summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)AuthorLines
2026-04-13vfio/xe: Reorganize the init to decouple migration from resetMichał Winiarski-18/+25
Attempting to issue reset on VF devices that don't support migration leads to the following: BUG: unable to handle page fault for address: 00000000000011f8 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 2 UID: 0 PID: 7443 Comm: xe_sriov_flr Tainted: G S U 7.0.0-rc1-lgci-xe-xe-4588-cec43d5c2696af219-nodebug+ #1 PREEMPT(lazy) Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-P DDR4 RVP, BIOS RPLPFWI1.R00.4035.A00.2301200723 01/20/2023 RIP: 0010:xe_sriov_vfio_wait_flr_done+0xc/0x80 [xe] Code: ff c3 cc cc cc cc 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 54 53 <83> bf f8 11 00 00 02 75 61 41 89 f4 85 f6 74 52 48 8b 47 08 48 89 RSP: 0018:ffffc9000f7c39b8 EFLAGS: 00010202 RAX: ffffffffa04d8660 RBX: ffff88813e3e4000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000f7c39c8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff888101a48800 R13: ffff88813e3e4150 R14: ffff888130d0d008 R15: ffff88813e3e40d0 FS: 00007877d3d0d940(0000) GS:ffff88890b6d3000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000011f8 CR3: 000000015a762000 CR4: 0000000000f52ef0 PKRU: 55555554 Call Trace: <TASK> xe_vfio_pci_reset_done+0x49/0x120 [xe_vfio_pci] pci_dev_restore+0x3b/0x80 pci_reset_function+0x109/0x140 reset_store+0x5c/0xb0 dev_attr_store+0x17/0x40 sysfs_kf_write+0x72/0x90 kernfs_fop_write_iter+0x161/0x1f0 vfs_write+0x261/0x440 ksys_write+0x69/0xf0 __x64_sys_write+0x19/0x30 x64_sys_call+0x259/0x26e0 do_syscall_64+0xcb/0x1500 ? __fput+0x1a2/0x2d0 ? fput_close_sync+0x3d/0xa0 ? __x64_sys_close+0x3e/0x90 ? x64_sys_call+0x1b7c/0x26e0 ? do_syscall_64+0x109/0x1500 ? __task_pid_nr_ns+0x68/0x100 ? __do_sys_getpid+0x1d/0x30 ? x64_sys_call+0x10b5/0x26e0 ? do_syscall_64+0x109/0x1500 ? putname+0x41/0x90 ? do_faccessat+0x1e8/0x300 ? __x64_sys_access+0x1c/0x30 ? x64_sys_call+0x1822/0x26e0 ? do_syscall_64+0x109/0x1500 ? tick_program_event+0x43/0xa0 ? hrtimer_interrupt+0x126/0x260 ? irqentry_exit+0xb2/0x710 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7877d5f1c5a4 Code: c7 00 16 00 00 00 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 80 3d a5 ea 0e 00 00 74 13 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 55 48 89 e5 48 83 ec 20 48 89 RSP: 002b:00007fff48e5f908 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007877d5f1c5a4 RDX: 0000000000000001 RSI: 00007877d621b0c9 RDI: 0000000000000009 RBP: 0000000000000001 R08: 00005fb49113b010 R09: 0000000000000007 R10: 0000000000000000 R11: 0000000000000202 R12: 00007877d621b0c9 R13: 0000000000000009 R14: 00007fff48e5fac0 R15: 00007fff48e5fac0 </TASK> This is caused by the fact that some of the xe_vfio_pci_core_device members needed for handling reset are only initialized as part of migration init. Fix the problem by reorganizing the code to decouple VF init from migration init. Fixes: 1f5556ec8b9ef ("vfio/xe: Add device specific vfio_pci driver variant for Intel graphics") Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/7352 Cc: stable@vger.kernel.org Signed-off-by: Michał Winiarski <michal.winiarski@intel.com> Reviewed-by: Kevin Tian <kevin.tian@intel.com> Link: https://lore.kernel.org/r/20260410224948.900550-1-michal.winiarski@intel.com Signed-off-by: Alex Williamson <alex@shazbot.org>
2026-04-13pnfs/flexfiles: validate ds_versions_cnt is non-zeroJenny Guanni Qu-0/+5
nfs4_ff_alloc_deviceid_node() reads version_count from XDR without checking it is non-zero. When a malicious NFS server sends a pNFS LAYOUTGET response with version_count=0, kcalloc(0, ...) returns ZERO_SIZE_PTR (0x10). The subsequent ds_versions[0] access in nfs4_ff_layout_ds_version() and other callers dereferences this invalid pointer, causing an out-of-bounds read. Add a check for version_count == 0 after parsing it from XDR, before the allocation. The OOB read was confirmed with KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] from accessing ZERO_SIZE_PTR. Fixes: d67ae825a59d ("pnfs/flexfiles: Add the FlexFile Layout Driver") Reported-by: Klaudia Kloc <klaudia@vidocsecurity.com> Reported-by: Dawid Moczadło <dawid@vidocsecurity.com> Tested-by: Jenny Guanni Qu <qguanni@gmail.com> Signed-off-by: Jenny Guanni Qu <qguanni@gmail.com> Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2026-04-13NFS/blocklayout: print each device used for SCSI layoutsChristoph Hellwig-2/+5
We already print device uses for block layouts, do the same for SCSI layouts as that greatly helps understanding the operation of the client. Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2026-04-13mlx4: correct error reporting in mlx4_master_process_vhcr()Alok Tiwari-2/+2
mlx4_master_process_vhcr() logs vhcr->errno on failures, but this field is never populated by the PF path. As a result, all failures are reported with errno 0 and err print in status case which is misleading. Use the actual return value (err) instead, translate it to FW status before logging, and report both values. Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com> Reviewed-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260409092754.508880-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-13Merge tag 'vfs-7.1-rc1.pidfs' of ↵Linus Torvalds-20/+1075
