summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)AuthorFilesLines
2026-07-26scsi: ibmvfc: add helper for creating protocol specific discovery eventTyrel Datwyler1-12/+27
Refactor discover-target event creation so it can be shared by both SCSI and NVMe/FC discovery. Introduce a helper that takes a protocol-specific channel group, selects the correct discover-target opcode, and maps the corresponding discovery buffer into the MAD. This is a preparatory cleanup for issuing protocol-specific discovery MADs in later patches. Signed-off-by: Tyrel Datwyler <tyreld@linux.ibm.com> Link: https://patch.msgid.link/20260723000149.969416-13-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-26scsi: ibmvfc: add wrapper to get vhost associated with a channel structTyrel Datwyler1-0/+10
Add ibmvfc_channels_to_vhost() to recover the parent struct ibmvfc_host from a protocol-specific struct ibmvfc_channels. Later patches need to operate on either the SCSI or NVMe channel group and still access host-wide state such as the primary CRQ, device, and logging context. Centralize that mapping in a helper instead of open- coding container lookups at each call site. Signed-off-by: Tyrel Datwyler <tyreld@linux.ibm.com> Link: https://patch.msgid.link/20260723000149.969416-12-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-26scsi: ibmvfc: add logic for protocol specific fabric loginsTyrel Datwyler2-35/+206
Add support for the protocol-specific fabric login flow introduced by the updated client/VIOS interface. After NPIV login, a VIOS that advertises protocol-specific support requires separate fabric login MADs for SCSI and NVMe/FC. Track whether SCSI and NVMe/FC fabric login are needed, extend channel enquiry/setup handling to negotiate both SCSI and NVMe queue counts, and issue the appropriate fabric login MADs before target discovery begins. Also update command layout selection so the driver uses the v3 command format when the VIOS advertises NVMe/FC-capable framing. Signed-off-by: Tyrel Datwyler <tyreld@linux.ibm.com> Link: https://patch.msgid.link/20260723000149.969416-11-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-26scsi: ibmvfc: alloc/dealloc sub-queues for nvme channelsTyrel Datwyler1-1/+14
Allocate, register, deregister, and release NVMe subordinate CRQs alongside the existing SCSI sub-CRQs. Update the CRQ reset and re-enable paths to tear down and recreate NVMe sub-queues, extend sub-CRQ initialization to allocate NVMe channels when enabled, and release NVMe channel resources during adapter teardown. This keeps the NVMe queue lifecycle aligned with the existing SCSI queue lifecycle so both protocols are reset consistently across probe, remove, and connection recovery. Signed-off-by: Tyrel Datwyler <tyreld@linux.ibm.com> Link: https://patch.msgid.link/20260723000149.969416-10-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-26scsi: ibmvfc: initialize NVMe channel configuration during driver probeTyrel Datwyler2-1/+8
Initialize the host's NVMe channel-group state during probe. Set up the NVMe channel list head, desired queue count, maximum queue count, protocol identifier, and enablement state alongside the existing SCSI channel-group initialization in ibmvfc_probe(). This prepares the driver with a NVMe/FC channel group that can will be used by later patches for NVMe queue allocation, discovery buffers, target management, and IO submission. Signed-off-by: Tyrel Datwyler <tyreld@linux.ibm.com> Link: https://patch.msgid.link/20260723000149.969416-9-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-26scsi: ibmvfc: split NVMe support into separate source file and add transport ↵Tyrel Datwyler5-4/+156
stubs Rename ibmvfc.c to ibmvfc-core.c as first step in decoupling each protocol from the core driver logic. Add ibmvfc-nvme.[ch] files, and register an nvme_fc_port_template with empty callback stubs. Add empty registration functions definitions for local and remote ports. No functional NVMe/FC support is added yet. Signed-off-by: Tyrel Datwyler <tyreld@linux.ibm.com> Link: https://patch.msgid.link/20260723000149.969416-8-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-26scsi: ibmvfc: add NVMe/FC protocol interface definitionsTyrel Datwyler1-34/+119
Add the protocol definitions for client-VIOS interface updates needed to support NVMe/FC over the ibmvfc NPIV transport. Extend the ibmvfc interface with: - NVMe/FC-specific capability bits and opcodes - protocol-specific channel and queue definitions - updated channel enquiry/setup fields for NVMe queues - v3 command layout support for protocol-specific payloads These changes provide the common header and interface plumbing needed by later patches that add NVMe/FC login, discovery, remote-port handling, and I/O submission. Signed-off-by: Tyrel Datwyler <tyreld@linux.ibm.com> Link: https://patch.msgid.link/20260723000149.969416-7-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-26scsi: ibmvfc: move target list from host to protocol specific channel groupsTyrel Datwyler2-28/+28
