kernel/git/next/linux-next.git/drivers/ata, branch master

Merge branch 'for-next' of https://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git

2026-09-08T19:43:51+00:00

Merge branch 'for-next' of https://git.kernel.org/pub/scm/linux/kernel/git/libata/linux

2026-09-08T18:37:41+00:00

ata: libata-scsi: do not raise UA for storage element depopulation and restoration

2026-09-03T14:10:44+00:00

The libata command completion for the ATA commands REMOVE ELEMENT AND TRUNCATE and RESTORE ELEMENTS AND REBUILD is handled using the function ata_scsi_depop_ua_cap_changed_complete(). This completion function raises a UNIT ATTENTION with the additional sense code CAPACITY DATA HAS CHANGED. But doing so, the scsi layer seeing the UNIT ATTENTION sense key ends up failing the command, even if the command result is in fact OK. The SAT specifications do provide more details about the capacity change should be notified, and that relies on the ACCESSIBLE CAPACITY field of the IDENTIFY DATA retrieved before or after the command is issued, and then raising a UNIT ATTENTION if the capacity has really changed. However, we do not have any simple mean to raise a unit attention from libata-scsi. So rather than seeing the REMOVE ELEMENT AND TRUNCATE and RESTORE ELEMENTS AND REBUILD commands failing, remove the function ata_scsi_depop_ua_cap_changed_complete() and rely on the regular completion callback. Since for now these commands can only be issued as passthrough commands, the user is responsible for revalidating the device capacity after executing these commands. Fixes: db496721cb0d ("ata: libata-scsi: add support for the REMOVE ELEMENT AND TRUNCATE command") Fixes: 1e307ca61a9c ("ata: libata-scsi: add support for the RESTORE ELEMENTS AND REBUILD command") Signed-off-by: Damien Le Moal Link: https://lore.kernel.org/r/20260902020828.1436048-1-dlemoal@kernel.org Signed-off-by: Niklas Cassel

ata: ahci: work around lost interrupts on Marvell 88SE61xx

2026-09-02T05:00:09+00:00

ahci_single_level_irq_intr() services the ports first and clears the global HOST_IRQ_STAT afterwards, as recommended by AHCI 1.1 section 10.6.2. The Marvell 88SE6111/6121/6145 family stops reporting interrupts for a port when HOST_IRQ_STAT is cleared while PxIS still holds bits: PxIS keeps its content, HOST_IRQ_STAT reads back as 0, the port is never looked at again, and the command in flight only ends in a timeout. Measured on a Seagate Blackarmor NAS440 (Marvell 88F6281 Kirkwood, 88SE6121 rev B2 behind PCIe) by polling the AHCI registers from userspace while an IDENTIFY was outstanding: t=303.046 irqs 127 PxIS 0x00000000 PxCI 0x00000001 IDENTIFY issued t=303.057 irqs 128 PxIS 0x00000020 PxCI 0x00000000 CI cleared, DPS set, one interrupt taken ... PxIS stays 0x00000020, HOST_IRQ_STAT stays 0 ... t~308.05 qc timeout after 5000 msecs The command had completed - PxCI was clear and PxIS had DPS set - so ahci_qc_complete() would have completed it. It never got the chance because the handler read HOST_IRQ_STAT as 0 and returned IRQ_NONE. Marvell's own driver for these chips clears the two registers in the opposite order and says so ("clear global before channel"), and ahci_xgene handles its broken edge latch the same way. Since the reordering costs at most one spurious interrupt per valid one on conforming controllers, do it in a private interrupt handler selected for board_ahci_mv instead of changing libahci for everyone. With this applied, SATA-2 and SATA-3 disks work at 3.0 Gbps on the 88SE6121 without the drive-side 1.5 Gbps jumper that was needed before. Time from link up to a successful IDENTIFY: WDC WD5000AADS-00S9B0 port 0 7 ms (never identified before) WDC WD3202ABYS-01B7A0 port 1 28 ms WDC WD30EFRX-68EUZN0 port 1 200 ms (3 TB, HPA detection ok) Only the 88SE6121 was tested; board_ahci_mv also covers the 88SE6145, which Marvell's driver treats identically. Fixes: cd70c26617f4 ("[libata] AHCI: Add support for Marvell AHCI-like chips (initially 6145)") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/linux-ide/db6b48b7-d69a-564b-24f0-75fbd6a9e543@noerenberg.de/ Link: https://bugzilla.kernel.org/show_bug.cgi?id=216094 Signed-off-by: Hajo Noerenberg Reviewed-by: Damien Le Moal Acked-by: Pali Rohar Link: https://lore.kernel.org/r/20260831124303.920391-1-hajo-linux-ide@noerenberg.de Signed-off-by: Niklas Cassel

