Commit graph

1,462,183 commits

Author SHA1 Message Date
Pawel Zalewski (The Capable Hub)
73b6bf3c31 ata: use named initializers for acpi_device_id
Use a named initializer for the acpi_device_id fields which makes the code
more readable and consistent with how lists are initialized in the rest of
the kernel code base. Also drop explicitly setting fields to 0 where it is
redundant.

While we are at it - unify the list terminator to have a single space
between the brackets and no trailing comma.

Signed-off-by: Pawel Zalewski (The Capable Hub) <pzalewski@thegoodpenguin.co.uk>
Reviewed-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
2026-08-04 18:48:43 +09:00
Rosen Penev
c303c3619a ata: pata_ep93xx: fix PIO fallback when DMA init fails
ep93xx_pata_dma_init() returns an error when dma_request_chan() fails,
which causes ep93xx_pata_probe() to abort entirely.  The probe function
already has a PIO fallback path (it checks both channel pointers before
enabling UDMA), so the DMA init should not fail the probe on non-fatal
errors.

Propagate -EPROBE_DEFER, such that we allow the DMA controller driver
to load, in case we got probed before the DMA controller driver.
For all other failures (e.g. -ENODEV when the DMA controller is missing
in the device tree), fall back to PIO.

Assisted-by: Opencode:Big-Pickle
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
2026-07-23 16:40:05 +09:00
Rosen Penev
43ea91dadb ata: pata_pxa: use devres for DMA channel management
Convert the DMA channel request to devm_dma_request_chan() so the
channel is released automatically on device teardown. This removes
the explicit dma_release_channel() calls in the probe error paths
and in pxa_ata_remove(), simplifying the driver.

Use ata_platform_remove_one() which is now equivalent to what remains of
the remove function after dma_release_channel() removal.

Built as a module for arm/pxa_defconfig (CONFIG_PATA_PXA=m) with
LLVM=1 W=1; no new warnings.

Assisted-by: opencode:hy3-free
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
2026-07-23 16:40:05 +09:00
Richard Weinberger
4a2e540947 ata: libata-sff: don't busy-wait for PIO data-in command completion
Unlike PIO data-out, the PIO data-in protocol raises no completion
interrupt, the last interrupt announces the final data block, and once
the host has drained it from the data register the ending status must
be obtained synchronously.  ata_sff_hsm_move() does this by spinning
in ata_wait_idle() for up to 10ms.

Usually this is not a big deal unless the device is slow.  In my case
it's a CF card which keeps BSY asserted for multiple milliseconds(!)
after the final data block.  Since the waiting happens in the
interrupt handler, under the port lock with interrupts disabled, the
CPU is hogged for milliseconds on every read command.

To improve the situation, bound the inline wait to ~100us.  If the
device is still busy after that, mark the command ATA_TFLAG_POLLING,
so the interrupt handler won't race for it, and obtain the ending
status via ata_sff_pio_task(), which sleeps between status checks
instead of spinning with the lock held.

Since ata_sff_pio_task() may now finish a data-in command, it must
wait for both BSY and DRQ to clear at HSM_ST_LAST, matching what
ata_wait_idle() enforced.

Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
2026-07-21 08:55:31 +09:00
Rosen Penev
5e8e8c42ce ata: ahci_da850: use devm_platform_ioremap_resource()
Replace the open-coded platform_get_resource(IORESOURCE_MEM, 1) plus
devm_ioremap() sequence with devm_platform_ioremap_resource(pdev, 1),
which looks up resource index 1 (the power-down control register),
reserves it and maps it in one call, returning an ERR_PTR checked with
IS_ERR()/PTR_ERR(). Resource index 0 (the AHCI register block) is still
mapped separately as hpriv->mmio via ahci_platform_get_resources().

Built for ARM (davinci_all_defconfig + CONFIG_AHCI_DA850) with LLVM=1;
drivers/ata/ahci_da850.o compiles cleanly.

Assisted-by: opencode:hy3-free
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
2026-07-18 11:58:16 +09:00
Rosen Penev
a807f19c0e ata: sata_highbank: use devm_platform_ioremap_resource
Replace the open-coded platform_get_resource() plus devm_ioremap()
sequence with devm_platform_ioremap_resource(), which fetches the
resource, requests the region and maps it in one call. Switch the error
check to IS_ERR()/PTR_ERR() and drop the now-unused struct resource
pointer.

There is a single IORESOURCE_MEM resource, and the SATA PHY registers
are mapped separately via of_iomap() from distinct DT nodes, so the
region reservation added by devm_ioremap_resource() is exclusive and
does not introduce overlap failures.

The mem-based ata_port_desc() line is dropped along with the resource
pointer; the remaining per-port description is retained.

Built for ARM (drivers/ata/sata_highbank.o) with LLVM=1.

Assisted-by: opencode:hy3-free
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
2026-07-18 11:58:16 +09:00
Rosen Penev
6f9fb3cf93 ata: pata_pxa: use devm_platform_ioremap_resource
Replace the open-coded platform_get_resource() plus devm_ioremap()
sequences for the CMD and CTL ports with devm_platform_ioremap_resource(),
which fetches the resource, requests the region and maps it in one call.
Switch the error checks to IS_ERR()/PTR_ERR() accordingly and drop the
now-unused cmd_res and ctl_res variables.

The DMA port keeps using devm_ioremap() as its resource is
IORESOURCE_DMA. The CMD (res 0) and CTL (res 1) MEM resources are
disjoint in the ATA task-file layout, so the added region reservation
in devm_ioremap_resource() does not introduce overlap failures.

Built for ARM (drivers/ata/pata_pxa.o) with LLVM=1.

Assisted-by: opencode:hy3-free
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
2026-07-18 11:58:16 +09:00
Rosen Penev
da75bb1116 ata: pata_rb532_cf: use devm_platform_ioremap_resource()
Replace the open-coded platform_get_resource() plus devm_ioremap()
sequence with a single devm_platform_ioremap_resource() call, which folds
the resource lookup and mapping into one step and returns an ERR_PTR on
failure, checked with IS_ERR() and propagated via PTR_ERR(). Similar to
platform_get_irq(), it can return -EPROBE_DEFER so move it early.

The pata-rb532-cf platform device (arch/mips/rb532/devices.c) provides a
single IORESOURCE_MEM window at the DEV1BASE chip-select, distinct from
the other RB532 chip-selects, so the region reservation now performed by
devm_platform_ioremap_resource() introduces no conflict. The mapped size
is unchanged. Drop the redundant error message, as
devm_platform_ioremap_resource() already logs on failure.

Built for MIPS (rb532_defconfig) with LLVM=1;
drivers/ata/pata_rb532_cf.o compiles cleanly.

Assisted-by: opencode:hy3-free
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
2026-07-18 11:58:16 +09:00
Rosen Penev
427ac6f5ff ata: sata_mv: use devm clock helpers
Replace clk_get/clk_prepare_enable/clk_put with
devm_clk_get_optional_enabled for both the main clock and
per-port clocks. This eliminates the need for manual clock
cleanup in probe error and remove paths.

The err label is retained for phy_power_off cleanup, since
devm_phy_optional_get does not manage phy power state.

Assisted-by: opencode:big-pickle
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
2026-07-18 11:58:16 +09:00
Rosen Penev
692a964305 ata: sata_mv: Use platform_get_irq() to get interrupt
Extract platform_get_irq() out of the conditional block to run it
unconditionally, replacing the direct use of irq_of_parse_and_map()
for DT-based systems. This simplifies the probe logic and avoids the
need for irq_dispose_mapping.

Remove dead branch for platform_get_irq(). It intercepts 0 and returns
-EINVAL, which goes to the first one.

Assisted-by: Antigravity:Gemini-3.5-Flash
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
2026-07-18 11:58:16 +09:00
Pan Chuang
5aef4cb321 ata: pata_mpc52xx: Remove redundant dev_err()
Since commit 55b48e23f5 ("genirq/devres: Add error handling in
devm_request_*_irq()"), devm_request_irq() automatically logs detailed
error messages on failure. Remove the now-redundant driver-specific
dev_err() call.

Signed-off-by: Pan Chuang <panchuang@vivo.com>
Reviewed-by: Hannes Reinecke <hare@kernel.org>
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
2026-07-18 10:09:19 +09:00
Damien Le Moal
9bf9aefdc0 ata: libata-eh: make ata_eh_qc_complete() and ata_eh_qc_retry() static
The functions ata_eh_qc_complete() and ata_eh_qc_retry() are used only in
libata-eh.c. So remove the declaration of these functions from
include/linux/libata.h and define them as static. While at it, add a
missing blank line between variable declaration and code in these two
functions.

No functional changes intended.

Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Niklas Cassel <cassel@kernel.org>
2026-07-18 10:09:19 +09:00
Damien Le Moal
b448bb42bd ata: libata-scsi: add support for the REMOVE ELEMENT AND MODIFY ZONES command
Define the translation for the REMOVE ELEMENT AND MODIFY ZONES command
(SERVICE ACTION IN command with service action
SAI_REMOVE_ELEMENT_AND_MODIFY_ZONES) into the ATA command
ATA_CMD_REMOVE_ELEMENT_AND_MODIFY_ZONES with the new function
ata_scsi_remove_element_and_modify_zones_xlat()

The array of supported commands ata_supported_cmds is modified to add a
new entry for this command. ata_scsi_cmd_is_supported() is also modify to
correctly handle this new entry depending on the target device flag
ATA_DFLAG_DEPOP being set, and the target device being a ZAC zoned device.

Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Reviewed-by: Hannes Reinecke <hare@kernel.org>
2026-07-18 10:09:15 +09:00
Damien Le Moal
1e307ca61a ata: libata-scsi: add support for the RESTORE ELEMENTS AND REBUILD command
Define the translation for the RESTORE ELEMENTS AND REBUILD command
(SERVICE ACTION IN command with service action
SAI_RESTORE_ELEMENTS_AND_REBUILD) into the ATA command
ATA_CMD_RESTORE_ELEMENTS_AND_REBUILD with the new function
ata_scsi_restore_elements_and_rebuild_xlat()

The array of supported commands ata_supported_cmds is modified to add a
new entry for this command. ata_scsi_cmd_is_supported() is also modify to
correctly handle this new entry depending on the target device flag
ATA_DFLAG_DEPOP_RESTORE being set.

The ATA command completion is handled using the function
ata_scsi_depop_ua_cap_changed_complete() so that on a successful
completion, a UNIT ATTENTION with the additional sense code set to
CAPACITY DATA HAS CHANGED is raised.

Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Reviewed-by: Hannes Reinecke <hare@kernel.org>
2026-07-18 10:09:10 +09:00
Damien Le Moal
db496721cb ata: libata-scsi: add support for the REMOVE ELEMENT AND TRUNCATE command
Define the translation for the REMOVE ELEMENT AND TRUNCATE command
(SERVICE ACTION IN command with service action
SAI_REMOVE_ELEMENT_AND_TRUNCATE) into the ATA command
ATA_CMD_REMOVE_ELEMENT_AND_TRUNCATE with the new function
ata_scsi_remove_element_and_truncate_xlat()

The array of supported commands ata_supported_cmds is modified to add a
new entry for this command. ata_scsi_cmd_is_supported() is also modify to
correctly handle this new entry depending on the target device flag
ATA_DFLAG_DEPOP being set.