Prepare the driver for protocol-specific target management by moving the target list and target count out of struct ibmvfc_host and into struct ibmvfc_channels. Today the driver only maintains a single SCSI target list, but NVMe/FC support will require separate target tracking for each protocol-specific channel group. Update the existing target iteration, allocation, and discovery paths to use the SCSI channel group's target list instead of a host-wide list. This is a preparatory refactoring only. No functional change is intended for existing SCSI operation. Signed-off-by: Tyrel Datwyler <tyreld@linux.ibm.com> Link: https://patch.msgid.link/20260723000149.969416-6-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-26scsi: ibmvfc: free ibmvfc_target allocations with mempool_freeTyrel Datwyler1-1/+1
The ibmvfc_target *tgt structures for discovery are allocated using mempool_alloc but in turn free'd via kfree in ibmvfc_release_target breaking pool guarentees. Fixup ibmvfc_release_target to call mempool_free instead so that memory is properly returned to the mempool instead of the general allocator. Signed-off-by: Tyrel Datwyler <tyreld@linux.ibm.com> Link: https://patch.msgid.link/20260723000149.969416-5-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-26scsi: ibmvfc: check for NULL evt in implicit LOGO and target delete pathTyrel Datwyler1-0/+8
Unlike ibmvfc_tgt_implicit_logout the ibmvfc_tgt_implicit_logout_and_del path fails to check for a NULL evt returned from ibmvfc_get_reserved_event and passes that directly to ibmvfc_send_event which will unconditionally derefence the evt. Check for a NULL evt and perform same escalation as ibmvfc_implicit_logout. Signed-off-by: Tyrel Datwyler <tyreld@linux.ibm.com> Link: https://patch.msgid.link/20260723000149.969416-4-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-26scsi: ibmvfc: flush rport_add_work_q during driver teardownTyrel Datwyler1-0/+1
INIT_WORK is called on rport_add_work_q during driver probe. When the adapter is removed, ibmvfc_remove() stops the work thread and proceeds to tear down the FC host, but any work item queued via schedule_work() that raced the teardown could still be running or pending in the system workqueue. Add a flush_work() call after kthread_stop() and before fc_remove_host() to drain any outstanding rport add work before the FC host and its rports are torn down. Signed-off-by: Tyrel Datwyler <tyreld@linux.ibm.com> Link: https://patch.msgid.link/20260723000149.969416-3-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-26scsi: ibmvfc: don't call locked done variant for MADs on send failureTyrel Datwyler1-1/+3
MADs are processed with the requirement that the host_lock is held for MAD sends and completions. When a MAD job step is called the host lock is already held and there is an unlikely scenario where h_send_crq fails with something other than H_CLOSED. If this happens there is a special done handler for MADs that tries to take the host lock. In this failure scenario fall back to the saved evt->_done unlocked completion handler. Signed-off-by: Tyrel Datwyler <tyreld@linux.ibm.com> Link: https://patch.msgid.link/20260723000149.969416-2-tyreld@linux.ibm.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-26scsi: ufs: host: Remove redundant dev_err()Pan Chuang2-5/+1
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() calls. Signed-off-by: Pan Chuang <panchuang@vivo.com> Reviewed-by: Peter Wang <peter.wang@mediatek.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/20260717035013.563791-1-panchuang@vivo.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-26scsi: ufs: debugfs: Reserve space for a string terminatorLi Qiang1-1/+1
ufs_saved_err_write() copies user input into a zero-initialized stack buffer and passes it to kstrtoint(). A write that fills the entire buffer overwrites its only terminator. Reject an input whose length leaves no room for the trailing NUL. Fixes: 7340faae9474 ("scsi: ufs: core: Add debugfs attributes for triggering the UFS EH") Signed-off-by: Li Qiang <liqiang01@kylinos.cn> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Peter Wang <peter.wang@mediatek.com> Link: https://patch.msgid.link/20260717153914.26321-7-liqiang01@kylinos.cn Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-26scsi: ufs: rpmb: Use unaligned accessors for RPMB framesLi Qiang1-2/+2
RPMB frame buffers are passed as u8 pointers and do not have an alignment guarantee. Use unaligned accessors for the req_resp field. Signed-off-by: Li Qiang <liqiang01@kylinos.cn> Reviewed-by: Peter Wang <peter.wang@mediatek.com> Link: https://patch.msgid.link/20260717153914.26321-6-liqiang01@kylinos.cn Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-26scsi: ufs: rpmb: Validate request frame length before parsingLi Qiang1-0/+4
The RPMB core only verifies that request and response buffers are nonempty. This callback reads req_resp at the end of the first request frame before validating the request length. Require a complete frame before that access. Fixes: b06b8c421485 ("scsi: ufs: core: Add OP-TEE based RPMB driver for UFS devices") Signed-off-by: Li Qiang <liqiang01@kylinos.cn> Reviewed-by: Peter Wang <peter.wang@mediatek.com> Reviewed-by: Bean Huo <beanhuo@micron.com> Link: https://patch.msgid.link/20260717153914.26321-5-liqiang01@kylinos.cn Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-26scsi: ufs: core: Validate connected lane countsLi Qiang1-1/+3
