Commit Graph

55734 Commits

Author SHA1 Message Date
Lorenzo Stoakes (ARM)
7e6543d1f9 mm: introduce linear_anon_page_index()
This function provides the anonymous equivalent of linear_page_index(),
instead offsetting based on the anonymous page offset of the VMA.

It is valid only for anonymous or MAP_PRIVATE file-backed mappings, in
other words CoW mappings.

For pure anon VMAs, this will be equal to linear_page_index().

Assert that both of these invariants are true in linear_anon_page_index()
and implement the algorithm in __linear_anon_page_index().

Note that MAP_PRIVATE-/dev/zero mappings will satisfy vma_is_anonymous()
but not fulfill this invariant, so when asserting this we check
vma->vm_file to account for this.

We do not update callsites yet, so no functional change intended.

Also const-ify vma_is_anonymous() to make it compatible with the
const-ified linear_anon_page_index().

While we're here, update linear_page_index() to be more succinct.

VMA userland tests are also updated accordingly.

Link: https://lore.kernel.org/20260813-b4-scalable-cow-virt-pgoff-v5-3-c21581c0c3c8@kernel.org
Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Reviewed-by: Gregory Price (Meta) <gourry@gourry.net>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Deucher <alexander.deucher@amd.com>
Cc: Alexander Gordeev <agordeev@linux.ibm.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Alistair Popple <apopple@nvidia.com>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Baoquan He <baoquan.he@linux.dev>
Cc: Barry Song <baohua@kernel.org>
Cc: Boris Brezillon <boris.brezillon@collabora.com>
Cc: Byungchul Park <byungchul@sk.com>
Cc: Chengming Zhou <chengming.zhou@linux.dev>
Cc: Chris Li <chrisl@kernel.org>
Cc: Christan König <christian.koenig@amd.com>
Cc: Christian Borntraeger <borntraeger@linux.ibm.com>
Cc: Claudio Imbrenda <imbrenda@linux.ibm.com>
Cc: Dave Airlie <airlied@gmail.com>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Harry Yoo <harry@kernel.org>
Cc: Heiko Carstens <hca@linux.ibm.com>
Cc: Huang Ray <Ray.Huang@amd.com>
Cc: "Huang, Ying" <ying.huang@linux.alibaba.com>
Cc: Ian Rogers <irogers@google.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jan Kara <jack@suse.cz>
Cc: Jann Horn <jannh@google.com>
Cc: Janosch Frank <frankja@linux.ibm.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: John Hubbard <jhubbard@nvidia.com>
Cc: Joshua Hahn <joshua.hahnjy@gmail.com>
Cc: Kairui Song <kasong@tencent.com>
Cc: Kees Cook <kees@kernel.org>
Cc: Kemeng Shi <shikemeng@huaweicloud.com>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Liviu Dudau <liviu.dudau@arm.com>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Marc Rutland <mark.rutland@arm.com>
Cc: "Masami Hiramatsu (Google)" <mhiramat@kernel.org>
Cc: Matthew Auld <matthew.auld@intel.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Maxime Ripard <mripard@kernel.org>
Cc: Miaohe Lin <linmiaohe@huawei.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Namhyung kim <namhyung@kernel.org>
Cc: Naoya Horiguchi <nao.horiguchi@gmail.com>
Cc: Nhat Pham <nphamcs@gmail.com>
Cc: Nico Pache <npache@redhat.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Pedro Falcato <pfalcato@suse.de>
Cc: Peter Xu <peterx@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Rakie Kim <rakie.kim@sk.com>
Cc: Rik van Riel <riel@surriel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Steven Price <steven.price@arm.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Sven Schnelle <svens@linux.ibm.com>
Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Cc: Thomas Zimemrmann <tzimmermann@suse.de>
Cc: Vasily Gorbik <gor@linux.ibm.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: xu xin <xu.xin16@zte.com.cn>
Cc: Zi Yan <ziy@nvidia.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-24 18:42:50 -07:00
Lorenzo Stoakes (ARM)
51943a18ad mm: provide vma_[flags_]is_cow_mapping() and remove is_cow_mapping()
All remaining callers of is_cow_mapping() are invoking it in the form of
is_cow_mapping(vma->vm_flags) or an indirected version of this.

Therefore, provide a helper - vma_is_cow_mapping() to directly test the
VMA.

Additionally provide a new helper vma_flags_is_cow_mapping() which
performs the check using the new vma_flags_t type, and share this logic
between vma_is_cow_mapping() and vma_desc_is_cow_mapping().

With these changes, no callers of is_cow_mapping() remain, so remove it.

Also update the userland VMA tests to reflect the change.

No functional change intended.

[akpm@linux-foundation.org: fix kerneldoc comment typo, per Lorenzo]
  Link: https://lore.kernel.org/aob1goSSPH6sTN9y@gremlin
Link: https://lore.kernel.org/20260813-b4-scalable-cow-virt-pgoff-v5-2-c21581c0c3c8@kernel.org
Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Deucher <alexander.deucher@amd.com>
Cc: Alexander Gordeev <agordeev@linux.ibm.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Alistair Popple <apopple@nvidia.com>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Baoquan He <baoquan.he@linux.dev>
Cc: Barry Song <baohua@kernel.org>
Cc: Boris Brezillon <boris.brezillon@collabora.com>
Cc: Byungchul Park <byungchul@sk.com>
Cc: Chengming Zhou <chengming.zhou@linux.dev>
Cc: Chris Li <chrisl@kernel.org>
Cc: Christan König <christian.koenig@amd.com>
Cc: Christian Borntraeger <borntraeger@linux.ibm.com>
Cc: Claudio Imbrenda <imbrenda@linux.ibm.com>
Cc: Dave Airlie <airlied@gmail.com>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Gregory Price (Meta) <gourry@gourry.net>
Cc: Harry Yoo <harry@kernel.org>
Cc: Heiko Carstens <hca@linux.ibm.com>
Cc: Huang Ray <Ray.Huang@amd.com>
Cc: "Huang, Ying" <ying.huang@linux.alibaba.com>
Cc: Ian Rogers <irogers@google.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jan Kara <jack@suse.cz>
Cc: Jann Horn <jannh@google.com>
Cc: Janosch Frank <frankja@linux.ibm.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: John Hubbard <jhubbard@nvidia.com>
Cc: Joshua Hahn <joshua.hahnjy@gmail.com>
Cc: Kairui Song <kasong@tencent.com>
Cc: Kees Cook <kees@kernel.org>
Cc: Kemeng Shi <shikemeng@huaweicloud.com>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Liviu Dudau <liviu.dudau@arm.com>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Marc Rutland <mark.rutland@arm.com>
Cc: "Masami Hiramatsu (Google)" <mhiramat@kernel.org>
Cc: Matthew Auld <matthew.auld@intel.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Maxime Ripard <mripard@kernel.org>
Cc: Miaohe Lin <linmiaohe@huawei.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Namhyung kim <namhyung@kernel.org>
Cc: Naoya Horiguchi <nao.horiguchi@gmail.com>
Cc: Nhat Pham <nphamcs@gmail.com>
Cc: Nico Pache <npache@redhat.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Pedro Falcato <pfalcato@suse.de>
Cc: Peter Xu <peterx@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Rakie Kim <rakie.kim@sk.com>
Cc: Rik van Riel <riel@surriel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Steven Price <steven.price@arm.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Sven Schnelle <svens@linux.ibm.com>
Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Cc: Thomas Zimemrmann <tzimmermann@suse.de>
Cc: Vasily Gorbik <gor@linux.ibm.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: xu xin <xu.xin16@zte.com.cn>
Cc: Zi Yan <ziy@nvidia.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-24 18:42:50 -07:00
Lorenzo Stoakes (ARM)
0bd14001eb mm/vma: introduce VMA anon page offset field and add helpers
Patch series "mm/rmap: index MAP_PRIVATE file-backed folios by anonymous
pgoff", v5.

In memory management we've managed to manufacture a great deal of
confusion around the concept of anonymous memory.  We have:

1. 'Pure anon' memory - anonymous VMAs whose folios are anonymous and
   swap-backed (thus for reclaim purposes, treated as anonymous). These are
   simple enough.

2. shmem - file-backed VMAs, file-backed folios (from rmap perspective) so
   present in the page cache and mapped by an address_space object, but
   whose folios are also swap-backed (thus treated as anonymous for reclaim
   purposes).

3. MAP_PRIVATE-mapped /dev/zero - a strange beast whose VMAs have
   vma->vm_file set, but which clears vma->vm_ops to satisfy
   vma_is_anonymous(), resulting in VMAs that were mmap()'d referencing a
   file, but are in every other sense anonymous, including the folios.

4. Other MAP_PRIVATE-file backed mappings - These possess file-backed VMAs
   and have file-backed folios until CoW'd, at which point those CoW'd
   folios are anonymous.

This series fixes issue 3.

In order for us to traverse VMAs using the reverse mapping, we require two
fields - folio->mapping and folio->index.  The first tells the rmap code
where to look for VMAs, and the second tells it at which offset the folio
starts within the referenced object.

For anonymous folios, folio->mapping points at an anon_vma object.  For
file-backed folios, it points at an address_space.  And:

* For file-backed folios folio->index is simply the page offset of the start
  of the folio within the file.

* For anonymous folios belonging to pure anon mappings, folio->index is
  equal to the anonymous page offset of the folio.

* For anonymous folios belonging to file-backed mappings (i.e. CoW'd folios
  of a MAP_PRIVATE file-backed mapping), folio->index is equal to the file
  page offset.

This series establishes a new anonymous page offset property of VMAs to
allow us to map anonymous folios at their anonymous page offset,
consistent with pure anon.

The purpose of doing so is to lay the foundations for the scalable CoW
work.  This is necessary because scalable CoW looks in the maple tree for
the VMA located at folio->index << PAGE_SHIFT, before falling back to
looking up tracked remaps if necessary.

The MAP_PRIVATE file-backed case means that folio indices will very often
conflict with one another and this remap tracking becomes substantially
more contended, and of course the fast path can never be used.

This also makes it possible, in future, to unshare anonymously mapped
folios with deep fork hierarchies on remap, eliminating the need for remap
tracking in the vast majority of cases.

Similar to page offset of pure anonymous VMAs, we update the anonymous
page offset of unfaulted file-backed VMAs on remap, but do not once CoW'd
(i.e.  vma->anon_vma is non-NULL).

Overall, there is little impact on mergeability, which remains exactly the
same for pure anonymous and shared file-backed mappings, with the only
impact being on MAP_PRIVATE-mapped file-backed mappings, which must now
match on anonymous page offset as well as file page offset to be merged.

To fail to merge like this would require CoW'ing the mapping, then finding
another VMA with identical file and compatible page offset to remap next
to.

This is therefore very much an edge case that should have very little
impact (and which scalable CoW may very well address in any case).


This patch (of 16):

Establish fields in vm_area_struct to store the anonymous page offset of
VMAs.

Initially, the anonymous page offset of a VMA is vma->vm_start >>
PAGE_SHIFT.

When a VMA is remapped to new_address its anonymous page offset is either
updated to new_address >> PAGE_SHIFT if unfaulted or, if faulted, remains
equal to the anonymous page offset it had when first faulted.

Currently, anonymous folios belonging to CoW'd MAP_PRIVATE-mapped
file-backed VMAs are tracked by their file offsets.  By adding anonymous
offset as a property of VMAs, we can now track them by their anonymous
page offset instead.

By tracking this, we provide the means by which to eliminate this
inconsistency, and more importantly lay the foundations for future work
for the scalable CoW anonymous rmap rework.

This patch simply adds the fields and some simple helpers.  Subsequent
patches will update mm code to make use of these fields correctly.

The fields chosen are packed in the VMA such that, for 64-bit kernel
builds, no additional space is taken up.

The first field is present on cacheline 0 containing key VMA fields, and
the second on cacheline 3, which contains file-backed reverse mapping
fields.

Given the relative time spent accessing reverse mapping fields as well as
updating them, there shouldn't be any performance impact here from false
sharing.

Update the VMA userland tests to account for this change.

No callsites are updated yet, so no functional change intended.

Link: https://lore.kernel.org/20260813-b4-scalable-cow-virt-pgoff-v5-0-c21581c0c3c8@kernel.org
Link: https://lore.kernel.org/20260813-b4-scalable-cow-virt-pgoff-v5-1-c21581c0c3c8@kernel.org
Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: Gregory Price (Meta) <gourry@gourry.net>
Reviewed-by: Xu Xin <xu.xin16@zte.com.cn>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Deucher <alexander.deucher@amd.com>
Cc: Alexander Gordeev <agordeev@linux.ibm.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Alistair Popple <apopple@nvidia.com>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Baoquan He <baoquan.he@linux.dev>
Cc: Barry Song <baohua@kernel.org>
Cc: Boris Brezillon <boris.brezillon@collabora.com>
Cc: Byungchul Park <byungchul@sk.com>
Cc: Chengming Zhou <chengming.zhou@linux.dev>
Cc: Chris Li <chrisl@kernel.org>
Cc: Christan König <christian.koenig@amd.com>
Cc: Christian Borntraeger <borntraeger@linux.ibm.com>
Cc: Claudio Imbrenda <imbrenda@linux.ibm.com>
Cc: Dave Airlie <airlied@gmail.com>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Harry Yoo <harry@kernel.org>
Cc: Heiko Carstens <hca@linux.ibm.com>
Cc: Huang Ray <Ray.Huang@amd.com>
Cc: "Huang, Ying" <ying.huang@linux.alibaba.com>
Cc: Ian Rogers <irogers@google.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jan Kara <jack@suse.cz>
Cc: Jann Horn <jannh@google.com>
Cc: Janosch Frank <frankja@linux.ibm.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: John Hubbard <jhubbard@nvidia.com>
Cc: Joshua Hahn <joshua.hahnjy@gmail.com>
Cc: Kairui Song <kasong@tencent.com>
Cc: Kees Cook <kees@kernel.org>
Cc: Kemeng Shi <shikemeng@huaweicloud.com>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Liviu Dudau <liviu.dudau@arm.com>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Marc Rutland <mark.rutland@arm.com>
Cc: "Masami Hiramatsu (Google)" <mhiramat@kernel.org>
Cc: Matthew Auld <matthew.auld@intel.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Maxime Ripard <mripard@kernel.org>
Cc: Miaohe Lin <linmiaohe@huawei.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Namhyung kim <namhyung@kernel.org>
Cc: Naoya Horiguchi <nao.horiguchi@gmail.com>
Cc: Nhat Pham <nphamcs@gmail.com>
Cc: Nico Pache <npache@redhat.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Pedro Falcato <pfalcato@suse.de>
Cc: Peter Xu <peterx@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Rakie Kim <rakie.kim@sk.com>
Cc: Rik van Riel <riel@surriel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Steven Price <steven.price@arm.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Sven Schnelle <svens@linux.ibm.com>
Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Cc: Thomas Zimemrmann <tzimmermann@suse.de>
Cc: Vasily Gorbik <gor@linux.ibm.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: xu xin <xu.xin16@zte.com.cn>
Cc: Zi Yan <ziy@nvidia.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-24 18:42:49 -07:00
Qingshuang Fu
11e41444a3 selftests/net: check fork() return value in fin_ack_lat
main() never checks fork() for failure.  When fork() returns -1
(EAGAIN/ENOMEM/RLIMIT_NPROC), the !child_pid test is false and the
process falls into server()'s infinite accept() loop with no client ever
connecting, producing empty output.  The wrapper script treats an
empty log as a passing test, producing a false positive.

Check fork() for failure with error(), as is done for every other
syscall in this file.

Signed-off-by: Qingshuang Fu <fuqingshuang@kylinos.cn>
Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260821031442.1124777-2-fffsqian@163.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-24 11:40:29 -07:00
Qingshuang Fu
2d83aa65dc selftests/net: fix kill() argument order and wrapper cleanup in fin_ack_lat
sig_handler() passes its arguments to kill() in the wrong order: it sends
signal number child_pid to PID SIGTERM (15) instead of sending SIGTERM
to the client process.  The call therefore always fails and the signal
is never forwarded: when only the server process receives SIGTERM, the
client keeps running its infinite connect loop as an orphan process.

Swap the arguments so that the server forwards SIGTERM to the client.
Guard the call with child_pid > 0: the client inherits the handler and
sees child_pid == 0, and a plain argument swap would make it call
kill(0, SIGTERM), signaling the whole process group instead of exiting
quietly.

Now that the server actually terminates the client before the wrapper
script's cleanup runs, kill() may fail with ESRCH for the already-exited
client.  The script uses set -e, so make the kill tolerant to avoid
aborting the EXIT trap and leaking temporary files.

Signed-off-by: Qingshuang Fu <fuqingshuang@kylinos.cn>
Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260821031442.1124777-1-fffsqian@163.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-24 11:40:25 -07:00
Stanislav Fomichev
bd7d30bd1d xsk: align TX metadata layout across ABIs
Add explicit padding before launch_time so xsk_tx_metadata has the same
layout on 32-bit and 64-bit systems.

On several architectures (csky, i386, nios2, m65k, openrisc, sh), the old
native 32-bit layout put launch_time at offset 12 and had a natural size of
20 bytes. Using sizeof(struct xsk_tx_metadata) as tx_metadata_len was already
rejected because the length must be a multiple of eight, so the
straightforward use of the interface was broken on those ABIs. Userspace
could still register a padded length of 24 bytes, though; mixing the old and
new layouts then silently reads launch_time from the wrong offset and
misprograms packet launch times. This intentionally replaces that
incompatible layout because the affected architectures are unlikely to
have any notable users. (x86_64 and arm64 have the most users and are _not_
affected)

Fixes: ca4419f15a ("xsk: Add launch time hardware offload support to XDP Tx metadata")
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Stanislav Fomichev <sdf@fomichev.me>
Link: https://patch.msgid.link/20260819160535.1472459-2-sdf@fomichev.me
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-24 11:11:59 -07:00
Linus Torvalds
5b05bb3f6c platform-drivers-x86 for v7.3-1
Highlights:
 
 - amd/halo: Add Halo RGB LED driver
 
 - amd/hsmp:
   - Properly serialize probe, remove, and data paths
   - Add support for protocol v7 used by Family 1AH Model 80H
   - Fix error checking corner cases (largely from AI review)
   - Reject negative power cap
 
 - amd/pmc:
   - Improve behavior on platforms that do not support STB
   - Add T14 Gen2 AMD (20XL) to s2idle quirk list
 
 - amd/pmf:
   - Add ioctl interface to retrieve device metrics
   - Add support for new metrics tables used by Family 1AH Model 80H
 
 - arm64: qcom-hamoa-ec: Reject short responses
 
 - asus-nb-wmi: Support ProArt key on ASUS ProArt PX13
 
 - asus-armoury:
   - Gate PPT writes behind active fan curve
   - Add power limits for more models
 
 - dell-wmi-base: Fix handling of ultra performance key
 
 - dell-wmi-sysman: Don't hex dump attribute security buffer
 
 - hp-bioscfg:
   - Various fixes
   - Improve reduced ACPI packages support (necessary for HP EliteBook 840 G2)
 
 - lg-laptop:
   - Fix LED resource handling
   - Add support for events used in newer models
   - Fix keyboard backlight support on LG Gram 16T90SP
 
 - hp-wmi:
   - Generalize thermal params to board params
   - Manage CPU and GPU PWM independently
   - Add GPU MUX switch support
   - Add Victus 15-fb0xxx support
   - Add OMEN MAX 16-ak0xxx, OMEN 16-n0xxx, OMEN 16-wd0xxx, OMEN
     16-wf0xxx, and OMEN board ID 8D88 support
   - Add OMEN Transcend 16-u0xxx support
 
 - huawei: Add support for Fn-lock ACPI interface found on newer Huawei
           laptops such as MateBook 14 2024
 
 - ISST:
   - Improve input validation (many fixes)
   - Disallow SST-CP (core-power) feature if perf profile add fails
 
 - lenovo/yb9-kbdock: Add driver for Yoga Book 9 14IAH10
 
 - lenovo/ymc:
   - Extend hinge switch query to support Yoga 9 2-in-1 14IPH11
   - Prevent loading on Yoga Book 9 14IAH10 to avoid duplicated input
     nodes
 
 - msi-ec: Add MSI Raider A18 HX A9WJG and MSI Katana GF76 11UEK support
 
 - msi-wmi: Add MSI Claw M-Center keys support
 
 - oxpec: Add support for OneXPlayer X2 Mini Pro
 
 - redmi-wmi: Report kbd backlight cycle, OEM preset power mode, and FnLock
              toggle events to userspace
 
 - samsung-galaxybook: Add Samsung Galaxy Book6 Pro support
 
 - thinkpad_acpi: Add USB-C Security support
 
 - uniwill-laptop:
   - Add keyboard backlight, AC auto boot, and USB powershare support
   - Add MACHENIKE L16 Pro, AiStone X4SP4NAL, and Avell A60 MUV support
   - Make lightbar max brightness configurable and add support for
     LAPQC71A/B
 
 - Major refactoring efforts:
   - Stop setting acpi_device_name/class() and pnp.device_class to
     faciliate their eventual removal
 
 - Many rollback/remove path fixes (presumably mostly found by AI)
 
 - Miscellaneous cleanups / refactoring / improvements
 
 The following is an automated shortlog grouped by driver:
 
 acer-wmi:
  -  reject missing gaming WMI results
 
 amd/hsmp:
  -  ACPI HSMP refcounted sockets and coordinated release
  -  Add HSMP messages for Family 1Ah, Model 50h-5Fh
  -  Add IOCTL_GET_TELEMETRY_DATA for metric table reads
  -  Clear mdev.this_device on deregister
  -  Enable protocol version 7 metric tables on the ACPI driver
  -  Gate the data plane on a fully initialized socket
  -  Map the metric table with ioremap() and unmap it explicitly
  -  Pass struct device explicitly to ACPI mailbox parsers
  -  Reject negative power cap writes in hwmon
  -  Serialize ACPI HSMP probe and remove with an rwsem
  -  Serialize per-socket metric table reads with a mutex
  -  Serialize the data plane against socket teardown
  -  Source metric-table size from firmware
  -  Unify response_sz validation to an upper-bound check
  -  Validate ACPI UID before parsing socket index
  -  Validate _DSD mailbox sub-package element count
 
 amd:
  -  Introduce Halo Box RGB LED driver
 
 amd/pmc:
  -  Add T14 Gen2 AMD (20XL) to s2idle quirk list
  -  Do not fail probe when STB init fails
  -  Fix LPS0 and debugfs leaks when STB init fails
  -  Fix msg_port restoration in amd_stb_debugfs_open_v2()
  -  Only expose stb_read after telemetry buffer is mapped
  -  Propagate SMU errors and validate S2D address
  -  Restore msg_port on amd_stb_s2d_init() error paths
 
 amd/pmf:
  -  Add 1AH_M80H device IDs and extended SMU mailbox registers
  -  Add 1AH_M80H metrics table and NPU metrics support
  -  Add missing newline in dev_err message
  -  Add util layer and userspace character device interface
  -  Implement util layer ioctl handler
  -  Introduce AMD PMF testing tool for driver metrics and features
  -  Move debug helper functions to UAPI header
  -  Move metrics code to dedicated file
  -  Refactor NPU metrics for platform extensibility
  -  store BIOS output values for user-space metrics via util IOCTL
  -  Store commonly used enums in the header file
  -  Use per-SoC smu_regs struct for SMU mailbox registers
  -  Use upper/lower_32_bits() in amd_pmf_set_dram_addr()
 
 arm64: qcom-hamoa-ec:
  -  reject incomplete responses
 
 asus-armoury:
  -  Add power limits for ROG Strix SCAR 16 (G635LX)
  -  Add power limits quirk for FA401KM
  -  Add power limits quirk for FA608WV
  -  add support for FX517ZR
  -  add support for HN7306EA and HN7306EAC
  -  fix Use-After-Free and memory leak in driver init
  -  gate PPT writes behind active fan curve
  -  use cleanup.h to manage tunables
 
 asus-laptop:
  -  Stop setting acpi_device_name/class()
 
 asus-nb-wmi:
  -  map ProArt key (0x8b) to KEY_PROG3
 
 asus-wireless:
  -  Fail probe when there is no ACPI match
 
 asus-wmi:
  -  fix resource leaks on probe failure
 
 dell-ddv:
  -  Use no_free_ptr() to simplify error handling
 
 dell-privacy:
  -  Fix race condition
 
 dell-smbios:
  -  Pass device to callbacks
 
 dell-smbios-wmi:
  -  Fix chardev resource management
  -  Replace global list with single item
 
 dell-wmi-base:
  -  Fix handling of ultra performance key
  -  Fix resource leak on module load failure
 
 dell-wmi-sysman:
  -  Don't hex dump attribute security buffer
  -  Fix instance ID bounds
 
 Documentation/ABI:
  -  add testing entry for AMD PMF character device interface
 
 eeepc-laptop:
  -  Stop setting acpi_device_name/class()
 
 fujitsu-laptop:
  -  Stop setting acpi_device_name/class()
 
 fujitsu-tablet:
  -  Stop setting acpi_device_name/class()
 
 hp-bioscfg:
  -  accept reduced ACPI packages from older HP BIOS
  -  advance elem past consumed array elements
  -  bound ordered-list parsing by the package count
  -  fix heap OOB read in sk_store() and kek_store()
  -  fix heap OOB read on empty password write
  -  fix new_password_store() overwriting current_password
  -  fix off-by-one write in hp_get_string_from_buffer()
  -  fix ORD_LIST_ELEMENTS never being parsed
  -  fix password encoding bounds check
  -  pass validated element count to package parsers
  -  warn on element type mismatch instead of failing
 
 hp-wmi:
  -  Add dual-channel PWM fan control
  -  Add GPU MUX switch support
  -  Add OMEN board 8A43 thermal profile support
  -  Add OMEN board 8BA9 thermal profile support
  -  Add OMEN board 8BAA thermal profile support
  -  Add OMEN board 8D88 thermal profile support
  -  Add OMEN Transcend 16 8BB3 support
  -  Add support for OMEN MAX 16-ak0xxx (8DD6)
  -  Add Victus 15-fb0xxx support
  -  Drive fan control from board data
  -  Introduce board-specific feature data
 
 huawei-wmi:
  -  add ACPI fallback for Fn-lock on newer models
 
 ideapad-laptop:
  -  Fix driver unregistration order
 
 int1092:
  -  Fix info leak in parse_package()
  -  Fix potential memory leak in sar_probe()
 
 intel/pmc:
  -  initialize empty PMT read result
 
 ishtp_eclite:
  -  Fix ACPI device reference leak in probe error path
 
 ISST:
  -  Add a NULL check for sst_inst[]
  -  Just allow 2 bits for SST feature enable
  -  Return error during profile addition
  -  Use PP level enable mask
  -  Validate level in perf mask ioctls
  -  Validate logical CPU id and clos id
  -  Validate max level for set feature
  -  Validate parameter for core power state
  -  Validate parameter for frequency and priority
  -  Validate socket ID in clos_assoc ioctl
 
 lenovo:
  -  Add Yoga Book 9 keyboard dock detection driver
 
 lenovo: lenovo-ymc:
  -  Suppress probe on Yoga Book 9 14IAH10
 
 lenovo/ymc:
  -  Only match lower byte in WMI lid switch query response
 
 lg-laptop:
  -  Add support for additional events
  -  Add support for native ACPI events
  -  Fix keyboard backlight support on LG Gram 16T90SP
  -  Fix LED resource handling
  -  Improve WMAB control method support
 
 MAINTAINERS:
  -  update Intel PMC Core maintainer contact
 
 mlxbf-bootctl:
  -  fix the build error with FIELD_PREP()
 
 mlxbf-pmc:
  -  Check ACPI_COMPANION() against NULL
 
 msi-ec:
  -  Add MSI Katana GF76 11UEK EC firmware
  -  Add MSI Raider A18 HX A9WJG EC firmware
 
 msi-wmi:
  -  Add MSI Claw M-Center keys
  -  Reformat msi_wmi_notify()
 
 oxpec:
  -  Add support for OneXPlayer X2 Mini Pro
 
 panasonic-laptop:
  -  Fix sentinel write past pcc->sinf[]
  -  Stop setting acpi_device_name/class()
 
 power: supply: surface_{battery,charger}:
  -  Consistently define ssam_device_ids using named initializers
 
 redmi-wmi:
  -  report EC state change events
 
 samsung-galaxybook:
  -  Add SAMB430 device ID
 
 sony-laptop:
  -  Stop setting acpi_device_class()
 
 sonypi:
  -  Stop setting acpi_device_name/class()
 
 surface: acpi-notify:
  -  Check ACPI companion before use
 
 surface: aggregator:
  -  Consistently define ssam_device_ids using named initializers
 
 surface: surfacepro3_button:
  -  Stop setting acpi_device_name()
 
 think-lmi:
  -  Fix certificate thumbprint sysfs output
  -  Fix current password length check
  -  Free system certificate signatures
 
 thinkpad_acpi:
  -  Add USB-C Security (USCS) support
  -  Fix fan speed reporting on Edge E330
  -  Fix USB-C Security probe failure on unsupported platforms
  -  Stop setting acpi_device_class()
 
 topstar-laptop:
  -  Stop setting acpi_device_name/class()
 
 toshiba_acpi:
  -  Do not use uninitialized device_class
 
 toshiba_bluetooth:
  -  Use more common error handling code in toshiba_bt_rfkill_probe()
 
 toshiba_haps:
  -  Do not use uninitialized device_class
 
 uniwill-laptop:
  -  Add 2 new feature defines for TUXEDO devices
  -  Add AC auto boot support
  -  Add Avell A60 MUV support
  -  Add keyboard backlight support
  -  Add lightbar support for LAPQC71A/B
  -  Add support for the AiStone X4SP4NAL
  -  Add support for the MACHENIKE L16 Pro
  -  Add support for USB powershare
  -  Handle screen-related events
  -  Remove single color keyboard detection
  -  Split uniwill_kbd_led_init()
 
 x86/platform/olpc: xo15:
  -  Stop setting acpi_device_name/class()
 
 xo15-ebook:
  -  Stop setting acpi_device_name/class()
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQSCSUwRdwTNL2MhaBlZrE9hU+XOMQUCaow0EgAKCRBZrE9hU+XO
 MRvYAP412gjYokIoj6ncE2OD897gX2d5BwUVKkraQHoevxLm8wEAikY+iYbdOv3a
 fqhPeCDZSRBn6yEBHewY7cdotNDn2go=
 =d/Uf
 -----END PGP SIGNATURE-----

Merge tag 'platform-drivers-x86-v7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86

Pull x86 platform driver updates from Ilpo Järvinen
 "Highlights:

  Major refactoring effort: stop setting acpi_device_name/class() and
  pnp.device_class to facilitate their eventual removal

  Many rollback/remove path fixes (presumably mostly found by AI)

  Miscellaneous cleanups / refactoring / improvements

  amd/halo:
   - Add Halo RGB LED driver

  amd/hsmp:
   - Properly serialize probe, remove, and data paths
   - Add support for protocol v7 used by Family 1AH Model 80H
   - Fix error checking corner cases (largely from AI review)
   - Reject negative power cap

  amd/pmc:
   - Improve behavior on platforms that do not support STB
   - Add T14 Gen2 AMD (20XL) to s2idle quirk list

  amd/pmf:
   - Add ioctl interface to retrieve device metrics
   - Add support for new metrics tables used by Family 1AH Model 80H

  qcom-hamoa-ec (arm64):
   - Reject short responses

  asus-nb-wmi:
   - Support ProArt key on ASUS ProArt PX13

  asus-armoury:
   - Gate PPT writes behind active fan curve
   - Add power limits for more models

  dell-wmi-base:
   - Fix handling of ultra performance key

  dell-wmi-sysman:
   - Don't hex dump attribute security buffer

  hp-bioscfg:
   - Various fixes
   - Improve reduced ACPI packages support (necessary for HP EliteBook 840 G2)

  lg-laptop:
   - Fix LED resource handling
   - Add support for events used in newer models
   - Fix keyboard backlight support on LG Gram 16T90SP

  hp-wmi:
   - Generalize thermal params to board params
   - Manage CPU and GPU PWM independently
   - Add GPU MUX switch support
   - Add Victus 15-fb0xxx support
   - Add OMEN MAX 16-ak0xxx, OMEN 16-n0xxx, OMEN 16-wd0xxx, OMEN
     16-wf0xxx, and OMEN board ID 8D88 support
   - Add OMEN Transcend 16-u0xxx support

  huawei:
   - Add support for Fn-lock ACPI interface found on newer Huawei
     laptops such as MateBook 14 2024

  ISST:
   - Improve input validation (many fixes)
   - Disallow SST-CP (core-power) feature if perf profile add fails

  lenovo/yb9-kbdock:
   - Add driver for Yoga Book 9 14IAH10

  lenovo/ymc:
   - Extend hinge switch query to support Yoga 9 2-in-1 14IPH11
   - Prevent loading on Yoga Book 9 14IAH10 to avoid duplicated input
    nodes

  msi-ec:
   - Add MSI Raider A18 HX A9WJG and MSI Katana GF76 11UEK support

  msi-wmi:
   - Add MSI Claw M-Center keys support

  oxpec:
   - Add support for OneXPlayer X2 Mini Pro

  redmi-wmi:
   - Report kbd backlight cycle, OEM preset power mode, and FnLock
     toggle events to userspace

  samsung-galaxybook:
   - Add Samsung Galaxy Book6 Pro support

  thinkpad_acpi:
   - Add USB-C Security support

  uniwill-laptop:
   - Add keyboard backlight, AC auto boot, and USB powershare support
   - Add MACHENIKE L16 Pro, AiStone X4SP4NAL, and Avell A60 MUV support
   - Make lightbar max brightness configurable and add support for
     LAPQC71A/B"

* tag 'platform-drivers-x86-v7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (152 commits)
  platform/x86: think-lmi: Fix current password length check
  platform/x86: redmi-wmi: report EC state change events
  MAINTAINERS: update Intel PMC Core maintainer contact
  platform/x86: oxpec: Add support for OneXPlayer X2 Mini Pro
  platform/x86: thinkpad_acpi: Fix fan speed reporting on Edge E330
  platform/x86: msi-ec: Add MSI Katana GF76 11UEK EC firmware
  platform/x86: think-lmi: Fix certificate thumbprint sysfs output
  mlxbf-bootctl: fix the build error with FIELD_PREP()
  platform/x86: think-lmi: Free system certificate signatures
  platform/x86: ISST: Add a NULL check for sst_inst[]
  platform/x86: ISST: Return error during profile addition
  platform/x86: ISST: Just allow 2 bits for SST feature enable
  platform/x86: ISST: Use PP level enable mask
  platform/x86: ISST: Validate parameter for frequency and priority
  platform/x86: ISST: Validate parameter for core power state
  platform/x86: ISST: Validate max level for set feature
  platform/x86: ISST: Validate logical CPU id and clos id
  platform/x86: ISST: Validate level in perf mask ioctls
  platform/x86: ISST: Validate socket ID in clos_assoc ioctl
  platform/x86/amd/hsmp: Reject negative power cap writes in hwmon
  ...
2026-08-24 10:16:35 -07:00
Guopeng Zhang
87d347a8c8 selftests/cgroup: Add test for preserving boot-isolated CPUs
Put a CPU isolated at boot into an isolated partition, change the
partition back to member and check that the CPU remains isolated.

Signed-off-by: Guopeng Zhang <zhangguopeng@kylinos.cn>
Reviewed-by: Waiman Long <longman@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-24 07:01:44 -10:00
Guopeng Zhang
2bf404b1bd selftests/cgroup: Drop invalid boot isolation comparison
check_isolcpus() clears ISOLCPUS before rebuilding it from sched domain
data. Comparing that empty value with
/sys/devices/system/cpu/isolated makes the test fail whenever
isolcpus=domain is present.

That sysfs file is generated from HK_TYPE_DOMAIN_BOOT and does not change
when cpuset updates HK_TYPE_DOMAIN. Re-reading it cannot validate dynamic
housekeeping updates. The cpuset.cpus.isolated and sched domain checks
already cover the two dynamic interfaces, so remove the invalid comparison.

This can be reproduced on a kernel booted with isolcpus=domain,15:

    # tools/testing/selftests/cgroup/test_cpuset_prs.sh

The test fails its first state-matrix isolation check before the change and
continues past that check afterward.

Fixes: 6df415aa46 ("cgroup/cpuset: Defer housekeeping_update() calls from CPU hotplug to workqueue")
Signed-off-by: Guopeng Zhang <zhangguopeng@kylinos.cn>
Reviewed-by: Waiman Long <longman@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-24 07:01:15 -10:00
Paolo Bonzini
76671054f9 KVM/arm64 changes for 7.3
- Add support for 'slot' based PMU events, paired with new UAPI that
    compels the user to select a specific PMU implementation
 
  - Lazy save/restore of vCPU state for pKVM, along with various fixes
    and cleanups to the management of vCPU state between the untrusted
    host and pKVM hypervisor
 
  - Disable traps of EL1 registers for nested hypervisors when FEAT_NV2p1
    is present, guaranteeing that EL2-specific register bits are stateful
    in the EL1 counterpart
 
  - Leverage FEAT_NV3 to avoid unnecessary ERET/TLBI traps when the scope
    of those instructions remains 'in host' (i.e. L1 kernel/userspace)
 
  - Pile of fixes for the management of the VNCR pseudo-TLB, such as
    under-invalidations and races with concurrent TLBIs on other vCPUs
 
  - Consolidate the non-protected and pKVM view of ICH_VTR_EL2 to a
    runtime-patched constant, allowing the same data to be shared with
    pKVM prior to dropping host privileges
 
  - Considerable pile of LLM-assisted fixes around the shop but mostly in
    the VGIC, our in-kernel generator of bugs (and sometimes interrupts)
 -----BEGIN PGP SIGNATURE-----
 
 iI0EABYKADUWIQSNXHjWXuzMZutrKNKivnWIJHzdFgUCaoZ/khccb2xpdmVyLnVw
 dG9uQGxpbnV4LmRldgAKCRCivnWIJHzdFkK7AP9zvAcDf+DVte8+mZjCMDrvNB1n
 UWsBnQkdZ1nDDYBJlwD8D1pvurK4ZV3UIl68IgpTqYKhMspCuOWDHrnBt1QyqQU=
 =2iPX
 -----END PGP SIGNATURE-----

Merge tag 'kvmarm-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD

KVM/arm64 changes for 7.3

 - Add support for 'slot' based PMU events, paired with new UAPI that
   compels the user to select a specific PMU implementation

 - Lazy save/restore of vCPU state for pKVM, along with various fixes
   and cleanups to the management of vCPU state between the untrusted
   host and pKVM hypervisor

 - Disable traps of EL1 registers for nested hypervisors when FEAT_NV2p1
   is present, guaranteeing that EL2-specific register bits are stateful
   in the EL1 counterpart

 - Leverage FEAT_NV3 to avoid unnecessary ERET/TLBI traps when the scope
   of those instructions remains 'in host' (i.e. L1 kernel/userspace)

 - Pile of fixes for the management of the VNCR pseudo-TLB, such as
   under-invalidations and races with concurrent TLBIs on other vCPUs

 - Consolidate the non-protected and pKVM view of ICH_VTR_EL2 to a
   runtime-patched constant, allowing the same data to be shared with
   pKVM prior to dropping host privileges

 - Considerable pile of LLM-assisted fixes around the shop but mostly in
   the VGIC, our in-kernel generator of bugs (and sometimes interrupts)
2026-08-24 12:42:07 -04:00
Baineng Shou
8985cbc927 selftests: dmabuf-heaps: add fd-leak-on-EFAULT regression test
Add a test case that verifies no file descriptor is leaked when
DMA_HEAP_IOCTL_ALLOC succeeds internally but copy_to_user() fails
to deliver the fd number back to userspace.

The failure is triggered by placing the ioctl argument in a private
anonymous page and flipping it to PROT_READ (via mprotect) between
the kernel's copy_from_user() and copy_to_user() calls.  With the
buggy kernel the ioctl returns -EFAULT but leaves an extra open fd
in the process's fd table; with the fixed kernel the fd count is
unchanged.

This serves as a regression test for:
  "dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds"

Suggested-by: Sumit Semwal <sumit.semwal@linaro.org>
Reviewed-by: T.J. Mercier <tjmercier@google.com>
Acked-by: Sumit Semwal <sumit.semwal@linaro.org>
Signed-off-by: Baineng Shou <shoubaineng@gmail.com>
Link: https://lore.kernel.org/r/20260817050457.1005285-5-shoubaineng@gmail.com
Signed-off-by: Christian König <christian.koenig@amd.com>
2026-08-24 14:21:55 +02:00
Jimmy Zuber
60dbcce156 selftests/fuse: test post-EOF page zeroing when a file is extended
Add a regression test for the bug where extending a file left the tail of
the old partial EOF page exposing stale mmap-dirtied data instead of zeros.

The test is a self-contained raw /dev/fuse server (no libfuse dependency)
that runs without writeback_cache and returns FOPEN_KEEP_CACHE, the
configuration in which the bug is visible.  Its backing data is always zero
in the hole, so any non-zero byte a read sees is stale page-cache data.
All offsets are relative to the runtime page size.  Four cases:

  - write_extend: pollute the post-EOF tail, extend past it by writing into
    a later page, and verify the tail reads back as zero;
  - ftruncate_extend: same, but extend via ftruncate();
  - fallocate_extend: same, but extend via fallocate() at the old EOF;
  - extend_into_eof_page_preserves_data: an extending write landing inside
    the old EOF page must not be clobbered by the zeroing.

Each case fails without the fix and passes with it.

Signed-off-by: Jimmy Zuber <jamz@amazon.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2026-08-24 12:18:02 +02:00
Miguel Ojeda
993f235c4a objtool/rust: add one more noreturn Rust function
When the pointer formatting series [1] is applied and KUnit tests
are enabled, `objtool` would report an error with any of our
supported Rust versions. For instance, with Rust 1.97.1:

    rust/kernel.o: error: objtool: _R..._4core3fmt7Pointer3fmtB7_()
    falls through to next function _R..._4core7convert5AsRefNtB5_4BStrE6as_ref()

Or, with Rust 1.85.0:

    rust/kernel.o: error: objtool: _R..._4core3fmt7Pointer3fmtB7_()
    falls through to next function _R..._4core3ffi5c_str4CStrENtNtBS_3fmt7Display3fmtB7_()

This happens due to calls to the `noreturn` symbol:

    core::str::slice_error_fail

Thus add the mangled one to the list so that `objtool` knows it is
actually `noreturn`.

See commit 56d680dd23 ("objtool/rust: list `noreturn` Rust functions")
for more details.

[ While the series [1] mentioned above was not applied in a way
  that triggered this, Gary found another case [2]:

    I am seeing this function causing issue on my 1.85.1 -Os build, although the
    error message is different this time:

        rust/kernel.o: warning: objtool: _R..._5range9RangeFromjEE5indexCsldbe0TGTmNx_6kernel+0x1d:
        stack state mismatch: cfa1=4+8 cfa2=4+16

    Disassembly shows that the function call before the warning location
    is a call to _4core3str16slice_error_fail, and objtool thought it can
    return (which will end up with a unbalanced stack if it does return).

  Thus apply it. - Miguel ]

Cc: stable@vger.kernel.org # Needed in 6.12.y and later (Rust is pinned in older LTSs).
Cc: Josh Poimboeuf <jpoimboe@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Reported-by: Alice Ryhl <aliceryhl@google.com>
Link: https://lore.kernel.org/rust-for-linux/anLxXvCKBcAVf91_@google.com/
Link: https://lore.kernel.org/rust-for-linux/20260706-hashedptr-v13-0-377a07f2f78d@kylinos.cn/ [1]
Link: https://lore.kernel.org/rust-for-linux/DKS7U9UHY6XR.2JC0EBIPCI06Z@garyguo.net/ [2]
Link: https://patch.msgid.link/20260805144524.233362-1-ojeda@kernel.org
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-08-23 21:27:16 +02:00
Linus Torvalds
388b607d10 EFI updates for v7.3
- Set a timeout for EFI runtime service completions, and declare the
   firmware wedged if it is exceeded. Note that this requires special
   handling in case the firmware does return after all.
 
 - Rate limit the efivarfs statfs() handler as the QueryVariableInfo()
   runtime service can be costly
 
 - Sanity check the size of struct properties_header on Mac/x86
 
 - Tweak the prototype of efi_guid_to_str()
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQQQm/3uucuRGn1Dmh0wbglWLn0tXAUCaoqdVQAKCRAwbglWLn0t
 XAb1AP9DIuHIAYlD4j8FKXcJtq1O/MzOadE3c4fNIdTPlTeUaAD8CAP0gHG3iRvc
 G265QOG2tjmmnFbCe+R8JVSdXBwCEAU=
 =GNJQ
 -----END PGP SIGNATURE-----

Merge tag 'efi-next-for-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi

Pull EFI updates from Ard Biesheuvel:

 - Set a timeout for EFI runtime service completions, and declare the
   firmware wedged if it is exceeded. Note that this requires special
   handling in case the firmware does return after all

 - Rate limit the efivarfs statfs() handler as the QueryVariableInfo()
   runtime service can be costly

 - Sanity check the size of struct properties_header on Mac/x86

 - Tweak the prototype of efi_guid_to_str()

* tag 'efi-next-for-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi:
  efivarfs: Rate limit statfs() handler
  efi: apple-properties: validate setup data header length
  efi: make efi_guid_to_str() take a const GUID pointer
  efi/runtime-wrappers: retire the worker if a wedged call ever returns
  efi/runtime-wrappers: honour EFI_RUNTIME_SERVICES in the non-blocking paths
  efi/runtime-wrappers: bound the wait for EFI runtime service calls
  efi/runtime-wrappers: check EFI_RUNTIME_SERVICES before using efi_rts_work
  efi/runtime-wrappers: handle queue_work() failure with goto exit
  efi/runtime-wrappers: factor out efi_rts_park_worker()
  efi: fix stale reference to efi_recover_from_page_fault()
2026-08-23 09:24:34 -07:00
Linus Torvalds
91959a31a3 kho: make boot time huge page allocation work nicely with KHO
Today allocation of gigantic pages in HugeTLB cannot work reliably with KHO:
 
 * HugeTLB allocates gigantic pages using memblock and autoscaling of KHO
   scratch accounts for these allocations. When gigantic pages occupy half
   of the memory of more, KHO fails to allocate its scratch memory.
 * After kexec handover, memblock allocations exclusively use KHO scratch
   that is not supposed to contain preserved memory. This essentially blocks
   preservation of HugeTLB with gigantic pages.
 
 Extend early memory pools available for KHO kernel with areas that are
 guaranteed not to contain preserved memory.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEeOVYVaWZL5900a/pOQOGJssO/ZEFAmqK9NwACgkQOQOGJssO
 /ZGN3wgAqX/mXawYnhwDW2J931VsT54RuEctSNTCZ4Va8CWfeVjSV2bD2BlM+ibi
 VtsvEAIdKb8tyx3t+3JLR3jrANE5XcxeDiS7sJG7QWaek6G++GdAmrm7q98rU7Pc
 rqX8kMf65AZpHuV5wzKgF1fuYYur5Y4sKK00GVq+hPyWshmeYhaa+nGtJNe67D1a
 CFw38r5WAPs/DwyvWg/3yfupbgTG6OShHPnKxqR7aaOJE4YnD3snsBM7hot/ZI7e
 kz4TqixkxKn1RXq0XDcj8w11LxhxxsI67x02Fnnc1ClgMynCgDOvRXW6B93qRIRM
 ZUK8fbzIxFDQHnfzWRXcIIsN7r54Ow==
 =JHVN
 -----END PGP SIGNATURE-----

Merge tag 'liveupdate-v7.3-rc1-20260823' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux

Pull more liveupdate updates from Mike Rapoport:
 "Make boot time huge page allocation work nicely with kexec handover.

  Today allocation of gigantic pages in HugeTLB cannot work reliably
  with kexec handover (KHO):

   - HugeTLB allocates gigantic pages using memblock and autoscaling of
     KHO scratch accounts for these allocations. When gigantic pages
     occupy half of the memory of more, KHO fails to allocate its
     scratch memory.

   - After kexec handover, memblock allocations exclusively use KHO
     scratch that is not supposed to contain preserved memory. This
     essentially blocks preservation of HugeTLB with gigantic pages.

  Extend early memory pools available for KHO kernel with areas that are
  guaranteed not to contain preserved memory"

* tag 'liveupdate-v7.3-rc1-20260823' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux: (21 commits)
  kho: exclude hugetlb memory from scratch size calculation
  memblock: add memblock_reserved_hugetlb_size()
  memblock: make HugeTLB bootmem allocation work with KHO
  memblock: always include KHO headers
  kho: extend scratch
  mm/mm_init: don't rely on memblock to get KHO scratch migratetype
  kho: initialize preserved memory map radix tree earlier
  kho: initialize kho_scratch pointer earlier in boot
  kho: expose kho_scratch_overlap() to kexec_handover.h
  kho: add kho_radix_init_tree()
  kho: allow destroying KHO radix tree
  kho: allow early-boot usage of the KHO radix tree
  kho: add data argument to radix walk callback
  kho: add callback for table pages
  kho: add a struct for radix callbacks
  kho: move all memory retrieval logic to kho_mem_retrieve()
  kho: store incoming radix tree in kho_in
  kho: disallow wide keys in radix tree
  kho: make radix max key width more obvious
  kho: generalize radix tree APIs
  ...
2026-08-23 09:17:38 -07:00
Linus Torvalds
e5f9260615 mm.git review status for master..mm-nonmm-stable
Total patches:       95
 Reviews/patch:       0.63
 Reviewed rate:       56%
 
 Summary of patch series in this merge:
 
 - "ocfs2/dlm: bound peer-controlled lengths in the o2dlm" (Bryam Vargas):
 
   Validate and bound all input lengths and count fields in the o2dlm
   migration and recovery receive handlers to prevent memory corruption and
   kernel panics from malformed cluster messages
 
 - "ocfs2: validate xattr entry bounds" (Cen Zhang):
 
   Validate OCFS2 extended attribute entry name and value bounds during
   metadata reads to prevent out-of-range memory accesses during retrieval
   or listing operations.
 
 - "taskstats: fix cgroupstats invalid fd handling and add selftests"
   (Yiyang Chen):
 
   Return -EBADF when cgroupstats receives an invalid file descriptor to
   prevent caller hangs and misleading success ACKs.  Add a kselftest to
   validate valid cgroup v1 queries and verify proper error handling across
   different Netlink flag combinations.
 
 - "misc lib/raid/ improvements v2" (Christoph Hellwig):
 
   Improve benchmark-based algorithm selection for the XOR and RAID6
   libraries, add KUnit benchmark tests, and cleanup minor implementation
   details.
 
 - "ocfs2: cluster: o2hb_region_pin() fixes" (Joseph Qi):
 
   Fix sleeping-in-atomic, lock order inversion and error-path cleanup
   bugs in o2hb_region_pin() by releasing o2hb_live_lock across sleeping
   configfs_depend_item() calls and using unlocked variants from callback
   context.  Ensure failed pin attempts properly decrement user counts and
   unpin partially initialized heartbeat regions to prevent memory leaks
   and unprotected states.
 
 - "lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()" (Vincent
   Mailhol)
 
   Fix an off-by-one which could cause an out-of-bounds read.
 
 - "ocfs2: harden heartbeat teardown races" (Cen Zhang):
 
   Fix two OCFS2 heartbeat/o2net teardown races found by KASAN.
 
 - "taskstats: tidy up the cpumask command path" *Bradley Morgan)
 
   make two small cleanups in kernel/taskstats.c.
 
 - "ocfs2: validate active orphan slots during inode read" (ZhengYuan Huang):
 
   Validate active ordinary and append-DIO orphan slots read from OCFS2
   dinodes at the metadata boundary to prevent corrupted slot indices from
   causing out-of-bounds array accesses.
 
 - "ocfs2: bound-check both readdir re-validation scans" (Zhan Xusheng)
 
   Enforce strict boundary checks on directory entry record lengths and
   offset calculations during OCFS2 directory re-scans to prevent
   out-of-bounds memory reads and directory position corruption.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCaoo38wAKCRDdBJ7gKXxA
 jnKuAP9tIUJoYIzxG7zr00qJj95gczgE0+GikN1wXfO9Cvh8QAEAqr5InWrANTBB
 l4qW3/o4hM9TlBdr84oT3RNnvBicuwA=
 =BY1d
 -----END PGP SIGNATURE-----

Merge tag 'mm-nonmm-stable-2026-08-22-16-57' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Pull non-MM updates from Andrew Morton:

 - "ocfs2/dlm: bound peer-controlled lengths in the o2dlm" (Bryam
   Vargas)

   Validate and bound all input lengths and count fields in the o2dlm
   migration and recovery receive handlers to prevent memory corruption
   and kernel panics from malformed cluster messages

 - "ocfs2: validate xattr entry bounds" (Cen Zhang)

   Validate OCFS2 extended attribute entry name and value bounds during
   metadata reads to prevent out-of-range memory accesses during
   retrieval or listing operations.

 - "taskstats: fix cgroupstats invalid fd handling and add selftests"
   (Yiyang Chen)

   Return -EBADF when cgroupstats receives an invalid file descriptor to
   prevent caller hangs and misleading success ACKs. Add a kselftest to
   validate valid cgroup v1 queries and verify proper error handling
   across different Netlink flag combinations.

 - "misc lib/raid/ improvements v2" (Christoph Hellwig)

   Improve benchmark-based algorithm selection for the XOR and RAID6
   libraries, add KUnit benchmark tests, and cleanup minor
   implementation details.

 - "ocfs2: cluster: o2hb_region_pin() fixes" (Joseph Qi)

   Fix sleeping-in-atomic, lock order inversion and error-path cleanup
   bugs in o2hb_region_pin() by releasing o2hb_live_lock across sleeping
   configfs_depend_item() calls and using unlocked variants from
   callback context. Ensure failed pin attempts properly decrement user
   counts and unpin partially initialized heartbeat regions to prevent
   memory leaks and unprotected states.

 - "lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()"
   (Vincent Mailhol)

   Fix an off-by-one which could cause an out-of-bounds read.

 - "ocfs2: harden heartbeat teardown races" (Cen Zhang)

   Fix two OCFS2 heartbeat/o2net teardown races found by KASAN.

 - "taskstats: tidy up the cpumask command path" *Bradley Morgan)

   make two small cleanups in kernel/taskstats.c.

 - "ocfs2: validate active orphan slots during inode read" (ZhengYuan
   Huang)

   Validate active ordinary and append-DIO orphan slots read from OCFS2
   dinodes at the metadata boundary to prevent corrupted slot indices
   from causing out-of-bounds array accesses.

 - "ocfs2: bound-check both readdir re-validation scans" (Zhan Xusheng)

   Enforce strict boundary checks on directory entry record lengths and
   offset calculations during OCFS2 directory re-scans to prevent
   out-of-bounds memory reads and directory position corruption.

* tag 'mm-nonmm-stable-2026-08-22-16-57' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (95 commits)
  mailmap: fix bouncing address for Taniya Das
  ocfs2: bound-check dir entries in the inline-data re-validation scan
  ocfs2: bound-check dir entries in the readdir re-validation scan
  squashfs: avoid thundering-herd cache wakeups
  prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator
  mailmap: update email address for Linfeng Sun
  lib/interval_tree: fix allocation warning messages
  checkpatch: add NOKPROBE_SYMBOL to the whitelist of lines that can occur immediately after functions
  Squashfs: check block offset is not negative
  signal: factor out the kernel reserved si_code check
  ocfs2: fix readdir position truncation on 32-bit kernels
  ocfs2: fix cached cluster count after suballocator reclaim
  ocfs2: fix circular locking dependency in ocfs2_init_acl()
  ocfs2: validate DIO orphan slot during inode read
  ocfs2: validate orphan slot during inode read
  selftests/prctl: fix non-anonymous VMA mapping in set-anon-vma-name test
  MAINTAINERS: add IRC and patchwork for LTP
  include/linux/list.h: mark list_add and __list_add as __always_inline
  tools/mm: prevent page_owner_sort from truncating input
  hung_task: update DETECT_HUNG_TASK_BLOCKER Kconfig help
  ...
2026-08-23 08:07:11 -07:00
Linus Torvalds
473f6c8f43 perf tools updates for v7.3
perf c2c:
 
  - Add 'function view' in perf c2c report TUI (switched by pressing 'TAB'
    in the cacheline view) to organize samples around functions rather than
    cachelines in 3-level hierarchy:
 
      Level 1: Read-side function (sorted by estimated Cycles %)
      Level 2:   Contending writer functions (sorted by Store count)
      Level 3:     Shared cacheline addresses
 
    Users can navigate the entries and fold/unfold using 'e' key.  An example
    output would look like below:
 
     Shared Data Functions Table     (19 entries, sorted on Cycles %)
        Cycles    Store
             %    count  Function / Contending function / Cacheline
     ----------------------------------------------------------------------
     +  35.67%      876  + [k] cpupri_set
     +  24.31%      424  + [k] pull_rt_task
     -  16.53%      555  - [k] dequeue_pushable_task
                    145    - [k] pull_rt_task
                    145        0xff2d0082809da080
                    139    - [k] enqueue_pushable_task
                     70        0xff2d00a2071f9640
                     69        0xff2d0082809da000
 
 python module support:
 
  - Extend "perf" python module so that it can be fully functional.  The goal
    is to run scripts directly, not by 'perf script' command.  This would give
    better performance as well as more control to build standalone programs
    with UI.
 
  - Add LiveSession helper (perf_live.py) to enable live event collection
    directly from Python using perf.evlist and perf.parse_events.
 
 perf stat:
 
  - Add --hide-zero-events option to suppress zero-count events.
  - Reject conflicting --field-separator and --json-output options.
  - Fix duplicate event output with --for-each-cgroup.
 
 perf sched latency:
 
  - Add -H/--histogram and --hist-mode (log|linear) options to show scheduler
    wait latency histograms.
  - Add --time option to filter analysis by time span in 'perf sched latency'.
 
 ARM CoreSight:
 
  - Synthesize callchains for instruction samples from CoreSight trace
    using thread stack ('--itrace=g...').
  - Support call indentation ('perf script -F +callindent') to display call
    depth hierarchy on branch samples.
  - Decode ETE (Embedded Trace Extension) exception packets.
 
 Build system:
 
  - Add 'make install-build-deps' target to install required packages.
  - Parallelize JSON and metric pre-computation in jevents.py for faster builds.
 
 Vendor event/metric updates:
 
  - Add Intel Nova Lake events and update tables for existing models.
  - Update AMD Zen 5 and Zen 6 core events.
  - Update Arm64 Tegra410 metrics and PowerPC hcalls.
 
 Internal changes and fixes:
 
  - Harden trace-event and synthetic event parsing against corrupted data.
  - Fix unwinding of multi-threaded processes in libdw unwinder.
  - Fix memory leaks in various commands and python bindings.
  - Speed up 'perf test' shell tests.
 
 Signed-off-by: Namhyung Kim <namhyung@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQSo2x5BnqMqsoHtzsmMstVUGiXMgwUCaojCVQAKCRCMstVUGiXM
 gxZLAP9u7Bqhfcrc1KKS9RcxBaiYwsPOIgbtdrDDCSiLtdz0EwEAk1UCSXodUsaR
 45nbx01h+h7cUWk2HM735f4RXRfO/AE=
 =GLJH
 -----END PGP SIGNATURE-----

Merge tag 'perf-tools-for-v7.3-2026-08-21' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools

Pull perf tools updates from Namhyung Kim:
 "perf c2c:

   - Add 'function view' in perf c2c report TUI (switched by pressing
     'TAB' in the cacheline view) to organize samples around functions
     rather than cachelines in 3-level hierarchy:

	Level 1: Read-side function (sorted by estimated Cycles %)
	Level 2:   Contending writer functions (sorted by Store count)
	Level 3:     Shared cacheline addresses

     Users can navigate the entries and fold/unfold using 'e' key. An
     example output would look like below:

	Shared Data Functions Table     (19 entries, sorted on Cycles %)
	   Cycles    Store
	        %    count  Function / Contending function / Cacheline
	----------------------------------------------------------------------
	+  35.67%      876  + [k] cpupri_set
	+  24.31%      424  + [k] pull_rt_task
	-  16.53%      555  - [k] dequeue_pushable_task
	               145    - [k] pull_rt_task
	               145        0xff2d0082809da080
	               139    - [k] enqueue_pushable_task
	                70        0xff2d00a2071f9640
	                69        0xff2d0082809da000

  python module support:

   - Extend "perf" python module so that it can be fully functional. The
     goal is to run scripts directly, not by 'perf script' command. This
     would give better performance as well as more control to build
     standalone programs with UI.

   - Add LiveSession helper (perf_live.py) to enable live event
     collection directly from Python using perf.evlist and
     perf.parse_events.

  perf stat:

   - Add --hide-zero-events option to suppress zero-count events
   - Reject conflicting --field-separator and --json-output options
   - Fix duplicate event output with --for-each-cgroup

  perf sched latency:

   - Add -H/--histogram and --hist-mode (log|linear) options to show
     scheduler wait latency histograms
   - Add --time option to filter analysis by time span in 'perf sched
     latency'

  ARM CoreSight:

   - Synthesize callchains for instruction samples from CoreSight trace
     using thread stack ('--itrace=g...')
   - Support call indentation ('perf script -F +callindent') to display
     call depth hierarchy on branch samples
   - Decode ETE (Embedded Trace Extension) exception packets

  Build system:

   - Add 'make install-build-deps' target to install required packages
   - Parallelize JSON and metric pre-computation in jevents.py for
     faster builds

  Vendor event/metric updates:

   - Add Intel Nova Lake events and update tables for existing models
   - Update AMD Zen 5 and Zen 6 core events
   - Update Arm64 Tegra410 metrics and PowerPC hcalls

  Internal changes and fixes:

   - Harden trace-event and synthetic event parsing against corrupted
     data
   - Fix unwinding of multi-threaded processes in libdw unwinder
   - Fix memory leaks in various commands and python bindings
   - Speed up 'perf test' shell tests"

* tag 'perf-tools-for-v7.3-2026-08-21' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools: (232 commits)
  perf vendor events arm64: Fix Tegra410 Olympus event 0x0197
  perf vendor events arm64: fix swapped MetricGroup for Tegra410 L1 prefetcher metrics
  perf evlist: Warn when 'sleep' workload is used without system-wide (-a) option
  perf c2c: document function view in perf-c2c man page
  perf c2c: add function view browser UI and cacheline detail
  perf c2c: build and finalize the function view hierarchy
  perf c2c: add function view hierarchy entry creation
  perf c2c: add function view stats merge and memory management
  perf c2c: add HPP list parsing for function view columns
  perf c2c: add column rendering for function view
  perf c2c: add function view model skeleton
  perf c2c: extract shared data structures into util/c2c.h
  perf test sample-parsing: Validate PERF_FORMAT_GROUP values without LOST
  perf dso: Replace assert with runtime check in dso__read_symbol()
  perf dso: Guard against cache underflow on short reads in dso_cache__memcpy()
  perf dso: Use stored fd error instead of stale errno in file_read() and file_size()
  perf dso: Guard close() against invalid fd in dso__decompress_kmodule_path()
  perf dso: Guard against errno==0 when dso__get_filename() returns NULL
  perf build: install-build-deps: add RHEL family devel package mapping
  perf build: Remove leftover feature tests for removed cxx and clang support
  ...
2026-08-22 08:47:50 -07:00
Tejun Heo
9e8581a090 sched_ext: Sync common and compat headers from the scx repo
Sync common.bpf.h, compat.bpf.h and compat.h with the scx repo, which
accumulated the following:

- __COMPAT_read_enum() can now recover 64-bit scx enum values from kernel
  BTF generated without BTF_KIND_ENUM64 support (pahole < 1.24 or
  --skip_encoding_btf_enum64, e.g. COS/GKE kernels), substituting values
  from the build-time vmlinux.h cross-checked against the low 32 bits the
  kernel does provide.