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull clone and pidfs updates from Christian Brauner: "Add three new clone3() flags for pidfd-based process lifecycle management. CLONE_AUTOREAP: CLONE_AUTOREAP makes a child process auto-reap on exit without ever becoming a zombie. This is a per-process property in contrast to the existing auto-reap mechanism via SA_NOCLDWAIT or SIG_IGN for SIGCHLD which applies to all children of a given parent. Currently the only way to automatically reap children is to set SA_NOCLDWAIT or SIG_IGN on SIGCHLD. This is a parent-scoped property affecting all children which makes it unsuitable for libraries or applications that need selective auto-reaping of specific children while still being able to wait() on others. CLONE_AUTOREAP stores an autoreap flag in the child's signal_struct. When the child exits do_notify_parent() checks this flag and causes exit_notify() to transition the task directly to EXIT_DEAD. Since the flag lives on the child it survives reparenting: if the original parent exits and the child is reparented to a subreaper or init the child still auto-reaps when it eventually exits. This is cleaner than forcing the subreaper to get SIGCHLD and then reaping it. If the parent doesn't care the subreaper won't care. If there's a subreaper that would care it would be easy enough to add a prctl() that either just turns back on SIGCHLD and turns off auto-reaping or a prctl() that just notifies the subreaper whenever a child is reparented to it. CLONE_AUTOREAP can be combined with CLONE_PIDFD to allow the parent to monitor the child's exit via poll() and retrieve exit status via PIDFD_GET_INFO. Without CLONE_PIDFD it provides a fire-and-forget pattern. No exit signal is delivered so exit_signal must be zero. CLONE_THREAD and CLONE_PARENT are rejected: CLONE_THREAD because autoreap is a process-level property, and CLONE_PARENT because an autoreap child reparented via CLONE_PARENT could become an invisible zombie under a parent that never calls wait(). The flag is not inherited by the autoreap process's own children. Each child that should be autoreaped must be explicitly created with CLONE_AUTOREAP. CLONE_NNP: CLONE_NNP sets no_new_privs on the child at clone time. Unlike prctl(PR_SET_NO_NEW_PRIVS) which a process sets on itself, CLONE_NNP allows the parent to impose no_new_privs on the child at creation without affecting the parent's own privileges. CLONE_THREAD is rejected because threads share credentials. CLONE_NNP is useful on its own for any spawn-and-sandbox pattern but was specifically introduced to enable unprivileged usage of CLONE_PIDFD_AUTOKILL. CLONE_PIDFD_AUTOKILL: This flag ties a child's lifetime to the pidfd returned from clone3(). When the last reference to the struct file created by clone3() is closed the kernel sends SIGKILL to the child. A pidfd obtained via pidfd_open() for the same process does not keep the child alive and does not trigger autokill - only the specific struct file from clone3() has this property. This is useful for container runtimes, service managers, and sandboxed subprocess execution - any scenario where the child must die if the parent crashes or abandons the pidfd or just wants a throwaway helper process. CLONE_PIDFD_AUTOKILL requires both CLONE_PIDFD and CLONE_AUTOREAP. It requires CLONE_PIDFD because the whole point is tying the child's lifetime to the pidfd. It requires CLONE_AUTOREAP because a killed child with no one to reap it would become a zombie - the primary use case is the parent crashing or abandoning the pidfd so no one is around to call waitpid(). CLONE_THREAD is rejected because autokill targets a process not a thread. If CLONE_NNP is specified together with CLONE_PIDFD_AUTOKILL an unprivileged user may spawn a process that is autokilled. The child cannot escalate privileges via setuid/setgid exec after being spawned. If CLONE_PIDFD_AUTOKILL is specified without CLONE_NNP the caller must have have CAP_SYS_ADMIN in its user namespace" * tag 'vfs-7.1-rc1.pidfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: selftests: check pidfd_info->coredump_code correctness pidfds: add coredump_code field to pidfd_info kselftest/coredump: reintroduce null pointer dereference selftests/pidfd: add CLONE_PIDFD_AUTOKILL tests selftests/pidfd: add CLONE_NNP tests selftests/pidfd: add CLONE_AUTOREAP tests pidfd: add CLONE_PIDFD_AUTOKILL clone: add CLONE_NNP clone: add CLONE_AUTOREAP
2026-04-13Merge tag 'namespaces-7.1-rc1.misc' of ↵Linus Torvalds-23/+41
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull namespace update from Christian Brauner: "Add two simple helper macros for the namespace infrastructure" * tag 'namespaces-7.1-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: nsproxy: Add FOR_EACH_NS_TYPE() X-macro and CLONE_NS_ALL
2026-04-13dt-bindings: ARM: arm,vexpress-scc: convert to DT schemaKhushal Chitturi-33/+53
Convert the ARM Versatile Express Serial Configuration Controller bindings to DT schema. Signed-off-by: Khushal Chitturi <khushalchitturi@gmail.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Reviewed-by: Liviu Dudau <liviu.dudau@arm.com> Link: https://patch.msgid.link/20260411183355.8847-1-khushalchitturi@gmail.com Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2026-04-13drivers/of: fdt: validate flat DT string properties before string usePengpeng Hou-24/+14
Firmware-supplied flat DT properties are raw byte sequences. Several early FDT helpers fetch properties such as status, model, compatible, and device_type and then use them as C strings with strcmp(), strlen(), or pr_info() without first proving that the property is NUL-terminated within its declared length. Use fdt_stringlist_get() for these string properties instead. That preserves the existing behavior for valid DTBs while rejecting malformed unterminated properties before they are passed to C string helpers. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Link: https://patch.msgid.link/20260403164501.1-drivers-of-fdt-v2-pengpeng@iscas.ac.cn Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2026-04-13drivers/of: fdt: validate stdout-path properties before parsing themPengpeng Hou-2/+2
early_init_dt_scan_chosen_stdout() fetches stdout-path and linux,stdout-path directly from the flat DT and immediately passes the result to strchrnul(). Flat DT properties are raw firmware-supplied byte sequences, and this path does not prove that either property is NUL-terminated within its declared bounds. Use fdt_stringlist_get() so malformed unterminated stdout-path properties are rejected before the local parser walks them as C strings. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Link: https://patch.msgid.link/20260403143001.1-dt-fdt-stdout-pengpeng@iscas.ac.cn Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2026-04-13dt-bindings: sram: Document qcom,hawi-imem compatibleMukesh Ojha-0/+1
On Qualcomm Hawi platform, IMEM is a block of SRAM shared across multiple IP blocks which can fall back to "mmio-sram". Document its compatible. Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com> Link: https://patch.msgid.link/20260401125528.594108-1-mukesh.ojha@oss.qualcomm.com Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2026-04-13kbuild: builddeb - avoid recompiles for non-cross-compilesMathias Krause-1/+7