The connected lane count is used by TX equalization code to index arrays sized by UFS_MAX_LANES. Reject zero and out-of-range RX or TX lane counts before they can be propagated. Fixes: 03e5d38e2f98 ("scsi: ufs: core: Add support for TX Equalization") Signed-off-by: Li Qiang <liqiang01@kylinos.cn> Link: https://patch.msgid.link/20260717153914.26321-4-liqiang01@kylinos.cn Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-26scsi: ufs: Avoid NULL CQE dereference when reporting invalid tagsLi Qiang1-2/+2
The single-doorbell completion path can call ufshcd_compl_one_cqe() with a NULL CQE. If no command is associated with the completion tag, the warning message dereferences the CQE while reporting the error. Avoid that dereference and include the invalid tag in the warning. Fixes: 22089c218037 ("scsi: ufs: core: Optimize the hot path") Signed-off-by: Li Qiang <liqiang01@kylinos.cn> Reviewed-by: Peter Wang <peter.wang@mediatek.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/20260717153914.26321-3-liqiang01@kylinos.cn Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-26scsi: ufs: core: Validate string descriptorsLi Qiang1-5/+19
The string descriptor length includes a two-byte header while the UTF-16 payload starts after it. utf16s_to_utf8s() expects a count of UTF-16 code units, not bytes. Passing the payload byte count can make it read beyond the descriptor buffer. Validate that the payload has an even byte count, pass a code-unit count to the converter, and allocate sufficient UTF-8 output space. The raw string buffer starts after the descriptor header but its size is bLength. Copying bLength bytes from that pointer can read beyond the response buffer. Allocate a zeroed bLength-sized buffer and copy only the UTF-16 payload. This preserves the raw buffer size consumed by the RPMB device-ID ABI while avoiding the overread. Fixes: 4b828fe156a6 ("scsi: ufs: revamp string descriptor reading") Fixes: d794b499f948 ("scsi: ufs: core: fix incorrect buffer duplication in ufshcd_read_string_desc()") Signed-off-by: Li Qiang <liqiang01@kylinos.cn> Reviewed-by: Peter Wang <peter.wang@mediatek.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/20260717153914.26321-2-liqiang01@kylinos.cn Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-26scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake raceXingui Yang2-28/+19
Commit fbefe22811c3 ("scsi: libsas: Don't always drain event workqueue for HA resume") introduced sas_resume_ha_no_sync() to avoid a deadlock: the PHYE_RESUME_TIMEOUT handler, running on the HA event workqueue, calls sas_deform_port() -> sas_destruct_devices(), which removes SCSI devices and waits for the host to become runtime-active. But the host cannot resume until sas_resume_ha() -> sas_drain_work() returns, and the drain is blocked on that very handler. However skipping the drain reintroduces a race: hisi_sas returns from resume before all PHY UP work and libsas discovery work finish. The controller may then autosuspend while disks are still waking up. The disks issue IO to a suspended controller, the IO fails, and the disks get disabled. Fix the deadlock at its source by moving the PHYE_RESUME_TIMEOUT notification to after sas_drain_work(). By then the host resume is about to complete, so device removal through device_link no longer blocks on the resume and the cycle is broken. With the deadlock gone, restore sas_resume_ha() (the draining variant) in hisi_sas and remove sas_resume_ha_no_sync(). The reorder is safe for the other libsas consumers (isci, pm8001, aic94xx, mvsas). During suspend, sas_suspend_devices() calls sas_notify_lldd_dev_gone() for each device, which sets dev->lldd_dev to NULL. When scsi_unblock_requests re-enables I/O in resume, any I/O to a timed-out phy's disk is immediately rejected by the LLDD before reaching hardware: isci returns SAS_DEVICE_UNKNOWN (mapped to DID_BAD_TARGET), and pm8001 returns SAS_PHY_DOWN (mapped to DID_NO_CONNECT). Both complete directly via scsi_done() without entering SCSI EH. This is identical in both the old and new ordering since lldd_dev_gone runs during suspend, before resume. The reorder only affects when the PHYE_RESUME_TIMEOUT handler runs (synchronized by sas_drain_work() vs. asynchronous after resume returns), not whether I/O can reach the device. aic94xx and mvsas do not register any PM ops and never reach this code path. Fixes: fbefe22811c3 ("scsi: libsas: Don't always drain event workqueue for HA resume") Signed-off-by: Xingui Yang <yangxingui@huawei.com> Reviewed-by: John Garry <john.g.garry@oracle.com> Link: https://patch.msgid.link/20260716081145.3950172-1-yangxingui@huawei.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-26scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection bufferHyeongJun An1-7/+1