- is_migration_disabled() no longer assumes the BPF prolog always disables
  migration. Since 8e4f0b1ebc ("bpf: use rcu_read_lock_dont_migrate() for
  trampoline.c") the prolog only does so under CONFIG_PREEMPT_RCU, so the
  old current-task test under-reported on v6.18+ !PREEMPT_RCU kernels. A
  runtime probe on bpf_scx_reg() handles older kernels with backported
  trampoline behavior.

- __COMPAT_scx_bpf_dsq_peek() is gated behind kernel v7.1 where 2f2ea77092
  ("sched_ext: Use dsq->first_task instead of list_empty() in
  dispatch_enqueue() FIFO-tail") fixed the kfunc spuriously returning NULL
  on non-empty FIFO DSQs, and the new
  scx_bpf_reenqueue_local_from_anywhere() provides a callable-from-anywhere
  reenqueue which prefers the generic scx_bpf_dsq_reenq(). Both were first
  posted by Gavin Guo and Changwoo Min and are picked up here with the
  review feedback folded in.

- __COMPAT_scx_bpf_cpu_curr() and the scx_bpf_cpu_rq() declaration are
  restored. Schedulers built from these headers still run on pre-v6.18
  kernels where scx_bpf_cpu_curr() does not resolve and the scx_bpf_cpu_rq()
  fallback still exists.

- scx_clock_task() and scx_clock_pelt() document their stale-read behavior
  for remote idle CPUs under NO_HZ_IDLE.

Link: https://lore.kernel.org/all/20260817143126.562923-1-changwoo@igalia.com
Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-21 21:19:26 -10:00
Tejun Heo
e10b8b4931 sched_ext: Sync tools autogen enum headers from the scx repo
Regenerate enum_defs.autogen.h against the current tree, picking up the
dispatch verdict enums and dropping the marker for the removed
SCX_RQ_IN_BALANCE. Add enums_abi.autogen.h, a table of 64-bit scx enumerator
values generated from vmlinux.h, used as the substitution source when the
running kernel's BTF truncates 64-bit enum values to 32 bits.

Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-21 21:19:26 -10:00
Linus Torvalds
7199989f3f Landlock update for v7.3-rc1
-----BEGIN PGP SIGNATURE-----
 
 iIYEABYKAC4WIQSVyBthFV4iTW/VU1/l49DojIL20gUCaoa8/RAcbWljQGRpZ2lr
 b2QubmV0AAoJEOXj0OiMgvbSSjMBAIq+/dIjMVUddtyqRlWKMfBQqokU4Dl5JeHB
 Y4Jh61idAQCihXimNu+TOuX1zc80eBR+IzDYaAU8ZGcK079hmGO5Bw==
 =TKoa
 -----END PGP SIGNATURE-----

Merge tag 'landlock-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux

Pull Landlock update from Mickaël Salaün:
 "This improves observability with Landlock tracepoints support, which
  required some refactoring for dedicated domain types and common
  helpers shared with audit code.

  A LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS flag is also added to improve
  process-wide domain enforcement consistency.

  Whiteout files are now correctly handled and tested, and a few other
  fixes"

* tag 'landlock-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux: (34 commits)
  landlock: Document tracepoints
  selftests/landlock: Add landlock_enforce_domain trace tests
  selftests/landlock: Add scope and ptrace tracepoint tests
  selftests/landlock: Add network tracepoint tests
  selftests/landlock: Add filesystem tracepoint tests
  selftests/landlock: Add trace event test infrastructure and tests
  landlock: Add tracepoints for ptrace and scope denials
  landlock: Add landlock_deny_access_fs and landlock_deny_access_net
  landlock: Add tracepoints for rule checking
  landlock: Add landlock_enforce_domain tracepoint
  landlock: Add create_domain and free_domain tracepoints
  landlock: Add landlock_add_rule_fs and landlock_add_rule_net tracepoints
  landlock: Add create_ruleset and free_ruleset tracepoints
  landlock: Consolidate access-right and scope names in a shared header
  landlock: Decouple the per-denial logging decision from CONFIG_AUDIT
  landlock: Split denial logging from audit into common framework
  landlock: Split struct landlock_domain from struct landlock_ruleset
  landlock: Move domain query functions to domain.c
  landlock: Prepare ruleset and domain type split
  samples/landlock: Add LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS to sampler
  ...
2026-08-21 12:28:35 -07:00
Linus Torvalds
2be02a7c99 power supply and reset changes for the 7.3 series
* power-supply core
   - Add PbAc, NiZn, RAM, and ZnAr battery chemistry types
   - Create LED triggers based on properties instead of device type
   - Provide power_supply_get_system_batteries() for usage with USB-C
   - Add registration init callback for race-free device setup
  * power-supply drivers
   - new TI BQ25630 charger driver
   - new SG Micro sgm41542 charger driver
   - bq257xx: Add support for BQ25792
   - max8903: add DC and USB input current-limit controls
   - max17042_battery: Initialize MAX17055 from battery info
   - sbs-battery: map newly introduced battery chemistries
   - drop extra error messages for IRQ request failures
   - lot's of driver removal race condition fixes
   - misc. small cleanups and fixes
  * reset drivers
   - add MCF5441x RCM power-on reason driver
   - misc. small cleanups and fixes
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE72YNB0Y/i3JqeVQT2O7X88g7+poFAmqHhI8ACgkQ2O7X88g7
 +prz8A//RwS840YNf/HU54EoG9daMtipcZ6RJrSoY0UiS4oYxERuOoP3azaj/B+l
 6x7q8sp84E6Ejrrt1Hr6guKvRclVbgFJwagbqbzZ1l/EQvxgHPo2grHlSHSpqoPM
 NafNyFyrItuC9T02XkI1AnDcrXBIXZ4EXxIH2pe/da027lUGkAZO56oxmX5WDBRc
 OsUvCBBMOe2wlLnQErT7AfEFOic4H4Uz6j+CDwitHGqPcctpLR9JuBiB5QDFKaeY
 Nf3GDxRG1pahCCgs9ltOAHKx3UmS71xwfEWoig4h4r88OpV59Mm3fMhteTSt2nAl
 5c5tkSwBpnlTdMJdJkrlR4bmGMGjAdd0+MkqBivWGev1NJMNo/QGoh0a7pVUFGSt
 lPgy0vA51+ZBGmcEY6lh4uOlJ0Pn9Sd04Ao/En+0fd0r+jlq3x1JebwqTeFt9pNd
 5zXxl2UKpd6xaF6EZoV59AI/DCwNKxHpFfh1IMvBsfFAqe/ULrlr4v+AD+TCUMdr
 PLU/jdg9j8iIXo7s5U9Xymba5/cxFmy95u+fsVtjjFhHdSRMcKjwRS3mg0L5W+GN
 umy/2ewraTNsHCLZ7bS0/OL/rSv6nnL5DH/Jk02pkws2lpmVL5x+xeCK4UTJy6rA
 rMHa+Ex5/i+fW5n5XBgbDmRu/ihojcsVX5Xz/7/LqyuHvTlLWj4=
 =TxN7
 -----END PGP SIGNATURE-----

Merge tag 'for-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply

Pull power supply and reset updates from Sebastian Reichel:
 "Power-supply core:
   - Add PbAc, NiZn, RAM, and ZnAr battery chemistry types
   - Create LED triggers based on properties instead of device type
   - Provide power_supply_get_system_batteries() for usage with USB-C
   - Add registration init callback for race-free device setup

  Power-supply drivers:
   - new TI BQ25630 charger driver
   - new SG Micro sgm41542 charger driver
   - bq257xx: Add support for BQ25792
   - max8903: add DC and USB input current-limit controls
   - max17042_battery: Initialize MAX17055 from battery info
   - sbs-battery: map newly introduced battery chemistries
   - drop extra error messages for IRQ request failures
   - lot's of driver removal race condition fixes
   - misc small cleanups and fixes

  Reset drivers:
   - add MCF5441x RCM power-on reason driver
   - misc small cleanups and fixes"

* tag 'for-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: (115 commits)
  power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address
  power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address
  power: supply: bq27xxx: bq27520g4: fix REG_TTES address
  power: supply: max17040: synchronize work cancellation on suspend
  power: supply: lp8727: fix use-after-free in lp8727_release_irq()
  power: supply: bq256xx: drain usb_work before freeing the charger
  power: supply: qcom_battmgr: fix battery chemistry strncmp length
  power: supply: bd99954: Drop bad register fields
  power: supply: bd71828: Do not hide errors
  power: supply: bd71828: Drop duplicate power-supply property
  power: supply: bd71828: Fix current direction
  power: supply: bd71815: Fix temperature reading
  power: supply: add stubs for notifier registration helpers
  power: supply: ucs1002: fix use-after-free on remove
  power: supply: lp8788-charger: fix use-after-free on remove
  power: supply: ab8500_fg: fix use-after-free on remove
  power: supply: bq24257: fix use-after-free on remove
  power: supply: qcom_battmgr: fix use-after-free
  power: supply: max17040: drop incorrect I2C functionality check
  power: supply: charger-manager: register regulators before exposing sysfs
  ...
2026-08-21 12:05:10 -07:00
Linus Torvalds
21bd0802cd RDMA v7.3 merge window pull
Quite alot of buf fixes again:
 
 - Assorted locking, bounds-checking, cleanup, and error-path fixes across
   UCMA/CMA, bng_re, bnxt_re, cxgb4, EFA, ERDMA, HFI1, HNS, ionic, iRDMA,
   mlx4/mlx5, RXE, SIW, SRP/SRPT, and iSER target.
 
 - netlink report for max # of supported resources
 
 - get_zeroed_page()/etc removal
 
 - Robust udata for ionic
 
 - Allow unique RDMA device names per network namespace
 
 - Completion counters and v2 admit queue support for EFA
 
 - UC QP support for MANA
 
 - Completion timestamps for ionic
 
 - Harden uverbs data validation and resource lifetime handling, fixing several core use-after-free conditions.
 
 - bnxt_re toggle-page ownership and lifetime bug fixes
 
 - dmabuf SRQ support for mlx5
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRRRCHOFoQz/8F5bUaFwuHvBreFYQUCaoeO2wAKCRCFwuHvBreF
 YcyJAQCn8JeqTuayLchCARJX+9fazTaJES9zj41i3M8a7BfxCAEA2b266g0S660m
 7eQ761NiIb1iklSl9rmt8vM22EMcngM=
 =qcwp
 -----END PGP SIGNATURE-----

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma

Pull RDMA updates from Jason Gunthorpe:
 "About the normal size, still a lot of AI bug fixes and so on, but some
  interesting new functionality too:

   - Assorted locking, bounds-checking, cleanup, and error-path fixes
     across UCMA/CMA, bng_re, bnxt_re, cxgb4, EFA, ERDMA, HFI1, HNS,
     ionic, iRDMA, mlx4/mlx5, RXE, SIW, SRP/SRPT, and iSER target.

   - netlink report for max # of supported resources

   - get_zeroed_page()/etc removal

   - Robust udata for ionic

   - Allow unique RDMA device names per network namespace

   - Completion counters and v2 admit queue support for EFA

   - UC QP support for MANA

   - Completion timestamps for ionic

   - Harden uverbs data validation and resource lifetime handling,
     fixing several core use-after-free conditions.

   - bnxt_re toggle-page ownership and lifetime bug fixes

   - dmabuf SRQ support for mlx5"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (160 commits)
  RDMA/ucma: Allow path records to exactly fit the output buffer
  RDMA/uverbs: Guard legacy bundles without method_elm
  RDMA/efa: Add support for 128B admin v2 SQ entry
  RDMA/efa: Generalize the admin SQ
  RDMA/efa: Decouple admin command payload from admin header
  RDMA/rxe: Fix OOB in free_rd_atomic_resources()
  RDMA/cma: Fix WARNING in res_to_rt
  RDMA/cxgb4: Free debugfs on registration failure
  RDMA/cxgb4: Cancel reg_work before freeing device on remove
  RDMA/ucma: Lock the handler in ucma_set_ib_path()
  RDMA/ucma: Lock the handler in ucma_write_cm_event()
  RDMA/erdma: restrict the driver to little-endian systems
  RDMA/ionic: Embed counter driver data in rdma_counter allocation
  RDMA/ionic: Cap eq_count to the eth driver's interrupt vector budget
  RDMA/siw: Fix use-after-free in siw_accept()
  IB/isert: post the full-feature receive buffers after session registration
  IB/isert: delay the final Login Response until the session is registered
  RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ
  RDMA/erdma: Hold QP references for AE and CM processing
  RDMA/erdma: Hold CQ references when processing EQ events
  ...
2026-08-21 11:48:54 -07:00
Linus Torvalds
ed3b875bea mm.git review status for mm-hotfixes-stable..mm-stable
Everything:
 
 Total patches:       501
 Reviews/patch:       1.66
 Reviewed rate:       70%
 
 Excluding DAMON:
 
 Total patches:       356
 Reviews/patch:       2.26
 Reviewed rate:       90%
 
 Excluding DAMON and selftests:
 
 Total patches:       329
 Reviews/patch:       2.31
 Reviewed rate:       92%
 
 Excluding DAMON, selftests and maple_tree:
 
 Total patches:       328
 Reviews/patch:       2.31
 Reviewed rate:       92%
 
 Summary of patch series in this merge:
 
 - The 2 patch series "mm: drop "sub" prefix from various places" from
   Dev Jain implements some page->folio conversion and a naming cleanup.
 
 - The 2 patch series "mm/kasan: remove redundant initialization for
   kasan_flag_write_only" from Igor Putko provides some KASAN cleanup work.
 
 - The 2 patch series "mm/filemap: reduce unnecessary xarray lookups"
   from Chi Zhiling provides a small speedup in the pagecaache read code.
 
 - The 4 patch series "mm/percpu: Fix possible NOFS/NOIO reclaim
   recursion" from Kaitao Cheng improves a few things in the vmalloc code -
   mainly the avoidance of GFP_KERNEL allocations when the caller asked for
   GFP_NOFS or GFP_NOIO.
 
 - The 3 patch series "mm/kmemleak: avoid soft lockup when scanning task
   stacks" from Breno Leitao avoids a soft lockup watchdog trigger from the
   kmemleak scanning code in extreme situations.
 
 - The 6 patch series "mm/page_owner: misc cleanups" from Ye Liu is a
   collection of unrelated cleanups to the page_owner code.  For some
   reason lots of people have been working on the page_owner code this
   cycle.
 
 - The 4 patch series "mm: convert to walk_page_range_vma() to eliminate
   find_vma()" from Kefeng Wang simplifies and accelerates the page walking
   library function.
 
 - The 3 patch series "mm/migrate: preparatory cleanups for batch copy
   and offload" from Shivank Garg implements cleanups in the migration
   code.
 
 - The 4 patch series "mm/page_owner: add per-fd filter infrastructure
   for print_mode and NUMA filtering" from Zhen Ni provides per-fd
   filtering to page_owner in order to reduce the sometimes vast amount of
   output it can produce.
 
 - The 19 patch series "mm: Refactor bootmem gigantic hugepage
   allocation" from Muchun Song is a "set of fixes and preparatory cleanups
   around bootmem HugeTLB handling, sparse initialization ordering, and
   related vmemmap setup".
 
 - The 4 patch series "mm/zsmalloc: reduce lock contention in zs_free()"
   from Wenchao Hao reduces lock contention in zs_free(), which dominates
   the unmap path under memory pressure on Android (LMK kills) and on x86
   servers running zswap-heavy workloads.  Up to 1.83x improvement in
   microbenchmarking.
 
 - The 2 patch series "move alloc_tag.c file under mm/" from Suren
   Baghdasaryan does that.
 
 - The 6 patch series "samples/damon: handle damon_{start,stop}()
   failures" from SJ Park fixes improper handling of damon_start(),
   damon_stop(), and damon_call() failures across DAMON sample modules to
   prevent potential memory leaks, operation disruptions and use-after-free
   bugs.
 
 - The 11 patch series "mm/damon/sysfs: kobject_del() directories that
   users can create/remove" from SJ Park resolves an issue where delayed
   sysfs directory removal under CONFIG_DEBUG_KOBJECT_RELEASE causes
   creation failures due to duplicate directory names by adding missing
   kobject_del() calls before creating new directories.
 
 - The 3 patch series "mm: cleanup clear_not_present_full_ptes()" from
   David Hildenbrand cleans up the core pte handling code.
 
 - The 3 patch series "selftests/damon: misc fixes for test bugs" from
   Kunwu Chan fixes several bugs in the DAMON selftests.
 
 - The 2 patch series "selftests/damon: fix memcg_path staging handling"
   from Cheng Nie fixes a bug in _damon_sysfs.py for damos_filter
   memcg_path setup, and adds a test case for it in sysfs.py.
 
 - The 2 patch series "selftests/damon: test kdamond refresh_ms" from
   Ruslan Valiyev introduces selftest coverage for DAMON's refresh_ms sysfs
   feature by updating the test control module and verifying that scheme
   stats update automatically without manual intervention.
 
 - The 5 patch series "mm/damon: five misc fixups" from Akinobu Mita
   contains miscellaneous DAMON fixups.
 
 - The 2 patch series "mm/damon/core: detect internal variation above
   max_nr_regions/2" from Jiayuan Chen fixes DAMON's region splitting
   behavior when region counts exceed half the maximum budget by
   dynamically scaling down the split fraction as the limit approaches,
   preventing large regions from staying un-split, and adds corresponding
   KUnit test coverage.
 
 - The 6 patch series "mm: preparatory patches for PMD level swap
   entries" from Usama Arif refactors and cleans up PMD softleaf helpers,
   call sites, and architecture flags to lay the groundwork for a follow-up
   series that introduces PMD page table swap entries.
 
 - The 11 patch series "mm/damon: update, optimize, and clean up doc,
   tests, and code" from SJ Park updates DAMON design and ABI
   documentation, expands unit and selftest coverage, optimizes
   damon_commit_target_regions(), and cleans up recently added sysfs
   interface code for better readability.
 
 - The 2 patch series "mm/vmpressure: reduce CPU, memory and code
   overhead on cgroup v2" from Usama Arif optimizes vmpressure() by
   skipping unnecessary work on cgroup v2 for userspace event notifications
   and refactors v1-only eventfd handling into mm/memcontrol-v1.c to reduce
   memory overhead and code complexity.
 
 - The 10 patch series "selftests/mm: refactor pkey helpers and fix mmap
   error handling" from Hongfu Li refactors pkeys shared tracing and
   assertion helpers into a common file, unifies protection key selftests
   to use consistent diagnostic logging and assertions, and enforces
   standardized MAP_FAILED return checks for mmap() calls across the tests.
 
 - The 18 patch series "mm/damon: optimize out nr_accesses_bp" from SJ
   Park replaces the error-prone, continuously updated nr_accesses_bp field
   in damon_region with an on-demand moving sum function
   (damon_nr_accesses_mvsum()), reducing structure memory overhead and
   avoiding state corruption bugs.
 
 - The 6 patch series "Open HugeTLB allocation routine for more generic
   use" from Ackerley Tng decouples HugeTLB folio allocation from VMA
   dependencies by introducing hugetlb_alloc_folio(), enabling subsystems
   like guest_memfd to allocate HugeTLB folios without standard VMA
   reservations or pseudo-VMAs.
 
 - The 3 patch series "mm/damon: provide pseudo moving sum probe_hits"
   from SJ Park integrates DAMON's probe_hits attribute counter into the
   pseudo moving sum infrastructure, enabling real-time, online monitoring
   without waiting for full aggregation intervals.
 
 - The 18 patch series "mm: Some cleanups for page allocator APIs" from
   Brendan Jackman simplifies and refactors the page allocator entry points
   and flags by unifying allocation paths, adding internal alloc_flags
   arguments, and eliminating redundant __ prefixed alloc_pages variants.
 
 - The 5 patch series "Fix incorrect access of hugetlb pte entries" from
   Dev Jain enforces the consistent use of huge_ptep_get() instead of
   ptep_get() for HugeTLB entries and fixes an unaligned address issue in
   arm64's huge_ptep_get() implementation.
 
 - The 8 patch series "mm/damon: validate all parameters in the core"
   from SJ Park consolidates parameter validation into the DAMON core
   specifically within damon_start() and damon_commit_ctx() to centralize
   error checking, eliminate caller-side redundant checks and to improve
   maintenance efficiency.
 
 - The 3 patch series "tools/mm/page_owner_sort: fix filtering and
   cleanup issues" from Yichong Chen renames is_need() to filter_record()
   for clearer return semantics, fixes per-record allocation memory leaks
   and bounds output copies in search_pattern() to address an existing
   buffer issue.
 
 - The 4 patch series "memcg: bail out reclaim when memcg is dying" from
   Jiayuan Chen mitigates a system-wide stall which occurs when a cgroup is
   removed while one of its memory control files is doing synchronous
   reclaim.
 
 - The 5 patch series "mm/memory-failure: add panic option for
   unrecoverable pages" from Breno Leitao introduces an opt-in
   vm.panic_on_unrecoverable_memory_failure sysctl that immediately panics
   the kernel on unrecoverable memory errors in kernel-owned pages to
   preserve error context and prevent delayed, silent data corruption.
 
 - The 11 patch series "mm/damon: refactor damon_{start,stop,commit}()
   for simple error handling" from SJ Park refactors the DAMON core API
   functions to guarantee that all contexts are fully stopped when
   damon_start(), damon_stop(), or damon_commit() fail, eliminating the
   need for complex and error-prone caller-side cleanup code.
 
 - The 5 patch series "Keep tail page private zero at free and folio
   split" from Zi Yan adds checks to ensure tail_page->private is zero when
   freeing compound or high-order pages and when promoting tail pages
   during large folio splits.  By validating these fields at free and split
   time, it allows the removal of redundant private field clearing inside
   prep_compound_tail().
 
 - The 4 patch series "mm: drop redundant lru_add_drain in anon folio
   reuse paths" from Barry Song eliminates redundant lru_add_drain() calls
   in wp_can_reuse_anon_folio() and do_swap_page() to reduce LRU lock
   contention and system overhead.
 
   By validating folio refcounts against the LRU cache before draining
   and removing unnecessary drains in the swap path, it achieves up to a
   30.5% reduction in drain calls during heavy swap workloads.
 
 - The 3 patch series "mm: clean up folio LRU and swap declarations" from
   Jianyue Wu reorganizes folio LRU and swap code by relocating
   page-cluster state to mm/swap_state.c, renaming mm/swap.c to mm/folio.c,
   and moving MM-internal reclaim declarations into mm/internal.h.
 
 - The 15 patch series "userfaultfd: working set tracking for VM guest
   memory" from Kiryl Shutsemau adds userfaultfd support for tracking the
   working set of VM guest memory, so a VMM can identify hot pages and
   reclaim cold ones to tiered or remote storage.
 
 - The 10 patch series "mm: remove CONFIG_HAVE_BOOTMEM_INFO_NODE (Part
   2)" from David Hildenbrand removes the remaining pieces of
   CONFIG_HAVE_BOOTMEM_INFO_NODE, performing some smaller cleanups around
   freeing of reserved vmemmap pages on the way.
 
 - The 7 patch series "mm/damon: update probe hits for runtime parameter
   commits" from SJ Park ensures that DAMON's probe_hits attribute counter
   is properly updated when monitoring intervals are changed at runtime,
   matching the behavior of nr_accesses.  To achieve this, it refactors and
   renames existing helper functions for shared use, applies the updates to
   probe_hits, and handles edge cases in damon_probe_hits_mvsum() to
   maintain measurement accuracy.
 
 - The 3 patch series "KSM: performance optimizations for rmap_walk_ksm"
   from xu xin resolves a severe KSM reverse-mapping performance bottleneck
   where thousands of split VMAs sharing a single anon_vma cause extended
   lock contention.  By adding an interval-filtering check during the rmap
   walk, it reduces worst-case anon_vma lock hold times from over 500ms
   down to under 2ms, preventing application freezes and latency spikes
   under memory pressure.
 
 - The 3 patch series "mm: split a couple of headers from internal.h"
   from Mike Rapoport splits declarations related to mm_init, memblock,
   vmalloc and sparse into new headers.
 
 - The 2 patch series "KSM: use linear_page_index in collect_procs_ksm()"
   from xu xin applies the interval tree optimization from rmap_walk_ksm()
   to collect_procs_ksm() to avoid iterating over non-matching VMAs during
   KSM memory error handling.  It hoists loop-invariant address
   initialization and restricts the anon_vma_interval_tree_foreach walk to
   a targeted page offset range, reducing redundant checks and improving
   lookup efficiency.
 
 - The 3 patch series "selftests/mm: avoid false failures in hugetlb and
   KSM tests" from Sayali Patil fixes issues in the hugetlb and KSM MM
   selftest categories that can report failures when the prerequisites for
   the tests are not satisfied.
 
 - The 19 patch series "mm/damon: introduce data attributes only
   monitoring" from SJ Park introduces attribute-weighted region management
   in DAMON, allowing users to prioritize specific data attributes (such as
   page sizes or cgroups) over or instead of access monitoring.
 
   By assigning weights to attribute probes, DAMON can completely disable
   access tracking and adjust monitoring regions based on weighted
   probe-hit counters to optimize monitoring quality for attribute-focused
   workloads.
 
 - The 8 patch series "mm/hmm: Add mmap lock-drop support for
   userfaultfd-backed mappings" from Stanislav Kinsburskii extends
   hmm_range_fault() to support userfaultfd-backed regions by allowing the
   mmap lock to be dropped during fault handling via a new
   hmm_range_fault_locked() helper.
 
   By accepting a locked pointer and signaling retry status when lock
   release occurs, it enables page fault resolution in userfaultfd regions
   while preserving backward compatibility for existing callers.
 
 - The 33 patch series "mm: make VMA page offset handling more
   consistent" from Lorenzo Stoakes cleans up and standardizes how
   vma->vm_pgoff is accessed and manipulated across file-backed and
   anonymous mappings in the kernel.
 
   It introduces dedicated helper functions such as vma_start_pgoff(),
   vma_end_pgoff(), vma_set_pgoff() and linear_page_delta() while renaming
   rmap interval tree helpers to better reflect their functionality.
 
   These changes establish a cleaner foundation for future work that will
   unify virtual page offset indexing for all anonymous and CoW'd folios.
 
 - The 3 patch series "mm: handle device-private PMDs in walk callbacks"
   from Usama Arif addresses kernel panics and state corruption caused by
   MM walk callbacks reaching non-present device-private PMD swap entries
   created during HMM migrations.
 
   It ensures that functions which acquire pmd_trans_huge_lock() properly
   recognize device-private PMDs instead of assuming a present THP or a
   standard migration entry.
 
 - The 5 patch series "mm/rmap: Refactor try_to_unmap_one" from Dev Jain
   refactors try_to_unmap_one by modularizing Hugetlb, anonymous-lazyfree,
   and anonymous-swapbacked logic into dedicated functions, laying the
   structural groundwork for batched anonymous large folio unmapping.
 
 - The 4 patch series "Docs/ABI/damon: sysfs ABI document fixes and
   additions" from Song Hu fixes typos and fills in missing entries in the
   DAMON sysfs ABI document.
 
 - The 10 patch series "dax/kmem: atomic whole-device hotplug via sysfs"
   from Gregory Price introduces an atomic sysfs state attribute and
   supporting DAX/MM infrastructure to prevent userland races when
   offlining and removing entire memory regions.
 
   By adding an unplugged state alongside standard online modes, it
   enables whole-device atomic hotplug control while preserving backward
   compatibility.
 
 - The 13 patch series "mm: convert more vm_flags_t users to vma_flags_t"
   from Lorenzo Stoakes continues transitioning the kernel from the
   deprecated vm_flags_t type to vma_flags_t across core memory management
   infrastructure.
 
   It replaces legacy type usage in core functions such as do_mmap(),
   unmapped area allocation, mm->def_vma_flags, and VMA operations like
   mlock, mprotect, and mremap.
 
 - The 2 patch series "Two small patches to clean up mm/mm_slot.h" from
   xu xin refactors mm_slot.h by introducing mm_slot_remove() to unify
   duplicate slot deletion sequences in khugepaged and KSM.  It also adds
   code documentation explaining why mm_slot_lookup and mm_slot_insert must
   remain as preprocessor macros rather than static inline functions.
 
 - The 10 patch series "mm/damon/core: hide core-private struct fields"
   from SJ Park cleans up DAMON core structures by consistently marking
   internal-only fields with private: comment tags to prevent improper
   direct access from outer layers.
 
   It enforces encapsulation across core structures including
   damon_region, damon_target, and damon_ctx and updates DAMON_SYSFS to
   interact through approved access APIs instead of exposing raw struct
   members.
 
 - The 6 patch series "mm/damon: unurgent fixes for infinite loop, NULL
   de-ref and races" from SJ Park addresses potential infinite loops, NULL
   dereferences, and race conditions identified in DAMON.
 
   It fixes an infinite loop triggered by extreme user configurations, a
   NULL pointer dereference within unit tests and minor monitoring
   accuracy degradation caused by subtle runtime races.
 
 - The 2 patch series "mm/page_alloc: fixes for free_pages_nolock() on
   RT/UP" from Brendan Jackman fixes an NMI safety flaw in
   __free_frozen_pages() where freeing pages on non-SMP or PREEMPT_RT
   kernels can bypass can_spin_trylock() checks via non-PCP or isolated
   migration paths.
 
   It also resolves potential kernel crashes and privilege escalation
   risks triggered when BPF tracing runs in NMI context alongside memory
   hotplug or large allocation frees.
 
 - The 4 patch series "mm/page_alloc: couple of followups for recent
   cleanups" from Brendan Jackman cleans up and updates page allocator
   nomenclature, documentation, and debug assertions.
 
   It aligns internal FPI_ flags with the public "nolock" naming
   convention, removes outdated internal implementation details from
   high-level page allocator comments, and eliminates obsolete VM_BUG_ON()
   assertions in allocation paths.
 
 - The 3 patch series "mm/mseal: further cleanups" from Lorenzo Stoakes
   refactors and simplifies the mseal implementation by clarifying API
   boundaries and removing unnecessary code complexity.
 
   It replaces generic do_mseal() usage outside the syscall with a
   dedicated mseal_mmap_page_zero() helper for MMAP_PAGE_ZERO, eliminates
   mm_struct parameters to enforce that sealing applies only to
   current->mm, and streamlines overall logic and comments with no
   functional changes intended.
 
 - The 4 patch series "mm/vmscan: fix swappiness=max and clean up
   per-node proactive reclaim" from Ridong Chen resolves reclaim behavior
   bugs and cleans up function parameters across memory reclaim paths.
 
   It fixes swappiness=max in both standard reclaim and MGLRU so
   unswappable anonymous memory no longer falls back to evicting page
   cache, ensures reclaim_store() returns accurate error codes instead of
   collapsing all failures into -EAGAIN, and removes the obsolete gfp_mask
   parameter from __node_reclaim().
 
 - The 6 patch series "mm: mincore: misc cleanups" from Kefeng Wang
   cleans up and simplifies the mincore code.  Most importantly, it removes
   the historical special behavior that always reports VM_PFNMAP pages as
   non-resident.
 
 - The 2 patch series "mm/huge_memory: drop dead split helper variants"
   from Kiryl Shutsemau implements two trivial cleanups in the folio split
   API.
 
 - The 7 patch series "mm/damon: fix uninitialized DAMOS field and kunit
   exec expectation bugs" from SJ Park resolves minor operational and
   testing bugs in DAMON identified by Sashiko.  It initializes the
   damos->last_applied field to prevent occasional efficiency degradation
   and fixes invalid memory accesses in DAMON KUnit tests during test
   failure handling.
 
 - The 3 patch series "cleanup for stable_page_flags()" from Jinjiang Tu
   cleans up and refactors stable_page_flags() used by /proc/kpageflags
   without altering functionality.
 
   It uses BIT_ULL() to prevent shift-overflow warnings on 64-bit flag
   bits, converts folio-specific flag checks to standard folio_test_*()
   helpers, and removes redundant CONFIG_PAGE_IDLE_FLAG handling.
 
 - The 3 patch series "Batch unmap of uffd-wp file folios" from Dev Jain
   extends batched folio unmapping support to file folios within
   userfaultfd write-protect (uffd-wp) VMAs by adding batching capabilities
   to pte_install_uffd_wp_if_needed().
 
   This removes special-case restrictions on uffd-wp VMAs in
   try_to_unmap_one(), significantly simplifying the function's control
   flow and complexity.
 
 - The 3 patch series "mm/early_ioremap: clarify and clean up
   early_ioremap_reset()" from Sang-Heon Jeon clarifies and cleans up the
   architecture-specific usage of __late_set_fixmap() and
   __late_clear_fixmap() after early_ioremap_reset().
 
   It adds explicit documentation regarding when early_ioremap_reset()
   must be called and removes redundant macro definitions and reset calls
   in the RISC-V and ARM64 architectures.
 
 - The 4 patch series "mm: fix reclaim storms in defrag_mode" from
   Johannes Weiner addresses severe performance regressions, swap storms,
   and spurious OOMs caused by vm.defrag_mode=1 under high memory pressure
   in Meta production.
 
   It updates the page allocator slowpath so non-movable allocation
   requests actively trigger direct reclaim and direct compaction at
   pageblock_order scale, allowing them to claim whole pageblocks rather
   than spinning unproductively.
 
 - The 2 patch series "zram: lockmap tweaks" from Sebastian Siewior
   optimizes and fixes lockdep tracking for zram devices by consolidating
   per-entry lockmaps and isolating lock classes across multiple instances.
 
   It reduces memory overhead by replacing per-entry lockdep_map instances
   with a single map per struct zram, and assigns a dynamic lock_class_key
   to each instance to prevent false deadlock reports when different zram
   devices are backed by distinct filesystems.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCaoUJbQAKCRDdBJ7gKXxA
 jqrzAP9WoPU0hiK4qS/kSjhtoZxhjpS5eLSUCy/utKuEvZbfGgEAu1zA+LH+X9Tm
 THK5ex4iUZxiFbXpWfLMxE/Q9PmQYQ8=
 =QTyb
 -----END PGP SIGNATURE-----

Merge tag 'mm-stable-2026-08-18-18-39' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Pull MM updates from Andrew Morton:

 - "mm: drop "sub" prefix from various places" (Dev Jain)

   page->folio conversion and a naming cleanup

 - "mm/kasan: remove redundant initialization for kasan_flag_write_only"
   (Igor Putko)

   KASAN cleanup work

 - "mm/filemap: reduce unnecessary xarray lookups" (Chi Zhiling)

   Small speedup in the pagecaache read code

 - "mm/percpu: Fix possible NOFS/NOIO reclaim recursion" (Kaitao Cheng)

   Improve the vmalloc code - mainly the avoidance of GFP_KERNEL
   allocations when the caller asked for GFP_NOFS or GFP_NOIO

 - "mm/kmemleak: avoid soft lockup when scanning task stacks" (Breno
   Leitao)

   Avoid a soft lockup watchdog trigger from the kmemleak scanning code
   in extreme situations

 - "mm/page_owner: misc cleanups" (Ye Liu)

   Cleanups to the page_owner code. For some reason lots of people have
   been working on the page_owner code this cycle.

 - "mm: convert to walk_page_range_vma() to eliminate find_vma()"
   (Kefeng Wang)

   Simplify and accelerate the page walking library function

 - "mm/migrate: preparatory cleanups for batch copy and offload"
   (Shivank Garg)

   Cleanups in the migration code

 - "mm/page_owner: add per-fd filter infrastructure for print_mode and
   NUMA filtering" (Zhen Ni)

   Per-fd filtering to page_owner in order to reduce the sometimes vast
   amount of output it can produce

 - "mm: Refactor bootmem gigantic hugepage allocation" (Muchun Song)

   Fixes and preparatory cleanups around bootmem HugeTLB handling,
   sparse initialization ordering, and related vmemmap setup

 - "mm/zsmalloc: reduce lock contention in zs_free()" (Wenchao Hao)

   Reduce lock contention in zs_free(), which dominates the unmap path
   under memory pressure on Android (LMK kills) and on x86 servers
   running zswap-heavy workloads.

   Up to 1.83x improvement in microbenchmarking.

 - "move alloc_tag.c file under mm/" (Suren Baghdasaryan)

 - "samples/damon: handle damon_{start,stop}() failures" (SJ Park)

   Fix improper handling of damon_start(), damon_stop(), and
   damon_call() failures across DAMON sample modules to prevent
   potential memory leaks, operation disruptions and use-after-free
   bugs

 - "mm/damon/sysfs: kobject_del() directories that users can
   create/remove" (SJ Park)

   Fix delayed sysfs directory removal under DEBUG_KOBJECT_RELEASE
   causeing creation failures due to duplicate directory names by adding
   missing kobject_del() calls before creating new directories

 - "mm: cleanup clear_not_present_full_ptes()" (David Hildenbrand)

   Clean up the core pte handling code

 - "selftests/damon: misc fixes for test bugs" (Kunwu Chan)

   Fix several bugs in the DAMON selftests

 - "selftests/damon: fix memcg_path staging handling" (Cheng Nie)

   Fix a bug in _damon_sysfs.py for damos_filter memcg_path setup, and
   add a test case for it in sysfs.py.

 - "selftests/damon: test kdamond refresh_ms" (Ruslan Valiyev)

   Selftest coverage for DAMON's refresh_ms sysfs feature by updating
   the test control module and verifying that scheme stats update
   automatically without manual intervention

 - "mm/damon: five misc fixups" (Akinobu Mita)

   Miscellaneous DAMON fixups.

 - "mm/damon/core: detect internal variation above max_nr_regions/2"
   (Jiayuan Chen)

   Fix DAMON's region splitting behavior when region counts exceed half
   the maximum budget by dynamically scaling down the split fraction as
   the limit approaches, preventing large regions from staying un-split,
   and add corresponding KUnit test coverage

 - "mm: preparatory patches for PMD level swap entries" (Usama Arif)

   Refactor and clean up PMD softleaf helpers, call sites, and
   architecture flags to lay the groundwork for a follow-up series that
   introduces PMD page table swap entries

 - "mm/damon: update, optimize, and clean up doc, tests, and code" (SJ
   Park)

   Update DAMON design and ABI documentation, expands unit and selftest
   coverage, optimize damon_commit_target_regions(), and clean up
   recently added sysfs interface code for better readability

 - "mm/vmpressure: reduce CPU, memory and code overhead on cgroup v2"
   (Usama Arif)

   Optimize vmpressure() by skipping unnecessary work on cgroup v2 for
   userspace event notifications and refactor v1-only eventfd handling
   into mm/memcontrol-v1.c to reduce memory overhead and code complexity

 - "selftests/mm: refactor pkey helpers and fix mmap error handling"
   (Hongfu Li)

   Refactor pkeys shared tracing and assertion helpers into a common
   file, unify protection key selftests to use consistent diagnostic
   logging and assertions, and enforce standardized MAP_FAILED return
   checks for mmap() calls across the tests

 - "mm/damon: optimize out nr_accesses_bp" (SJ Park)

   Replace the error-prone, continuously updated nr_accesses_bp field in
   damon_region with an on-demand moving sum function, reducing
   structure memory overhead and avoiding state corruption bugs

 - "Open HugeTLB allocation routine for more generic use" (Ackerley Tng)

   Decouple HugeTLB folio allocation from VMA dependencies by
   introducing hugetlb_alloc_folio(), enabling subsystems like
   guest_memfd to allocate HugeTLB folios without standard VMA
   reservations or pseudo-VMAs

 - "mm/damon: provide pseudo moving sum probe_hits" (SJ Park)

   Integrate DAMON's probe_hits attribute counter into the pseudo moving
   sum infrastructure, enabling real-time, online monitoring without
   waiting for full aggregation intervals

 - "mm: Some cleanups for page allocator APIs" (Brendan Jackman)

   Simplify and refactor the page allocator entry points and flags by
   unifying allocation paths, adding internal alloc_flags arguments, and
   eliminating redundant __ prefixed alloc_pages variants.

 - "Fix incorrect access of hugetlb pte entries" (Dev Jain)

   Enforce the consistent use of huge_ptep_get() instead of ptep_get()
   for HugeTLB entries and fixes an unaligned address issue in arm64's
   huge_ptep_get() implementation

 - "mm/damon: validate all parameters in the core" (SJ Park)

   Consolidate parameter validation into the DAMON core specifically
   within damon_start() and damon_commit_ctx() to centralize error
   checking, eliminate caller-side redundant checks and to improve
   maintenance efficiency

 - "tools/mm/page_owner_sort: fix filtering and cleanup issues" (Yichong
   Chen)

   Rename is_need() to filter_record() for clearer return semantics, fix
   per-record allocation memory leaks and bound output copies in
   search_pattern() to address an existing buffer issue

 - "memcg: bail out reclaim when memcg is dying" (Jiayuan Chen)

   Mitigate a system-wide stall which occurs when a cgroup is removed
   while one of its memory control files is doing synchronous reclaim

 - "mm/memory-failure: add panic option for unrecoverable pages" (Breno
   Leitao)

   Introduce an opt-in vm.panic_on_unrecoverable_memory_failure sysctl
   that immediately panics the kernel on unrecoverable memory errors in
   kernel-owned pages to preserve error context and prevent delayed,
   silent data corruption

 - "mm/damon: refactor damon_{start,stop,commit}() for simple error
   handling" (SJ Park)

   Refactor the DAMON core API functions to guarantee that all contexts
   are fully stopped when damon_start(), damon_stop(), or damon_commit()
   fail, eliminating the need for complex and error-prone caller-side
   cleanup code

 - "Keep tail page private zero at free and folio split" (Zi Yan)

   Add checks to ensure tail_page->private is zero when freeing compound
   or high-order pages and when promoting tail pages during large folio
   splits. By validating these fields at free and split time, it allows
   the removal of redundant private field clearing inside
   prep_compound_tail()

 - "mm: drop redundant lru_add_drain in anon folio reuse paths" (Barry
   Song)

   Eliminate redundant lru_add_drain() calls in
   wp_can_reuse_anon_folio() and do_swap_page() to reduce LRU lock
   contention and system overhead

   By validating folio refcounts against the LRU cache before draining
   and removing unnecessary drains in the swap path, it achieves up to a
   30.5% reduction in drain calls during heavy swap workloads

 - "mm: clean up folio LRU and swap declarations" (Jianyue Wu)

   Reorganize folio LRU and swap code by relocating page-cluster state
   to mm/swap_state.c, renaming mm/swap.c to mm/folio.c, and moving
   MM-internal reclaim declarations into mm/internal.h.

 - "userfaultfd: working set tracking for VM guest memory" (Kiryl
   Shutsemau)

   Add userfaultfd support for tracking the working set of VM guest
   memory, so a VMM can identify hot pages and reclaim cold ones to
   tiered or remote storage

 - "mm: remove CONFIG_HAVE_BOOTMEM_INFO_NODE (Part 2)" (David
   Hildenbrand)

   Remove the remaining pieces of CONFIG_HAVE_BOOTMEM_INFO_NODE,
   performing some smaller cleanups around freeing of reserved vmemmap
   pages on the way.

 - "mm/damon: update probe hits for runtime parameter commits" (SJ Park)

   Ensure that DAMON's probe_hits attribute counter is properly updated
   when monitoring intervals are changed at runtime, matching the
   behavior of nr_accesses. To achieve this, it refactors and renames
   existing helper functions for shared use, applies the updates to
   probe_hits, and handles edge cases in damon_probe_hits_mvsum() to
   maintain measurement accuracy.

 - "KSM: performance optimizations for rmap_walk_ksm" (xu xin)

   Resolve a severe KSM reverse-mapping performance bottleneck where
   thousands of split VMAs sharing a single anon_vma cause extended lock
   contention.

   By adding an interval-filtering check during the rmap walk, it
   reduces worst-case anon_vma lock hold times from over 500ms down to
   under 2ms, preventing application freezes and latency spikes under
   memory pressure.

 - "mm: split a couple of headers from internal.h" (Mike Rapoport)

   Split declarations related to mm_init, memblock, vmalloc and sparse
   into new headers

 - "KSM: use linear_page_index in collect_procs_ksm()" (xu xin)

   Apply the interval tree optimization from rmap_walk_ksm() to
   collect_procs_ksm() to avoid iterating over non-matching VMAs during
   KSM memory error handling.

   It hoists loop-invariant address initialization and restricts the
   anon_vma_interval_tree_foreach walk to a targeted page offset range,
   reducing redundant checks and improving lookup efficiency.

 - "selftests/mm: avoid false failures in hugetlb and KSM tests" (Sayali
   Patil)

   Fix issues in the hugetlb and KSM MM selftest categories that can
   report failures when the prerequisites for the tests are not
   satisfied

 - "mm/damon: introduce data attributes only monitoring" (SJ Park)

   Introduce attribute-weighted region management in DAMON, allowing
   users to prioritize specific data attributes (such as page sizes or
   cgroups) over or instead of access monitoring.

   By assigning weights to attribute probes, DAMON can completely
   disable access tracking and adjust monitoring regions based on
   weighted probe-hit counters to optimize monitoring quality for
   attribute-focused workloads.

 - "mm/hmm: Add mmap lock-drop support for userfaultfd-backed mappings"
   (Stanislav Kinsburskii)

   Extend hmm_range_fault() to support userfaultfd-backed regions by
   allowing the mmap lock to be dropped during fault handling via a new
   hmm_range_fault_locked() helper.

   By accepting a locked pointer and signaling retry status when lock
   release occurs, it enables page fault resolution in userfaultfd
   regions while preserving backward compatibility for existing callers.

 - "mm: make VMA page offset handling more consistent" (Lorenzo Stoakes)

   Clean up and standardize how vma->vm_pgoff is accessed and
   manipulated across file-backed and anonymous mappings in the kernel

   It introduces dedicated helper functions such as vma_start_pgoff(),
   vma_end_pgoff(), vma_set_pgoff() and linear_page_delta() while
   renaming rmap interval tree helpers to better reflect their
   functionality.

   These changes establish a cleaner foundation for future work that
   will unify virtual page offset indexing for all anonymous and CoW'd
   folios.

 - "mm: handle device-private PMDs in walk callbacks" (Usama Arif)

   Address kernel panics and state corruption caused by MM walk
   callbacks reaching non-present device-private PMD swap entries
   created during HMM migrations

   It ensures that functions which acquire pmd_trans_huge_lock()
   properly recognize device-private PMDs instead of assuming a present
   THP or a standard migration entry.

 - "mm/rmap: Refactor try_to_unmap_one" (Dev Jain)

   Refactor try_to_unmap_one by modularizing Hugetlb,
   anonymous-lazyfree, and anonymous-swapbacked logic into dedicated
   functions, laying the structural groundwork for batched anonymous
   large folio unmapping.

 - "Docs/ABI/damon: sysfs ABI document fixes and additions" (Song Hu)

   Fix typos and fills in missing entries in the DAMON sysfs ABI
   document

 - "dax/kmem: atomic whole-device hotplug via sysfs" (Gregory Price)

   Introduce an atomic sysfs state attribute and supporting DAX/MM
   infrastructure to prevent userland races when offlining and removing
   entire memory regions

   By adding an unplugged state alongside standard online modes, it
   enables whole-device atomic hotplug control while preserving backward
   compatibility.

 - "mm: convert more vm_flags_t users to vma_flags_t" (Lorenzo Stoakes)

   Continue transitioning the kernel from the deprecated vm_flags_t type
   to vma_flags_t across core memory management infrastructure.

   It replaces legacy type usage in core functions such as do_mmap(),
   unmapped area allocation, mm->def_vma_flags, and VMA operations like
   mlock, mprotect, and mremap.

 - "Two small patches to clean up mm/mm_slot.h" (xu xin)

   Refactor mm_slot.h by introducing mm_slot_remove() to unify duplicate
   slot deletion sequences in khugepaged and KSM. It also adds code
   documentation explaining why mm_slot_lookup and mm_slot_insert must
   remain as preprocessor macros rather than static inline functions.

 - "mm/damon/core: hide core-private struct fields" (SJ Park)

   Clean up DAMON core structures by consistently marking internal-only
   fields with private: comment tags to prevent improper direct access
   from outer layers.

   It enforces encapsulation across core structures including
   damon_region, damon_target, and damon_ctx and updates DAMON_SYSFS to
   interact through approved access APIs instead of exposing raw struct
   members.

 - "mm/damon: unurgent fixes for infinite loop, NULL de-ref and races"
   (SJ Park)

   Address potential infinite loops, NULL dereferences, and race
   conditions identified in DAMON

   It fixes an infinite loop triggered by extreme user configurations, a
   NULL pointer dereference within unit tests and minor monitoring
   accuracy degradation caused by subtle runtime races.

 - "mm/page_alloc: fixes for free_pages_nolock() on RT/UP" (Brendan
   Jackman)

   Fix an NMI safety flaw in __free_frozen_pages() where freeing pages
   on non-SMP or PREEMPT_RT kernels can bypass can_spin_trylock() checks
   via non-PCP or isolated migration paths.

   It also resolves potential kernel crashes and privilege escalation
   risks triggered when BPF tracing runs in NMI context alongside memory
   hotplug or large allocation frees.

 - "mm/page_alloc: couple of followups for recent cleanups" (Brendan
   Jackman)

   Clean up and update page allocator nomenclature, documentation, and
   debug assertions.

   It aligns internal FPI_ flags with the public "nolock" naming
   convention, removes outdated internal implementation details from
   high-level page allocator comments, and eliminates obsolete
   VM_BUG_ON() assertions in allocation paths.

 - "mm/mseal: further cleanups" (Lorenzo Stoakes)

   Refactor and simplify the mseal implementation by clarifying API
   boundaries and removing unnecessary code complexity.

   It replaces generic do_mseal() usage outside the syscall with a
   dedicated mseal_mmap_page_zero() helper for MMAP_PAGE_ZERO,
   eliminates mm_struct parameters to enforce that sealing applies only
   to current->mm, and streamlines overall logic and comments with no
   functional changes intended.

 - "mm/vmscan: fix swappiness=max and clean up per-node proactive
   reclaim" (Ridong Chen)

   Resolve reclaim behavior bugs and clean up function parameters across
   memory reclaim paths

   It fixes swappiness=max in both standard reclaim and MGLRU so
   unswappable anonymous memory no longer falls back to evicting page
   cache, ensures reclaim_store() returns accurate error codes instead
   of collapsing all failures into -EAGAIN, and removes the obsolete
   gfp_mask parameter from __node_reclaim().

 - "mm: mincore: misc cleanups" (Kefeng Wang)

   Clean up and simplifies the mincore code. Most importantly, it
   removes the historical special behavior that always reports VM_PFNMAP
   pages as non-resident.

 - "mm/huge_memory: drop dead split helper variants" (Kiryl Shutsemau)

   Two trivial cleanups in the folio split API

 - "mm/damon: fix uninitialized DAMOS field and kunit exec expectation
   bugs" (SJ Park)

   Resolve minor operational and testing bugs in DAMON identified by
   Sashiko. It initializes the damos->last_applied field to prevent
   occasional efficiency degradation and fixes invalid memory accesses
   in DAMON KUnit tests during test failure handling.

 - "cleanup for stable_page_flags()" (Jinjiang Tu)

   Clean up and refactor stable_page_flags() used by /proc/kpageflags
   without altering functionality.

   It uses BIT_ULL() to prevent shift-overflow warnings on 64-bit flag
   bits, converts folio-specific flag checks to standard folio_test_*()
   helpers, and removes redundant CONFIG_PAGE_IDLE_FLAG handling.

 - "Batch unmap of uffd-wp file folios" (Dev Jain)

   Extend batched folio unmapping support to file folios within
   userfaultfd write-protect (uffd-wp) VMAs by adding batching
   capabilities to pte_install_uffd_wp_if_needed().

   This removes special-case restrictions on uffd-wp VMAs in
   try_to_unmap_one(), significantly simplifying the function's control
   flow and complexity.

 - "mm/early_ioremap: clarify and clean up early_ioremap_reset()"
   (Sang-Heon Jeon)

   Clarify and clean up the architecture-specific usage of
   __late_set_fixmap() and __late_clear_fixmap() after
   early_ioremap_reset()

   It adds explicit documentation regarding when early_ioremap_reset()
   must be called and removes redundant macro definitions and reset
   calls in the RISC-V and ARM64 architectures.

 - "mm: fix reclaim storms in defrag_mode" (Johannes Weiner)

   Address severe performance regressions, swap storms, and spurious
   OOMs caused by vm.defrag_mode=1 under high memory pressure in Meta
   production

   It updates the page allocator slowpath so non-movable allocation
   requests actively trigger direct reclaim and direct compaction at
   pageblock_order scale, allowing them to claim whole pageblocks rather
   than spinning unproductively.

 - "zram: lockmap tweaks" (Sebastian Siewior)

   Optimize and fix lockdep tracking for zram devices by consolidating
   per-entry lockmaps and isolate lock classes across multiple instances

   This reduces memory overhead by replacing per-entry lockdep_map
   instances with a single map per struct zram, and assigns a dynamic
   lock_class_key to each instance to prevent false deadlock reports
   when different zram devices are backed by distinct filesystems.

* tag 'mm-stable-2026-08-18-18-39' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (501 commits)
  selftests/mm: thuge-gen: fix test_shmget() for PAGE_SIZE check
  selftests/mm: unpoison pages in memory-failure teardown
  mm/shmem: downgrade final i_blocks check in shmem_evict_inode() to pr_warn()
  mm/khugepaged: replace mutex_lock/mutex_unlock usage with guard macro
  mm/zsmalloc: fix release order of locks in zs_page_migrate()
  Documentation: zram: remove sections numbering
  ksm: stop iterating VMAs when ksm_test_exit returns true
  mm: fold userfaultfd_rwp() to false without CONFIG_ARCH_HAS_PTE_PROTNONE
  mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()
  zram: use a custom key for each zram object
  zram: move lockmap to be per-zram instead per table
  selftests/mm: fix gup_longterm EINVAL error message
  mm: page_alloc: fix non-movable reclaim storm in defrag_mode
  mm: page_alloc: move capture_control to the page allocator
  mm: compaction: support non-movable compaction for pageblock requests
  mm: page_alloc: __GFP_FS lockdep annotation for direct compaction
  hugetlb: evaluate subpool free state while locked
  mm/damon: remove trailing semicolons after function definitions
  mm/damon/ops-common: prevent migration fallback to non-target nodes
  mm/damon: update outdated comment about DAMOS filter handling
  ...
2026-08-20 18:17:08 -07:00
Linus Torvalds
7f063b2f17 vhost,vdpa,virtio: fixes, features
- transport v3 support in virtio-mmio
 - suspend support in vduse
 - fixes, cleanups all over the place
 
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 
 iQFDBAABCgAtFiEEXQn9CHHI+FuUyooNKB8NuNKNVGkFAmqF3YcPHG1zdEByZWRo
 YXQuY29tAAoJECgfDbjSjVRph3oH/RxUHWzRWDFhaDNLBz8ZIkwQlkX6+pkAxhEf
 zkiMCI/SRLi1R7mg74ARuFvR/3LWZCtB1JUdY4R49pZ5yjkzcxW3E8pNdoqxmbkv
 3S06idrDGzAPLTpjn/RnT9CLmPFjyD/0L2VDbH406VplNy4QFo8jI0IA8720f/2b
 JeV03jYr9hCSwZJKxPKnWnBKGHJ2F9TwdIim7heo4+kFPe60dkra8VwwQQ5XpYBa
 mAgRJwZ04y2pAyunRP7wYRQKEbyWn/3bBDUDP2rNNnzuSQMngXrlhKDYRjugxMia
 JDLQIE6TwEOB7hy7QhuPwfwAelDdjF/veMN038ejjXZyMaZNZmo=
 =ln0X
 -----END PGP SIGNATURE-----

Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost

Pull vhost,vdpa,virtio updates from Michael Tsirkin:

 - transport v3 support in virtio-mmio

 - suspend support in vduse

 - fixes, cleanups all over the place

* tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: (54 commits)
  vduse: Add suspend
  vduse: do not take rwsem at reset work flush
  vduse: add F_QUEUE_READY feature
  vduse: add VDUSE_SET_FEATURES ioctl
  vduse: add VDUSE_GET_FEATURES ioctl
  vduse: store control device pointer
  tools/virtio: Fix control typo in trace agent comment
  tools/virtio: Fix userspace typo in vringh test comment
  vhost: reject zero-size IOTLB INVALIDATE
  vdpa: Remove redundant dev_err()
  virtio_ring: fix infinite loop in virtnet_poll_cleantx when device is broken
  vdpa/mlx5: roll back MR update after VQ setup failure
  MAINTAINERS: remove Gabriel from LiteX and fw-cfg drivers
  virtio_mem: fix typo in comment
  vdpa/solidrun: fix typos in snet_ctrl comments
  virtio: fix article before virtio in dma-buf comment
  vhost: fix inaccurate kdoc in iotlb helpers
  virtio: rtc: time out alarm requests
  vdpa/mlx5: fix wrong MLX5_ADDR_OF struct type in alloc_inout()
  vdpa: octeon_ep: add missing MODULE_DEVICE_TABLE()
  ...
2026-08-20 17:07:50 -07:00
Linus Torvalds
a625b2a387 VFIO updates for v7.3-rc1
- Add nv_falcon vfio selftest driver.  The Falcon is a general-purpose
    microcontroller embedded within NVIDIA GPUs, presenting a relatively
    simple DMA programming interface.  This adds another selftest target
    for vfio-pci with real DMA transfers. (Rubin Du, Alex Williamson)
 
  - Add allocation assertion helpers to vfio selftests and use them to
    avoid variable length arrays and the compiler errors they generate.
    (Alex Mastro)
 
  - Fix use-after-free hazard where an init path error in MSI support
    leaves a stray pointer that can later be reused or double-freed.
    (Xiang Mei)
 
  - Fix previous refactor of PCI BAR mappings to honor non_mappable_bars
    flag, which otherwise generates a warning when trying to pci_iomap()
    a 256TiB BAR on ISM devices on s390. (Farhan Ali)
 
  - Add igb vfio selftest driver.  Like nv_falcon, this provides another
    target for DMA testing with vfio selftests, but importantly this
    driver supports both physical 82576 NICs and the emulation model in
    QEMU.  This therefore enables a vfio selftest vector with no physical
    hardware requirements. (Josh Hilke, Alex Williamson)
 
  - Mark selftest fixture objects __maybe_unused to accommodate builds
    with clang -Wunused-but-set-global. (David Matlack)
 
  - Add error recovery for vfio-pci devices on s390x.  This expands
    devices which expose the existing error eventfd and introduces a
    device feature for reporting firmware defined error state
    information to the user, allowing recovery through hypervisor
    channels. (Farhan Ali)
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEQvbATlQL0amee4qQI5ubbjuwiyIFAmqE1t4RHGFsZXhAc2hh
 emJvdC5vcmcACgkQI5ubbjuwiyJyRg//UQg1EnIu18XdTIMWwFDOIeeJBj+Vm/KK
 FzlS4Fsp2jw3qIXTX9KbxU+Bxx8TyHo9h7IhBYSPfaLAjoWLvCllu/HTScU1zumL
 +oXiiSLKcqX3q63c1i3U7/QJNgBeRf7CAnwaCXe6Sd57UL2JT+lcURJvEYYj9KRG
 yWlsnEnw0kKH4w1rujh3fRcDx31GJf6RmxCK4RqIDyMk7YRfVExD3AOm0GjBN+0N
 6YyW0/jF7cy0OgAr1DN5EZocyWJX70roWBSFPa2jO3q9UwDomexQDvH26x5VucDG
 6kK1qHHPcW2P5Rel3ggEzKEo3C9bjC1vCqHGT7Vf/5MZMtDekJ82L31jd8gxCodD
 q9dnNVXJAScQV38GrIG04FXzjyyB1dnUY6lm2wiZsEhsen2Eot1ZcWAVxHZ8zqdZ
 hE6mjA2fCgDC5OUrHj7KhGD1Ya4SZRs0qjuW32GLnv7BoGGaec4x6nLDJKdB4V+y
 n26NjoutQdhwj+LjgOZNXb9K3dVgayMvzzDgBV9z6i574R5/A9EjjmkeVUAnfie1
 UfW7uod3gCJq9Yzo58GnHLRR7jDZ0miXzq2iZ6SM8FpuHP52Eq0Q7GPs7PHs1coO
 xD0ONL6hJav3ZEZEJLtUhCSop7T7CVv3JsSPc6rJo8b5AyhIf7ZZQ8OEOqhiN4uX
 ixBRMTzcYkw=
 =hR5/
 -----END PGP SIGNATURE-----

Merge tag 'vfio-v7.3-rc1' of https://github.com/awilliam/linux-vfio

Pull VFIO updates from Alex Williamson:

 - Add nv_falcon vfio selftest driver.

   The Falcon is a general-purpose microcontroller embedded within
   NVIDIA GPUs, presenting a relatively simple DMA programming
   interface.

   This adds another selftest target for vfio-pci with real DMA
   transfers (Rubin Du, Alex Williamson)

 - Add allocation assertion helpers to vfio selftests and use them to
   avoid variable length arrays and the compiler errors they generate
   (Alex Mastro)

 - Fix use-after-free hazard where an init path error in MSI support
   leaves a stray pointer that can later be reused or double-freed
   (Xiang Mei)

 - Fix previous refactor of PCI BAR mappings to honor non_mappable_bars
   flag, which otherwise generates a warning when trying to pci_iomap()
   a 256TiB BAR on ISM devices on s390 (Farhan Ali)

 - Add igb vfio selftest driver.

   Like nv_falcon, this provides another target for DMA testing with
   vfio selftests, but importantly this driver supports both physical
   82576 NICs and the emulation model in QEMU.

   This therefore enables a vfio selftest vector with no physical
   hardware requirements (Josh Hilke, Alex Williamson)

 - Mark selftest fixture objects __maybe_unused to accommodate builds
   with clang -Wunused-but-set-global (David Matlack)

 - Add error recovery for vfio-pci devices on s390x.