scsi: core: Drop Scsi_Host.default_lock

2026-09-02T02:46:18+00:00

Back in the 2.6.xx days, it was possible to for low-level drivers to set the shost lock pointer. That is why there is a default lock and a pointer to the shost lock. However, support for this has long been removed, so drop Scsi_Host.default_lock and make Scsi_Host.host_lock as the actual lock. Getting the address of embedded host_lock structure just requires adding a fixed offset value to the shost pointer. However, getting the value of the host_lock pointer requires loading from a fixed offset to the shost pointer. The latter should be very slightly slower, which is relevant as this lock is used a lot throughout the core code and drivers. Signed-off-by: John Garry Acked-by: Damien Le Moal # ata parts Reviewed-by: Hannes Reinecke Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260831095821.3486994-1-john.g.garry@oracle.com Signed-off-by: Martin K. Petersen (Oracle)

ata: pata_parport: Fix use-after-free in new_device_store

2026-08-31T09:24:15+00:00

The function new_device_store() calls driver_find() without any protection against concurrent driver unregistration. This can lead to a use-after-free (UAF) when a driver is unloaded (via rmmod) in parallel with a new device addition via sysfs. The race window exists because driver_find() returns a pointer to the driver's private data, but does not increase its reference count. The caller is responsible for ensuring the driver remains valid, but new_device_store() did not hold any lock or reference during the lookup and subsequent use. Concurrently, pata_parport_unregister_driver() releases the pi_mutex before calling driver_unregister(), allowing new_device_store to proceed with a stale pointer after the driver has been freed. Fix this by expanding the critical section protected by pi_mutex in both functions: - In new_device_store(): acquire pi_mutex before calling driver_find(), and keep it held until all uses of the found driver pointer are completed. - In pata_parport_unregister_driver(): hold pi_mutex throughout the entire unregistration process, including the driver_unregister() call, so that no concurrent lookup can see a partially removed driver. Thread A (new_device_store) | Thread B (pata_parport_unregister_driver) driver_find("ate") | | mutex_lock(&pi_mutex) | idr_remove(&protocols, id) | mutex_unlock(&pi_mutex) | driver_unregister(&pr->driver) | (frees driver_private) /* continues using stale driv */| -> UAF! | Logs: BUG: KASAN: slab-use-after-free in driver_find+0xd0/0xd4 Read of size 8 at addr ffffff9f970dc690 by task sh/4737 Call trace: show_stack+0x14/0x1c (C) dump_stack_lvl+0x70/0x84 print_report+0xf4/0x5a4 kasan_report+0xa0/0xe4 __asan_report_load8_noabort+0x18/0x20 driver_find+0xd0/0xd4 new_device_store+0x140/0x30c [pata_parport] bus_attr_store+0x5c/0x94 sysfs_kf_write+0x1c4/0x25c ... Allocated by task 4734: kasan_save_stack+0x28/0x4c kasan_save_track+0x1c/0x34 kasan_save_alloc_info+0x3c/0x4c __kasan_kmalloc+0x98/0xac __kmalloc_cache_noprof+0x158/0x3cc bus_add_driver+0x70/0x4d8 driver_register+0xf0/0x3b0 pata_parport_register_driver+0xb8/0x1c4 [pata_parport] 0xffffffc07f5ce014 do_one_initcall+0xb8/0x36c do_init_module+0x230/0x6d4 ... Freed by task 4737: kasan_save_stack+0x28/0x4c kasan_save_track+0x1c/0x34 kasan_save_free_info+0x48/0x8c __kasan_slab_free+0x5c/0x84 kfree+0x174/0x3e0 driver_release+0x1c/0x7c kobject_put+0x178/0x47c driver_find+0x78/0xd4 new_device_store+0x140/0x30c [pata_parport] bus_attr_store+0x5c/0x94 sysfs_kf_write+0x1c4/0x25c ... Fixes: 246a1c4c6b7f ("ata: pata_parport: add driver (PARIDE replacement)") Reported-by: Shuangpeng Bai Closes: https://lore.kernel.org/lkml/20260728024015.2014674-1-shuangpeng.kernel@gmail.com/ Signed-off-by: Pei Xiao Link: https://lore.kernel.org/r/77dad1184ebd0e1e7ea541d4207568f8bc5ec01f.1785381141.git.xiaopei01@kylinos.cn Signed-off-by: Niklas Cassel