iscsi_tcp_hdr_dissect() receives the data segment of several PDU types into the fixed-size conn->data buffer, which is allocated for ISCSI_DEF_MAX_RECV_SEG_LEN (8192) bytes. For the LOGIN_RSP, TEXT_RSP, REJECT and ASYNC_EVENT opcodes the dissect path already rejects a PDU whose DataSegmentLength exceeds that buffer. The SCSI Command Response (ISCSI_OP_SCSI_CMD_RSP) path also copies its data segment (sense/response data) into conn->data via iscsi_tcp_data_recv_prep(), but it does so without the same check. The only upstream bound on in.datalen is conn->max_recv_dlength, the initiator's advertised MaxRecvDataSegmentLength, which is commonly negotiated well above 8192 (open-iscsi defaults to 262144). A target that returns a SCSI Response with a DataSegmentLength between 8193 and max_recv_dlength therefore overflows the 8192-byte conn->data buffer. Once the same bound applies, ISCSI_OP_SCSI_CMD_RSP is handled exactly like those responses: bound the data segment, receive it into conn->data when present, and otherwise complete the PDU with no data. Fold the opcode into that case group rather than duplicating the check. Fixes: a081c13e39b5 ("[SCSI] iscsi_tcp: split module into lib and lld") Suggested-by: Chris Leech <cleech@redhat.com> Assisted-by: Claude:claude-opus-4-8 Signed-off-by: HyeongJun An <sammiee5311@gmail.com> Acked-by: Chris Leech <cleech@redhat.com> Link: https://patch.msgid.link/20260716065848.1653431-1-sammiee5311@gmail.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-26power: supply: sbs-battery: Bound the serial number conversion to 16 bitsBabanpreet Singh1-1/+1
The SBS SerialNumber register is a 16-bit word and chip->serial[] is sized for its four hex digits plus the NUL terminator. The value is carried in an int, though, and only the negative half of that range is rejected before the conversion, so the compiler has to assume [0, INT_MAX] - up to eight digits: drivers/power/supply/sbs-battery.c:835:32: warning: '%04x' directive writing between 4 and 8 bytes into a region of size 5 [-Wformat-overflow=] drivers/power/supply/sbs-battery.c:835:31: note: directive argument in the range [0, 2147483647] drivers/power/supply/sbs-battery.c:835:9: note: 'sprintf' output between 5 and 9 bytes into a destination of size 5 The overflow is not reachable: sbs_read_word_data() returns the result of i2c_smbus_read_word_data(), which yields at most 0xffff on success, and negative returns are rejected just above. Cast to u16 to state the register width at the point of use, which also lets the compiler prove the buffer is large enough. No functional change. This is the only W=1 warning in this driver. Assisted-by: Claude:claude-opus-5 Signed-off-by: Babanpreet Singh <bbnpreetsingh@gmail.com> Link: https://patch.msgid.link/20260726072206.7-3-bbnpreetsingh@gmail.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-07-26power: supply: sbs-battery: Use a per-device serial number bufferBabanpreet Singh1-3/+4
sbs_get_battery_serial_number() formats the battery serial number into sbs_serial[], a single file-scope buffer shared by every sbs-battery instance, and points val->strval at it. Nothing restricts this driver to one instance. It binds per I2C client, and sbs-manager registers one muxed I2C channel per supported battery specifically so that the smart battery driver can be bound to each of them, so several sbs-battery instances on one system is a supported configuration. The power supply core reads strval after the driver's get_property() callback has returned: power_supply_show_property() fills a local union power_supply_propval, then formats it with sysfs_emit(). Two concurrent POWER_SUPPLY_PROP_SERIAL_NUMBER reads on different batteries therefore race for the shared buffer - battery B's sprintf() can land between battery A filling the buffer and the core reading it, and battery A then reports battery B's serial number. Move the buffer into struct sbs_info so that each battery formats into its own storage. It is deliberately not added to the chip->strings[] array: those entries hold the cached constant strings that sbs_invalidate_cached_props() clears on presence changes, whereas the serial number is re-read from its word register on every access. Fixes: d3ab61ecbab2 ("bq20z75: Add support for more power supply properties") Assisted-by: Claude:claude-opus-5 Signed-off-by: Babanpreet Singh <bbnpreetsingh@gmail.com> Link: https://patch.msgid.link/20260726072206.7-2-bbnpreetsingh@gmail.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-07-26scsi: dc395x: Remove unused variable 'fact'Colin Ian King1-6/+0
The variable 'fact' was used for debug but this was removed in commit 62b434b0db2c ("scsi: dc395x: Remove DEBUG conditional compilation"). The variable is now redundant and can be removed. Cleans up clang scan build warning: drivers/scsi/dc395x.c: In function ‘msgin_set_sync’: drivers/scsi/dc395x.c:2185:13: warning: variable ‘fact’ set but not used [-Wunused-but-set-variable] 2185 | int fact; Signed-off-by: Colin Ian King <colin.i.king@gmail.com> Link: https://patch.msgid.link/20260714073510.43289-1-colin.i.king@gmail.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-26Merge patch series "scsi: mpt3sas: add hwmon support"Martin K. Petersen5-0/+255