Commit e2c318225ac1 ("kbuild: deb-pkg: add pkg.linux-upstream.nokernelheaders build profile") changed how install-extmod-build gets called, making it always rebuild the host programs below scripts/ if HOSTCC wasn't specified with its full triplet on the make command line. That is, apparently, needed to fix up commit f1d87664b82a ("kbuild: cross-compile linux-headers package when possible") for cross-compiles. However, in the much more common case of non-cross-compile builds this will lead to unnecessary rebuilding of host tools including gcc plugins. This, in turn, will lead to a full kernel rebuild on the next 'make bindeb-pkg' which is unfortunate. Avoid that by only triggering the rebuild of host tools for actual cross-compile builds. Signed-off-by: Mathias Krause <minipli@grsecurity.net> Fixes: e2c318225ac1 ("kbuild: deb-pkg: add pkg.linux-upstream.nokernelheaders build profile") Cc: Masahiro Yamada <masahiroy@kernel.org> Reviewed-by: Nathan Chancellor <nathan@kernel.org> Reviewed-by: Nicolas Schier <nsc@kernel.org> Link: https://patch.msgid.link/20260402145116.1010901-1-minipli@grsecurity.net Signed-off-by: Nicolas Schier <nsc@kernel.org>
2026-04-13Merge tag 'vfs-7.1-rc1.bh.metadata' of ↵Linus Torvalds-492/+474
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs buffer_head updates from Christian Brauner: "This cleans up the mess that has accumulated over the years in metadata buffer_head tracking for inodes. It moves the tracking into dedicated structure in filesystem-private part of the inode (so that we don't use private_list, private_data, and private_lock in struct address_space), and also moves couple other users of private_data and private_list so these are removed from struct address_space saving 3 longs in struct inode for 99% of inodes" * tag 'vfs-7.1-rc1.bh.metadata' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (42 commits) fs: Drop i_private_list from address_space fs: Drop mapping_metadata_bhs from address space ext4: Track metadata bhs in fs-private inode part minix: Track metadata bhs in fs-private inode part udf: Track metadata bhs in fs-private inode part fat: Track metadata bhs in fs-private inode part bfs: Track metadata bhs in fs-private inode part affs: Track metadata bhs in fs-private inode part ext2: Track metadata bhs in fs-private inode part fs: Provide functions for handling mapping_metadata_bhs directly fs: Switch inode_has_buffers() to take mapping_metadata_bhs fs: Make bhs point to mapping_metadata_bhs fs: Move metadata bhs tracking to a separate struct fs: Fold fsync_buffers_list() into sync_mapping_buffers() fs: Drop osync_buffers_list() kvm: Use private inode list instead of i_private_list fs: Remove i_private_data aio: Stop using i_private_data and i_private_lock hugetlbfs: Stop using i_private_data fs: Stop using i_private_data for metadata bh tracking ...
2026-04-13Merge tag 'vfs-7.1-rc1.fat' of ↵Linus Torvalds-8/+175
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull FAT updates from Christian Brauner: "Minor fixes for the fat filesystem" * tag 'vfs-7.1-rc1.fat' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: fat: fix stack frame size warnings in KUnit tests fat: add KUnit tests for timestamp conversion helpers
2026-04-13Merge tag 'vfs-7.1-rc1.kino' of ↵Linus Torvalds-1321/+1331
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs i_ino updates from Christian Brauner: "For historical reasons, the inode->i_ino field is an unsigned long, which means that it's 32 bits on 32 bit architectures. This has caused a number of filesystems to implement hacks to hash a 64-bit identifier into a 32-bit field, and deprives us of a universal identifier field for an inode. This changes the inode->i_ino field from an unsigned long to a u64. This shouldn't make any material difference on 64-bit hosts, but 32-bit hosts will see struct inode grow by at least 4 bytes. This could have effects on slabcache sizes and field alignment. The bulk of the changes are to format strings and tracepoints, since the kernel itself doesn't care that much about the i_ino field. The first patch changes some vfs function arguments, so check that one out carefully. With this change, we may be able to shrink some inode structures. For instance, struct nfs_inode has a fileid field that holds the 64-bit inode number. With this set of changes, that field could be eliminated. I'd rather leave that sort of cleanups for later just to keep this simple" * tag 'vfs-7.1-rc1.kino' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: nilfs2: fix 64-bit division operations in nilfs_bmap_find_target_in_group() EVM: add comment describing why ino field is still unsigned long vfs: remove externs from fs.h on functions modified by i_ino widening treewide: fix missed i_ino format specifier conversions ext4: fix signed format specifier in ext4_load_inode trace event treewide: change inode->i_ino from unsigned long to u64 nilfs2: widen trace event i_ino fields to u64 f2fs: widen trace event i_ino fields to u64 ext4: widen trace event i_ino fields to u64 zonefs: widen trace event i_ino fields to u64 hugetlbfs: widen trace event i_ino fields to u64 ext2: widen trace event i_ino fields to u64 cachefiles: widen trace event i_ino fields to u64 vfs: widen trace event i_ino fields to u64 net: change sock.sk_ino and sock_i_ino() to u64 audit: widen ino fields to u64 vfs: widen inode hash/lookup functions to u64
2026-04-13dax/fsdev: fix uninitialized kaddr in fsdev_dax_zero_page_range()John Groves-1/+4
__fsdev_dax_direct_access() returns -EFAULT without setting *kaddr when dax_pgoff_to_phys() returns -1 (pgoff out of range). The return value was ignored, leaving kaddr uninitialized before being passed to fsdev_write_dax(). Check the return value and propagate the error. Thanks to Dan Carpenter and the smatch project for reporting this. Signed-off-by: John Groves <john@groves.net> Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com> Reviewed-by: Dave Jiang <dave.jiang@intel.com> Link: https://patch.msgid.link/0100019d8262cda2-9714d31c-8fc1-4ca5-b32d-4df678240d14-000000@email.amazonses.com Signed-off-by: Ira Weiny <ira.weiny@intel.com>
2026-04-13xprtrdma: Post receive buffers after RPC completionChuck Lever-5/+9