The ATA command completion is handled using the function
ata_scsi_depop_ua_cap_changed_complete() so that on a successful
completion, a UNIT ATTENTION with the additional sense code set to
CAPACITY DATA HAS CHANGED is raised.

Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Reviewed-by: Hannes Reinecke <hare@kernel.org>
2026-07-18 10:09:06 +09:00
Damien Le Moal
0f0bfa1bca ata: libata-scsi: add support for the GET PHYSICAL ELEMENT STATUS command
Define the translation for the GET PHYSICAL ELEMENT STATUS command
(SERVICE ACTION IN command with service action
SAI_GET_PHYSICAL_ELEMENT_STATUS) into the ATA command
ATA_CMD_GET_PHYS_ELEMENT_STATUS with the new function
ata_scsi_get_phys_element_status_xlat(). The reply of this function also
needs translation from little endian to big endian. This is done with the
completion callback ata_scsi_get_phys_element_status_complete().

The array of supported commands ata_supported_cmds is modified to add a
new entry for this command. ata_scsi_cmd_is_supported() is also modified
to correctly handle this new entry depending on the target device flag
ATA_DFLAG_DEPOP being set.

Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Reviewed-by: Hannes Reinecke <hare@kernel.org>
2026-07-18 10:09:01 +09:00
Damien Le Moal
4ba5eb54c2 ata: libata-core: detect support for depopulation capabilities
Introduce the device flags ATA_DFLAG_DEPOP to indicate support by a device
for the basic commands of the storage element depopulation feature set,
that is, the GET PHYSICAL ELEMENT STATUS and REMOVE ELEMENT AND TRUNCATE
commands. The device flag ATA_DFLAG_DEPOP_RESTORE flag is introduced to
indicate support for the RESTORE ELEMENTS AND REBUILD command. Both flags
are obtained from the command support bits of the qword at bytes 152 to
159 of the supported capabilities log page.

For ZAC devices, the device flag ATA_DFLAG_DEPOP_MODIFY is introduced to
indicate support for the REMOVE ELEMENT AND MODIFY ZONES command. This
support is indicated by the REMOVE ELEMENT AND MODIFY ZONES SUPPORTED bit
in the qword at byte 8 to 15 of the zoned device information log page.

The function ata_dev_config_depop() is introduced to set these flags
based on the content of the supported capabilities log and zoned device
information log. As per the ACS specifications, NCQ autosense support is
also mandatory if these flags are set.

Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Reviewed-by: Hannes Reinecke <hare@kernel.org>
2026-07-18 10:08:56 +09:00
Damien Le Moal
19598e92c8 ata: libata-scsi: improve ata_get_xlat_func
ata_get_xlat_func() is given only the opcode of a SCSI command to
determine the ATA command to translate to. This makes it impossible to
translate SCSI commands such as SERVICE ACTION IN which need a service
action field to fully specify the command.

In preparation for supporting the translation of the SERVICE ACTION IN
command with service actions different from the SAI_READ_CAPACITY_16 (READ
CAPACITY 16), change ata_get_xlat_func() to take a pointer to a SCSI
command CDB so that all fields of the SCSI command to translate can be
easily inspected.

Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Reviewed-by: Hannes Reinecke <hare@kernel.org>
2026-07-18 10:08:52 +09:00
Damien Le Moal
ee1badfde3 ata: libata: improve the definition of device flags
The flags field of struct ata_device has the unsigned long type. Define
all the ATA_DFLAG_XXX flags using a 1UL bit shift to match this type, thus
avoiding flags to become signed values (e.g. for bit 31 flag).

To avoid all other values defined in the same enum as the ATA_DFLAG_XXX
flags to implicitly also become unsigned long values, move the device
flags definition to a separate enum.

Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-18 10:08:52 +09:00
Damien Le Moal
2a0adbb80a scsi: define depopulation capabilities related service actions
Add to include/scsi/scsi_proto.h the definition of the four service
actions of the SERVICE ACTION IN (16) command for the storage element
depopulation and restoration capabilities, as defined in the SBC5 and
ZBC2 specifications. These are:
 - SAI_GET_PHYSICAL_ELEMENT_STATUS (GET PHYSICAL ELEMENT STATUS command)
 - SAI_REMOVE_ELEMENT_AND_TRUNCATE (REMOVE ELEMENT AND TRUNCATE command)
 - SAI_RESTORE_ELEMENTS_AND_REBUILD (RESTORE ELEMENTS AND REBUILD command)
 - SAI_REMOVE_ELEMENT_AND_MODIFY_ZONES (REMOVE ELEMENT AND MODIFY ZONES
   command)

The physical element types and physical element health values reported by
the GET PHYSICAL ELEMENT STATUS command are also defined.

Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Reviewed-by: Hannes Reinecke <hare@kernel.org>
2026-07-18 10:08:46 +09:00
Damien Le Moal
7c8b3f6578 scsi: scsi_debug: move ASC and ASCQ definitions to scsi_proto.h
The scsi_debug driver internally defines lots of SCSI additional sense
codes (ASC) and additional sense code qualifiers (ASCQ). Move these
definitions to include/scsi/scsi_proto.h so that they can be reused
elsewhere in the SCSI and ATA code. This also makes the scsi_debug.c file
a little smaller.

Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-13 13:58:51 +09:00
Niklas Cassel
e64e6b5dc8 ata: libata-scsi: scale DSM TRIM payload by MAX PAGES PER DSM COMMAND
DSM TRIM currently always emits a single 512-byte page of LBA Range Entries
(ATA_MAX_TRIM_RNUM == 64 ranges), regardless of how many pages the device
can accept in one DATA SET MANAGEMENT command.

The maximum is reported by MAX PAGES PER DSM COMMAND (IDENTIFY DEVICE word
105).  Honour it: size the TRIM descriptor as a whole number of 512-byte
pages, bounded by that limit and by the logical sector size (the WRITE SAME
data-out buffer is a single logical block).  Build and transfer only as
many pages as the request needs, and set the DSM COUNT field, qc->nbytes
and the maximum WRITE SAME length in the Block Limits VPD page accordingly.

Build the descriptor straight into the WRITE SAME data-out buffer using an
atomic sg_miter mapping, instead of staging it in the shared ata_scsi_rbuf
and copying it out.  This removes the global ata_scsi_rbuf_lock and a
memcpy from the TRIM path.

While commit 9379e6b8e0 ("libata: Safely overwrite attached page in WRITE
SAME xlat") replaced direct access to the data-out buffer with an
intermediate step that writes the entries in the ata_scsi_rbuf buffer, this
solution writes to the data-out buffer using sg_miter, which maps each
segment with kmap_atomic (SG_MITER_ATOMIC), so it's highmem- and
multi-segment-safe, and it's usable from the non-sleeping
command-submission path (unlike the page_address() access that
ata_scsi_rbuf originally replaced).

A 512-byte-sector device still uses a single page, so its behaviour is
unchanged.

Add ata_id_dsm_max_pages() to read IDENTIFY DEVICE word 105.

Reviewed-by: Hannes Reinecke <hare@kernel.org>
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
2026-07-06 10:19:16 +09:00
Niklas Cassel
79cce911e6 ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes
ata_scsi_write_same_xlat() translates a SCSI WRITE SAME command with the
UNMAP bit set into an ATA DATA SET MANAGEMENT TRIM command.  The TRIM
descriptor is built by ata_format_dsm_trim_descr() into the 2048-byte
ata_scsi_rbuf staging buffer, and the number of bytes copied is compared
against the logical sector size by the caller:

	size = ata_format_dsm_trim_descr(scmd, trmax, block, n_block);
	if (size != len)		/* len == sdp->sector_size */
		goto invalid_param_len;

ata_format_dsm_trim_descr() clamps the copy length to ATA_SCSI_RBUF_SIZE
(2048).  On a device whose logical sector size exceeds that (e.g. a 4Kn
device, where sector_size == 4096) the function can never return more than
2048, while the caller expects it to return sector_size.  The comparison
therefore always fails, so every TRIM is rejected with "Parameter list
length error" and WARN_ON() splats on each attempt.  TRIM / discard is
thus completely broken on such devices.

The descriptor was incorrectly sized from the logical sector size.  A DSM
TRIM payload is a list of 512-byte pages, each holding up to
ATA_MAX_TRIM_RNUM (64) LBA Range Entries, and is independent of the logical
sector size.  The Block Limits VPD page already advertises a single such
page as the maximum WRITE SAME length (65535 * ATA_MAX_TRIM_RNUM logical
blocks), so the block layer never sends a request that needs more than one
page.

Emit exactly one 512-byte page, independent of the logical sector size,
and transfer only that page (COUNT == 1).  For a 512-byte-sector device
this is unchanged; devices with larger logical sectors now work instead of
failing every TRIM.

Reviewed-by: Hannes Reinecke <hare@kernel.org>
Fixes: ef2d7392c4 ("libata: SCT Write Same / DSM Trim")
Cc: stable@vger.kernel.org
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
2026-07-06 10:19:16 +09:00
Damien Le Moal
81ab2321c1 ata: libata-scsi: support the all command format for reporting supported commands
Add support to ata_scsi_report_supported_opcodes() for the all command
format indicated with a reporting option of 0. The function
ata_scsi_report_all_supported_opcodes() is introduced to implement this
support. This function operates by testing all commands of the
ata_supported_cmds array and testing them using
ata_scsi_cmd_is_supported(), filling rbuf as it loops through all the
commands that libata can emulate or translate.

With this change, sg_opcodes /dev/sdX is able to list all commands
supported by libata and a device. An example below is shown for a SATA
disk also supporting CDL:

  # sg_opcodes /dev/sda
    ATA       WDC  WUH722626AL  WZ41
    Peripheral device type: disk

  Opcode  Service    CDB  RWCDLP,  Name
  (hex)   action(h)  size   CDLP
  -----------------------------------------------
   00                  6    0,0    Test Unit Ready
   01                  6    0,0    Rezero Unit
   03                  6    0,0    Request Sense
   08                  6    0,0    Read(6)
   0a                  6    0,0    Write(6)
   0b                  6    0,0    Seek(6)
   12                  6    0,0    Inquiry
   15                  6    0,0    Mode select(6)
   1a                  6    0,0    Mode sense(6)
   1b                  6    0,0    Start stop unit
   1d                  6    0,0    Send diagnostic
   25                 10    0,0    Read capacity(10)
   28                 10    0,0    Read(10)
   2a                 10    0,0    Write(10)
   2b                 10    0,0    Seek(10)
   2f                 10    0,0    Verify(10)
   35                 10    0,0    Synchronize cache(10)
   55                 10    0,0    Mode select(10)
   5a                 10    0,0    Mode sense(10)
   7f     1ff0        32    0,0    ATA pass-through(32)
   85                 16    0,0    ATA pass-through(16)
   88                 16    1,1    Read(16)
   8a                 16    1,2    Write(16)
   8f                 16    0,0    Verify(16)
   91                 16    0,0    Synchronize cache(16)
   9e       10        16    0,0    Read capacity(16)
   a0                 12    0,0    Report luns
   a1                 12    0,0    ATA pass-through(12)
   a3        c        12    0,0    Report supported operation codes

Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Hannes Reinecke <hare@kernel.org>
2026-07-06 10:19:16 +09:00
Damien Le Moal
bff44d253f ata: libata-scsi: support reporting options 2 in REPORT SUPPORTED OPERATION CODES
Add support for the reporting options value 2 of the in REPORT SUPPORTED
OPERATION CODES command in ata_scsi_report_supported_opcodes(). With this
reporting option, the specified opcode to check must have a service
action. Use ata_scsi_supported_cmd_has_sa() to check for this and fill the
command reply buffer using the one command format based on the command
support.

Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Hannes Reinecke <hare@kernel.org>
2026-07-06 10:19:16 +09:00
Damien Le Moal
eac22d76d9 ata: libata-scsi: improve service action support in ata_scsi_report_supported_opcodes()
ata_scsi_report_supported_opcodes() is ignoring the service action
specified in the SCSI command CDB, but the one command format must take
this field into consideration. With the reporting options field set to 1,
the REPORT SUPPORTED OPERATION CODES command must be failed if the
specified opcode to check has service actions, while reporting option 3
must match supported opcodes together with the specified service action.

Stop ignoring the service action by passing it to
ata_scsi_cmd_is_supported() and searching for commands in the
array of supported commands (ata_supported_cmds) using both the command
opcode and service action.

Introduce the helper function ata_scsi_supported_cmd_use_sa() to determine
if a particular command has service actions and use this function to fail
a REPORT SUPPORTED OPERATION CODES command if such command is specified
with reporting options 1.

Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Hannes Reinecke <hare@kernel.org>
2026-07-06 10:19:16 +09:00
Damien Le Moal
1128f29f99 ata: libata-scsi: refactor ata_scsi_report_supported_opcodes()
ata_scsi_report_supported_opcodes() is very limited in functionality as it
lacks support for the all command format and also does not handle
correctly commands that have a service action.

In preparation for adding these missing features, refactor how
ata_scsi_report_supported_opcodes() operates to make modifications and
extensions easier. To do so, introduce the array of supported commands
ata_supported_cmds. This array entries are of type struct ata_scsi_cmd.
This structure stores the operation code, CDB length, and the service
action of a supported SCSI command that libata SAT can translate or
emulate. Since some service actions (e.g. ZI_REPORT_ZONES) can have a
value of 0, the field sa_valid of struct ata_scsi_cmd is used to indicate
if the sa field is valid, or if it should be ignored.

The helper function ata_scsi_get_supported_cmd() is implemented to search
for a particular command by opcode in this array. This function is used in
ata_scsi_cmd_is_supported() together with a struct ata_scsi_cmd_support to
check based on the target device features if the specified command is
supported.

ata_scsi_cmd_is_supported() is used as the main function in
ata_scsi_report_supported_opcodes() to determine if a particular command
is supported and fill the command reply rbuf as needed. In the case of a
command that is not supported, the support field is set to 1 as specified
in SPC, indicating that the command is not supported.

Of note is that the old ata_scsi_report_supported_opcodes() code did not
handle the VARIABLE_LENGTH_CMD/ATA_32 command which is supported and
translated by libata-scsi. The ata_supported_cmds array includes this
command. As commented in the code, WRITE_SAME_16 is left out of the array
of supported command ata_scsi_write_same_xlat() prevents the use of this
command as a passthrough command.

Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Hannes Reinecke <hare@kernel.org>
2026-07-06 10:19:16 +09:00
Damien Le Moal
13d5478d9b ata: libata: rename ata_dev_is_zac()
The helper function ata_dev_is_zac() checks if a device is a ZAC class
device (host managed zoned disk) or if it is a host aware zoned disk, that
is, a regular ATA disk that supports the zoned capabilities. So the name
of this helper function is confusing as it hints at the first case only.

Rename this helper function to ata_dev_is_zoned() to avoid confusions and
better reflect the two cases tested. Use this helper in
ata_scsiop_inq_std(), ata_scsiop_read_cap() and
ata_scsi_report_supported_opcodes() instead of having the same tests open
coded.

While at it, to stay consistent with this renaming, also rename
ata_dev_config_zac() to ata_dev_config_zoned().

Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Hannes Reinecke <hare@kernel.org>
2026-07-06 10:19:16 +09:00
Linus Torvalds
8cdeaa50ea Linux 7.2-rc2 v7.2-rc2 2026-07-05 14:44:06 -10:00
Linus Torvalds
f105f3631d - Prevent OOB access in the resctrl code while offlining
CPUs when Intel SNC (Sub-NUMA Clustering) is enabled
    (Reinette Chatre)
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmpKEsURHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1gcWhAApp+w5vUx0FXlou1Mzvn63bXey9/CMXyX
 rrUeWA+ic7PpNvImuwixdyPyS1CnF2l7lMcmOtiNE4wnRvCf+0rsrwgYy4m4qd/2
 aLAftFDp9WhKKH3Bb6gnVfMXiXmYb4eCQO0pRhJY26QtVJ2RGkbenW/TdTnAAAwS
 KO8bJGsllufiF0+k4G5YMgiVcgZFByn/nuqmzvIc+oKQt5LSMvkKijoM7ozX9q5g
 c1ABWvag3KWU2gFI00GfvzuQ7n7ckGhBVRwtO9DMox68liOlKOHedEFF0A0+KiDt
 fk6b2LFbqm6hB7TpWRQqQ+rPusbDdAVxKG8ehIkjR8BD49VwzZUcr5kiWS5/xplm
 a9F7cJpAJiuSiTi2HYtQVOlrCujonmjt11qqj3cCCjkton+IC9twhDkrj6+Kxygq
 W3oc8Gia2JWoFBNt/6l0iKRJjluqgPJ8crPHpnDr4C5KEnsEIqCQsSPsVjoYM5mY
 +xwS9jMJM7Dhrw3OZ6b5D8jY9oonBM/BB+jMomQ9ncDijUwKybgqp0JXB/3ydIw3
 ci69tewFdVD+9EyNAz+dqANuhNyF1JTFza/5QxAU88E1wp2O2WjahSPvkNU/ekNK
 jDGLf8VyiI08bH2pyYIhEhcvmTZ5Ocyuj9zA4Ufi2V3gaDMkvMXRipxm50dAhaWG
 CMoZ+wTnI/8=
 =mae/
 -----END PGP SIGNATURE-----

Merge tag 'x86-urgent-2026-07-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull x86 fix from Ingo Molnar:

 - Prevent OOB access in the resctrl code while offlining
   CPUs when Intel SNC (Sub-NUMA Clustering) is enabled
   (Reinette Chatre)

* tag 'x86-urgent-2026-07-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled
2026-07-05 05:37:46 -10:00
Linus Torvalds
c10dc5c03e Misc perf events fixes:
- Fix a perf_event_attr::remove_on_exec bug for group
    events (Taeyang Lee)
 
  - Fix uprobes CALL emulation interaction with shadow stacks,
    and add a testcase for this (David Windsor)
 
  - Fix uprobes unregister bug (Jiri Olsa)
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmpKCX8RHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1hwJRAAne1HniwuV9PV2GQHNKipeKV320tod2iR
 WY9yy9ez5WJbPttS7Fy28NobQKxuTanNWnAJqqM3TJF0tPPSrrYqkhAGrpEb2ab0
 G7gl4KlrO//5kKTZnnI86t/quSV5BDt00UUdMBFp+hbNYXNul5/AeUxqMhNoGqB6
 DpJHrV+7kNQZ4I7tjatYWL11hZHpEhrx4QWLUsnd+nDwddpmdsRNXVZwpGh9+Dh4
 +XXcgLD7M8FqNFN3GCVfhJKO8x8HRaBWv3FHeGqbCUL9k5viWcn+N91IbrcPVat1
 HBk0JDtpLK286WHLFy7uROafCA59AlYp5DX7mobXi0VF1FdMqPtjaXEsZM7Ng/P5
 /tpbV5P4irrUnMSCEDSDzqZJWXbcBSqCJ9p6z5/Tjzo3VegHyrXe29wjVoqvXjLx
 og/9OnPZv/2QEsE37rBRwNC889ihFMUDZh3T+uUc1YKUEwYWFXwtUECTg+0Oi+lL
 mLTdK05j/6NmVkcY77mFjQfTMFAZeD78g6cPY3yDHiHRFtxPOIhknCKBeLD5BjXD
 tz08x3MN0ItVEBXfuKAlkb1KPhHy8x02IrpdfVojoQ7lUBRH/JqLvnSGgvVsRM+0
 v9D3N9BAuB3s8DmxEdh0wyRzISl6jzBHJDJ83+uWSfZWLlEW+RVn9NbH2ubNU/jt
 FO3U81r1MvE=
 =Mb4z
 -----END PGP SIGNATURE-----

Merge tag 'perf-urgent-2026-07-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull perf events fixes from Ingo Molnar:

 - Fix a perf_event_attr::remove_on_exec bug for group events
   (Taeyang Lee)

 - Fix uprobes CALL emulation interaction with shadow stacks, and
   add a testcase for this (David Windsor)

 - Fix uprobes unregister bug (Jiri Olsa)

* tag 'perf-urgent-2026-07-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  uprobes/x86: Use proper mm_struct in __in_uprobe_trampoline
  selftests/x86: Add shadow stack uprobe CALL test
  x86/uprobes: Keep shadow stack in sync for emulated CALLs
  perf/core: Detach event groups during remove_on_exec
2026-07-05 05:34:43 -10:00
Linus Torvalds
fe5881ed72 - Fix a futex-requeue deadlock detection regression
(Thomas Gleixner)
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmpKCDcRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1jyeA//UjX1T39xy3suH0on24bO4aiMe9I/+rSD
 cSYRE7di8o/B6W8emvnrL1qumt18fO2wVbV84WpVJEznuphoVRR8CveOcISyBlmt
 Ea73S80RX5hDyJAkCSY4ttAFFyULTPE+gvTrP2lagNRV2S0K+80lqtZxRIiL7IYU
 ElVbCoeMUm+5mOFQ8t6KdkNxNJudceQEO7KY0xu3k3qUL1CDFWO6XYY3cdhfYirO
 z2A4k4nFp9i+FrvJxPG2BF6KboNbXukdBYWIecFdoTHK2r2n81ZFBodlQFYuB3/o
 g6Gv73rcCr2mKxrMiKO5LUBoxsbLbbchxF4dZROktf8h54v/qwcHWLSZDDerhXyX
 zk92iw//N71HO+3ktJdmfXxN2sk0ZZy2Yt5bgdMGvTZIoSbwklIEMn67mlQQqB5X
 bKsZWWgiH/tN7z/JN6JQZ2+J1F7lTwrx/bJ4iriy79iIjPAYbne1OSM9j1/ycWgN
 9u1fpcd3lcK4W3A3DUE1AJnmGw+NwDPHipoD5lk5wAdQGSpeIH712kKB05eIonIa
 l8dF7ZDgKVDSLDfcqoHfbKGPxm06NZuSc4VL9+YSftV7YeRhpDPP6gti/aaYBtew
 0Bz5uBR9Sptvi+GsHNiblkEsNVkS5SSbvs0wkgxLHd22nVRO9bi1SdMSWLeI7PDn
 LzJpjnA+5Cs=
 =JNeN
 -----END PGP SIGNATURE-----