Louis Sautier <sautier.louis@gmail.com> says: Expose the IOC and board temperature sensors of LSI / Broadcom / Avago SAS HBAs that bind to mpt3sas through the hwmon interface. The data lives in MPI IO Unit Page 7. The same fields are exposed by Broadcom's userspace tooling through the /dev/mpt[23]ctl ioctl path (typically root-only): IOCTemperature and BoardTemperature in lsiutil; ROC and Controller in storcli. With this driver, sensors(1) shows them unprivileged: $ sensors mpt3sas-pci-0200 mpt3sas-pci-0200 Adapter: PCI adapter IOC: +42.0°C Testing ------- Build-tested all four SCSI_MPT3SAS x HWMON combinations (=y and =m each), including the SCSI_MPT3SAS=y with HWMON=m case that requires IS_REACHABLE(). Validated across three Broadcom SAS chip generations. None of the cards had a board sensor present, so the testing only covers the IOC channel: * LSI 9500-8i / SAS3816, SAS-3: - hwmon device registers as "mpt3sas" with only temp1 (IOC) exposed - IOC reading matches `storcli /c0 show temperature` and `lsiutil -p1 -a 25,2,0,0` - rmmod / modprobe cycle goes through the explicit unregister/register paths cleanly * LSI 9305-24i / SAS3224, SAS-3: same behaviour. * LSI 9211-4i / SAS2004, SAS-2: firmware reports both *TemperatureUnits = NOT_PRESENT, no hwmon device registered (graceful-skip path). Not verified (no available hardware): * Path with both IOC and board sensors present. * Fahrenheit-units conversion. * Sub-zero readings (signed-cast path). Link: https://patch.msgid.link/20260630224922.2543096-1-sautier.louis@gmail.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-26scsi: libiscsi: Fix stale-data leak into the SCSI sense bufferHyeongJun An1-1/+1
iscsi_scsi_cmd_rsp() copies the sense data of a SCSI Response from the target-supplied data segment. The segment carries a 2-byte sense length followed by the sense bytes, so it must hold 2 + senselen bytes, but the bounds check only requires datalen >= senselen: senselen = get_unaligned_be16(data); if (datalen < senselen) goto invalid_datalen; memcpy(sc->sense_buffer, data + 2, min_t(uint16_t, senselen, SCSI_SENSE_BUFFERSIZE)); A target that returns a SCSI Response whose datalen equals senselen (with senselen <= SCSI_SENSE_BUFFERSIZE) makes the memcpy() from data + 2 read up to two bytes past the received data. Those bytes are stale conn->data contents and end up in the command's sense buffer, which is returned to userspace. Account for the 2-byte sense length prefix in the check. Fixes: 7996a778ff8c ("[SCSI] iscsi: add libiscsi") Suggested-by: Sashiko AI <sashiko-bot@kernel.org> Assisted-by: Claude:claude-opus-4-8 Signed-off-by: HyeongJun An <sammiee5311@gmail.com> Acked-by: Chris Leech <cleech@redhat.com> Link: https://patch.msgid.link/20260714104934.1404423-1-sammiee5311@gmail.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-26Merge tag 'spi-fix-v7.2-rc4' of ↵Linus Torvalds1-2/+2
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "Just a couple of small bits for the SpacemiT driver - one small fix, and a new compatible in the DT binding" * tag 'spi-fix-v7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: dt-bindings: spacemit: add K3 SPI compatible spi: spacemit: Correct TX FIFO slot calculation
2026-07-26Merge tag 'regulator-fix-v7.2-rc4' of ↵Linus Torvalds2-74/+91
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "One driver specific fix where one of the MediaTek drivers duplicated some core code buggily, and a core fix for an ordering issue on startup where we could end up configuring a voltage outside of constraints due to the order in which we applied constraints" * tag 'regulator-fix-v7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: core: clamp voltage constraints before applying apply_uV regulator: mt6358: use regmap helper to read fixed LDO calibration
2026-07-26iio: chemical: sgp30: Handle IAQ thread creation failureLinmao Li1-0/+3
kthread_run() can fail and return an error pointer, but sgp_probe() stores it and returns success, so the device is registered without its IAQ thread and sgp_remove() later passes the error pointer to kthread_stop(). Return the error from probe instead. Fixes: ce514124161a ("iio: chemical: sgp30: Support Sensirion SGP30/SGPC3 sensors") Signed-off-by: Linmao Li <lilinmao@kylinos.cn> Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com> Cc: <Stable@vger.kernel.org> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-07-26iio: magnetometer: add support for QST QMC6308Jorijn van der Graaf3-0/+613