ata: pata_cswarp: Add Amiga cslab ata support

2026-08-31T08:25:18+00:00

Driver for the on-board IDE interface on CS-Lab Warp Expansion Card (NOTE that idemode=native has to be set in Warp Configuration) Assisted-by: Claude_Code:claude-opus-5 Signed-off-by: Paolo Pisati Reviewed-by: Damien Le Moal Link: https://lore.kernel.org/r/20260826160911.460165-2-p.pisati@gmail.com Signed-off-by: Niklas Cassel

ata: add where missing

2026-08-31T07:29:39+00:00

It appears that libahci.c, ahci.c as well as the ahci_brcm, ahci_ceva and ahci_qoriq drivers are using runtime PM operations without including . This header is somehow being indirectly provided by , which would like to drop it (none of the functions it exports need it). Signed-off-by: Vladimir Oltean Acked-by: Damien Le Moal Link: https://lore.kernel.org/r/20260810132502.460566-1-vladimir.oltean@nxp.com Signed-off-by: Niklas Cassel

ata: ata_generic: Do not bind to devices that are not IDE controllers

2026-08-31T05:14:12+00:00

syzbot force-bound ata_generic to 0000:00:03.0 on a QEMU arm64 virt machine. That device is a virtio-blk-pci device holding the root file system, and it reports PCI class 0x010000, i.e. PCI_CLASS_STORAGE_SCSI. QEMU gives the virtio-blk-pci device a legacy virtio I/O BAR0 and a 4 KiB MSI-X BAR1, so both resources are non-empty, the port is not discarded, and the device control register ends up in the middle of the MSI-X table. The emulated device rejects the byte write, and arm64 reports the resulting bus error as a fatal synchronous external abort: Internal error: synchronous external abort: 0000000096000050 [#1] SMP pc : ata_sff_freeze+0x7c/0x90 drivers/ata/libata-sff.c:1606 Call trace: ata_sff_freeze+0x7c/0x90 ata_eh_freeze_port+0x34/0x5c ata_host_start+0x13c/0x228 ata_pci_sff_activate_host+0x50/0x340 ata_pci_init_one+0x19c/0x1d8 ata_pci_bmdma_init_one+0x14/0x20 ata_generic_init_one+0xc4/0x1ac local_pci_probe+0x40/0xa8 pci_device_probe+0xd8/0x288 really_probe+0xbc/0x2bc device_driver_attach+0x48/0xb4 bind_store+0x7c/0xd8 Refuse devices which neither report the IDE class nor appear in our ID table. Table entries keep binding as before, because some of the listed controllers cannot be assumed to report the IDE class. A controller which needs ata_generic but does not report the IDE class should get an ID table entry, which is what the table is for. Binding a driver to unrelated hardware requires root and is what driver_override is meant to do, so this does not fix a privilege boundary. This change only stops ata_generic from binding to a PCI device which it has no reason to believe to be an IDE controller. Reported-by: syzbot+891c7b195b408052e519@syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-ide/6a82bc54.10853dc7.22f513.001b.GAE@google.com/ Reviewed-by: Damien Le Moal Link: https://lore.kernel.org/r/20260818094205.2672967-2-cassel@kernel.org Signed-off-by: Niklas Cassel