Merge tag 'locking-urgent-2026-07-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull futex fix from Ingo Molnar:

 - Fix a futex-requeue deadlock detection regression (Thomas Gleixner)

* tag 'locking-urgent-2026-07-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock""
2026-07-05 05:31:41 -10:00
Linus Torvalds
610533cb3b Misc irqchip driver fixes:
- Fix a resource leak in the RISC-V imsic-early driver
    (Haoxiang Li)
 
  - Fix an OF node reference leak in the ARM gic-v3-its driver
    (Yuho Choi)
 
  - Fix a dangling handler function on module removal bug in
    the TS-4800 ARM board irqchip driver (Qingshuang Fu)
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmpKBtQRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1jUjRAAjiQDEcEdOsNtx7WEmi077EX32qv6ZQ2L
 rn15M3sJyFS/XlZNYhgNa5DQ+8BsmHxZY5FjUW/VvQ6tQop+KbH83WjUDG3wnZYz
 TZzZHR2I3k6tjJc3eAccJphn/2e4jDfkMcBy+Ao4Zbgxc6ntpXKxMRTNAFDd1p+1
 OHPk7P7e4YJ4YcskJNxcbQ1zeg8d07NQa4tAoIEGrAx0LPcKW61jp7DW+AL/y/dc
 MjAmNL7e+pMfGOQHKBk2iXS7oX9OiNf4oWbHQA60GQsrngRb41sF1SJ9kcKbb4vl
 K/Pe8s0uH68g9bYARTFUbh2zuIEK36PmLNvF0lIhm3QEmaT57a+n4b3AzSCFOlLD
 WnLWpRAog5aEw6RNu/WHTnhwV2FZMY9ivwVncL75GDlepCzMiGHGNLnv2hDs3Dqz
 ogiZ1BseAnFKWXbhjuaYJApv+Z3pUqIhGvbQ0TmMa6K1f8O2cWaCWJedJ7tK1C1F
 jj2ijSkKP1+3DM1yOZ8cLJ5g+Ci4bRtUDWjA3TzJ1q6eI4Fys3YpHWzF4to9qbqH
 8wtGgI7CH8aXr4wWwUYxWEljhc8t+El7mE4ZndFMbMX6m0LsYP6eYRipDJefa2BR
 L0IcxiW+FtAq9A6iqdH2nVdldVrIGAZ0yIwDlkSOxb46ac/mlNVIOafs319wci1K
 LU9T/ZT8p5w=
 =aWLS
 -----END PGP SIGNATURE-----

Merge tag 'irq-urgent-2026-07-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull irq fixes from Ingo Molnar:
 "Misc irqchip driver fixes:

   - Fix a resource leak in the RISC-V imsic-early driver (Haoxiang Li)

   - Fix an OF node reference leak in the ARM gic-v3-its driver (Yuho
     Choi)

   - Fix a dangling handler function on module removal bug in the
     TS-4800 ARM board irqchip driver (Qingshuang Fu)"

* tag 'irq-urgent-2026-07-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  irqchip/ts4800: Fix missing chained handler cleanup on remove
  irqchip/gic-v3-its: Fix OF node reference leak
  irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failure
2026-07-05 05:29:41 -10:00
Linus Torvalds
216a8b2179 sound fixes for 7.2-rc2
A standard set of driver-specific fixes and quirks accumulated since
 the merge window:
 
 ASoC:
 - SOF: Sanity check to prevent OOB reads
 - rsnd: Fix clock leak and double-disable issues with PM
 - tas675x: Misc fixes for register fields, etc
 - lpass-va-macro: Correct codec version for Qualcomm SC7280
 - amd-yc: DMIC quirk for Alienware m15 R7 AMD
 
 Others:
 - us144mkii: Fix a UAF on disconnect and anchor list corruption
 - HD-audio: Realtek quirks for HP models
 -----BEGIN PGP SIGNATURE-----
 
 iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmpKCqgOHHRpd2FpQHN1
 c2UuZGUACgkQLtJE4w1nLE+lgBAAk83zPbT+2y7L7GewxT2QTwOj5WMudl6q9RBp
 sDfT8sabkVGs68IoWBVijn6H8n7Jy9V9OVqm+I1j/53mcQl4haLiW+Uk0hcOlN1N
 UOySZLQusv+UOM7eVOpfvfb+rdx0MiGOr3NZeFD5tyIfhcMjhJ0NRDFHUDu1W3YU
 7BRCOqX1xchsYAnGEdI/otb1d2rEHlg4bRUYMqanfOO1mAayfd2kw3RkVlEF4dW9
 +8SoVdxWNOueIuq1WWU3DI/nE5Lq0la3ZsHulKTVkfKW3wlBsFhbk5tbWPBC123o
 odz71gpoM1wNM10ANWniJoZ3FlUSvKc2N3gJfKgYVp/EWSzFAp01BYpqm4JA8Iq7
 EAX7vNj+4wA4HMZYg20vGaj9dekZ15jrro9Xy8sg1+8TSC377xIpXBo1WA470YrS
 /B1UCvhhaYmao0tTTsChaDEcBI0OWgS+OagWDijPz8ASwskNOczVeBhE4HxgHidd
 eq4IqXcK+qakTcNc6d8AdFdOog8PekUqE+ZaSPkrW7P/QIYKgWEAXfpu0f2IaK8k
 3S15xQAg4dvkGAz4+vOWvZfJSP1P1xRabuSNftEgZk8UvlAoIwMZSuoB7uazt61n
 4La6BdPHiY//qmco9rV310YHYQE6uISFEPgs0xxKAHWYeTNRfhACDClm8U905Jo2
 LZH9c5g=
 =eXcj
 -----END PGP SIGNATURE-----

Merge tag 'sound-7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "A standard set of driver-specific fixes and quirks accumulated since
  the merge window:

  ASoC:
   - SOF: Sanity check to prevent OOB reads
   - rsnd: Fix clock leak and double-disable issues with PM
   - tas675x: Misc fixes for register fields, etc
   - lpass-va-macro: Correct codec version for Qualcomm SC7280
   - amd-yc: DMIC quirk for Alienware m15 R7 AMD

  Others:
   - us144mkii: Fix a UAF on disconnect and anchor list corruption
   - HD-audio: Realtek quirks for HP models"

* tag 'sound-7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ASoC: rsnd: src: Add missing scu_supply clock to suspend/resume
  Documentation: sound: tas675x: Fix temperature range and impedance documentation
  ASoC: codecs: tas675x: Fix CHx temperature range register bit fields
  ASoC: codecs: tas675x: use READ_ONCE for params to be used concurrently
  ASoC: rsnd: adg: make rsnd_adg_clk_control() idempotent
  ASoC: SOF: validate probe info element counts
  ALSA: usx2y: us144mkii: fix work UAF on disconnect
  ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table
  ALSA: hda/realtek: Add quirk for HP Victus 16-e0xxx (88EE) to enable mute LED
  MAINTAINERS: ASoC: SOF: add AMD reviewer for Sound Open Firmware
  ASoC: codecs: lpass-va-macro: Fix LPASS Codec Version for SC7280
  ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmission
2026-07-05 05:26:45 -10:00
Linus Torvalds
9c9330c764 spi: Fixes for v7.2
A small set of fixes that came in since -rc1, we have one core fix for
 shutting down target mode properly if the system suspends while it's
 running plus a small set of fairly unremarkable device specific fixes.
 There's also a couple of pure DT binding changes for Renesas SoCs, the
 power domains one allows some SoCs to be correctly described with
 existing code.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmpKRNUACgkQJNaLcl1U
 h9DGTAf9GNwul6yPo0ybe0uwbkuymsUhkf6oWz8qVPY4nFiQfP+pGiFae7gJrST7
 gCeyTlqPT2549MpxgsJwxCdsAaX4VuJbdwY1U8OVeg5VCtVmv/geDweJBXax5uHR
 EKayi1W8wGrdt+xReDvbcqS9T+kwyRWxrrWRi7HIz7P4Lbziq8naQaPQ6LODnHnT
 h5/M9nr4VjQh+kSHIIOyHlN10hQR256XRHoZY6e7yQmJfzxayN9NTw7MmIw7kE3P
 ZztQT8VcqaT4hlsJYZKLC9anSeWz03aTnJ3lPpKy935Od1PktElGEV6SLgbX/hEZ
 QI6rjVNbe3UT5fiy+PjMDSl67II+DA==
 =wCwg
 -----END PGP SIGNATURE-----

Merge tag 'spi-fix-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi

Pull spi fixes from Mark Brown:
 "A small set of fixes that came in since -rc1, we have one core fix for
  shutting down target mode properly if the system suspends while it's
  running plus a small set of fairly unremarkable device specific fixes.
  There's also a couple of pure DT binding changes for Renesas SoCs, the
  power domains one allows some SoCs to be correctly described with
  existing code"

* tag 'spi-fix-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
  spi: rzv2h-rspi: Fix DMA transfer error handling for signal interruption
  spi: dt-bindings: snps,dw-apb-ssi: add 'power-domains' property
  spi: dt-bindings: snps,dw-apb-ssi: drop superfluous RZ/N1 entry
  spi: dw: use the correct error msg if request_irq() fails
  spi: dw: fix first spi transfer with dma always fallback to PIO
  spi: core: Abort active target transfer on controller suspend
  spi: sh-msiof: abort transfers when reset times out
2026-07-05 05:24:06 -10:00
Linus Torvalds
7404ce5163 s390 updates for 7.2-rc2
- Fix PKEY_VERIFYPROTK ioctl key type handling by removing the generic
   key-length based type check with its wrong bit-size calculation,
   and leaving protected key verification to the pkey handler
 
 - Fix monwriter buffer reuse by rejecting records that change the data
   length, preventing out of bounds user copy into the kernel buffer
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEE3QHqV+H2a8xAv27vjYWKoQLXFBgFAmpJMw4ACgkQjYWKoQLX
 FBg7mwf/V8AKr7uPTvCMEvPUrgFPz1NWE0Eg4UZb5WYoToP6HwMMJpkkBcuWDcpT
 L7UVkXczlzhd4QqjftmVSVd8ea3MT+IZQ8W6TVEM+zgu3kYuLT0JC2POUTwIS5D+
 boYruqFfH4Cn2DRacOEV8dRfHNVyrZ4MdWEQnHTtJ0n6dxT1O93aH4YfAPhRrT57
 LEf4PnnWTza/xWF5Huyk5pXmNjrwsF63djwh7YSHIOxMfG4mK3h/cQzu/sEwKMWs
 Q5wPqhl8U20WG8fc8bi+VpfEI/v7ajjZm7mIYC09t2ymVSqz85wzaDk9igeSvv7i
 bsy26udNG4XjmwFNbJSz8JOyaph8LA==
 =AWqj
 -----END PGP SIGNATURE-----