rpcrdma_post_recvs() runs in CQ poll context and its cost falls on the latency-critical path between polling a Receive completion and waking the RPC consumer. Every cycle spent refilling the Receive Queue delays delivery of the reply to the NFS layer. Move the rpcrdma_post_recvs() call in rpcrdma_reply_handler() to after the RPC has been decoded and completed. The larger batch size from the preceding patch provides sufficient Receive Queue headroom to absorb the brief delay before buffers are replenished. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2026-04-13xprtrdma: Scale receive batch size with credit windowChuck Lever-2/+4
The fixed RPCRDMA_MAX_RECV_BATCH of 7 results in frequent small ib_post_recv batches during high-rate workloads. With a 128-slot credit window, receives are reposted every 7th completion, each batch incurring atomic serialization and a doorbell write. Replace the fixed batch constant with a per-endpoint value scaled to 25% of the negotiated credit window. For a typical 128-credit connection this raises the batch from 7 to 32, reducing doorbell frequency by roughly 4x and amortizing the per-batch atomic and MMIO costs over a larger group of receive WRs. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2026-04-13xprtrdma: Replace rpcrdma_mr_seg with xdr_buf cursorChuck Lever-158/+194
The FRWR registration path converts data through three representations: xdr_buf -> rpcrdma_mr_seg[] -> scatterlist[] -> ib_map_mr_sg(). The rpcrdma_mr_seg intermediate is a relic of when multiple registration strategies existed (FMR, physical, FRWR). Only FRWR remains, so this indirection and the 6240-byte rl_segments[260] array embedded in each rpcrdma_req serve no purpose. Introduce struct rpcrdma_xdr_cursor to track position within an xdr_buf during iterative MR registration. Rewrite frwr_map to populate scatterlist entries directly from the xdr_buf regions (head kvec, page list, tail kvec). The boundary logic for non-SG_GAPS devices is simpler because the xdr_buf structure guarantees that page-region entries after the first start at offset 0, and that head/tail kvecs are separate regions that naturally break at MR boundaries. Fix a pre-existing bug in rpcrdma_encode_write_list where the write-pad statistics accumulator added mr->mr_length from the last data MR rather than the write-pad MR. The refactored code uses ep->re_write_pad_mr->mr_length. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2026-04-13xprtrdma: Decouple frwr_wp_create from frwr_mapChuck Lever-7/+50
frwr_wp_create is the only caller of frwr_map outside the encode path. It registers a single 4-byte write-pad region from a stack- local rpcrdma_mr_seg. Inlining the registration logic directly (sg_init_table + sg_set_page + ib_dma_map_sg + ib_map_mr_sg + IOVA mangle + reg_wr setup) eliminates the coupling that would otherwise complicate the removal of rpcrdma_mr_seg from frwr_map's interface. The inlined version adds a proper error-unwind ladder: on failure, the DMA mapping (if established) is released, ep->re_write_pad_mr is cleared, and the MR is returned to the transport free list. The old frwr_map-based code relied on rpcrdma_mrs_destroy at teardown to reclaim partially-initialized MRs. This is a one-time setup path; duplicating ~20 lines is a reasonable tradeoff for decoupling the write-pad registration from the data- path MR registration. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2026-04-13xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slotChuck Lever-1/+32
xprt_rdma_alloc_slot() and xprt_rdma_free_slot() lack serialization between the buffer pool and the backlog queue. A buffer freed after rpcrdma_buffer_get() finds the pool empty but before rpc_sleep_on() places the task on the backlog is returned to the pool with no waiter to wake, leaving the task stuck on the backlog indefinitely. After joining the backlog, re-check the pool and route any recovered buffer through xprt_wake_up_backlog(), whose queue lock serializes with concurrent wakeups and avoids double-assignment of slots. Because xprt_rdma_free_slot() does not hold reserve_lock, the XPRT_CONGESTED double-check in xprt_throttle_congested() is ineffective: a task can join the backlog through that path after free_slot has already found it empty and cleared the bit. Avoid this by using xprt_add_backlog_noncongested(), which queues the task without setting XPRT_CONGESTED, so every allocation reaches xprt_rdma_alloc_slot() and its post-sleep re-check. Fixes: edb41e61a54e ("xprtrdma: Make rpc_rqst part of rpcrdma_req") Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2026-04-13xprtrdma: Avoid 250 ms delay on backlog wakeupChuck Lever-1/+1
Commit a721035477fb ("SUNRPC/xprt: async tasks mustn't block waiting for memory") changed xprt_rdma_alloc_slot() to set tk_status to -ENOMEM so that call_reserveresult() would sleep HZ/4 before retrying. That rationale applies to xprt_dynamic_alloc_slot(), where an immediate retry under memory pressure wastes CPU, but not to the RDMA backlog path: a task woken from the backlog has a slot waiting for it, so the 250 ms rpc_delay adds latency without benefit. This also aligns the code with the existing kernel-doc for xprt_rdma_alloc_slot(), which already documented %-EAGAIN. Fixes: a721035477fb ("SUNRPC/xprt: async tasks mustn't block waiting for memory") Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2026-04-13xprtrdma: Close sendctx get/put race that can block a transportChuck Lever-1/+16
rpcrdma_sendctx_get_locked() and rpcrdma_sendctx_put_locked() can race in a way that leaves XPRT_WRITE_SPACE set permanently, blocking all further sends on the transport: get_locked put_locked (Send completion) ---------- -------------------------- read rb_sc_tail -> ring full advance rb_sc_tail xprt_write_space(): test_bit(WRITE_SPACE) -> not set, return set_bit(WRITE_SPACE) return NULL (-EAGAIN) After the sender releases XPRT_LOCKED, the release path refuses to wake the next task because XPRT_WRITE_SPACE is set. The sender retries, finds XPRT_WRITE_SPACE still set, and sleeps on xprt_sending. No further Send completions arrive to clear the flag because no new Sends can be posted. With nconnect, the stalled transport's share of congestion credits are never returned, starving the remaining transports as well. Fixes: 05eb06d86685 ("xprtrdma: Fix occasional transport deadlock") Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2026-04-13nfs: update inode ctime after removexattr operationJeff Layton-4/+27