Merge tag 'pci-v7.3-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci

2026-08-23T19:44:10+00:00

Pull PCI updates from Bjorn Helgaas: "Resource management: - Add hotplug reservation only once (not at each level of the hierarchy) so bridge windows don't grow more than necessary (Ilpo Järvinen) Driver binding: - Rework device matching so device ID lifetime only needs to cover the probe path since dynamic IDs can be removed at any time (Gary Guo) Error handling: - Update mappings of AER errors to agent & layer and log them for each individual error when multiple errors detected (Lukas Wunner) - Log Error Source only once, not twice in separate messages (Lukas Wunner) - Emit TLP Log only for unmasked errors (Lukas Wunner) - Support Advisory Non-Fatal Errors (Lukas Wunner) - Allow DPC on all Downstream Ports, not just Root Ports, when OS controls AER (Darshit Shah) ASPM: - Program the same ASPM Control values for every function of multi-function devices, as recommended by the PCIe spec (Krishna Chaitanya Chundru) - Avoid L0s for Realtek RTS525A, where it causes an AER interrupt storm (Max Lee) - Avoid ASPM L0s, L1, and L1 PM Substates based on 'aspm-no-l0s', 'aspm-no-l1' [1], and 'aspm-no-l1ss' DT properties (Krishna Chaitanya Chundru) Power management: - Allow D3 for native hotplug-capable Root Ports on non-x86 platforms (we avoid D3 for these ports on x86 because some old platforms didn't validate it) (Manivannan Sadhasivam) - Allow portdrv to claim Ports even if they don't support services (AER, PME, DPC, hotplug, etc) so it can do power management (Brian Norris) Power control: - Add support for PCIe WAKE# interrupt when described via DT (Krishna Chaitanya Chundru) - For the TC9563 PCIe switch: - Take a reference on the I2C adapter to avoid uninterruptible hang when unloading an I2C module while in-use (Johan Hovold) - Update DT binding and driver to restrict Tx Amplitude, DFE and N_FTS to USP, DSP1 and DSP2 (Manivannan Sadhasivam) - Power off only external-facing ports (DSP1, DSP2), leaving USP and DSP3 (aka VDSP) powered up (Manivannan Sadhasivam) - Move integrated MAC Endpoint out of the list of internal ports and configure it separately (Manivannan Sadhasivam) Virtualization: - Add ACS quirk for Pericom PI7C9X2G608 switches (Tim Harvey) - Fix a long-standing bug in the Intel PCH Root Port MPC ACS quirk that didn't update the intended INTEL_MPC_REG_IRBNCE bit because it used a 16-bit config write when a 32-bit write was intended (Mohamad Raizudeen) Procfs: - Avoid spurious runtime PM wakeup on config space accesses that are outside config space and fail before reaching PCI (Krzysztof Wilczyński) - Warn on user-space writes to kernel-exclusive config space regions, as we already do for sysfs (Krzysztof Wilczyński) - Check credentials of opener, not reader, for config space reads, as we already do for sysfs (Krzysztof Wilczyński) Sysfs: - In pci_write_legacy_io(), avoid out-of-bounds reads from the user buffer and fix incorrect ioport write data (1-byte writes on little-endian powerpc, 2- and 4-byte writes on big-endian powerpc) (Krzysztof Wilczyński) - In pci_read_legacy_io(), fix incorrect ioport read data for 2- and 4-byte reads on big-endian powerpc (Krzysztof Wilczyński) - Fix I/O port accessor argument order in Alpha pci_legacy_write() (Krzysztof Wilczyński) - Avoid spurious runtime PM wakeup on config space accesses that are outside config space and fail before reaching PCI (Krzysztof Wilczyński) - Return -EINVAL, not -ENODEV, for mmap of I/O BAR that fails because the arch doesn't support it, as we do for procfs (Krzysztof Wilczyński) - Check for LOCKDOWN_PCI_ACCESS for legacy_io and legacy_mem, as we do for other config space accessors (Krzysztof