Merge tag 's390-7.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux

Pull s390 fixes from Vasily Gorbik:

 - Fix PKEY_VERIFYPROTK ioctl key type handling by removing the generic
   key-length based type check with its wrong bit-size calculation, and
   leaving protected key verification to the pkey handler

 - Fix monwriter buffer reuse by rejecting records that change the data
   length, preventing out of bounds user copy into the kernel buffer

* tag 's390-7.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390/monwriter: Reject buffer reuse with different data length
  pkey: Move keytype check from pkey api to handler
2026-07-04 06:28:45 -10:00
Linus Torvalds
410430b616 collected fixes for 7.2
-----BEGIN PGP SIGNATURE-----
 
 iQJOBAABCAA4FiEEbt46xwy6kEcDOXoUeZbBVTGwZHAFAmpIu3UaHHRzYm9nZW5k
 QGFscGhhLmZyYW5rZW4uZGUACgkQeZbBVTGwZHC8MRAAmzNvYJhYC+4wnvzTv3q0
 kzsVgAkQaYQT5mwRjRBjZ4dX396s+zvFtXKJ3/DBZ/cluBOAOCf9sXCpVbKHKCq3
 y2n8kxTMT1Z4w1blbpK0BXLbJec2Kij5tnqLewWfg+Q08sodmBaahX0/41VBjLkl
 ldvtOaWwrW1vKY/67WS9GOA8W+YcmuMIPZFvEXHxWZ/kEGo0Te5jPD595FF5LENe
 G1c9W6tmlYuQnbwJHbTAnpLhVzeDuXVbVf6zpvnqqakAYEhA15f/FO1AiFLIlCUT
 Eimbc+MXpYmOfN1I+pDCxt6BMQDZ4jFhfmbtonFUnmRZ4B7nB4OlUHjz1gK8ipMZ
 yWu2NQRXXsb5ABJY2MWFvQEkMiyMHWOmjvtT8Ptfj7mnztSuXZLTXTbECz3OBIXr
 KqHK/9j2CLVLs8/RorDLh0VGuPJ2TtVryMGMQ5SSV3KvkLPrDLBgpxL5z3uPLoC6
 Vrh13Zb/TDLubAiKvIepbB31sWECLS12d+btvKfFBChIkKsAhAlYtcjp5yfg9UgP
 Rj95UGwPgnNmQ8I0B0Wa+dNIA6pDHFp5x0ZHHLYfUcjPgf9GL1NhEYD1N43/bOi0
 TqrPgsBKWRwDpLAmojnIpgJrUC3P6KL04jRhhDBWTRoYkQ55lrTH22Sb3QNo2xLN
 CLg/1pGpdAiWUV8FmssP140=
 =fR8s
 -----END PGP SIGNATURE-----

Merge tag 'mips-fixes_7.2_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux

Pull MIPS fixes from Thomas Bogendoerfer.

* tag 'mips-fixes_7.2_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux:
  MIPS: configs: Enable the current Ingenic USB PHY symbol
  MIPS: loongson64: add IRQ work based on self-IPI
  MIPS: mm: Add check for highmem before removing memory block
  mips: Add build salt to the vDSO
  MIPS: DEC: Ensure RTC platform device deregistration upon failure
2026-07-04 06:05:28 -10:00
Linus Torvalds
1e9cdc2ea1 16 ksmbd server fixes
-----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmpIIEQACgkQiiy9cAdy
 T1F7/Qv+JNKEjHIO4ckW44iuX9FC435P9A0hNI41ILqPwAkPFr3nbJFlFGiHQXRr
 zCwsxOUDBNtvleJczata8b6hcHR+6d00w6k5MKTZn/h59MJx21I7ukZd6RLy9saV
 KtndptFrfUw1ZR+BWohVUknpEFzt8lU9Ai2V1Rq8zvb9GtckkArR5sapF38Y3Cbr
 F7bu3uDlyXM9uGBDNoU58o0qA7en7FfISR6S3YC7ToZPsOUZUFMmu/7LtbUFv1WH
 EMKaCdFKKKqJbBrqDC0AnLQW8N6js5yOJ2KXc1+eG1t1sBQizYf8x3yy94YECVkI
 sXppz7s9aDYoWMAMD9ofDq+fBQQhI9zyRULNZIVCtLy09WDoXYoibbTWzID7nrd/
 ufW7H91s9t4s+yTFKigN3vzY3A8JEqEA04TscJw7rLi/LaovcVvgLvm33A5mrxOS
 kjcjoha7Rz2kac7A8KxAIHK4CCLMS7bG028sLS0vY2lBW2KrDjzKiANJqMeSuB1m
 9IM0u7eK
 =waBr
 -----END PGP SIGNATURE-----

Merge tag 'v7.2-rc1-smb3-server-fixes' of git://git.samba.org/ksmbd

Pull smb server fixes from Steve French:

 - Fix several use-after-free races in durable handle reconnect,
   supersede, and oplock handling

 - Avoid holding the inode oplock lock while waiting for a lease break
   acknowledgement. This removes delays of up to 35 seconds when cifs.ko
   closes a deferred handle in response to a lease break

 - Fix malformed security descriptor handling, including an undersized
   DACL allocation issue and an out-of-bounds ACE SID read

 - Fix memory leaks in security descriptor and DOS attribute xattr
   encoding/decoding error paths

 - Fix outstanding SMB2 credit leaks on aborted requests and correct the
   QUERY_INFO credit charge calculation

 - Fix hard-link creation without replacement being incorrectly rejected
   when the handle lacks DELETE access

 - Avoid unnecessary zeroing of large SMB2 read buffers

 - Add an oplock list lockdep annotation and update the documented
   support status for durable handles and SMB3.1.1 compression

 - Durable handle fixes to address ownership and lifetime races during
   reconnect, session teardown, oplock handling, and superseding opens,
   preventing stale session and file references from being used by
   concurrent operations

* tag 'v7.2-rc1-smb3-server-fixes' of git://git.samba.org/ksmbd:
  ksmbd: fix app-instance durable supersede session UAF
  ksmbd: snapshot previous oplock state before durable checks
  ksmbd: close superseded durable handles through refcount handoff
  ksmbd: fix use-after-free of fp->owner.name in durable handle owner check
  smb/server: do not require delete access for non-replacing links
  ksmbd: don't hold ci->m_lock while waiting for a lease break ack
  ksmbd: doc: update feature support status for durable handles and compression
  ksmbd: annotate oplock list traversals under m_lock
  ksmbd: fix outstanding credit leak on abort and error paths
  ksmbd: fix credit charge calculation for SMB2 QUERY_INFO
  ksmbd: avoid zeroing the read buffer in smb2_read()
  ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl
  ksmbd: reject undersized DACLs before parsing ACEs
  ksmbd: fix n.data memory leak in ksmbd_vfs_set_dos_attrib_xattr
  ksmbd: Fix acl.sd_buf memory leak and invalid sd_size error handling
  ksmbd: fix sd_ndr.data memory leak in ksmbd_vfs_set_sd_xattr
2026-07-03 18:55:34 -10:00
Linus Torvalds
dac0b8c587 drm fixes for 7.2-rc2
core:
 - kernel doc fix
 - include types.h in drm_ras.h
 
 dma-fence:
 - fix NULL ptr dereference
 - use correct callback
 - make dma_fence_dedup_array more robust
 
 dp:
 - handle torn down topology gracefully
 - fix kernel doc
 
 i915:
 - Input validation fixes for BIOS and EDID
 - Fix HDCP code buffer overflow and seq_num_v monotonic increase check
 - Fix near-NULL deref in i915_active during GFP_ATOMIC exhaustion
 
 xe:
 - Wedge from the timeout handler only after releasing the queue
 - Fix a NULL pointer dereference
 - Remove redundant exec_queue_suspended
 - RTP / OA whitelist fixes
 - Return error on non-migratable faults requiring devmem
 - Skip FORCE_WC and vm_bound check for external dma-bufs
 - Hold notifier lock for write on inject test path
 - Drop bogus static from finish in force_invalidate
 - Fix double-free of managed BO in error path
 - Don't attempt to process FAST_REQ or EVENT relays
 - Fix NPD in bo_meminfo
 - Prevent invalid cursor access for purged BOs
 - Fix offset alignment for MERT WHITELST_OA_MERT_MMIO_TRG
 
 amdgpu:
 - Soc24 aborted suspend fix
 - Drop unecessary BUG() and BUG_ON() from error paths
 - SCPM fix
 - Power reporting fix
 - DCE HDR fix
 - UVD boundary checks
 - VCN boundary checks
 - VCE boundary checks
 - DCN 4.2 fixes
 - Large stack allocation fixes
 - Fix aperture mapping leak
 - UserQ fixes
 - Ignore_damage_clips fix
 - ACP fixes
 - DC boundary checks
 - GPUVM fixes
 - JPEG idle check fixes
 - Userptr fix
 - GC 11.7 updates
 - Non-4K page fix
 - SMU 13 fixes
 - DP alt mode fix
 
 amdkfd:
 - Boundary checks
 - CRIU fixes
 
 amdxdna:
 - fix device removal issues
 - fix use after free in debug BO
 
 imagination:
 - fix double call to scheduler fini
 - fix ioctl return values
 - fix user array stride
 
 virtio:
 - handle EDIDs better
 
 panthor:
 - irq safe fence lock fix
 - reset work fix
 - fix invalid pointer
 - fix iomem access in suspended state
 - sched resume fix
 - unplug suspend fix
 - drop needless check
 - eviction leak fix
 - bail on group start/resume fix
 - keep irqs masked
 
 malidp:
 - use clock bulk API
 
 komeda:
 - clock prepare fixes
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmpILLYACgkQDHTzWXnE
 hr4jBw/7Bhh6wdPLs2lqdFecpMikm3icmyQylayY8f67TiHhsg93FNgmjHlkjnkH
 VfblnRR5jB5VNwOdzeMPKivR5X2wP2ruvjRWUIfN1dZiHoI6cf+1ClR1ZJD1aWPH
 kJkE35bbufGldjiztwGmuUjfiOl/8b58DzJdWYs5BJXbNTDn8XMGQp0ai+ye2yco
 PwHEDlD576k40BRPUVQk8fjPNd/YZw7t/zdmUQJxKVqVnT1GtgkJabdfje/QtqVw
 PU3diSmT/tYHZ4H0AIyYvneXFDHPKrvTBm7T1ADTnK2QbLxEcBaidgcGHYmncbFX
 nB/KP30ordTWf23LtsFYMfzB/yM+b0n/XiyzsZhm1XP9C2uPe4YJsmf+mPCH3KVI
 tAoSBpsPI9LQEkywf8Vu/QjiiWdO5b25SlkJy1AlNfLBZ2XX+TjgOCwjD62sUzer
 gfanrUl+viIUOBvT9oRMMTiR37g7+U2JoBJWLLB+pnTkZylJdLcK5J/tquEnjOdN
 uw/feReG221NJqJvxh7i1plfZTIx08E99gmH3OhVIvNOQbKSdSRGkCN9qON33XbA
 GovE+RoF5Zzl4MU1RlbfCOmG56Yez8VW2loSZwpX6r1JyJa/Mld6UjSp+/tkI00r
 e+LLdbQ/LeB/ARGGPf3ctS5/PZRvPNNGJiVtYpwN2ZvPz8lL1d8=
 =bXRh
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-2026-07-04' of https://gitlab.freedesktop.org/drm/kernel