   This expands devices which expose the existing error eventfd and
   introduces a device feature for reporting firmware defined error
   state information to the user, allowing recovery through hypervisor
   channels (Farhan Ali)

* tag 'vfio-v7.3-rc1' of https://github.com/awilliam/linux-vfio:
  vfio/pci: Remove the pcie check for VFIO_PCI_ERR_IRQ_INDEX
  vfio-pci/zdev: Add a device feature for error information
  s390/pci: Store PCI error information for passthrough devices
  PCI/MSI: Enable memory decoding before restoring MSI-X messages
  PCI: Fail FLR when config space is inaccessible
  PCI: Avoid saving config space state if inaccessible
  PCI: Allow per function PCI slots to fix slot reset on s390
  PCI: Introduce PCI_SLOT_PLACEHOLDER constant for slot_nr placeholder value
  selftests: harness: Mark test fixture objects __maybe_unused
  vfio: selftests: Retry on EAGAIN during device reset
  vfio: selftests: igb: Add driver for Intel 82576 device
  vfio: selftests: Add helpers to re-enable interrupts
  vfio/pci: Avoid mapping BARs for devices with non-mappable BARs
  vfio/pci: clear vdev->msi_perm after freeing it on init failure
  vfio: selftests: Avoid VLAs
  vfio: selftests: Add allocation assert helpers
  vfio: selftests: Add NVIDIA Falcon driver for DMA testing
  vfio: selftests: Allow drivers without send_msi() support
  vfio: selftests: Add generic PCI command register helpers
  vfio: selftests: Add memcpy chunking to vfio_pci_driver_memcpy()
2026-08-20 16:57:59 -07:00
Linus Torvalds
6439079365 Probes updates for v7.3:
- probes: Advanced BTF typecasting and variable fetch enhancements
   . Typecast support across probe events: Extended BTF typecasting syntax
     (e.g., (STRUCT)PARAM->MEMBER) to kprobes, uprobes, and fprobes on
     function entry and return.
   . Nested typecasts: Added support for chaining and nesting typecasts up
     to 3 levels, including casting registers and stack variables.
   . Field specifier option: Added (STRUCT,FIELD) syntax to emulate
     container_of(), allowing retrieval of parent structures from member
     pointers.
   . $current variable support: Introduced $current special variable to
     access the running task_struct via BTF dereferencing.
   . Per-CPU variable access: Added this_cpu_read() and this_cpu_ptr()
     fetcharg methods to trace CPU-local data safely.
   . Fetcharg bytecode dumper: Added CONFIG_PROBE_EVENTS_DUMP_FETCHARG to
     dump the compiled fetcharg bytecode instructions as comments in
     dynamic_events.
   . Extended symbol name handling: Removed the MAX_COMMON_HEAD_LEN limit
     and extended MAX_ARGSTR_LEN to 256 bytes, enabling probing of long
     symbols, mangled Rust symbols and complex BTF expressions.
   . eprobe variable syntax: Allowed eprobes to reference event fields
     directly without requiring a '$' prefix.
   . Cleanup unused parameters, redundant codes, duplicate macros and
     pointer arithmetic.
   . Use a ternary operator for simplifying fetch_type_from_btf_type().
 
 - bootconfig / boottime-trace: Expanded dynamic probe support
   . Added boot-time tracing configuration support for event probes
     (eprobes), function probes (fprobes), and tracepoint probes
     (tprobes).
   . ftrace2bootconfig: Allowed comment lines ('#') in dynamic_events file.
 
 - fprobe / kprobe: Optimization, robustness, and cleanups
   . fprobe: Simplified fprobe_remove_ips() by reusing graph and ftrace
     helpers.
   . fprobe: Removed __packed attribute from struct __fprobe_header to avoid
     unaligned memory access penalties on RISC architectures.
   . kprobe & fprobe: Removed redundant memset() calls in perf event probe
     handlers.
   . kprobes: Replaced legacy __ASSEMBLY__ with __ASSEMBLER__ in header
     files.
 
 - selftests & refactoring:
   . Refactored parse_probe_arg() and parse_probe_vars(), and eliminated
     recursion in probe argument parsing to protect kernel stack depth.
   . Added selftests for BTF typecasts and module probing without module
     prefixes.
   . Forced LC_ALL=C in ftracetest to prevent test failures on localized
     systems.
   . Refactored btf_type_skip_modifiers() to remove ignored id parameter.
   . Sorted ERRORS list in trace_probe.h alphabetically.
   . Fixed typo in fprobe docs, and trace_fprobe function name.
   . Renamed FETCH_OP_DATA to FETCH_OP_IMMSTR.
   . Made file offset error message probe-agnostic.
 -----BEGIN PGP SIGNATURE-----
 
 iQFPBAABCgA5FiEEh7BulGwFlgAOi5DV2/sHvwUrPxsFAmqEbbEbHG1hc2FtaS5o
 aXJhbWF0c3VAZ21haWwuY29tAAoJENv7B78FKz8bpXsH/i61CqF8bt3/BNUG5qTV
 JP/j/Znl9utOq4+g01AeSt6tJREEp262w/b4ZwdXiu+Q41VYwyGazY93FxtX3rQC
 gcYnJcAGghzNUjf7ujI2VXDYa11t+GiYSR3Jv8hc/Xu7rq/ilExLObFwJfdhNZAb
 go7mC0x9TgRAyw/k/9ezwukBcXQUsuoBU3+IFvict9BrSVmvMPNFhCyvIi6Ps5Fj
 NldKTDAaWiKUOuIBDF1vXXSbHMoec31qNll/Ps4HG8RLpdrSWbW4nTOaazir2bbS
 RA6hUlVNwsYn7UN6x/taV2szojyAODDv1r6ULplCVjbsn5M0TcdmLFW8JUimaAIr
 wm0=
 =6KXI
 -----END PGP SIGNATURE-----

Merge tag 'probes-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Pull probes updates from Masami Hiramatsu:
 "BTF typecasting and variable fetch enhancements:

   - Typecast support across probe events: Extended BTF typecasting
     syntax (e.g., (STRUCT)PARAM->MEMBER) to kprobes, uprobes, and
     fprobes on function entry and return

   - Nested typecasts: Added support for chaining and nesting typecasts
     up to 3 levels, including casting registers and stack variables

   - Field specifier option: Added (STRUCT,FIELD) syntax to emulate
     container_of(), allowing retrieval of parent structures from member
     pointers

   - $current variable support: Introduced $current special variable to
     access the running task_struct via BTF dereferencing

   - Per-CPU variable access: Added this_cpu_read() and this_cpu_ptr()
     fetcharg methods to trace CPU-local data safely

   - Fetcharg bytecode dumper: Added CONFIG_PROBE_EVENTS_DUMP_FETCHARG
     to dump the compiled fetcharg bytecode instructions as comments in
     dynamic_events

   - Extended symbol name handling: Removed the MAX_COMMON_HEAD_LEN
     limit and extended MAX_ARGSTR_LEN to 256 bytes, enabling probing of
     long symbols, mangled Rust symbols and complex BTF expressions

   - eprobe variable syntax: Allowed eprobes to reference event fields
     directly without requiring a '$' prefix

   - Cleanup unused parameters, redundant codes, duplicate macros and
     pointer arithmetic

   - Use a ternary operator for simplifying fetch_type_from_btf_type()

  Expanded boot time dynamic probe support:

   - Add boot-time tracing configuration support for event probes
     (eprobes), function probes (fprobes), and tracepoint probes
     (tprobes)

   - Allow comment lines ('#') in dynamic_events file

  Optimization, robustness, and cleanups:

   - Simplify fprobe_remove_ips() by reusing graph and ftrace helpers

   - Remove __packed attribute from struct __fprobe_header to avoid
     unaligned memory access penalties on RISC architectures

   - Remove redundant memset() calls in perf event probe handlers

   - Replace legacy __ASSEMBLY__ with __ASSEMBLER__ in header files

  Selftests & refactoring:

   - Refactor parse_probe_arg() and parse_probe_vars(), and eliminate
     recursion in probe argument parsing to protect kernel stack depth

   - Add selftests for BTF typecasts and module probing without module
     prefixes

   - Force LC_ALL=C in ftracetest to prevent test failures on localized
     systems

   - Refactor btf_type_skip_modifiers() to remove ignored id parameter

   - Sort ERRORS list in trace_probe.h alphabetically

   - Fix typo in fprobe docs, and trace_fprobe function name

   - Rename FETCH_OP_DATA to FETCH_OP_IMMSTR

   - Make file offset error message probe-agnostic"

* tag 'probes-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (37 commits)
  fprobe: Simplify fprobe_remove_ips() by reusing existing helpers
  tracing/boot: Add support for eprobe, fprobe, and tprobe events
  selftests/ftrace: Force C locale in ftracetest
  tracing/probes: Treating longer symbol name on event comparation
  docs: trace: fprobe: fix 'thos' spelling
  tracing/probes: Fix extra whitespace in trace_probe_kernel.h
  tracing/kprobe: Remove redundant memset in kprobe_perf_func()
  tracing/fprobe: Remove redundant memset in fentry_perf_func()
  tracing/fprobe: Remove redundant snprintf in trace_fprobe_match_command_head()
  tracing/probes: Simplify BTF_KIND_PTR case in fetch_type_from_btf_type()
  tracing/probes: Cleanup pointer arithmetic in store_trace_entry_data()
  tracing/probes: Remove unused parameter from parse_probe_var_retval()
  tracing/probes: Remove redundant bounds check in trace_probe_compare_arg_type()
  tracing/probes: Remove redundant boolean conversion in trace_probe_has_single_file()
  tracing/probes: Remove duplicate MAX_ARRAY_LEN macro definition
  selftests/ftrace: Add test case for a symbol in a module without module name
  tracing/probes: Eliminate recursion in parse_probe_arg()
  tracing/probes: Extend max length of argument string
  tracing/probes: Sort ERRORS list in trace_probe.h alphabetically
  tracing/probes: Refactor parse_probe_arg()
  ...
2026-08-20 15:11:52 -07:00
Linus Torvalds
920f27122c CXL for v7.3
CXL core type2 support:
 cxl: Support dpa without a mailbox
 cxl: Support Type2 cxl regs mapping
 
 CXL test type2 support:
 cxl/test: Rework cxl_type2_mem_init() to use cxl_mock_platform_device_add()
 cxl/test: Add cxl_test accelerator driver
 cxl/test: Fixup hdm init for auto region to support type2
 cxl/test: Propagate -ENOMEM on platform_device_alloc() failures
 cxl/test: Add hierarchy enumeration support for type2 device
 cxl/test: Refactor platform device enumerations
 cxl/test: Add type2 support for mock CFMWS0
 cxl/test: Add test for module parameters
 
 CXL port error handling support prep patches:
 cxl: Rename find_cxl_port() to find_cxl_port_by_dport()
 cxl: Tighten CPER kfifo registration API and symbol visibility
 acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locks
 cxl/ras: Fix cxl_rch_get_aer_severity() wrong severity register
 cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read
 
 CXL misc patches:
 cxl/Documentation: Spell out globbed sysfs attribute names
 cxl/test: Assign one mock memdev a full-width serial number
 cxl/core: Format the memdev serial number as unsigned in TP_printk
 cxl/pmem: Format the nvdimm serial number as unsigned decimal
 cxl: Use %pe to print error pointers
 cxl: Deny Features commands on the RAW mailbox path
 
 CXL fixes:
 cxl/region: Use __free(put_device) in find_pos_and_ways()
 cxl/region: Fix use-after-free in find_pos_and_ways() error path
 cxl/features: Clamp Get Feature output size to the remaining buffer
 cxl/features: Reject Set Features output buffer smaller than the header
 cxl/features: Reject Get Feature count larger than the output buffer
 cxl/port: Restart port enumeration when a sibling adds the dport first
 cxl/features: Serialize multi-part Get/Set Feature transfers
 cxl/pci: Honor -EPROBE_DEFER from component register setup
 cxl/mbox: Break poison list loop on an empty payload
 cxl/memdev: Fix firmware upload exact-fit handling
 cxl/features: bound fwctl command payload to the input buffer
 cxl/mce: Make the MCE notifier per-region
 cxl/pci: Remove incorrect mbox.valid check in cxl_pci_type3_init_mailbox()
 cxl: docs/linux/dax-driver - fix typos
 cxl: fix mailbox return code description typo
 cxl/mbox: Clamp mailbox output allocation to the payload size
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE5DAy15EJMCV1R6v9YGjFFmlTOEoFAmqDPQEACgkQYGjFFmlT
 OEqNBw/+LP25RACa3Jtwb53KtycNi/MzyVBXV311rDaBGzSKUixkO9LYCIV76lI/
 86x+U7+fmXBTmynD8lNwgVUw2P18xguYPe3bfn9qlmC2AZ6zmyeEzRU4p4BRzxTv
 iE9utK7DLetNRLGMnYIz3ziHLaSaZf0RslvecXF61y+nNhfd5N/pg52Bw1dUdpRi
 91m8v0JJ+v+OtEKwCsinV4lck07WRmk+roCFFqcwIdR4GkhKBKiipf+Vv9EoR/k5
 zBkhPazWFNKmnvf3VAY+vvo/Nh+wmHOrLqJUi5QYOQDXUGiJgt6/2JDVDBrY+QZL
 1I7BN66d4PE7lQnYpZHnu/aSlhcV/QI/4tKRnt1eZ7kIFO0s7QbPo7Fg8+Ql+43m
 V/qYWPxC6BgQXHBYAcnvJZO6COL1EIG1+sGy+x6kInTn33KPBeit6Ru7c3wxmYFa
 jXfdrudfN+0fUtjEhrMb2IIxfhNV5O/wLQqlj2c8vXgRmZo9dElyyiIxOC87EnOG
 sWD2Z+4z9Id4egU6bU5iTdVdT+CW0WkUHAd9gtmYwlr9Ttrqh01CTu7vc0XEKyKS
 j5YU/3sV2H8KbU5PqVo9GeYRukylESe+w42+7UemBUSzX6OIDaiNNokmDt9L+Cg7
 pdBr1qzjasR7XIDXNP9IRdkPKTgqDbSrg/gVIZJe+j7OsUHu0Nw=
 =6Bd/
 -----END PGP SIGNATURE-----

Merge tag 'cxl-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl

Pull CXL updates from Dave Jiang:
 "This includes the remaining patches to complete the basic support for
  CXL type2 (accelerators) drivers by the CXL core. A set of unit
  testing support to catch regressions for the CXL core type2 exported
  functions has also been added. The actual CXL type 2 driver support
  for the AMD Solarflare NIC driver has been picked up by net-dev.

  A set of preparatory patches has been picked up from the CXL port
  error handling series in order to reduce the number of patches in that
  series for review. The rest of that series is getting close to be
  merged but was not ready for the 7.3 merge window.

  There are also a number of misc patches and a large number of bug
  fixes against pre-existing issues flagged by sashiko reviews as
  contributors post new patches on the mailing list. We will continue to
  work through the sashiko raised issues as they show up."

* tag 'cxl-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: (35 commits)
  cxl/Documentation: Spell out globbed sysfs attribute names
  cxl: Rename find_cxl_port() to find_cxl_port_by_dport()
  cxl: Tighten CPER kfifo registration API and symbol visibility
  acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locks
  cxl/ras: Fix cxl_rch_get_aer_severity() wrong severity register
  cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read
  cxl/test: Assign one mock memdev a full-width serial number
  cxl/core: Format the memdev serial number as unsigned in TP_printk
  cxl/pmem: Format the nvdimm serial number as unsigned decimal
  cxl: Use %pe to print error pointers
  cxl/region: Use __free(put_device) in find_pos_and_ways()
  cxl/region: Fix use-after-free in find_pos_and_ways() error path
  cxl: Deny Features commands on the RAW mailbox path
  cxl/features: Clamp Get Feature output size to the remaining buffer
  cxl/features: Reject Set Features output buffer smaller than the header
  cxl/features: Reject Get Feature count larger than the output buffer
  cxl/port: Restart port enumeration when a sibling adds the dport first
  cxl/features: Serialize multi-part Get/Set Feature transfers
  cxl/pci: Honor -EPROBE_DEFER from component register setup
  cxl/mbox: Break poison list loop on an empty payload
  ...
2026-08-20 15:02:09 -07:00
Linus Torvalds
caf325ab81 LoongArch changes for v7.3
1, Add DIRECT_MAP_PHYSMEM_END definition;
 2, Expand module virtual address space to 2GB;
 3, Use current_stack_pointer in current_pt_regs();
 4, BPF JIT enhancements such as kptr_xchg and timed may_goto;
 5, Some bug fixes and other small changes.
 -----BEGIN PGP SIGNATURE-----
 
 iQJKBAABCAA0FiEEzOlt8mkP+tbeiYy5AoYrw/LiJnoFAmqDGUUWHGNoZW5odWFj
 YWlAa2VybmVsLm9yZwAKCRAChivD8uImeiE5D/0XYl8xAsOegm2dNuM+kKfqXAV4
 FcbaoB7GuYHWG7lFkVTITwBe8A30BInADrwZQPxv7wb7aTQusTwNjAfq1pX1MOxG
 ET1Fady7dEokCB9VAS/FP24lbF5nDYLVs0kEcx+xvAwQpW750Rk+aWcyCZeX5xgV
 3KrlnYVXDvDYY6HDeuL9pXkKhyRe4uqnPLh1loOhK0HC/NhLCu+tfyLH3pQl/ZCf
 QuNnw93fSTJPvZD2HcTb81tG4ohdj5GXM9SuckfIvNiZoRtc5pMnVE6we1N5yQKY
 E4EwB9fqQ74piMbM2RjLPi5bjgzzdJSGamdEZ4QUau4HjFXZsDiNEfWRmN2Z3qQo
 +zsLzZq43yHsCUsaobWmtmo0Q6YF4pjtyff904YYrPIKH+96dyGsvjbA+n46H7pL
 Eg+HNdOH0t6dU706y0zbR0t1Za4PiM9dZtV3BZT3B8MLMEy7dsVYoBUt+7Kc+eYB
 lq5SlWaFYyOSnC1WL8/uzzrH6adF/62DruHy1ovlWOE6bhPc+uQucXHOyNxyf86h
 xIlOB0hRCO18sYql6WuxpQO9bKP0LCQv5JoeCqjXsKTQgiG3kFAx9bpRmTHt4CqH
 3LWiBRRVzLvScZ0qqerGXXylXXkdN3uagtpSXM+f/bXbWje3cROSyWK4rktwLsPN
 ugAIATgZ8+/B45X56w==
 =h0m2
 -----END PGP SIGNATURE-----

Merge tag 'loongarch-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson

Pull LoongArch updates from Huacai Chen:

 - Add DIRECT_MAP_PHYSMEM_END definition

 - Expand module virtual address space to 2GB

 - Use current_stack_pointer in current_pt_regs()

 - BPF JIT enhancements such as kptr_xchg and timed may_goto

 - Some bug fixes and other small changes

* tag 'loongarch-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson:
  selftests/bpf: Enable kptr_xchg_inline test on LoongArch
  LoongArch: BPF: Add arch_bpf_stack_walk() implementation
  LoongArch: BPF: Add timed may_goto implementation
  LoongArch: BPF: Resolve per-CPU addrs for internal-only MOV
  LoongArch: BPF: Advertise JIT support for kptr xchg inline
  LoongArch: BPF: Align value-returning atomics with LKMM
  LoongArch: BPF: Split unconditional branch JA paths statically
  LoongArch: BPF: Remove dead move_imm() call in BPF_NEG path
  LoongArch: BPF: Remove redundant zext jumping in move_imm()
  LoongArch: BPF: Implement branchless conditional move for TCC
  LoongArch: BPF: Refactor jump offset calculation in tail call
  LoongArch: BPF: Move arena register slot below TCC context
  LoongArch: BPF: Optimize redundant TCC loads in epilogue
  LoongArch: Use current_stack_pointer in current_pt_regs()
  LoongArch: Use generic cmp_int() instead of custom cmp_3way()
  LoongArch: Expand module virtual address space to 2GB
  LoongArch: Add DIRECT_MAP_PHYSMEM_END definition
  LoongArch: Fix acpi_package_ids[] array overflow
2026-08-20 14:46:50 -07:00
Linus Torvalds
55ab7e1422 for-7.3/block-20260819
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmqGD2AQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgpomLD/9rr3SIQvdQRTnSCJlw1cFypSrnRhGAx1g8
 v1F7UXuf4Abt4GIerbdXmBTx9zZRctpcOC41ReQk3YKkYuukuvna+Z6tBGf5I5+e
 3SR3Zkrj2k4zyNC49g0/QkUJkTTS4tlsBFhNJtY3Q5BBIRMRd/sPvZ+cLnD7g/wH
 3zM9IaEMk9xu9mF1nGI7LRl1qY0IOr4ynQpqohl5sEL3TQWgIa0r2B0jhGacBAvC
 GGDwIwGDrM6oGwCn6mLN78O5odhLyTufIMNy3EnVw7BcDpLApcnJzYYjGzv+ElCM
 WLBJwWYj+PYeoenuJuFhbRihbOPg5gZT3Mn8CUhLxUYzwZvIdFGWOjcGffD9sVu/
 JO4nB6A+2AG/wgsb2YVKefhN86FoD0F/2hhdEdgZPJE6a+7+xeyyp9IzyQEWd0cg
 Seo06fxE4pwF+dczXT3jzU3LXSZb/Jbh9hzu163VMSWbGYDCpDzfipqZGeN6DWE7
 nG2NssAQtjtZrgdggYbZXtwecLZhu3cMj3jbhS4wSUzhQFW42yceJstCx4wpRhW9
 m9EXjHQnRFMAb2TjUC3FzEncjbxL+uACjcKhTetd1hLbTI5I8KArZXjam1OdJOHV
 urdtsru79LanQLAgRwWYPeKCZGNhX7I2o3OsmVDLQgHIDaZguTcPUVQs3wVui7Dk
 IDmmrtwzpg==
 =G1l4
 -----END PGP SIGNATURE-----

Merge tag 'for-7.3/block-20260819' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

Pull block updates from Jens Axboe:

 - NVMe updates via Keith:
     - Enable Clang context analysis for the nvme host driver, adding
       context annotations across core, fabrics, rdma, tcp and pci
     - nvmet reservation state exposed through a new namespace-level
       debugfs directory, plus ABI documentation for the host sysfs and
       target configfs interfaces
     - nvme-tcp host memory disclosure fixes on the read path: reject a
       read that transferred too few bytes, don't accept C2HData based
       on blk_rq_payload_bytes() alone, and fix the R2T case for a read
       command
     - Parallelize nvme-rdma I/O queue allocation and startup (Surabhi)
     - Apple nvme fixes and quirks: page aligned admin queue buffers,
       destroy the admin queue on removal, and various DMA/NVMMU
       correctness fixes
     - A large pile of nvmet and host fixes for out-of-bounds reads,
       refcount/resource leaks, and NULL derefs across auth, zns,
       passthru, pci-epf, rdma and configfs
     - Various other fixes and cleanups

 - MD updates via Yu Kuai:
     - llbitmap reshape support, the large series wiring exact bitmap
       mapping and reshape lifecycle through raid5 and raid10, growing
       the page cache in place, and remapping checkpointed bits as
       reshape progresses
     - raid5 fixes for lockless max_nr_stripes and recovery_offset
       accesses, a reshape deadlock with more failed devices than max
       degraded, and bitmap batch counter consistency
     - Atomic write handling for raid1/raid10, and removal of the
       REQ_NOWAIT support from raid1/10/456
     - raid5-ppl use-after-free fix in ppl_do_flush()
     - A batch of smaller fixes across md core and the bitmap code

 - s390/dasd ESE full-track write support and the surrounding
   infrastructure, plus enabling CONTEXT_ANALYSIS for s390/block

 - RWF_DONTCACHE support for block devices, built on new task-context
   bio completion infrastructure, and wiring it up for the iomap and
   buffer dropbehind writeback paths

 - Async io_uring zone reset all, plus zone management command cleanups
   allowing REQ_NOWAIT and tightening conventional zone rejection

 - Block integrity refactoring: lift BIP_CHECK_FLAGS to the shared
   header, handle nogenerate/noverify properly in fs-integrity, and drop
   the blk-integrity.h include from bdev.c

 - Split out a new blk_plug.h header

 - ublk improvements: add UBLK_F_IO_DESC_SIZE, split request validation
   from io_desc init, reject non-power-of-2 zone sizes in SET_PARAMS,
   and a series of hardening fixes around map/unmap and auto buf reg

 - null_blk cleanups and configfs serialization fixes

 - nbd queue freeze removal on the setup paths, and a new
   pre_defined_connections module parameter for pre-created devices

 - blk-cgroup fixes for the race between policy activation and blkg
   destruction, and accounting per-cpu stats over possible CPUs across
   blk-stat, iolatency, iocost and kyber

 - Various dio fixes: leak on metadata mapping error, validate user
   space vectors during extraction, and set dma_alignment from the
   backing file for loop and zloop direct I/O

 - bio cleanups

 - Various other fixes and cleanups all over

* tag 'for-7.3/block-20260819' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (241 commits)
  nbd: add pre_defined_connections module parameter for pre-created devices
  nbd: remove queue freeze for newly created nbd from netlink path
  nbd: factor out a nbd_genl_foreach_sock
  nbd: skip queue freeze when setting size at device startup
  nbd: remove queue freeze in nbd_add_socket
  nbd: clear queue limits on disconnect
  nbd: disallow NBD_SET_SOCK on an active device
  nbd: simplify find_fallback() by removing redundant logic
  blk-mq: add missing call to srcu_barrier() in blk_mq_free_tag_set()
  block: mtip32xx: synchronize ioctls with device removal
  ublk: avoid teardown retry loop on xarray allocation failure
  null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows
  block: don't include blk-integrity.h in bdev.c
  xfs: avoid double deferrals for RWF_DONTCACHE writes
  loop: Fix recently introduced lock inversion
  block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead()
  swim3: Add missing MODULE_DESCRIPTION
  selftests: ublk: add SET_PARAMS validation test
  selftests: ublk: add helper for SET_PARAMS
  ublk: reject non-power-of-2 zone sizes in SET_PARAMS
  ...
2026-08-20 13:55:16 -07:00
Triet Hoang
25b863cd6d tools: ynl: handle calloc failure in ynl_ntf_parse
Check the return value of calloc() before dereferencing the allocated
response structure in ynl_ntf_parse().

Signed-off-by: Triet Hoang <triet.hoang.dev@gmail.com>
Link: https://patch.msgid.link/20260818132739.469624-1-triet.hoang.dev@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-20 13:29:36 -07:00
Linus Torvalds
d141ec2825 NFSD 7.3 Release Notes
Jeff Layton contributed CB_NOTIFY support to NFSD's NFSv4.1
 directory delegations. The server used to recall a delegation as
 soon as the directory changed. NFSD now watches delegated
 directories through fsnotify and reports adds, removes, renames,
 and directory attribute changes, carrying the filehandle and
 attributes of the affected entry, so clients can keep their
 caches. Some of the NOTIFY4 flags come from RFC 8881bis.
 
 Jeff Layton also continued the netlink work that started in v7.2.
 A new server-stats-get operation reports what /proc/net/rpc/nfsd
 publishes, plus NFSv4 callback counts, and SUNRPC now keeps its
 per-procedure call counts per network namespace, so a container
 sees its own numbers. nfsstat reads all of this over netlink, with
 a procfs fallback for older kernels.
 
 SUNRPC's service thread pool mode selection is gone. Pernode is
 the right choice on any host we run today, so the auto, global,
 and percpu modes have been removed. A single-node host still gets
 one pool. A multi-NUMA host now gets a pool per node.
 sunrpc.pool_mode accepts the old names but no longer selects
 anything.
 
 The rest is bug fixes, clean-ups, and small optimizations: an
 async COPY offload rework from Jeff Layton, more use-after-free
 fixes in the NFSv4 state revocation paths, percpu counter
 contention removed from the reply cache and IO accounting, and a
 long list of hardening fixes from Chris Mason. Sincere thanks to
 all contributors, reviewers, testers, and bug reporters who
 participated in the v7.3 NFSD development cycle.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEKLLlsBKG3yQ88j7+M2qzM29mf5cFAmqDDs4ACgkQM2qzM29m
 f5eUTQ/+NgtZZ93ssYPbu5vW1lnxI0zVMPwBw+jvdF4YShaLUTVD3AYN/wOn2n2v
 Y0ULB2QOyz5zXq+9e9sL/zWJNPsGucx4G4pfcXzn96e3zPkZPChaJUKRQd347kPc
 gkaExMxQBwqU7xDIaBF+g1vh4pogORfhc4xi0zE0j4kqiYJOQCJIUg33SNLrqeSa
 DG7IbTuS+nvFBalbUQiWaL7DMxO2N2JlYbpU15kzBuJ8GLK7I3kPPTDGKEbEaUuF
 m8krI6Drdrwb1puiZnjUO+OHvalC5JzKcLkHG9Ps1KlUgfYDZ546waPIcpCT0KjM
 JFG3Avg2Zu9o+cz1AZB9Kq7epPQgHzNea3h48DOLvJP9r97cvObkg2ZocMzlHe0/
 yy2qRCBpX41MWDgckB6hCVP1l/l0u7EatpXxMtdBm4Jnv6a6Em39RLX4MzFVcJ5t
 cYROdLEAfwblIeJyOJm197LjjhKb7minPWRWaYwnGMe05VXUXSh7MZI/Rw7NkJev
 P8p+bt1CEv1pEM0ArrDmcjPvsX2JJXMsspHovf/ymbTYLdDf9I/7NFLE/Jc6c9BT
 h9/oMBcw7lumlB5aq3L/NOlXQmjtoGTQVjyMrKDwtRQXjQgFo8gaB5nXSIlB4ik+
 DFz2ajp+F07VATS89Dc2m7ALO08pdNwzn4p8jq/IKnqlGWlxNIE=
 =g1IS
 -----END PGP SIGNATURE-----

Merge tag 'nfsd-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux

Pull nfsd updates from Chuck Lever:

 - CB_NOTIFY support for NFSD's NFSv4.1 directory delegations

   The server used to recall a delegation as soon as the directory
   changed. NFSD now watches delegated directories through fsnotify and
   reports adds, removes, renames, and directory attribute changes,
   carrying the filehandle and attributes of the affected entry, so
   clients can keep their caches. Some of the NOTIFY4 flags come from
   RFC 8881bis (Jeff Layton)

 - Continued netlink work

   A new server-stats-get operation reports what /proc/net/rpc/nfsd
   publishes, plus NFSv4 callback counts, and SUNRPC now keeps its
   per-procedure call counts per network namespace, so a container sees
   its own numbers. nfsstat reads all of this over netlink, with a
   procfs fallback for older kernels (Jeff Layton)

 - Remove SUNRPC service thread pool mode selection

   Per node is the right choice on any host we run today, so the auto,
   global, and percpu modes have been removed. A single-node host still
   gets one pool. A multi-NUMA host now gets a pool per node.

   sunrpc.pool_mode accepts the old names but no longer selects
   anything.

 - Bug fixes, clean-ups, and small optimizations:
    - async COPY offload rework (Jeff Layton)
    - more use-after-free fixes in the NFSv4 state revocation paths
    - percpu counter contention removed from the reply cache and IO
      accounting
    - a long list of hardening fixes (Chris Mason)

Sincere thanks to all contributors, reviewers, testers, and bug
reporters who participated in the v7.3 NFSD development cycle.

* tag 'nfsd-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: (182 commits)
  nfsd: export NFSv4 callback op stats via netlink
  nfsd: count NFSv4 callback operations per netns
  sunrpc: remove unused svc_version vs_count field
  nfsd: implement server-stats-get netlink handler
  sunrpc: use per-net counts in svc_seq_show()
  sunrpc: add per-netns per-procedure call counts to svc_stat
  NFSD: Document reply_cache_stats ABI
  NFSD: Eliminate percpu counter contention in IO byte accounting
  NFSD: Eliminate percpu counter contention in reply cache statistics
  NFSD: Eliminate percpu counter contention in DRC memory accounting
  NFSD: Fix off-by-one in DRC bucket pruning limit
  NFSD: Relocate NFSv4 "supported attributes" to new header
  NFSD: Relocate nfsd4_set_netaddr()
  NFSD: Relocate nfsd_user_namespace()
  NFSD: Move struct readdir_cd
  NFSD: Move the export.h include from nfsd.h to auth.c
  NFSD: Remove '#include "nfsd.h"' from fs/nfsd/cache.h
  NFSD: include "netns.h"
  NFSD: Explicitly include "stats.h"
  NFSD: Make "stats.h" self-contained
  ...
2026-08-20 12:39:56 -07:00
Linus Torvalds
62abb6cffd NVDIMM and DAX for v7.3
Documentation cleanup:
 nvdimm-btt: clean up kernel-doc warnings
 libnvdimm: nd.h: clean up kernel-doc warnings
 
 DAX prepare for FAMFS:
 dax: fsdev.c minor formatting cleanup
 dax: fix holder_ops race in fs_put_dax()
 dax: read holder_ops once in dax_holder_notify_failure()
 dax/fsdev: fail probe on invalid pgmap offset
 dax/fsdev: use __va(phys) for kaddr in direct_access
 dax/fsdev: clear pgmap ops and owner on unbind
 dax/fsdev: don't leave a dangling dev_dax->pgmap on probe failure
 dax/fsdev: clear vmemmap_shift when binding static pgmap
 dax/fsdev: fix multi-range offset in memory_failure handler
 dax: fix misleading comment about share/index union in dax_folio_reset_order()
 
 NVDIMM misc fixups:
 nvdimm/btt: reject an arena whose nfree is below the lane count
 libnvdimm/labels: Bound the on-media label size before the shift
 libnvdimm/labels: Prevent integer overflow in __nd_label_validate()
 
 Coccinelle reported cleanups:
 nvdimm: ndtest: remove redundant NULL check before vfree()
 nvdimm: nfit: remove redundant NULL check before vfree()
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQR/ATNjDEocsE1wudD5tRoRP7nxxwUCaoOJMQAKCRD5tRoRP7nx
 x6FQAQCmAfXFZK5eE+nujrFanI5d2iiKcTefwR/LYu0HOVG82AEA/c39OZz4jhSj
 bx49jE45o7qTaZHzY8ADSBVl8GHSOQA=
 =0lJA
 -----END PGP SIGNATURE-----

Merge tag 'libnvdimm-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm

Pull NVDIMM and DAX updates from Alison Schofield:
 "Most are DAX preparatory patches for FAMFS support, along with a few
  NVDIMM fixes and documentation cleanups.

   - Documentation cleanup, removing kernel-doc warnings

   - preparing DAX for FAMFS

   - misc NVDIMM fixups with cleanups for issues reported by Coccinelle"

* tag 'libnvdimm-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm:
  nvdimm-btt: clean up kernel-doc warnings
  libnvdimm: nd.h: clean up kernel-doc warnings
  dax: fsdev.c minor formatting cleanup
  dax: fix holder_ops race in fs_put_dax()
  dax: read holder_ops once in dax_holder_notify_failure()
  dax/fsdev: fail probe on invalid pgmap offset
  dax/fsdev: use __va(phys) for kaddr in direct_access
  dax/fsdev: clear pgmap ops and owner on unbind
  dax/fsdev: don't leave a dangling dev_dax->pgmap on probe failure
  dax/fsdev: clear vmemmap_shift when binding static pgmap
  dax/fsdev: fix multi-range offset in memory_failure handler
  dax: fix misleading comment about share/index union in dax_folio_reset_order()
  nvdimm/btt: reject an arena whose nfree is below the lane count
  libnvdimm/labels: Bound the on-media label size before the shift
  libnvdimm/labels: Prevent integer overflow in __nd_label_validate()
  nvdimm: ndtest: remove redundant NULL check before vfree()
  nvdimm: nfit: remove redundant NULL check before vfree()
2026-08-20 12:17:36 -07:00
Eric Dumazet
e5c8e301b4 selftests: net: packetdrill: add tests for advertised MSS with PMTU exceptions
Add packetdrill tests for IPv4 and IPv6 to verify that the advertised
MSS in SYN-ACK is derived from the configured interface/route MTU,
and is not shrunk by learned Path MTU exceptions from previous
outbound connections.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Link: https://patch.msgid.link/20260815071532.301908-1-jiayuan.chen@linux.dev
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-20 12:14:23 -07:00
Jiayuan Chen
7ee2f20bf2
selftests/bpf: Add reg-invariants test for speculative pointer arithmetic
An unprivileged socket filter does variable pointer arithmetic on a
PTR_TO_MAP_VALUE whose offset collapses to a constant. The Spectre-v1
speculative path used to snapshot the pointer with a const offset and an
unbounded r32, which tripped reg_bounds_sanity_check() on the following
register move.

Mark the test __success_unpriv (the speculative path only runs
unprivileged) and flag it BPF_F_TEST_REG_INVARIANTS so the invariant
violation becomes a hard load failure. The unprivileged run fails without
the verifier fix and passes with it:

  verifier_bounds/spec_ptr_alu_const_offset @unpriv:FAIL   # without fix
  verifier_bounds/spec_ptr_alu_const_offset @unpriv:OK     # with fix

Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Tested-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/bpf/20260819125840.286434-2-jiayuan.chen@linux.dev
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-08-20 20:44:16 +02:00
Linus Torvalds
ae814200e8 bitmap updates for v7.3
- bitmap_find_next_zero_area_off() optimization (Sunyi);
  - bitmap_find_next_zero_area_off(): return size when no zero area is
    found (Yury);
  - bitmap vs IDA vs Maple Tree performance test (Yury);
  - get rid of cpumap_print_to_pagebuf() (Yury);
  - use nr_node_ids in __nodemask_pr_numnodes() (Li RongQing);
  - bitops: make the *_bit_le functions use unsigned long (Benjamin);
  - bitmap scatter & gather test fix (Christophe);
  - use __ASSEMBLER__ in bitmap header files (Thomas);
 -----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEEi8GdvG6xMhdgpu/4sUSA/TofvsgFAmqDX1YACgkQsUSA/Tof
 vsjcpwwAw7130xQPNFREr+ttdoUn3gN/aVUOl7K2Mi3kUOdlg8i9FEaQ/a07nE5L
 ozXRAWgSM7VxW1I7nkj5McsGRiRX0SRoXmTbjDfPugMiXbD1UBPqCz2n0rYHYR4P
 GfQ0RJK8LUN3Sq1eIu27HNirLG1HU1jCm3fsaTft2naaY6TnSPjklZdVE6Phz87E
 eblgm+AO8//EoKsggoMCnGVCVWKE3N1RrWzsaT4ltErGyHvIzvWEbCCk2cI764Qj
 orLLeefPf2xVDlbzywU7uUklNWYRe4miPxrbnT5TH2KmTipb3M62MkGjPa5dzYIq
 ssOvSnKoQEV9od9cNv1hPFGs5b+RO+kOolcrWKTqWeHFgVTv7dZZL0QvuGHeOfOa
 Fc5GPxE2SiXLPVuUEgMhlrg9DsXGf0d9u7JHTnJF+ZL/QhIE+4wOVnIYWUyBZiqx
 zF7Ic62xmeJOKz9kfYg9JQYPwUblhhyYtiWOmzLIisf8FXi5M3L9eH6rO6CEWcrk
 viEkTMbW
 =q8Lf
 -----END PGP SIGNATURE-----

Merge tag 'bitmap-for-7.3' of https://github.com/norov/linux

Pull bitmap updates from Yury Norov:
 "The usual set of fixes, cleanups and performance improvements together
  with a couple of new tests:

   - bitmap_find_next_zero_area_off() optimization (Sunyi)

   - bitmap_find_next_zero_area_off(): return size when no zero area is
     found (Yury)

   - bitmap vs IDA vs Maple Tree performance test (Yury)

   - get rid of cpumap_print_to_pagebuf() (Yury)

   - use nr_node_ids in __nodemask_pr_numnodes() (Li RongQing)

   - bitops: make the *_bit_le functions use unsigned long (Benjamin)

   - bitmap scatter & gather test fix (Christophe)

   - use __ASSEMBLER__ in bitmap header files (Thomas)"

* tag 'bitmap-for-7.3' of https://github.com/norov/linux: (25 commits)
  lib: test bitmap vs IDA vs Maple Tree performance for region allocations
  bitmap: Return size when no zero area is found
  media: s5p-mfc: Treat bitmap size as allocation failure
  crypto: ccp: Treat bitmap size as allocation failure
  powerpc/msi: Treat bitmap size as allocation failure
  ARM: dma-mapping: Treat bitmap size as allocation failure
  bitmap: drop bitmap_next_set_region()
  nodemask: reduce bitmap width to nr_node_ids in __nodemask_pr_numnodes()
  bitmap: Properly initialise destination bitmap for scatter & gather test
  lib/bitmap-str: get rid of cpumap_print_to_pagebuf()
  perf: Use sysfs_emit() for cpumask show callbacks
  PCI/sysfs: Use sysfs_emit() for cpumask show callbacks
  RDMA/hfi1: Use sysfs_emit() for cpumask show helper
  hwtracing: hisi_ptt: Use sysfs_emit() for cpumask show
  fpga: dfl-fme-perf: Use sysfs_emit() for cpumask show
  devfreq: Use sysfs_emit() for cpumask show callbacks
  cpu: Use sysfs_emit() for cpumask show callback
  x86/events: Use sysfs_emit() for cpumask show callbacks
  powerpc: Use sysfs_emit() for cpumask show callbacks
  arm: Use sysfs_emit() for cpumask show callbacks
  ...
2026-08-20 11:41:46 -07:00
Linus Torvalds
11260c335e sched_ext: Changes for v7.3
This depends on the arena argument support in the BPF tree and should be
 pulled after the scheduler core and BPF pulls. The patches based on bpf-next
 were kept on a separate branch which was merged into for-7.3 just now. The
 same merged result was in linux-next for several days.
 
 Most of this cycle completes the enqueue-path support for hierarchical
 sub-scheduling, which makes sub-scheduler support feature complete: a root
 BPF scheduler can now hand a cgroup subtree over to a nested sub-scheduler
 together with revocable CPU grants, and the sub-scheduler owns all
 scheduling decisions for its tasks on those CPUs.
 
 Development volume was high and a number of changes plugging holes in the
 new support landed late in the cycle. Also included are core scheduling
 fixes that were completed too late for the v7.2 release and are routed
 through this pull request.
 
 - Sub-scheduler CPU delegation:
 
   - Parent schedulers now grant and revoke per-CPU capabilities (enqueueing,
     preemption, CPU frequency control) on their children, enforced on every
     path a scheduler can reach a CPU through. Previously only dispatching
     could be delegated; this lets sub-schedulers fully schedule their CPUs.
 
   - Rescue execution: a task whose scheduler doesn't have access to the CPUs
     the task needs to run on starved until the watchdog ejected the whole
     scheduler. The kernel now runs such tasks directly on a small bandwidth
     budget, turning a scheduler-killing failure into bounded degradation.
 
   - Cgroup integration: tasks migrating across a sub-scheduler boundary
     weren't re-homed to the new owner, causing wrong-scheduler scheduling
     and a use-after-free. Sub-schedulers now take over their cgroup subtree
     and receive its cgroup callbacks.
 
   - Arena objects now cross the kernel/BPF boundary as typed pointer
     arguments, translated transparently by the BPF tree's new arena argument
     support, replacing untyped arguments with manual translation.
 
   - scx_qmap now demonstrates full hierarchical sub-scheduling.
 
 - Robustness improvements: the abort path is now NMI-safe, fixing deadlocks
   when errors are raised from NMI context and making hardlockup recovery
   direct. Reenqueue loops that could monopolize a CPU ahead of the watchdog
   now eject the offending scheduler, and stalls are blamed on the scheduler
   actually responsible.
 
 - Hardening: BPF-writable arena memory is validated before kernel use, and
   task slice and vtime writes got explicit synchronization rules, closing
   corruption vectors open to buggy or malicious schedulers.
 
 - Core scheduling: sched_ext dispatching can drop the rq lock inside the
   core-wide pick, which let interleaving selections corrupt each other's
   state and hard-hang the machine. The selection now restarts when the lock
   was released. The task ordering callback was also invoked with its
   arguments swapped, and the default ordering is updated to work across
   sub-scheduler boundaries. The fixes are marked for stable.
 
 - Other fixes headed for stable: a task init leak on fork failure during
   enable, tooling compat macros that silently failed to detect newer
   kernels, and a crash on reenqueueing against a destroyed dispatch queue.
 
 - Tooling: scx_pair moves off deprecated callbacks, and the deprecated
   scx_bpf_cpu_rq() kfunc is removed.
 -----BEGIN PGP SIGNATURE-----
 
 iIQEABYKACwWIQTfIjM1kS57o3GsC/uxYfJx3gVYGQUCaoOA7w4cdGpAa2VybmVs
 Lm9yZwAKCRCxYfJx3gVYGQWqAP9Sy8GwS7dRdGze/eHwYlDBt5U9ayd2ntR0Z+H1
 1Hd23AEA5kYPaEN68OgCXh/XqmFljkvEgEisXtMtw8XsZA+pHQA=
 =OwIm
 -----END PGP SIGNATURE-----

Merge tag 'sched_ext-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext

Pull sched_ext updates from Tejun Heo:
 "Most of this cycle completes the enqueue-path support for hierarchical
  sub-scheduling, which makes sub-scheduler support feature complete: a
  root BPF scheduler can now hand a cgroup subtree over to a nested
  sub-scheduler together with revocable CPU grants, and the
  sub-scheduler owns all scheduling decisions for its tasks on those
  CPUs.

  Development volume was high and a number of changes plugging holes in
  the new support landed late in the cycle. Also included are core
  scheduling fixes that were completed too late for the v7.2 release and
  are routed through this pull request.

  Sub-scheduler CPU delegation:

   - Parent schedulers now grant and revoke per-CPU capabilities
     (enqueueing, preemption, CPU frequency control) on their children,
     enforced on every path a scheduler can reach a CPU through.
     Previously only dispatching could be delegated; this lets
     sub-schedulers fully schedule their CPUs.

   - Rescue execution: a task whose scheduler doesn't have access to the
     CPUs the task needs to run on starved until the watchdog ejected
     the whole scheduler. The kernel now runs such tasks directly on a
     small bandwidth budget, turning a scheduler-killing failure into
     bounded degradation.

   - Cgroup integration: tasks migrating across a sub-scheduler boundary
     weren't re-homed to the new owner, causing wrong-scheduler
     scheduling and a use-after-free. Sub-schedulers now take over their
     cgroup subtree and receive its cgroup callbacks.

   - Arena objects now cross the kernel/BPF boundary as typed pointer
     arguments, translated transparently by the BPF tree's new arena
     argument support, replacing untyped arguments with manual
     translation.

   - scx_qmap now demonstrates full hierarchical sub-scheduling.

  Other fixes and updates:

   - Robustness improvements: the abort path is now NMI-safe, fixing
     deadlocks when errors are raised from NMI context and making
     hardlockup recovery direct. Reenqueue loops that could monopolize a
     CPU ahead of the watchdog now eject the offending scheduler, and
     stalls are blamed on the scheduler actually responsible.

   - Hardening: BPF-writable arena memory is validated before kernel
     use, and task slice and vtime writes got explicit synchronization
     rules, closing corruption vectors open to buggy or malicious
     schedulers.

   - Core scheduling: sched_ext dispatching can drop the rq lock inside
     the core-wide pick, which let interleaving selections corrupt each
     other's state and hard-hang the machine. The selection now restarts
     when the lock was released. The task ordering callback was also
     invoked with its arguments swapped, and the default ordering is
     updated to work across sub-scheduler boundaries. The fixes are
     marked for stable.

   - Other fixes headed for stable: a task init leak on fork failure
     during enable, tooling compat macros that silently failed to detect
     newer kernels, and a crash on reenqueueing against a destroyed
     dispatch queue.

   - Tooling: scx_pair moves off deprecated callbacks, and the
     deprecated scx_bpf_cpu_rq() kfunc is removed"

* tag 'sched_ext-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: (144 commits)
  sched_ext: Drop the dead SCX_DEQ_CORE_SCHED_EXEC test in dequeue_task_scx()
  sched_ext: Make core-sched task ordering hierarchy-aware
  sched_ext: Use runnable_at for the default core-sched task ordering
  sched_ext: Fix inverted ops.core_sched_before() invocation
  sched_ext: Move the config-off sub-cap kfunc stubs into sub.c
  sched_ext: Rename balance-era identifiers to dispatch terms
  sched_ext: Drop the stale keep_prev fixup in dispatch_pick()
  sched_ext: Keep kick_sync waiting on the rq's own CPU
  sched_ext: Make SCHED_CLASS_EXT select GENERIC_ALLOCATOR
  sched_ext/scx_flatcg: Fix cvtime true-up on slice expiry
  sched_ext: Don't BUG_ON a destroyed DSQ in process_deferred_reenq_users
  sched_ext: Fix scx_bpf_dsq_move_to_local___v2 compat detection
  sched_ext: Make scx_bpf_events() read the calling scheduler's counters
  sched_ext: Drop unlocked scx_rq_clock_invalidate() from scx_root_disable()
  selftests/sched_ext: Fix flaky ddsp failure tests on busy systems
  selftests/sched_ext: Make numa idle validation race-free
  sched_ext: Fix scx_bpf_dsq_reenq___compat kfunc extern prototype
  sched_ext/scx_flatcg: expire cached hweights on weight changes
  sched_ext: Fix exit_task leak on fork failure during enable
  sched_ext: fix stale references in doc comments
  ...
2026-08-20 11:01:37 -07:00
Hongfu Li
a8c6daab4b selftests/cgroup: Fix cg_run_in_subcgroups ignoring arg parameter
cg_run_in_subcgroups() discards its arg and always passes NULL to cg_run(),
turning the (void *)100 from test_kmem_dead_cgroups() into NULL so no
allocation occurs.

This makes test_kmem_dead_cgroups() falsely pass without exercising the
"dying cgroup with charged slab" scenario it intends to test.

Pass the arg through to cg_run() to fix this.

Fixes: 933dc80ec2 ("kselftests: cgroup: add kernel memory accounting tests")
Signed-off-by: Hongfu Li <lihongfu@kylinos.cn>
Reviewed-by: Michal Koutný <mkoutny@suse.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-20 07:48:01 -10:00
Linus Torvalds
40d8c81577 cgroup: Changes for v7.3
- cpuset:
 
   - Attach path bug fixes: migrations spanning multiple source or
     destination cpusets were mishandled, most visibly leaving thread
     affinities stale when the controller is disabled in a threaded subtree.
     Configuration writes could also race an in-flight attach and apply stale
     state, and the deadline task count could get corrupted by concurrent
     updates, skewing SCHED_DEADLINE admission decisions.
 
   - Memory binding bug fixes: which node masks get applied differed between
     the binding update paths, and tasks cloned with CLONE_INTO_CGROUP
     skipped rebinding entirely. Rebinding also now runs once per process
     instead of repeating for every thread sharing the mm.
 
   - Overhead removals with no behavior change: CPU hotplug iterated tasks of
     cpusets that just inherit the parent's effective masks, and the
     slab-spreading task flag was still being maintained although the SLAB
     allocator that consumed it is long gone.
 
 - Data-race annotations for benign races so that KCSAN reports stay
   meaningful, selftest coverage for the fixes above along with flakiness and
   portability fixes, and documentation corrections.
 -----BEGIN PGP SIGNATURE-----
 
 iIQEABYKACwWIQTfIjM1kS57o3GsC/uxYfJx3gVYGQUCaoNzqw4cdGpAa2VybmVs
 Lm9yZwAKCRCxYfJx3gVYGRxVAQDK5MAK0wUhxkG2bO7eSp0F74J/uAMXTSQdcXR+
 LR3wnQD/aYTHVPXecNc2XqU10uaVqPctHTuCt2qb4J7w8brHPQ8=
 =9TyI
 -----END PGP SIGNATURE-----

Merge tag 'cgroup-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup

Pull cgroup updates from Tejun Heo:

 - Attach path bug fixes: migrations spanning multiple source or
   destination cpusets were mishandled, most visibly leaving thread
   affinities stale when the controller is disabled in a threaded
   subtree. Configuration writes could also race an in-flight attach and
   apply stale state, and the deadline task count could get corrupted by
   concurrent updates, skewing SCHED_DEADLINE admission decisions.

 - Memory binding bug fixes: which node masks get applied differed
   between the binding update paths, and tasks cloned with
   CLONE_INTO_CGROUP skipped rebinding entirely. Rebinding also now runs
   once per process instead of repeating for every thread sharing the
   mm.

 - Overhead removals with no behavior change: CPU hotplug iterated tasks
   of cpusets that just inherit the parent's effective masks, and the
   slab-spreading task flag was still being maintained although the SLAB
   allocator that consumed it is long gone.

 - Data-race annotations for benign races so that KCSAN reports stay
   meaningful, selftest coverage for the fixes above along with
   flakiness and portability fixes, and documentation corrections.

* tag 'cgroup-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: (34 commits)
  selftests/cgroup: Remove redundant chown in test_cgcore_lesser_ns_open
  selftests/cgroup: Preserve CPU hotplug write errors
  cgroup/cpuset: Add test for partition root invalidation returning wrong CPUs
  cgroup/cpuset: Remove obsolete PFA_SPREAD_SLAB task flag
  docs: cgroup-v2: fix stale "io" controller introduction
  selftests/cgroup: Avoid awk -e in cpuset tests
  cgroup/cpuset: Use WRITE_ONCE() for shared prs_err updates
  selftests/cgroup: add user_usec sanity check in test_cpucg_nice
  cgroup: drop unneeded semicolon
  docs: cgroup-v2: mark memory.pressure and io.pressure as read-write
  selftests/cgroup: Fix minor defects in test_cpuset
  Docs/admin-guide/cgroup-v2: fix delay_nsec unit in io.latency doc
  selftests/cgroup: Remove redundant cg_enter_current() call in test_core
  selftests/cgroup: Add test for cpuset affinity on controller disable
  cgroup/cpuset: Handle the special case of non-moving tasks in cpuset_can_attach()
  cgroup/cpuset: Support multiple destination cpusets for cpuset_*attach()
  selftests/cgroup: fix missing TAP output in test_hugetlb_memcg
  cgroup/cpuset: Support multiple source cpusets for cpuset_*attach()
  cgroup/cpuset: Move mpol_rebind_mm/cpuset_migrate_mm() calls inside cpuset_attach_task()
  cgroup/cpuset: Make attach_ctx.old_cs track task group leader
  ...
2026-08-20 10:37:42 -07:00
Linus Torvalds
39e34e88ec workqueue: Changes for v7.3
- Worker wakeups moved out of pool->lock on the hot paths, shortening lock
   hold times. The wakeup can be expensive on arm64 due to the idle wakeup
   IPI, and the change improves the workqueue microbenchmark there by up to
   10%.
 
 - Stall diagnostics now report pools stuck with no running worker, with a
   backtrace of what the CPU is executing and the likely culprit worker,
   instead of dumping every in-flight worker.
 
 - Preparation for turning per-cpu workqueues into an affinity scope of
   unbound workqueues instead of a separate backend.
 
 - Race annotations for KCSAN and sparse warnings, and doc and monitoring
   script fixes.
 -----BEGIN PGP SIGNATURE-----
 
 iIQEABYKACwWIQTfIjM1kS57o3GsC/uxYfJx3gVYGQUCaoNxSg4cdGpAa2VybmVs
 Lm9yZwAKCRCxYfJx3gVYGWDfAP4tp2XFrNOOai4aCcWivKV99Arb0YFdjozM4vjX
 rx3HCwEAiwfLTduv+ZeLHYTIm3V3Nxrf246fitSEYUknb+Cx8QE=
 =XrZO
 -----END PGP SIGNATURE-----

Merge tag 'wq-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq

Pull workqueue updates from Tejun Heo:

 - Worker wakeups moved out of pool->lock on the hot paths, shortening
   lock hold times. The wakeup can be expensive on arm64 due to the idle
   wakeup IPI, and the change improves the workqueue microbenchmark
   there by up to 10%

 - Stall diagnostics now report pools stuck with no running worker, with
   a backtrace of what the CPU is executing and the likely culprit
   worker, instead of dumping every in-flight worker

 - Preparation for turning per-cpu workqueues into an affinity scope of
   unbound workqueues instead of a separate backend

 - Race annotations for KCSAN and sparse warnings, and doc and
   monitoring script fixes

* tag 'wq-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: (23 commits)
  workqueue: annotate racy p->wake_cpu accesses in kick_pool_pick()
  workqueue: BUG_ON() instead of returning NULL in wq_node_nr_active()
  workqueue: use RCU accessors when populating wq->cpu_pwq
  workqueue: use rcu_dereference_sched() in workqueue_congested()
  workqueue: skip the node_nr_active update for non-unbound workqueues
  workqueue: rename alloc_unbound_pwq() to alloc_pwq()
  workqueue: allocate attrs for all workqueues
  workqueue: rename wq->unbound_attrs to wq->attrs
  workqueue: test WQ_UNBOUND explicitly in the hotplug loops
  workqueue: account nr_active by the backing pool
  workqueue: release pwq pools by pool type
  workqueue: factor out alloc_and_link_percpu_pwqs()
  workqueue: factor out get_percpu_pool()
  docs: workqueue: Fix bracket
  workqueue: annotate racy sum_exec_runtime reads for CPU-intensive detection
  workqueue: annotate racy PWQ_STAT_CPU_TIME update in wq_worker_tick()
  workqueue: dump the last woken worker for stalled pools
  workqueue: trigger a single-CPU backtrace for stalled pools
  workqueue: only show running workers in stall diagnostics
  workqueue: defer the worker wakeup outside pool->lock in process_one_work()
  ...
2026-08-20 10:34:25 -07:00
Linus Torvalds
72fdff1416 It has been a not-too-busy cycle for docs; here's the highlights:
- A (hopefully) consensus change to our LLM-attribution requirements,
   removing the specific model name from the Assisted-by tag.
 
 - A couple of new realtime documents
 
 - Various docs-build-system fixes
 
 - Ongoing work with the Chinese, Portuguese, and Japanese translations.
 
 ...and lots of typo fixes, grammar tweaks, etc.
 -----BEGIN PGP SIGNATURE-----
 
 iQFDBAABCgAtFiEEIw+MvkEiF49krdp9F0NaE2wMflgFAmqDI84PHGNvcmJldEBs
 d24ubmV0AAoJEBdDWhNsDH5Yc2IH/Rq89biNmBQjQ+QX5hC0hZAUv8KyGeYiK6zx
 W6xoU62lYWx7IR4ZbOP5Z/+EVZALV3MDY4Tfd1JYcu+8+T6qNcTIbgCm5+R+AQrb
 BpD5eK/MovpWoErePJEK9/QbF2EjUkVmsDnPleJr6xvH11+RQH6TtctfY6ORFDTJ
 wc2rXEIuR3GBLMk8UAvDhRfJcvIuwESiV5JAQAhZ6lq9NW7ZVUHTy/XUs+MEHpuW
 xCwjAAw55maozO1uHzGGSRT03X4VJ/bug2MVBRN0AuRBvA/w0n3mg5DdqJt5r/+q
 bYEay3V4PRXAkxdo0vZHHhcpIBqMSWlmHLJtEIdzbxT4wkf2v6A=
 =7NXc
 -----END PGP SIGNATURE-----

Merge tag 'docs-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/docs/linux

Pull documentation updates from Jonathan Corbet:
 "It has been a not-too-busy cycle for docs; here's the highlights:

   - A (hopefully) consensus change to our LLM-attribution requirements,
     removing the specific model name from the Assisted-by tag

   - A couple of new realtime documents

   - Various docs-build-system fixes

   - Ongoing work with the Chinese, Portuguese, and Japanese
     translations

  ...and lots of typo fixes, grammar tweaks, etc"

* tag 'docs-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/docs/linux: (85 commits)
  Doc: admin-guide: pm: Remove unnecessary backticks and fix a spell
  Documentation: Extend the real-time hardware bits with some firmware bits
  docs: pt_BR: Reorganize process/index.rst to follow english structure
  docs: conf.py: fix the 'utf-8' typo
  doc tools: fix 'path' typos
  Documentation: real-time: Add kernel configuration guide
  docs: python: abi_regex: convert adjacent index placeholders
  docs: python: abi_regex: catch the right exception for a bad regex
  docs: sphinx-build-wrapper: include localversion in kernel version string
  Documentation: html: adjust sidebar section titles styling
  Documentation: html: show sections in the sidebar
  checkpatch.pl: adapt to new Assisted-by: format
  MAINTAINERS: update Traditional Chinese documentation maintainers
  docs: pt_BR: process: Translate CVE documentation
  docs: pt_BR: translate the management-style.rst to Brazilian Portuguese
  docs: xforms_lists: support DEFINE_IDTENTRY_IRQ()
  coding-assistants: simplify attribution
  docs: translations: pt_BR: translate email-clients.rst
  docs: pt_BR: process: Translate the security-bugs.rst
  doc:it_IT: align doc-guide translation
  ...
2026-08-20 10:31:50 -07:00
Kumar Kartikeya Dwivedi
175a58668e selftests/bpf: Test invalid DW LDSX diagnostics
An invalid BPF_MEMSX | BPF_DW instruction can reach Program Structure
diagnostics before opcode validation when placed at the end of a subprogram.
Exercise this path and require the disassembler fallback so table bounds
regressions are caught.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20260820022020.3450479-3-memxor@gmail.com
2026-08-20 18:45:44 +02:00
Linus Torvalds
9d2ed026f0 Summary
* Documentation
 
   Fix kernel-doc warnings by adjusting in file documentation.
 
 * Consolidate do_proc_* function into do_proc_vec.
 
   Consolidate three slightly different implementations of applying a converter
   on all elements of a vector. Fixes to this function now propagate to the three
   types.
 
 * Miscellaneous
 
   Replaced CONFIG_PROC_SYSCTL with CONFIG_SYSCTL (they were the same) and
   restrict cad_pid modifications to global root (GLOBAL_ROOT_UID)
 
 * Testing
 
   This series was run through sysctl selftests/kunit test suite in x86_64. And
   went into linux-next around rc2, giving it a bit more than a month of testing.
 -----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEErkcJVyXmMSXOyyeQupfNUreWQU8FAmp0ga8ACgkQupfNUreW
 QU9RZQv/UFBopK15/HcUPWAp8h0Yq68Reij0ryPhuOuoqRaWjLrz5iT9SvNW4IZH
 WfAHal9+gVyAov2TvZUDHE0iojYa1S7l1MSBSvzlEijZnbglnt+63Ijfria3FTr2
 FIqk7gOxCpDg7kRh1GkIm8yc6Ke7T2IcbMT8XW5PAs43QqMPgGfeUry14sr6H89u
 pc1vXS/PcRDdsKkYKADCuljGG3ywL/7frDhSRcc+5WkCACOujzosmXTL10TVVs7H
 6Lz3vujtQyCnv3UxlHicsJQXD60m2gqbCLcqa5gndfE5jO2nS3ZTqRBALT9Cimuk
 43k+cKgJwOa5ry9OFXmp+in57hgOg8AZqWWENY2W0RaU6Tw7Ui5x6z36ZtE5PR9u
 NlNAOprv6UnKOQ6Bc4GGtfSMh+EviqQBSNQroEz4UxLdrFx2X7SxkSgz5I6gLbzf
 w+KZpQ3Y3Kjvr9ywkQUftekWqaeapv/OfrjGXRwiIBYhlurmKqvFpjjSQXmjow9u
 RD1bfR9X
 =aYrQ
 -----END PGP SIGNATURE-----

Merge tag 'sysctl-7.03-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl

Pull sysctl updates from Joel Granados:

 - Fix kernel-doc warnings by adjusting in file documentation

 - Consolidate do_proc_* function into do_proc_vec

   Consolidate three slightly different implementations of applying a
   converter on all elements of a vector. Fixes to this function now
   propagate to the three types.