The QST QMC6308 is a 3-axis anisotropic magnetoresistive (AMR) magnetometer on I2C, found e.g. in the Fairphone 6. Its register map is not compatible with the QMC5883L's, so add a separate driver rather than extending the QMC5883L driver. Support raw X/Y/Z reads, output data rate, field range, filter oversampling ratio, the mount matrix, and runtime PM. Run measurements in the chip's periodic "normal" mode paced by the DRDY flag rather than in its one-shot "single" mode: the datasheet specifies no conversion time that could bound a one-shot wait, while normal mode is paced by the specified output data rates, which also keeps the sampling_frequency ABI meaningful. Runtime PM puts the chip into its suspend mode after 500 ms without a reading, dropping supply current to a few microamps. The suspended chip retains its registers and keeps responding on I2C, so resuming only rewrites the mode field and discards one stale sample, and configuration changes apply even while suspended; VDD is left enabled across runtime suspend. Assisted-by: Claude:claude-fable-5 Signed-off-by: Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-07-26Merge tag 'char-misc-7.2-rc5' of ↵Linus Torvalds8-37/+48
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes from Greg KH: "Here are a number of small char/misc/etc driver fixes for 7.2-rc5 that resolve a bunch of different reported issues. Included in here are: - rust_binder error message reporting fix - stratix10-svc firmware driver fixes - mei driver fix - intel_th hardware tracing driver fix - comedi driver fix - uio_hv_generic driver fix - ntsync selftest fix - nsm misc driver fix - some MAINTAINER file updates All of these have been in linux-next for over a week with no reported issues" * tag 'char-misc-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: MAINTAINERS: Update wine-devel list address rust_binder: only print failure if error has source intel_th: fix MSC output device reference leak misc: nsm: pin the module while the device is open mei: bus: access mei_device under device_lock on cleanup misc: nsm: only unlock nsm_dev on post-lock error paths selftests: ntsync: correct CONFIG_NTSYNC name comedi: comedi_parport: deal with premature interrupt uio_hv_generic: Bind to FCopy device by default MAINTAINERS: Add Greg Kroah-Hartman to GPIB firmware: stratix10-svc: fix teardown order in remove to prevent race firmware: stratix10-svc: handle NO_RESPONSE in async poll firmware: stratix10-svc: fix FCS SMC call kernel-doc firmware: stratix10-svc: fix memory leaks and list corruption bugs
2026-07-26Merge tag 'staging-7.2-rc5' of ↵Linus Torvalds2-2/+9
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver fixes from Greg KH: "Here are two small staging driver fixes for 7.2-rc5. They both resolve some reported bugs in the rtl8723bs staging driver and have been in linux-next for over a week with no reported issues" * tag 'staging-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() staging: rtl8723bs: fix inverted HT40 secondary channel offset
2026-07-26Merge tag 'tty-7.2-rc5' of ↵Linus Torvalds2-5/+21
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull serial driver fixes from Greg KH: "Here are two small serial driver fixes for 7.2-rc5. They are: - sc16is7xx get_direction() callback fix, which resolves a user-triggerable warning in the driver - NULL pointer dereference on some platforms using the 8250_mid serial driver Both have been in linux-next for over a week with no reported issues" * tag 'tty-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: serial: sc16is7xx: implement gpio get_direction() callback serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms
2026-07-26Merge tag 'usb-7.2-rc5' of ↵Linus Torvalds30-212/+582
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are some small USB fixes and new device quirks and ids: - usb storage quirk added - new usb serial device ids added - usb-serial device name leak and other bug fixes - small xhci driver fixes - normal batch of typec driver fixes for reported issues - usb-atm much-reported-by-syzbot fix for firmware download races - sysfs BOS device removal race fix - lots of usb gadget driver fixes for reported issues - other small USB driver fixes for other reported problems All of these have been in linux-next this past week, many of them much longer" * tag 'usb-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (30 commits) usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path USB: serial: io_edgeport: cap received transmit credits USB: serial: option: add TDTECH MT5710-CN USB: serial: io_ti: reject oversized boot-mode firmware USB: serial: mxuport: validate firmware header size usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect usb: typec: ucsi: yoga_c630: Remove redundant duplicate altmode handling usb: typec: ucsi: Add duplicate detection to nvidia registration path usb: typec: ucsi: Detect and skip duplicate altmodes from buggy firmware usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback usb: chipidea: fix usage_count leak when autosuspend_delay is negative usb: core: sysfs: add lock to bos_descriptors_read() usb: musb: omap2430: Do not put borrowed of_node in probe usb: core: port: Deattach Type-C connector on component unbind USB: storage: add NO_ATA_1X quirk for Longmai USB Key USB: serial: ftdi_sio: add support for E+H FXA291 USB: serial: keyspan_pda: fix data loss on receive throttling usb: gadget: printer: fix infinite loop in printer_read() usb: gadget: f_midi: cancel pending IN work before freeing the midi object usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown ...