Pull drm fixes from Dave Airlie:
 "Weekly fixes for drm. This is large for rc2 but it's just a lot of
  small fixes across a bunch of drivers, xe, amdgpu as usual, plus some
  sashiko-inspired fixes for panthor, and some dma-fence updates.

  core:
   - kernel doc fix
   - include types.h in drm_ras.h

  dma-fence:
   - fix NULL ptr dereference
   - use correct callback
   - make dma_fence_dedup_array more robust

  dp:
   - handle torn down topology gracefully
   - fix kernel doc

  i915:
   - Input validation fixes for BIOS and EDID
   - Fix HDCP code buffer overflow and seq_num_v monotonic increase check
   - Fix near-NULL deref in i915_active during GFP_ATOMIC exhaustion

  xe:
   - Wedge from the timeout handler only after releasing the queue
   - Fix a NULL pointer dereference
   - Remove redundant exec_queue_suspended
   - RTP / OA whitelist fixes
   - Return error on non-migratable faults requiring devmem
   - Skip FORCE_WC and vm_bound check for external dma-bufs
   - Hold notifier lock for write on inject test path
   - Drop bogus static from finish in force_invalidate
   - Fix double-free of managed BO in error path
   - Don't attempt to process FAST_REQ or EVENT relays
   - Fix NPD in bo_meminfo
   - Prevent invalid cursor access for purged BOs
   - Fix offset alignment for MERT WHITELST_OA_MERT_MMIO_TRG

  amdgpu:
   - Soc24 aborted suspend fix
   - Drop unecessary BUG() and BUG_ON() from error paths
   - SCPM fix
   - Power reporting fix
   - DCE HDR fix
   - UVD boundary checks
   - VCN boundary checks
   - VCE boundary checks
   - DCN 4.2 fixes
   - Large stack allocation fixes
   - Fix aperture mapping leak
   - UserQ fixes
   - Ignore_damage_clips fix
   - ACP fixes
   - DC boundary checks
   - GPUVM fixes
   - JPEG idle check fixes
   - Userptr fix
   - GC 11.7 updates
   - Non-4K page fix
   - SMU 13 fixes
   - DP alt mode fix

  amdkfd:
   - Boundary checks
   - CRIU fixes

  amdxdna:
   - fix device removal issues
   - fix use after free in debug BO

  imagination:
   - fix double call to scheduler fini
   - fix ioctl return values
   - fix user array stride

  virtio:
   - handle EDIDs better

  panthor:
   - irq safe fence lock fix
   - reset work fix
   - fix invalid pointer
   - fix iomem access in suspended state
   - sched resume fix
   - unplug suspend fix
   - drop needless check
   - eviction leak fix
   - bail on group start/resume fix
   - keep irqs masked

  malidp:
   - use clock bulk API

  komeda:
   - clock prepare fixes"

* tag 'drm-fixes-2026-07-04' of https://gitlab.freedesktop.org/drm/kernel: (105 commits)
  drm/xe/oa: Fix offset alignment for MERT WHITELIST_OA_MERT_MMIO_TRG
  drm/xe/pt: prevent invalid cursor access for purged BOs
  drm/xe: fix NPD in bo_meminfo()
  drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays
  drm/xe/hw_engine: Fix double-free of managed BO in error path
  drm/xe/userptr: Drop bogus static from finish in force_invalidate
  drm/xe/userptr: Hold notifier_lock for write on inject test path
  drm/xe/display: skip FORCE_WC and vm_bound check for external dma-bufs
  drm/xe: Return error on non-migratable faults requiring devmem
  drm/xe/rtp: Ensure locking/ref counting for OA whitelists
  drm/xe/oa: (De-)whitelist OA registers on OA stream open/release
  drm/xe/rtp: (De-)whitelist OA registers for all hwe's for a gt
  drm/xe/rtp: Toggle 'deny' bit to (de-)whitelist OA regs
  drm/xe/rtp: Save OA nonpriv registers to register save/restore lists
  drm/xe/rtp: Generalize whitelist_apply_to_hwe
  drm/xe/rtp: Keep track of non-OA nonpriv slots
  drm/xe/rtp: Maintain OA whitelists separately
  drm/xe/rtp: Fix build error with clang < 21 and non-const initializers
  drm/imagination: Fix user array stride in pvr_set_uobj_array()
  drm/imagination: Fix returned size for DRM_IOCTL_PVR_DEV_QUERY
  ...
2026-07-03 15:42:20 -10:00
Linus Torvalds
e6174e9b38 ACPI support fixes for 7.2-rc2
- Add a missing ACPI_TAD_AC_WAKE capability check omitted by mistake to
    the ACPI TAD driver (Xu Rao)
 
  - Define acpi_ut_safe_strncpy() as an alias for strscpy_pad() which is
    viable because that function is only called from kernel code (Rafael
    Wysocki)
 -----BEGIN PGP SIGNATURE-----
 
 iQFGBAABCAAwFiEEcM8Aw/RY0dgsiRUR7l+9nS/U47UFAmpIAfgSHHJqd0Byand5
 c29ja2kubmV0AAoJEO5fvZ0v1OO1BrsH/j1RgYp/hU3ws2RFCw7Cs2ap8vbidedB
 XtcliFxVfvy4NI5Xlw+YNHW2lyjCcF1lcInumkW1yG5KFkqyOevX6YmnykOJkDON
 7alv7rt/W7qLT3BDvZdzUm+zCflm8ieapohpFMEtaJTgguJKwP+0HS3XCQ1eSorH
 4mou0SI1qkjqllXZB7PKTPEgcD0ji3dkusjtcp3qvZrgeO9qsZ6C2GABeQwDRIPU
 BZhIdjf1jwX/T7Qn5llQHGMWCM78zHSGIRDA6zXnqn7jse5pntbQOwYL/6jRc0QA
 kj+9akgDe1YnEAAvIm5cMAygBuqGDCH4S4XEBtQeTc9XwJaDC0g1Hzc=
 =ffMf
 -----END PGP SIGNATURE-----

Merge tag 'acpi-7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull ACPI support fixes from Rafael Wysocki:
 "These fix a coding mistake in the ACPI TAD (Time and Alarm
  Device) driver introduced by one of its previous updates and
  get rid of the ugly #ifdef __KERNEL__ conditional compilation
  in acpi_ut_safe_strncpy() by redefining that function as an
  alias for strscpy_pad():

   - Add a missing ACPI_TAD_AC_WAKE capability check omitted by mistake
     to the ACPI TAD driver (Xu Rao)

   - Define acpi_ut_safe_strncpy() as an alias for strscpy_pad()
     which is viable because that function is only called from kernel
     code (Rafael Wysocki)"

* tag 'acpi-7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  ACPICA: Define acpi_ut_safe_strncpy() as strscpy_pad() alias
  ACPI: TAD: Check AC wake capability before enabling wakeup
2026-07-03 15:13:50 -10:00
Linus Torvalds
590cae7152 RISC-V updates for v7.2-rc2
- Fix a crash when a kretprobe reads from the stack
 
 - Fix an issue with the build-time mcount sorter that broke ftrace
 
 - Fix the rv32 IRQ stack frame padding to match the ABI
 
 - Only defer IOMMU configuration during initialization.  This avoids
   an issue where IOMMU configuration could be indefinitely deferred
 
 - Add the missing build salt to the vDSO
 
 - Now that RISC-V systems with higher numbers of cores are starting to
   become available, raise NR_CPUS for RISC-V to 256
 
 - Clean up some warnings from sparse caused by the RISC-V-optimized
   RAID6 code
 
 - Clean up our __cpu_up() code with a few minor fixes
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEElRDoIDdEz9/svf2Kx4+xDQu9KksFAmpH+BAACgkQx4+xDQu9
 Kkt2BxAAkHACbEzUDBJnhKL+Ce39S4QzNb+5iE25t7cUrpkK2ArYMBCd5Zir0Q+E
 WIP1nmDYsE9z6fNa8CncIEY6CnNBNDRK2eR7BiUM+tOhS5jMqvctb7LxkIGgbh3/
 VuNCw0NIavQ5zMqdVHQVzfIS+PojysZVnSQ3CwAHV1hgKO0p1FVozfv3N+TWBHjL
 hMCGxCNxIQaDXFKLSYlOh4fJEgpyznRo/YNybmugCAe8HqY2RyOgWhm62ipL0kcP
 OAjpKRIJ9o4CCaC+F3TNGjubw2I+AkEf8rMbw1KDuzwDI2HmsubMyFS/LHrhM0D7
 VhSjxu3DxJT7ObM4ID07hjywWTRAfmwI0AokajYmBPqVi3t+erJnAU2ayExnFmg9
 PWN53BbEMg+T2W5ym7arhWz28MdHoATviwEy1gLgaJbQtAQJDzK1FQ9in5m+AJAe
 QAO6O04bS+PUOz4orlGMDa7bLnHQucLKNvkI7EkXdS47yYPvs6OwOX1EjfMkM1TE
 O+36Uc6FSAEoO3nN5QGhV2OUegPyKm8lSJhqfftK4qBSd7Ffd9Mpsw9APCj/75ay
 uZ2yvllHli+SLo/xgOs/oFFUTrID1LUmwDzU7K1tr11hI2AV2BZ4aA1h3B6LbVt9
 Tz3vxaOC4DEx9owhQRaFgo13KvSYAAz4QYAwr1EMPHtDMRxu6k8=
 =qgfC
 -----END PGP SIGNATURE-----

Merge tag 'riscv-for-linus-7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux

Pull RISC-V fixes from Paul Walmsley:

 - Fix a crash when a kretprobe reads from the stack

 - Fix an issue with the build-time mcount sorter that broke ftrace

 - Fix the rv32 IRQ stack frame padding to match the ABI

 - Only defer IOMMU configuration during initialization. This avoids an
   issue where IOMMU configuration could be indefinitely deferred

 - Add the missing build salt to the vDSO

 - Now that RISC-V systems with higher numbers of cores are starting to
   become available, raise NR_CPUS for RISC-V to 256

 - Clean up some warnings from sparse caused by the RISC-V-optimized
   RAID6 code