 - Replace CONFIG_PROC_SYSCTL with CONFIG_SYSCTL (they were the same)
   and restrict cad_pid modifications to global root (GLOBAL_ROOT_UID)

* tag 'sysctl-7.03-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl:
  sysctl: remove CONFIG_PROC_SYSCTL, it just mirrors CONFIG_SYSCTL
  sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[]
  sysctl: repair some kernel-doc comments
  sysctl: add Returns: kernel-doc for all functions
  sysctl: Update API function documentation
  sysctl: Rename proc_doulongvec_minmax_conv to proc_doulongvec_conv
  sysctl: Group proc_handler declarations and document
  sysctl: Replace do_proc_do{int,ulong,uint}vec with do_proc_vec
  sysctl: Add negp parameter to douintvec converter functions
  sysctl: Move default converter assignment out of do_proc_dointvec
2026-08-20 08:46:41 -07:00
Linus Torvalds
91ec203513 Networking changes for 7.3.
Core & protocols
 ----------------
 
  - A few steps lowering rtnl_lock dependence:
    - per-netns netdev unregistration for select SW drivers
      (e.g. veth, ipvlan, tunnels)
    - rtnl_lock-less FIB rule changes (RTM_NEWRULE and RTM_DELRULE)
    - prepare software drivers and TC qdiscs for rtnl_lock-less GET
 
  - Support BIG TCP (>64kB TSO) in UDP tunnels (vxlan, geneve).
 
  - Support buffers larger than PAGE_SIZE in devmem zero-copy API.
 
  - Improve MPTCP handling of extreme memory pressure handling,
    when out-of-order queue had to be pruned.
 
  - Report the per-group user count via RTM_GETMULTICAST.
 
  - Expose the route deletion reason in RTM_DELROUTE.
 
  - Add a SO_RIGHTS_NOTRUNC option to UNIX sockets to enable more useful
    handling of LSM denials when receiving SCM_RIGHTS messages: instead
    of truncating the message at the first blocked fd, keep every fd slot
    and store the LSM errno in the blocked slot.
 
  - IPv6 Segment Routing - support looking up the post-encap SID
    (address) in a different/specified routing table.
 
  - Support PRP RedBox (interlink) creation.
 
  - Support per-nexthop UDP dst port in VXLAN.
 
  - Continue converting getsockopt callbacks in a number of protocols
    to iov_iter.
 
 Ethernet
 --------
 
  - Marge initial CXL support for AMD/Solarflare NICs (shared branch
    with the CXL tree).
 
  - New drivers:
    - ADIN1140 10BASE-T1S MACPHY
    - Initial skeleton of Intel iXD and ZTE Dinghai drivers.
 
  - High-speed NICs:
    - AMD/Pensando:
      - support firmware flashing
    - Cisco (enic):
      - SR-IOV V2 admin channel and MBOX protocol
    - Huawei (hns3):
      - support for ethtool pfc_prevention_tout
    - nVidia/Mellanox:
      - support sharing bandwidth control across interfaces of
        the same device
    - Marvell (octeontx2-pf):
      - link RQ page pools to netdev for Netlink stats
    - Google vNIC:
      - XDP metadata support for DQ RDA
    - Microsoft vNIC:
      - support forcing full-page RX buffers
 
  - Other NICs:
    - Synopsys IP:
      - eic7700: support for eth1
    - Microchip (lan743x):
      - support for RMII interface
    - Wangxun:
      - support for ethtool -G and -C for VFs
      - add Tx timeout and PCIe error handling
    - Intel (igb/igc):
      - RSS key get/set support
      - support for forcing link speed without auto-negotiation
 
  - Switches:
    - NXP (dpaa2):
      - support bonding/LAG offload
    - Mediatek:
      - mt7530: EN7528 support
      - initial support for MT7628
    - Micrel (ksz8/9):
      - refactoring work to move towards library model
      - PTP support for KSZ8463
    - nVidia/Mellanox:
      - support rtnl-lock-less ethtool callbacks
    - Realtek:
      - rtl8366rb: use generic RTL83xx code
      - support SGMII and HSGMII for RTL8367S
 
  - PHYs:
    - Airoha:
      - EcoNet EN7528 PHY support
    - DAPU Telecom
      - DAPU Telecom DAP8211R(I) Gigabit PHY support
    - Realtek:
      - support RTL8261C_CG
      - support RTL8261D
 
 Wireless
 --------
 
  - nl80211: per-link statistics support for multi-link operation
 
  - mac80211: AQL/airtime-fairness support for multicast
 
  - Merge Peripheral Authentication Service (PAS) / TEE support
    for ath12k (shared branch with the firmware/qcom tree).
 
  - New drivers:
    - mm81x for Morse Micro Long-Range S1G devices
    - nxpwifi for NXP devices (mostly forked off from mwifiex)
 
  - Driver changes:
    - Broadcom (brcmfmac):
      - DPP support, some Cypress part update
    - MediaTek (mt76):
      - mt7928 support
      - mt7925 NAN support
      - mt7996 AP powersave improvements
    - Qualcomm (ath12k):
      - much kernel infrastructure integration work
      - AHB platform MultiPD support
    - Realtek (rt89):
      - LED support
      - RTL8922DE support
      - dual-BT coex for RTL8922D
    - Intel:
      - new FW version support
 
 Bluetooth
 ---------
 
  - HCI: add support for Shorter Connection Interval (SCI) feature.
 
  - af_bluetooth: add minimal context analysis annotations.
 
  - Driver changes:
    - Intel:
      - add Bluetooth SAR revision 2 support
      - add vendor_reset PCI sysfs for PLDR
    - Mediatek:
      - add USB IDs for MT7902 and MT7922 devices
    - Realtek:
      - add USB IDs for 8761CU and 8852BE devices
    - NXP:
      - add M.2 Bluetooth device support using pwrseq
 
 Misc
 ----
 
  - DPLL support for manual/numerical oscillator control (NCO)
    (implement in zl3073x).
 
  - MCTP support for MCTP over USB v1.1 (DMTF DSP0283).
 
  - Power-over-Ethernet: support Realtek PSE controllers.
 
  - Remove the IBM EHEA driver.
 
  - Remove tulip/xircom_cb driver.
 
 Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE6jPA+I1ugmIBA4hXMUZtbf5SIrsFAmqEwJ4ACgkQMUZtbf5S
 Irsegw//fmHJae525nxg3DHoXhrUz8EDDOVoLH6oyWyLQnh5bmbReAY/+oWA4m54
 3KKKO0b2rtgRvmY/7rnjAt3bjecYgCSjvZT7I+NosB0QbbBYc14PtHfYig9HffYm
 uCXfNJOk+aJ2QK4ncEvU2SjgE89Ya7cC+yARFBAwYx4zi/Qx24RB+ziOyvkQ8ksX
 atvMOZrnhwqvYUFOwnOLNHTpvdxB/ZsNwWY6iXcx6EYp9xrtPusbh3FlushWkwxH
 8cI/dNla44TcIKXAzRn0znRdgiEVmCMyHvOv7LKaOfy8P3I+knmuIf/mScYQqOEF
 T143HdXhVSBZFRtLtFKXIja/KsvCjX9lCeMn/2ak0brQDUREcacXxYbuZKDsNAAK
 zXt/+5qAcm/mO8W1gKR9Ulfli5bhFN4HKXgXMLjo5ucPtzfPxFN7HGxTiC3Cxv1v
 lSXexKaj74pNBVFmADrb5jWbq7oG+GzIdjzx3ycvm2q39Fr4nJ2SzrSPPNwc/ItQ
 IHv3tGLQKXlr8dl0+p2mDkRInmHXrawVNsB1UgN8E/jtcwT2QMwyWOV6s5G3uEDl
 a+0U/XsrPvDYBTUCRs/KaOJQGB90QkzLe9DATt159mf+rPzAX2/oCDo8xIEe+kWV
 aivP+YutFfMH/CSC9PMuvdLE2KmoPY4mibAeE4/4AYLKtJnc/yU=
 =zDto
 -----END PGP SIGNATURE-----

Merge tag 'net-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next

Pull networking updates from Jakub Kicinski:
 "One of the 'small improvements all over the place' releases for us.

  It's hard to draw any direct comparisons because summer vacations
  disrupted our patch processing (and presumably - generation) quite a
  bit.

  Quick and dirty count suggests we (Paolo and I) merged a very similar
  number of net (632) and net-next (648) patches. This is not telling
  the full story either because 1/3 to 1/2 of the net-next patches also
  *seem* like AI-driven low priority fixes, cleanups and clarifications.

  We are completely overwhelmed, of course. The glimmer of hope is that
  we secured sufficient LLM budget and access (thank you Meta!) to run
  reviews with multiple frontier models on each patch. This eliminates
  some hallucinations. That said, in terms of review, the LLMs can only
  do so much.

  The sad truth is that our APIs (especially for rare events like PCIe
  errors, timeouts etc) have always been racy, and now LLMs don't let us
  ignore that. I expect our direction for the next release will be to
  tweak the reviews a little bit more, but start shifting focus to
  letting the LLMs take care of the busy work - managing patchwork,
  automating common process complaints, editing commit messages, and
  maybe applying patches which already got "reviewed-by" tags from
  people we trust...

  Core & protocols:

   - A few steps lowering rtnl_lock dependence:
      - per-netns netdev unregistration for select SW drivers (e.g.
        veth, ipvlan, tunnels)
      - rtnl_lock-less FIB rule changes (RTM_NEWRULE and RTM_DELRULE)
      - prepare software drivers and TC qdiscs for rtnl_lock-less GET

   - Support BIG TCP (>64kB TSO) in UDP tunnels (vxlan, geneve)

   - Support buffers larger than PAGE_SIZE in devmem zero-copy API

   - Improve MPTCP handling of extreme memory pressure handling, when
     out-of-order queue had to be pruned

   - Report the per-group user count via RTM_GETMULTICAST

   - Expose the route deletion reason in RTM_DELROUTE

   - Add a SO_RIGHTS_NOTRUNC option to UNIX sockets to enable more
     useful handling of LSM denials when receiving SCM_RIGHTS messages:
     instead of truncating the message at the first blocked fd, keep
     every fd slot and store the LSM errno in the blocked slot

   - IPv6 Segment Routing - support looking up the post-encap SID
     (address) in a different/specified routing table

   - Support PRP RedBox (interlink) creation

   - Support per-nexthop UDP dst port in VXLAN

   - Continue converting getsockopt callbacks in a number of protocols
     to iov_iter

  Ethernet:

   - Merge initial CXL support for AMD/Solarflare NICs (shared branch
     with the CXL tree)

   - New drivers:
      - ADIN1140 10BASE-T1S MACPHY
      - Initial skeleton of Intel iXD and ZTE Dinghai drivers

   - High-speed NICs:
      - AMD/Pensando:
         - support firmware flashing
      - Cisco (enic):
         - SR-IOV V2 admin channel and MBOX protocol
      - Huawei (hns3):
         - support for ethtool pfc_prevention_tout
      - nVidia/Mellanox:
         - support sharing bandwidth control across interfaces
           of the same device
      - Marvell (octeontx2-pf):
         - link RQ page pools to netdev for Netlink stats
      - Google vNIC:
         - XDP metadata support for DQ RDA
      - Microsoft vNIC:
         - support forcing full-page RX buffers

   - Other NICs:
      - Synopsys IP:
         - eic7700: support for eth1
      - Microchip (lan743x):
         - support for RMII interface
      - Wangxun:
         - support for ethtool -G and -C for VFs
         - add Tx timeout and PCIe error handling
      - Intel (igb/igc):
         - RSS key get/set support
         - support for forcing link speed without auto-negotiation

   - Switches:
      - NXP (dpaa2):
         - support bonding/LAG offload
      - Mediatek:
         - mt7530: EN7528 support
         - initial support for MT7628
      - Micrel (ksz8/9):
         - refactoring work to move towards library model
         - PTP support for KSZ8463
      - nVidia/Mellanox:
         - support rtnl-lock-less ethtool callbacks
      - Realtek:
         - rtl8366rb: use generic RTL83xx code
         - support SGMII and HSGMII for RTL8367S

   - PHYs:
      - Airoha:
         - EcoNet EN7528 PHY support
      - DAPU Telecom
         - DAPU Telecom DAP8211R(I) Gigabit PHY support
      - Realtek:
         - support RTL8261C_CG
         - support RTL8261D

  Wireless:

   - nl80211: per-link statistics support for multi-link operation

   - mac80211: AQL/airtime-fairness support for multicast

   - Merge Peripheral Authentication Service (PAS) / TEE support for
     ath12k (shared branch with the firmware/qcom tree)

   - New drivers:
      - mm81x for Morse Micro Long-Range S1G devices
      - nxpwifi for NXP devices (mostly forked off from mwifiex)

   - Driver changes:
      - Broadcom (brcmfmac):
         - DPP support, some Cypress part update
      - MediaTek (mt76):
         - mt7928 support
         - mt7925 NAN support
         - mt7996 AP powersave improvements
      - Qualcomm (ath12k):
         - much kernel infrastructure integration work
         - AHB platform MultiPD support
      - Realtek (rt89):
         - LED support
         - RTL8922DE support
         - dual-BT coex for RTL8922D
      - Intel:
         - new FW version support

  Bluetooth:

   - HCI: add support for Shorter Connection Interval (SCI) feature

   - af_bluetooth: add minimal context analysis annotations

   - Driver changes:
      - Intel:
         - add Bluetooth SAR revision 2 support
         - add vendor_reset PCI sysfs for PLDR
      - Mediatek:
         - add USB IDs for MT7902 and MT7922 devices
      - Realtek:
         - add USB IDs for 8761CU and 8852BE devices
      - NXP:
         - add M.2 Bluetooth device support using pwrseq

  Misc:

   - DPLL support for manual/numerical oscillator control (NCO)
     (implement in zl3073x)

   - MCTP support for MCTP over USB v1.1 (DMTF DSP0283)

   - Power-over-Ethernet: support Realtek PSE controllers

   - Remove the IBM EHEA driver

   - Remove tulip/xircom_cb driver"

* tag 'net-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next: (1433 commits)
  net/mlx5e: do not HW-GRO coalesce small frames
  net: openvswitch: fix nf_connlabels leak in ovs_ct_init
  net: add missing ref_tracker_dir_exit() to alloc_netdev_mqs()
  net: openvswitch: fix flow mask use-after-free on flow deletion
  sctp: stop processing a packet once its association is deleted
  dpll: zl3073x: add PTP clock support
  dpll: zl3073x: add channel ToD, phase step and TIE operations
  dpll: zl3073x: scale poll interval proportionally to timeout
  ptp: vmclock: prevent read-only mappings from becoming writable
  ipv4: reject undersized MTUs in ip_do_fragment()
  bonding: initialize err for empty target lists
  net: dsa: initial support for MT7628 embedded switch
  net: dsa: initial MT7628 tagging driver
  net: phy: mediatek: add phy driver for MT7628 built-in Fast Ethernet PHYs
  dt-bindings: net: dsa: add MT7628 ESW
  net: pse-pd: realtek-pse-mcu: add UART transport
  net: pse-pd: realtek-pse-mcu: add I2C transport
  net: pse-pd: add Realtek PSE MCU core
  dt-bindings: net: pse-pd: add bindings for Realtek PSE MCU
  vsock: use sock_error() to consume sk_err after a failed connect
  ...
2026-08-20 08:16:04 -07:00
Linus Torvalds
5a8cd539ac Major changes:
- Redesign the verifier error reporting: failures now carry source and
   instruction annotations along with the causal event history that led
   to them, making program rejections far easier to debug and repair
   (Kumar Kartikeya Dwivedi)
 
 - Add arena argument support to kfuncs and struct_ops through the new
   __arena and __arena__nullable suffixes (Tejun Heo, Puranjay Mohan,
   Kumar Kartikeya Dwivedi, Ihor Solodrai)
 
 - Signed BPF program loader rework to accommodate both BPF and security
   community needs where the kernel runs the signature verification at
   BPF_PROG_LOAD time before the LSM admission hook (Daniel Borkmann)
 
 - Add a set of ksock kfuncs which let BPF LSM and syscall programs
   create, connect and send on UDP sockets in order to emit telemetry
   data (Mahe Tardy)
 
 - Unify helper and kfunc call argument verification and classify kfunc
   arguments purely from BTF into a generated bpf_func_proto which is
   computed once at add-call time (Amery Hung)
 
 Other features and fixes:
 
 - Enable EXECMEM_ROX_CACHE for BPF allocations on x86 (Mike Rapoport)
 
 - Add bidirectional VLAN support to bpf_fib_lookup() through the new
   BPF_FIB_LOOKUP_VLAN and BPF_FIB_LOOKUP_VLAN_INPUT flags
   (Avinash Duduskar)
 
 - Infer zext_dst from static register liveness analysis to fix 32-bit
   zero-extension semantics, and remove the artificial limitations on
   pointer types eligible for spilling (Eduard Zingerman)
 
 - Inline the numeric open-coded iterator kfuncs so that bpf_for() loops
   no longer pay a kfunc call on every iteration (Puranjay Mohan)
 
 - Add an arena-based bitmap data structure to libarena along with
   serial and parallel selftests (Emil Tsalapatis)
 
 - Teach resolve_btfids to discover kfuncs from the kernel's BTF ID sets
   and to emit kfunc BTF decl tags, reducing the kernel build's
   dependency on pahole features (Ihor Solodrai)
 
 - Add BPF_F_ADJ_ROOM_DECAP_* flags to bpf_skb_adjust_room() so that
   tunnel decapsulation can update the GSO and encapsulation state of
   the skb (Nick Hudson)
 
 - Fix the ring buffer pending_pos walk and the available-data
   accounting on 32-bit position wrap (Israel Téllez García)
 
 - Add memory usage accounting for arena maps and fix an mmap_lock
   deadlock on arena lock failure (Jiayuan Chen)
 
 - Add tracing_multi link info support to the kernel UAPI and bpftool,
   and refactor the stack map code to run with preemption disabled
   (Jiri Olsa)
 
 - Support BPF_F_EGRESS in bpf_redirect_peer() to emit the skb in the
   egress direction of the target's peer device (Jordan Rife)
 
 - Add a KF_SPINLOCK_SAFE kfunc flag so that providers, in particular
   modules, can declare kfuncs safe to call under bpf_spin_lock instead
   of relying on the verifier's hard-coded allowlist (Kaitao Cheng)
 
 - Introduce global percpu data for BPF programs with libbpf probing
   and bpftool skeleton support, and stop exposing uninitialized kernel
   heap memory when copying per-CPU map values (Leon Hwang)
 
 - Add s390 JIT support for load-acquire and store-release instructions
   (Maxim Khmelevskii)
 
 - Fix a CFI mismatch in the task work callback and an arm64 KASAN
   false positive after bpf_throw() (Mykyta Yatsenko)
 
 - Reject writes through untrusted BTF pointers and bound the
   rdonly/rdwr_buf_size kfunc arguments (Nicholas Dudar)
 
 - Invalidate RCU pointers only after the final spin unlock and account
   for preempt and IRQ disabled regions as overlapping RCU protection
   (Ning Ding)
 
 - Support mixing bpf2bpf calls and tail calls on RV64, add signed
   operations and 32-bit atomics to the RV32 JIT, and add timed may_goto
   support (Pu Lehui, Kuan-Wei Chiu, Feng Jiang)
 
 - Fix a use-after-free on mm_struct in bpf_find_vma() for foreign tasks
   and an mmap_lock leak in the irq_work path (Sanghyun Park)
 
 - Populate mmap-able BPF array map memory lazily which makes mmap() O(1)
   instead of proportional to the map size (Song Liu)
 
 - Introduce a jit_required flag and reject programs with inlined
   helpers when no JIT is available, where the interpreter would
   otherwise jump into an invalid address (Tiezhu Yang)
 
 - Fix the x86 JIT per-CPU address resolution into an extended register
   where the REX prefix dropped the high destination register bit
   (Vineet Gupta)
 
 - Reject MEM_ALLOC BTF accesses past object bounds, arena frees below
   the arena base, and mixed arena and ordinary atomic paths
   (Yiyang Chen)
 
 - Fix the trampoline handling of 128-bit arguments and of return values
   larger than 8 bytes (Yonghong Song)
 
 - Ensure that any fault prone load is rewritten with exception table
   handling, and fix the arena load-acquire and atomic fetch handling
   in the x86, arm64, riscv and s390 JITs (Daniel Borkmann)
 
 - Many more fixes and cleanups across the verifier, arena, trampolines,
   sockmap, cgroup, ring buffer, x86/arm64/riscv/s390 JITs, libbpf,
   bpftool, resolve_btfids and selftests.
 
 Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
 -----BEGIN PGP SIGNATURE-----
 
 iIsEABYKADMWIQTFp0I1jqZrAX+hPRXbK58LschIgwUCaoNzBBUcZGFuaWVsQGlv
 Z2VhcmJveC5uZXQACgkQ2yufC7HISIOb3QEAy5cyrLXY+VWofhsC9wULkHyETOdj
 oTkdohQomZp4VhEA/1RZXdHVS1ANFgreWv0fMorUOHEKv2ZuNokfk3LWgW4L
 =VRyL
 -----END PGP SIGNATURE-----

Merge tag 'bpf-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next

Pull bpf updates from Daniel Borkmann:
 "Major changes:

   - Redesign the verifier error reporting: failures now carry source
     and instruction annotations along with the causal event history
     that led to them, making program rejections far easier to debug and
     repair (Kumar Kartikeya Dwivedi)

   - Add arena argument support to kfuncs and struct_ops through the new
     __arena and __arena__nullable suffixes (Tejun Heo, Puranjay Mohan,
     Kumar Kartikeya Dwivedi, Ihor Solodrai)

   - Signed BPF program loader rework to accommodate both BPF and
     security community needs where the kernel runs the signature
     verification at BPF_PROG_LOAD time before the LSM admission hook
     (Daniel Borkmann)

   - Add a set of ksock kfuncs which let BPF LSM and syscall programs
     create, connect and send on UDP sockets in order to emit telemetry
     data (Mahe Tardy)

   - Unify helper and kfunc call argument verification and classify
     kfunc arguments purely from BTF into a generated bpf_func_proto
     which is computed once at add-call time (Amery Hung)

  Other features and fixes:

   - Enable EXECMEM_ROX_CACHE for BPF allocations on x86 (Mike Rapoport)

   - Add bidirectional VLAN support to bpf_fib_lookup() through the new
     BPF_FIB_LOOKUP_VLAN and BPF_FIB_LOOKUP_VLAN_INPUT flags (Avinash
     Duduskar)

   - Infer zext_dst from static register liveness analysis to fix 32-bit
     zero-extension semantics, and remove the artificial limitations on
     pointer types eligible for spilling (Eduard Zingerman)

   - Inline the numeric open-coded iterator kfuncs so that bpf_for()
     loops no longer pay a kfunc call on every iteration (Puranjay
     Mohan)

   - Add an arena-based bitmap data structure to libarena along with
     serial and parallel selftests (Emil Tsalapatis)

   - Teach resolve_btfids to discover kfuncs from the kernel's BTF ID
     sets and to emit kfunc BTF decl tags, reducing the kernel build's
     dependency on pahole features (Ihor Solodrai)

   - Add BPF_F_ADJ_ROOM_DECAP_* flags to bpf_skb_adjust_room() so that
     tunnel decapsulation can update the GSO and encapsulation state of
     the skb (Nick Hudson)

   - Fix the ring buffer pending_pos walk and the available-data
     accounting on 32-bit position wrap (Israel Téllez García)

   - Add memory usage accounting for arena maps and fix an mmap_lock
     deadlock on arena lock failure (Jiayuan Chen)

   - Add tracing_multi link info support to the kernel UAPI and bpftool,
     and refactor the stack map code to run with preemption disabled
     (Jiri Olsa)

   - Support BPF_F_EGRESS in bpf_redirect_peer() to emit the skb in the
     egress direction of the target's peer device (Jordan Rife)

   - Add a KF_SPINLOCK_SAFE kfunc flag so that providers, in particular
     modules, can declare kfuncs safe to call under bpf_spin_lock
     instead of relying on the verifier's hard-coded allowlist (Kaitao
     Cheng)

   - Introduce global percpu data for BPF programs with libbpf probing
     and bpftool skeleton support, and stop exposing uninitialized
     kernel heap memory when copying per-CPU map values (Leon Hwang)

   - Add s390 JIT support for load-acquire and store-release
     instructions (Maxim Khmelevskii)

   - Fix a CFI mismatch in the task work callback and an arm64 KASAN
     false positive after bpf_throw() (Mykyta Yatsenko)

   - Reject writes through untrusted BTF pointers and bound the
     rdonly/rdwr_buf_size kfunc arguments (Nicholas Dudar)

   - Invalidate RCU pointers only after the final spin unlock and
     account for preempt and IRQ disabled regions as overlapping RCU
     protection (Ning Ding)

   - Support mixing bpf2bpf calls and tail calls on RV64, add signed
     operations and 32-bit atomics to the RV32 JIT, and add timed
     may_goto support (Pu Lehui, Kuan-Wei Chiu, Feng Jiang)

   - Fix a use-after-free on mm_struct in bpf_find_vma() for foreign
     tasks and an mmap_lock leak in the irq_work path (Sanghyun Park)

   - Populate mmap-able BPF array map memory lazily which makes mmap()
     O(1) instead of proportional to the map size (Song Liu)

   - Introduce a jit_required flag and reject programs with inlined
     helpers when no JIT is available, where the interpreter would
     otherwise jump into an invalid address (Tiezhu Yang)

   - Fix the x86 JIT per-CPU address resolution into an extended
     register where the REX prefix dropped the high destination register
     bit (Vineet Gupta)

   - Reject MEM_ALLOC BTF accesses past object bounds, arena frees below
     the arena base, and mixed arena and ordinary atomic paths (Yiyang
     Chen)

   - Fix the trampoline handling of 128-bit arguments and of return
     values larger than 8 bytes (Yonghong Song)

   - Ensure that any fault prone load is rewritten with exception table
     handling, and fix the arena load-acquire and atomic fetch handling
     in the x86, arm64, riscv and s390 JITs (Daniel Borkmann)

   - Many more fixes and cleanups across the verifier, arena,
     trampolines, sockmap, cgroup, ring buffer, x86/arm64/riscv/s390
     JITs, libbpf, bpftool, resolve_btfids and selftests"

* tag 'bpf-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: (373 commits)
  selftests/bpf: Add tests for a store on a fault prone qdisc pointer
  selftests/bpf: Add tests for fault prone loads out of RCU pointers
  selftests/bpf: Add tests for pointer type merge at a shared load
  selftests/bpf: Remove duplicate copies of the arena spinlock qnodes
  selftests/bpf: Retry stat generation in cgroup_iter_memcg
  selftests/bpf: Test pseudo-function policy diagnostics
  bpf: Distinguish function references in policy diagnostics
  bpf: Preserve source attribution without source text
  selftests/bpf: Test kfunc argument diagnostics
  bpf: Correct kfunc argument diagnostics
  bpf: Use canonical stack argument names in diagnostics
  bpf: Preserve R0 lineage across helper calls
  selftests/bpf: Exercise negative optlen in cgroup getsockopt hook
  bpf: Reject negative optlen in cgroup getsockopt hook
  selftests/bpf: tc_tunnel - validate decap GSO and encapsulation state
  bpf: Clear decap state on skb_adjust_room shrink path
  bpf: Allow new DECAP flags and add guard rails
  bpf: Add BPF_F_ADJ_ROOM_DECAP_* flags for tunnel decapsulation
  bpf: Refactor masks for ADJ_ROOM flags and encap validation
  bpf: Name the enum for BPF_FUNC_skb_adjust_room flags
  ...
2026-08-20 07:36:20 -07:00
Breno Leitao
ecbccdbdab efi/runtime-wrappers: factor out efi_rts_park_worker()
x86's efi_crash_gracefully_on_page_fault() ends in an infinite
schedule() loop so the kworker that faulted in firmware never runs
efi_rts_wq again. A later change needs the same "park this worker
forever" primitive on the runtime service timeout path, so factor the
loop into a shared efi_rts_park_worker() and call it from the x86
page-fault handler.

No functional change.

Signed-off-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
2026-08-20 14:45:04 +03:00
Linus Torvalds
09005a6398 lsm/stable-7.3 PR 20260814
-----BEGIN PGP SIGNATURE-----
 
 iQJIBAABCgAyFiEES0KozwfymdVUl37v6iDy2pc3iXMFAmp/iWkUHHBhdWxAcGF1
 bC1tb29yZS5jb20ACgkQ6iDy2pc3iXPvbQ/8DT62doPc0ECTXQXcTNjBOddjNspB
 pk2mK238UQP50aU7/su4RdgmGG+spVoPc7oqeavnm2J+c552t0eHI61itYMe7nkY
 uOIjShLN93g9pjG4IqhmCDvGTpsQp9Oiec5F/6C++7OUT5oUqm/faXAZtwFLFgmx
 pTNf91w+u5s3DJjqG5zqEdteRrQMzDNozdq4YbNkzeIiofsUJvq6IJ6rV66kyOa/
 zk2hC6zI3mL0Vuin3WdxKqd1mD7mhYWxjl2nt/0TTIRMKmycxovlvbfADXXi2hlp
 4tALFgbEmeOgXr7HWvOqClNZ002/gG84Ty2F/8D/p0EGlzOc0Ga/q1dSAM/JJ5RZ
 bArXY3qgioU4/zOp998kXIYgRV3i6ZBBEzqTavcVtgCtNTgc2MH+KftD9HJaVjx8
 keRClwB85r72mNqKVcTVgQ8MJvA+Fq03JHc/JH3npv2tSPELK4V4vkW0nCGQsLXV
 /oX87E9/Wh6wWchvUTYToX5j6eNRUjD8xQzIAbPWTilusPcIp9pW58I6gaDKAu6A
 dNox9I064JfLK+LEmn8Le8AatTT0g/mj1wTD0KeRfo0zKyjSYoT0ECnXBeAfg9QI
 Vr6ZTXPM0fMpKEHqJvYLJAqVbm3kJKZqxr1z4nmz14elms1SmwdmOSq66Qm8fRCS
 P5fGVxFzNbDVZvs=
 =eToU
 -----END PGP SIGNATURE-----

Merge tag 'lsm-pr-20260814' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm

Pull LSM updates from Paul Moore:

 - Remove task_euid()

   The task_euid(), and Rust counterpart, was never widely used, for
   good reason, and now that the only user is gone we're removing it to
   rid ourselves of both dead and funky code.

 - Documentation improvements

   Correct some of the kdoc comments for security_task_prctl() and
   clarify the rust comments on task UID accessors.

 - Fix a memory leak in the LSM syscall selftests

* tag 'lsm-pr-20260814' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm:
  selftests/lsm: Fix memory leak in attr_lsm_count
  cred: delete task_euid()
  rust: task: clarify comments on task UID accessors
  lsm: clarify security_task_prctl() hook documentation
2026-08-19 16:28:23 -07:00
Linus Torvalds
081e5bf2a9 tracing updates for v7.3:
- Expose btf_ids to trace events
 
   In order to allow BPF programs to attach to system call trace events (which
   are actually pseudo trace events built on top of raw_syscall events),
   expose the BTF ID of the events. This will allow BPF programs better
   precision in attaching to events.
 
 - Use "u64" to assign to hist_field->type
 
   Instead of using kstrdup("u64", GFP_KERNEL) to assign the hist_field->type,
   just point it to "u64" instead. The hist_field->type is freed via
   kfree_const().
 
 - Replace kmalloc()/strcpy() with kstrdup() for trace_printk
 
   Instead of having two calls to copy the module format string, just use
   kstrdup().
 
 - Use __free() in trace event histograms and triggres where possible
 
 - Use seq_buf in trace event code instead of strcat()
 
   Instead of calculating the size of the buffer to use and filling it with
   strcat(), use the seq_buf infrastructure that takes care of making sure
   not to overflow the string size.
 
 - Reject invalid preemptirq_delay_test CPU affinity
 
   The preempt_delay_test module can take an invalid CPU affinity mask and
   create confusing output. Simply have the module reject invalid affinity
   masks.
 
 - Prevent division by zero in ftrace_ops sample module code
 
   If the ftrace_ops sample module code receives the module parameter
   nr_function_calls set to zero, it can cause a division by zero error.
 
 - Warn when an event dereferences a parameter in TP_printk()
 
   On boot up and module load, the trace event TP_printk() is scanned for
   possible bugs. As the TP_printk() code is executed when the user reads the
   "trace" file and processes the data written when the trace_event executed,
   the data it reads can be literally days old. The scan currently checks for
   dereferencing printk formats like "%pI6". But it does not check if the
   parameters themselves have a dereference like:
 
   TP_printk("offset %08x: value %08x",
            (u32)(__entry->addr - __entry->edma->membase), __entry->value)
 
   __entry represents the pointer to the event on the ring buffer. The
   __entry->edma->membase is dereferencing a pointer on the ring buffer to
   find membase, but the __entry->edma may no longer be a valid pointer.
 
   Warn on this case too.
 
 - Replace some strcpy() with strscpy()
 
 - Clean up mmiotrace events to use assign_type() macro
 
   The assign_type() macro makes sure the event type is indeed the type that
   is being parsed. The mmiotrace trace was written before that macro was
   created so it just simply typecasted the pointer.
 
   Replace the typecasting with the macro.
 
 - Have the ENUM processing to numbers only process what is added
 
   The code that converts ENUMs to their numbers in the trace events scanned
   all events to do the processing. This was true when a module was loaded
   too. That is, instead of processing just the events for the module, it
   processed *all* events. Even the builtin ones that were processed at boot
   up.
 
   Add a check for the event->module matching mod if it is a module before
   processing it.
 -----BEGIN PGP SIGNATURE-----
 
 iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCan+WhRQccm9zdGVkdEBn
 b29kbWlzLm9yZwAKCRAp5XQQmuv6qk1sAQDIvuux39ii379T9hTm7hgXF9Dr8aH7
 RgxILUmr3c4y6QD+Iv9QQto+NfauqjkEMdPuVdOyUpDCYPTRw9i/YCty7Qk=
 =vya7
 -----END PGP SIGNATURE-----

Merge tag 'trace-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Pull tracing updates from Steven Rostedt:

 - Expose btf_ids to trace events

   In order to allow BPF programs to attach to system call trace events
   (which are actually pseudo trace events built on top of raw_syscall
   events), expose the BTF ID of the events. This will allow BPF
   programs better precision in attaching to events.

 - Use "u64" to assign to hist_field->type

   Instead of using kstrdup("u64", GFP_KERNEL) to assign the
   hist_field->type, just point it to "u64" instead. The
   hist_field->type is freed via kfree_const().

 - Replace kmalloc()/strcpy() with kstrdup() for trace_printk

   Instead of having two calls to copy the module format string, just
   use kstrdup().

 - Use __free() in trace event histograms and triggres where possible

 - Use seq_buf in trace event code instead of strcat()

   Instead of calculating the size of the buffer to use and filling it
   with strcat(), use the seq_buf infrastructure that takes care of
   making sure not to overflow the string size.

 - Reject invalid preemptirq_delay_test CPU affinity

   The preempt_delay_test module can take an invalid CPU affinity mask
   and create confusing output. Simply have the module reject invalid
   affinity masks.

 - Prevent division by zero in ftrace_ops sample module code

   If the ftrace_ops sample module code receives the module parameter
   nr_function_calls set to zero, it can cause a division by zero error.

 - Warn when an event dereferences a parameter in TP_printk()

   On boot up and module load, the trace event TP_printk() is scanned
   for possible bugs. As the TP_printk() code is executed when the user
   reads the "trace" file and processes the data written when the
   trace_event executed, the data it reads can be literally days old.
   The scan currently checks for dereferencing printk formats like
   "%pI6". But it does not check if the parameters themselves have a
   dereference like:

	TP_printk("offset %08x: value %08x",
		(u32)(__entry->addr - __entry->edma->membase), __entry->value)

   __entry represents the pointer to the event on the ring buffer. The
   __entry->edma->membase is dereferencing a pointer on the ring buffer
   to find membase, but the __entry->edma may no longer be a valid
   pointer.

   Warn on this case too.

 - Replace some strcpy() with strscpy()

 - Clean up mmiotrace events to use assign_type() macro

   The assign_type() macro makes sure the event type is indeed the type
   that is being parsed. The mmiotrace trace was written before that
   macro was created so it just simply typecasted the pointer.

   Replace the typecasting with the macro.

 - Have the ENUM processing to numbers only process what is added

   The code that converts ENUMs to their numbers in the trace events
   scanned all events to do the processing. This was true when a module
   was loaded too. That is, instead of processing just the events for
   the module, it processed *all* events. Even the builtin ones that
   were processed at boot up.

   Add a check for the event->module matching mod if it is a module
   before processing it.

* tag 'trace-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (21 commits)
  tracing: Have trace_event_update_all() only handle module that is loading
  tracing: Cleanup event_enable_trigger_parse() by using __free()
  tracing: Report every TP_printk double dereference
  tracing/mmiotrace: Use trace_assign_type() in mmio_print_mark()
  tracing: Make per-template BTF id lists file-local
  tracing: Use seq_buf for string concatenation
  tracing: Use strscpy() instead of strcpy() in trace_sched_switch
  tracing: Warn when an event dereferences a pointer in TP_printk()
  samples/ftrace: Prevent division by zero when nr_function_calls is zero
  tracing: Reject invalid preemptirq_delay_test CPU affinity
  fgraph: Use trace_seq_putc() in print_graph_return()
  tracing/user_events: Replace a seq_printf() call by seq_puts() in user_seq_show()
  tracing/user_events: Use seq_putc() in two functions
  tracing: Bound histogram expression strings with seq_buf
  tracing: Return ERR_PTR() from expr_str()
  tracing: Use __free() for expr_str() buffer
  kernel/trace/trace_printk: Use kstrdup() instead of kmalloc() and strcpy()
  tracing: Point constant hist field type to string literal
  selftests/bpf: Add test for tracepoint btf_ids tracefs file
  tracing: Expose tracepoint BTF ids via tracefs
  ...
2026-08-19 14:06:14 -07:00
Linus Torvalds
00d66b29a6 ftrace updates for 7.3:
- Deprecrate ftrace_enabled in disabling ftrace
 
   The file /proc/sys/kernel/ftrace_enabled was created when ftrace was first
   introduced back in 2008. It was to be a "kill switch" if something was to
   go wrong. It was also used as a way to turn off function tracing for the
   latency tracers that would have it on by default. But in 2013 (Linux 3.10)
   the option "function-trace" was introduced to disable function tracing for
   the latency tracers as the "ftrace_enabled" file was considered too big of
   a hammer and caused too many side effects.
 
   When live kernel patching came along, disabling ftrace via the
   ftrace_enabled file would put the system into an unstable state if a live
   kernel patch was installed. This created the need to mark some function
   hooks as "PERMANENT".
 
   Now there's a need for BPF usage marked as PERMANENT for the same reasons.
 
   The file "ftrace_enabled" usage is no longer viable. It doesn't do what it
   says it does and there is no reason to use it.
 
   Make writing '0' to it a nop and print a message saying its usage is
   deprecated. The return value of writing '0' is -EOPNOTSUPP so that user
   space will error on that write (hopefully to inform any developer that it
   no longer works).
 
   Eventually the file should be removed completely, but for now just making
   it not do anything is the path forward to that.
 
 - Update the livepatch tests to handle ftrace_enabled being disabled
 
   Because in the past, livepatch was broken by ftrace_enabled being turned
   off, there's a test case that checks to make sure it still doesn't break.
   But having the write of '0' return an error caused that test to break.
   Updated the test to handle the new change.
 -----BEGIN PGP SIGNATURE-----
 
 iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCan9buBQccm9zdGVkdEBn
 b29kbWlzLm9yZwAKCRAp5XQQmuv6qkrAAP9lStpPUUVGUVprdRttG8tv4LlSMqX3
 +A5WdksIKD+XMAD+ODdXKQkjynRpTf9YnIV3PXNg6Adi3ItOXG1+UsbWGQY=
 =QLhM
 -----END PGP SIGNATURE-----

Merge tag 'ftrace-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Pull ftrace updates from Steven Rostedt:

 - Deprecrate ftrace_enabled in disabling ftrace

   The file /proc/sys/kernel/ftrace_enabled was created when ftrace was
   first introduced back in 2008. It was to be a "kill switch" if
   something was to go wrong. It was also used as a way to turn off
   function tracing for the latency tracers that would have it on by
   default. But in 2013 (Linux 3.10) the option "function-trace" was
   introduced to disable function tracing for the latency tracers as the
   "ftrace_enabled" file was considered too big of a hammer and caused
   too many side effects.

   When live kernel patching came along, disabling ftrace via the
   ftrace_enabled file would put the system into an unstable state if a
   live kernel patch was installed. This created the need to mark some
   function hooks as "PERMANENT".

   Now there's a need for BPF usage marked as PERMANENT for the same
   reasons.

   The file "ftrace_enabled" usage is no longer viable. It doesn't do
   what it says it does and there is no reason to use it.

   Make writing '0' to it a nop and print a message saying its usage is
   deprecated. The return value of writing '0' is -EOPNOTSUPP so that
   user space will error on that write (hopefully to inform any
   developer that it no longer works).

   Eventually the file should be removed completely, but for now just
   making it not do anything is the path forward to that.

 - Update the livepatch tests to handle ftrace_enabled being disabled

   Because in the past, livepatch was broken by ftrace_enabled being
   turned off, there's a test case that checks to make sure it still
   doesn't break. But having the write of '0' return an error caused
   that test to break. Updated the test to handle the new change.

* tag 'ftrace-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  selftests/livepatch: update test-ftrace.sh for deprecated ftrace_enabled
  ftrace: deprecate disabling via ftrace_enabled sysctl
2026-08-19 14:01:58 -07:00
Linus Torvalds
3793b558ff RTLA updates for v7.3
- Extend support for unsetting CLI options
 
   libsubcmd auto-generates "--no-<option>" to unset options, provided
   the option callback supports it. Implement this for RTLA CLI beyond
   boolean options, and document the few exceptions that are left out.
 
 - Test all tracer options in runtime tests
 
   Verify that RTLA sets osnoise/timerlat options correctly by reading them
   from tracefs during runtime tests.
 
 - Improve range validation for option arguments
 
   Make CLI range validation consistent with the kernel limits and unify
   implementation and error messages between options.
 
 - Improve invalid option argument parsing
 
   Consistently reject invalid values for numeric option arguments with
   a unified error message for all options.
 -----BEGIN PGP SIGNATURE-----
 
 iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCan+DpBQccm9zdGVkdEBn
 b29kbWlzLm9yZwAKCRAp5XQQmuv6qpEsAP90dBAnAxttyHCUIfdDJuVZRRu2EXzn
 xuBVPvL2sMt89wEA8Un0jTztzmGEUohIWpUG4tQJ7Ebi9xGYqkbmcymbKQo=
 =aUyh
 -----END PGP SIGNATURE-----

Merge tag 'trace-tools-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Pull RTLA updates from Steven Rostedt:

 - Extend support for unsetting CLI options

   libsubcmd auto-generates "--no-<option>" to unset options, provided
   the option callback supports it. Implement this for RTLA CLI beyond
   boolean options, and document the few exceptions that are left out.

 - Test all tracer options in runtime tests

   Verify that RTLA sets osnoise/timerlat options correctly by reading
   them from tracefs during runtime tests.

 - Improve range validation for option arguments

   Make CLI range validation consistent with the kernel limits and unify
   implementation and error messages between options.

 - Improve invalid option argument parsing

   Consistently reject invalid values for numeric option arguments with
   a unified error message for all options.

* tag 'trace-tools-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  rtla/cli: Unify and improve handling of invalid option arguments
  rtla/cli: Unify and improve range validation logic
  rtla/tests: Test all tracer options in runtime tests
  Documentation/rtla: Document unsetting options
  rtla: Add unit tests for CLI with unset
  rtla: Add unit tests for unset in opt callbacks
  rtla: Allow unsetting non-list custom-callback CLI options
2026-08-19 14:00:15 -07:00
Linus Torvalds
55ee4b931a Real-time Verifier updates for v7.3
- Switch LTL and DOT parsers to Lark in code generation tool
 
   The rvgen code generation tool originally parsed DOT files and LTL
   specifications using custom string parsing and Ply, which is no longer
   maintained. The DOT parser was fragile and prone to failure on minor
   format variations. Both LTL and DOT parsers have been rewritten to use
   the Lark parsing library.
 
 - Simplify Hybrid Automata clock variables
 
   The clock variables in hybrid automata monitors now use a single
   representation of the elapsed time since the clock was reset, rather
   than converting between invariant and guard representations.
   This allows simpler code generation for the newly refactored parser.
 
 - Generate cleanup hook for per-obj monitor
 
   The code generation scripts now adds a cleanup function to per-obj
   monitors for the user to wire to the appropriate event (e.g.
   sched_process_exit for tasks).
 
 - Reduce read_lock scope during per-task cleanup
 
   Take the tasklist_lock only when necessary, that is when iterating
   over for_each_process_thread().
 
 - Simplify task monitor slot management
 
   Only rely on the slot array for per-task slot management to avoid
   inconsistency with the unused counter.
 
 - Improve rvgen code robustness and templates
 
   Use pathlib in rvgen and improve kernel path discovery. Also improve
   consistency across templates when generating code (e.g. author
   placeholder and monitor struct name).
 
 - Update rtapp sleep monitor
 
   Simplify the sleep monitor by excluding kernel threads and
   updating the nanosleep check to focus only on CLOCK_REALTIME. Also
   switch to use the sched_exit tracepoint to run in the context of the
   offending (wakee) task.
 
 - Add wakeup monitor
 
   Add the new rtapp/wakeup monitor to detect when lower-priority tasks
   wake up higher-priority ones, complementing the existing sleep monitor
   by running in the waker context and capturing its stack trace.
 
 - Fix tools/rv exit status on failure
 
   Ensure the rv tool returns a failure exit code when a monitor fails to
   start because it was already running.
 
 - Add automated selftests for tools/rv and rvgen
 
   Introduced automated bash selftests to validate rv monitor listing and
   execution under different configurations. Added tests for the rvgen code
   generator, validating generated files against expected output (golden).
   Tests are reachable via make check.
 
 - Add KUnit test coverage for verification monitors
 
   Added comprehensive KUnit tests to validate the functionality of
   deterministic, hybrid, and LTL monitors by emulating event sequences
   and timing in a mock environment without affecting the running kernel
   while expecting mock reactions to fire. Ensure real RV monitors cannot
   run during KUnit tests to avoid state corruption.
 
 - Mock current in rv monitors
 
   Mock the call to current in rv monitors when the KUnit tests are built
   to allow them to run the test on dummy tasks. No overhead is expected
   when KUnit tests aren't running.
 
 - Introduce rvgen kunit subcommand
 
   Added a new 'kunit' subcommand to rvgen to automatically patch an already
   generated monitor with KUnit integration templates by parsing its event
   handlers and creating the required mock structures and initializations.
 
 - Refine kernel verification selftests
 
   Added new selftests for the deadline and stall monitors and rearranged
   the existing wwnr_printk test to resolve flakiness.
   Additionally, fixed an issue in the selftests framework where negative
   assertion failures were not correctly propagated due to shell rules.
 
 - Fix 32-bit build of nomiss KUnit test
 
   A previous commit introduced a division between an u64 and a constant
   value and that doesn't build on 32-bit systems. Use div_u64() instead.
 
 - Document changes in sleep monitor
 
   The sleep monitor introduced some changes in the past like allowing
   epoll_wait() as a valid sleep and a task going to runnable before
   scheduling as a valid wakeup. Document both.
 -----BEGIN PGP SIGNATURE-----
 
 iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCan+BsRQccm9zdGVkdEBn
 b29kbWlzLm9yZwAKCRAp5XQQmuv6qicKAQD5aLUnn4zrZGuT+k5qmNmmbOsAXriS
 g+TfUXShvRoL6QD+KrsUyNf9KzLd+IqJG1N3G3wbhOiVd60Y5srLZP87UgA=
 =iqRx
 -----END PGP SIGNATURE-----

Merge tag 'trace-rv-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Pull Real-time Verifier updates from Steven Rostedt:

 - Switch LTL and DOT parsers to Lark in code generation tool

   The rvgen code generation tool originally parsed DOT files and LTL
   specifications using custom string parsing and Ply, which is no
   longer maintained. The DOT parser was fragile and prone to failure on
   minor format variations. Both LTL and DOT parsers have been rewritten
   to use the Lark parsing library.

 - Simplify Hybrid Automata clock variables

   The clock variables in hybrid automata monitors now use a single
   representation of the elapsed time since the clock was reset, rather
   than converting between invariant and guard representations. This
   allows simpler code generation for the newly refactored parser.

 - Generate cleanup hook for per-obj monitor

   The code generation scripts now adds a cleanup function to per-obj
   monitors for the user to wire to the appropriate event (e.g.
   sched_process_exit for tasks).

 - Reduce read_lock scope during per-task cleanup

   Take the tasklist_lock only when necessary, that is when iterating
   over for_each_process_thread().

 - Simplify task monitor slot management

   Only rely on the slot array for per-task slot management to avoid
   inconsistency with the unused counter.

 - Improve rvgen code robustness and templates

   Use pathlib in rvgen and improve kernel path discovery. Also improve
   consistency across templates when generating code (e.g. author
   placeholder and monitor struct name).

 - Update rtapp sleep monitor

   Simplify the sleep monitor by excluding kernel threads and updating
   the nanosleep check to focus only on CLOCK_REALTIME. Also switch to
   use the sched_exit tracepoint to run in the context of the offending
   (wakee) task.

 - Add wakeup monitor

   Add the new rtapp/wakeup monitor to detect when lower-priority tasks
   wake up higher-priority ones, complementing the existing sleep
   monitor by running in the waker context and capturing its stack
   trace.

 - Fix tools/rv exit status on failure

   Ensure the rv tool returns a failure exit code when a monitor fails
   to start because it was already running.

 - Add automated selftests for tools/rv and rvgen

   Introduced automated bash selftests to validate rv monitor listing
   and execution under different configurations. Added tests for the
   rvgen code generator, validating generated files against expected
   output (golden). Tests are reachable via make check.

 - Add KUnit test coverage for verification monitors

   Added comprehensive KUnit tests to validate the functionality of
   deterministic, hybrid, and LTL monitors by emulating event sequences
   and timing in a mock environment without affecting the running kernel
   while expecting mock reactions to fire. Ensure real RV monitors
   cannot run during KUnit tests to avoid state corruption.

 - Mock current in rv monitors

   Mock the call to current in rv monitors when the KUnit tests are
   built to allow them to run the test on dummy tasks. No overhead is
   expected when KUnit tests aren't running.

 - Introduce rvgen kunit subcommand

   Added a new 'kunit' subcommand to rvgen to automatically patch an
   already generated monitor with KUnit integration templates by parsing
   its event handlers and creating the required mock structures and
   initializations.

 - Refine kernel verification selftests

   Added new selftests for the deadline and stall monitors and
   rearranged the existing wwnr_printk test to resolve flakiness.
   Additionally, fixed an issue in the selftests framework where
   negative assertion failures were not correctly propagated due to
   shell rules.

 - Fix 32-bit build of nomiss KUnit test

   A previous commit introduced a division between an u64 and a constant
   value and that doesn't build on 32-bit systems. Use div_u64()
   instead.

 - Document changes in sleep monitor

   The sleep monitor introduced some changes in the past like allowing
   epoll_wait() as a valid sleep and a task going to runnable before
   scheduling as a valid wakeup. Document both.

* tag 'trace-rv-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (40 commits)
  Documentation/rv: Explain epoll and aborted sleeps
  rv: Fix 32-bit build of nomiss KUnit test
  selftests/verification: Add selftests for deadline and stall monitors
  selftests/verification: Rearrange the wwnr_printk test
  selftests/verification: Fix wrong errexit assumption
  rv: Add KUnit tests for some LTL monitors
  rv: Add KUnit mock for current
  rv: Add KUnit tests for some DA/HA monitors
  rv: Export task monitor slot and react symbols
  verification/rvgen: Add selftests for rvgen kunit
  verification/rvgen: Add the rvgen kunit subcommand
  verification/rvgen: Add selftests
  verification/rvgen: Add golden and spec folders for tests
  tools/rv: Add selftests
  verification/rvgen: Improve consistency in template files
  verification/rvgen: Use pathlib instead of os.path
  verification/rvgen: Improve rv_dir discovery in RVGenerator
  tools/rv: Fix exit status when monitor execution fails
  rv: Use generic rv_this for the rv_monitor variable in LTL
  rv/rtapp: Add wakeup monitor
  ...
2026-08-19 13:29:22 -07:00
Hemanth Selam
0c893d170f selftests/cgroup: set the test plan after the setup checks
The cgroup tests announce their plan before checking whether cgroup v2 is
available, so on a host without it they promise a number of results and
then skip out after the first one:

	TAP version 13
	1..3
	ok 1 # SKIP cgroup v2 isn't mounted
	# Planned tests != run tests (3 != 1)
	# Totals: pass:0 fail:0 xfail:0 xpass:0 skip:1 error:0

ksft_exit_skip() can only emit a well formed "1..0 # SKIP" line while no
plan has been printed, as the comment above it in kselftest.h points out.

Move ksft_set_plan() below the setup checks that can skip, so that a
skipped run reports:

	TAP version 13
	1..0 # SKIP cgroup v2 isn't mounted

Several of the tests skip more than once while setting up, for a missing
or unwritable controller as well, so the plan goes after the last of
them.  test_core joins its two setup paths at the post_v2_setup label and
sets the plan there.

Reporting each planned test as skipped instead would keep the plan where
it is, but the setup failures here mean the whole test cannot run rather
than its individual cases being skipped, which is what "1..0 # SKIP" is
for.

Fixes: 1dc830ee4c ("selftests/cgroup: conform test to KTAP format output")
Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com>
Reviewed-by: Sarthak Sharma <sarthak.sharma@arm.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-19 10:04:43 -10:00
Oliver Upton
5f44f603b0 Merge branch 'kvm-arm64/feat-nv3' into next
* kvm-arm64/feat-nv3: (29 commits)
  : Support for FEAT_NV2p1 and FEAT_NV3, courtesy of Marc Zyngier
  :
  : Couple of accelerations for nested virtualization:
  :
  :  - Elide traps for EL1 alias registers when hardware guarantees that
  :    EL2-only bits are stateful (NV2p1)
  :
  :  - Use TGE-aware hardware to avoid unnecesary ERET/TLBI traps that
  :    remain 'in-context' (i.e. L1 kernel/userspace)
  arm64: Add override for ID_AA64MMFR4_EL1.NV_frac
  KVM: arm64: selftest: Add NVHCR_EL2 to get-reg-list
  KVM: arm64: Expose FEAT_NV3 to guests
  KVM: arm64: Add FEAT_NV3 detection
  KVM: arm64: Engage NV3 TLBI trap elision
  KVM: arm64: Engage NV3 ERET trap elision
  KVM: arm64: Add NVHCR_EL2 context switching
  KVM: arm64: Add routing for NVHCR_EL2 trap
  KVM: arm64: Add NVHCR_EL2 handling to the sysreg array
  KVM: arm64: Add sanitisation for NVHCR_EL2
  KVM: arm64: Make HCR_EL2 a non-VNCR register
  KVM: arm64: Add kvm_has_nv{2,3}() predicates
  KVM: arm64: Add NV3 control bits to HCRX_EL2 sanitisation
  KVM: arm64: Split NV-specific exit fixups from the non-NV handling
  arm64: Add ARM64_HAS_NV3 capability
  arm64: sysreg: Add HCRX_EL2 bits related to FEAT_NV3
  arm64: sysreg: Add NVHCR_EL2 description as a mirror of HCR_EL2
  arm64: Add FEAT_NV2p1 detection
  KVM: arm64: Expose FEAT_NV2p1 to NV guests
  KVM: arm64: Relax CNTHCTL_EL2 handling when FEAT_NV2p1 is present
  ...

Signed-off-by: Oliver Upton <oupton@kernel.org>
2026-08-19 12:27:53 -07:00
Oliver Upton
5279b2f422 Merge branch 'kvm-arm64/pkvm-7.3' into next
* kvm-arm64/pkvm-7.3: (26 commits)
  : pKVM updates for 7.3
  :
  :  - Avoid name collision on trace_clock() when CONFIG_NVHE_EL2_TRACING is
  :    disabled (Mostafa Saleh)
  :
  :  - Clean up state tracking for whether the EL2 shadow VM has been
  :    created (Fuad Tabba)
  :
  :  - Synchronize SCTLR_EL1 when injecting an exception to use current
  :    PAN/SSBS state (Fuad Tabba)
  :
  :  - Avoid unnecessary cache maintenance when I/D-cache are known to be
  :    coherent in pKVM (Mostafa Saleh)
  :
  :  - Lazy vCPU context save/restore for pKVM (Fuad Tabba)
  :
  :  - Various fixes to the stage-2 MMU for pKVM (Fuad Tabba)
  :
  :  - Allow counter offsetting of non-protected guests in protected mode
  :    (Mostafa Saleh)
  :
  :  - Condition the 'broken CNTVOFF' mitigation on a VM actually having a
  :    nonzero offset, fixing boot failures of pVMs on affected hardware
  :    (Mostafa Saleh)
  KVM: arm64: Fix hvhe and broken CNTVOFF_EL2
  KVM: arm64: Fix timer offsets for non-protected VMs
  KVM: arm64: Make timer_get_offset() work in all contexts
  KVM: arm64: selftests: Add stage-2 block transition test
  KVM: arm64: Don't advertise eager page splitting under pKVM
  KVM: arm64: Don't WARN on pKVM stage-2 map failures
  KVM: arm64: Skip pKVM stage-2 flush when FWB is enabled
  KVM: arm64: Top up stage-2 memcache for dirty logging faults
  KVM: arm64: Top up the memcache for pKVM permission faults
  KVM: arm64: Skip cache maintenance for non-cacheable pKVM mappings
  KVM: arm64: Implement lazy vCPU state sync for non-protected guests
  KVM: arm64: Add primitives to flush/sync the VGIC state at EL2
  KVM: arm64: Minimise EL2's exposure of host VGIC state during world switch
  KVM: arm64: Add host and hypervisor vCPU lookup primitives
  KVM: arm64: Move PSCI helper functions to a shared header
  KVM: arm64: Factor out reusable vCPU reset helpers
  KVM: arm64: Make vcpu_{read,write}_sys_reg available to HYP code
  KVM: arm64: Extract MPIDR computation into a shared header
  KVM: arm64: selftests: Add a userspace watchpoint test
  KVM: arm64: Flush external_mdscr_el1 to the pKVM hyp vCPU
  ...

Signed-off-by: Oliver Upton <oupton@kernel.org>
2026-08-19 12:27:35 -07:00
Oliver Upton
f181451283 Merge branch 'kvm-arm64/pmu-7.3' into next
* kvm-arm64/pmu-7.3:
  : vPMU updates for 7.3
  :
  :  - Support for slot-based PMU events, relying on new UAPI that makes
  :    selection of a vPMU implementation mandatory (Congkai Tan)
  KVM: arm64: Add KVM_ARM_VCPU_PMU_V3_STRICT vCPU feature
  KVM: arm64: Ignore writes to PMCR_EL0.N when using strict UAPI
  KVM: arm64: Advertise STALL_SLOT* in PMCEID1 under strict PMUv3 UAPI
  KVM: arm64: Expose PMMIR_EL1.SLOTS under strict PMUv3 UAPI

Signed-off-by: Oliver Upton <oupton@kernel.org>
2026-08-19 12:27:30 -07:00
Linus Torvalds
307b9ddbbc spi: Updates for v7.3
Along with a lot of driver specific work we've got a couple of core
 features here.  The bigger one is that we've now got support for
 instantiating devices from sysfs similarly to how it's already done for
 I2C, this is used with development boards with non-enumerable expansion
 headers since SPI devices need to be manually specified.  We also have
 support for the DQS signal on higher end flash devices.
 
  - Support for intantiating devices from sysfs, useful for development
    boards with non-enumerable plugin modules, from Vishwaroop A.
  - Support for DQS in spi-mem, an additional signal used by flash
    devices to avoid clock skew from Miquel Raynal.
  - Support for more advanced SPI modes on DesignWare controllers from
    Sudip Mukherjee.
  - Changes from Jisheng Zhang to update to modern methods of specifying
    the PM callbacks.
  - Fixes for DMA mapping error handling, plus KUnit tests for this, from
    Honghui Jiang.
  - Substantial cleanup and performance work in the nxp-spi driver.
  - Support for Microchip LAN969x, Nuvoton MA35D1 QSPI, Qualcomm SA8255p
    and SA8797P, and StarFive JHB100 SFC.
 
 There is a trivial add/add conflict with the KUnit tree in their
 all_tests.config.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmqDOgcACgkQJNaLcl1U
 h9BKxQf/QznwKffXtoEL4ZFVBckmuYXRzbkHLoX1v7upZ3QFEPG8K6rRySaXufDI
 BX3/W14CfjXANIwWCr7llQmXLBoyOq8faz8U2h/aLnBpbI4WzZELfw49Lh9JQVk5
 dxVwWQ674UFuyRC4B8QaPqMFdbn8a1CORa5Rqg/dyenxwxgsVCyl2qz+PTLVdCGH
 IWO1WW6ZISDJ5YovzMcHM4KBgut1gO6FDtz0DEj2GQC+JpCl8oHyF7E/RQ2E+Nv+
 LWb6nCLfp4z3/68zQ2UrcXa1crdGsdEIFJFwV8FUYdmv24TSD+/pClczK57h422v
 Ros+Krb7fOTE+YCXqFcZgg8IGupZsw==
 =5wbJ
 -----END PGP SIGNATURE-----

Merge tag 'spi-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi

Pull spi updates from Mark Brown:
 "Along with a lot of driver specific work we've got a couple of core
  features here. The bigger one is that we've now got support for
  instantiating devices from sysfs similarly to how it's already done
  for I2C, this is used with development boards with non-enumerable
  expansion headers since SPI devices need to be manually specified. We
  also have support for the DQS signal on higher end flash devices.

   - Support for instantiating devices from sysfs, useful for
     development boards with non-enumerable plugin modules, from
     Vishwaroop A.

   - Support for DQS in spi-mem, an additional signal used by flash
     devices to avoid clock skew from Miquel Raynal.

   - Support for more advanced SPI modes on DesignWare controllers from
     Sudip Mukherjee.

   - Changes from Jisheng Zhang to update to modern methods of
     specifying the PM callbacks.

   - Fixes for DMA mapping error handling, plus KUnit tests for this,
     from Honghui Jiang.

   - Substantial cleanup and performance work in the nxp-spi driver.

   - Support for Microchip LAN969x, Nuvoton MA35D1 QSPI, Qualcomm
     SA8255p and SA8797P, and StarFive JHB100 SFC"

* tag 'spi-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (132 commits)
  spi: Add KUnit coverage for DMA mapping error paths
  spi: Clear current DMA devices when unmapping a message
  spi: Move __spi_unmap_msg() before __spi_map_msg()
  spi: Fix DMA mapping ownership on partial map failure
  spi: dt-bindings: sun6i: Add compatibles for A733's SPI controllers
  spi: ma35d1-qspi: Use the existing update helper
  spi: ma35d1-qspi: Add DTR support
  spi: ma35d1-qspi: Allow several command bytes
  spi: ma35d1-qspi: Move speed setting to bus configuration
  spi: ma35d1-qspi: Remove redundant reset operation
  spi: dw: Remove shadowed dws in dw_spi_setup()
  spi: img-spfi: don't disable runtime PM on DMA deferred probe
  spi: mtk-nor: Propagate errors from IRQ request
  spi: mtk-nor: Propagate errors from optional IRQ lookup
  spi: spi-qpic-snand: Handle Macronix quad read opcode 0x6b
  spi: spi-qpic-snand: add quad mode support
  spi: spi-qpic-snand: move command mapping helper
  spi: hisi-sfc-v3xx: Propagate errors from optional IRQ lookup
  spi: meson-spifc: use devm_pm_runtime_set_active_enabled
  spi: sprd-adi: Fix probe succeeding without registering the controller
  ...
2026-08-19 09:47:41 -07:00
GuoHan Zhao
05d32474ab tools/virtio: Fix control typo in trace agent comment
Fix a misspelling of "control" in the trace agent controller description.