xfstest generic/728 fails with delegated timestamps. The client does a removexattr and then a stat to test the ctime, which doesn't change. The stat() doesn't trigger a GETATTR because of the delegated timestamps, so it relies on the cached ctime, which is wrong. The setxattr compound has a trailing GETATTR, which ensures that its ctime gets updated. Follow the same strategy with removexattr. Fixes: 3e1f02123fba ("NFSv4.2: add client side XDR handling for extended attributes") Reported-by: Olga Kornievskaia <aglo@umich.edu> Signed-off-by: Jeff Layton <jlayton@kernel.org> Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2026-04-13nfs: fix utimensat() for atime with delegated timestampsJeff Layton-8/+1
xfstest generic/221 is failing with delegated timestamps enabled. When the client holds a WRITE_ATTRS_DELEG delegation, and a userland process does a utimensat() for only the atime, the ctime is not properly updated. The problem is that the client tries to cache the atime update, but there is no mtime update, so the delegated attribute update never updates the ctime. Delegated timestamps don't have a mechanism to update the ctime in accordance with atime-only changes due to utimensat() and the like. Change the client to issue an RPC in this case, so that the ctime gets properly updated alongside the atime. Fixes: 40f45ab3814f ("NFS: Further fixes to attribute delegation a/mtime changes") Reported-by: Olga Kornievskaia <aglo@umich.edu> Signed-off-by: Jeff Layton <jlayton@kernel.org> Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2026-04-13NFS: improve "Server wrote zero bytes" errorOlga Kornievskaia-1/+1
When a pnfs error occurs, the IO is retried against the MDS. However, the initial IO leads to the kernel logging "Serer wrote zero bytes" when in fact the MDS IO will not fail and thus the error misleads administrators that the system is experiencing issues. When pnfs IO fails which triggers pnfs_write_done_resent_to_mds() which would end up clearing nfs_pgio_header's pages structure (copying the content into a new one to do new RPC calls to the MDS). Thus, in nfs_writeback_result() when we have no pages to work with no need to try and also therefore skip logging the message about 0bytes. Fixes: 6c75dc0d498c ("NFS: merge _full and _partial write rpc_ops") Suggested-by: Trond Myklebust <trond.myklebust@hammerspace.com> Signed-off-by: Olga Kornievskaia <okorniev@redhat.com> Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2026-04-13ALSA: usb-audio: Exclude Scarlett 18i20 1st Gen from SKIP_IFACE_SETUPGeoffrey D. Bennett-0/+1
Same issue as the other 1st Gen Scarletts: QUIRK_FLAG_SKIP_IFACE_SETUP causes distorted audio on the Scarlett 18i20 1st Gen (1235:800c). Fixes: 38c322068a26 ("ALSA: usb-audio: Add QUIRK_FLAG_SKIP_IFACE_SETUP") Reported-by: tucktuckg00se [https://github.com/geoffreybennett/linux-fcp/issues/54] Signed-off-by: Geoffrey D. Bennett <g@b4.vu> Link: https://patch.msgid.link/ad0ozNnkcFrcjVQz@m.b4.vu Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-13Merge branch 'pci/misc'Bjorn Helgaas-11/+8
- Warn only once about invalid ACS kernel parameter format (Richard Cheng) - Suppress FW_BUG warning when writing sysfs 'numa_node' with the current value (Li RongQing) - Drop redundant 'depends on PCI' from Kconfig (Julian Braha) * pci/misc: PCI: Clean up dead code in Kconfig PCI/sysfs: Suppress FW_BUG warning when NUMA node already matches PCI: Use pr_warn_once() for ACS parameter parse failure PCI: of: Reduce severity of missing of_root error message
2026-04-13Merge branch 'pci/controller/rzg3s-host'Bjorn Helgaas-110/+376
- Assert (not deassert) resets in probe error path (John Madieu) - Assert resets in suspend path in reverse order they were deasserted during probe (John Madieu) - Rework inbound window algorithm to prevent mapping more than intended region and enforce alignment on size, to prepare for RZ/G3E support (John Madieu) - Fix renesas,r9a08g045s33-pcie 'serr_cor' typo and convert properties from 'description' to 'const' for better validation (John Madieu) - Add RZ/G3E to DT binding and to driver (John Madieu) * pci/controller/rzg3s-host: PCI: rzg3s-host: Add support for RZ/G3E PCIe controller PCI: rzg3s-host: Add PCIe Gen3 (8.0 GT/s) link speed support PCI: rzg3s-host: Explicitly set class code for RZ/G3E compatibility PCI: rzg3s-host: Add SoC-specific configuration and initialization callbacks PCI: rzg3s-host: Make configuration reset lines optional PCI: rzg3s-host: Make SYSC register offsets SoC-specific dt-bindings: PCI: renesas,r9a08g045s33-pcie: Document RZ/G3E SoC dt-bindings: PCI: renesas,r9a08g045s33-pcie: Fix naming properties PCI: rzg3s-host: Rework inbound window algorithm for supporting RZ/G3E SoC PCI: rzg3s-host: Reorder reset assertion during suspend PCI: rzg3s-host: Fix reset handling in probe error path # Conflicts: # drivers/pci/controller/pcie-rzg3s-host.c
2026-04-13Merge branch 'pci/controller/mediatek-gen3'Bjorn Helgaas-99/+133
- Use dev_err_probe() to simplify error paths and make deferred probe messages visible in /sys/kernel/debug/devices_deferred (Chen-Yu Tsai) - Initialize IRQ domains earlier to remove need for cleanup if it fails (Chen-Yu Tsai) - Set up controller windows and MSI before bringing the link up to separate controller init and things related to downstream devices (Chen-Yu Tsai) - Split out device power up and down helpers (Chen-Yu Tsai) - Power off device if setup fails (Chen-Yu Tsai) - Integrate new pwrctrl API to enable power control for WiFi/BT adapters on mainboard or in PCIe or M.2 slots (Chen-Yu Tsai) - Prevent leaking IRQ domains when IRQ not found (Chen-Yu Tsai) * pci/controller/mediatek-gen3: PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found PCI: mediatek-gen3: Integrate new pwrctrl API PCI: mediatek-gen3: Disable device if further setup fails PCI: mediatek-gen3: Split out device power helpers PCI: mediatek-gen3: Add error path for resume driver callbacks PCI: mediatek-gen3: Move controller setup steps before PERST# control PCI: mediatek-gen3: Move mtk_pcie_setup_irq() out of mtk_pcie_setup() PCI: mediatek-gen3: Clean up mtk_pcie_parse_port() with dev_err_probe()