 - Clean up our __cpu_up() code with a few minor fixes

* tag 'riscv-for-linus-7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
  riscv: probes: save original sp in rethook trampoline
  riscv: Fix 32-bit call_on_irq_stack() frame pointer ABI
  scripts/sorttable: Handle RISC-V patchable ftrace entries
  riscv: smp: use secs_to_jiffies in __cpu_up
  ACPI: RIMT: Only defer the IOMMU configuration in init stage
  riscv: Add build salt to the vDSO
  raid6: fix raid6_recov_rvv symbol undeclared warning
  raid6: fix riscv symbol undeclared warnigns
  riscv: Raise default NR_CPUS for 64BIT to 256
2026-07-03 15:07:24 -10:00
Linus Torvalds
6cf48bfec9 4 smb client fixes
-----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmpIEO8ACgkQiiy9cAdy
 T1FANwwAiPzR+deWnTwY0euLqG7MxRe7JTF2jQYvF4YPa6HRzCj6wjcPzwYa0fAV
 fu2ZpOvfmHZFmgbMdcTU2NcRbDIjGAG02wEFHu7okw1BgcQSijHqTz7k82N7LzzF
 4GiOqX3L4zXKzwSH1HIyudfDdEsuo1xN2ydW6mouWM8r26BUvAA7SFyCquN9t+ou
 sp76oxlj9VZbNvaTWenYRFQM+PfLCEM/E+RcSDwpyvtj0uYArE/bLxteDr7gbao4
 zJltCCQCO8lzhHjwBWP9RRUQZH/pbtfZ6ylr3Qaa/eRgZR/C3cKBe6B5pZ/6RPUN
 9vLvd4cRaO1rxTcZ2+8DVXFWVz42CMPa6JkBQeRLgpNlAfEqeTmrDX2EsX/m53yz
 56/heHWz7yUtuuBFPI2y83tEzcRCIkOV9T3Xbw9+Q/qPweHuXvM3u0zmVuPwnvID
 LAGRvqC6g2VhJFw1u4T4i6Z/RDl0uQSZPcwDQriEknONGwT0jCteuXBMK6waMEbn
 ZH3DQ6Sj
 =C9Qx
 -----END PGP SIGNATURE-----

Merge tag 'v7.2-rc1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6

Pull smb client fixes from Steve French:

 - Credit fix

 - Fix alignment issue in parse_posix_ctxt

 - SID parsing fix

* tag 'v7.2-rc1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6:
  cifs: Fix missing credit release on failure in cifs_issue_read()
  cifs: update internal module version number
  smb: client: use unaligned reads in parse_posix_ctxt()
  smb: client: harden POSIX SID length parsing
2026-07-03 15:01:33 -10:00
Rafael J. Wysocki
973772c7cf Merge branch 'acpi-tad'
Merge an ACPI TAD (Time and Alarm Device) driver fix for 7.2-rc2.

* acpi-tad:
  ACPI: TAD: Check AC wake capability before enabling wakeup
2026-07-03 20:28:08 +02:00
Linus Torvalds
71dfdfb020 vfs-7.2-rc2.fixes
Please consider pulling these changes from the signed vfs-7.2-rc2.fixes tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCakeSGAAKCRCRxhvAZXjc
 opdAAQDCui7Q517Wxe59USK+wtnOVARMzCN0Tu6e/HodvbbIEAD/RmgGnQrYF13I
 3BuCwTMS9Q1lHQLUtIkd9WqqYa2rQws=
 =uL08
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.2-rc2.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull vfs fixes from Christian Brauner:

 - netfs:

    - fix the decision when to disallow write-streaming with fscache in
      use, handling of asynchronous cache object creation, a double fput
      in cachefiles, clearing S_KERNEL_FILE without the inode lock held,
      page extraction bugs in the iov_iter helpers (a potential
      underflow, a missing allocation failure check, a memory leak, and
      a folio offset miscalculation), writeback error and ENOMEM
      handling, DIO write retry for filesystems without a
      ->prepare_write() method, and the replacement of the wb_lock mutex
      with a bit lock plus writethrough collection offload so that
      multiple asynchronous writebacks don't interfere with each other.

    - Fix the barriering when walking the netfs subrequest list during
      retries as it was possible to see a subrequest that was just added
      by the application thread.

 - iomap:

    - Change iomap to submit read bios after each extent instead of
      building them up across extents. The old behavior was considered
      problematic for a while and now caused an actual erofs bug.

    - Guard the ioend io_size EOF trim in iomap against underflow when a
      concurrent truncate moves EOF below the start of the ioend,
      wrapping io_size to a huge value.

 - overlayfs

    - Fix a stale overlayfs comment about the locking order.

    - Store the linked-in upper dentry instead of the disconnected
      O_TMPFILE dentry during overlayfs tmpfile copy-up. With a FUSE or
      virtiofs upper layer ->d_revalidate() would try to look up "/" in
      the workdir and fail, causing persistent ESTALE errors that broke
      dpkg and apt.

 - vfs-bpf:

   Have the bpf_real_data_inode() kfunc take a struct file instead of a
   dentry so it is usable from the bprm_check_security, mmap_file, and
   file_mprotect hooks, and rename it from bpf_real_inode() to make the
   data-inode semantics explicit. The kfunc landed this cycle so the
   change is safe.

 - afs:

   NULL pointer dereferences in the callback service and in
   afs_get_tree(), several memory and refcount leaks, missing locking
   around the dynamic root inode numbers and premature cell exposure
   through /afs, a netns destruction hang caused by a misplaced
   increment of net->cells_outstanding, a bulk lookup malfunction caused
   by the dir_emit() API change, inode (re)initialisation issues, and
   assorted smaller fixes to error codes, seqlock handling, and debug
   output.

 - vfs:

   Refuse O_TMPFILE creation with an unmapped fsuid or fsgid and add a
   selftest for it.

 - vboxsf:

   Add Jori Koolstra as vboxsf maintainer, taking over from Hans de
   Goede.

 - dio:

   Release the pages attached to a short atomic dio bio; the REQ_ATOMIC
   size check error path leaked them.

 - procfs:

   Only bump the parent directory link count when registering
   directories in procfs. Registering regular files inflated the count
   and leaked a link on every create and remove cycle.

 - minix:

   Avoid an unsigned overflow in the minix bitmap block count
   calculation that let crafted images with huge inode or zone counts
   pass superblock validation and crash the kernel during mount.

 - cachefiles:

   Fix a double unlock in the cachefiles nomem_d_alloc error path left
   over from the start_creating() conversion.

 - fat:

   Stop fat from reading directory entries past the 0x00
   end-of-directory marker. If the trailing on-disk slots aren't
   zero-filled the driver surfaced arbitrary garbage as directory
   entries.

 - freexvfs:

   Don't BUG() on unknown typed-extent types in freevxfs, reachable via
   ioctl(FIBMAP) on a crafted image; fail with an I/O error instead.

 - orangefs:

   Keep the readdir entry size 64-bit in orangefs fill_from_part().
   Truncating it to __u32 bypassed the bounds check and led to
   out-of-bounds reads triggerable by the userspace client.

 - xfs:

   Fix the error unwind in xfs_open_devices() which released the rt
   device file twice and left dangling buftarg pointers behind that were
   freed again when the failed mount was torn down.

 - exec:

   Fix an off-by-one in the comment documenting the maximum binfmt
   rewrite depth in exec_binprm(). The code allows five rewrites, not
   four; restricting the code would break userspace so the comment is
   fixed instead.

 - file handles:

   Reject detached mounts in capable_wrt_mount(). A detached mount can
   be dissolved concurrently, leaving a NULL mount namespace that
   open_by_handle_at() would dereference.

* tag 'vfs-7.2-rc2.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (57 commits)
  netfs: Fix barriering when walking subrequest list
  iomap: submit read bio after each extent
  fuse: call fuse_send_readpages explicitly from fuse_readahead
  iomap: consolidate bio submission
  fhandle: reject detached mounts in capable_wrt_mount()
  netfs: Fix DIO write retry for filesystems without a ->prepare_write()
  netfs: Fix folio state after ENOMEM whilst under writeback iteration
  netfs: Fix writeback error handling
  netfs: Fix writethrough to use collection offload
  netfs: Replace wb_lock with a bit lock for asynchronicity
  netfs: Fix kdoc warning
  scatterlist: Fix offset in folio calc in extract_xarray_to_sg()
  iov_iter: Remove unused variable in kunit_iov_iter.c
  iov_iter: Fix a memory leak in iov_iter_extract_user_pages()
  iov_iter: Fix missing alloc fail check in iov_iter_extract_bvec_pages()
  iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages()
  cachefiles: Fix file burial to take lock when unsetting S_KERNEL_FILE
  cachefiles: Fix double fput
  netfs: Fix netfs_create_write_req() to handle async cache object creation
  netfs: Fix decision whether to disallow write-streaming due to fscache use
  ...
2026-07-03 05:48:05 -10:00
Linus Torvalds
025d0d6221 xfs: fixes for 7.2-rc2
Signed-off-by: Carlos Maiolino <cem@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iJUEABMJAB0WIQSmtYVZ/MfVMGUq1GNcsMJ8RxYuYwUCakeeeQAKCRBcsMJ8RxYu
 Y6Q+AX9gnOQ1ZkxIKb+/hHq061nh/41iOaiO1CHEgvkCuX2pkRDJkIO2g5+1WaCC
 FcjSzLcBf0COW1/Pye2+ViB1u/SkMJZpKbrKl6lY4wcVHtqNSwn/D0zvbXsfBSsb
 Zj6I2kGZGw==
 =FpZC
 -----END PGP SIGNATURE-----

Merge tag 'xfs-fixes-7.2-rc2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux

Pull xfs fixes from Carlos Maiolino:
 "A collection of bugfixes and some small code refactoring"

* tag 'xfs-fixes-7.2-rc2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
  xfs: simplify __xfs_buf_ioend
  xfs: fix handling of synchronous errors in xfs_buf_submit
  xfs: remove xfs_buf_ioend
  xfs: improve the xfs_buf_ioend_fail calling convention
  xfs: use null daddr for unset first bad log block
  xfs: fix memory leak in xfs_dqinode_metadir_create()
  xfs: release dquot buffer after dqflush failure
  xfs: also mark the buffer stale on verifier failure in xfs_buf_submit
  xfs: open code xfs_buf_ioend_fail in xfs_buf_submit
  xfs: fix AGFL extent count calculation in xrep_agfl_fill
  xfs: simplify the failure path in xfs_buf_alloc_vmalloc
  xfs: fix incorrect use of gfp flags in xfs_buf_alloc_backing_mem
  xfs: lift setting __GFP_NOFAIL from xfs_buf_alloc_kmem to the caller
  xfs: split up xfs_buf_alloc_backing_mem
2026-07-03 05:44:56 -10:00
Linus Torvalds
4dbc94bcc2 xen: branch for v7.2-rc2
-----BEGIN PGP SIGNATURE-----
 
 iJEEABYKADkWIQRTLbB6QfY48x44uB6AXGG7T9hjvgUCakeC1xsUgAAAAAAEAA5t
 YW51MiwyLjUrMS4xMiwyLDIACgkQgFxhu0/YY74ZBQD/chB7mZrRK5FWdhtEYZuT
 5is9FKdEe7P3rRChGuDxGZoBAISClrfxdh46C90D8jhjE3G3xWsN5DIajo1YaDbH
 TroI
 =wiih
 -----END PGP SIGNATURE-----

Merge tag 'for-linus-7.2a-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip

Pull xen fixes from Juergen Gross:

 - rename function parameters and a comment related to
   xen_exchange_memory() (Jan Beulich)

 - replace __ASSEMBLY__ with __ASSEMBLER__ (Thomas Huth)

 - add some sanity checking to the Xen pvcalls frontend driver (Michael
   Bommarito)