Wilczyński) Peer-to-peer DMA: - Add Nvidia Vera Rubin to list of platforms that support P2PDMA (Leon Romanovsky) Endpoint framework: - Check doorbell SUCCESS bit in pci_endpoint_test to avoid treating some failures as successes (Niklas Cassel) - Fail doorbell test when the trigger IRQ is missed (Niklas Cassel) New native PCIe controller drivers: - Add DT binding and driver for NVIDIA Tegra264 (Thierry Reding) Native PCIe controllers: - Use common wait time definitions for PCIe link monitoring instead of defining driver-private duplicates (Thierry Reding) Generic host bridge driver: - Fix NULL pointer dereference that caused enumeration failures on 32-bit CAM systems (Steffen Persvold) Amlogic Meson PCIe controller driver: - Correct the PERST# GPIO state so it remains asserted until power and REFCLK become stable to fix enumeration failure (Ronald Claveau) ASPEED PCIe controller driver: - Switch to irq_domain_create_linear() so we can obsolete irq_domain_add_linear() (Jiri Slaby) Cadence PCIe controller driver: - Add MODULE_DEVICE_TABLE to generate module aliases for OF-based module autoloading (Pengpeng Hou) - Add debugfs 'ltssm_status' file for LGA- and HPA-based Cadence controllers (Hans Zhang) - Support up to x4 (not x2) lanes for J200 (Takuma Fujiwara) - Fix host/endpoint dependencies for cadence-plat driver to fix link error when cadence-plat is built-in but the host or endpoint driver is modular (Aksh Garg) Freescale i.MX6 PCIe controller driver: - Add imx6 intr/aer/pme interrupt lines for i.MX95 (Richard Zhu) - Remove PERST# checking from pci_host_common_parse_port() so callers can decide whether to fall back to legacy DT binding with PERST# in the host bridge (Sherry Sun) - Fix build issues when PCI_PWRCTRL_GENERIC or PCI_HOST_COMMON is a module (Arnd Bergmann) - Create pwrctrl devices only once by doing it from imx_pcie_probe() instead of imx_pcie_host_init(), which is used during both probe and resume (Sherry Sun) - Use 'dw_pcie_rp->skip_pwrctrl_off' to avoid powering off devices during suspend to preserve wakeup capability (Sherry Sun) - Add runtime PM support for i.MX95 to allow dynamic power management when the link is idle (Richard Zhu) Intel VMD host bridge driver: - Support device ID 0x28C1 and assume that BIOS has already enumerated the hierarchy below VMD and stored bus range info for OS to use (Nirmal Patel) - Add support for VMCONFIG BUS_RESTRICT_CFG=3, which makes it possible to enumerate downstream devices on Intel Arrow Lake-HX systems and probably others (Ali Alaei) - Pay attention to _OSC negotiation for VMD hierarchy only when running on bare metal, not when running in a VM (Nirmal Patel) - Add Nova Lake (NVL) and Dunlow (DNL) Device IDs (Szymon Durawa) MediaTek PCIe controller driver: - Add support for PCIe controller in EcoNet EN7528 and EN751221 SoCs (Caleb James DeLisle) MediaTek PCIe Gen3 controller driver: - Add mediatek-gen3 'memory-region' for restricted DMA buffer (Chen-Yu Tsai) NVIDIA Tegra264 PCIe controller driver: - Distinguish Tegra264 C0 PCIe controller for internal GPU from C1-C5 controllers so the unit address matches the first 'reg' entry (Thierry Reding) - Add Tegra264 Root Port stanzas to prepare for generic WAKE# handling (Thierry Reding) Qualcomm PCIe controller driver: - Add IPQ9650 compatible with global interrupt (Kathiravan Thirumoorthy) - Add IPQ5210 compatible with IPQ9574 fallback (Varadarajan Narayanan) - Add DT binding and driver support for Hawi SoC (Matthew Leung) - Skip PERST# GPIOs provided by downstream PCIe devices, which should be handled by drivers of those devices (Manivannan Sadhasivam) - Stop advertising Attention Button Present (no Qcom SoCs support Attention Buttons) so pciehp can use Presence Detect Changed