2026-04-13Merge branch 'pci/controller/mediatek'Bjorn Helgaas-1/+1
- Increase snprintf() buffer size to avoid truncation warnings (Ryder Lee) * pci/controller/mediatek: PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port()
2026-04-13Merge branch 'pci/controller/dwc-tegra194'Bjorn Helgaas-105/+168
- Poll less aggressively and non-atomically for PME_TO_Ack during transition to L2 (Vidya Sagar) - Increase LTSSM poll time on surprise link down (Manikanta Maddireddy) - Disable LTSSM after transition to Detect on surprise link down to stop toggling between Polling and Detect (Manikanta Maddireddy) - Don't force the device into the D0 state before L2 when suspending or shutting down the controller (Vidya Sagar) - Disable PERST# IRQ only in Endpoint mode because it's not registered in Root Port mode (Manikanta Maddireddy) - Handle 'nvidia,refclk-select' as optional (Vidya Sagar) - Disable direct speed change in Endpoint mode so link speed change is controlled by the host (Vidya Sagar) - Set LTR values before link up to avoid bogus LTR messages with 0 latency (Vidya Sagar) - Allow system suspend when the Endpoint link is down (Vidya Sagar) - During remove, free resources allocated during Endpoint .probe() (Vidya Sagar) - Use DWC IP core version, not Tegra custom values, to avoid DWC core version check warnings (Manikanta Maddireddy) - Apply ECRC workaround to devices based on DesignWare 5.00a as well as 4.90a (Manikanta Maddireddy) - Disable PM Substate L1.2 in Endpoint mode to work around Tegra234 erratum (Vidya Sagar) - Delay post-PERST# cleanup until core is powered on to avoid CBB timeout (Manikanta Maddireddy) - Assert CLKREQ# so switches that forward it to their downstream side can bring up those links successfully (Vidya Sagar) - Calibrate pipe to UPHY for Endpoint mode to reset stale PLL state from any previous bad link state (Vidya Sagar) - Remove IRQF_ONESHOT flag from Endpoint interrupt registration so DMA driver and Endpoint controller driver can share the interrupt line (Vidya Sagar) - Enable DMA interrupt to support DMA in both Root Port and Endpoint modes (Vidya Sagar) - Enable hardware link retraining after link goes down in Endpoint mode (Vidya Sagar) - Add DT binding and driver support for core clock monitoring (Vidya Sagar) * pci/controller/dwc-tegra194: PCI: tegra194: Add core monitor clock support dt-bindings: PCI: tegra194: Add monitor clock support PCI: tegra194: Enable hardware hot reset mode in Endpoint mode PCI: tegra194: Enable DMA interrupt PCI: tegra194: Remove IRQF_ONESHOT flag during Endpoint interrupt registration PCI: tegra194: Calibrate pipe to UPHY for Endpoint mode PCI: tegra194: Assert CLKREQ# explicitly by default PCI: tegra194: Fix CBB timeout caused by DBI access before core power-on PCI: tegra194: Disable L1.2 capability of Tegra234 EP PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well PCI: tegra194: Use DWC IP core version PCI: tegra194: Free up Endpoint resources during remove() PCI: tegra194: Allow system suspend when the Endpoint link is not up PCI: tegra194: Set LTR message request before PCIe link up in Endpoint mode PCI: tegra194: Disable direct speed change for Endpoint mode PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select" PCI: tegra194: Disable PERST# IRQ only in Endpoint mode PCI: tegra194: Don't force the device into the D0 state before L2 PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down PCI: tegra194: Increase LTSSM poll time on surprise link down PCI: tegra194: Fix polling delay for L2 state
2026-04-13Merge branch 'pci/controller/dwc-rockchip'Bjorn Helgaas-0/+215
- Add tracepoints for PCIe controller LTSSM transitions and link rate changes (Shawn Lin) - Trace LTSSM events collected by the dw-rockchip debug FIFO (Shawn Lin) * pci/controller/dwc-rockchip: PCI: dw-rockchip: Add pcie_ltssm_state_transition tracepoint support Documentation: tracing: Add PCI controller event documentation PCI: trace: Add PCI controller tracepoint feature
2026-04-13Merge branch 'pci/controller/dwc-rcar-gen4-ep'Bjorn Helgaas-1/+3
- Mark BAR0 and BAR2 as Resizable (Koichiro Den) - Reduce EPC BAR alignment requirement to 4K (Koichiro Den) * pci/controller/dwc-rcar-gen4-ep: PCI: dwc: rcar-gen4: Change EPC BAR alignment to 4K as per the documentation PCI: dwc: rcar-gen4: Mark BAR0 and BAR2 as Resizable BARs in endpoint mode # Conflicts: # drivers/pci/controller/dwc/pcie-rcar-gen4.c
2026-04-13Merge branch 'pci/controller/dwc-qcom'Bjorn Helgaas-6/+11
- Advertise 'Hot-Plug Capable' and set 'No Command Completed Support' since Qcom Root Ports support hotplug events like DL_Up/Down and can accept writes to Slot Control without delays between writes (Krishna Chaitanya Chundru) * pci/controller/dwc-qcom: PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion support
2026-04-13Merge branch 'pci/controller/dwc-layerscape'Bjorn Helgaas-2/+16
- Allow Layerscape host controller driver to be build as a removable module (Sascha Hauer) * pci/controller/dwc-layerscape: PCI: layerscape: Allow to compile as module
2026-04-13Merge branch 'pci/controller/dwc-imx6'Bjorn Helgaas-27/+35
- Fix device node reference leak in imx_pcie_probe() (Felix Gu) - Delay instead of polling for L2/L3 Ready after PME_Turn_off when suspending i.MX6SX because LTSSM registers are inaccessible (Richard Zhu) - Separate PERST# assertion (for resetting endpoints) from core reset (for resetting the RC itself) to prepare for new DTs with PERST# GPIO in per-Root Port nodes (Sherry Sun) - Retain the Root Port MSI capability on i.MX7D, i.MX8MM, and i.MX8MQ so MSI from downstream devices will work (Richard Zhu) - Fix the i.MX95 reference clock source selection when internal refclk is used (Franz Schnyder) * pci/controller/dwc-imx6: PCI: imx6: Fix reference clock source selection for i.MX95 PCI: imx6: Keep Root Port MSI capability with iMSI-RX to work around hardware bug PCI: imx6: Separate PERST# assertion from core reset functions PCI: imx6: Change imx_pcie_deassert_core_reset() return type to void PCI: imx6: Skip waiting for L2/L3 Ready on i.MX6SX PCI: imx6: Fix device node reference leak in imx_pcie_probe()