Signed-off-by: GuoHan Zhao <zhaoguohan@kylinos.cn>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260720014506.90012-1-zhaoguohan@kylinos.cn>
2026-08-19 06:38:48 -04:00
GuoHan Zhao
bce2a966f7 tools/virtio: Fix userspace typo in vringh test comment
Fix a misspelling of "userspace" in the vringh test description.

Signed-off-by: GuoHan Zhao <zhaoguohan@kylinos.cn>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260720014421.89345-1-zhaoguohan@kylinos.cn>
2026-08-19 06:38:48 -04:00
Yichong Chen
b07513e747 tools/virtio: Remove unsupported --batch option from vhost_net_test
vhost_net_test has --batch in longopts, but not in help.

The parser never handles 'b', so --batch hits assert(0).

Remove the unsupported option.

Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
Acked-by: Eugenio Pérez <eperezma@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <E091F15D8FBE8F16+20260618100254.513806-1-chenyichong@uniontech.com>
2026-08-19 06:38:45 -04:00
Greg Kroah-Hartman
258ad62593 IIO new device support, features, cleanup for 7.3
Includes a merge of 7.2-rc2 to pick up the changes around
 mod_devicetable.h and reduce resulting conflicts around includes.
 
 New device support
 ------------------
 
 adi,ad3530R
 - Add support for the AD3532R and AD3532 16 channel DACs.
 adi,ad4080
 - Add support for the AD4883 ADC.
 adi,ad5686
 - Add support for AD5313R, AD5317R, AD5674, AD5687R, AD5689, AD5689R DACs
   over SPI
 - Add support for AD5316R, AD5674, AD5697R and AD5696 DACs over I2C
 - Significant driver refactoring prior to these additions, partly to reduce
   bus traffic and to add triggered buffer and gain control support. An
   earlier set added support for missing supplies, reset and LDAC GPIO.
 adi,adf41513
 - New driver to support this PLL frequency synthesizer that runs up to
   26.5 GHz.
 - Included infrastructure to handle higher precision attributes with
   extensive tests
 adi,ltc2378-20
 - New driver supporting LTC2338, LTC2364, LTC2367, LTC2368, LT2369, LTC2370
   LTC2376, LTC2377, LTC2378, LTC2379 and LTC23980 ADCs with both high speed
   capture via appropriate backend and conventional triggered buffer SPI
   capture.
 invensense,icm42607
 - New driver for this IMU.
 mediateck,mt6323
 - New driver for this PMIC ADC.
 microchip,mcp47a1
 - New driver for this I2C 6 bit DAC.
 nxp,mcf54415-dac
 - New driver for this DAC found in NXP SoCs.
 qst,qmc5884l
 - New driver for this 3 axis magnetometer. Included dt vendor entry for qst.
 qst,qmc6308
 - New driver for this 3 axis magnetometer.
 sensiron,slf3s
 - New driver for this liquid flow sensor. Includes adding IIO_VOLUMEFLOW
   channel type.
 st,vl53l1x
 - Refactors to improve readability.
 ti,ads112c14
 - New driver supporting the ADS112C14 and ADS122C14 ADCs. These bring
   some new ABI for input chopping, particular useful for resistive sensors
   like thermocouples or Wheatstone bridges.
 - Support CRC8 detection of corruption on the bus.
 - Support buffered reads.
 ti,tmp117
 - (trivial) Add support for the tmp119 temperature sensor.
 xilinx,versal-sysmon
 - New ADC driver for this block found on various FPGAs including various
   bus interfaces, threshold and oversampling support.
 
 dt binding updates
 ------------------
 new shared bindings
 - excitation-channels and excitation-current-nanoamp allow per channel
   specification of currents used for resistive sensor measurement.
 - reference-sources property to allow selection of a per channel reference.
 rockchip,saradc
 - Add RV1106 which is compatible with the RV3588.
 
 Features
 --------
 
 buffer-dmaengine
 - Allow cyclic buffers, useful for repeating sequence generation with DACs.
 devantech,dmard09
 - Implement read back of channel scale - previously interface always
   returned an error.
 hid,sensors-als
 - Enable separate channel scaling for hardware that supports it.
 invensense,timestamp library
 - Various precision improvements.
 invensense,icm42600
 - Add support for hwfifo watermark interfaces.
 taos,tcs3472
 - Support wait time and sampling frequency control.
 
 Cleanups, minor fixes
 ---------------------
 
 Minor cleanups not mentioned at all in this summary such
 as white space fixes or typos.
 
 Affecting various drivers
 - Cleanup of conditionals that had no affect.
 - Drop some runtime pm local wrappers as now runtime_pm does the
   mark_last_busy part inside the put, these provide no useful code
   deduplication or readability advantages over directly calling the
   runtime_pm functions.
 - Return 0 from write_raw() on success.
 - Use of dev_err_probe() to simplify code and sometimes provide useful
   info for deferred probe debugging.
 - Drop some redundant error prints where the called function already
   provides information on errors.
 - Make some read only arrays in functions static.
 - Fix up missing handling of regcache_sync() errors.
 - Drop some false kernel-doc markings.
 - Add missing MODULE_DEVICE_TABLE for some of_match_id tables.
 - Use local variables for things like the struct device to shorten and
   improve readability of code.
 - Drop some unused structure elements.
 - Reorder dds.h macro parameters to be inline with others.
 - Header reorders and IWYU. Often part of a more significant series.
 - Remove abstractions designed to allow a driver to support multiple device
   types, when they have been around a long time and only the original part
   showed up.
 - Initialize spi_device_id arrays using member names following dropping of
   driver data from drivers that didn't actually use it.
 - Catch up with i2c_device_id tables added since previous effort to use
   named initializers for all those.
 - Use kernel types in a few places instead of standard C ones or bare
   unsigned.
 
 Misc
 - Update Xilinx AMS maintainer.
 - Update email address for Maxwell Doose.
 - Update email address for Siratul Islam.
 - Update email address for Tomasz Duszynski and re-add Tomasz to
   various maintainer entries.
 Docs
 - Encourage use of differential channel naming even when there is no
   flexibility in input to differential pair mapping. Intended to
   provide a strong signal to userspace that a channel is differential.
 adi,ad_sigma_delta
 - Allow COMPILE_TEST without any users.
 adi,ad2s1201
 - Refactor trigger handler to avoid mix of guard() and goto.
 adi,ad5686
 - Avoid potential NULL dereference is user forces a driver bind.
 adi,ad5696
 - Add a couple of missing entries to the of_match_id table and update
   binding to match.
 atmel,ad91_adc
 - Use const char * for DT string property allowing a cast to be dropped.
 avia,hx711
 - Various refactors and cleanup to enable support of additional parts
   (to come)
 - Add missing supply and gpio dt-bindings.
 bosch,bmc150
 - Harden against device reporting too large a FIFO sample count.
 - Use FIELD_PREP() / FIELD_GET() to improve readability.
 freescale,fxls8962af
 - Harden against device reporting too large a FIFO sample count.
 hid-sensors-*
 - Reorder probe to not expose userspace interfaces until the rest of
   the setup is done to avoid potentially dropping data.
 honeywell,abp2030pa
 - Drop an unreachable return.
 invensens,icm45600
 - Harden against bad value of FIFO sample count from device.
 - Use i2c_match_data if firmware table sourced match data isn't available.
 nxp,mpl1115
 - Ensure runtime_pm is balanced on error in probe.
 rohm,bm1390
 - Make the driver slightly more likely to recover from transient errors.
 sensiron,sgp30
 - Handle thread creation errors.
 st,lsm6dsx
 - Update the enable mask when doing sensor fusion to avoid incorrect fifo
   data handling.
 st,stm32-dfsdm
 - Treat dt flags as booleans.
 ti,ads1015
 - Switch to devm helpers which simplified code and closed a resource leak.
 ti,opt3001
 - Split complicated opt3001_get_processed() logic into irq an no irq
   helper functions.
 - Use devm to simplify code.
 - Use guard() to simplify code.
 - Reorder probe so final call exposes userspace interfaces.
 - Various other more minor cleanup
 taos,tsl2772
 - Fix calibscale readback to check right channel type.
 taos,tsl2583
 - Use sysfs_emit() and sysfs_emit_at() to replace open coded equivalents.
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEbilms4eEBlKRJoGxVIU0mcT0FogFAmp1Pm8RHGppYzIzQGtl
 cm5lbC5vcmcACgkQVIU0mcT0FoioNRAAi338gJ/xvG3rZlPr1RrTEgmsWaMqxxpr
 FWxFApdjAGvINn6SGwcWWkdfmB+OYg8sbhLLGkOx07e9R/GbS0y3j2kODvZHodZz
 k3wYXEy12HwuMgQRQWR+rNIke6bJdJFI10saJTfIRr3if7GkVvBTqd9exfoD2vGa
 Xzj12YN6ZcRiv8eWgju4yqQuVomMkRigd2mDHwvN4H9/ZylBRMgGIHhteWoPjx3y
 hs6lLeqc8lfocz1Azslb0ZEDPJ4+zPCO9eCBZ+1ZMwrzKUeqCfMYDQdE9TVUswpG
 aHlr5E+R2PlpLn4Ijk0faFJUZYFaOFIn3II3ZZfzzgFop2C0cVORYuIf7bgDRsaD
 zrLj2ybzSr/7+aAK2ry3hoVrxh9mkbv6G0Lf7bvFhQaXltJJBVQi98pU13p2AoFj
 BT8+pHOwgKUsF+LyxNqch6LyLDEzNw0P3Fl7SmrH/k2RVfj/L4+8PMOAijBTLpCC
 3J4k17laTYWJZ8sFpyBEXYyhgp6SZqr2UIIcizrc1nIUK+mJI2/XBVbtsBY/6jW8
 7RM07TNqkm+ZhsV58YiMfKdDuqPiQpCp5TYjVcxjjmOK4aE5bFSbyzi5SvAcG6oG
 C2l9k5vgZEpti6ZkFBj4qNUK0cVXinDWqHhlAXF7wjKCj69yEFLCtl+de//A0I+v
 3FBEkBCsq+M=
 =4ayG
 -----END PGP SIGNATURE-----

Merge tag 'iio-for-7.3a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-next

Jonathan writes:

IIO new device support, features, cleanup for 7.3

Includes a merge of 7.2-rc2 to pick up the changes around
mod_devicetable.h and reduce resulting conflicts around includes.

New device support
------------------

adi,ad3530R
- Add support for the AD3532R and AD3532 16 channel DACs.
adi,ad4080
- Add support for the AD4883 ADC.
adi,ad5686
- Add support for AD5313R, AD5317R, AD5674, AD5687R, AD5689, AD5689R DACs
  over SPI
- Add support for AD5316R, AD5674, AD5697R and AD5696 DACs over I2C
- Significant driver refactoring prior to these additions, partly to reduce
  bus traffic and to add triggered buffer and gain control support. An
  earlier set added support for missing supplies, reset and LDAC GPIO.
adi,adf41513
- New driver to support this PLL frequency synthesizer that runs up to
  26.5 GHz.
- Included infrastructure to handle higher precision attributes with
  extensive tests
adi,ltc2378-20
- New driver supporting LTC2338, LTC2364, LTC2367, LTC2368, LT2369, LTC2370
  LTC2376, LTC2377, LTC2378, LTC2379 and LTC23980 ADCs with both high speed
  capture via appropriate backend and conventional triggered buffer SPI
  capture.
invensense,icm42607
- New driver for this IMU.
mediateck,mt6323
- New driver for this PMIC ADC.
microchip,mcp47a1
- New driver for this I2C 6 bit DAC.
nxp,mcf54415-dac
- New driver for this DAC found in NXP SoCs.
qst,qmc5884l
- New driver for this 3 axis magnetometer. Included dt vendor entry for qst.
qst,qmc6308
- New driver for this 3 axis magnetometer.
sensiron,slf3s
- New driver for this liquid flow sensor. Includes adding IIO_VOLUMEFLOW
  channel type.
st,vl53l1x
- Refactors to improve readability.
ti,ads112c14
- New driver supporting the ADS112C14 and ADS122C14 ADCs. These bring
  some new ABI for input chopping, particular useful for resistive sensors
  like thermocouples or Wheatstone bridges.
- Support CRC8 detection of corruption on the bus.
- Support buffered reads.
ti,tmp117
- (trivial) Add support for the tmp119 temperature sensor.
xilinx,versal-sysmon
- New ADC driver for this block found on various FPGAs including various
  bus interfaces, threshold and oversampling support.

dt binding updates
------------------
new shared bindings
- excitation-channels and excitation-current-nanoamp allow per channel
  specification of currents used for resistive sensor measurement.
- reference-sources property to allow selection of a per channel reference.
rockchip,saradc
- Add RV1106 which is compatible with the RV3588.

Features
--------

buffer-dmaengine
- Allow cyclic buffers, useful for repeating sequence generation with DACs.
devantech,dmard09
- Implement read back of channel scale - previously interface always
  returned an error.
hid,sensors-als
- Enable separate channel scaling for hardware that supports it.
invensense,timestamp library
- Various precision improvements.
invensense,icm42600
- Add support for hwfifo watermark interfaces.
taos,tcs3472
- Support wait time and sampling frequency control.

Cleanups, minor fixes
---------------------

Minor cleanups not mentioned at all in this summary such
as white space fixes or typos.

Affecting various drivers
- Cleanup of conditionals that had no affect.
- Drop some runtime pm local wrappers as now runtime_pm does the
  mark_last_busy part inside the put, these provide no useful code
  deduplication or readability advantages over directly calling the
  runtime_pm functions.
- Return 0 from write_raw() on success.
- Use of dev_err_probe() to simplify code and sometimes provide useful
  info for deferred probe debugging.
- Drop some redundant error prints where the called function already
  provides information on errors.
- Make some read only arrays in functions static.
- Fix up missing handling of regcache_sync() errors.
- Drop some false kernel-doc markings.
- Add missing MODULE_DEVICE_TABLE for some of_match_id tables.
- Use local variables for things like the struct device to shorten and
  improve readability of code.
- Drop some unused structure elements.
- Reorder dds.h macro parameters to be inline with others.
- Header reorders and IWYU. Often part of a more significant series.
- Remove abstractions designed to allow a driver to support multiple device
  types, when they have been around a long time and only the original part
  showed up.
- Initialize spi_device_id arrays using member names following dropping of
  driver data from drivers that didn't actually use it.
- Catch up with i2c_device_id tables added since previous effort to use
  named initializers for all those.
- Use kernel types in a few places instead of standard C ones or bare
  unsigned.

Misc
- Update Xilinx AMS maintainer.
- Update email address for Maxwell Doose.
- Update email address for Siratul Islam.
- Update email address for Tomasz Duszynski and re-add Tomasz to
  various maintainer entries.
Docs
- Encourage use of differential channel naming even when there is no
  flexibility in input to differential pair mapping. Intended to
  provide a strong signal to userspace that a channel is differential.
adi,ad_sigma_delta
- Allow COMPILE_TEST without any users.
adi,ad2s1201
- Refactor trigger handler to avoid mix of guard() and goto.
adi,ad5686
- Avoid potential NULL dereference is user forces a driver bind.
adi,ad5696
- Add a couple of missing entries to the of_match_id table and update
  binding to match.
atmel,ad91_adc
- Use const char * for DT string property allowing a cast to be dropped.
avia,hx711
- Various refactors and cleanup to enable support of additional parts
  (to come)
- Add missing supply and gpio dt-bindings.
bosch,bmc150
- Harden against device reporting too large a FIFO sample count.
- Use FIELD_PREP() / FIELD_GET() to improve readability.
freescale,fxls8962af
- Harden against device reporting too large a FIFO sample count.
hid-sensors-*
- Reorder probe to not expose userspace interfaces until the rest of
  the setup is done to avoid potentially dropping data.
honeywell,abp2030pa
- Drop an unreachable return.
invensens,icm45600
- Harden against bad value of FIFO sample count from device.
- Use i2c_match_data if firmware table sourced match data isn't available.
nxp,mpl1115
- Ensure runtime_pm is balanced on error in probe.
rohm,bm1390
- Make the driver slightly more likely to recover from transient errors.
sensiron,sgp30
- Handle thread creation errors.
st,lsm6dsx
- Update the enable mask when doing sensor fusion to avoid incorrect fifo
  data handling.
st,stm32-dfsdm
- Treat dt flags as booleans.
ti,ads1015
- Switch to devm helpers which simplified code and closed a resource leak.
ti,opt3001
- Split complicated opt3001_get_processed() logic into irq an no irq
  helper functions.
- Use devm to simplify code.
- Use guard() to simplify code.
- Reorder probe so final call exposes userspace interfaces.
- Various other more minor cleanup
taos,tsl2772
- Fix calibscale readback to check right channel type.
taos,tsl2583
- Use sysfs_emit() and sysfs_emit_at() to replace open coded equivalents.

* tag 'iio-for-7.3a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio: (232 commits)
  iio: dac: mcp47a1: add support for new device
  dt-bindings: iio: dac: add support for mcp47a1
  iio: Update email for Maxwell Doose
  iio: imu: st_lsm6dsx: Update enable mask when using sensor fusion
  iio: light: cm32181: return zero after writing calibscale
  iio: flow: add Sensirion SLF3S liquid flow sensor driver
  iio: core: add IIO_VAL_DECIMAL64_FEMTO format type
  dt-bindings: iio: flow: add Sensirion SLF3S liquid flow sensor
  iio: types: add IIO_VOLUMEFLOW channel type
  iio: ABI: Encourage differential voltage ABI usage
  iio: adc: ltc2378: Add support for LTC2338-18
  iio: adc: ltc2378: Enable triggered buffer data capture
  iio: adc: ltc2378: Enable high-speed data capture
  iio: adc: ltc2378: Add support for LTC2378-20 and similar ADCs
  dt-bindings: iio: adc: Add ltc2378
  iio: magnetometer: ak8974: remove conditional return with no effect
  iio: light: tsl2583: remove conditional return with no effect
  iio: adc: rcar-gyroadc: remove rcar_gyroadc_set_power() helper
  iio: light: vcnl4000: remove vcnl4000_set_pm_runtime_state() helper
  iio: light: vcnl4035: remove vcnl4035_set_pm_runtime_state() helper
  ...
2026-08-19 09:45:01 +02:00
Linus Torvalds
ccb9331e13 - Remove the smp_locks alternatives machinery which was used to patch out lock
prefixes when running a SMP kernel on a uniprocessor machine
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmqD58YACgkQEsHwGGHe
 VUrzQRAAoaN6wL22NNqknd4axMd1ZDNo7mjwHqwQFH8dctba9nEHtnwhM+G0iqUP
 LAMpd4rJNClt14uMCSvN0zwx4SAB+/Dsn56ZN22TR74fWLjCBHuATgIzNCte2arF
 ifwP+qkiZJxixnYHKjE+CkbRPOd3xQr6nskte5/ywbbYoXjwve1GX3Lrf5YJ9mHJ
 IWZaRYHl5dd/tMlrN+Nv+AU0aK86gROdll6KLWE7LVrcDqLrjmigYOXvrFoUzMzR
 4aCSSq3ZkaMUNyCNyJqqAkK17xxxSbZLaSwgx/mpo/7jKeiLHYkbE7SPJFhpSu7R
 fC3/DqsbqqbkN7yOGJ2amQsqmvNbnVsv7/P3litw8r41S+QYjJLCB9BW3TvRa/Ff
 obeN52sJCilvCg4dYnaokl17EZ6bOTpapGQlPAFySUvemUDvFfsHFXeBvnPbzFhg
 6Mjf6ZPIf28yB/QUuJG6bESUdSodG/PUN5N4330tVuKQSJU0CnBHEWstsN5u9MVO
 aRecbdiWM69m9CUuwx9d+xoIa89aietaDSO7WvxdJe/psbL2GkO3jhl6BcdNQTi3
 7A5M0F0QkOfMgtL8N0Kz6URSgrcnj+e5XKG8AvSQ68vRUFd6OXu82eWGUIT6MUk7
 XULB9XeVQ8MkXwO+TDVsL6GkWcfCBy60JMO5ZibDZBRcFpsJfV4=
 =1kMm
 -----END PGP SIGNATURE-----

Merge tag 'x86_alternatives_for_v7.3_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull x86 alternatives update from Borislav Petkov:

 - Remove the smp_locks alternatives machinery which was used to patch
   out lock prefixes when running a SMP kernel on a uniprocessor machine

* tag 'x86_alternatives_for_v7.3_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/alternative: Drop smp_locks glue
2026-08-18 18:11:25 -07:00
Linus Torvalds
3b4128b9f3 Timers and timekeeping core updates:
- Fix a subtly inconsistency in the timekeeping code, which fails to
     account for the monotonicity adjustment in ntp_error. For small changes
     of the clocksource multiplicator (+/-1) which are typically used by the
     NTP PLL this is hardly to observe. But for larger adjustments,
     e.g. caused by a direct frequency setting through adjtimex() the
     one-time uncompensated offset is significant.
 
     Cure this by adjusting ntp_error with the resulting offset so that the
     discrepancy is smoothed away over time
 
   - Make tick length calculations correct in NTP. The timekeeping core
     takes the quantisation of the clocksource into account when calculating
     the tick length to compensate for the deviation of the nominal
     NTP_INTERVAL_LENGTH. While timekeeping gets this right, NTP is not
     aware of that, which means it operates on the nominal value and not on
     the actual value which is determined by the clock source frequency. The
     rounding of a coarse clocksource like the ACPI PM timer results in a
     +127 PPM deviation.
 
     Cure this by exposing the deviation to the NTP code so that it can
     operate on the same data as the timekeeping core. This is purely kernel
     internal. User space still sees the nominal tick lenght via adjtimex().
 
   - The accuracy of the NTP adjustments is fairly approximate as the code
     assumes that the invocations are precisely in NTP interval frequency
     ticks and the final adjustment can over and under-run.
 
     Cure this by adjusting ntp_error by the intended skew on each tick to
     achieve the desired rate.
 
   - Handle the two competing skews of time offset and time adjustment
     correctly by calculating the conflict portion between the skews and
     adjusting both accordingly.
 
   - A set of updates and improvements for the selftests
 
   - The usual small fixes and improvements all over the place
 -----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCgAuFiEEQp8+kY+LLUocC4bMphj1TA10mKEFAmqCwxwQHHRnbHhAa2Vy
 bmVsLm9yZwAKCRCmGPVMDXSYoaOwD/45XBW2s5/L+GSy52r/APrzYOqgjYQdn2UQ
 XI85iTjDqg9sfZQNFbr7toJ84gY/wQ0ZxykLMi+LlOSZVe5azSepoUHMg9XGk8S0
 4kI+GLznmnDLFypTezpzk3DUgNgu8rhOYvPsgwQEgx0DuzWHRZgNoNDk4AfJ8HP6
 8cRgPIJ7CpIbP7/p0Kc5IjW3ybo849wBirl7ZDxNRRao+Dkc56ArZvSfQgnQu5Kw
 D3Ei+AFcxpBQ2GEJT4Z/92yNf1x2AXjkhfijgO6hIFzPAR+c049fG5sgneo3GoLQ
 riduEPQHvoiJO3gVGzoICF2DAuVOwMHwIBlGtNEDd+FcMAvMU4V3lQi8lJV+9CpH
 SJwa5R6KJHg2aTuoPup8lmfJN7BqmthrkZwcYVrv2Ikt5yWGYuoW0/e00So9IfUO
 R7UG/VlruckK+T0GCuKBAAfm/+zm6Sbir+4liPDZwDz4dW2lkvkZnAb6xHPCev8S
 ioYL/Jqr3GmIMgK7UelUkQ/gy5YCek89JAszdlD+blLAjUMcDeYsZaAN9rSdjzSu
 dbEA4Hze6Q8HpIW35bHkytyyjNNhvL6xobjKBNRuOPUHTFMe+s5itMApRlhsu32J
 6EL/D1TuwkiHlqaSek7ZqUAiitZoNWxa1NyreM9EuZ7qWPjUWOzlsDXkP2v298+t
 p27xt+/8sA==
 =prJt
 -----END PGP SIGNATURE-----

Merge tag 'timers-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull timer and timekeeping core updates from Thomas Gleixner:

 - Fix a subtly inconsistency in the timekeeping code, which fails to
   account for the monotonicity adjustment in ntp_error.

   For small changes of the clocksource multiplicator (+/-1) which are
   typically used by the NTP PLL this is hard to observe. But for larger
   adjustments, e.g. caused by a direct frequency setting through
   adjtimex() the one-time uncompensated offset is significant.

   Cure this by adjusting ntp_error with the resulting offset so that
   the discrepancy is smoothed away over time

 - Make tick length calculations correct in NTP.

   The timekeeping core takes the quantisation of the clocksource into
   account when calculating the tick length to compensate for the
   deviation of the nominal NTP_INTERVAL_LENGTH.

   While timekeeping gets this right, NTP is not aware of that, which
   means it operates on the nominal value and not on the actual value
   which is determined by the clock source frequency. The rounding of a
   coarse clocksource like the ACPI PM timer results in a +127 PPM
   deviation.

   Cure this by exposing the deviation to the NTP code so that it can
   operate on the same data as the timekeeping core. This is purely
   kernel internal. User space still sees the nominal tick lenght via
   adjtimex().

 - The accuracy of the NTP adjustments is fairly approximate as the code
   assumes that the invocations are precisely in NTP interval frequency
   ticks and the final adjustment can over and under-run.

   Cure this by adjusting ntp_error by the intended skew on each tick to
   achieve the desired rate.

 - Handle the two competing skews of time offset and time adjustment
   correctly by calculating the conflict portion between the skews and
   adjusting both accordingly.

 - A set of updates and improvements for the selftests

 - The usual small fixes and improvements all over the place

* tag 'timers-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (58 commits)
  selftests: timers: nsleep-lat: Check all calls to clock_nanosleep() and clock_gettime()
  selftests: timers: nsleep-lat: Reuse kselftest error numbers
  selftests: timers: nsleep-lat: Explicitly list the tested clocks
  selftests: timers: nsleep-lat: Use NSEC_PER_MSEC define for unreasonable latency
  selftests: timers: nanosleep: Report each test separately
  selftests: timers: nanosleep: Explicitly handle timer_delete() failure
  selftests: timers: nanosleep: Move all single clock tests out of the loop in main()
  selftests: timers: nanosleep: Reuse kselftest error numbers
  selftests: timers: nanosleep: Explicitly list the tested clocks
  selftests: timers: nanosleep: Drop output alignment
  selftests: timers: Use clock_name() and constants from clock-helpers.h
  selftests: Add clock-helpers.h
  timer_list: Use ktime_t over nanoseconds
  timer_list: Use standard 'long long' format placeholders
  hrtimer: Add a lockdep assertion to hrtimer_update_base()
  timekeeping: Use u32 for clock_was_set_seq
  timekeeping: Rename clockid_aux_valid() to clockid_is_aux_clock()
  hrtimer: Account nr_retries on recovered interrupt retries
  timers/itimer: Zero-init old itimerval before copy to userspace
  nohz: Replace dead select with choice default
  ...
2026-08-18 16:23:56 -07:00
Linus Torvalds
b844715e8a Futex updates:
- A set of improvements to various futex self tests
 
     - Conversion to the selftest harness
 
     - Provide and use thread creation and synchronization helpers to reduce
       the dependency on delays, which tend to fail on loaded test systems
 
     - New tests for validating owner exit scenarios for robust and PI futexes
 
     - Runtime detect supported features and skip the tests if the kernel
       has no support
 
     - A few minor fixes
 -----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCgAuFiEEQp8+kY+LLUocC4bMphj1TA10mKEFAmqC2iUQHHRnbHhAa2Vy
 bmVsLm9yZwAKCRCmGPVMDXSYoTPBD/4sMc+o2TiWn4bf7vcoln3XlVA8oWkiJCIB
 UUIW1n77CTK9jF50/xb77uvDvSHYr7Zx/Gm1QOvz/xdMvbgqUtPCExBoQXEz/1VV
 y+s7x3K4pwI7BLzEPNsvC2kN0+cVisMXdCi5C5ot7xo3AilfcxxSIwauGyEdQuqZ
 ArvVJjaBCXjRE1EtaVTeiGSINeR4kWPohOkH7dou/OISSd+EcA1kOsTrWlgVa2AA
 o7Vy4u5VsYK7m+UVZUYmwf7+pU91iDj0FZ9fMYYskOw5F+Xax4seNO4bozre80LJ
 3LE2aB8Rg5qGYCTL3D54O1c/2wczJueqGPHy+bF9SOOdlzo0N4Ro8wYUa3MmQuY5
 8+JyfFOsFcqflCYFK/ketzu3JrlZdu8DV9pJ67+RIKpHIXG5VRZHBDDrkL60PF7x
 TQoaZ57sOP7e5GJ+ByxxkltPuXGsIILcPytZoTtm6NwQIh2eSOtPSEPh9VprSChn
 vhY50WJuZ6L//Z7YQfXPQ9B7Xe+39OIWgY1GnUKF09BNVx6V4/As7Nc8llH+7cR7
 eyiVqs0uRDlnpe5zQkAj0hdYR9WK/XVAQ26rsHZDJnSnoalJbl2AjdH1FIg8xm7n
 0PPKqr3hZC4lilpwoBXXPQLIOBKNAUXZpVWxEopGSFIZ5tdrcnNcxgYFMuKiN5cQ
 glxSVQVl0g==
 =6VmJ
 -----END PGP SIGNATURE-----

Merge tag 'locking-futex-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull futex updates from Thomas Gleixner:

 - Improvements to various futex self tests:

    - Conversion to the selftest harness

    - Provide and use thread creation and synchronization helpers to
      reduce the dependency on delays, which tend to fail on loaded test
      systems

    - New tests for validating owner exit scenarios for robust and PI
      futexes

    - Runtime detect supported features and skip the tests if the kernel
      has no support

 - A few minor fixes

* tag 'locking-futex-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  selftests/futex: Give circular-list nodes static storage
  selftests/futex: Use thread synchronization helpers instead of usleep()
  selftests/futex: Provide thread creation and synchronization helpers
  selftests/futex: Dynamically skip unsupported tests
  selftests/futex: Add FUTEX_LOCK_PI owner-exiting coverage
  selftests/futex: Migrate robust_list to harness
  selftests/futex: Migrate futex_priv_hash to harness
  selftests/futex: Migrate futex_numa_mpol to harness
  selftests/futex: Migrate futex_requeue_pi_signal_restart to harness
  selftests/futex: Migrate futex_requeue_pi_mismatched_ops to harness
  selftests/futex: Migrate futex_requeue_pi to harness
  selftests/futex: Migrate futex_requeue to harness
  selftests/futex: Migrate futex_wait_uninitialized_heap to harness
  selftests/futex: Migrate futex_wait_private_mapped_file to harness
  selftests/futex: Migrate futex_wait to harness
  selftests/futex: Correct validation logic in waitv
  selftests/futex: Migrate functional tests to harness
  selftests/futex: Remove static keyword from 'head'
  futex: Remove unnecessary NULL check before kvfree()
  selftests/rseq: Replace glibc-specific __GNUC_PREREQ with portable check
2026-08-18 15:26:35 -07:00
Linus Torvalds
6138016752 Two trivial updates for RSEQ:
- Add the recently added new test binaries to .gitignore
 
    - Fix a trivial typo in a comment.
 -----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCgAuFiEEQp8+kY+LLUocC4bMphj1TA10mKEFAmqCs+AQHHRnbHhAa2Vy
 bmVsLm9yZwAKCRCmGPVMDXSYoRklEACcQNhe4wm9llUmLlbHNqKhXi5px16fE5bb
 etd6iIds3TXTLT5VMz0aEA3SR24zDSXEXgDLLZjwokngo9F0Y8dPY+OG79XTNe40
 dMf7nWco7AEX00QZhSYcwgt1tk/PRURGI78iSTn4xNbP9LTdKuM5uqSjBXGAZ25V
 YOuXZWjy9q98GSpwxNTfMRn80bHAd/7phJ7XMB/xjU1gshZAV+vIW/C5/fZ27vZU
 1TEEu3hZUI2zK5y9ZWQaxxJ+0qmzO43En8VuNmw35OR6y99GqxWblrlHD0cLVbA3
 ipxI/oNKazbVME8xbEc6yE4/ERvLA10I19S9qmejNkOMBEMOlCgVOoImxvmPOzIg
 RDJz+cVPEyr0b/1l6ZmqByPHY2XBxD0zpDM8lqhS98nwBRaPcxcbyMaSTuQm/PJ5
 KEu+4vlP/GJM3PxLXdWKtSj8UUmz25Ok2AXw5drWUnOdE5Tqoq7hraeUTeAKNdId
 yNjD+ttDo5+f7Si2qvbyBRo0qJDHM2K+J3qNvb/sZ303AyCA7SWiJWMl39CDmHNq
 Y7RpwWJF4alYIPEHstPZoBuuyfkpkXHX/2FUva89Zk9tu2v3q0vgV5xKA80/B1tB
 r887+BLcG1vXSC53HnboVgRXHkUmAmTRmt3n3KTdWcuyhl+UwxtLQbSPIQGvgyEa
 2+5i5hpNrw==
 =FSxg
 -----END PGP SIGNATURE-----

Merge tag 'core-rseq-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull rseq updates from Thomas Gleixner:
 "Two trivial updates for RSEQ:

   - Add the recently added new test binaries to .gitignore

   - Fix a trivial typo in a comment"

* tag 'core-rseq-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  selftests/rseq: Add missing test binaries to .gitignore
  selftests/rseq: Fix spelling of accommodate
2026-08-18 15:16:10 -07:00
Linus Torvalds
3424d8c18a Generic entry code updates:
- Make syscall user dispatching configurable
 
     Not all architectures can makes use of syscall user dispatching. Allow
     them to disable the feature completely.
 
   - Consolidate stack randomization for the generic entry code and the
     architectures using it.
 
     Stack randomization on syscall entry was sprinkled throughout the
     architecture specific low level entry code and in some cases at the
     wrong points, e.g. before establishing state, which violates the
     non-instrumentable constraints of that code.
 
     Clean this up by integrating stack randomization into the generic entry
     code helpers so that it is invoked at the earliest possible point right
     after establishing state and converting all generic entry code using
     architecture over.
 
   - Clean up the syscall number handling in the generic entry code. It
     works correctly for architectures which have a separate return value
     storage in pt_regs, but fails to distinguish the case where user space
     handed in -1 as syscall number from the case where the entry code
     rejects it by returning -1 to the callers. Aside of that the return
     value functionality of those interfaces is not really intuitive.
 
     Fix this by separating the decision to reject a syscall (user dispatch,
     ptrace, seccomp ...) from the potential modification of the syscall
     number through these mechanisms.
 
     This solves most of the problems for architectures which do not have a
     separate return value storage in pt_regs except for the case where a
     tracepoint has a BPF script or a probe attached which overwrite both
     the syscall number and the return value. But that's a problem which
     cannot be solved in the generic code, that only can be addressed by
     separating the storage model in the affected architectures.
 -----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCgAuFiEEQp8+kY+LLUocC4bMphj1TA10mKEFAmqCs10QHHRnbHhAa2Vy
 bmVsLm9yZwAKCRCmGPVMDXSYoaf6D/0ZBG1Yb0/C/6lrI185qPu38aGOROuAcxP+
 RV1O1x6C83w2hCLBH8LeswY2x4/iGbdftne/hfmvu8eNCE5MzBfYvXhLL4If75Tc
 IJ6C8uummnDmrT1TFuWHryTAfjyF28gt0+GGq0Zy5Hyz9b4CTJqOMx5u6KV4cZuJ
 odoNQpE/GlWo40wCSTYP/Tt5xONrogk2pMQtFyV8JEoaXkdYSj/V815yojEmofYU
 fmgPPO5/vOnZzE4b29gZyndXnU1Boah7r1l5fg7c9za376yCEEzh/ApPhovHyY0A
 t8zjnrtooZ27IUKbcsyycrAM14asfcmViDNDgaCj8ttBioQaCnxO1BpKWjVxEZhE
 AbM6q3Q66ER4Df6GNhZjPqT5Lr7E7+vLLarhXLWztsGQklIx4AFbrsa73hA20UC9
 1PSeMd45JSxH3yA8vMauXAGHFK1tD1V8Lgofu69+2Z3jtKB+aU0fqWeL1jesSEM0
 oCGhUb3hIC1pz3KVA0MGmNTm0yyQJYTGZL7wADYNV5NbxJVqXgo37qa/0n94Gf/4
 TG3OwY4Sb/H/sve7v/eY4IvxVh+xs3dLZP8ZoqMlPCp9JIxc6iNoe6VHqPI7PFnM
 fXwDtsy+bRF/SKnB/32qxnR7UJqmdNH3XIjd+lXWliKt6UYoC79/MEKN5DmJcO9P
 CykZUWa72A==
 =XUd9
 -----END PGP SIGNATURE-----

Merge tag 'core-entry-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull generic entry code updates from Thomas Gleixner:

 - Make syscall user dispatching configurable

   Not all architectures can makes use of syscall user dispatching.
   Allow them to disable the feature completely.

 - Consolidate stack randomization for the generic entry code and the
   architectures using it.

   Stack randomization on syscall entry was sprinkled throughout the
   architecture specific low level entry code and in some cases at the
   wrong points, e.g. before establishing state, which violates the
   non-instrumentable constraints of that code.

   Clean this up by integrating stack randomization into the generic
   entry code helpers so that it is invoked at the earliest possible
   point right after establishing state and converting all generic entry
   code using architecture over.

 - Clean up the syscall number handling in the generic entry code. It
   works correctly for architectures which have a separate return value
   storage in pt_regs, but fails to distinguish the case where user
   space handed in -1 as syscall number from the case where the entry
   code rejects it by returning -1 to the callers. Aside of that the
   return value functionality of those interfaces is not really
   intuitive.

   Fix this by separating the decision to reject a syscall (user
   dispatch, ptrace, seccomp ...) from the potential modification of the
   syscall number through these mechanisms.

   This solves most of the problems for architectures which do not have
   a separate return value storage in pt_regs except for the case where
   a tracepoint has a BPF script or a probe attached which overwrite
   both the syscall number and the return value. But that's a problem
   which cannot be solved in the generic code, that only can be
   addressed by separating the storage model in the affected
   architectures.

* tag 'core-entry-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (23 commits)
  entry, treewide: Make syscall_enter_from_user_mode[_work]() indicate syscall execution
  entry: Make return type of syscall_trace_enter() bool
  entry: Rework trace_syscall_enter()
  entry: Rework syscall_audit_enter()
  syscall_user_dispatch: Introduce ARCH_SUPPORTS_SYSCALL_USER_DISPATCH
  entry: Fix seccomp bypass after ptrace with TSYNC
  x86/entry: Simplify the syscall number logic
  x86/entry: Get rid of the sys_ni_syscall() indirection
  x86/entry: Make syscall functions static
  ptrace, treewide: Rename ptrace_report_syscall_entry() to ptrace_report_syscall_permit_entry()
  seccomp, treewide: Rename and convert __secure_computing() to return boolean
  entry: Use syscall number instead of rereading it
  entry: Remove syscall_enter_from_user_mode()
  x86/syscall: Use [syscall_]enter_from_user_mode_randomize_stack()
  s390/syscall: Use enter_from_user_mode_randomize_stack()
  riscv/syscall: Use syscall_enter_from_user_mode_randomize_stack()
  powerpc/syscall: Use syscall_enter_from_user_mode_randomize_stack()
  loongarch/syscall: Use syscall_enter_from_user_mode_randomize_stack()
  entry: Provide [syscall_]enter_from_user_mode_randomize_stack()
  randomize_kstack: Provide add_random_kstack_offset_irqsoff()
  ...
2026-08-18 15:00:56 -07:00
Besar Wicaksono
9453bc6a69 perf vendor events arm64: Fix Tegra410 Olympus event 0x0197
The name and description for NVIDIA Tegra410 Olympus implementation-defined
event 0x0197 incorrectly indicate a TXREQ limit between one quarter and
one half. Correct them to describe a TXREQ limit below one half.

Fixes: 86ff690f45 ("perf vendor events arm64: Add Tegra410 Olympus PMU events")
Signed-off-by: Besar Wicaksono <bwicaksono@nvidia.com>
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-18 14:31:18 -07:00
Saurav Sachidanand
2d85e13c55 perf vendor events arm64: fix swapped MetricGroup for Tegra410 L1 prefetcher metrics
The L1D prefetcher metrics (l1d_cache_rw_miss_ratio, l1d_demand_accesses,
etc.) were incorrectly assigned to MetricGroup "L1I_Prefetcher_Effectiveness"
and vice versa. This causes 'perf stat --metric-group L1D_Prefetcher_Effectiveness'
to display L1I metrics, which is misleading.

Swap the MetricGroup assignments so L1D metrics are in the L1D group and
L1I metrics are in the L1I group.

Fixes: 86ff690f45 ("perf vendor events arm64: Add Tegra410 Olympus PMU events")
Signed-off-by: Saurav Sachidanand <sauravsc@amazon.com>
Reviewed-by: Besar Wicaksono <bwicaksono@nvidia.com>
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-18 14:31:18 -07:00
Linus Torvalds
dfa35434d7 Locking updates for v7.3:
Futexes:
 
  - Use runtime constants for futex_hash computation
    (K Prateek Nayak, Peter Zijlstra)
 
  - Optimise the size check get_futex_key() (Sebastian Andrzej Siewior)
 
  - Avoid private hash use-after-free on final put (Felix Hoffmann)
 
  - Tell kmemleak we're not leaking __futex_queues (Peter Zijlstra)
 
 Rust integration updates:
 
  - Implement refcounted interrupt disable and SpinLockIrq for Rust
    (Boqun Feng, Heiko Carstens, Joel Fernandes, Lyude Paul)
 
  - Rust sync: add helpers for mb, dma_mb and friends;
    add generic memory barriers and use LKMM atomics
    instead of Rust atomics in the revocable code (Gary Guo)
 
  - Add abstraction and integrate synchronize_rcu() (Philipp Stanner)
 
 Lock debugging:
 
  - Add qspinlock contended_release tracepoint
    (Dmitry Ilvokhin, Peter Zijlstra)
 
  - Enable the printing of held locks of remote running tasks and print
    task CPU (Ingo Molnar)
 
  - percpu-rwsem: Annotate intentional data race in readers_active_check()
    (Sun Shaojie)
 
 Misc fixes and updates by Boqun Feng, Peter Zijlstra, Fangrui Song,
 Naveen Kumar Chaudhary and Thomas Huth.
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmqC2KMRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1gNwg//awvTQONfhPanAyTgl7CLDSlMSHdqmlyh
 Ue0/Q8Ef1Cy4jwXY2FE2A0b1VcM6cGpDPoryVdg/wMdUXRNwinzAEXmxIkRy9kve
 4LybrZwDShgLxJ7pJ6KKhgjgDiat8EdYmOwCBEE3LnP7AYhkAb8BFetA3YZJvzPa
 KfA2BRYCgvBTid6yOAuXWm55Ev92AczOBamBzTxCadcaDGtNGXtQO6LfnqiQDOav
 X5tVoANBeaQtSs1+LxE41WdNOiRoBuy0IFFvXtZRal6PZYuGGmZ5tbQvscD099em
 haVwQyzDHQrqzglv71M0KRTXvYzdGveMRg/Au1SQnuLO3V6Vd5rMQ1g7I2M9Ln0f
 Pg+tlRvQ77mLoqcgrtl0W/u0fRR4eDkiJ1pmG+98oniPwau23RdbFhC0vKFz3ikF
 WHMgk3/9TcULylgF1Tj6QLmNrBY3Vx8LBdsFjhflEw7bG4cW42D91npmXIiEDE6K
 tJc9CcaVdyE75o59z2Dtjj+qQVBlNPlfKQFXFL7p3jU/gFw2SzYuqon66X3kGmr0
 mKJ9UNJdkLdiCjxS/QiMcDeYhwJksJqxFBkH50z3Kzmo84JsSpUFkoa6GM4aSiGn
 HEwgC0Q7oOXVNIKUBYk5QaRW0HSk55hbsX2TWkvpeBYkE1zXshVZCCmgpaTSJgb5
 oFmiwrGfUjo=
 =slqC
 -----END PGP SIGNATURE-----

Merge tag 'locking-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull locking updates from Ingo Molnar:
 "Futexes:

   - Use runtime constants for futex_hash computation (K Prateek Nayak,
     Peter Zijlstra)

   - Optimise the size check get_futex_key() (Sebastian Andrzej Siewior)

   - Avoid private hash use-after-free on final put (Felix Hoffmann)

   - Tell kmemleak we're not leaking __futex_queues (Peter Zijlstra)

  Rust integration updates:

   - Implement refcounted interrupt disable and SpinLockIrq for Rust
     (Boqun Feng, Heiko Carstens, Joel Fernandes, Lyude Paul)

   - Rust sync: add helpers for mb, dma_mb and friends; add generic
     memory barriers and use LKMM atomics instead of Rust atomics in the
     revocable code (Gary Guo)

   - Add abstraction and integrate synchronize_rcu() (Philipp Stanner)

  Lock debugging:

   - Add qspinlock contended_release tracepoint (Dmitry Ilvokhin, Peter
     Zijlstra)

   - Enable the printing of held locks of remote running tasks and print
     task CPU (Ingo Molnar)

   - percpu-rwsem: Annotate intentional data race in readers_active_check()
     (Sun Shaojie)

  Misc fixes and updates by Boqun Feng, Peter Zijlstra, Fangrui Song,
  Naveen Kumar Chaudhary and Thomas Huth"

* tag 'locking-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (44 commits)
  rust: sync: Introduce SpinLockIrq::lock_with() and friends
  rust: sync: Add SpinLockIrq
  rust: sync: Use super::* in spinlock.rs
  rust: helper: Add spin_{un,}lock_irq_{enable,disable}() helpers
  rust: Introduce interrupt module
  s390/preempt: Enable HAS_SEPARATE_PREEMPT_RESCHED_BITS
  arm64: sched/preempt: Enable HAS_SEPARATE_PREEMPT_RESCHED_BITS
  preempt: Introduce HAS_SEPARATE_PREEMPT_RESCHED_BITS
  sched: Avoid signed comparison of preempt_count() in __cant_migrate()
  sched: Remove the unused preempt_offset parameter of __cant_sleep()
  locking: Switch to _irq_{disable,enable}() variants in cleanup guards
  irq: Add KUnit test for refcounted interrupt enable/disable
  irq,spin_lock: Add counted interrupt disabling/enabling
  openrisc: Include <linux/cpumask.h> in smp.h
  preempt: Introduce __preempt_count_{sub,add}_return()
  preempt: Introduce HARDIRQ_DISABLE_BITS
  preempt: Track NMI nesting to separate per-CPU counter
  futex: Tell kmemleak we're not leaking __futex_queues
  x86/paravirt: Trace contended_release on unlock
  tracing/lock: Use TRACE_EVENT_FN() for contended_release
  ...
2026-08-18 13:07:17 -07:00
Linus Torvalds
8915457146 Performance events updates for v7.3:
uprobes updates:
 
  - Patch series to fix a category of bugs with optimized uprobes that
    can clobber the redzone area with call instruction storing return
    address on stack where user code may keep temporary data without
    adjusting RSP. Fix this by moving the optimized uprobes on top of
    10-bytes NOP instruction, so we can squeeze another instruction to
    escape the redzone area before doing the call.
    (Jiri Olsa, Andrii Nakryiko)
 
  - Switch uretprobes_srcu to SRCU-fast-updown, to improve performance
    (Puranjay Mohan)
 
 Intel CPU PMU driver updates:
 
  - Optimize ACR handling in match_prev_assignment() (Dapeng Mi)
  - Patch series to fix various PMU driver bugs and data leaks (Dapeng Mi)
  - Fix Intel PT stop/start with no update (Adrian Hunter)
 
 Intel uncore PMU driver updates:
 
  - Series to fix various uncore PMU setup robustness bugs (Zide Chen)
 
 AMD uncore PMU driver updates:
 
  - Add group validation (Sandipan Das)
 
 Misc fixes and updates by Dapeng Mi, Randy Dunlap and Zide Chen.
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmqC1G0RHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1gMehAAh/p3A42YKWgcEjnlmCTJ+RTGTrLbL/OB
 Q2uj4H9D32lBV8+ZyBjt3iVT5u8Z3pliUMAq4yaLua6SiWO4gbb/XLp7K9tnHSj9
 J/9zvOdxC74ZmnuKYzcjmSAFzYL0VmfHoHUMXNKEqjP/cfZnlp7Zhs7n0s+aEt9h
 IzkgzUt3maY7xjXnBXiHHmIvOrGt5i2avXFJxUeE6YPnRjUK6+8b8jzJTsvL7GrM
 lVTG7D0ptRELVKpgvbHWAK4738Oxls0tB6KmEHO+lMwM5i2OFy/Xs3PxX7Z6ruII
 3+RUAk9K8MNpxG+eIUzBs+Qu3a3cS/bAMS4LiD+oKSg0OxAbnvRey1l0uQOZLevb
 UUG3mNMpOJ0rfQIBMT0FhJZ7Rk6V0XRCfjyXnrZhfjCa879g+GPxrHoSAVjMa0PG
 S1y51mj5QNeXwMi7U9Pwl88GF2TLsxj1kNlpgMrFfZywjXD5wp2Oqd6s+fVuFk/X
 5FuUcY7evchxXjlfrYM84gtBBklVeOmd4yrqAGmhM5LUoFBCTt6HPzzn8U9Z8BIm
 qZvtSsZ4/FGQPNrAbGXXQ1tWxxP+g0HeRYmyxoj2n6Xpope8vDdWzs/cA1NeG9Dl
 4sbwkiOmWUCBniR05oTTCFtSejnr3UIq/H/ulUJRSRHocGaveFVhuUJYqQRsfUSX
 d223r/dlwj0=
 =V8n9
 -----END PGP SIGNATURE-----

Merge tag 'perf-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull performance events updates from Ingo Molnar:
 "uprobes updates:

   - Fix a category of bugs with optimized uprobes that can clobber the
     redzone area with call instruction storing return address on stack
     where user code may keep temporary data without adjusting RSP.

     Fix this by moving the optimized uprobes on top of 10-bytes NOP
     instruction, so we can squeeze another instruction to escape the
     redzone area before doing the call (Jiri Olsa, Andrii Nakryiko)

   - Switch uretprobes_srcu to SRCU-fast-updown, to improve performance
     (Puranjay Mohan)

  Intel CPU PMU driver updates:

   - Optimize ACR handling in match_prev_assignment() (Dapeng Mi)

   - Fix various PMU driver bugs and data leaks (Dapeng Mi)

   - Fix Intel PT stop/start with no update (Adrian Hunter)

  Intel uncore PMU driver updates:

   - Fix various uncore PMU setup robustness bugs (Zide Chen)

  AMD uncore PMU driver updates:

   - Add group validation (Sandipan Das)

  .. and misc fixes and updates by Dapeng Mi, Randy Dunlap and Zide Chen"

* tag 'perf-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (42 commits)
  perf/x86: Optimize ACR handling in match_prev_assignment()
  perf/x86/intel: Fix intel_cap handling on hybrid PMUs
  perf/x86: Remove stale fixed counter helper and fix hybrid PMU access
  perf/x86/intel: Unwind cpuc state if PEBS buffer setup fails
  perf/x86: Guard intel_pmu_cpu_dead() against invalid hybrid PMU casts
  perf/x86: Free hybrid state on PMU init failure
  perf/x86: Unregister PMI handler on PMU init failure
  perf/x86/intel/pt: Fix stop/start with no update
  perf/x86/intel/pt: Use bitwise access for PERF_HES_STOPPED
  perf/x86/intel/pt: Factor out pt_config_enable()
  uprobes: Switch uretprobes_srcu to SRCU-fast-updown
  srcu: Add lock guard for srcu_fast_updown flavor
  perf/x86/intel/pt: Drop kernel-doc for deleted struct members
  perf/x86/amd/uncore: Add group validation
  selftests/bpf: Add tests for forked/cloned optimized uprobes
  selftests/bpf: Add tests for uprobe nop10 red zone clobbering
  selftests/bpf: Add reattach tests for uprobe syscall
  selftests/bpf: Change uprobe/usdt trigger bench code to use nop10
  selftests/bpf: Change uprobe syscall tests to use nop10
  selftests/bpf: Emit nop,nop10 instructions combo for x86_64 arch
  ...
2026-08-18 12:31:07 -07:00
Linus Torvalds
a0acd94e38 Objtool updates for v7.3:
- Fix various klp-build bugs reported by Joe Lawrence
    (Josh Poimboeuf, Joe Lawrence)
 
  - Misc fixes and cleanups (Puranjay Mohan, Thomas Huth and Ingo Molnar).
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmqCz54RHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1gD/A/8DRBAjlv+aj6knJgmAP6GZI6Wc2pfjj1C
 5UPUZQf9/ib+/19D2YfOEvUM2T5RZg9fy2OhPGM3Qbe8GiCbKKpB1quJg3U7JB0P
 Z1jO7ViSt0n1ako04xWfDAOjRld32u7idDu/RD+qw5Sahzsy/HPejnIZS6AXYe8V
 Jw1KDviPfx3d2xPAcizp92Zg9SywcPcBI+jQVn61+ly1ZNbVTvUOlsARIWYOB4LI
 wTfeNt3G1rbrmODsm6bXcz7y+anuO8OmjYJbZKoGraiXwnbuZewocBXK00NPDAVx
 tuxnbwQ0g+dQ8gNQBL9bqEG/jeJzG7h/2n5s5/EnGV4SelQC/m+HPK/E40aHbwjv
 tCLIe9rVYXRpiMVgfR4xUDfTVM3EPiu6chIVPFYG8YDXZ0lMdUccGZEZEAIuflxT
 sSdHJT5P1ARzzuVHriPe3DS/jXEcd7UTVW99jcis3Xbl4TlfhQC5X2IueBfSYEFj
 hSMizFzaJJ1S7wC5x7lO6nNQklyzivLB1fARVT84uYCfdKcxPleobT6mSggW290Z
 u6kznFOLhiFt2eGAcWEEPzgIp9PjMKpXlHXzZnCl8TJyXVvwUGZgE6xEzKjJGa0B
 ZsGJyeJUwpnKPfS/1dULsFub/zTtviVIluCWs0teWhp5FAdbkGXGRBF8K1CqZpOw
 5tOwtn/kIDU=
 =4+gg
 -----END PGP SIGNATURE-----

Merge tag 'objtool-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull objtool updates from Ingo Molnar:

 - Fix various klp-build bugs reported by Joe Lawrence (Josh Poimboeuf,
   Joe Lawrence)

 - Misc fixes and cleanups (Puranjay Mohan, Thomas Huth and Ingo Molnar)

* tag 'objtool-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  objtool/klp: Fix vmlinux klp relocations for EXPORT_SYMBOL_FOR_MODULES()
  objtool/klp: Fix .kcfi_traps special section extraction
  objtool/klp: Fix vmlinux .klp.symid link error for .exitcall.exit symbols
  objtool/klp: Fix line numbers in Module.symvers parse errors
  objtool/klp: Fix relocations for EXPORT_SYMBOL_FOR_MODULES() symbols
  objtool/klp: Allow new references to module exports
  objtool/klp: Don't match local symbols against exports
  objtool/klp: Fix cross-module klp relocation section naming
  objtool/klp: Explicitly disallow patching or referencing init code/data
  objtool/klp: Ignore replacement offset of empty x86 alternatives
  objtool/klp: Fix size of empty special section entries
  objtool/klp: Fix vmlinux .klp.symid link error for .no_trim_symbol symbols
  objtool/headers: Sync tools/include/linux/objtool_types.h with include/linux/objtool_types.h
  objtool: Replace __ASSEMBLY__ with __ASSEMBLER__ in header files
  objtool/klp: Fix symbol resolution for duplicate data symbols
  objtool/klp: Add .klp.symid for sympos disambiguation
  objtool/klp: Skip hidden directories when finding objects
  objtool/klp: Fix false module dependencies caused by dead relocs
  objtool/klp: Normalize Module.symvers paths to module names
  objtool/klp: Fix module name normalization for paths with dots
2026-08-18 12:18:33 -07:00
Linus Torvalds
85cdaca697 arm64 updates for 7.3
ACPI:
 - Combine reads of AMU counters into a single FFH feedback counter op.
 
 Confidential computing:
 - Fix smp_processor_id() in preemptible context when retrieving an
   attestation token inside a realm.
 
 - Convert pKVM over to a "CC platform".
 
 - Clean-up our SWIOTLB configuration in preparation for reworking the
   handling of encrypted/decryped DMA buffers in the dma-mapping tree.
 
 CPU errata handling:
 - Work around broken device memory ordering on NVIDIA Olympus cores.
 
 - Fix broken 'nospectre_bhb' command-line option.
 
 - Select the idle loop backend instruction on the command-line.
 
 CPU features:
 - Replace our BBML2-noabort feature with the new architectural BBML3
   feature.
 
 - Disable in-kernel BTI for recent versions of Clang due to issues with
   livepatch that are still being investigated.
 
 - Clean-up documentation describing which ID register fields are exposed
   to userspace.
 
 Interrupts:
 - Preliminary work towards supporting FEAT_NMI, which cleans up our
   IRQ entry code and fixes some latent issues with pseudo-NMI.
 
 - Support for an SDEI backend to trigger an NMI backtrace.
 
 Memory management:
 - Treat all devices as coherent when CLIDR_EL1.LoC == 0.
 
 - Fix no-map handling of sub-page-sized regions.
 
 - Second attempt at unmapping the linear aliases of the kernel data and
   bss sections.
 
 - Fix EFI runtime calls when software-PAN is enabled.
 
 Miscellaneous:
 - Add Mark Rutland as a reviewer!
 
 - Tidy-up our futex cmpxchg logic when using the new LSUI instructions.
 
 - Drop the requirement on DYNAMIC_FTRACE_WITH_CALL_OPS when selecting
   HAVE_DYNAMIC_FTRACE_WITH_DIRECT_CALLS.
 
 - Fix a false-positive KCSCAN splat in the delay loop.
 
 - Use a portable typedef for 128-bit scalar types in our UAPI headers.
 
 - Non-critical fixes for Sashiko reports all over.
 
 MPAM:
 - Hook MPAM memory bandwidth counters into resctrl's counter assignment
   interface.
 
 - Fix a quirk in the MPAM bandwidth counting on Nvidia T241 so that it
   also applies to 63 bit counters.
 
 Perf:
 - Workarounds for hardware issues in the CMN-S3 PMU (Graviton 5) and CPU
   PMU (NVIDIA Olympus again!)
 
 - Add support for the DDR PMU on Marvell CN20K SoCs.
 
 - Add support for Picoheart implementations of the DCW PCIe PMU.
 
 - Add support for Channel/Rank/Bank filtering in the CXL PMU driver.
 
 - Add support for 64-bit counters in the CSPMU device.
 
 - Add support for revision 2 of the CMN S3 PMU.
 
 Ptrace:
 - Fix a decade-old bug in our handling of seccomp and tracing on syscall
   entry.
 
 - Fix regset handling for inactive SVE and SSVE registers.
 
 Selftests
 - Add some tests for the decade-old bug that we just tried to fix in our
   syscall entry path.
 
 - Fix SVE test crash on SME-only CPUs.
 -----BEGIN PGP SIGNATURE-----
 
 iQFEBAABCgAuFiEEPxTL6PPUbjXGY88ct6xw3ITBYzQFAmp+9HkQHHdpbGxAa2Vy
 bmVsLm9yZwAKCRC3rHDchMFjNEjXB/4y8KueLwgMOcpjzJom6ujmE2Ab7IOI+I5v
 rYQkGDdHLcQd0WW9gtFXoxlq/EUcWuVCGAdOF3PxkUmVhHJC45ZNSmBGS9/LbU3f
 AqeFskSE46D2gOdMXSscwGAQ+OiQ6WlSSgqy2dU1ZfTXy7ioxydWVUtvmqMmB85O
 ctN9Ocr3zAZuptuyLJurCJNnyCuzd55SIuy+WKU6NIpWseiIqiLEb/6HFbWcw6iV
 vVZjD/Je5my8Gfjuu12z7kJ6o5jwGNpI8U7Z0b68ESUG3b5fh9E2zVLIq0fvn83B
 rjPqg/Wj2TVGag/+yZgafLwQ/7111hhkdf1bPBitClx4GxOoZEjG
 =Iypw
 -----END PGP SIGNATURE-----

Merge tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux

Pull arm64 updates from Will Deacon:
 "There's a reasonable amount of stuff here, including a bunch of
  updates to the perf PMU drivers and some MPAM updates to expose the
  memory bandwidth counters via resctrl.

  On the architecture side, some highlights include support for BBML3
  and steps towards support for an architectural NMI solution, all
  wrapped up in a web of fixes for latent issues identified by Sashiko.

  ACPI:

   - Combine reads of AMU counters into a single FFH feedback counter op

  Confidential computing:

   - Fix smp_processor_id() in preemptible context when retrieving an
     attestation token inside a realm

   - Convert pKVM over to a "CC platform"

   - Clean-up our SWIOTLB configuration in preparation for reworking the
     handling of encrypted/decryped DMA buffers in the dma-mapping tree

  CPU errata handling:

   - Work around broken device memory ordering on NVIDIA Olympus cores

   - Fix broken 'nospectre_bhb' command-line option

   - Select the idle loop backend instruction on the command-line

  CPU features:

   - Replace our BBML2-noabort feature with the new architectural BBML3
     feature

   - Disable in-kernel BTI for recent versions of Clang due to issues
     with livepatch that are still being investigated

   - Clean-up documentation describing which ID register fields are
     exposed to userspace

  Interrupts:

   - Preliminary work towards supporting FEAT_NMI, which cleans up our
     IRQ entry code and fixes some latent issues with pseudo-NMI

   - Support for an SDEI backend to trigger an NMI backtrace

  Memory management:

   - Treat all devices as coherent when CLIDR_EL1.LoC == 0

   - Fix no-map handling of sub-page-sized regions

   - Second attempt at unmapping the linear aliases of the kernel data
     and bss sections

   - Fix EFI runtime calls when software-PAN is enabled

  Miscellaneous:

   - Add Mark Rutland as a reviewer!

   - Tidy-up our futex cmpxchg logic when using the new LSUI
     instructions

   - Drop the requirement on DYNAMIC_FTRACE_WITH_CALL_OPS when
     selecting HAVE_DYNAMIC_FTRACE_WITH_DIRECT_CALLS

   - Fix a false-positive KCSCAN splat in the delay loop

   - Use a portable typedef for 128-bit scalar types in our UAPI headers

   - Non-critical fixes for Sashiko reports all over

  MPAM:

   - Hook MPAM memory bandwidth counters into resctrl's counter
     assignment interface

   - Fix a quirk in the MPAM bandwidth counting on Nvidia T241 so that
     it also applies to 63 bit counters

  Perf:

   - Workarounds for hardware issues in the CMN-S3 PMU (Graviton 5) and
     CPU PMU (NVIDIA Olympus again!)