events (Qiang Yu) Renesas R-Car PCIe controller driver: - Add rcar-gen4-pci-host optional 'msi-parent' for GIT ITS (Marek Vasut) - When MSI is enabled but iMSI-RX is not used, configure AXIINTC to allow GIT ITS to handle MSI (Marek Vasut) - Refactor GIC600 implementation to make it easier to add platforms that only support 32-bit addressing (Marek Vasut) - Add Renesas R-Car Gen4 S4/V4H/V4M to the list of GIC600 integrations that only support 32-bit addressing (Marek Vasut) Renesas RZ/G3S PCIe controller driver: - Add DT binding and driver support for RZ/V2H(P) SoC, which contains two PCIe controllers, configured either as a single x4 link or two independent x2 link controllers (Lad Prabhakar) SpacemiT K1 PCIe controller driver: - Add missing MODULE_DEVICE_TABLE() to generate module alias info for OF-based module autoloading (Pengpeng Hou) StarFive PCIe controller driver: - Fix resource leaks on error paths in host_init() (Ali Tariq) - Fix runtime PM handling and teardown ordering to avoid register access while power or clocks are disabled (Ali Tariq) - Check for runtime PM resume failure to avoid register access while power or clocks are disabled (Ali Tariq) Synopsys DesignWare PCIe controller driver: - Add LECARC PMU IDs to the DWC RAS/DES VSEC list so it can take advantage of the existing debugfs support for silicon debug, error injection, and event counters (Brett Zhou) - Factor pcie_valid_speed() and pci_bus_speed2lnkctl2() out of bwctrl so they can be shared by the DWC core (Hans Zhang) - Flush MSI writes from endpoint before unmapping the iATU, as we already do for MSI-X writes (Niklas Cassel) - Unmap MSI iATU window before mapping MSI-X window, to avoid a subsequent MSI write using a disabled aperture and losing the interrupt (Niklas Cassel) - Change endpoint .pre_init() and .init() callbacks to return errors and handle them (Marek Vasut) UltraRISC PCIe controller driver: - Add 'core', 'dbi', and 'aux' clocks to DT binding and manage them in the driver (Jia Wang) - Use module_platform_driver() since this may be built as a module, though not removable because IRQs can't be safely disposed (Jia Wang) MicroSemi Switchtec management driver: - Add Microchip PCI1008 device ID and include it in NTB DMA alias quirk (Logan Gunthorpe) Miscellaneous: - Document how to write PCI Host Controller drivers (Manivannan Sadhasivam) - Fix typos in documentation (D'Orus Tsitera) - Use %pe format specifier to print error pointers so we get symbolic errname when available (Krzysztof Wilczyński)" * tag 'pci-v7.3-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: (124 commits) PCI: vmd: Add Nova Lake (NVL) and Dunlow (DNL) Device IDs PCI: tegra264: Add Tegra264 support dt-bindings: PCI: tegra264: Switch to PCIe Root Port bindings dt-bindings: PCI: tegra264: Strictly distinguish C0 from C1-C5 PCI/AER: Support Advisory Non-Fatal Errors PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk PCI: dwc: Handle return value from endpoint .pre_init callback PCI: dwc: Handle return value from endpoint .init callback PCI: dwc: Add PCI ID for LECARC PCIe PMU PCI/ASPM: Mask ASPM states based on Devicetree properties PCI/ASPM: Disable/restore ASPM on every function for multi-function devices Documentation: PCI: Document how to write PCI Host Controller drivers PCI/ASPM: Use pcie_capability_clear_and_set_word() for ASPM disable/restore PCI: Add support for PCIe WAKE# interrupt PCI: Allow D3 for native hotplug-capable Root Ports on non-x86 platforms dt-bindings: PCI: Correct white-space style PCI/ASPM: Avoid L0s for Realtek RTS525A PCI: ultrarisc: Use module_platform_driver() PCI: ultrarisc: Get and enable DP1000 PCIe controller clocks dt-bindings: PCI: ultrarisc: Add required DP1000 PCIe clocks ...