2026-04-13Merge branch 'pci/controller/dwc-eswin'Bjorn Helgaas-0/+592
- Add DT binding and driver for ESWIN PCIe Root Complex (Senchuan Zhang) * pci/controller/dwc-eswin: PCI: eswin: Add ESWIN PCIe Root Complex driver dt-bindings: PCI: eswin: Add ESWIN PCIe Root Complex # Conflicts: # drivers/pci/controller/dwc/Kconfig # drivers/pci/controller/dwc/Makefile
2026-04-13Merge branch 'pci/controller/dwc-andes-qilai'Bjorn Helgaas-0/+305
- Add Andes QiLai SoC PCIe host driver support (Randolph Lin) * pci/controller/dwc-andes-qilai: PCI: qilai: Add Andes QiLai SoC PCIe host driver support dt-bindings: PCI: Add Andes QiLai PCIe support # Conflicts: # drivers/pci/controller/dwc/Makefile
2026-04-13Merge branch 'pci/controller/dwc-amd-mdb'Bjorn Helgaas-1/+1
- Correct the IRQ number logged in INTx error message (Rakuram Eswaran) * pci/controller/dwc-amd-mdb: PCI: amd-mdb: Correct IRQ number in INTx error message
2026-04-13Merge branch 'pci/controller/dwc'Bjorn Helgaas-841/+111
- Continue with system suspend even if an Endpoint doesn't respond with PME_TO_Ack message (Manivannan Sadhasivam) - Remove the Baikal-T1 controller driver since it never quite became usable (Andy Shevchenko) - Set Endpoint MSI-X Table Size in the correct function of a multi-function device when configuring MSI-X, not in Function 0 (Aksh Garg) - Set Max Link Width and Max Link Speed for all functions of a multi-function device, not just Function 0 (Aksh Garg) - Clean up in the dw_pcie_resume_noirq() error path (Manivannan Sadhasivam) - Expose PCIe event counters in groups 5-7 in debugfs (Hans Zhang) - Fix type mismatch for kstrtou32_from_user() in debugfs write functions (Hans Zhang) * pci/controller/dwc: PCI: dwc: Fix type mismatch for kstrtou32_from_user() return value PCI: dwc: Expose PCIe event counters for groups 5 to 7 over debugfs PCI: dwc: Perform cleanup in the error path of dw_pcie_resume_noirq() PCI: dwc: ep: Mirror the max link width and speed fields to all functions PCI: dwc: ep: Fix MSI-X Table Size configuration in dw_pcie_ep_set_msix() PCI: dwc: Remove not-going-to-be-supported code for Baikal SoC PCI: dwc: Proceed with system suspend even if the endpoint doesn't respond with PME_TO_Ack message
2026-04-13Merge branch 'pci/controller/cadence-sky1'Bjorn Helgaas-2/+4
- Release ECAM config on probe failure (Felix Gu) * pci/controller/cadence-sky1: PCI: sky1: Use boolean true for is_rc field PCI: sky1: Fix missing cleanup of ECAM config on probe failure
2026-04-13Merge branch 'pci/controller/cadence-sg2042'Bjorn Helgaas-0/+28
- Add cadence core flags to disable advertising broken ASPM support (Yao Zi) - Disable ASPM L0s and L1 on Sophgo 2042 PCIe Root Ports that advertise support for them (Yao Zi) * pci/controller/cadence-sg2042: PCI: sg2042: Avoid L0s and L1 on Sophgo 2042 PCIe Root Ports PCI: cadence: Add flags for disabling ASPM capability for broken Root Ports
2026-04-13Merge branch 'pci/controller/cadence'Bjorn Helgaas-31/+25
- Implement byte/word config reads with dword (32-bit) reads because some Cadence controllers don't support sub-dword accesses (Aksh Garg) * pci/controller/cadence: PCI: cadence: Use cdns_pcie_read_sz() for byte or word read access
2026-04-13Merge branch 'pci/controller/aspeed'Bjorn Helgaas-4/+4
- Fix IRQ domain leak on platform_get_irq() failure (Felix Gu) * pci/controller/aspeed: PCI: aspeed: Fix IRQ domain leak on platform_get_irq() failure
2026-04-13Merge branch 'pci/controller/max-link-speed'Bjorn Helgaas-26/+41
- Add pcie_get_link_speed() to encapsulate and bounds-check pcie_link_speed[] accesses (Hans Zhang) - Validate max-link-speed from DT in j721e, brcmstb, mediatek-gen3, rzg3s (where the actual controller constraints are known), and remove it from the generic OF DT accessor (Hans Zhang) * pci/controller/max-link-speed: PCI: of: Remove max-link-speed generation validation PCI: controller: Validate max-link-speed PCI: j721e: Validate max-link-speed from DT PCI: dwc: Use pcie_get_link_speed() helper for safe array access PCI: Add pcie_get_link_speed() helper for safe array access
2026-04-13Merge branch 'pci/endpoint'Bjorn Helgaas-250/+313
- Free all previously requested IRQs in epf_ntb_db_bar_init_msi_doorbell() error path (Koichiro Den) - Free doorbell IRQ in pci-epf-test only if it has actually been requested (Koichiro Den) - Discard pointer to doorbell message array after freeing it in pci_epf_alloc_doorbell() error path (Koichiro Den) - Advertise dynamic inbound mapping support in pci-epf-test and update host pci_endpoint_test to skip doorbell testing if not advertised by endpoint (Koichiro Den) - Constify configfs item and group operations (Christophe JAILLET) - Use array_index_nospec() on configfs MW show/store attributes (Koichiro Den) - Return -ERANGE (not -EINVAL) for configfs out-of-range MW index (Koichiro Den) - Return 0, not remaining timeout, when MHI eDMA ops complete so mhi_ep_ring_add_element() doesn't interpret non-zero as failure (Daniel Hodges) - Remove vntb and ntb duplicate resource teardown that leads to oops when .allow_link() fails or .drop_link() is called (Koichiro Den) - Disable vntb delayed work before clearing BAR mappings and doorbells to avoid oops caused by doing the work after resources have been torn down (Koichiro Den) - Fix pci_epf_add_vepf() kernel-doc typo (Alok Tiwari) - Propagate pci_epf_create() errors to pci_epf_make() callers (Alok Tiwari) - Remove redundant BAR_RESERVED annotation for the high order part of a 64-bit BAR (Niklas Cassel) - Add a way to describe reserved subregions within BARs, e.g., platform-owned fixed register windows, and use it for the RK3588 BAR4 DMA ctrl window (Koichiro Den) - Add BAR_DISABLED for BARs that will never be available to an EPF driver, and change some BAR_RESERVED annotations to BAR_DISABLED (Niklas Cassel) - Disable BARs in common code instead of in each glue driver (Niklas Cassel) - Advertise reserved