   - Add support for the DDR PMU on Marvell CN20K SoCs

   - Add support for Picoheart implementations of the DCW PCIe PMU

   - Add support for Channel/Rank/Bank filtering in the CXL PMU driver

   - Add support for 64-bit counters in the CSPMU device

   - Add support for revision 2 of the CMN S3 PMU

  Ptrace:

   - Fix a decade-old bug in our handling of seccomp and tracing on
     syscall entry

   - Fix regset handling for inactive SVE and SSVE registers

  Selftests

   - Add some tests for the decade-old bug that we just tried to fix in
     our syscall entry path

   - Fix SVE test crash on SME-only CPUs"

* tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: (95 commits)
  arm64/efi: Avoid voluntary preemption with efi_mm installed
  arm64: bti: Disable in-kernel BTI with recent versions of Clang
  arm64: entry: Avoid unnecessary local_irq_disable() on kernel exit
  irqchip/gic-v3: make the unmasking of pseudo-NMIs explicit when handling IRQs
  arm64: Disable KCSAN instrumentation in delay.o
  arm_mpam: Disable driver unbind to avoid UAF
  arm_mpam: Fix a NULL pointer dereference on unbinding after an error interrupt
  perf: arm_pmuv3: Zero initialize hw_id branch stack field
  arm64: mm: Unmap kernel data/bss entirely from the linear map
  iommu/arm-smmu-v3-sva: Use system_supports_bbml3() to detect CPU feature
  perf/arm-cmn: Support CMN S3 r2
  perf/arm-cmn: Plumb in new filter types
  perf/arm-cmn: Refactor event filter data
  perf/arm-cmn: Refactor event filter programming
  perf/arm-cmn: Rename filter variables for clarity
  arm64: mm: fix accidental linear mapping of no-map reserved memory
  tools: Ensure tools copy of linux/filter.h exports the UAPI
  kselftest/arm64: Fix abi test compilation errors
  arch: arm64: add early_param idle=<wfi|yield|nop>
  arm64: entry: mask DAIF before returning from C EL1 handlers
  ...
2026-08-18 11:57:17 -07:00
Linus Torvalds
d24f5cdbef Rust changes for v7.3
Toolchain and infrastructure:
 
  - Warn when using 'bindgen' < 0.72.1 with 'libclang' >= 22, since that
    combination may fail to build. It includes a probe for the bug in
    case 'bindgen' happens to be patched, and tests.
 
    In parallel, Nathan updated the instructions for the kernel.org
    LLVM+Rust toolchains so that the latest version of 'bindgen' is
    installed, which should avoid some of these situations.
 
  - Support testing 'rust_is_available.sh' with 'bash' as '/bin/sh'.
 
  - Fix an objtool warning by adding one more 'noreturn' function for
    Rust 1.99.0 (expected 2026-10-01).
 
  - Fix build error in the 'rusttest' target due to ambiguity when the
    'rustc-dev' component is installed, which was uncovered by the work
    to support Rust's GCC backend ('rustc_codegen_gcc').
 
  - Fix future Clang warnings in the upcoming powerpc support due to
    macro redefinitions in the UAPI helper header by including the
    arch-aware 'ioctl.h' header.
 
 'kernel' crate:
 
  - Rework module ownership support:
 
      - Move the module-related types into a new 'module' module and make
        the 'THIS_MODULE' pointer a constant of 'ModuleMetadata' so that
        modules can provide the pointer in const contexts, and add a
        'this_module' 'const fn' to retrieve it.
 
        This was enabled by upstream Rust's work on the 'const_mut_refs'
        and 'const_refs_to_static' features which were stabilized back
        in Rust 1.83.0.
 
      - Teach '#[vtable]' to associate implementations with their owning
        module, defaulting to the local one, including fallbacks for
        doctests, uses within the 'kernel' crate (like upcoming KUnit
        '#[test]'s for DRM) and 'rusttest'.
 
      - Set 'fops.owner' from the module pointer for DRM and miscdevice.
 
      - Migrate Rust Binder and configfs away from the old 'THIS_MODULE'
        'static' and finally remove it from the 'module!' macro.
 
  - 'num' module:
 
      - Add the new 'casts' module for lossless integer conversions.
 
        Rust's 'core' library's 'From' implementations do not cover
        conversions that are not portable or future-proof. However, the
        kernel supports a narrower set of architectures, which makes it
        helpful to provide more infallible conversions, instead of having
        developers use 'as' casts, which carry the risk of silently
        losing data.
 
        This goes along with previous work we did to avoid casts in Rust
        kernel code since they are more powerful than needed.
 
        Thus, provide safe 'const' conversion functions (e.g.
        'usize_as_u64' and 'u64_into_u8'), as well as the 'FromSafeCast'
        and 'IntoSafeCast' extension traits that provide conversions that
        are known to be lossless in the kernel, and an 'arch' submodule
        defining conversions that are known to be lossless on particular
        architectures (e.g. 64-bit platforms). For instance:
 
            // Conversion in const context.
            const USIZED_CONST: usize = u8_as_usize(255u8);
 
            // Non-const conversions.
            let a = u64::from_safe_cast(4096usize);
            let b: u64 = 4096usize.into_safe_cast();
 
      - Add 'Bounded::shr_exact' method in the vein of 'try_shrink' which
        shifts a bounded right only if it loses no set bits.
 
      - Fix unsoundness issue in the 'Bounded::shr' method by rejecting,
        at compile-time, shifts of at least the type's bit width.
 
  - 'fmt' module:
 
      - Route '{:p}' raw pointer formatting through the kernel's hashed
        '%p' format to prevent address leaks, including support for width
        and padding. Include tests for both 'no_hash_pointers' case and
        the default (hashed) one.
 
      - Fix the '{:p}' forwarding implementation, which could print the
        address of a temporary stack variable.
 
  - 'time' module:
 
      - Make 'Delta' generic over its time unit, with a default unit of
        nanoseconds ('Nsec'), preserving the existing behavior. Then, add
        a 'Jiffy' time unit.
 
      - Add the 'Delta::as_millis_ceil()' method.
 
      - Fix 'as_micros_ceil()' rounding near 'i64::MAX', which could
        yield a result one microsecond too small.
 
  - 'sync' module:
 
      - Implement 'ForeignOwnable' for 'ARef<T>', allowing C code to own
        an 'ARef<T>'.
 
      - Add a safe abstraction for 'rcu_barrier()'.
 
  - 'error' module: add all of the remaining error codes, except the
    deprecated compatibility aliases.
 
  - 'bug' module:
 
      - Fix build error on UML in 'warn_on!' for callers from within
        the 'kernel' crate.
 
      - Fix future 'dead_code' warning on arm and loongarch64 and under
        'CONFIG_BUG=n' in 'warn_on!', which would trigger with the
        upcoming SRCU abstractions.
 
      - Fix future build error in 'rusttest' on cross-compilation cases,
        which would trigger when 'warn_on!' has callers inside the
        'kernel' crate.
 
  - 'bitfield' module: fix build error for the upcoming support for
    Rust's GCC backend ('rustc_codegen_gcc') by always inlining a couple
    conversions used in tests.
 
 'pin-init' crate:
 
  - User-visible changes:
 
      - Merge the '__pinned_init' and '__init' methods and make 'Init'
        a marker trait.
 
      - Introduce public APIs 'raw_init' and 'raw_try_init' to prevent
        users from needing to invoke the internal
        '__pinned_init'/'__init' methods.
 
      - Emit errors for duplicate '#[pin]' attributes.
 
      - Link 'Zeroable::zeroed' and 'pin_init::zeroed' in documentation.
 
  - Other changes:
 
      - Fix unwind safety issues.
 
      - Clean up lint 'allow' and 'expect's.
 
      - Overhaul '#[cfg]' handling to pave the way for tuple structs and
        self-referential structs.
 
      - Mark many functions as '#[inline]' for better codegen with '-C
        opt-level=s' ('CC_OPTIMIZE_FOR_SIZE').
 
 'MAINTAINERS':
 
  - Update 'MODULE SUPPORT' to cover the new 'module' module.
 
 And some other fixes, cleanups and improvements.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEPjU5OPd5QIZ9jqqOGXyLc2htIW0FAmqCCJQACgkQGXyLc2ht
 IW3ErA//e5gz1OEDalINpUt1zYktodleilyxvaUkoR0Q0T+pQIgoMniD7OWxPCPG
 G6Qq/bBEPezwuMncJizsc3Gj9h9/KEPfZXaDYPt/p0rdVL4Ej5gOzpOWM1lB4XCA
 z2xgOwVSyY6Go6sTEru1tG8Qs7v72NmjqIf1088K+6NQ9CVwWBL78arXzIuzi4L/
 rK829rV/8evCxomQxCNN3Nb7VYXpmavRLqXvbF3mt8AAAkqlbF8I2DVZusZNJpNT
 0b9fpefw4Im8zwaXMP1Tiw1RCV8rAATKDjJARNEh0jUEKfJ6KGnO7hDqx0k7HGYG
 9T+ZLTSV4i24J2hs3f1+atN4rScPntpOSxUylBgPsregj2jdbUwWs80PdtzePBPD
 rxpUXY/1zFT0JcC9qkgnBwB7OXwR0GmLQdf70OtSj3SgVQnsulHv7Xe/BIXtxCkR
 +I88//hHssEIkyHvi2Q+F1id+aj3ag05UuKivE+pgs7rIINoOSO8B0XPRGmeXYeC
 uo+OTHz/wzq1/7qR/a/rTw28fW/H7gc/06c29qQagfuwrZz4rVzpaZrh7DyZEm18
 t4m+rtJ2Ccw8vmkl6Y8axx3nlRhaIICIlSgv2iGULYYOH5jZ9tdBAqxXxHlcCyLw
 Ns9n95MYvbLXDlO0+Woz4Y6Ltdz1BXXubH881WRQL4Zck3LJ10g=
 =4uyP
 -----END PGP SIGNATURE-----

Merge tag 'rust-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux

Pull Rust updates from Miguel Ojeda:
 "Toolchain and infrastructure:

   - Warn when using 'bindgen' < 0.72.1 with 'libclang' >= 22, since
     that combination may fail to build. It includes a probe for the bug
     in case 'bindgen' happens to be patched, and tests

     In parallel, Nathan updated the instructions for the kernel.org
     LLVM+Rust toolchains so that the latest version of 'bindgen' is
     installed, which should avoid some of these situations

   - Support testing 'rust_is_available.sh' with 'bash' as '/bin/sh'

   - Fix an objtool warning by adding one more 'noreturn' function for
     Rust 1.99.0 (expected 2026-10-01)

   - Fix build error in the 'rusttest' target due to ambiguity when the
     'rustc-dev' component is installed, which was uncovered by the work
     to support Rust's GCC backend ('rustc_codegen_gcc')

   - Fix future Clang warnings in the upcoming powerpc support due to
     macro redefinitions in the UAPI helper header by including the
     arch-aware 'ioctl.h' header

  'kernel' crate:

   - Rework module ownership support:

       - Move the module-related types into a new 'module' module and
         make the 'THIS_MODULE' pointer a constant of 'ModuleMetadata'
         so that modules can provide the pointer in const contexts, and
         add a 'this_module' 'const fn' to retrieve it

         This was enabled by upstream Rust's work on the 'const_mut_refs'
         and 'const_refs_to_static' features which were stabilized back
         in Rust 1.83.0

       - Teach '#[vtable]' to associate implementations with their
         owning module, defaulting to the local one, including fallbacks
         for doctests, uses within the 'kernel' crate (like upcoming
         KUnit '#[test]'s for DRM) and 'rusttest'

       - Set 'fops.owner' from the module pointer for DRM and
         miscdevice

       - Migrate Rust Binder and configfs away from the old
         'THIS_MODULE' 'static' and finally remove it from the 'module!'
         macro

   - 'num' module:

       - Add the new 'casts' module for lossless integer conversions

         Rust's 'core' library's 'From' implementations do not cover
         conversions that are not portable or future-proof. However, the
         kernel supports a narrower set of architectures, which makes it
         helpful to provide more infallible conversions, instead of
         having developers use 'as' casts, which carry the risk of
         silently losing data

         This goes along with previous work we did to avoid casts in
         Rust kernel code since they are more powerful than needed

         Thus, provide safe 'const' conversion functions (e.g.
         'usize_as_u64' and 'u64_into_u8'), as well as the
         'FromSafeCast' and 'IntoSafeCast' extension traits that provide
         conversions that are known to be lossless in the kernel, and an
         'arch' submodule defining conversions that are known to be
         lossless on particular architectures (e.g. 64-bit platforms).
         For instance:

             // Conversion in const context.
             const USIZED_CONST: usize = u8_as_usize(255u8);

             // Non-const conversions.
             let a = u64::from_safe_cast(4096usize);
             let b: u64 = 4096usize.into_safe_cast();

       - Add 'Bounded::shr_exact' method in the vein of 'try_shrink'
         which shifts a bounded right only if it loses no set bits

       - Fix unsoundness issue in the 'Bounded::shr' method by
         rejecting, at compile-time, shifts of at least the type's bit
         width

   - 'fmt' module:

       - Route '{:p}' raw pointer formatting through the kernel's hashed
         '%p' format to prevent address leaks, including support for
         width and padding. Include tests for both 'no_hash_pointers'
         case and the default (hashed) one

       - Fix the '{:p}' forwarding implementation, which could print the
         address of a temporary stack variable

   - 'time' module:

       - Make 'Delta' generic over its time unit, with a default unit of
         nanoseconds ('Nsec'), preserving the existing behavior. Then,
         add a 'Jiffy' time unit

       - Add the 'Delta::as_millis_ceil()' method

       - Fix 'as_micros_ceil()' rounding near 'i64::MAX', which could
         yield a result one microsecond too small

   - 'sync' module:

       - Implement 'ForeignOwnable' for 'ARef<T>', allowing C code to
         own an 'ARef<T>'

       - Add a safe abstraction for 'rcu_barrier()'

   - 'error' module: add all of the remaining error codes, except the
     deprecated compatibility aliases

   - 'bug' module:

       - Fix build error on UML in 'warn_on!' for callers from within
         the 'kernel' crate

       - Fix future 'dead_code' warning on arm and loongarch64 and under
         'CONFIG_BUG=n' in 'warn_on!', which would trigger with the
         upcoming SRCU abstractions

       - Fix future build error in 'rusttest' on cross-compilation
         cases, which would trigger when 'warn_on!' has callers inside
         the 'kernel' crate

   - 'bitfield' module: fix build error for the upcoming support for
     Rust's GCC backend ('rustc_codegen_gcc') by always inlining a
     couple conversions used in tests

  'pin-init' crate:

   - User-visible changes:

       - Merge the '__pinned_init' and '__init' methods and make 'Init'
         a marker trait

       - Introduce public APIs 'raw_init' and 'raw_try_init' to prevent
         users from needing to invoke the internal '__pinned_init' and
         '__init' methods

       - Emit errors for duplicate '#[pin]' attributes

       - Link 'Zeroable::zeroed' and 'pin_init::zeroed' in documentation

   - Other changes:

       - Fix unwind safety issues

       - Clean up lint 'allow' and 'expect's

       - Overhaul '#[cfg]' handling to pave the way for tuple structs
         and self-referential structs

       - Mark many functions as '#[inline]' for better codegen with '-C
         opt-level=s' ('CC_OPTIMIZE_FOR_SIZE')

  'MAINTAINERS':

   - Update 'MODULE SUPPORT' to cover the new 'module' module

  And some other fixes, cleanups and improvements"

* tag 'rust-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux: (54 commits)
  rust: add functions and traits for lossless integer conversions
  rust: kernel: add `LocalModule` fallback for `#[vtable]` `impl`s
  rust: fmt: route {:p} through HashedPtr to prevent address leaks
  rust: fmt: fix {:p} printing stack addresses
  rust: module: update MAINTAINERS to cover module.rs
  rust: macros: remove `THIS_MODULE` static from `module!`
  rust_binder: use `LocalModule` for `THIS_MODULE`
  rust: configfs: use `LocalModule` for `THIS_MODULE`
  rust: miscdevice: set fops.owner from driver module pointer
  rust: drm: set fops.owner from driver module pointer
  rust: macros: auto-insert OwnerModule in #[vtable]
  rust: doctest: add LocalModule fallback for #[vtable] ThisModule
  rust: module: add `THIS_MODULE` const to `ModuleMetadata` trait
  rust: module: move module types into `module.rs`
  rust: num: add Bounded::shr_exact
  rust: num: reject Bounded::shr overshifts at build time
  rust: num: use const_assert! in Bounded
  rust: uapi: replace direct asm-generic/ioctl.h include with linux/ioctl.h
  rust: time: add Delta::as_millis_ceil()
  rust: time: add jiffies time unit for Delta
  ...
2026-08-18 11:25:09 -07:00
Linus Torvalds
2063dd9d0b nolibc changes for v7.3
Highlights:
 * New architectures: Alpha
 * New library functionality: readlink(), getcwd()
 * Various bugfixes and cleanups
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQTg4lxklFHAidmUs57B+h1jyw5bOAUCan7WEAAKCRDB+h1jyw5b
 OJl9AQD1L1S4Gvg+e82cFHeQp44+oTbj6evLQrwlRe0GZmZxHQEAhA9qMc0blpfn
 E7EYaldFXNzbO5Sl4MDwTh2huWj00Qk=
 =BSX8
 -----END PGP SIGNATURE-----

Merge tag 'nolibc-20260814-for-7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/nolibc/linux-nolibc

Pull nolibc updates from Thomas Weißschuh:

 - New architecture: Alpha

 - New library functionality: readlink(), getcwd()

 - Various bugfixes and cleanups

* tag 'nolibc-20260814-for-7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/nolibc/linux-nolibc:
  tools/nolibc: add support for Alpha
  tools/nolibc/powerpc: mark ctr and xer as clobbered by system call
  tools/nolibc: remove dead __ARCH_WANT_SYS_OLD_SELECT
  selftests/nolibc: add debug information
  tools/nolibc: mark arg1 operand in __nolibc_syscall0() as write-only
  selftests/nolibc: Add test for getcwd() and readlink()
  tools/nolibc: unistd: Add readlink()
  tools/nolibc: unistd: Add getcwd()
2026-08-18 10:50:44 -07:00
Linus Torvalds
7b24dd46a7 liveupdate: updates for v7.3-rc1
KHO:
 * Fix size calculation in kho_preserved_memory_reserve() for preservations
   larger than 2 GiB
 
 LUO:
   * move liveupdate selftest utilities into a library so that selftests of
     subsystems participating in liveupdate, e.g. PCI and VFIO, can use them and
     drop direct ioctl calls from the tests
   * add end to end liveupdate test infrastructure that allows running the
     tests across a kexec in QEMU
   * remove redundant INIT_LIST_HEAD in luo_session_alloc()
   * remember the error status of an FLB retrieve() and return it on subsequent
     attempts rather than retrying retrieve() with an FLB in an unexpected
     state
   * reference count the outgoing FLB so that it cannot be freed while a caller
     is using it, the same way it's done for the incoming FLB
   * reject nonzero reserved field in LIVEUPDATE_SESSION_FINISH so that it can
     be reused by a future extension
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEeOVYVaWZL5900a/pOQOGJssO/ZEFAmp9oz8ACgkQOQOGJssO
 /ZHtBwf+LyzW59fGyPd8hHASkqcGzlvRGe9E1ML1XjbR7vMPPxCwt/WbJ6V5dbIb
 Se/jNVrcnaI0NE1vudeA3uNqdboQwOQ8+KiPdLp/SjGsPptlQgpORX86gMf5ggYR
 rVl7FFCqQcZmVHbAvLWhuSdVfhdADBjeR50JfqVcLUch1L48ykkHLJG+n7cEsClg
 2YGsANNyM+l72JPBHzjRsy57O4fxCr5z9AQLJTHJYkT7N3j3aXprCzY00duFfiZw
 4xOlvgUAkcxEOs5J27Ra8X+Wy6EmNwL72vZQLC7JuLCaGnfQ0EAtHuOB/E5CQX9G
 o9fwgR8mY4/UPM2ao7+MjkV2cv23yA==
 =p+yU
 -----END PGP SIGNATURE-----

Merge tag 'liveupdate-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux

Pull liveupdate updates from Mike Rapoport:
 "Kexec Handover:

   - Fix size calculation in kho_preserved_memory_reserve() for
     preservations larger than 2 GiB

  Live Update Orchestrator:

   - move liveupdate selftest utilities into a library so that selftests
     of subsystems participating in liveupdate, e.g. PCI and VFIO, can
     use them and drop direct ioctl calls from the tests

   - add end to end liveupdate test infrastructure that allows running
     the tests across a kexec in QEMU

   - remove redundant INIT_LIST_HEAD in luo_session_alloc()

   - remember the error status of an FLB retrieve() and return it on
     subsequent attempts rather than retrying retrieve() with an FLB in
     an unexpected state

   - reference count the outgoing FLB so that it cannot be freed while a
     caller is using it, the same way it's done for the incoming FLB

   - reject nonzero reserved field in LIVEUPDATE_SESSION_FINISH so that
     it can be reused by a future extension"

* tag 'liveupdate-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux:
  kho: fix size calculation in kho_preserved_memory_reserve()
  selftests/liveupdate: Move luo_test_utils.* into a reusable library
  selftests/liveupdate: Use luo_test_utils.c for liveupdate ioctl APIs
  liveupdate: Remember FLB retrieve() status
  liveupdate: Reference count outgoing FLB data
  liveupdate: reject nonzero reserved value for SESSION_FINISH
  liveupdate: Remove redundant INIT_LIST_HEAD in luo_session_alloc
  selftests/liveupdate: add end to end test infrastructure and scripts
2026-08-18 10:43:01 -07:00
Linus Torvalds
c5c7a47af8 Thermal control updates for 7.3-rc1
- Add support for the Directed Package-level Thermal Interrupt to
    the Intel thermal throttling driver to allow package-level thermal
    interrupts to go to one specific CPU in a processor package instead
    of going to all of the CPUs in it (Ricardo Neri)
 
  - Remove hwmon class devices created for thermal zones when the thermal
    zone devices holding them are removed (Rafael Wysocki)
 
  - Use sysfs_emit_at() in trans_table_show() (Thorsten Blum)
 
  - Clean up RFIM groups on DVFS failure and clean up ODVP on probe
    failures in the int340x thermal driver (Pengpeng Hou)
 
  - Remove redundant dev_err() from the int340x thermal driver and the
    bxt_pmic driver (Pan Chuang)
 
  - Simplify ptc_temperature_write() in the int340x thermal driver by
    using kstrtou32_from_user() (Dmitry Antipov)
 
  - Close fd on realloc() failure in the thermometer utility (Amarjeet)
 -----BEGIN PGP SIGNATURE-----
 
 iQFGBAABCAAwFiEEcM8Aw/RY0dgsiRUR7l+9nS/U47UFAmp+CyMSHHJqd0Byand5
 c29ja2kubmV0AAoJEO5fvZ0v1OO1BK8H/1IZB1+rtDdoWY/PduNeRU9Yq+lGk/CV
 +09bPM2EbPu6pepbpXJdPCc+IwX4P56FPs2w2nvmznRdbBAyo9aCwkP+Lu28cRP5
 HPLebzTmBycpURQactcAk2zSWISnYaS5cfBOmRsJPEOc6FTlByWOD28mD4GtRXlU
 96HpSperk0cnMNTewIaIqUweoBo6afXfEUTw6qbRPYUITxu0aS5MpQcQFcbcS78P
 rm6yhuYS0vFWVmmf3eQCOE7VeSC5CHWDqJ60754SrX5D5mrBjreUgQNESccSuS6U
 9RhyYVLfrhjr4+P1gvtygMbR1UV3tplcD0fSNlgs70NXljARvx+6arw=
 =UxYB
 -----END PGP SIGNATURE-----

Merge tag 'thermal-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull thermal control updates from Rafael Wysocki:
 "These include an introduction of Intel Directed Package Thermal
  Interrupt support into the thermal throttling driver for Intel
  processors, probe failure code path fixes and code cleanups in Intel
  thermal drivers, a thermal core fix related to hwmon, a sysfs-related
  cleanup of that code, and a thermometer utility fix:

   - Add support for the Directed Package-level Thermal Interrupt to the
     Intel thermal throttling driver to allow package-level thermal
     interrupts to go to one specific CPU in a processor package instead
     of going to all of the CPUs in it (Ricardo Neri)

   - Remove hwmon class devices created for thermal zones when the
     thermal zone devices holding them are removed (Rafael Wysocki)

   - Use sysfs_emit_at() in trans_table_show() (Thorsten Blum)

   - Clean up RFIM groups on DVFS failure and clean up ODVP on probe
     failures in the int340x thermal driver (Pengpeng Hou)

   - Remove redundant dev_err() from the int340x thermal driver and the
     bxt_pmic driver (Pan Chuang)

   - Simplify ptc_temperature_write() in the int340x thermal driver by
     using kstrtou32_from_user() (Dmitry Antipov)

   - Close fd on realloc() failure in the thermometer utility (Amarjeet)"

* tag 'thermal-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  thermal: hwmon: Remove hwmon class device along with its parent
  thermal: sysfs: Use sysfs_emit_at() in trans_table_show()
  tools/thermal/thermometer: close fd on realloc() failure
  thermal: intel: int340x: simplify ptc_temperature_write()
  thermal: intel: bxt_pmic: Remove redundant dev_err()
  thermal: intel: int340x: Remove redundant dev_err()
  thermal: intel: int3400: clean up ODVP on probe failures
  thermal: intel: int340x: clean up RFIM groups on DVFS failure
  thermal: intel: Add a syscore shutdown callback for kexec reboot
  thermal: intel: Add syscore callbacks for suspend and resume
  thermal: intel: Enable the Directed Package-level Thermal Interrupt
  thermal: intel: Add resources to handle directed package-level thermal interrupts
  x86/thermal: Add bit definitions for Intel Directed Package Thermal Interrupt
2026-08-18 08:59:40 -07:00
Linus Torvalds
a5778046a0 Power management updates for 7.3-rc1
- Minor fixes and cleanups in assorted cpufreq drivers (Dan Carpenter,
    Guru Das Srinagesh, Haoxiang Li, Karl Mehltretter, Sasha Finkelstein,
    and Pan Chuang)
 
  - Fix cpufreq table creation and bios_limits() callback in the Rust
    bindings (Priya Bala Govindasamy)
 
  - Add IPQ5210 support to qcom-nvmem driver (Varadarajan Narayanan)
 
  - Adjust the .adjust_perf() cpufreq driver callback to allow the
    maximum performance value to be passed to drivers and update the
    intel_pstate driver to use it (Rafael Wysocki)
 
  - Set policy->cur to the actual requested frequency in the intel_pstate
    driver when the performance policy is used (Rafael Wysocki)
 
  - Simplify HWP handling on Broadwell processors in intel_pstate (Rafael
    Wysocki)
 
  - Fix setting minimum P-state at init time in intel_pstate (Rafael
    Wysocki)
 
  - Consolidate frequency values computation in intel_pstate and clean up
    code in that driver (Rafael Wysocki)
 
  - Add missing kernel-doc descriptions for structure and union members
    in the amd-pstate driver (David Vernet)
 
  - Handle missing policy in dynamic EPP callbacks in the amd-pstate
    driver (EDAMAMEX)
 
  - Introduce EXPORT_SYMBOL_FOR_PSTATE_UT() to export amd-pstate driver
    symbols to the amd-pstate-ut subdriver (K Prateek Nayak)
 
  - Add dynamic EPP as an "energy_performance_preference" mode in
    amd-pstate, remove the "amd_dynamic_epp" kernel command line option
    and the "dynamic_epp" sysfs attribute, and update the dynamic_epp
    documentation accordingly (K Prateek Nayak)
 
  - Add unit tests for CPPC Performance Priority and the "dynamic" EPP
    mode in the amd-pstate driver (K Prateek Nayak)
 
  - Set min_limit_freq based on bios_min_perf in amd-pstate and remove
    the defensive check for bios_min_perf from it (K Prateek Nayak)
 
  - Fix EPP return type and handle errors in amd-pstate during
    initialization, toggle auto_sel in active mode on shared memory
    systems, and cache the firmware programmed EPP value (Marco Scardovi)
 
  - Skip tests in amd-pstate-ut if the amd-pstate driver is not in active
    use (Qianheng Peng)
 
  - Replace sprintf() with sysfs_emit() in sysfs show in the cpufreq
    schedutil governor and fix a self-contradictory comment in
    sugov_iowait_apply() (Zhongqiu Han)
 
  - Fix the usage example for the sampling_rate tunable of the ondemand
    cpufreq governor in admin-guide (wangxiaodong)
 
  - Avoid using deep idle states during initialization in the intel_idle
    driver to work around device handling issues (Rafael Wysocki)
 
  - Fix and refactor the ACPI processor driver code related to ACPI _LPI
    support and add ACPI _LPI support to intel_idle based on that ACPI
    processor driver update (Rafael Wysocki)
 
  - Backup and restore governor for cpufreq sptests (Yiwei Lin)
 
  - Remove unnecessary sudo from quick_shuffle() and remove unused local
    variables from switch_show_governor() in cpufreq selftests (Jinseok
    Kim)
 
  - Rename the PM core module parameter prefix to "pm" and allow the PM
    transition (DPM) watchdog to be disabled by default (Tzung-Bi Shih)
 
  - Fix off-by-one in wakelocks number limit check in the system sleep
    sysfs interface (Haowen Tu)
 
  - Remove kernel-doc markings from helper descriptions in the core
    hibernation code (Adi Nata)
 
  - Use %pe to print error pointer values in the hibernation core (Ronan
    Marchal)
 
  - Fix memory leak in snapshot_write_next() error path (Malaya Kumar
    Rout)
 
  - Delay allocating and linking the next swap_map_page in the
    hibernation image saving code until another image page actually
    needs to be recorded (Haesung Kim)
 
  - Fix cleanup ordering around scope-based pointers in OPP (Gregor
    Herburger).
 
  - Use clk_get_optional() for optional clocks in OPP (Praveen Talari).
 
  - Stop setting runtime_error on runtime resume callback failures to
    allow drivers to recover from resume issues (Praveen Talari)
 
  - Handle PMU registration failure during probe in the intel_rapl_tpmi
    driver (Sumeet Pawnikar)
 
  - Avoid optional imports in intel_pstate_tracer unless they are really
    needed (Yousef Alhouseen)
 
  - Add generic CPPC performance display to the cpupower utility, build
    and call CPPC information on non-AMD processors, make cpupower print
    kernel and hardware frequency information, and add libm to cpupower
    for generic CPPC view (Jeremy Linton)
 
  - Remove conditional return with no effect from cpupower (Sang-Heon
    Jeon)
 -----BEGIN PGP SIGNATURE-----
 
 iQFGBAABCAAwFiEEcM8Aw/RY0dgsiRUR7l+9nS/U47UFAmp+DXsSHHJqd0Byand5
 c29ja2kubmV0AAoJEO5fvZ0v1OO10Z4IAIYwM9RKwbwCqPMKGvWExIb+1kpEy1aw
 wyFnYSiQd09XCt8/YjERFR9gB7CfGduisTxEOqOdCIpGX2rT9Me5xO5aR5Gz4FE3
 bML7KyulS9tVyaEVBjFx1yDZxGTNooTQVTLIxBYbCVB1RrgiCGdLyC2okn79XHlk
 olTZemq59Kn0B6t7BP7UQ0WCCCAs3RlbrQIZSrVh0HydoO0DHlJvttN2fc7bjeiM
 Je/dSm14o+vjglkVpY1kbxzBHJOH7/XH5nqSQRoHoAZWdllWK4+iQtll63Un4A72
 2KG0O5+nFrS3d166TEjDEInnEwR012Sod/8Gk72M0IZZhG/naqs5ekE=
 =mn7E
 -----END PGP SIGNATURE-----

Merge tag 'pm-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull power management updates from Rafael Wysocki:
 "As has been the case for quite some time, this set of changes is
  dominated by cpufreq updates including intel-pstate and amd-pstate
  driver updates, minor fixes and cleanups of other assorted cpufreq
  drivers, schedutil governor updates, fixes of the Rust bindings, new
  hardware support (IPQ5210 in qcom-nvmem), and some updates of self
  tests related to cpufreq.

  The second largest group of changes are cpuidle updates consisting of
  intel_idle driver updates and ACPI processor idle driver updates, both
  mostly related to ACPI _LPI support.

  There are also updates related to system sleep, mostly in the
  hibernation core code, two operating performance points (OPP) updates,
  one runtime PM framework update, one power capping update, and some
  tools updates including the addition of ACPI CPPC support to cpupower.

  Specifics:

   - Minor fixes and cleanups in assorted cpufreq drivers (Dan
     Carpenter, Guru Das Srinagesh, Haoxiang Li, Karl Mehltretter, Sasha
     Finkelstein, and Pan Chuang)

   - Fix cpufreq table creation and bios_limits() callback in the Rust
     bindings (Priya Bala Govindasamy)

   - Add IPQ5210 support to qcom-nvmem driver (Varadarajan Narayanan)

   - Adjust the .adjust_perf() cpufreq driver callback to allow the
     maximum performance value to be passed to drivers and update the
     intel_pstate driver to use it (Rafael Wysocki)

   - Set policy->cur to the actual requested frequency in the
     intel_pstate driver when the performance policy is used (Rafael
     Wysocki)

   - Simplify HWP handling on Broadwell processors in intel_pstate
     (Rafael Wysocki)

   - Fix setting minimum P-state at init time in intel_pstate (Rafael
     Wysocki)

   - Consolidate frequency values computation in intel_pstate and clean
     up code in that driver (Rafael Wysocki)

   - Add missing kernel-doc descriptions for structure and union members
     in the amd-pstate driver (David Vernet)

   - Handle missing policy in dynamic EPP callbacks in the amd-pstate
     driver (EDAMAMEX)

   - Introduce EXPORT_SYMBOL_FOR_PSTATE_UT() to export amd-pstate driver
     symbols to the amd-pstate-ut subdriver (K Prateek Nayak)

   - Add dynamic EPP as an "energy_performance_preference" mode in
     amd-pstate, remove the "amd_dynamic_epp" kernel command line option
     and the "dynamic_epp" sysfs attribute, and update the dynamic_epp
     documentation accordingly (K Prateek Nayak)

   - Add unit tests for CPPC Performance Priority and the "dynamic" EPP
     mode in the amd-pstate driver (K Prateek Nayak)

   - Set min_limit_freq based on bios_min_perf in amd-pstate and remove
     the defensive check for bios_min_perf from it (K Prateek Nayak)

   - Fix EPP return type and handle errors in amd-pstate during
     initialization, toggle auto_sel in active mode on shared memory
     systems, and cache the firmware programmed EPP value (Marco
     Scardovi)

   - Skip tests in amd-pstate-ut if the amd-pstate driver is not in
     active use (Qianheng Peng)

   - Replace sprintf() with sysfs_emit() in sysfs show in the cpufreq
     schedutil governor and fix a self-contradictory comment in
     sugov_iowait_apply() (Zhongqiu Han)

   - Fix the usage example for the sampling_rate tunable of the ondemand
     cpufreq governor in admin-guide (wangxiaodong)

   - Avoid using deep idle states during initialization in the
     intel_idle driver to work around device handling issues (Rafael
     Wysocki)

   - Fix and refactor the ACPI processor driver code related to ACPI
     _LPI support and add ACPI _LPI support to intel_idle based on that
     ACPI processor driver update (Rafael Wysocki)

   - Backup and restore governor for cpufreq sptests (Yiwei Lin)

   - Remove unnecessary sudo from quick_shuffle() and remove unused
     local variables from switch_show_governor() in cpufreq selftests
     (Jinseok Kim)

   - Rename the PM core module parameter prefix to "pm" and allow the PM
     transition (DPM) watchdog to be disabled by default (Tzung-Bi Shih)

   - Fix off-by-one in wakelocks number limit check in the system sleep
     sysfs interface (Haowen Tu)

   - Remove kernel-doc markings from helper descriptions in the core
     hibernation code (Adi Nata)

   - Use %pe to print error pointer values in the hibernation core
     (Ronan Marchal)

   - Fix memory leak in snapshot_write_next() error path (Malaya Kumar
     Rout)

   - Delay allocating and linking the next swap_map_page in the
     hibernation image saving code until another image page actually
     needs to be recorded (Haesung Kim)

   - Fix cleanup ordering around scope-based pointers in OPP (Gregor
     Herburger).

   - Use clk_get_optional() for optional clocks in OPP (Praveen Talari).

   - Stop setting runtime_error on runtime resume callback failures to
     allow drivers to recover from resume issues (Praveen Talari)

   - Handle PMU registration failure during probe in the intel_rapl_tpmi
     driver (Sumeet Pawnikar)

   - Avoid optional imports in intel_pstate_tracer unless they are
     really needed (Yousef Alhouseen)

   - Add generic CPPC performance display to the cpupower utility, build
     and call CPPC information on non-AMD processors, make cpupower
     print kernel and hardware frequency information, and add libm to
     cpupower for generic CPPC view (Jeremy Linton)

   - Remove conditional return with no effect from cpupower (Sang-Heon
     Jeon)"

* tag 'pm-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (76 commits)
  cpufreq: imx6q: fix out-of-bounds write when probed more than once
  cpufreq: imx6q: fix devres accumulation across driver rebind
  rust: cpufreq: Fix temporary write in Registration::bios_limit_callback
  rust: cpufreq: Add CPUFREQ_TABLE_END as last table entry in TableBuilder::to_table
  opp: Use clk_get_optional() to avoid leaving opp_table->clk as an error pointer
  intel_idle: Avoid using deep idle states during initialization
  cpupower: remove conditional return with no effect
  cpufreq: intel_pstate: Adjust policy->cur in active mode to policy
  cpufreq/amd-pstate: Document missing kernel-doc members
  cpufreq/amd-pstate-ut: Add unit test for CPPC Performance Priority
  cpufreq/amd-pstate-ut: Add unit test for "dynamic" EPP mode
  cpufreq/amd-pstate: Reduce the scope of exported symbols
  Documentation/amd-pstate: Update dynamic_epp documentation with new behavior
  cpufreq/amd-pstate: Remove "amd_dynamic_epp" cmdline and "dynamic_epp" sysfs
  cpufreq/amd-pstate: Add dynamic EPP as an "energy_performance_preference" mode
  cpufreq/amd-pstate: Extract platform profile to EPP conversion into a helper
  cpufreq/amd-pstate: Remove the defensive check for bios_min_perf
  cpufreq/amd-pstate: Set min_limit_freq based on bios_min_perf
  powercap: intel_rapl_tpmi: Handle PMU registration failure during probe
  PM: sleep: Allow disabling DPM watchdog by default
  ...
2026-08-18 08:47:09 -07:00
Paolo Bonzini
d75b484605 KVM x86 misc changes for 7.3
- Fix VPID virtualization bugs where KVM would fail to flush hardware TLBs.
 
  - Harden the SNP and TDX "populate" ioctls against bad input, and to prepare
    for supporting in-place private<=>shared conversion.
 
  - Fix a variety of #DB priority bugs.
 
  - Fix a class of races related to enabling Hyper-V emulation on a vCPU after
    the vCPU is visible to the rest of KVM.
 
  - Use static calls for nested virtualization ops.
 
  - Move more KVM-internal code out of x86's kvm_host.h.
 
  - Enumerate support for a variety of Zhaoxin instructions that don't require
    explicit virtualization.
 
  - Fix missing EFER validation bugs, including in the KVM_SET_SREGS* path.
 
  - Harden kvm_vcpu_map() against double-mapping and thus leaking references.
 
  - Misc fixes and cleanups, e.g. for largely benign syzkaller splats.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEKTobbabEP7vbhhN9OlYIJqCjN/0FAmp8uZQACgkQOlYIJqCj
 N/2Pgw//ZmY9QZSvbSS69yYporgRhlTCMq1k3siLYfT19XShCpjO0KK9QTggs57L
 0JXgbv4kwzvWWliwlRVK3e2nw027GI0j0kDRdcI3RAsaufZCjVT300cfUJBy/T4C
 EQLULA8J3Q5pXStuW7SS2bMjI/D6J0+h80co1gfN4yeBDuKXUhtpmW9G/frCQyqI
 3DduI57IBWO+pHImMWVx5jFc6WeDokQPxVASWE4zAU5PobXZSQ2K7KCbcx/rHxLt
 3JZRw9sECF4Rn5DHm9Xag4bfZH0IR1jQ4P5fIzlvvYcW8yhj4CcTK648fVivBCL5
 cpVQRCUVM6DyAX7l6tchP44XHv8a+D/bB2qZUlKvrMiSYA3usW7olKEDNUPI0dsm
 vviat3br/XBu3msNkMZcYoP2WS+ka9zDAkSw7MkNWg1m62UfzvI70AQC0r7Fs/UG
 +bUwMpJ11C/TOjwVL8DNMu0RT2uPgZ2xgtyD/IeVrqlm867xtlGxit+Uqs9V0vro
 LC2YhNR2LYk8NhKO/IZsHI/9eTD4xQyPBn13U6dsZy19fqcPftSJM7avZfQNiA+l
 nPN3v/FZmM22k32hc4NmGCx1/pBU1QtnTcZ0Z91pVzD5+DrvpYnMJpdhazrLL18j
 IN2OK+Vy/WiP2xnAvCjOFcHCVgAe3SCorqIrjRlY2nMbnRmc03E=
 =bQJe
 -----END PGP SIGNATURE-----

Merge tag 'kvm-x86-misc-7.3' of https://github.com/kvm-x86/linux into HEAD

KVM x86 misc changes for 7.3

 - Fix VPID virtualization bugs where KVM would fail to flush hardware TLBs.

 - Harden the SNP and TDX "populate" ioctls against bad input, and to prepare
   for supporting in-place private<=>shared conversion.

 - Fix a variety of #DB priority bugs.

 - Fix a class of races related to enabling Hyper-V emulation on a vCPU after
   the vCPU is visible to the rest of KVM.

 - Use static calls for nested virtualization ops.

 - Move more KVM-internal code out of x86's kvm_host.h.

 - Enumerate support for a variety of Zhaoxin instructions that don't require
   explicit virtualization.

 - Fix missing EFER validation bugs, including in the KVM_SET_SREGS* path.

 - Harden kvm_vcpu_map() against double-mapping and thus leaking references.

 - Misc fixes and cleanups, e.g. for largely benign syzkaller splats.
2026-08-18 13:41:51 +02:00
Paolo Bonzini
15a9a2ba0c KVM selftests changes for 7.3, part 2
- Fix several issues with seeding KVM's pRNG, and rework the pRNG APIs to that
    the pRNG can be sanely used in host code, not just guest code.
 
  - Add an IRQ test to validate virtual IRQ deliverty for IRQs wired up via
    KVM_IRQFD + KVM_SET_GSI_ROUTING, with optional support for triggering IRQs
    via writes to an assigned VFIO device.
 
  - Add syscall wrappers to assert success on a variety of pthreads and CPU
    affinity APIs.
 
  - Set vCPU pthread affinity as early as possible to reduce contention issues
    that were surfaced by PREEMPT_LAZY, which result in runtimes of over a
    minute on large hosts, versus the expected ~5 seconds.
 
  - Rework the PMU counters test to run each testcase using a single VM with
    many vCPUs for each sub-testcase, instead of using a unique VM for each
    sub-testcase.  This cuts the runtime by ~20x.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEKTobbabEP7vbhhN9OlYIJqCjN/0FAmp8yNoACgkQOlYIJqCj
 N/2s+w/+KtexoVLUzAy5DwIpm2g0pHqPAm5me7lTj1IuKyPxCksmmskNu3Nrfpn+
 0fp0QyB3gfUFscwKgqq8waLHBRyszQvTgfF43h/Bvu7QoNgoBViu9ybkd91REkSM
 CZj6ltUiHYJ1AmyB2khc5kPisLdZvEewSr1A2I9PudaPDa7DlOzN7DOCq4yePYkq
 4Bt7oFKDB/BH1Cv/QlCpUbseKLydBX8Zgd9QZy8bTqRdEeHywXfbKv1b1AkX8Vc+
 C0puEKrnJ6gluBTERYZ8+ibLBdewt/Hr+JdqlVtVkjSF2esGAWW//RuDlRj2zRzl
 MTj5BK8MXotmrHp0RZD+QTcG6JEOVM5XtRTstJP4taKV1jKXxHcCa3+9jOSFbcU1
 0E7cklQOwbgXIGw/Tc2fQ1wHu2E4Ee/r7C29qGxx6xUZQ6krUYBqRUZMZ0e5isK1
 GW2EPpb8AXC6+XaoNeCP2rPhu6mB+GhC2Q4k9pKWjasDTLes6CkBfDf/+i5+LEXk
 oQ3UTP1qGqUmm1y5m9h7+jUy4CdlzIbcLIUUt4X0naNJbpJsZqRvX3D4SKLf/wtV
 ZPmmih2ha01gnErm3Znn8rxIIodEiwwXIRSSKi1IzBmghOJzgSXtynMzXmwOaQtW
 4vdT22Yf1ip3pREfvtbL0pPDdxaJI4ngmm8Ia/ORHLYFbJmA5aM=
 =fs2O
 -----END PGP SIGNATURE-----

Merge tag 'kvm-x86-selftests2-7.3' of https://github.com/kvm-x86/linux into HEAD

KVM selftests changes for 7.3, part 2

 - Fix several issues with seeding KVM's pRNG, and rework the pRNG APIs to that
   the pRNG can be sanely used in host code, not just guest code.

 - Add an IRQ test to validate virtual IRQ deliverty for IRQs wired up via
   KVM_IRQFD + KVM_SET_GSI_ROUTING, with optional support for triggering IRQs
   via writes to an assigned VFIO device.

 - Add syscall wrappers to assert success on a variety of pthreads and CPU
   affinity APIs.

 - Set vCPU pthread affinity as early as possible to reduce contention issues
   that were surfaced by PREEMPT_LAZY, which result in runtimes of over a
   minute on large hosts, versus the expected ~5 seconds.

 - Rework the PMU counters test to run each testcase using a single VM with
   many vCPUs for each sub-testcase, instead of using a unique VM for each
   sub-testcase.  This cuts the runtime by ~20x.
2026-08-18 13:24:04 +02:00
Paolo Bonzini
2bee2e6c98 KVM selftests changes for 7.3, part 1
- Clean up nested SVM's handling of GPRs on L2<=>L1 transitions, reuse the
    functionality for nested VMX, and drop the ucall hack that was fudging
    around the lack of GPR switching on nVMX.
 
  - Add a stress test to verify KVM doesn't clobber/drop #PF state, e.g. CR2,
    across save/restore, including when L2 is active.
 
  - Add a test to verify KVM_CREATE_VM accepts exactly what is reported by
    KVM_CAP_VM_TYPES.
 
  - Misc selftests fixes and cleanups
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEKTobbabEP7vbhhN9OlYIJqCjN/0FAmp8wrYACgkQOlYIJqCj
 N/2XHxAAgqT2MgtdpST9/n7pW1ifgiaRsxqFI09c2YheFVmpYzILVio4qaCLrO1e
 92whJbOuiXgPWqPOU0FyS0wHICo5Q4aMJG3ECoAufeBifHM6+pR/mNE2q4U95rkw
 jbLhEaRgWgeiHrRoPZo8KtH/gbzaXCJZJIkVfsRVFY10wPiymM/OSsSHeBHYsJAN
 L9vmoJFa14tFu5c2rwPcpqgczWj2mKgVnlGVPRX3MizVXUuOwfatdChFOEEDxKCC
 xsGieTbu19MBZuqcwzeIWLEw1e4TJcsi1YsCiwFGyV5r3eq2ZFvjMoLBJ7drLERs
 awHaK8kG3qOo1KMZO0fVKi7gOq41h8VqsGDx/RKr3sKdd4aO67X5Sw5YZWB4xy68
 TJduTwUn8DFHzl9VJK5iyyIw8R8E2EqlxlybMPh2B+luulzo5DkCD6XBjDo5TD1A
 m2Ky7BzTzGOVlHpSj6uqf5+654BW/nEDMAekXFD7NkQfdZ8Bz27PpdA7l1sijFU0
 0kDCRroAUqj/IVw+j2Ptnh+YbYYlKq/8OVu7RJmKw/nFSMSFLAiRn1U3xZedDrIW
 HU08F3xZ/FxNIqu9a8biYJsLJovUFG5l2V2NGDy8POOkPLQ+bERjq366h50LHY5d
 PPD8erp8cQwaX6Ypa3/K5lezUMTdDZowXevMfFt3/nV5gp37+Es=
 =VqlG
 -----END PGP SIGNATURE-----

Merge tag 'kvm-x86-selftests-7.3' of https://github.com/kvm-x86/linux into HEAD

KVM selftests changes for 7.3, part 1

 - Clean up nested SVM's handling of GPRs on L2<=>L1 transitions, reuse the
   functionality for nested VMX, and drop the ucall hack that was fudging
   around the lack of GPR switching on nVMX.

 - Add a stress test to verify KVM doesn't clobber/drop #PF state, e.g. CR2,
   across save/restore, including when L2 is active.

 - Add a test to verify KVM_CREATE_VM accepts exactly what is reported by
   KVM_CAP_VM_TYPES.

 - Misc selftests fixes and cleanups
2026-08-18 13:16:16 +02:00
Paolo Bonzini
4136288688 LoongArch KVM changes for v7.3
1. Advertise already-supported capabilities.
 2. Some bug fixes about timer and MMIO.
 3. Some hardening about interrupt injection.
 4. Replace kvm_err() with kvm_pr_unimpl().
 5. Add FPU/LSX/LASX test cases for selftests.
 -----BEGIN PGP SIGNATURE-----
 
 iQJKBAABCAA0FiEEzOlt8mkP+tbeiYy5AoYrw/LiJnoFAmp9ca4WHGNoZW5odWFj
 YWlAa2VybmVsLm9yZwAKCRAChivD8uImelAuD/4jhprQWR9b8RMQ9bGYaBDml+98
 fCRW8NPyicnct+97U/E9EXJrrMyyDOqJtOSnNQOVmTjz3IGQtzLoHULaJPqUv0Dh
 7xUbpmb7qkqxrykUEUa81tDnClpISfLcgUBWKsg0VGLyF7MIEnbtECTadbzQEd10
 hNXy/Pv8OiAIZe4rtlGWxOU5JxU6OVf0zEmXiS6cbqXrwxVl4STbF97/5ULqjU+D
 4KMMs1IcOdf4klQeoE1oKvWsCiedZQBkKbtsv2hpDMmY4lUdheJg9+0atr8Oh7VS
 TtlO6Fmt7ilK9eFOCapDcs4gf5WQgs8WXKAyVUYSoteyEXQ9kSF2bHMYiC+WaKhb
 kMRR9ZyJa086FwDvW9/TyMrP8HLR4ORa7ksOeBnGt4Uv9A92ZbGqvEqLILPoKsIR
 LBJUM17XuLlR9J56sYNtid3Rdq88VLo84Wfc0hW966b+6oNdOVQBPI2YRpk4wDT1
 Mtra60dtzwQ3jCW/GTjJThueEC4lqOFKHpYPIP3rd4aL8oCvfgLYlYZ4TiXHUjpX
 MgQ9rm8nDZAWipsjvt2yADFnv3YW4kD6hrn1S0EaDJXsTtT7pB6Mr0jlxQE/ZJdA
 ibXSubO5cakIdpMnAylL78ZyGZOWn6YOSG1pEjHjkI+in73sZ5a89k4s5ErxKxtB
 Hnc/FXwVWbylUdJkKw==
 =eMRy
 -----END PGP SIGNATURE-----

Merge tag 'loongarch-kvm-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson into HEAD

LoongArch KVM changes for v7.3

1. Advertise already-supported capabilities.
2. Some bug fixes about timer and MMIO.
3. Some hardening about interrupt injection.
4. Replace kvm_err() with kvm_pr_unimpl().
5. Add FPU/LSX/LASX test cases for selftests.
2026-08-18 13:11:45 +02:00
Paolo Bonzini
637315cb40 Merge tag 'kvm-riscv-7.3-1' of https://github.com/kvm-riscv/linux into HEAD
KVM/riscv changes for 7.3

- Svadu/Zicfiss/Zicfilp FWFT support for Guest
- Use try_cmpxchg for IMSIC MRIF RMW
- More arch-specific tracepoints in KVM RISC-V
- Eager Page Splitting for KVM RISC-V
- Optimize hfence request handling for SMP Guests
- Improve dirty log clearing by skipping zero bits in mask
- Guard HFENCE range loops against overflow
- CPU PM notifiers in KVM RISC-V for non-retentive idle states
- Fix kernel-mode vector context save/restore for Guest
2026-08-18 13:09:51 +02:00
Linus Torvalds
0f23d56f17 linux_kselftest-next-7.3-rc1
Fixes zram test failure in kernel_gte() when using dash and a spelling
 error in ftrace poll test comment.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEPZKym/RZuOCGeA/kCwJExA0NQxwFAmqDcTUACgkQCwJExA0N
 Qxxq6Q/7BCbPLp7csLCB5d37VO7OZ0bxgCu3W7hjQC6Edy0PAW29YuYdFKFqQ4b6
 Sw+z4m02uYrHwTNvaKSA6S9QiHHzjUp5ldX5HQ4LUKVADUuNVF6N6U/LxUofmHtp
 dpE8z4D0ueMj7XkoDwjUgq03brS2YSnL7fsjLcX7bSwGh4BmantGp4Yig1ffL1SG
 0EziRDQLAY9Iepr2UZ8kFkW4mTSLSXMNApTzL8FGcv6nUzvm9VM+SJdK1g9f1qph
 hccbz3s/QWXy1uG2H5Gp4BRrPkvgnabhe7WRnf3PUAD1QPdPfch6UrcpB0hVF4tx
 x2/grMmuf+rDlDVZwDNv9UbelIvT2Ll9Zt9fRzA6mqGWyjHgIzIxwpCb+dmQfw2q
 u/Rkzk9Oc1H7+ZalySv44jXTdJj5G+cGaQzT6GbQ+kTnJqT2PtNVQlZdKnPgjBFq
 8HsxT8KX1NvW9zDqUFG1lBsbssigL7pKDTM9dIqxR+g3Qs6bgCOo/vaNPemhA1ih
 ldhNrDrgL9sl2xio23URQS30swe6qtbte2Dd30OA+dLD3PM4tmfeznLp2fdElehD
 KzXi/PlicRFKQmOa/QPxaLphGaKX99dyWmgzCzFqnCA+i8xotxIFVTFQCyfrMx6O
 +Qmd9qnJyHyiTEeszvyESH998fByTh4EN9g/XZmb5lMgyxu6gh4=
 =2Uye
 -----END PGP SIGNATURE-----

Merge tag 'linux_kselftest-next-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest

Pull kselftest update from Shuah Khan:
 "Fix zram test failure in kernel_gte() when using dash and a spelling
  error in ftrace poll test comment"

* tag 'linux_kselftest-next-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:
  selftests/zram: fix kernel_gte() for POSIX sh
  selftests/ftrace: fix spelling error in poll test comment
2026-08-17 20:52:03 -07:00
Linus Torvalds
fd89b0be55 linux_kselftest-kunit-7.3-rc1
Fixes and new kunit and tool, enables new configs, and updates
 documentation:
 
 -- kunit: configs: enable GPIO kunit test cases in all_tests.config
 -- kunit: string-stream: Replace strlcat() with strscpy() and seq_buf
 -- kunit: configs: enable GPIO kunit test cases in all_tests.config
 -- Documentation: kunit: Test Kconfig entries shouldn't select other
    configs
 -- Documentation: kunit: Fix outdated FAQ entries
 
 Adds ability to skip entire test suites and an example test suite that
 can be skipped at runtime.
 
 -- kunit,rust: Add ability to skip entire test suites
 -- kunit: Add example of test suite that can be skipped at runtime
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEPZKym/RZuOCGeA/kCwJExA0NQxwFAmqDa/4ACgkQCwJExA0N
 Qxyo9BAAqaZhmbNMJoKQ7bU6sM7qHOVC7ZxWNE028Pij/Imi53270LF0W2muOgsV
 Ex8I5uTr/pMlClAJSSpz/Cu8YN+coXhKVlJvOmvUAd5buveVFuQpwL9kmZmhqD/c
 8S4N1fYYOIxXP+bxbYTdmBXCH+AwdfAAsRucZ+nLOK8g2ZDEfkQPScASHjNgQ9ED
 ZG6iRNynVRAigypzdBCU1KMs0+PbU0BK6f78l9HoUEBprjyUOaO4bJU9CxWamL7x
 ebJGU7xYmcr6t34VFQp8aHxMVIe1b6oiXXTvfGmVx8WtUAe1h8cm7ACU2apPSLlV
 PAjlj0bAtkBBBae3gI6oatWn0dOMeR76CdaKpLhhXXjDXod7Q41gu/WaxSIS1Jjb
 CotFVWalqpfTpLGiUvSRH9FXDaaUgskODHwAQO3EW9QpexxaWPciLUtWCRbvfFU9
 EEN/zxkSKME9DW6Z8pjwtnJgZ3/GEl+fTxQsRZ5NMkYY9RBo8OeZMlUSx6aACEl0
 etqWTQI3kIdojGifTCndKFhExe9hl/H48PORvQZUijOfcjWVEk45+i1W9YyB+DPg
 5V1b4lyq01IdAlxigK5BVklL5jzXFouR+eouhsfSd1c8rIQosJgzt1iB/9nWjB1n
 Dd84PcsqAKvt2kojFHQXaJhwryP0OxV6VgDFdqDfZ/dZuuobEZ0=
 =09RL
 -----END PGP SIGNATURE-----

Merge tag 'linux_kselftest-kunit-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest

Pull kunit updates from Shuah Khan:
 "Fixes and new kunit and tools, enable new configs:

   - configs: enable GPIO kunit test cases in all_tests.config

   - string-stream: Replace strlcat() with strscpy() and seq_buf

   - configs: enable GPIO kunit test cases in all_tests.config

  Documentation:

   - Test config entries shouldn't select other configs

   - Fix outdated FAQ entries

  Add the ability to skip entire test suites and an example test suite
  that can be skipped at runtime:

   - Add ability to skip entire test suites

   - Add example of test suite that can be skipped at runtime"

* tag 'linux_kselftest-kunit-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:
  kunit: tool: fix _list_tests filtering wrong variable when list has TAP prefix
  kunit: configs: enable GPIO kunit test cases in all_tests.config
  kunit: string-stream: Replace strlcat() with strscpy() and seq_buf
  Documentation: kunit: Fix outdated FAQ entries
  Documentation: kunit: Test Kconfig entries shouldn't select other configs
  kunit: Add example of test suite that can be skipped at runtime
  kunit,rust: Add ability to skip entire test suites
2026-08-17 19:44:06 -07:00
Linus Torvalds
1d7443e4dc fscrypt updates for 7.3
The main change this cycle is a significant simplification that's been
 overdue for a while now: standardizing on a single file contents
 encryption implementation in ext4 and f2fs, instead of having two.
 
 Specifically, the original filesystem-layer file contents encryption
 implementation is removed, and the blk-crypto implementation is now
 used unconditionally. blk-crypto delegates either to inline crypto
 hardware or to the CPU via blk-crypto-fallback. The latter is
 functionally equivalent to the original filesystem-layer code.
 
 The blk-crypto implementation already existed, but previously it was
 used only when the filesystem was mounted with "-o inlinecrypt". Now,
 "-o inlinecrypt" just selects whether inline crypto hardware is used.
 
 To allow maintaining that user control over hardware use, the
 blk-crypto API is extended with a new flag BLK_CRYPTO_CFG_ALLOW_HW.
 
 Overall, this removes quite a bit of redundant code from ext4, f2fs,
 and fs/crypto/. It should make things easier for ongoing filesystem
 efforts such as iomap support, large folios, and btrfs encryption.
 (btrfs had already been planning to use blk-crypto exclusively.)
 
 There are two small behavior changes of note:
 
 - Direct I/O now works on encrypted files even without
   "-o inlinecrypt", rather than falling back to buffered I/O. This is
   effectively a bugfix, though I'll continue to keep an eye out for
   any user that may have been depending on the buffered I/O fallback.
 
 - IV_INO_LBLK_32 policies are no longer supported in certain cases
   that didn't make sense and have no known uses.
 
 This has been in linux-next since July 22 with no reported issues.
 All encryption xfstests pass on ext4 and f2fs. As usual I've also been
 using it on a system with an fscrypt-encrypted home directory. Of
 course, the blk-crypto code paths also aren't new and were already
 being used on many systems via the inlinecrypt mount option.
 
 In addition to the main change described above, there are a few other
 cleanups such as using lock guards for mutexes, improving
 documentation, and removing a workaround for outdated gcc versions.
 -----BEGIN PGP SIGNATURE-----
 
 iIoEABYIADIWIQSacvsUNc7UX4ntmEPzXCl4vpKOKwUCaoDumhQcZWJpZ2dlcnNA
 a2VybmVsLm9yZwAKCRDzXCl4vpKOKwk1AP9gAHdxAK2tr+Wpklkos/qTMR3a7h2I
 xLmgwhLHmHoHTgD/cD+0eMoK4RIVVGS/73Bf7oF2qY5jOyfi1aGh4ERQ0AA=
 =0+o6
 -----END PGP SIGNATURE-----

Merge tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux

Pull fscrypt updates from Eric Biggers:
 "The main change this cycle is a significant simplification that's been
  overdue for a while now: standardizing on a single file contents
  encryption implementation in ext4 and f2fs, instead of having two.

  Specifically, the original filesystem-layer file contents encryption
  implementation is removed, and the blk-crypto implementation is now
  used unconditionally. blk-crypto delegates either to inline crypto
  hardware or to the CPU via blk-crypto-fallback. The latter is
  functionally equivalent to the original filesystem-layer code.

  The blk-crypto implementation already existed, but previously it was
  used only when the filesystem was mounted with "-o inlinecrypt". Now,
  "-o inlinecrypt" just selects whether inline crypto hardware is used.

  To allow maintaining that user control over hardware use, the
  blk-crypto API is extended with a new flag BLK_CRYPTO_CFG_ALLOW_HW.

  Overall, this removes quite a bit of redundant code from ext4, f2fs,
  and fs/crypto/. It should make things easier for ongoing filesystem
  efforts such as iomap support, large folios, and btrfs encryption
  (btrfs had already been planning to use blk-crypto exclusively.)

  There are two small behavior changes of note:

   - Direct I/O now works on encrypted files even without "-o inlinecrypt",
     rather than falling back to buffered I/O. This is effectively a
     bugfix, though I'll continue to keep an eye out for any user that
     may have been depending on the buffered I/O fallback.

   - IV_INO_LBLK_32 policies are no longer supported in certain cases
     that didn't make sense and have no known uses.

  This has been in linux-next since July 22 with no reported issues. All
  encryption xfstests pass on ext4 and f2fs. As usual I've also been
  using it on a system with an fscrypt-encrypted home directory. Of
  course, the blk-crypto code paths also aren't new and were already
  being used on many systems via the inlinecrypt mount option.

