FWNODE_FLAG_LINKS_ADDED, so the late supplier is missed. Graph/remote- endpoint ordering is left out for now as well as there are no known users. Link: https://patch.msgid.link/20260713-swnode-fw-devlink-v4-0-d4f2dee27ad9@oss.qualcomm.com Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-07-17dmaengine: Constify struct dma_descriptor_metadata_opsChristophe JAILLET
'struct dma_descriptor_metadata_ops' in not modified in these drivers. Constifying these structures moves some data to a read-only section, so increases overall security, especially when the structure holds some function pointers. On a x86_64, with allmodconfig, as an example: Before: ====== text data bss dec hex filename 120635 21584 64 142283 22bcb drivers/dma/xilinx/xilinx_dma.o After: ===== text data bss dec hex filename 120699 21520 64 142283 22bcb drivers/dma/xilinx/xilinx_dma.o Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Reviewed-by: Frank Li <Frank.Li@nxp.com> Reviewed-by: Sai Sree Kartheek Adivi <s-adivi@ti.com> Reviewed-by: Manivannan Sadhasivam <mani@kernel.org> Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com> Link: https://patch.msgid.link/b0a22171f3ed68e156a2fa84383e99c23ec6b2ff.1784037977.git.christophe.jaillet@wanadoo.fr Signed-off-by: Vinod Koul <vkoul@kernel.org>