BARs in Capabilities so host-side drivers can skip them (Niklas Cassel) - Skip reserved BARs in selftests (Niklas Cassel) - Improve error messages and include device name when available (Manivannan Sadhasivam) - Add NTB .get_dma_dev() callback for cases where DMA API requires a different device, e.g., vNTB devices (Koichiro Den) - Return -EINVAL, not -ENOSPC, if endpoint test determines the subrange size is too small (Koichiro Den) - Add reserved region types for MSI-X Table and PBA so Endpoint controllers can them as describe hardware-owned regions in a BAR_RESERVED BAR (Manikanta Maddireddy) - Make Tegra194/234 BAR0 programmable and remove 1MB size limit (Manikanta Maddireddy) - Expose Tegra BAR2 (MSI-X) and BAR4 (DMA) as 64-bit BAR_RESERVED (Manikanta Maddireddy) - Add Tegra194 and Tegra234 device table entries to pci_endpoint_test (Manikanta Maddireddy) - Skip the BAR subrange selftest if there are not enough inbound window resources to run the test (Christian Bruel) * pci/endpoint: selftests: pci_endpoint: Skip BAR subrange test on -ENOSPC misc: pci_endpoint_test: Add Tegra194 and Tegra234 device table entries PCI: tegra194: Expose BAR2 (MSI-X) and BAR4 (DMA) as 64-bit BAR_RESERVED PCI: tegra194: Make BAR0 programmable and remove 1MB size limit PCI: endpoint: Add reserved region type for MSI-X Table and PBA misc: pci_endpoint_test: Use -EINVAL for small subrange size PCI: endpoint: pci-epf-vntb: Implement .get_dma_dev() NTB: ntb_transport: Use ntb_get_dma_dev() for DMA buffers NTB: core: Add .get_dma_dev() callback to ntb_dev_ops PCI: endpoint: Improve error messages PCI: endpoint: Print the EPF name in the error log of pci_epf_make() selftests: pci_endpoint: Skip reserved BARs misc: pci_endpoint_test: Give reserved BARs a distinct error code PCI: endpoint: pci-epf-test: Advertise reserved BARs PCI: dwc: Disable BARs in common code instead of in each glue driver PCI: dwc: Replace certain BAR_RESERVED with BAR_DISABLED in glue drivers PCI: endpoint: Introduce pci_epc_bar_type BAR_DISABLED PCI: dw-rockchip: Describe RK3588 BAR4 DMA ctrl window PCI: endpoint: Describe reserved subregions within BARs PCI: endpoint: Allow only_64bit on BAR_RESERVED PCI: endpoint: Do not mark the BAR succeeding a 64-bit BAR as BAR_RESERVED PCI: endpoint: Propagate error from pci_epf_create() PCI: endpoint: Fix typo in pci_epf_add_vepf() kernel-doc PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete PCI: endpoint: pci-epf-vntb: Return -ERANGE for out-of-range MW index PCI: endpoint: pci-epf-vntb: Use array_index_nospec() on mws_size[] access PCI: endpoint: Constify struct configfs_item_operations and configfs_group_operations selftests: pci_endpoint: Skip doorbell test when unsupported misc: pci_endpoint_test: Gate doorbell test on dynamic inbound mapping PCI: endpoint: pci-epf-test: Advertise dynamic inbound mapping support PCI: endpoint: pci-ep-msi: Fix error unwind and prevent double alloc PCI: endpoint: pci-epf-test: Don't free doorbell IRQ unless requested PCI: endpoint: pci-epf-vntb: Fix MSI doorbell IRQ unwind
2026-04-13Merge branch 'pci/dt-binding'Bjorn Helgaas-19/+35
- Add 'power-domains' to cix,sky1-pcie-host DT binding for Sky1 controller SCMI power domain (Gary Yang) - Increase 'clocks' maxItems to 6 in fsl,imx6q-pcie-common DT binding (Richard Zhu) - Add i.MX94 and i.MX943 to fsl,imx6q-pcie-ep DT binding (Richard Zhu) * pci/dt-binding: dt-bindings: PCI: imx6q-pcie: Add i.MX94 and i.MX943 SoCs dt-bindings: PCI: imx6q-pcie: Fix maxItems of clocks and clock-names dt-bindings: PCI: cix,sky1-pcie-host: Add power-domains
2026-04-13Merge branch 'pci/virtualization'Bjorn Helgaas-0/+3
- Avoid FLR for AMD NPU device, where it causes the device to hang (Lizhi Hou) * pci/virtualization: PCI: Avoid FLR for AMD NPU device
2026-04-13Merge branch 'pci/vga'Bjorn Helgaas-3/+29
- Return vga_get_uninterruptible() back to userspace in the /dev/vga_arbiter path so user can tell whether VGA routing was updated (Simon Richter) - Make pci_set_vga_state() fail if bridge doesn't support VGA routing, i.e., PCI_BRIDGE_CTL_VGA is not writable, and return errors up to vga_get() callers (Simon Richter) * pci/vga: PCI/VGA: Fail pci_set_vga_state() if VGA decoding not supported PCI/VGA: Pass errors from pci_set_vga_state() up PCI/VGA: Pass vga_get_uninterruptible() errors to userspace
2026-04-13Merge branch 'pci/resource'Bjorn Helgaas-52/+199
- Prevent assigning space to unimplemented bridge windows; previously we mistakenly assumed prefetchable window existed and assigned space and put a BAR there (Ahmed Naseef) - Avoid shrinking bridge windows to fit in the initial Root Port window; this fixes one problem with devices with large BARs connected via switches, e.g., Thunderbolt (Ilpo Järvinen) - Retain information about optional resources to make assignment during rescan more likely to succeed (Ilpo Järvinen) - Add __resource_contains_unbound() for use in finding space for resources with no address assigned (Ilpo Järvinen) - Pass full extent of empty space, not just the aligned space, to resource_alignf callback so free space before the requested alignment can be used (Ilpo Järvinen) - Remove unnecessary second alignment from ARM, m68k, MIPS (Ilpo Järvinen) - Place small resources before larger ones for better utilization of address space (Ilpo Järvinen) - Fix alignment calculation for resource size larger than align, e.g., bridge windows larger than the 1MB required alignment (Ilpo Järvinen) * pci/resource: PCI: Fix alignment calculation for resource size larger than align PCI: Align head space better PCI: Rename window_alignment() to pci_min_window_alignment() parisc/PCI: Clean up align handling MIPS: PCI: Remove unnecessary second application of align m68k/PCI: Remove unnecessary second application of align ARM/PCI: Remove unnecessary second application of align resource: Rename 'tmp' variable to 'full_avail' resource: Pass full extent of empty space to resource_alignf callback resource: Add __resource_contains_unbound() for internal contains checks PCI: Fix premature removal from realloc_head list during resource assignment PCI: Prevent shrinking bridge window from its required size PCI: Prevent assignment to unsupported bridge windows