2026-07-26iommu/iommufd: Fix IOPF group ownership UAFPeiyang He2-5/+21
iopf_group_alloc() links each last-page IOPF group into the generic IOPF pending list before invoking the domain fault handler. iommufd_fault_iopf_handler() also queued an accepted group in the IOMMUFD deliver list without removing it from the generic pending list. When detach or HWPT replacement drops the device's IOPF reference count to zero, an IOMMU driver may call iopf_queue_remove_device(). That function responds to and frees groups through the generic pending list without removing the same groups from IOMMUFD's deliver list or response xarray. A later read, response, or cleanup can then access the freed group and cause a UAF. Fix this by dequeuing an accepted group from the generic pending list before IOMMUFD queues it for userspace response. Make iopf_group_response() send a response regardless of pending-list membership, so the dequeued group can still be completed by IOMMUFD. Link: https://patch.msgid.link/r/3CFD314D0FE4D7EC+20260720085017.3998878-2-peiyang_he@smail.nju.edu.cn Closes: https://lore.kernel.org/all/B4F28798E2E784CA+d29f723c-b2b5-4b67-8d1c-4f7b9b0b27cb@smail.nju.edu.cn/ Fixes: 34765cbc679c ("iommufd: Associate fault object with iommufd_hw_pgtable") Cc: stable@vger.kernel.org Tested-by: Peiyang He <peiyang_he@smail.nju.edu.cn> Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Peiyang He <peiyang_he@smail.nju.edu.cn> Reviewed-by: Kevin Tian <kevin.tian@intel.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-07-26iommu/rockchip: Clear stale page faults before enabling stallJiaxing Hu1-0/+13
Boot firmware can leave an IOMMU bank in PAGE_FAULT_ACTIVE before the driver has configured paging: PAGE_FAULT_ACTIVE=1 STALL_ACTIVE=0 IDLE=1 Such a bank ignores CMD_ENABLE_STALL and never reaches STALL_ACTIVE, so rk_iommu_enable_stall()'s readx_poll_timeout() spins until it times out (seen on the RK3576 NPU, whose MMUs share this poll across banks). Rather than special-casing these banks in the stall path, acknowledge the stale fault with CMD_PAGE_FAULT_DONE before enabling stall, so every bank starts from a clean state and the normal stall sequence applies to all of them. Banks without a pending fault are untouched. Signed-off-by: Jiaxing Hu <gahing@gahingwoo.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-07-26iommu/rockchip: Take all DT clocksJiaxing Hu1-19/+9
rk_iommu only enabled a fixed {aclk,iface} pair. On the RK3576 NPU the MMU sits behind the CBUF/DSU gates, so writes to DTE_ADDR are silently dropped until those clocks run too (reads work, writes need more clocks). Use devm_clk_bulk_get_all() to take every clock the devicetree provides instead of a fixed pair, so a platform can list the full set it needs. Clocks stay optional for the older clock-less devicetrees. Signed-off-by: Jiaxing Hu <gahing@gahingwoo.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-07-26iommu/rockchip: Fix silent probe success when all MMU resources failZhaoJinming1-1/+1
When all MMU register mappings fail in rk_iommu_probe(), the error path returns PTR_ERR(iommu->bases[0]). However, bases[0] can be NULL if the first platform_get_resource() also returned NULL, causing PTR_ERR(NULL) to evaluate to 0 and the probe to succeed silently. Return -ENODEV directly instead. Signed-off-by: ZhaoJinming <zhaojinming@uniontech.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-07-26iommu/rockchip: Drop global rk_ops in favor of per-device opsSimon Xue1-38/+36
The driver currently uses a global rk_ops pointer, forcing all IOMMU instances to share the same operations. This restricts the driver from supporting SoCs that might integrate different versions of IOMMU hardware. Since the IOMMU framework passes the master device information to iommu_paging_domain_alloc(), the global variable is no longer needed. Fix this by moving rk_ops into struct rk_iommu and struct rk_iommu_domain. Initialize it per-device during probe via of_device_get_match_data(), and replace all global references with the instance-specific pointers. Signed-off-by: Simon Xue <xxm@rock-chips.com> Reviewed-by: Robin Murphy <robin.murphy@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-07-26RDMA/cxgb4: remove dead NULL checks after GFP_NOFAIL allocationsGou Hao1-8/+2