  In addition to the main change described above, there are a few other
  cleanups such as using lock guards for mutexes, improving
  documentation, and removing a workaround for outdated gcc versions"

* tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux: (29 commits)
  blk-crypto: Update docs for blk-crypto-fallback motivation
  blk-crypto: Remove unused function blk_crypto_config_supported()
  fscrypt: Update docs for data path
  fscrypt: Remove unused function fscrypt_finalize_bounce_page()
  f2fs: Update outdated comment in f2fs_write_begin()
  fs: Update outdated comment for SB_INLINECRYPT
  fscrypt: Update encryption policy version docs
  fscrypt: Replace some variable-size memsets with fixed-size
  fscrypt: Add safety checks to non-block-based en/decryption
  fscrypt: Merge bio.c and inline_crypt.c into block.c
  fscrypt: Remove unused functions and workqueue
  fscrypt: Remove fs-layer zeroout code
  fscrypt: Remove fscrypt_dio_supported()
  fscrypt: Replace calls to fscrypt_inode_uses_inline_crypto()
  fs/buffer: Remove fs-layer decryption code
  f2fs: Remove fs-layer file contents en/decryption code
  ext4: Further de-generalize the bio postprocessing code
  ext4: Make ext4_bio_write_folio() return void
  ext4: Remove fs-layer file contents en/decryption code
  Documentation: fscrypt: Update docs for inlinecrypt
  ...
2026-08-17 19:04:16 -07:00
Jori Koolstra
5d513ce19d selftest: Add tests for useful handling of LSM denials on SCM_RIGHTS
Tests SCM_RIGHTS fd passing on a socket with the new socket option
SO_RIGHTS_NOTRUNC turned on. To hook into the security_file_receive()
call, BPF is used. The BPF program shares a hashmap with userspace that
lists the inos to be blocked (of the receiver tgid).

Signed-off-by: Jori Koolstra <jkoolstra@xs4all.nl>
Link: https://patch.msgid.link/20260814172806.158954-1-jkoolstra@xs4all.nl
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-17 18:14:52 -07:00
Jiangshan Yi
6e5635a714 selftests: mptcp: diag: fix stack buffer overflow in get_subflow_info()
get_subflow_info() parses the subflow address string with:

	char saddr[64], daddr[64];

	ret = sscanf(subflow_addrs, "%[^:]:%d %[^:]:%d",
		     saddr, &sport, daddr, &dport);

The subflow_addrs buffer holds up to 1024 bytes and is taken directly
from the command line ("-c" argument). The "%[^:]" conversions have no
maximum field width, so if the address substring before the ':' exceeds
63 bytes, sscanf() writes past the end of the 64-byte saddr/daddr stack
buffers. This overflows the stack, corrupting adjacent stack data such
as the saved return address, and can crash the tool or lead to
out-of-bounds writes controlled by user-supplied input.

Bound both string conversions to the destination buffer size by adding
an explicit maximum field width of 63 (leaving room for the terminating
NUL), so at most 63 bytes are written into each 64-byte buffer:

	ret = sscanf(subflow_addrs, "%63[^:]:%d %63[^:]:%d",
		     saddr, &sport, daddr, &dport);

The subflow address can be passed in argument, so fixing this is helpful
when the tool is manually used.

Reviewed-by: Geliang Tang <geliang@kernel.org>
Signed-off-by: Jiangshan Yi <yijiangshan@kylinos.cn>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20260812-net-next-mptcp-misc-feat-7-3-v1-11-1905a818f6cb@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-17 17:25:50 -07:00
Geliang Tang
f4a1b63ed5 selftests: mptcp: fix const qualifier warnings in strchr usage
In mptcp_connect.c, strchr() returns a pointer to a character within
the input string, which is declared as const char *. Assigning this
return value to a non-const char * discards the const qualifier,
triggering compiler warnings:

 make: Entering directory 'tools/testing/selftests/net/mptcp'
   CC       mptcp_connect
 mptcp_connect.c: In function 'parse_cmsg_types':
 mptcp_connect.c:1267:22: warning: initialization discards 'const'
	qualifier from pointer target type [-Wdiscarded-qualifiers]
  1267 |         char *next = strchr(type, ',');
       |                      ^~~~~~
 mptcp_connect.c: In function 'parse_setsock_options':
 mptcp_connect.c:1295:22: warning: initialization discards 'const'
	qualifier from pointer target type [-Wdiscarded-qualifiers]
  1295 |         char *next = strchr(name, ',');
       |                      ^~~~~~
 make: Leaving directory 'tools/testing/selftests/net/mptcp'

Fix these warnings by declaring the 'next' variable as const char *,
as it is only used for read-only parsing.

Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20260812-net-next-mptcp-misc-feat-7-3-v1-10-1905a818f6cb@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-17 17:25:50 -07:00
Matthieu Baerts (NGI0)
1d206e8e43 selftests: mptcp: pcap: drop most of the payload
Limit the size of each captured packet to 108B (IPv4 only) or 128B (a
mix of v4 and v6): this should drop most of the payload that is
generally not needed when debugging an issue.

8 bytes are left in this payload, to be able to inspect the beginning,
just in case.

Please also note that generally, this payload is usually mostly filled
with 0, except at the end. This reduces the .pcap sizes, and reduce IO
usage, which helps debugging issues.

Reviewed-by: Mat Martineau <martineau@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20260812-net-next-mptcp-misc-feat-7-3-v1-9-1905a818f6cb@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-17 17:25:50 -07:00
Matthieu Baerts (NGI0)
a574bd9b61 selftests: mptcp: simult_flow: test name in pcap file
To be able to easily find out which pcap was produced by which test, the
selftest name is now added to the pcap file, similar to the other tests.

While at it, print the prefix name to be able to find which capture
files have been produced by which test after several runs. This prefix
was not printed anywhere before.

Reviewed-by: Mat Martineau <martineau@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20260812-net-next-mptcp-misc-feat-7-3-v1-8-1905a818f6cb@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-17 17:25:50 -07:00
Matthieu Baerts (NGI0)
158765a0e5 selftests: mptcp: connect: test name in pcap file
Even if the pcap prefix is printed in the test, it is clearer if this
prefix also include the test name: mptcp_connect.

With this, it is easily possible to find out which pcap was produced by
which test, and easily delete the right ones.

Reviewed-by: Mat Martineau <martineau@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20260812-net-next-mptcp-misc-feat-7-3-v1-7-1905a818f6cb@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-17 17:25:50 -07:00
Shardul Bankar
1aa38a1581 selftests: mptcp: check per-event MPTCP_RST_EMPTCP counters
Add named env-var expectations for each per-event MPTCP_RST_EMPTCP
counter, matching the pattern used by the existing JOIN/RST checks.
Each defaults to 0 and is checked silently on success; a mismatch prints
a check line and fails the test.  Counters absent from the running
kernel are skipped silently so older kernels do not false-fail.

The JOIN-related counters (MPJoinSynAckNoMPJoin, MPJoinAckNoMPJoin,
MPJoinAckNoCtx, MPJoinNotEstablished, MPJoinNoIdFound) are checked in
chk_join_nr() on fixed namespaces; the two remaining reset counters
(MD5SigReset, DssReset) stay in chk_rst_nr().

Add a test at the end of signal_address_tests that triggers
MPJoinSynAckNoMPJoin: ns1 signals an address that is already bound on
the client (ns2), where a TCP-only mptcp_connect listener is started.
The client's MP_JOIN routes locally to the TCP listener, which responds
with a plain SYN/ACK without the MP_JOIN option, and the new counter
increments on the client side.

Other per-event counters (MD5SigReset, MPJoinAckNoMPJoin, MPJoinAckNoCtx,
DssReset, MPJoinNotEstablished, MPJoinNoIdFound) are not currently
reachable from mptcp_join.sh; the env-var hooks are in place for future
tests to set expectations explicitly.

Signed-off-by: Shardul Bankar <shardul.b@mpiricsoftware.com>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20260812-net-next-mptcp-misc-feat-7-3-v1-6-1905a818f6cb@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-17 17:25:50 -07:00
Ian Rogers
78148c8529 perf evlist: Warn when 'sleep' workload is used without system-wide (-a) option
A common mistake when trying to record system-wide profiles for a given
duration is running commands like 'perf record sleep 1' or 'perf stat
sleep 1' without passing '-a' / '--all-cpus'. When '-a' is omitted, perf
defaults to per-process monitoring of the sleep process itself, which
does not collect system-wide activity and records very few events.

Add a warning in evlist__prepare_workload() when the workload executable
is 'sleep' and system-wide mode is not enabled.

Assisted-by: Antigravity:gemini-3.6-flash
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-17 16:04:06 -07:00
Jiebin Sun
16e113d46d perf c2c: document function view in perf-c2c man page
Describe the function view hierarchy (read-side function -> contending
writer function -> shared cachelines), the per-level indentation, and the
keys, with a worked example.

Document that reliable function attribution requires `iaddr` in
`--coalesce`, that the reader and writer may be the same function, and why
the coalesced function view cannot distinguish same-thread from
different-thread accesses in that case. Also document that verbose mode
includes code addresses in function rows.

Signed-off-by: Jiebin Sun <jiebin.sun@intel.com>
Reviewed-by: Tianyou Li <tianyou.li@intel.com>
Reviewed-by: Wangyang Guo <wangyang.guo@intel.com>
Reviewed-by: Ian Rogers <irogers@google.com>
Cc: Dapeng Mi <dapeng1.mi@linux.intel.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Thomas Falcon <thomas.falcon@intel.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-17 16:04:06 -07:00
Jiebin Sun
1975d27d11 perf c2c: add function view browser UI and cacheline detail
Add the browser front end: create/run/delete the hist_browser and add the
title. The d shortcut opens the existing per-cacheline detail view for the
selected level-3 cacheline. Level-3 entries retain the source cacheline
index, so the shortcut can locate the original entry without relying on a
potentially ambiguous virtual address.

Report a warning when the common model rejects a cacheline coalescing field
list without `iaddr`. Without it, the detail histograms may already have
merged samples from different functions and cannot support reliable
function attribution.

Keep visible-row accounting local to the function view by wrapping the
generic browser refresh callback and recounting the currently reachable
hierarchy before each redraw. This keeps navigation correct when a level-1
row is collapsed while level-3 descendants remain expanded, without adding
C2C-specific hooks to the shared hist_browser. Also handle Ctrl-C like the
other function-view exit keys.

Keep callchains hidden while the function browser runs, restoring the
user's setting while opening the cacheline detail view.

Wire the builder into perf_c2c__browse_function_view().

Signed-off-by: Jiebin Sun <jiebin.sun@intel.com>
Reviewed-by: Tianyou Li <tianyou.li@intel.com>
Reviewed-by: Wangyang Guo <wangyang.guo@intel.com>
Reviewed-by: Ian Rogers <irogers@google.com>
Cc: Dapeng Mi <dapeng1.mi@linux.intel.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Thomas Falcon <thomas.falcon@intel.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-17 16:04:05 -07:00
Jiebin Sun
7763561994 perf c2c: build and finalize the function view hierarchy
Add the builder that walks the top-level cacheline entries and, for each
read-side function, correlates the functions that write the same lines
(level 2) and the specific cachelines they contend over (level 3) within
each retained detail histogram. Aggregate the write traffic per contending
function, resort by store count, and prune writers/functions with no
contention. The finalize pass then computes the Cycles % denominator from
the surviving level-1 entries after pruning, so the column shows each
function's share of the functions retained in the table rather than of the
whole recording -- the semantics documented for Cycles % in perf-c2c.txt.

Expose c2c_function__build() and c2c_function__reset() for the TUI front
end added by the next patch. The builder requires iaddr in the cacheline
coalescing fields and returns the completed hists through an output
argument. Validate the inputs before replacing an existing model.

Function-view entries do not carry callchains. Suppress callchain handling
while building and tearing down the model so the common API does not depend
on the caller's current callchain setting.

Signed-off-by: Jiebin Sun <jiebin.sun@intel.com>
Reviewed-by: Tianyou Li <tianyou.li@intel.com>
Reviewed-by: Wangyang Guo <wangyang.guo@intel.com>
Reviewed-by: Ian Rogers <irogers@google.com>
Cc: Dapeng Mi <dapeng1.mi@linux.intel.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Thomas Falcon <thomas.falcon@intel.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-17 16:04:05 -07:00
Jiebin Sun
473a047faa perf c2c: add function view hierarchy entry creation
Add the entry-creation layer: owned-reference child allocation and
insertion, and the level-1/2/3 lookup-or-create functions keyed by
function symbol (level 1 read-side, level 2 writer) and by the source
cacheline's existing index (level 3).

Give synthetic children normal entry operations and acquire their thread
and map-symbol references. This lets the hierarchy teardown use
hist_entry__delete() for the common fields while the function-view free
callback handles the private child tree and containing allocation.

Reuse cacheline_idx to preserve the source entry identity without adding
function-view-only state. Add c2c_function__find_cacheline() to locate the
original cacheline entry by the same index.

These are driven by the hierarchy builder in the next patch and are
__maybe_unused until then.

Signed-off-by: Jiebin Sun <jiebin.sun@intel.com>
Reviewed-by: Tianyou Li <tianyou.li@intel.com>
Reviewed-by: Wangyang Guo <wangyang.guo@intel.com>
Reviewed-by: Ian Rogers <irogers@google.com>
Cc: Dapeng Mi <dapeng1.mi@linux.intel.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Thomas Falcon <thomas.falcon@intel.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-17 16:04:05 -07:00
Jiebin Sun
929c4ebb54 perf c2c: add function view stats merge and memory management
Add the per-entry stats/cstats aggregation helpers and hierarchy teardown.
Child common fields are released through hist_entry__delete(), while the
function-view free callback handles the private child tree and containing
allocation. Also add a helper for pruning writer entries with no stores or
cacheline children.

These are used by the entry-creation and builder patches that follow and
are __maybe_unused until then.

Signed-off-by: Jiebin Sun <jiebin.sun@intel.com>
Reviewed-by: Tianyou Li <tianyou.li@intel.com>
Reviewed-by: Wangyang Guo <wangyang.guo@intel.com>
Reviewed-by: Ian Rogers <irogers@google.com>
Cc: Dapeng Mi <dapeng1.mi@linux.intel.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Thomas Falcon <thomas.falcon@intel.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-17 16:04:05 -07:00
Jiebin Sun
e888662432 perf c2c: add HPP list parsing for function view columns
Add the parser that builds the function view's local HPP output and
sort lists from field strings. This includes dimension lookup, comparator
wrappers, c2c_fmt allocation, and the initialization entry points used by
the hierarchy builder.

The generic perf_hpp__setup_output_field() registers formats on the global
perf_hpp_list. Using it here would leave the function view's local list
without output columns and modify the cacheline view's list instead. Add
c2c_function_hists__setup_output_field() to append sort keys to the local
output list.

Signed-off-by: Jiebin Sun <jiebin.sun@intel.com>
Reviewed-by: Tianyou Li <tianyou.li@intel.com>
Reviewed-by: Wangyang Guo <wangyang.guo@intel.com>
Reviewed-by: Ian Rogers <irogers@google.com>
Cc: Dapeng Mi <dapeng1.mi@linux.intel.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Thomas Falcon <thomas.falcon@intel.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-17 16:04:05 -07:00
Jiebin Sun
1b4eb7a2dd perf c2c: add column rendering for function view
Add renderers for the function view's Cycles %, Store count, and
hierarchy identity columns. The identity column renders the read-side
function, contending writer, or cacheline, with indentation for the
hierarchy level. Also add width and header helpers, estimated-cycle
calculation, comparators, and the dimension table that ties them together.

Clamp the identity renderer's returned length to its local buffer before
using it for pointer and padding calculations. This handles snprintf-style
would-have-been lengths without changing normal output.

The next patch connects these dimensions to the view's HPP lists, so the
symbols used only there are temporarily marked __maybe_unused.

Signed-off-by: Jiebin Sun <jiebin.sun@intel.com>
Reviewed-by: Tianyou Li <tianyou.li@intel.com>
Reviewed-by: Wangyang Guo <wangyang.guo@intel.com>
Reviewed-by: Ian Rogers <irogers@google.com>
Cc: Dapeng Mi <dapeng1.mi@linux.intel.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Thomas Falcon <thomas.falcon@intel.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-17 16:04:05 -07:00
Jiebin Sun
e9ffc77f3f perf c2c: add function view model skeleton
Add the initial common model for the c2c function view: model state and
small helpers shared by the hierarchy construction and formatting added
in later patches.

Build the model from util/ so it remains independent of the TUI and
command-private symbols.

Signed-off-by: Jiebin Sun <jiebin.sun@intel.com>
Reviewed-by: Tianyou Li <tianyou.li@intel.com>
Reviewed-by: Wangyang Guo <wangyang.guo@intel.com>
Reviewed-by: Ian Rogers <irogers@google.com>
Cc: Dapeng Mi <dapeng1.mi@linux.intel.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Thomas Falcon <thomas.falcon@intel.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-17 16:03:42 -07:00
Jiebin Sun
734150717a perf c2c: extract shared data structures into util/c2c.h
The function browser belongs in libperf-ui.a, but that archive is also
linked into python/perf.so, where builtin command objects are unavailable.
The browser therefore cannot depend on types or callbacks owned by
builtin-c2c.c.

Move c2c_hists, compute_stats, c2c_hist_entry, and the shared column
formatting definitions from builtin-c2c.c to a new util/c2c.h. Move
c2c_fmt_free() and c2c_fmt_equal() to a new util/c2c.c.

Keep struct perf_c2c, the command instance, and
perf_c2c__browse_cacheline() private to builtin-c2c.c.

No functional change.

Signed-off-by: Jiebin Sun <jiebin.sun@intel.com>
Reviewed-by: Tianyou Li <tianyou.li@intel.com>
Reviewed-by: Wangyang Guo <wangyang.guo@intel.com>
Reviewed-by: Ian Rogers <irogers@google.com>
Cc: Dapeng Mi <dapeng1.mi@linux.intel.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Thomas Falcon <thomas.falcon@intel.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-17 15:07:08 -07:00
Tejun Heo
fab183d632 sched_ext: Merge branch 'for-7.3-arena-args' into for-7.3
Pull to receive the __arena argument conversion:

 67f1f4a48c ("sched_ext: Pass kernel arena pointers to ops_cid callbacks")
 a8dc810968 ("sched_ext: Convert sub-cap kfuncs to __arena cmask arguments")
 a05c5b5cb5 ("sched_ext: Convert scx_bpf_cid_override() to __arena array arguments")

along with the bpf-next branch carrying the __arena argument support they
depend on.

Conflict in kernel/sched/ext/ext.c between:

 c384ab8a0b ("sched_ext: Move the config-off sub-cap kfunc stubs into sub.c")

and:

 a8dc810968 ("sched_ext: Convert sub-cap kfuncs to __arena cmask arguments")

which updated the stubs in their old ext.c location. Resolved by keeping
ext.c without the stubs and applying the prototype conversion to the
relocated stubs in sub.c.

Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-17 11:20:34 -10:00
Linus Torvalds
1781f0b3d7 vfs-7.3-rc1.super
Please consider pulling these changes from the signed vfs-7.3-rc1.super tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCan7RJQAKCRCRxhvAZXjc
 oroBAP40BufiChnC6I9Ev79QWF+Pfri1r/3AR4xXRG4HkXQaYQD/YE+Ria3+Bt35
 +tWU66cYlQ/+9LfU8DJ3KXm7jPUBiQA=
 =hXLH
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.3-rc1.super' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull vfs superblock updates from Christian Brauner:

 - Make it possible to share a block device between multiple
   filesystems.

   erofs can mount read-only blob devices shared between many
   superblocks, but because we only tracked a single superblock a
   freeze, thaw, removal or sync on such a device was never propagated
   to all the superblocks using it, and there was no way to find them.

   Add an efficient table to lookup all superblocks using a given block
   device.

 - A bunch of pre-existing fixes fell out of this work:

   A block-device freeze racing a btrfs device change could leave the
   whole filesystem stuck frozen. A bdev_freeze() issued by "dmsetup
   suspend" or an LVM snapshot resolves that holder to freeze the
   filesystem. and bdev_thaw() resolves it again to thaw. A freeze
   landing while btrfs is adding, removing or replacing a device freezes
   the filesystem. The membership change then drops that link. So the
   matching thaw could no longer find the superblock.

   Forbid freezing a device for the duration of a membership change,
   modelled on deny_write_access()/allow_write_access().

* tag 'vfs-7.3-rc1.super' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (24 commits)
  super: fix dying superblock warning messages
  block: reject block device inodes with i_rdev == 0 in lookup_bdev()
  selftests/filesystems: add ustat() coverage
  fs: look up the superblock via the device table in user_get_super()
  super: make fs_holder_ops private
  f2fs: open via dedicated fs bdev helpers
  erofs: open via dedicated fs bdev helpers
  fs: tolerate per-superblock freeze errors on shared devices
  fs: look up superblocks via the device table in fs_holder_ops
  ext4: open via dedicated fs bdev helpers
  btrfs: open via dedicated fs bdev helpers
  xfs: port to fs_bdev_file_open_by_path()
  fs: add dedicated block device open helpers for filesystems
  fs: maintain a global device-to-superblock table
  ocfs2: don't reset s_dev on dismount
  ext4: use anonymous devices for KUnit test superblocks
  fs, block: move blk_mode_t and fop_flags_t into <linux/types.h>
  super: take lock after last reference count
  super: convert s_count to refcount_t s_passive
  btrfs: deny freezing devices undergoing a replace
  ...
2026-08-17 13:57:04 -07:00
Linus Torvalds
aaed66fadb vfs-7.3-rc1.ovl
Please consider pulling these changes from the signed vfs-7.3-rc1.ovl tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCan7RJQAKCRCRxhvAZXjc
 ok/9AQDpiRYIoLwnUa7URD92AQXBRQeSYFqicAqDqP3NpCUMwQD+IcmA1EtkfmaG
 ROdhiUJWe8TV5Ci1qNPXzoy1XRVhNQU=
 =xOj4
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.3-rc1.ovl' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull overlayfs updates from Christian Brauner:
 "This lets the merged overlayfs mount itself be idmapped through
  mount_setattr(MOUNT_ATTR_IDMAP), in addition to the already supported
  idmapped lower and upper layers. The same overlay tree can then be
  exposed under a different ownership view.

  Overlayfs already normalizes every underlying id through the relevant
  layer idmap when ovl_copyattr() copies attributes into the overlay
  inode. So the overlay inode's i_uid and i_gid are overlay-final ids.

  The overlay mount idmap composes on top of that and is applied at the
  overlay-inode boundary only while the underlying layers keep being
  accessed with the mounter's credentials through their own (possibly
  idmapped) mounts.

  So this only changes how the caller sees the overlay inode and never
  widens the mounter's access to the layers. The second,
  mounter-credential check in ovl_permission() against the real inode
  stays on the layer idmap.

  Most paths need no change because the VFS applies the mount idmap to
  the overlay inode before overlayfs runs or after it returns at the
  syscall boundary. Overlayfs only has to change where it bypasses the
  generic path.

  This also included is a fix for a double end_creating() on the
  overlayfs casefold-mismatch path"

* tag 'vfs-7.3-rc1.ovl' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  ovl: fix double end_creating() on the casefold-mismatch path
  ovl: document security.capability idmapping on the xattr forward paths
  selftests/filesystems/overlayfs: test idmapped overlay mounts
  selftests/filesystems/overlayfs: fix set_layers_via_fds link error
  docs: document idmapped overlay mounts
  ovl: allow idmapping overlay mounts
  ovl: handle idmapped mounts in ovl_set_acl()
  ovl: handle idmapped mounts in ovl_getattr()
  ovl: handle idmapped mounts in ovl_setattr()
  ovl: handle idmapped mounts in ovl_permission()
  ovl: handle idmapped mounts in ovl_create_object() and ovl_tmpfile()
2026-08-17 13:38:36 -07:00
Linus Torvalds
1c3e8cef79 vfs-7.3-rc1.misc
Please consider pulling these changes from the signed vfs-7.3-rc1.misc tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCan7RJQAKCRCRxhvAZXjc
 otI6AQCIwshv02UI9fmbTC9pFr8b+v/9IWQwdVULaH61HXgICQD7BE/CktL8nfRs
 zCzGS6kBdWgiOA6bdVpgGGLqiMRnQgo=
 =Kc+G
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.3-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull misc vfs updates from Christian Brauner:
 "Bigger cleanups:

   - The lockref dead-count handling is tidied up.

     The open-coded check for a count below zero as the dead marker
     relies on information the caller should not have.

   - make put_mnt_ns() leave mounts connected. Destroying a mount
     namespace disconnected its mounts from their mount points. So a
     file descriptor still open on the parent of a mount point could be
     used to peek under it.

     Locked mounts were already kept connected to prevent exactly that.
     But a mount is only locked when its tree is copied across a user
     namespace boundary. So a mount namespace set up by a privileged
     component had no locked mounts and its mounts were disconnected.
     Passing UMOUNT_CONNECTED keeps every mount connected and prevents
     that bug.

   - vfs_prepare_mode() passes S_IFDIR for directories. I meant to fix
     that ago but didn't get to it. So now someone finally did it.

     This kills the exception where the mode could be 0 when a directory
     was created whereas every other creation operation passed it
     explicitly already.

   - move long delayed work for ufs, jffs2, hfsplus, hfs and affs from
     the per-cpu system_long_wq to the new unbound system_dfl_long_wq.

     None of that work relies on per-cpu state and the work item is
     enqueued with queue_delayed_work() whose timer is global anyway. So
     it may as well benefit from scheduler task placement.

  Smaller fixes and cleanups:

   - unlock_buffer() and journal_end_buffer_io_sync() use
     clear_and_wake_up_bit()

   - the pipe page pools are unified into a single per-pipe pool and the
     extra wake_up(rd_wait) is limited to EPOLLET consumers

   - eventpoll now computes its timer slack lazily in ep_poll()

   - shrink_dcache_for_umount() keeps making progress on busy roots

   - excess xarray nodes are freed in clear_inode()

   - romfs detects hard link cycles

   - the user path of nested backing files is fixed

   - pidfd holds exec_update_lock around the namespace ioctl

   - non-memcg-aware nr_cached_objects is skipped during memcg slab
     shrink

   - iomap_write_iter() always returns status

   - mangle_path() is renamed to seq_mangle_path()

   - inode timestamp accessors are annotated

   - new regression test for pipe->poll_usage.

   - a few documentation, kernel-doc and selftest fixes"

* tag 'vfs-7.3-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (67 commits)
  selftests/namespaces: Fix racy pipe handshake in timens and pidns_separate
  selftests/epoll: add a regression test for pipe->poll_usage
  pipe: only enable the extra wake_up(rd_wait) for EPOLLET consumers
  pidfd: hold exec_update_lock around namespace ioctl
  fs: fix user path of nested backing files
  fs: remove stale inode_insert5() kernel-doc parameter
  fs: fix switch/case indentation in sysfs() syscall
  fs: document semantics of kstat::{uid,gid} fields
  dcache: keep shrink_dcache_for_umount() making progress on busy roots
  seq_file: rename mangle_path to seq_mangle_path
  nstree: add/fix struct ns_id_req kernel-doc member fields
  dcache: use lockref routines for dead count checks
  lockref: tidy up dead count handling
  initramfs: fix typo in reserve_initrd_mem comment
  fs/pipe: unify the page pools into a single per-pipe pool
  fs: annotate inode timestamp accessors
  eventpoll: compute timer slack lazily in ep_poll()
  selftests/filesystems: add mntns cleanup test
  put_mnt_ns(): leave mounts connected
  affs: Move long delayed work on system_dfl_long_wq
  ...
2026-08-17 12:56:12 -07:00
Linus Torvalds
de03b17ec0 vfs-7.3-rc1.kfunc
Please consider pulling these changes from the signed vfs-7.3-rc1.kfunc tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCan7RJQAKCRCRxhvAZXjc
 oqBnAQDzCTHIa0wColluZLaFVuL4pvipQzC7tjUUQCwPmy85EwEA2cyeguEkNYJZ
 SK3m4z8kfuZjO2tEOig+XCkmtVrSMQQ=
 =6gwq
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.3-rc1.kfunc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull vfs bpf access updates from Christian Brauner:
 "This adds a bpf_sock_read_xattr() kfunc so a BPF LSM program can read
  a user.* extended attribute from a socket's sockfs inode locklessly.

  userspace already uses user.* xattrs on sockets to implement socket
  rate limiting and to tag sockets for other purposes such as a varlink
  registry. There has been no efficient way for a BPF program to read
  those labels back. With this a listening socket marked from userspace
  with fsetxattr() can be read back during bind or connect and acted
  upon on the connecting socket. That lets userspace mark sockets and
  later rediscover them or implement policy on them"

* tag 'vfs-7.3-rc1.kfunc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  selftests/bpf: Add test for bpf_sock_read_xattr() kfunc
  fs: Add bpf_sock_read_xattr() kfunc to read socket xattrs
2026-08-17 11:02:10 -07:00
Marcelo Mendes Spessoto Junior
96bf660d4c selftests: net: separate ipv6_flowlabel_mgr test
The ipv6_flowlabel_mgr used to be a component of a broader overall
flow label test, defined in the ipv6_flowlabel.sh file. This wrapper
script called tests defined on ipv6_flowlabel.c and
ipv6_flowlabel_mgr.c files, using predefined parameters and enforcing
the in_netns.sh helper to set network namespaces for each test env.

However, the ipv6_flowlabel_mgr.c was drastically changed recently.
These modifications led to the mgr tests becoming a self contained and
independent test suite, enforcing netns creation by itself and
not relying on the ipv6_flowlabel.sh wrapper for proper test execution
anymore. Therefore, remove the mgr tests from the wrapper and update
the Makefile to handle it as a standalone test program instead.

Signed-off-by: Marcelo Mendes Spessoto Junior <marcelomspessoto@gmail.com>
Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>
Link: https://patch.msgid.link/20260813030708.37609-1-marcelomspessoto@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-17 10:58:53 -07:00
Daniel Borkmann
f79066c784
selftests/bpf: Add tests for a store on a fault prone qdisc pointer
Cover the store which used to be left as a plain BPF_STX without an
exception table entry:

  1: R1=trusted_ptr_Qdisc()
  ; struct Qdisc *next = sch->next_sched;
  1: (79) r1 = *(u64 *)(r1 +216)        ; R1=ptr_Qdisc()
  ; next->limit = 1000;
  3: (63) *(u32 *)(r1 +20) = r2         ; R1=ptr_Qdisc() R2=1000

Assert that it is rejected now.

  # LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh -- ./test_progs -t ns_bpf_qdisc
  [...]
  #257/1   ns_bpf_qdisc/fifo:OK
  #257/2   ns_bpf_qdisc/fq:OK
  #257/3   ns_bpf_qdisc/attach to mq:OK
  #257/4   ns_bpf_qdisc/attach to non root:OK
  #257/5   ns_bpf_qdisc/incompl_ops:OK
  #257/6   ns_bpf_qdisc/invalid_dynptr:OK
  #257/7   ns_bpf_qdisc/invalid_dynptr_cross_frame:OK
  #257/8   ns_bpf_qdisc/invalid_dynptr_slice:OK
  #257/9   ns_bpf_qdisc/untrusted_write:OK
  #257/10  ns_bpf_qdisc/dynptr_use_after_invalidate_clone:OK
  #257     ns_bpf_qdisc:OK
  Summary: 1/10 PASSED, 0 SKIPPED, 0/0 FAILED

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20260817141015.878071-3-daniel@iogearbox.net
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-08-17 19:31:53 +02:00
Daniel Borkmann
2b918fe2f1
selftests/bpf: Add tests for fault prone loads out of RCU pointers
Cover the two loads which used to lose the BPF_PROBE_MEM rewrite, both reached
from an RCU read-side critical section. The purpose of this patch is to assert
load success in order to make sure to not trigger verifier_bug_if() on
bpf_may_fault_on_deref() due to forgotten rewrite of a probed pointer.

  # LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh -- ./test_progs -t rcu_read_lock
  [...]
  #332/1   rcu_read_lock/success:OK
  #332/2   rcu_read_lock/rcuptr_acquire:OK
  #332/3   rcu_read_lock/negative_tests_inproper_region:OK
  #332/4   rcu_read_lock/negative_tests_rcuptr_misuse:OK
  #332     rcu_read_lock:OK
  Summary: 1/4 PASSED, 0 SKIPPED, 0/0 FAILED

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/bpf/20260817141015.878071-2-daniel@iogearbox.net
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-08-17 19:31:52 +02:00
Daniel Borkmann
78d8e5b375
selftests/bpf: Add tests for pointer type merge at a shared load
Cover the ways in which the type recorded for a shared load used to lose
the BPF_PROBE_MEM rewrite which would then trigger a NULL deref if not
handled properly.

  # LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh -- ./test_progs -t mem_rdonly_untrusted
  [...]
  #242/1   mem_rdonly_untrusted/btf_id_to_ptr_mem:OK
  #242/2   mem_rdonly_untrusted/ldx_is_ok_bad_addr:OK
  #242/3   mem_rdonly_untrusted/ldx_is_ok_good_addr:OK
  #242/4   mem_rdonly_untrusted/offset_not_tracked:OK
  #242/5   mem_rdonly_untrusted/stx_not_ok:OK
  #242/6   mem_rdonly_untrusted/atomic_not_ok:OK
  #242/7   mem_rdonly_untrusted/atomic_rmw_not_ok:OK
  #242/8   mem_rdonly_untrusted/kfunc_param_not_ok:OK
  #242/9   mem_rdonly_untrusted/mixed_mem_type:OK
  #242/10  mem_rdonly_untrusted/mixed_mem_untrusted_btf_id_type:OK
  #242/11  mem_rdonly_untrusted/mixed_mem_btf_id_type:OK
  #242/12  mem_rdonly_untrusted/mixed_rdonly_mem_btf_id_type:OK
  #242/13  mem_rdonly_untrusted/mixed_mem_mem_type:OK
  #242/14  mem_rdonly_untrusted/mixed_map_value_mem_type:OK
  #242/15  mem_rdonly_untrusted/mixed_stack_mem_type:OK
  #242/16  mem_rdonly_untrusted/diff_size_access:OK
  #242/17  mem_rdonly_untrusted/misaligned_access:OK
  #242/18  mem_rdonly_untrusted/null_check:OK
  #242/19  mem_rdonly_untrusted/ldx_is_ok_commuted_addr:OK
  #242/20  mem_rdonly_untrusted/helper_param_not_ok:OK
  #242     mem_rdonly_untrusted:OK
  Summary: 1/20 PASSED, 0 SKIPPED, 0/0 FAILED

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/bpf/20260817141015.878071-1-daniel@iogearbox.net
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-08-17 19:31:52 +02:00
Changwoo Min
9d19ca5d0e
selftests/bpf: Remove duplicate copies of the arena spinlock qnodes
bpf_arena_spin_lock.h defines its 64KB qnodes array in the header, so
every translation unit including it emits a copy. __weak makes them all
resolve to one instance, but bpftool gen object merges only the symbols
and concatenates each input's .addr_space.1 bytes, leaving the surplus
copies unreferenced in the linked object.

libarena links ten such units, so nine copies were dead weight (bytes):

  object                             before       after
  -----------------------------------------------------
  .addr_space.1 in libarena.bpf.o    676200       86376
  libarena.skel.h                   2100123      892371
  libarena_asan.skel.h              2641124     1466477

Declare qnodes in the header and let each program define it once:
libarena in src/common.bpf.c, and the arena_spin_lock test beside the
lock it guards.

Tested with test_progs -t arena_spin_lock and -t libarena.

Signed-off-by: Changwoo Min <changwoo@igalia.com>
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Link: https://lore.kernel.org/bpf/20260817160249.655916-1-changwoo@igalia.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-08-17 19:31:12 +02:00
Linus Torvalds
cd051cfe1e vfs-7.3-rc1.failfs
Please consider pulling these changes from the signed vfs-7.3-rc1.failfs tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCan7RJAAKCRCRxhvAZXjc
 ouz+AQCXKHb1Ay9ra1RG+dGu8mCpVZLebMt/+VO0/beMCqiqWAD8ChgvsFqObmr5
 8vLKOnzsSMeglRYGPL81h3xnaILRIQk=
 =0qwg
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.3-rc1.failfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull failfs filesystem from Christian Brauner:
 "Add failfs and expose a FD_FAILFS_ROOT sentinel.

  This allows userspace to shed their filesystem state completely. A
  process with its root or working directory in failfs must anchor every
  path lookup at an explicit file descriptor. Absolute paths, absolute
  symlinks and AT_FDCWD-relative lookups simply fail.

  Failfs is the counterpart to nullfs. nullfs says adds a permanently
  empty, immutable directory whose lookups fail with ENOENT but which
  can be opened, read, stat'd and mounted upon. Failfs on the other hand
  fails every operation. The root cannot be opened at all. A single
  instance is mounted during early boot via kern_mount(), which makes it
  logically distinct from every mount namespace.

  This is accompanied by a new fchroot() system call which makes
  chrooting via a file descriptor a first class concept. It's possible
  to chroot into failfs as an unprivileged user provided the task has no
  new privileges set"

* tag 'vfs-7.3-rc1.failfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  Documentation: add failfs documentation
  selftests/filesystems: add failfs selftests
  arch: hookup fchroot() system call
  fs: support FD_FAILFS_ROOT in fchroot()
  fs: add fchroot()
  fs: support FD_FAILFS_ROOT in fchdir()
  fs: add failfs
2026-08-17 09:15:52 -07:00
Linus Torvalds
b9cba7ebfe vfs-7.3-rc1.binfmt
Please consider pulling these changes from the signed vfs-7.3-rc1.binfmt tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCan7RJAAKCRCRxhvAZXjc
 ovtnAQDiMF2CvH2vr/eiUEUNdDjeyzRKipkh3a9krO0XbFxpnAD8CZypBFw/oWOQ
 7z3PDGhHp10ie6KYC45XbUc+a4b6vgQ=
 =X9RZ
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.3-rc1.binfmt' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull binfmt updates from Christian Brauner:
 "This contains a bunch of work for binfmt_misc. It fixes a bunch of
  old bugs, reworks the locking, and then extends the format registry
  so a binary type can be matched programmatically and its interpreter
  computed per exec instead of being a fixed string recorded at
  registration time.

  This allows nixos and other to e.g., implement relocatable binaries
  meaning the interpreter/dynamic loader can be determined
  programatically, say found relative to the binary. The mechanism is
  flexible and can support other policies:

   - Handler lookup is now an rcu walk. An exec that matches no
     binfmt_misc entry should now never write to a shared cacheline

   - remove the VERBOSE_STATUS and USE_DEBUG compile time toggles

   - convert the entry file to a seq_file which simplifies things quite
     a bit and kills a lot of custom logic

   - make flags proper enums

   - rename struct Node to binfmt_misc_entry

   - allow entries to be removed with unlink(2)

   - Add the ability to attach bpf programs to binfmt_misc entries so
     it's possible to dynamically choose the execution environment such
     as the loader or interpreter on a per binary basis.

     A handler is an instance of a binfmt_misc_ops struct_ops with a
     ->match() and a ->load() program. match() decides from the entry
     lookup walk whether the handler applies under the same
     registration-order. It can read file content as needed not only the
     prefetched 256 bytes in bprm->buf.

     load() then selects the interpreter and stages it through the new
     bpf_binprm_set_interp(), bpf_binprm_set_interp_arg() and
     bpf_binprm_set_flags() kfuncs.

     Handlers are published in a registry keyed by the registering
     task's user namespace and activated through the existing text
     interface with a new 'B' type carrying the handler name:

	echo ':origin:B::::nix:' > /proc/sys/fs/binfmt_misc/register

     The permission and namespacing model is unchanged. Activating a
     handler requires the same write access to an instance as any other
     registration. A container mounting its own instance escapes the
     host's entries exactly as before. The computed interpreter is
     opened with open_exec() under the caller's credentials and goes
     through full LSM vetting as the next binprm level. A program can
     only ever redirect the caller to something the caller could exec
     anyway.

   - Two dispatch modes are added. So far the chosen interpreter owns
     the whole process identity (argv[0], /proc/pid/cmdline,
     /proc/self/exe all name interpreter information). So relocatable
     find the dynamic linker instead. Also a binary passed to execveat()
     as an inaccessible O_CLOEXEC fd cannot run at all and gdb trips
     because AT_ENTRY and AT_PHDR do not match the exe file. So PIE
     symbols are unrelocated.

     This adds transparent dispatch which allows the interpreter to load
     the binary through AT_EXECFD and leaves the argument vector exactly
     as the caller built it and labels mm->exe_file and comm with the
     binary. It also raises the AT_FLAGS_TRANSPARENT_INTERP aux vector
     bit. The interpreter keeps control of mapping the binary.

     The second mode is loader substitution. This allows a binary to be
     executed natively and only the interpreter to be changed.

   - Last, interpreters can be bound at registration time. Each
     interpreter is opened by its own write with the credentials the
     entry file was opened with. The program picks one per exec with
     bpf_binprm_select_interp().

     Ucounts are used to properly account for pre-opened interpreters
     via /proc/sys/user/max_binfmt_misc_interpreters"

* tag 'vfs-7.3-rc1.binfmt' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (63 commits)
  binfmt_misc: document the pre-opened interpreter limit
  selftests/exec: test the pre-opened interpreter limit
  binfmt_misc: correctly account pre-opened interpreters
  binfmt_misc: document interpreters bound by a 'B' entry
  selftests/exec: test interpreters bound to a 'B' entry
  binfmt_misc: let a 'B' entry bind its interpreters
  binfmt_misc: carry pre-opened interpreters in struct binfmt_misc_interp
  selftests/exec: share the bpf handler preconditions
  binfmt_misc: document registering an entry disabled
  selftests/exec: test registering an entry disabled
  selftests/exec: let binfmt_flag_supported() return a bool
  selftests/exec: check that a binfmt_misc instance cannot be pinned
  binfmt_misc: let a register string create an entry disabled
  binfmt_misc: document loader substitution
  selftests/exec: test binfmt_misc loader substitution
  binfmt_misc: let a bpf handler request loader substitution
  binfmt_misc: add the 'L' loader substitution flag
  binfmt_elf_fdpic: consume a stashed PT_INTERP substitute
  binfmt_elf: consume a stashed PT_INTERP substitute
  exec: carry a PT_INTERP substitute in struct linux_binprm
  ...
2026-08-17 08:35:25 -07:00
Andrii Nakryiko
3d9393ff98 selftests/bpf: Retry stat generation in cgroup_iter_memcg
Each cgroup_iter_memcg subtest touches 1024 pages and expects the matching
memcg counter to be non-zero. On a host with many CPUs it reads zero
instead:

  test_anon:FAIL:final anon mapped val: actual 0 <= expected 0

memcg stats are cached per-cpu and only become visible once the periodic
flusher runs (FLUSH_TIME, 2s), or once pending updates cross
MEMCG_CHARGE_BATCH * num_online_cpus(). That threshold is 512 pages at 8
CPUs but 8192 at 128, so a single pass no longer reaches it and
bpf_mem_cgroup_flush_stats() returns without flushing anything.

Retry the stat generation, sleeping in between, so that a flusher cycle is
always covered. Sleep before dropping the mapping, so that a flusher cycle
landing in the sleep observes the mapped state. nr_anon_mapped and
nr_file_mapped are rmap gauges, and unmapping first would post a matching
negative delta for the flusher to aggregate to a net zero.

test_file asserts on both nr_file_pages and nr_file_mapped, which have
different lifetimes, as page cache pages outlive the mapping. Retry
while either one is still zero.

Fixes: 6bce6ddbe6 ("bpf: selftests: selftests for memcg stat kfuncs")
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20260814232017.2839959-1-andrii@kernel.org
2026-08-17 17:14:48 +02:00
Chenguang Zhao
6afb035996 selftests/bpf: Enable kptr_xchg_inline test on LoongArch
Enable the kptr_xchg_inline functional test on LoongArch64 now that the
BPF JIT can inline bpf_kptr_xchg() with correct memory ordering.

Acked-by: Hengqi Chen <hengqi.chen@gmail.com>
Acked-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Tested-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Signed-off-by: Chenguang Zhao <zhaochenguang@kylinos.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2026-08-17 22:07:49 +08:00
Kumar Kartikeya Dwivedi
6ab6a94c4f
selftests/bpf: Test pseudo-function policy diagnostics
Load a socket-filter program that passes a callback to bpf_loop() without
making a BPF-to-BPF call. Verify that the privileged load succeeds and the
unprivileged Policy report identifies the BPF function reference at its
ldimm64 instruction.

Also reject the inaccurate BPF-to-BPF call wording in the portion of the log
covered by the structured report.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/bpf/d02e6a6d3b2dc43a207b8ba836ce62497b250dede9252e7409c5212201c794b7@mail.kernel.org
Link: https://lore.kernel.org/bpf/20260816015746.2632990-15-memxor@gmail.com
2026-08-17 11:58:24 +02:00
Kumar Kartikeya Dwivedi
b03bb4a597
selftests/bpf: Test kfunc argument diagnostics
Extend existing negative kfunc programs to assert that BTF void is rendered
as void and that variable __szk arguments receive a structured constant-size
diagnostic.

Also pass a context pointer to bpf_refcount_acquire() and verify that the
report describes the generic refcounted-object contract and the actual
argument type. Retain the legacy verbose-message assertions.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/bpf/3eda33675965763aa9b2e6a5784f32b34a6a83988a55fbea98b0dbd0cf3b088d@mail.kernel.org
Link: https://lore.kernel.org/bpf/20260816015746.2632990-8-memxor@gmail.com
2026-08-17 11:58:23 +02:00
Junseo Lim
6b0835ac79 selftests/bpf: Exercise negative optlen in cgroup getsockopt hook
Add a cgroup getsockopt selftest that sets ctx->optlen to -1. Use
TCP_ZEROCOPY_RECEIVE to exercise the kernel-buffer getsockopt hook.

The userspace-visible result is -EFAULT on both patched and unpatched
kernels, so the return value alone cannot distinguish the bug. The test
still exercises the kernel-buffer getsockopt path with a negative
ctx->optlen, which reproduces the hardened usercopy warning on unpatched
kernels.

Signed-off-by: Junseo Lim <zirajs7@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/4dbdcda23b2f2be06c5659f8102cd6bd036825b3.1786448307.git.zirajs7@gmail.com
2026-08-17 11:33:29 +02:00
Nick Hudson
adb7719730 selftests/bpf: tc_tunnel - validate decap GSO and encapsulation state
tc_tunnel only partially validated decap state and missed some tunnel
cases. In particular, IPXIP decap checks were not exercised for
IPIP/SIT paths, and non-GSO decap encapsulation state was not
verified.

Tighten the test by:

- setting DECAP_IPXIP4/6 flags for IPIP/SIT/IP6 decap paths based on
  the outer tunnel header family;
- requiring needed DECAP enum values via CO-RE enum existence checks
  so missing kernel support fails fast;
- validating post-decap tunnel state for both GSO and non-GSO packets:
  expected gso_type bits must be cleared and skb->encapsulation must
  match remaining tunnel flags;
- removing forced TSO disable in the test harness so GSO validation is
  exercised.

This improves coverage for decap tunnel-state regressions and ensures
sit_none/ipip-style paths are checked correctly.

Signed-off-by: Nick Hudson <nhudson@akamai.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20260812083115.73100-7-nhudson@akamai.com
2026-08-17 11:30:28 +02:00
Nick Hudson
da199070bc bpf: Add BPF_F_ADJ_ROOM_DECAP_* flags for tunnel decapsulation
Add new bpf_skb_adjust_room() decapsulation flags:

- BPF_F_ADJ_ROOM_DECAP_L4_GRE
- BPF_F_ADJ_ROOM_DECAP_L4_UDP
- BPF_F_ADJ_ROOM_DECAP_IPXIP4
- BPF_F_ADJ_ROOM_DECAP_IPXIP6

These flags let BPF programs describe which tunnel layer is being
removed, so later changes can update tunnel-related GSO state
accordingly during decapsulation.

This patch only introduces the UAPI flag definitions and helper
documentation.

Co-developed-by: Max Tottenham <mtottenh@akamai.com>
Co-developed-by: Anna Glasgall <aglasgal@akamai.com>
Signed-off-by: Max Tottenham <mtottenh@akamai.com>
Signed-off-by: Anna Glasgall <aglasgal@akamai.com>
Signed-off-by: Nick Hudson <nhudson@akamai.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://lore.kernel.org/bpf/20260812083115.73100-4-nhudson@akamai.com
2026-08-17 11:30:04 +02:00
Nick Hudson
5e4bcad617 bpf: Name the enum for BPF_FUNC_skb_adjust_room flags
The existing anonymous enum for BPF_FUNC_skb_adjust_room flags is
named to enum bpf_adj_room_flags to enable CO-RE (Compile Once -
Run Everywhere) lookups in BPF programs.

Co-developed-by: Max Tottenham <mtottenh@akamai.com>
Co-developed-by: Anna Glasgall <aglasgal@akamai.com>
Signed-off-by: Max Tottenham <mtottenh@akamai.com>
Signed-off-by: Anna Glasgall <aglasgal@akamai.com>
Signed-off-by: Nick Hudson <nhudson@akamai.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://lore.kernel.org/bpf/20260812083115.73100-2-nhudson@akamai.com
2026-08-17 11:29:40 +02:00
Tiezhu Yang
77877bf570 selftests/bpf: Enable timed may_goto tests for LoongArch
Enable stream_cond_break, may_goto_interaction, and verifier_may_goto_1
tests for LoongArch, aligning with recent architectural infrastructure
support (timed may_goto and arch_bpf_stack_walk JIT).

With this patch, the following tests passed on LoongArch:

  sudo ./test_progs -a stream_success/stream_cond_break
  sudo ./test_progs -a verifier_bpf_fastcall/may_goto_interaction
  sudo ./test_progs -a verifier_may_goto_1

Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20260813070906.5164-1-yangtiezhu@loongson.cn
2026-08-17 11:18:00 +02:00
Josh Poimboeuf
d8a2860b4a objtool/klp: Fix vmlinux klp relocations for EXPORT_SYMBOL_FOR_MODULES()
When a module function references a vmlinux symbol which is exported
with EXPORT_SYMBOL_FOR_MODULES(), a patch to that function needs to use
a klp reloc.

Currently, livepatch fails to load such a module:

  livepatch: invalid access to vmlinux symbol 'get_task_policy' from module-specific livepatch relocation section
  livepatch: failed to initialize patch 'livepatch_test' for module 'testmod' (-22)
  livepatch: patch 'livepatch_test' failed for module 'testmod', refusing to load module 'testmod'

klp diff puts all klp relocs in __klp_relocs.<patched object>, so
post-link names the section .klp.rela.<patched object>.<secname>, which the
kernel rejects for vmlinux symbols.

Commit 07f14d6af9 ("objtool/klp: Fix cross-module klp relocation
section naming") changed the meaning of objname in the klp rela section
name to be where the referenced symbol is referenced rather than where
it lives.  That premise only holds for symbols in a module: the relocs
get applied when the patched module gets patched, and the module
dependency guarantees the referenced module is loaded by then.

A vmlinux symbol needs the opposite.  It's always resolvable, and it has
to be applied when the patch module loads, before the module loader
initializes the patch module's special sections, which may reference it.
That's why livepatch rejects vmlinux symbols in module-specific
sections.

Use "vmlinux" as the section objname when the referenced symbol lives in
vmlinux.  This moves such klp relocs from .klp.rela.kvm..text to
.klp.rela.vmlinux..text.

Fixes: 07f14d6af9 ("objtool/klp: Fix cross-module klp relocation section naming")
Reported-by: Dylan Hatch <dylanbhatch@google.com>
Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Acked-by: Song Liu <song@kernel.org>
Link: https://patch.msgid.link/f8e3b9fae109903a6aafb2a33310e4afdcebf58e.1786761327.git.jpoimboe@kernel.org
Closes: https://lore.kernel.org/CADBMgpz7iWC0=t=_gE-tfvv0mTPq4kg0qQ2zgPH8DVPE6eQ9Kw@mail.gmail.com
2026-08-17 10:53:55 +02:00
Alexis Lothoré (eBPF Foundation)
c238ff829e selftests/bpf: Fix comment style in network_helpers.c
BPF subsystem requires multi-line comments to have the opening /* start
on its own line. Update multi-line comments in network_helpers.c to follow
this requirement.

Signed-off-by: Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20260814-tc_tunnel_flaky-v5-1-5b93d030c42c@bootlin.com
2026-08-17 10:32:53 +02:00
Mickaël Salaün
ac6d193de5
selftests/landlock: Add landlock_enforce_domain trace tests
Add trace tests for the landlock_enforce_domain event in trace_test.c,
asserting field counts after the syscall returns rather than line
ordering across per-CPU buffers.  They cover single-threaded and TSYNC
enforcement (complete and process_wide set), a multi-threaded non-TSYNC
process (process_wide clear), the single-threaded non-leader edge case,
the flags-only path that creates no domain, and a thread-sync abort that
emits create_domain and free_domain but no enforce_domain.

landlock_enforce_domain is added to the fixture enable path and every
disable list so its zero-events assertions cannot be tripped by a stray
enforcement event.

Test coverage for security/landlock is 91.6% of 2571 lines according to
LLVM 22.

Cc: Günther Noack <gnoack@google.com>
Cc: Tingmao Wang <m@maowtm.org>
Link: https://patch.msgid.link/20260811094338.288094-19-mic@digikod.net
Signed-off-by: Mickaël Salaün <mic@digikod.net>
2026-08-17 10:17:19 +02:00
Mickaël Salaün
aef2dd32dd
selftests/landlock: Add scope and ptrace tracepoint tests
Add trace tests for the landlock_deny_ptrace,
landlock_deny_scope_signal, and landlock_deny_scope_abstract_unix_socket
tracepoints, each placed alongside the functional tests for its
subsystem, mirroring the audit test layout.

Each tracepoint is exercised by a fixture with three variants that pin
both branches of the other-party domain field: denied against an
unsandboxed other party (other-party domain ID 0), denied against a
sandboxed other party (non-zero ID), and an allowed baseline that
records no event.  A second fixture per type exercises an alternate LSM
hook that reaches the same tracepoint with the same other-party domain
ID, since each denial type can be reached through more than one hook.

The datagram abstract-unix variant does not assert peer_pid, which is 0
for a datagram peer (no SO_PEERCRED); sun_path is the reliable peer
identifier.  The ptrace fixtures install a plain domain-creating ruleset
rather than a dedicated flag, since ptrace denial relies on domain
ancestry, not on a specific scoped flag.  The fixtures unshare the mount
namespace and remount / as MS_PRIVATE before mounting tracefs so the
helper instance is visible only to the test process.

Cc: Günther Noack <gnoack@google.com>
Cc: Tingmao Wang <m@maowtm.org>
Link: https://patch.msgid.link/20260811094338.288094-18-mic@digikod.net
Signed-off-by: Mickaël Salaün <mic@digikod.net>
2026-08-17 10:17:18 +02:00
Mickaël Salaün
6e2df0117b
selftests/landlock: Add network tracepoint tests
Add network-specific trace tests, co-located with the existing audit
fixture so each subsystem's functional, audit, and trace tests live
together.

Parameterized fixtures verify the landlock_deny_access_net event: a bind
or connect denied outside the ruleset emits exactly one event with the
expected sport/dport, an allowed bind or connect emits none, and the
unsandboxed baseline emits none.  A separate fixture verifies the
landlock_check_rule_net event on an allowed bind, anchoring its domain,
access_request, port, and grants to exact values; only check_rule_fs had
a dedicated field test before.

Port fields are read in host endianness, matching the
landlock_net_port_attr.port UAPI convention, so the decimal comparisons
also catch byte-order regressions in the tracepoint plumbing.  IPv6
trace tests are intentionally elided: IPv6 hook dispatch shares the
current_check_access_socket() path with IPv4 (covered by the audit
tests), and the trace fields do not depend on address family.

Cc: Günther Noack <gnoack@google.com>
Cc: Tingmao Wang <m@maowtm.org>
Link: https://patch.msgid.link/20260811094338.288094-17-mic@digikod.net
Signed-off-by: Mickaël Salaün <mic@digikod.net>
2026-08-17 10:17:18 +02:00
Mickaël Salaün
30478db56c
selftests/landlock: Add filesystem tracepoint tests
Add filesystem-specific trace tests in a dedicated file, following the
audit-test pattern of living alongside each subsystem's functional
tests.

trace_fs_test.c verifies that the add_rule_fs, check_rule_fs, and
deny_access_fs events fire with the correct fields on matching rules and
denied accesses, that check_rule_fs does not fire for unhandled access
types, and that no event fires without a sandbox.  A denial covered by a
quiet rule still emits a deny_access_fs event but with logged=0, the
same suppression verdict audit applies; because that verdict must not
depend on CONFIG_AUDIT, the test also runs under a tracepoints-only
build.

Add trace_layout1 fixture tests in fs_test.c that reuse the layout1
hierarchy to verify the per-layer grants field: field values, multi-rule
pathwalk short-circuit, request intersection, the optional truncate
right surfacing in the request and grants, and an empty grants set from
a rule that grants none of the requested rights.

Cc: Günther Noack <gnoack@google.com>
Cc: Tingmao Wang <m@maowtm.org>
Link: https://patch.msgid.link/20260811094338.288094-16-mic@digikod.net
Signed-off-by: Mickaël Salaün <mic@digikod.net>
2026-08-17 10:17:17 +02:00
Mickaël Salaün
2651712a15
selftests/landlock: Add trace event test infrastructure and tests
Add tracefs test infrastructure in trace.h: helpers for mounting
tracefs, enabling/disabling events, reading the trace buffer, counting
regex matches, and extracting field values, plus per-event regex
patterns.  The patterns are anchored with ^ and $, verify every
TP_printk field, and use no unescaped dot characters; TRACE_PREFIX
matches the ftrace line format with either the expected task name
(truncated to TASK_COMM_LEN - 1) or "<...>" for an evicted comm cache
entry.

Add trace_test.c with the trace fixture (setup enables all available
events with a PID filter, teardown disables and clears) and the
lifecycle, API, denial-field, and log-flag tests.  Extend the existing
true helper to open its working directory before exiting, triggering a
read_dir denial inside a sandbox, so the exec-based tests can verify
same_exec and the logged decision across an exec.  Move regex_escape()
from audit.h to common.h for shared use by the audit and trace tests.

Enable CONFIG_ENABLE_DEFAULT_TRACERS alongside CONFIG_FTRACE in the
selftest config: CONFIG_FTRACE alone only enables the tracer menu
without activating any tracer, while CONFIG_ENABLE_DEFAULT_TRACERS
selects TRACING (and thus TRACEPOINTS and event tracing) without
depending on architecture-specific syscall tracepoints.  When
CONFIG_FTRACE is disabled it cannot be set, so TRACEPOINTS is correctly
disabled too.

Cc: Günther Noack <gnoack@google.com>
Cc: Tingmao Wang <m@maowtm.org>
Link: https://patch.msgid.link/20260811094338.288094-15-mic@digikod.net
Signed-off-by: Mickaël Salaün <mic@digikod.net>
2026-08-17 10:17:17 +02:00
Yiyang Chen
5ab9fbeca8 selftests/bpf: Cover mixed arena and stack atomics
Add a verifier test with one atomic RMW instruction reached through
PTR_TO_ARENA and PTR_TO_STACK paths. The verifier must reject the
shared instruction with the existing incompatible-pointer diagnostic.

Signed-off-by: Yiyang Chen <chenyy23@mails.tsinghua.edu.cn>
Link: https://patch.msgid.link/20260816-bpf-next-038-mixed-atomic-v1-v2-2-4644c1886dbc@mails.tsinghua.edu.cn
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-08-16 20:36:23 -07:00
Mike Rapoport (Microsoft)
08745c6235 selftests/mm: thuge-gen: fix test_shmget() for PAGE_SIZE check
Commit 49a4e7186b ("selftests/mm: thuge-gen: add setup of HugeTLB
pages") changed thuge-gen test to use common functions for reading hugetlb
attributes from sysfs, but it missed that the original read_free()
function special cased PAGE_SIZE tests.

For PAGE_SIZE tests, failure to read sysfs was ignored and read_free()
returned 0.

This allowed test_shmget() to essentially skip the check of how many huge
pages was consumed when it ran with PAGE_SIZE.

Commit 3199b0c09efa ("selftests/mm: fix read_file() return value check")
fixed checks for read_file() return value and this exposed the issue in
test_shmget() that checks the number of free hugetlb pages even for
PAGE_SIZE test, tries to access

/sys/kernel/mm/hugepages/hugepages-<PAGE_SIZE>/free_hugepages

and obviously fails there.

Gate the checks for free huge pages on size != getpagesize() and
initialize before and after variables to values matching PAGE_SIZE test.

Link: https://lore.kernel.org/20260812-selftests-thuge-gen-fix-v2-1-9adaa693e73b@kernel.org
Fixes: 49a4e7186b ("selftests/mm: thuge-gen: add setup of HugeTLB pages")
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: Sarthak Sharma <sarthak.sharma@arm.com>
Acked-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-15 21:12:24 -07:00
Tejun Heo
006dd4d04b sched_ext: Make core-sched task ordering hierarchy-aware
With sub-schedulers, tasks of different schedulers routinely share rqs and
SMT siblings, but scx_prio_less() consults ops.core_sched_before() only when
both tasks belong to the same scheduler. Every pair spanning two schedulers
falls back to the default ordering, so no scheduler can express ordering
across a scheduler boundary, including a root over its sub-schedulers'
tasks.

Order a pair spanning schedulers by the nearest common ancestor that
implements ops.core_sched_before(): both tasks are in its subtree, making
this the one op where a scheduler is called on tasks it delegated to its
sub-schedulers and may not be scheduling anymore. Same-scheduler pairs keep
using the owning scheduler's op so a parent never orders inside a subtree it
delegated. The op is skipped when the deciding scheduler is bypassing on
either task's CPU.

Update scx_qmap to fall back to the kernel's default ordering when handed a
delegated task it has no task_ctx for.

Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-15 16:07:49 -10:00
Tejun Heo
f7b6d128dd sched_ext: Fix inverted ops.core_sched_before() invocation
scx_prio_less() implements prio_less() semantics - %true means that @a is
the lower priority and should run after @b. ops.core_sched_before() is
documented to return %true when @a should run before @b. scx_prio_less()
returns the op's value as-is, inverting the documented semantics at runtime.

Call the op with the arguments swapped.

scx_qmap followed the wiring instead of the documentation and returned %true
for the younger task, so the two inversions canceled out and it behaved as
intended. Flip its comparison to match. scx_qmap is likely the only current
user in or out of the kernel tree. Any scheduler written the same way needs
the same flip, while schedulers following the documentation are fixed by
this change.

Fixes: 7b0888b7cc ("sched_ext: Implement core-sched support")
Cc: stable@vger.kernel.org # v6.12+
Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-15 16:07:49 -10:00
Yao Sang
007af5e5cc selftests: ublk: add SET_PARAMS validation test
Add test_params_01.sh for SET_PARAMS. The test checks valid basic
parameters and several invalid parameter cases.

Also cover zoned parameters, including a non-power-of-2 zone size. This
case must fail in SET_PARAMS instead of being accepted and rejected later
when the device is started.

Signed-off-by: Yao Sang <sangyao@kylinos.cn>
Link: https://patch.msgid.link/20260814023226.354288-4-sangyao@kylinos.cn
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-08-15 17:17:11 -06:00
Yao Sang
176f02a86c selftests: ublk: add helper for SET_PARAMS
The normal kublk add command goes through device startup. It does not
tell the shell test whether a bad parameter is rejected by SET_PARAMS or
later by START_DEV.

Add a set_params command. It creates a temporary ublk device, sends
SET_PARAMS with the command line parameters, returns the ioctl result,
and deletes the device before START_DEV.

Signed-off-by: Yao Sang <sangyao@kylinos.cn>
Link: https://patch.msgid.link/20260814023226.354288-3-sangyao@kylinos.cn
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-08-15 17:17:11 -06:00
Mahe Tardy
c93cbdb13f selftests/bpf: Add ksock test for async callback guard
Because the kfuncs are going through LSM hooks, allowing their use via
workqueue callbacks would expose the wrong credentials. This test
ensures the kfunc are preventing any use from these contexts.