 - fix error handling in the Xen gntdev driver (Wentao Liang)

 - fix several minor bugs in Xen related drivers (Yousef Alhouseen)

* tag 'for-linus-7.2a-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
  x86/Xen: correct commentary and parameter naming of xen_exchange_memory()
  xenbus: reject unterminated directory replies
  xen/gntalloc: validate grant count before allocation
  xen/gntalloc: make grant counters unsigned
  xen/front-pgdir-shbuf: free grant reference head on errors
  xen/gntdev: fix error handling in ioctl
  xen: Replace __ASSEMBLY__ with __ASSEMBLER__ in header files
  xen/pvcalls: bound backend response req_id before indexing rsp[]
2026-07-03 05:40:58 -10:00
Linus Torvalds
2916bfc6ba gpio fixes for v7.2-rc2
- check the return value of gpiochip_add_data() in gpio-mvebu and
   gpio-htc-egpio
 - avoid locking context issues with GPIO drivers using the shared GPIO
   proxy by only allowing sleeping operations (atomic GPIO ops don't
   really make sense in shared context anyway)
 - with the above: restoe non-sleeping GPIO access in pinctrl-meson
 - fix return value on OOM in gpio-timberdale
 - fix interrupt handling in gpio-mt7621
 - support both A and B variants of NCT6126D in gpio-f7188x
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEkeUTLeW1Rh17omX8BZ0uy/82hMMFAmpHaxAACgkQBZ0uy/82
 hMMo+Q/+MPDFUmy4E7mA1FwcJ1jwx4sFp7tIVu5jAjlC9GyrRJXxN6IS4od4RcqP
 x6r+FU+2j8G1Fyob6kh7nvsjsvNFkGkHToMIzJLaR/BNCQe3JhU/ipNx8rQ5OOHN
 lFBUfax0NoodxXbCftn3FHtvvLjNuRMTq9i0OkmoNgtqvuGmPFI4Zv/M3NdR/+bA
 hvv4cmdnQFNceX2FNTo5tcOyDyuAsrt+2oguE8zgLoLXKXk4E5NTrtxUVlyOCtPD
 43WpqoLC1nZJQZ2pK7Tfh4vjSlKl78ybhSEk9i/h9N+8fjWfWYQfYnT+akmi5oou
 LhDrg2k7AD4tJUJX1TPJofCnRM5F/qTPkxliXzzsi6zzMGpoKuLTejDEuY4Vl5D3
 TRk5lMi6yoorNtaKKmpDzflbpFZlnNvn7BE1KrUgYp/w1Vm8sEPfva87rSH+yYj/
 AhDnJvm9c6A6vsb58RO0h4QMArzq71BIR8S1fA7P5AFDyUk2EEBM3RZGdJfCo61c
 8/2PoYvRJWvlHsRlPmY/eWsOq25RE2fUEjpVI5PV8C9z+QFFM6gW+6QSZjbnWrtA
 Bdph8+549oWtPwCmx1CmdM5vxMOkuLYU/B7fdWAjzgL/YtIbM93+KLuzh9eblUpr
 eOKRxHIZoOb09Zcte4ke8wFckbCCEN3HmDIl+2TSgVG8i1L3FS8=
 =Q09c
 -----END PGP SIGNATURE-----

Merge tag 'gpio-fixes-for-v7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux

Pull gpio fixes from Bartosz Golaszewski:

 - check the return value of gpiochip_add_data() in gpio-mvebu and
   gpio-htc-egpio

 - avoid locking context issues with GPIO drivers using the shared GPIO
   proxy by only allowing sleeping operations (atomic GPIO ops don't
   really make sense in shared context anyway)

 - with the above: restore non-sleeping GPIO access in pinctrl-meson

 - fix return value on OOM in gpio-timberdale

 - fix interrupt handling in gpio-mt7621

 - support both A and B variants of NCT6126D in gpio-f7188x

* tag 'gpio-fixes-for-v7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
  pinctrl: meson: restore non-sleeping GPIO access
  gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe
  gpio: mt7621: be sure IRQ domain is created before exposing GPIO chips
  gpio: mt7621: more robust management of IRQ domain teardown
  gpio: mt7621: avoid corruption of shared interrupt trigger state
  gpio: shared-proxy: always serialize with a sleeping mutex
  gpio-f7188x: Add support for NCT6126D version B
  gpio: htc-egpio: use managed gpiochip registration
  gpio: mvebu: fail probe if gpiochip registration fails
2026-07-03 05:38:12 -10:00
David Howells
5c6ce05e40
netfs: Fix barriering when walking subrequest list
Fix the barriering used when walking the subrequest list in retry as
there's a possibility of seeing a subreq that's just been added by the
application thread.

Fixes: ee4cdf7ba8 ("netfs: Speed up buffered reading")
Fixes: 288ace2f57 ("netfs: New writeback implementation")
Link: https://sashiko.dev/#/patchset/20260608145432.681865-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
Link: https://patch.msgid.link/138807.1782980582@warthog.procyon.org.uk
Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
cc: Paulo Alcantara <pc@manguebit.org>
cc: netfs@lists.linux.dev
cc: linux-fsdevel@vger.kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-07-03 11:52:41 +02:00
Takashi Iwai
5720deab6d ASoC: Fixes for v7.2
A fairly standard set of driver specific fixes and quirks that have come
 in since the merge window, plus a MAINTAINERS update.  The tas675x
 READ_ONCE change is probably not actually fixing issues properly but we
 need a whole new approach to concurrency there and it came along with
 some good fixes.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmpGs+4ACgkQJNaLcl1U
 h9ACNwf/Tn088OJahzUFoky3ZZo/BYIf+Fg0Dsc4rhYZxxuolL8ahW5505KXsNt/
 zqAViW+Stk+CcYRnMHHUcUvU9QNo5m7rG2L6fi5vxR5TckFNktIi21HgR12vmRE2
 vQB6Oxwf2wHJogrtNplA1BUTz+3f3pho3yXu/7dDN+rARHnXxS31/mGStzRP2dhO
 xl74IQ0Gg+7vCOHkmH2LTKOmZMxUFOfSriejyTNqNiUbZrufeCpA6u64ply05wD+
 Hawc5hg1qaTykIGvr+cvZyav2Z8lvQmiDAcCp19bp4sk3HPo15U1ZdeqdVFkBXjK
 B+OfMgQZrN5b3sIA7vhj9ztDT/RSmA==
 =aubo
 -----END PGP SIGNATURE-----

Merge tag 'asoc-fix-v7.2-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus

ASoC: Fixes for v7.2

A fairly standard set of driver specific fixes and quirks that have come
in since the merge window, plus a MAINTAINERS update.  The tas675x
READ_ONCE change is probably not actually fixing issues properly but we
need a whole new approach to concurrency there and it came along with
some good fixes.
2026-07-03 09:30:30 +02:00
Linus Torvalds
d2c9a99135 Split <linux/mod_devicetable.h> in per subsystem headers
<linux/mod_devicetable.h> is included transitively in nearly every
 driver in an x86_64 allmodconfig build of v7.1:
 
         $ find drivers -name \*.o -not -name \*.mod.o | wc -l
         21330
         $ find drivers -name \*.o.cmd -not -name \*.mod.o.cmd | xargs grep -l mod_devicetable.h | wc -l
         17038
 
 The result of this mixture of different and unrelated subsystem details
 is that even when touching an obscure device id struct most of the
 kernel needs to be recompiled. Given that each driver typically only
 needs one or two of these structures, splitting into per subsystem
 headers and only including what is really needed reduces the amount of
 needed recompilation.
 
 This split is implemented in the first commit and then after some
 preparatory work in the following commits, the last two replace
 includes of <linux/mod_devicetable.h> by the actually needed more
 specific headers. There are still a few instances left, but the ones
 with high impact (that is in headers that are used a lot) and the easy
 ones (.c files) are handled. These remaining includes will be addressed
 during the next merge window.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEP4GsaTp6HlmJrf7Tj4D7WH0S/k4FAmpHSvIACgkQj4D7WH0S
 /k6Rdgf/QqxMIt7DEAN6KvyCnwVnNnvEWQhac/DtYA3NF1JaynieJIoFcimrRr/j
 cntxjz2zlMhLH4CYZ87IunZ7nGZgkMlsnl/OVMm5NY0wq0vVYX6VmpiSvhMAgvjV
 QxKHOAyuVqPslwVE8DF2Vh9mgJILviH5t/yIy8DHF85QBrDSjcd/n6csx09uTjIy
 +D6NuxQ7ZeOi+O2wZuiDhYpD1kwgO1sXAg56ogN1OSTQoo1kkKqj66b5fgbPVm4/
 MX3EBOjKIytX8csfWBJjNSB7aRyWVMkMKmmDO9+7MIq6tPRbc3yYwhu2kZBAw5Pt
 mQfy1oyUi+0jwew4yKHeoVLyWAc4bg==
 =YhFg
 -----END PGP SIGNATURE-----

Merge tag 'device-id-rework' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux

Pull mod_devicetable.h header split from Uwe Kleine-König:
 "Split <linux/mod_devicetable.h> in per subsystem headers

  <linux/mod_devicetable.h> is included transitively in nearly every
  driver in an x86_64 allmodconfig build of v7.1:

      $ find drivers -name \*.o -not -name \*.mod.o | wc -l
      21330
      $ find drivers -name \*.o.cmd -not -name \*.mod.o.cmd | xargs grep -l mod_devicetable.h | wc -l
      17038

  The result of this mixture of different and unrelated subsystem
  details is that even when touching an obscure device id struct most of
  the kernel needs to be recompiled. Given that each driver typically
  only needs one or two of these structures, splitting into per
  subsystem headers and only including what is really needed reduces the
  amount of needed recompilation.

  This split is implemented in the first commit and then after some
  preparatory work in the following commits, the last two replace
  includes of <linux/mod_devicetable.h> by the actually needed more
  specific headers.

  There are still a few instances left, but the ones with high impact
  (that is in headers that are used a lot) and the easy ones (.c files)
  are handled. These remaining includes will be addressed during the
  next merge window"

* tag 'device-id-rework' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux:
  Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
  Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (headers)
  parisc: #include <linux/compiler.h> for unlikely() in <asm/ptrace.h>
  media: em28xx: Add include for struct usb_device_id
  LoongArch: KVM: Add include defining struct cpu_feature
  ALSA: hda/core: Add include defining struct hda_device_id
  usb: dwc2: Add include defining struct pci_device_id
  platform/x86: int3472: Add include defining struct dmi_system_id
  platform/x86: x86-android-tablets: Add include defining struct dmi_system_id
  i2c: Let i2c-core.h include <linux/i2c.h>
  of: Explicitly include <linux/types.h> and <linux/err.h>
  platform/x86: msi-ec: Ensure dmi_system_id is defined
  usb: serial: Include <linux/usb.h> in <linux/usb/serial.h>
  driver core: platform: Include header for struct platform_device_id
  driver: core: Include headers for acpi_device_id and of_device_id for struct device_driver
  media: ti: vpe: #include <linux/platform_device.h> explicitly
  mod_devicetable.h: Split into per subsystem headers
2026-07-02 20:54:26 -10:00