alloc_skb() with the __GFP_NOFAIL flag will never return NULL, so the subsequent NULL checks and error handling are unreachable dead code. Remove them. Signed-off-by: Gou Hao <gouhao@uniontech.com> Link: https://patch.msgid.link/20260724022851.466017-7-gouhao@uniontech.com Reviewed-by: Potnuri Bharat Teja <bharat@chelsio.com> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26RDMA/rxe: Implement disassociate_ucontext callbackJiri Pirko1-0/+5
Implement an empty disassociate_ucontext() callback so the RDMA core can move rxe devices between net namespaces. The core requires this callback to reset user contexts without waiting for userspace. rxe needs no teardown here: its user-mapped queues live in reference-counted vmalloc memory (see rxe_mmap.c) that stays valid while userspace holds the mappings. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-14-jiri@resnulli.us Reviewed-by: Yanjun Zhu <yanjun.zhu@linux.dev> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26RDMA/rxe: Allow queue VMAs to outlive ucontextsJiri Pirko1-33/+2
Prepare queue mappings for asynchronous ucontext disassociation during device disable. Rely on the VMA page references to preserve mapped memory until the final unmap. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-13-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26RDMA/core: Make device names unique per net namespaceJiri Pirko1-7/+15
Use rdma_dev_access_netns() to scope RDMA device name lookup and "%d" name allocation to the relevant net namespace. Keep shared mode and CONFIG_NET_NS=n behaviour system-wide. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-12-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26RDMA/core: Document the SELinux ibendport net namespace limitationJiri Pirko1-0/+6
Document that SELinux ibendport labels use a global (device name, port) key, so same-named RDMA devices in different net namespaces share a label. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-11-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26RDMA/cma: Document that CM configfs cannot be net namespace scopedJiri Pirko1-0/+4
Document the rdma_cm configfs limitation: configfs is global, so same-named RDMA devices in different net namespaces cannot both be represented there. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-10-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26RDMA/cgroup: Disambiguate devices across net namespacesJiri Pirko1-0/+1
RDMA device names are unique only within a network namespace, but an RDMA cgroup can account resources for devices from multiple namespaces. Duplicate names therefore make cgroup output ambiguous and can cause limit writes to select the wrong device. Use the system-wide RDMA device index to distinguish duplicate names while preserving the existing UAPI for unique names. Reject ambiguous name-only writes with -ENOTUNIQ and expose a complete device view to administrators. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-9-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26RDMA/srp: Make the SRP sysfs class net namespace awareJiri Pirko1-1/+15
Tag srp_class by the RDMA device's net namespace so SRP hosts derived from same-named RDMA devices can coexist across namespaces. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-8-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26RDMA/nldev: Allow setting the device name while changing net namespaceJiri Pirko2-9/+24
Accept RDMA_NLDEV_ATTR_DEV_NAME together with RDMA_NLDEV_NET_NS_FD so a netlink move can rename the device in the destination namespace. Keep the name semantics aligned with the existing RDMA rename path. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-6-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26RDMA/nldev: Report net namespace move errors through extackJiri Pirko3-7/+26
Thread extack through the existing net namespace move helper and report the main failure reasons from the core path. Keep the existing move UAPI shape unchanged. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-5-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26RDMA/core: Support renaming a device when changing its net namespaceJiri Pirko3-17/+35
Allow namespace moves to request a destination device name. Keep requested names on the same literal-name path as the existing RDMA rename operation, and keep teardown fallback naming on the trusted kernel-controlled path. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-4-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
generated by cgit (git 2.54.0.dirty) at 2026-09-30 01:26:06 +0000