Signed-off-by: Mahe Tardy <mahe.tardy@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Stanislav Fomichev <sdf@fomichev.me>
Acked-by: Song Liu <song@kernel.org>
Link: https://lore.kernel.org/bpf/20260813110540.103550-6-mahe.tardy@gmail.com
2026-08-15 23:36:19 +02:00
Mahe Tardy
7b0dfbf577 selftests/bpf: Test forbidden bpf_ksock_send() LSM attach
The bpf_ksock_send() kfunc eventually calls security_socket_sendmsg(),
thus creating a possible recursion if a program calling the kfunc is
attached on that specific hook. A filter is added on the kfunc
registration to prevent that at load time from the verifier. This test
exercises that the verifier will reject such program on that attach
point.

Signed-off-by: Mahe Tardy <mahe.tardy@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Stanislav Fomichev <sdf@fomichev.me>
Acked-by: Song Liu <song@kernel.org>
Link: https://lore.kernel.org/bpf/20260813110540.103550-5-mahe.tardy@gmail.com
2026-08-15 23:36:19 +02:00
Mahe Tardy
c7838e3dc6 selftests/bpf: Add ksock kfunc test
Add a selftest that exercises the ksock kfuncs end-to-end. One syscall
BPF setup program creates a ksock context and connects the socket.
Another LSM sleepable BPF program looks up the context and send test
data. The userspace harness creates a network namespace and a new socket
on loopback, run the setup syscall prog and send LSM BPF prog then check
that the userspace socket received the data from BPF.

Signed-off-by: Mahe Tardy <mahe.tardy@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Acked-by: Stanislav Fomichev <sdf@fomichev.me>
Link: https://lore.kernel.org/bpf/20260813110540.103550-4-mahe.tardy@gmail.com
2026-08-15 23:36:18 +02:00
Kumar Kartikeya Dwivedi
66e2727395 bpf: Report Call Type Safety argument errors
Augment selected helper and kfunc argument-contract failures with Call Type
Safety reports. Keep the existing terse verifier messages and add reason,
source context, causal register or stack-argument history, and targeted
suggestions.

Cover helper register-type mismatch, helper and kfunc non-NULL pointer
requirements, release-helper ownership requirements, scalar and constant kfunc
arguments, trusted and RCU pointer contracts, kfunc memory arguments,
memory/length pairs, refcounted kptrs, constant strings, and IRQ flag stack
arguments.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://patch.msgid.link/20260815064612.378577-12-memxor@gmail.com
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-08-15 11:15:17 -07:00
Kumar Kartikeya Dwivedi
d63284e62b bpf: Report Register Type Safety errors
Augment selected register-state verifier failures with Register Type Safety
reports. The existing verbose verifier messages remain in place; the new
reports add reason, source context, causal path, and suggestions.

Cover invalid pointer dereferences, unreadable registers, missing outgoing
stack arguments for bpf2bpf and kfunc calls, and rejected pointer arithmetic.
Use scoped diagnostic history so reports start from the latest relevant value
change and then show later branch outcomes.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://patch.msgid.link/20260815064612.378577-9-memxor@gmail.com
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-08-15 11:11:16 -07:00
PVS Narasimha Rao
6ae6fb96cc perf test sample-parsing: Validate PERF_FORMAT_GROUP values without LOST
The sample parsing test only validates grouped read values when
PERF_FORMAT_LOST is present.

For PERF_FORMAT_GROUP without PERF_FORMAT_LOST, the contents of
read.group.values[] are not validated, allowing corruption of the parsed
value and id fields to go undetected.

The values are also handed to the synthesis as a plain array of struct
sample_read_value, which always has a 24-byte stride, while
read.group.values is expected to be packed according to read_format --
evsel__parse_sample() points it into the event data.  Without
PERF_FORMAT_LOST the stride is 16, so both the synthesis and the
comparison walk overlapping bytes and the test passes regardless of the
contents.

Validate value and id for grouped reads and continue to validate lost
when PERF_FORMAT_LOST is present, walking the entries with
next_sample_read_value().  Also build the input packed using
sample_read_value_size() so the compared fields are the real ones.

Verified with a deliberate stride bug in copy_read_group_values(): the
test still passes without this change and fails at read_format 0xc with
it applied.

Signed-off-by: PVS Narasimha Rao <venkatasuryapala@gmail.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-15 06:37:18 -07:00
Arnaldo Carvalho de Melo
62972e5644 perf dso: Replace assert with runtime check in dso__read_symbol()
dso__read_symbol() asserts that len <= jited_prog_len, where len comes
from sym->end - sym->start (parsed from PERF_RECORD_KSYMBOL in
perf.data).  Both values originate from untrusted file input.

With NDEBUG (production builds), the assert is compiled out, allowing
an out-of-bounds heap read when the BPF program buffer is accessed.
Without NDEBUG, a crafted perf.data crashes perf with an assertion
failure.

Replace the assert with a runtime bounds check that returns NULL with
an appropriate error code, matching the existing error handling
pattern in this function.

Fixes: aa04707f50 ("perf dso: Support BPF programs in dso__read_symbol()")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Reviewed-by: Ian Rogers <irogers@google.com>
Cc: Song Liu <song@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-15 06:37:14 -07:00
Arnaldo Carvalho de Melo
390a9461cd perf dso: Guard against cache underflow on short reads in dso_cache__memcpy()
dso_cache__memcpy() computes cache_offset = offset - cache->offset,
then cache_size = min(cache->size - cache_offset, size).  The RB tree
lookup in __dso_cache__find() matches using the full
DSO__DATA_CACHE_SIZE window, but cache->size reflects the actual pread
return value from dso_cache__populate().

A short pread (e.g. near end-of-file) makes cache->size smaller than
DSO__DATA_CACHE_SIZE.  If a subsequent access targets an offset past
cache->offset + cache->size but within the DSO__DATA_CACHE_SIZE
window, the cache entry is found but cache_offset exceeds cache->size.
Since both are u64, the subtraction cache->size - cache_offset wraps
to a large value, min() selects the caller's size, and memcpy reads
out of bounds.

Return 0 for an offset past the valid cached data.  For a regular
file a short pread only happens at end-of-file, so 0 is what a direct
pread() at that offset would return: cached_io() stops its read loop
as on EOF.  Re-reading from the backing file would not help — a
second pread at the same offset returns the same short count.

Fixes: 366df72657 ("perf dso: Refactor dso_cache__read()")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Reviewed-by: Ian Rogers <irogers@google.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-15 06:37:09 -07:00
Arnaldo Carvalho de Melo
075d2c3235 perf dso: Use stored fd error instead of stale errno in file_read() and file_size()
file_read() and file_size() use ret = -errno when
dso__data(dso)->fd is negative after try_to_open_dso() fails.  By this
point errno has been through mutex_lock(), nsinfo__mountns_enter(), and
multiple open() attempts inside try_to_open_dso() — it no longer
reflects the actual open failure.  If errno happens to be 0, ret = 0
looks like EOF rather than an error, and file_size() callers like
dso__data_size() would then report a zero-sized file instead of
failing.

dso__data(dso)->fd is always negative on failure — -errno from
__open_dso() when no filename could be built (e.g. -EINVAL, -ENOENT),
or -1 when do_open() itself failed — and never 0, so use it directly
instead of reading the stale global errno.

No assert() or comment is needed after the assignment: the enclosing
if (dso__data(dso)->fd < 0) already guarantees ret < 0
[Namhyung Kim review].

Fixes: 33bdedcea2 ("perf tools: Protect dso cache fd with a mutex")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Reviewed-by: Ian Rogers <irogers@google.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-15 06:37:04 -07:00
Arnaldo Carvalho de Melo
10f452dc2d perf dso: Guard close() against invalid fd in dso__decompress_kmodule_path()
dso__decompress_kmodule_path() unconditionally calls close(fd) on the
return value of decompress_kmodule().  When decompression fails or the
DSO is not compressed, decompress_kmodule() returns -1.  close(-1)
fails with EBADF and clobbers errno, which callers up the chain
(dso__get_filename → __open_dso) depend on for error propagation.

Guard the close() call with fd >= 0 so only valid file descriptors are
closed.

Fixes: 42b3fa6708 ("perf tools: Introduce dso__decompress_kmodule_{fd,path}")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Reviewed-by: Ian Rogers <irogers@google.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-15 06:37:00 -07:00
Arnaldo Carvalho de Melo
51a7a9ddcb perf dso: Guard against errno==0 when dso__get_filename() returns NULL
__open_dso() computes fd = -errno when dso__get_filename() returns NULL.
Some failure paths in dso__get_filename() (e.g. binary type mismatch)
return NULL without making a syscall, leaving errno at 0 from a prior
successful call.  fd = -0 = 0, which is stdin — subsequent code treats
it as a valid file descriptor.

Fall back to ENOENT when errno is 0, ensuring fd is always negative on
failure.

The forced ENOENT stays in errno for the callers that check it after a
negative fd.  It must not misdirect the try_to_open_dso() fallback
loop, though: dso__get_filename()'s chroot fallback used to accept a
stale ENOENT even when stat() succeeded on a non-regular file (e.g. a
directory).  Re-stat() there and only take the chroot path when
stat() actually failed with ENOENT [sashiko-bot review of PATCH 1/5].

Fixes: eba5102d2f ("perf tools: Add global list of opened dso objects")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Reviewed-by: Ian Rogers <irogers@google.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-15 06:36:55 -07:00
Tejun Heo
3167bd3e0c sched_ext: Rename balance-era identifiers to dispatch terms
sched_class->balance() is gone from sched_ext and what balance_one() does is
run dispatch to produce something pickable. Update the balance-era names to
dispatch terms:

- balance_one() -> dispatch_one()
- SCX_RQ_IN_BALANCE -> SCX_RQ_IN_DISPATCH

No BPF scheduler reads the flag. The enum autogen headers gain the new name
with the old entry retained like other removed enumerators, zero-filling at
load time. No functional changes.

Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-15 00:07:42 -10:00
Tao Cui
9b4243d304 sched_ext/scx_flatcg: Fix cvtime true-up on slice expiry
fcg_dispatch() true-ups the current cgroup's cvtime when its slice
expires or its DSQ runs empty while the slice is still active:

	__sync_fetch_and_add(&cgc->cvtime_delta,
			     (cpuc->cur_at + cgrp_slice_ns - now) *
			     FCG_HWEIGHT_ONE / (cgc->hweight ?: 1));

The true-up should be actual minus charged: on CNS_EXPIRE, the overrun
(now - cur_at - cgrp_slice_ns) should be added; on CNS_EMPTY, the
unused portion of the slice should be subtracted. The expression above
has the sign inverted, and in the CNS_EXPIRE case now is already past
cur_at + cgrp_slice_ns, so the u64 subtraction wraps. The
multiplication preserves the two's complement encoding but the
unsigned division by hweight destroys it, adding roughly 2^64/hweight
per expiry instead of a small correction.

Under saturation the hweight budget clamp in cgrp_cap_budget() masks
most of the garbage, so the weight distribution barely moves, but the
accounting is broken all the same. Compute the delta as a signed value
and use fetch_and_add()/fetch_and_sub() so that the dividends stay
positive, as BPF division is unsigned.

Instrumented the true-up and ran a saturated three-leaf cgroup tree on
a 4-CPU VM: without the fix, each expiry added ~5e15 (2^64/hweight
territory) to cvtime_delta; with it, the corrections are back to
slice scale, with the overrun added and the unused portion subtracted.

Fixes: a4103eacc2 ("sched_ext: Add a cgroup scheduler which uses flattened hierarchy")
Suggested-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Tao Cui <cuitao@kylinos.cn>
Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-14 23:50:47 -10:00
fangqiurong
56bbc91219 sched_ext: Fix scx_bpf_dsq_move_to_local___v2 compat detection
libbpf strips the last ___flavor suffix when resolving kfunc externs, so
the bare ___v2 declaration resolves to scx_bpf_dsq_move_to_local, whose
BTF proto lacks @enq_flags. The extern never matches, bpf_ksym_exists()
returns false on every kernel that has the ___v2 kfunc, and the macro
falls back to ___v1, silently dropping @enq_flags.

Add the trailing ___compat suffix used by the other versioned externs in
this file (scx_bpf_dsq_insert___v2, scx_bpf_reenqueue_local___v2).

Any caller passing non-zero @enq_flags through the compat macro silently
loses them.

Fixes: 860683763e ("sched_ext: Add enq_flags to scx_bpf_dsq_move_to_local()")
Cc: stable@vger.kernel.org # v7.1+
Assisted-by: Z.ai:glm-5.2
Signed-off-by: fangqiurong <fangqiurong@kylinos.cn>
Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-14 23:50:47 -10:00
Justin Suess
71f98bc6e5
selftests/landlock: Test LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS
Check that a successful landlock_restrict_self(2) call with
LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS sets no_new_privs without a prior
prctl(2) call nor CAP_SYS_ADMIN, that a failed call from both an
invalid ruleset and hitting the layer maximum leaves the attribute
unchanged, and that LANDLOCK_RESTRICT_SELF_TSYNC extends it to sibling
threads.  Also check that this flag requires a ruleset.

Turn the multi_threaded_success test into a multi_threaded fixture with
success, no_new_privs, and no_new_privs_max_layers variants to factor
out the threading code.

Finally, rename restrict_self_fd_logging_flags to
restrict_self_fd_flags, and restrict_self_logging_flags to
restrict_self_flags to indicate that non-logging flags are now tested.

Test coverage for security/landlock is 91.8% of 2373 lines according to
LLVM 22.

Signed-off-by: Justin Suess <utilityemal77@gmail.com>
Link: https://patch.msgid.link/20260809154544.1253100-4-utilityemal77@gmail.com
Signed-off-by: Mickaël Salaün <mic@digikod.net>
2026-08-15 09:14:47 +02:00
Justin Suess
6887c03bf2
landlock: Add LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS
Add a landlock_restrict_self(2) flag to set the no_new_privs attribute
of the calling thread only after enforcement of the ruleset:
no_new_privs is set if and only if the call succeeds.  This removes the
need for a prior prctl(2) PR_SET_NO_NEW_PRIVS call and guarantees that
a failed enforcement leaves the attribute unchanged.

Because no_new_privs is set by the call itself, the no_new_privs /
CAP_SYS_ADMIN requirement of landlock_restrict_self(2) is fulfilled by
construction, and the related EPERM check is skipped.

Unlike LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF, this flag always
requires a valid ruleset: with a ruleset_fd of -1, such a call would be
nothing more than a Landlock-flavored prctl(2) PR_SET_NO_NEW_PRIVS, and
there is no valid use case for setting no_new_privs (possibly with
LANDLOCK_RESTRICT_SELF_TSYNC) without also enforcing Landlock
restrictions.  Rejecting these calls also keeps the option of giving
them a meaning later.

The attribute is only set past the last point of failure, just before
committing the new credentials.  When combined with
LANDLOCK_RESTRICT_SELF_TSYNC, no_new_privs is set on the sibling threads
as well, in their commit phase, with the same ordering.

Bump the Landlock ABI version to 11, and include the minimal related
test changes to keep the tests bisectable.

Cc: Mickaël Salaün <mic@digikod.net>
Signed-off-by: Justin Suess <utilityemal77@gmail.com>
Link: https://patch.msgid.link/20260809212459.2427878-1-utilityemal77@gmail.com
Signed-off-by: Mickaël Salaün <mic@digikod.net>
2026-08-15 09:14:46 +02:00
Justin Suess
c2fe8b60b8
landlock: Check landlock_restrict_self(2)'s flags before privileges
landlock_restrict_self(2) currently checks the no_new_privs /
CAP_SYS_ADMIN requirement before validating the flags argument.  An
unprivileged caller without no_new_privs thus gets EPERM even when the
passed flags are invalid, hiding the EINVAL error.

Move the no_new_privs / CAP_SYS_ADMIN check just after the flags check
so that malformed calls consistently error out with EINVAL whatever the
caller's privileges, the same way seccomp(2) validates its flags before
checking no_new_privs.

Update the restrict_self_checks_ordering test accordingly.

Cc: Mickaël Salaün <mic@digikod.net>
Signed-off-by: Justin Suess <utilityemal77@gmail.com>
Link: https://patch.msgid.link/20260809154544.1253100-2-utilityemal77@gmail.com
Signed-off-by: Mickaël Salaün <mic@digikod.net>
2026-08-15 09:14:46 +02:00
Günther Noack
17522b96dc
selftests/landlock: Test whiteout object behaviour in OverlayFS renames
Even though OverlayFS uses vfs_rename() with RENAME_WHITEOUT on its
backing directories, and even though RENAME_WHITEOUT requires
LANDLOCK_ACCESS_FS_MAKE_REG, a process that renames non-regular files in
an OverlayFS can do so without having the LANDLOCK_ACCESS_FS_MAKE_REG
right in that location.

This works, and is supposed to work, because the changes to the backing
directories are done by OverlayFS, not by the originator task that did
the original rename() on the OverlayFS mount.  Therefore, the changes
done to backing directories are not subject to the originator task's
credentials.

Test coverage for security/landlock is 91.8% of 2368 lines according to
LLVM 22.

Signed-off-by: Günther Noack <gnoack@google.com>
Link: https://patch.msgid.link/20260813093157.1436894-6-gnoack@google.com
[mic: Add test coverage, reflow commit message]
Signed-off-by: Mickaël Salaün <mic@digikod.net>
2026-08-15 09:14:44 +02:00
Günther Noack
8c46c6acbe
selftests/landlock: Add audit test for whiteout object creation
Add audit_layout1.make_whiteout: This test looks similar to
audit_layout1.make_char, but creates a whiteout object through mknod().
Since whiteout object creation is now guarded with
LANDLOCK_ACCESS_FS_MAKE_REG rather than LANDLOCK_ACCESS_FS_MAKE_CHAR, it
also needs to log the matching denial to audit.

Signed-off-by: Günther Noack <gnoack@google.com>
Link: https://patch.msgid.link/20260813093157.1436894-5-gnoack@google.com
Signed-off-by: Mickaël Salaün <mic@digikod.net>
2026-08-15 09:14:44 +02:00
Günther Noack
ee890889b3
selftests/landlock: Add tests for whiteout object creation
Add tests to check that whiteout object creation is guarded by
LANDLOCK_ACCESS_FS_MAKE_REG, in the cases where these are created from
userspace:

* Conventional creation with mknod()
* Linking or renaming an existing whiteout object
* renameat2() with RENAME_WHITEOUT,
  which creates a new whiteout object in the source location
* renameat2() with RENAME_EXCHANGE,
  with one of the renamed objects being a whiteout object

Signed-off-by: Günther Noack <gnoack@google.com>
Link: https://patch.msgid.link/20260813093157.1436894-4-gnoack@google.com
[mic: Update commit message as requested]
Signed-off-by: Mickaël Salaün <mic@digikod.net>
2026-08-15 09:14:43 +02:00
Günther Noack
173b1bd873
selftests/landlock: Use an actual chardev for MAKE_CHAR audit test
By passing a (0, 0) device number, the audit test for
LANDLOCK_ACCESS_FS_MAKE_CHAR was accidentally creating a whiteout object
rather than a char device.  In preparation to treating whiteout objects
differently, use an actual character device instead.

Signed-off-by: Günther Noack <gnoack@google.com>
Link: https://patch.msgid.link/20260813093157.1436894-2-gnoack@google.com
Signed-off-by: Mickaël Salaün <mic@digikod.net>
2026-08-15 09:14:40 +02:00
Vineet Gupta
f61306e8c9 selftests/bpf: Check per-CPU address resolution per register
An ld_imm64 of a per-CPU map value is followed by a mov_percpu_addr that
reuses the same register, so which register the address lands in decides
how the JIT encodes the add. Getting the REX prefix wrong there is
invisible to a functional test unless the address happens to land in an
extended register, which is why this went unnoticed.

Load a .percpu variable into every register in one program and match the
JITed add against the register each one must resolve into.

Signed-off-by: Vineet Gupta <vineet.gupta@linux.dev>
Link: https://patch.msgid.link/20260814220254.3797467-3-vineet.gupta@linux.dev
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-08-14 23:55:32 -07:00
Michal Blaszczyk
e72979d326 selftests/sched_ext: Fix flaky ddsp failure tests on busy systems
The ddsp_vtimelocal_fail and ddsp_bogus_dsq_fail tests skip calling
scx_bpf_dsq_insert_vtime() if scx_bpf_pick_idle_cpu() fails to find an idle
CPU (returns a negative error code). On loaded systems, this results in the
tests skipping the very assertions they are meant to verify.

Eliminate this flakiness by falling back to prev_cpu if no idle CPU is
found, ensuring the illegal dispatch operations are unconditionally
attempted and tested.

Fixes: a5db7817af ("sched_ext: Add selftests")
Signed-off-by: Michal Blaszczyk <michalblk@google.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-14 12:32:23 -10:00
Cheng-Yang Chou
0e3a6e977c selftests/sched_ext: Make numa idle validation race-free
A CPU returned by scx_bpf_pick_idle_cpu_node() can be re-advertised as
idle by an idle-to-idle re-pick before the BPF program validates the
selection, and the scx_bpf_pick_any_cpu_node() fallback doesn't claim
the CPU at all. Asserting that the picked CPU is absent from the node's
idle cpumask is therefore inherently racy.

Follow the same approach as commit 12da4723b6 ("selftests/sched_ext:
Make allowed_cpus idle validation race-free") and validate a stable
local invariant instead: a CPU executing ops.select_cpu() in a non-idle
scheduling context must not be advertised as idle in its node's idle
cpumask. Keep the node-membership validation of the picked CPU, which
is stable.

Signed-off-by: Cheng-Yang Chou <yphbchou0911@gmail.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-14 12:24:24 -10:00
Israel Téllez García
fdd4fad0bb libbpf: Fix ring buffer consumer loop on 32-bit position wrap
ringbuf_process_ring() walks the records between the consumer and the
producer with an ordering comparison:

	while (cons_pos < prod_pos) {

cons_pos and prod_pos mirror the kernel's ring positions and are
unsigned long here too, so on 32-bit they wrap at 2^32 bytes of traffic.
When producer_pos has wrapped and consumer_pos has not, prod_pos is the
smaller of the two, the loop body never runs and no record is consumed.
Since consumer_pos only advances inside that loop, it never wraps either
and the consumer stops delivering samples for good, with no error
returned to the caller: ring_buffer__poll() keeps reporting zero
records while the kernel side fills up and starts dropping.

Compare the distance instead. The consumer never runs ahead of the
producer, so prod_pos - cons_pos is the amount of unconsumed data and
stays correct across the wrap.

64-bit hosts are unaffected in practice: the counters would need 16 EiB
to wrap. This is the userspace counterpart of the kernel-side walk fixed
in "bpf: Fix pending_pos walk on 32-bit ring position wrap"; a 32-bit
consumer hits whichever of the two comes first.

Signed-off-by: Israel Téllez García <i.tellez@btesa.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20260814124843.22041-5-i.tellez@btesa.com
2026-08-14 15:21:09 -07:00
Ihor Solodrai
a2b83a8c84 selftests/bpf: Fix selftest build after filter.h update
Upstream commit 7a1f400ff5 ("tools: Ensure tools copy of
linux/filter.h exports the UAPI") caused selftests/bpf build to
fail [1] with:

  In file included from progs/arena_atomics.c:9:
  /codebuild/output/src2365462129/src/actions-runner/_work/bpf/bpf/tools/testing/selftests/bpf/../../../include/linux/filter.h:9:10: fatal error: 'uapi/linux/filter.h' file not found
      9 | #include <uapi/linux/filter.h>
        |          ^~~~~~~~~~~~~~~~~~~~~
  1 error generated.
    CLNG-BPF [test_progs] bind_perm.bpf.o
  make: *** [Makefile:888: /codebuild/output/src2365462129/src/actions-runner/_work/bpf/bpf/tools/testing/selftests/bpf/arena_atomics.bpf.o] Error 1
  make: *** Waiting for unfinished jobs....
    GEN-OBJ  [libarena] libarena.bpf.o
    GEN-SKEL [libarena] libarena.skel.h
  make: Leaving directory '/codebuild/output/src2365462129/src/actions-runner/_work/bpf/bpf/tools/testing/selftests/bpf'
  Process completed with exit code 2.

BPF selftest programs include the tools header directly, but
BPF_CFLAGS only exposes tools/include/uapi. Compiler therefore cannot
resolve the nested UAPI include.

Add tools/include after tools/include/uapi in BPF_CFLAGS. This
preserves the existing UAPI header precedence while allowing tools
headers to include uapi headers.

[1] https://github.com/kernel-patches/bpf/actions/runs/31806678733/job/94787271162

Fixes: 7a1f400ff5 ("tools: Ensure tools copy of linux/filter.h exports the UAPI")
Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20260814173522.2783625-1-ihor.solodrai@linux.dev
2026-08-14 15:14:36 -07:00
Tejun Heo
62f3d531e4 sched_ext: Fix scx_bpf_dsq_reenq___compat kfunc extern prototype
scx_bpf_dsq_reenq() is registered with KF_IMPLICIT_ARGS and its kernel BTF
prototype omits the trailing bpf_prog_aux argument. The ___compat extern
declares the argument explicitly, so libbpf never matches the prototype and
the weak extern silently stays unresolved on every kernel. The wrapper
always takes the old fallback path, which disables generic reenq users like
scx_qmap's lowpri mechanism and fails non-local reenq with "kernel too old"
even on kernels that have the kfunc.

Drop the explicit aux argument. Also correct the stale v6.20 reference, the
kfunc was added in v7.1.

Fixes: 9c34c5074d ("sched_ext: Introduce scx_bpf_dsq_reenq() for remote local DSQ reenqueue")
Cc: stable@vger.kernel.org # v7.1+
Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-14 11:00:56 -10:00
Leon Hwang
90bd0329ab selftests/bpf: Improve readability in iter test for percpu data
The original 'offsetof()' + offset is equal to the new 'offsetof()'. Use
the new 'offsetof()' instead.

Rename two variables btw:

* offsetof_num -> num_off
* percpu_data_sum -> sum

Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20260814173206.93082-6-leon.hwang@linux.dev
2026-08-14 13:33:37 -07:00
Leon Hwang
3808171428 libbpf: Avoid unnecessary mmap resize for percpu data maps
Use array_map_mmap_sz() for PERCPU_ARRAY like ARRAY in bpf_map_mmap_sz().
This lets bpf_map__set_value_size() skip mmap(), memcpy(), and munmap()
when the old and new value sizes occupy the same number of pages.

Fix some typos btw:

* mmapble -> mmapable
* satisified -> satisfied
* relocatin -> relocation
* atach_btf_obj_fd -> attach_btf_obj_fd
* len_secnd -> len_second
* precendence -> precedence

Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20260814173206.93082-3-leon.hwang@linux.dev
2026-08-14 13:33:35 -07:00
Tao Cui
94c20e1fb3 sched_ext/scx_flatcg: expire cached hweights on weight changes
fcg_cgroup_set_weight() updates cgc->weight and the parent's
child_weight_sum but doesn't bump hweight_gen, so the hweights cached by
cgrp_refresh_hweight() stay stale until some task activation bumps the
generation. For cgroups whose tasks never go through a 0->n runnable
transition (e.g. persistently busy ones), a cpu.weight change never
propagates to scheduling at all.

Bump hweight_gen on weight changes so the next refresh recomputes with
the new weight.

Verified on a flatcg VM: a live cpu.weight 100->800 change on a busy
cgroup leaves HWT update at 0 and the distribution unchanged; with it,
hweight_gen increments and the refresh recomputes.

Signed-off-by: Tao Cui <cuitao@kylinos.cn>
Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-14 09:56:28 -10:00
Jakub Kicinski
4cc4f59258 netfilter pull request 26-08-10
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEjF9xRqF1emXiQiqU1w0aZmrPKyEFAmp6JRsACgkQ1w0aZmrP
 KyG/dQ/+IGRY1T2VT0qP0QpQ717Ml0NC7FzWvK6Fn+7U5u0/AbcyDZkBcMLPv7GV
 CjIRbHPr6/1PcF+DkJD1shLE/+gPXckcjzVn/Yw9pXMWsbE2nL/4ASWhB/Knji1J
 x3hOrRFBOQFOFJZrsI1kzt34MBYQv82NwHSjuWuY00CqaEIMVa0Sn/1BQrUt6qYK
 eQaOTVfzf+br7UF5bVUp5irGDlFTpVMSkBxJUtWCez1Bv9R4YGhQt2bIf5vgep1O
 zQ5Dx20+3NowpICGUegik06zYiBYG3F4jA/4ut2r2ofq/p+us6KXd/UfdvgKkw2t
 XU1A4+OpM4x0RX9Ac12ti8xI3vNQynL8wh8Ag4RIXXaJPEFoU3n+0z+GXOwHZJS9
 yhSHOlksCqD4WLXIJKHaF0rFO+++x3TsNP+aBraj3Pz1lHAzyPjIs0FzS0uj6M7e
 7CD4tZkuUoiOQ56wrKyl44J1XAt4zIsSvPJ5iYUIDm7SnV/Q6LwuD1mjgL0zo6i8
 AJ6QEmhsCVKXcYO2xfPbSNlmBVKqFD7tVefJxadS+MCWA+J5J6Rudy2kMO74eMo/
 TKuJeRDsp5oo1uv/zfMv3y6KFOsqLWx9WFu3robvUSsjIlTooDrQcmPjEMfNNskr
 nBQjjoLNvWUHQvwEVEB4cS526Qw3a2XGhmht00uXjR93t7+IUgI=
 =DxIh
 -----END PGP SIGNATURE-----

Merge tag 'nf-next-26-08-10' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next

Pablo Neira Ayuso says:

====================
Netfilter updates for net

This includes an enhancement to detect ct memleaks easier via
DEBUG_NET and flowtable preparation patches for IPv4 over IPV6
and vice-versa. This also includes a fix for the nft_ct custom
expectation support.

1) Add DEBUG_NET_WARN_ON_ONCE to nf_ct_set() to spot ct memleaks.

2) Pass struct net_device_path_ctx to dev_fill_forward_path() to
   make it easier to pass more parameters to this function.
   From Lorenzo Bianconi.

3) Add ether_type field to net_device_path context structucture.

4) Rename tun.l3_proto field to tun.inner_proto.

5) Rename ctx.tun.proto to ctx.tun.inner_proto.

6) Store ether_type in flowtable context.

7) Move IPv4 and IPv6 xmit path to a helper function.

8) Move encapsulation header parser out of the flowtable lookup
   function.

9) Rework nft_ct custom expectation support to address a possible
   reallocation of ct extension area while expectation list also
   contains expectations. Move datapath to a ct helper to fix it.

10) Ensure timeout is always lowered for the non-closing RST case
    in the TCP connection tracking.

11) Bail out when inserting already dead expectation, this should
    not ever happen, hence report it via DEBUG_NET.

12) Comestic updates for improving the conntrack selftest dump and
    flush userspace program, from Qingshuang Fu.

* tag 'nf-next-26-08-10' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next:
  selftests: netfilter: conntrack_dump_flush: remove unused variables and fix typo
  netfilter: nf_conntrack_expect: bail out on insert dead expectations
  netfilter: conntrack: always lower timeout for non-closing RST packets
  netfilter: nft_ct: move custom expectation support to helper
  netfilter: flowtable: detach layer 2 encapsulation parser from lookup
  netfilter: flowtable: move ipv4 and ipv6 xmit path to function
  netfilter: flowtable: store ethertype in flowtable context
  netfilter: flowtable: rename ctx.tun.proto to ctx.tun.inner_proto
  netfilter: flowtable: rename tun.l3_proto to tun.inner_proto
  net: netfilter: add ether_type to net_device_path_ctx and use it
  net: pass net_device_path_ctx to dev_fill_forward_path()
  netfilter: add DEBUG_NET_WARN_ON_ONCE to skb_set_nfct()
====================

Link: https://patch.msgid.link/20260810194015.932627-1-pablo@netfilter.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-14 12:23:12 -07:00
Shaojie Sun
2d19207f3f selftests/cgroup: Remove redundant chown in test_cgcore_lesser_ns_open
test_cgcore_lesser_ns_open runs as root throughout and never changes its
euid, so chowning the two cgroup.procs files to a non-root uid has no
effect on the test.

The ENOENT the test expects comes from the cgroup namespace delegation
check in cgroup_procs_write_permission(): the source and destination
cgroups must both be descendants of the namespace root captured at open
time.  That check does not depend on file ownership.  In addition, the
permission check only examines the common ancestor's cgroup.procs file
(the test root here), which the chown calls do not touch.

Remove the redundant chown calls and the now unused test_euid and
cg_test_a_procs variables.

Signed-off-by: Shaojie Sun <sunshaojie@kylinos.cn>
Reviewed-by: Tao Cui <cuitao@kylinos.cn>
Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-14 08:32:58 -10:00
Andrii Nakryiko
c7e6175529 selftests/bpf: Make pyperf600 a success again
pyperf600 has been running into 8K BPF_COMPLEXITY_LIMIT_JMP_SEQ limitations
for a long while now, after some internal compiler changes.

Until BPF verifier is bestowed with scalar evolution logic, make that test
actually work by doing what would anyone should do in such situations: by
moving repeatable per-iteration work into independently verified global
functions.

`void *` argument is a problem for global funcs, but a static function wrapper
doing necessary casts and a bit of __arg_nonnull magic dust is all it takes.

Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
Tested-by: Pu Lehui <pulehui@huawei.com> # riscv
Reviewed-by: Pu Lehui <pulehui@huawei.com>
Link: https://lore.kernel.org/bpf/20260813232943.581283-1-andrii@kernel.org
2026-08-14 18:22:38 +02:00
Andrii Nakryiko
073574da7a selftests/bpf: Use ping_command() for IPv6 pings in lwt_ip_encap
lwt_ip_encap hardcodes the ping6 binary for its IPv6 pings. iputils
merged ping6 into ping long ago and distros have started dropping the
compat symlink -- Arch's iputils 20250605 ships only arping, clockdiff,
ping and tracepath. There, every lwt_ip_encap subtest fails:

  check_ping_ok:FAIL:ip netns exec ns-lwt-ip-encap-1-0101330 ping6 -c 1 \
    -W1 -I veth1 fb04::1 > /dev/null unexpected error: 256 (errno 2)
  #217/1   lwt_ip_encap_ipv4/egress:FAIL

The IPv4 subtests fail too, because check_ping_ok() pings both families.
SYS() runs the command through system(), so a missing binary is
indistinguishable from an unreachable peer.

network_helpers.c has had ping_command() for exactly this since commit
372642ea83 ("selftests/bpf: Move netcnt test under test_progs"): it
falls back to "ping -6" when ping6 is not present. lwt_ip_encap.c is the
last hardcoded ping6 user. Fix that.

Fixes: f5e288943e ("selftests/bpf: Move test_lwt_ip_encap to test_progs")
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Song Liu <song@kernel.org>
Link: https://lore.kernel.org/bpf/20260813213558.3103179-1-andrii@kernel.org
2026-08-14 18:18:45 +02:00
Honghui Jiang
9b81a87c52
spi: Add KUnit coverage for DMA mapping error paths
Add KUnit tests for the __spi_map_msg() error paths. The tests verify
that a later TX or RX mapping failure clears the mapping state of
earlier transfers and leaves cur_{tx,rx}_dma_dev identifying the
current mapping device.

A zero-length transfer causes sg_alloc_table() to return -EINVAL,
providing deterministic failure injection without test hooks.
Additional cases cover successful map/unmap and a message which
requires no mapping.

Build the DMA suite as a separate translation unit, exposing the two
internal mapping helpers only for KUnit through the local internal
header. Enable SPI in the default and all-tests KUnit configurations so
the suite is exercised there.

Signed-off-by: Honghui Jiang <jiang_hh2019@163.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/20260814031419.43378-5-jiang_hh2019@163.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-14 16:48:52 +01:00
Linus Torvalds
ad8d485e66 vfs-7.2-rc8.fixes
Please consider pulling these changes from the signed vfs-7.2-rc8.fixes tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCan7RJAAKCRCRxhvAZXjc
 olPOAP9C1jX75LIMjyoJb9lpVAvCdlrvf0wcD88NXVBylueILAEA6GC8/lVpvUX8
 nSFAZojyykVsPitfUdsbLagltXwLqgU=
 =/Rxi
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.2-rc8.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull vfs fixes from Christian Brauner:

 - Don't warn when a mount is completed from another user namespace.

   fsopen() records the caller's user namespace in fc->user_ns and
   hands back an ordinary file descriptor. The task that calls
   fsconfig(FSCONFIG_CMD_CREATE) doesn't have to be the one that
   created the context, and mount_capable() lets it through as long
   as the caller has CAP_SYS_ADMIN over fc->user_ns, which anyone in
   an ancestor namespace does. So fc->user_ns != current_user_ns()
   is something an unprivileged user can arrange.

   Both overlayfs and binfmt_misc WARN_ON() that. Overlayfs already
   has the same check as a plain error return in ovl_parse_param().

   Drop the WARN_ON() and just refuse. Add selftests for both cases.

 - Reject pid allocations through dead ancestor pid namespaces.

   Require PIDNS_ADDING in every namespace that will receive the pid
   before publishing any of them. That preserves the invariant that
   free_pid() never decrements pid_allocated in a namespace whose
   child_reaper is no longer live. The existing ENOMEM behavior is
   unchanged.

* tag 'vfs-7.2-rc8.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  pid: reject allocations through dead ancestor pid namespaces
  selftests/filesystems: test completing a context from another user namespace
  binfmt_misc: don't warn when the mount is completed from another user namespace
  ovl: don't warn when the mount is completed from another user namespace
2026-08-14 07:58:01 -07:00
Wang Yan
525acde34d
selftests/landlock: Fix spelling error in fs_test comment
Fix typo "allowes" -> "allows" in Landlock filesystem test comment.

Signed-off-by: Wang Yan <wangyan01@kylinos.cn>
Reviewed-by: Günther Noack <gnoack@google.com>
Link: https://patch.msgid.link/20260702015823.368529-1-wangyan01@kylinos.cn
Signed-off-by: Mickaël Salaün <mic@digikod.net>
2026-08-14 12:38:29 +02:00
Will Deacon
26b77009ee Merge branch 'for-next/uapi' into for-next/core
* for-next/uapi:
  arm64: uapi: Use __u128 instead of __uint128_t in UAPI headers
  tools: linux/types.h: Add 128-bit integer types for arm64 UAPI structures
2026-08-14 10:16:13 +00:00
Puranjay Mohan
197d34b169
selftests/bpf: Test a multi-slot argument before a struct_ops arena argument
The trampoline reads the __arena flag from the btf_func_model per
argument but stores the ctx one register slot at a time, so the two only
line up if every preceding argument occupies exactly one slot. Every
arena-bearing member of bpf_testmod_ops3 takes single-slot arguments, so
nothing exercises the mapping and a mis-indexed arg_flags lookup would
go unnoticed on any architecture.

Add test_arena_multislot(), whose first argument is a 16-byte struct
passed by value. It fills ctx[0] and ctx[1], putting the arena pointer
at argument index one but slot two. The callback checks both halves of
the struct before dereferencing ctx[2], so a JIT that walks registers
instead of arguments converts the wrong slot and fails the test.

Signed-off-by: Puranjay Mohan <puranjay@kernel.org>
Acked-by: Xu Kuohai <xukuohai@huawei.com>
Link: https://lore.kernel.org/bpf/20260813190356.335181-8-puranjay@kernel.org
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-08-14 05:55:03 +02:00
Puranjay Mohan
05a3575f22
selftests/bpf: Enable __arena argument tests on arm64
The arena kfunc and struct_ops argument tests were restricted to x86-64
because it was the only JIT that implemented the conversions. arm64 does
now, so let them run there too: tag every program in arena_kfunc.c with
__arch_arm64 in addition to __arch_x86_64, and widen the __x86_64__
guards in the struct_ops arena test.

Without this the tests report SKIP on arm64 rather than exercising the
newly added JIT support.

Signed-off-by: Puranjay Mohan <puranjay@kernel.org>
Acked-by: Xu Kuohai <xukuohai@huawei.com>
Link: https://lore.kernel.org/bpf/20260813190356.335181-7-puranjay@kernel.org
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-08-14 05:55:03 +02:00
Puranjay Mohan
1c5bc60f95
selftests/bpf: Add arm64 JIT-sequence tests for __arena kfunc arguments
Pin the arm64 counterparts of the x86-64 rebase sequences: the single
extended-register add for an unconditional argument, the nullable
truncate-test-and-skip variant, and all five argument registers in one
call. The nullable cases use a local label so the branch is pinned to
the instruction right after the add, and the label line does not spell
out the call because arm64 emits either a direct bl or a materialize-
and-blr pair depending on the distance to the kfunc.

Note that on arm64 an unconditional argument is one instruction with
nothing to anchor it against, so arena_arg_jit_rebase alone cannot tell
the two forms apart; it only requires that nothing is emitted between
the rebase and the call. The args5 test is what pins the distinction,
since its four consecutive adds leave no room for a nullable
truncate-and-branch pair between them.

Signed-off-by: Puranjay Mohan <puranjay@kernel.org>
Acked-by: Xu Kuohai <xukuohai@huawei.com>
Link: https://lore.kernel.org/bpf/20260813190356.335181-6-puranjay@kernel.org
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-08-14 05:55:02 +02:00
Minxi Hou
07a9e39750 selftests/net/openvswitch: add SCTP flow key support and test
The ovskey flow-string parser has no OVS_KEY_ATTR_SCTP entry, so a
flow string containing sctp(src=.../dst=...) parses without error but
silently drops the L4 key. The resulting flow carries only
ipv4(proto=132), and the kernel rejects it: match_validate() in
flow_netlink.c requires OVS_KEY_ATTR_SCTP when the IP protocol is
IPPROTO_SCTP and returns -EINVAL for the missing key.

Register OVS_KEY_ATTR_SCTP in the parse table and add a matching
selftest that verifies SCTP flow key matching (sctp src/dst port).

One listener serves the whole test. socat's fork option handles each
association in a child, so the flow rules are the only thing that
changes between the three phases and the listener is never restarted
underneath them. -t 1 bounds how long a forked child lingers after
its association closes, and the existing kill -TERM of the captured
pid on teardown removes the listener itself.

Also enable CONFIG_IP_SCTP in the selftest kernel config. The config
checker strips underscores before comparing keys, so the entry sorts
before CONFIG_IPV6 rather than after it.

Signed-off-by: Minxi Hou <houminxi@gmail.com>
Reviewed-by: Aaron Conole <aconole@redhat.com>
Link: https://patch.msgid.link/20260811181645.1918420-1-houminxi@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-13 18:30:53 -07:00
Eduard Zingerman
033506fc06 selftests/bpf: Guarantee zero termination for veristat test buffers
In veristat tests replace direct read() calls with calls to
read_output() utility function, which:
- guarantees that the input buffer is zero terminated;
- asserts that read operation succeeded.

Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20260811-veristat-filter-fix-v2-3-6c234c4cd6ef@gmail.com
2026-08-13 15:50:55 -07:00
Eduard Zingerman
6c034d962b selftests/bpf: Exercise veristat filtering logic in a selftest
Test cases for veristat file/prog name filtering logic.
Check various formulations for any (*foo*), file (*foo*/),
prog (/bar) and file/prog (*foo*/bar) filters, alongside
erroneous filters and mixed allow/deny filter expressions.

Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20260811-veristat-filter-fix-v2-2-6c234c4cd6ef@gmail.com
2026-08-13 15:50:55 -07:00
Eduard Zingerman
98d309ec81 selftests/bpf: Fix for veristat file/prog filters processing
At the moment veristat filtering behaves unexpectedly for the
following filter expression:

  -f !file/prog

The expression rejects all programs with name 'prog', and all programs
in a file with name 'file'. This commit fixes the expression to
exclude only a program 'prog' from a file 'file'. Additionally,
the commit makes empty filters like '-f ""' or '-f "/"' and error.
Here is the filtering behaviour compared old versus new:

| filter   | file | prog | old verdict | new verdict |
|----------+------+------+-------------+-------------|
| !foo     | foo  | bar  | skipped     | skipped     |
| !foo     | bar  | foo  | skipped     | skipped     |
| !foo     | bar  | bar  | processed   | processed   |
| !foo/bar | foo  | bar  | skipped     | skipped     |
| !foo/bar | foo  | buz  | skipped     | processed   | (!)
| !foo/bar | bar  | bar  | skipped     | processed   | (!)
| !foo/    | foo  | bar  | skipped     | skipped     |
| !foo/    | bar  | bar  | processed   | processed   |
| !/bar    | foo  | bar  | skipped     | skipped     |
| !/bar    | foo  | foo  | processed   | processed   |
| !/       | foo  | bar  | processed   | error       | (!)
| !        | foo  | bar  | processed   | error       | (!)
|----------+------+------+-------------+-------------|
| foo      | foo  | bar  | processed   | processed   |
| foo      | bar  | foo  | processed   | processed   |
| foo      | bar  | bar  | skipped     | skipped     |
| foo/bar  | foo  | bar  | processed   | processed   |
| foo/bar  | foo  | buz  | skipped     | skipped     |
| foo/bar  | bar  | bar  | skipped     | skipped     |
| foo/     | foo  | bar  | processed   | processed   |
| foo/     | bar  | bar  | skipped     | skipped     |
| /bar     | foo  | bar  | processed   | processed   |
| /bar     | foo  | foo  | skipped     | skipped     |
| /        | foo  | bar  | processed   | error       | (!)
|          | foo  | bar  | skipped     | error       | (!)

Fixes: 10b1b3f3e5 ("selftests/bpf: consolidate and improve file/prog filtering in veristat")
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20260811-veristat-filter-fix-v2-1-6c234c4cd6ef@gmail.com
2026-08-13 15:50:55 -07:00
Hongfu Li
8f1d96a16c selftests/prctl: fix non-anonymous VMA mapping in set-anon-vma-name test
The test creates a non-anonymous VMA (ptr_not_anon) via mmap() with
MAP_PRIVATE but without MAP_ANONYMOUS, using fd=0 (stdin) as the file
descriptor.  This always fails because fd=0 is not a regular file, and the
failure was hidden because ASSERT_NE() incorrectly checked for NULL
instead of MAP_FAILED.

Fix by using mkstemp() + ftruncate() to create a real temporary file, then
mapping it with MAP_PRIVATE to obtain a genuine file-backed VMA.  Also fix
the mmap() error checks to use MAP_FAILED instead of NULL, and pass fd=-1
for the anonymous mapping for clarity.  The temp file is unlinked
immediately so it does not persist on disk.

Link: https://lore.kernel.org/20260803103046.14324-1-hongfu.li@linux.dev
Signed-off-by: Hongfu Li <lihongfu@kylinos.cn>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Wei Yang <richard.weiyang@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-13 15:42:07 -07:00
Warren Xiong
825cef942c tools/mm: prevent page_owner_sort from truncating input
page_owner_sort opens the output file with "w" before reading the input. 
If both paths refer to the same file, this truncates the input and the
tool silently processes zero records before returning success.

Delay opening the output file until all input records have been loaded
into memory.  This allows the tool to sort a file in place without
truncating data before it has been consumed.

Link: https://lore.kernel.org/20260730015809.3819606-1-warren.xiong@ugreen.com
Signed-off-by: Warren Xiong <warren.xiong@ugreen.com>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Vishal Moola <vishal.moola@gmail.com>
Cc: Ye Liu <ye.liu@linux.dev>
Cc: Zhen Ni <zhen.ni@easystack.cn>
Cc: Zi Yan <ziy@nvidia.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-13 15:42:06 -07:00
Yuan Chen
259d60f5bf bpftool: Fix double close in map dump
map_dump() closes the map fd in its error path, and do_dump() then
closes the same fd again after a successful dump. Closing an already
closed fd leaves errno set to EBADF, which poisons later errno checks
such as the batch file read check in do_batch(). Let do_dump() own the
fd and remove the close from map_dump().

The same double-close pattern exists in do_show_subset(): both
show_map_close_json() and show_map_close_plain() already close the fd,
so drop the extra close() there as well.

Also propagate the error when bpf_map_get_info_by_fd() fails on a
subsequent map in do_dump(): set err = -1 before breaking out of the
loop, so a later failure is not silently hidden after an earlier
iteration succeeded.

Fixes: 99f9863a0c ("bpftool: Match maps by name")
Signed-off-by: Yuan Chen <chenyuan@kylinos.cn>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20260810142224.2907373-2-chenyuan_fl@163.com
2026-08-13 14:54:06 -07:00
Jakub Kicinski
3da8c3c8b8 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Cross-merge networking fixes after downstream PR (net-7.2-rc8).

No conflicts.

Adjacent changes:

drivers/net/ethernet/wangxun/ngbe/ngbe_main.c
  5f3a13e0bb ("net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling")
  d661abdc30 ("net: ngbe: correct misleading interrupt comment")

drivers/net/ipvlan/ipvlan_main.c
  e16e960d55 ("ipvlan: inherit needed_headroom and needed_tailroom from phy_dev")
  00a40d8092 ("ipvlan: Support per-netns netdev unregistration.")

Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-13 11:00:14 -07:00
Leon Hwang
15945d02c6 selftests/bpf: Verify bpf_iter for global percpu data
Add a test to verify that it is OK to iter the percpu_array map used for
global percpu data.

Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Link: https://lore.kernel.org/bpf/20260813152324.97937-11-leon.hwang@linux.dev
2026-08-13 10:27:41 -07:00
Leon Hwang
1ed2294b31 selftests/bpf: Test verifier log for global percpu data
Add two tests to verify the verifier log
"R%d points to percpu_array map which cannot be used as const string\n".

Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Link: https://lore.kernel.org/bpf/20260813152324.97937-10-leon.hwang@linux.dev
2026-08-13 10:27:40 -07:00
Leon Hwang
3993d5beef selftests/bpf: Test direct reading/writing read-only percpu_array map
Verify these two cases:

1. Direct reading the data of read-only percpu data's percpu_array map
   is allowed.
2. Direct writing the data of read-only percpu data's percpu_array map
   is disallowed.

Assisted-by: Codex:gpt-5.5-xhigh
Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20260813152324.97937-9-leon.hwang@linux.dev
2026-08-13 10:27:40 -07:00
Leon Hwang
4c9241bd73 selftests/bpf: Add tests to verify global percpu data
If the arch, like s390x, does not support percpu insn, these cases won't
test global percpu data by checking FEAT_PERCPU_DATA support.

The following APIs have been tested for global percpu data:

1. bpf_map__set_initial_value()
2. bpf_map__initial_value()
3. bpf_map__set_value_size()
4. generated percpu struct pointer pointing to internal map's mmaped data
5. bpf_map__lookup_elem() for global percpu data map
6. bpf_map_lookup_elem_flags() for global percpu data map

At the same time, the case is also tested with 'bpftool gen skeleton -L'.

Assisted-by: Codex:gpt-5.5-xhigh
Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20260813152324.97937-8-leon.hwang@linux.dev
2026-08-13 10:27:40 -07:00
Leon Hwang
68d4fde73c bpftool: Generate skeleton for global percpu data
Enhance bpftool to generate skeletons that properly handle global percpu
variables. The generated skeleton now includes a dedicated structure for
percpu data, allowing users to initialize and access percpu variables more
efficiently.

For global percpu variables, the skeleton now includes a nested
structure, e.g.:

struct test_global_percpu_data {
	struct bpf_object_skeleton *skeleton;
	struct bpf_object *obj;
	struct {
		struct bpf_map *percpu;
	} maps;
	// ...
	struct test_global_percpu_data__percpu {
		int data;
		char run;
		struct {
			char set;
			int i;
			int nums[7];
		} struct_data;
		int nums[7];
	} *percpu;

	// ...
};

  * The "struct test_global_percpu_data__percpu *percpu" points to
    initialized data, which is actually "maps.percpu->mmaped".
  * Before loading the skeleton, updating the
    "struct test_global_percpu_data__percpu *percpu" modifies the initial
    value of the corresponding global percpu variables.
  * After loading the skeleton, "maps.percpu->mmaped" has been marked as
    read-only in libbpf. If users want to update the global percpu
    variables, they have to update the "maps.percpu" map instead.
  * For lightweight skeleton, "lskel->percpu" will be protected by
    "mprotect(p, sz, PROT_READ)".
  * For subskeleton, those variables of global percpu data will be
    skipped.

Assisted-by: Codex:gpt-5.5-xhigh
Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Quentin Monnet <qmo@kernel.org>
Link: https://lore.kernel.org/bpf/20260813152324.97937-7-leon.hwang@linux.dev
2026-08-13 10:27:40 -07:00
Leon Hwang
f4e64cb65f libbpf: Add support for global percpu data
Add support for global percpu data in libbpf by adding a new ".percpu"
section, similar to ".data". It enables efficient handling of percpu
global variables in bpf programs.

When generating loader for lightweight skeleton, update the percpu_array
map used for global percpu data using BPF_F_ALL_CPUS, in order to update
values across all CPUs using one value slot.

Unlike global data, the mmaped data for global percpu data will be marked
as read-only after populating the percpu_array map. Thereafter, users can
read those initialized percpu data after loading prog. If they want to
update the percpu data after loading prog, they have to update the
percpu_array map using key=0 instead.

Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20260813152324.97937-6-leon.hwang@linux.dev
2026-08-13 10:27:40 -07:00
Leon Hwang
3634e4f2dc libbpf: Probe percpu data feature
libbpf needs a reliable way to distinguish kernels that can support
global percpu data from those that cannot.

Add a dedicated feature probe, so libbpf can make capability decisions
early and fail predictably when global percpu data is unavailable.

Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20260813152324.97937-5-leon.hwang@linux.dev
2026-08-13 10:27:40 -07:00
Rui Qi
ddabc5dbd2 selftests/cgroup: Preserve CPU hotplug write errors
The cpuset partition root state selftest checks several CPU hotplug
transitions. If writing to a CPU online file fails, the helper still
runs pause afterwards and returns the status of pause instead of the
failed write.

This hides the real hotplug failure and can make later checks run
against expectations for a transition that never happened. Move the
write before the bookkeeping and return when it fails, so callers can
observe the hotplug error and the test does not record a CPU as offline
unless the offline operation actually succeeded.

Also change the O* command handler in set_ctrl_state() to use
"eval $COMM $REDIRECT" like all other handlers. The previous version
set COMM but still called write_cpu_online directly, bypassing the
redirect that captures stderr for error reporting.

Changes since v1:
 - Use eval $COMM $REDIRECT in the O* handler instead of calling
   write_cpu_online directly (Waiman Long)

Fixes: a8c52eba88 ("kselftest/cgroup: Add cpuset v2 partition root state test")
Signed-off-by: Rui Qi <qirui.001@bytedance.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-13 07:07:34 -10:00
Yonghong Song
9786d424a3 selftests/bpf: Fix chained_global_func_calls_success() for cpu v4
The chained_global_func_calls_success() test hardcodes the instruction
counts reported by the verifier's per-subprog stats:

  subprog {{[0-9]+}} (global_good) global insns_self 5 insns_total 5 stack
  processed 14 insns

global_good() does 'return arr[0]', where arr[] is an int array and the
return type is long. Without cpu v4 this is a zero-extending load
followed by a <<32/s>>32 sign-extension pair. With -mcpu=v4 llvm emits a
single sign-extending load instead:

  18: (18) r1 = 0xffa00000008eb000
  20: (81) r0 = *(s32 *)(r1 +0)
  21: (95) exit

so the subprog is 3 insns rather than 5, and the whole program is
12 processed insns rather than 14. test_progs-cpuv4 fails with:

  EXPECTED    REGEX: 'subprog {{[0-9]+}} (global_good) global insns_self 5 insns_total 5 stack'
  #606/1   verifier_global_subprogs/chained_global_func_calls_success:FAIL

Select the expected counts based on __BPF_CPU_VERSION__.

Fixes: c2e6c7de88 ("bpf: Show more useful info in stack depth stats")
Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20260813150641.3347662-1-yonghong.song@linux.dev
2026-08-13 18:23:33 +02:00
Linus Torvalds
e14aacefb7 There is a known WiFi/mt76 regression, waiting for a complete fix that
should land soonish.
 
 Including fixes from netfilter.
 
 Previous releases - regressions:
 
   - tcp: fix icsk_ack.ato bitfield overflow
 
   - af_unix: Unlink scc_entry in unix_del_edge().
 
   - ipv4: fix use-after-free in fib_nhc_update_mtu()
 
   - netfilter:
     - ipset: fix refcount race between list:set GC and swap
     - nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path
 
   - sched: act_ct: fix sk_buff leak when the header checks reject a packet
 
   - sctp: clear new_transport when removing a peer
 
   - dibs: correct freeing of dmb_clientid_arr
 
   - ovpn: fix NULL dereference when killing missing key
 
   - eth: veth: fix queue index used to wake the peer txq in veth_poll
 
   - eth: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling
 
   - eth: gve: fix zero-length skb frag with header-split
 
 Previous releases - always broken:
 
   - core: fix skb length accounting after generic XDP frag adjustment
 
   - af_packet: don't send zero-byte data in tpacket_snd().
 
   - eth: bnxt: avoid deadlock when canceling IRQ affinity notifier
 
   - eth: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
 
 Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 
 iQJGBAABCgAwFiEEg1AjqC77wbdLX2LbKSR5jcyPE6QFAmp93xcSHHBhYmVuaUBy
 ZWRoYXQuY29tAAoJECkkeY3MjxOkMMEP/AyjDJBRLMNyKkqY5lEK1ZvPqgaCTWuE
 U/A8ZBxveuCmRDCWkEJhQp2bQHuwJsqW9wYmFob8eEEsAmjey7362t3z7OxKuq7x
 kL8MOpkSY7MyB1kJBrzNMhBSHtSfbRQ/6vqJApoeXkMYxldi9NKvT1pndVwx1vdZ
 G0dVD0dMTR/bWuALfg1aQXAHziACL7eR19eJ/IR9IF2F+Tqi8LgrZpiv0FT9ZU8G
 vHeX9P1WpiorU4nnyqpBoNNpam3mTupcXg+ScqSKlkYKUCZV8ILA0rLZijZxXTrK
 WbO7VxzAjwoz//GMTHAdnw4m0lsPVpCXGzWm/CIUQ/Z1OO04NXGru6LPOlsgufZ1
 LNtbon7+GJ3JWl54/cvBYuDMBaYY+9CW6WdiWdlQuxlaZmixAWpbSxCZuwZMlV9Z
 5HRhQfbg1N20zSTNnmKi5o6uwWOWxpQpxIwDkmPlDIpFPX2HtD+gNJ8UqHwIhgcG
 j6h2oP2up6PS6NxtWm5+UFXqrwL/0AyI1R5x5hdbOO2rfyfcDDec4eo+qhrOhnkq
 uKvBADD4b9zO7hllOz/XQ0uDYfylZlnp4Gx3+6JMYkqeMbk+TmSxrras+g6jnPyk
 gTQ9MK2RHoFywDGMiNebDUJAX/fNWxWywzyzuY3izW4B1jho9YGMSLilaJ/xDDQ9
 AL7fWaTpvCty
 =asb8
 -----END PGP SIGNATURE-----

Merge tag 'net-7.2-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Paolo Abeni:
 "Including fixes from netfilter.

  There is a known WiFi/mt76 regression, waiting for a complete fix that
  should land soonish.

  Previous releases - regressions:

   - tcp: fix icsk_ack.ato bitfield overflow

   - af_unix: Unlink scc_entry in unix_del_edge()

   - ipv4: fix use-after-free in fib_nhc_update_mtu()

   - netfilter:
      - ipset: fix refcount race between list:set GC and swap
      - nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort
        path

   - sched: act_ct: fix sk_buff leak when the header checks reject a
     packet

   - sctp: clear new_transport when removing a peer

   - dibs: correct freeing of dmb_clientid_arr

   - ovpn: fix NULL dereference when killing missing key

   - eth:
      - veth: fix queue index used to wake the peer txq in veth_poll
      - ngbe: fix NULL pointer dereference in non-MSI-X interrupt
        enabling
      - gve: fix zero-length skb frag with header-split

  Previous releases - always broken:

   - core: fix skb length accounting after generic XDP frag adjustment

   - af_packet: don't send zero-byte data in tpacket_snd().

   - eth:
      - bnxt: avoid deadlock when canceling IRQ affinity notifier
      - ipvlan: inherit needed_headroom and needed_tailroom from
        phy_dev"

* tag 'net-7.2-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (55 commits)
  l2tp: fix tunnel and session refcount leak on seq_file release
  net/sched: cls_bpf: reject dev-bound programs bound to a different device
  sctp: fix use-after-free of cached ASCONF chunk
  net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
  sctp: clear new_transport when removing a peer
  net/dibs: Correct freeing of dmb_clientid_arr
  net/sched: cls_u32: skip hash tables in u32_bind_class()
  gve: fix NULL dereference due to missing ptp adjfine
  gve: fix zero-length skb frag with header-split
  net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain
  af_packet: Don't send zero-byte data in tpacket_snd().
  tipc: read le->link under the node lock in tipc_node_link_down()
  selftests: tls: cover splice after a failed decrypt
  net/tls: Fail tls_sw_splice_read() after a failed async decrypt
  net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling
  net: tap: fix wrong transport_header when sending VLAN-tagged frame
  net: packet: fix wrong transport_header when sending VLAN-tagged frame
  vxlan: do not arm the ageing timer on a device that is down
  ipv4: fix use-after-free in fib_nhc_update_mtu()
  NTB: ntb_netdev: Preserve RX queue depth on allocation failure
  ...
2026-08-13 08:37:26 -07:00
Breno Leitao
3d2452c2fb selftests: netconsole: add a userdata torture test
The userdata payload is rebuilt and republished on every configfs write,
including while the target is enabled and messages are being sent.

Add netcons_userdata.sh that runs random tests with userdata.

Signed-off-by: Breno Leitao <leitao@debian.org>
Reviewed-by: Gustavo Luiz Duarte <gustavold@gmail.com>
Link: https://patch.msgid.link/20260810-netcons-userdata-rcu-v3-2-f65557f769ce@debian.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-13 15:04:40 +02:00
Yuyang Huang
046d883265 selftests: net: verify RTA_DEL_REASON on route deletion
Extend rtnetlink.py to check the reason reported in RTM_DELROUTE:

- expired: route with a 2s lifetime collected by the fib6 GC
  (gc_interval lowered like fib_tests.sh fib6_gc_test does);
- ra-withdrawn: a single RA advertises a default route (router
  lifetime), an on-link prefix route (RFC 4861 prefix information
  option) and a route information option route (RFC 4191), then a
  second RA withdraws all three with zero lifetimes; the RAs are
  crafted over a raw ICMPv6 socket so the test does not depend on an
  external RA tool;
- absence: a userspace deletion request records no cause and must not
  carry the attribute at all.

Signed-off-by: Yuyang Huang <sigefriedhyy@gmail.com>
Link: https://patch.msgid.link/20260808005642.26901-11-sigefriedhyy@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-13 12:30:28 +02:00
Ricardo B. Marlière (SUSE)
dcacab904f
selftests/namespaces: Fix racy pipe handshake in timens and pidns_separate
In timens_separate and pidns_separate both the child and the grandchild
write a 'Y' readiness byte to the same pipe, but the parent expects a
single 'Y' followed by the grandchild's pid. If the grandchild's byte
arrives first, the parent takes it for the child's and reads the pid
misaligned, ending up with a garbage value.

The parent stores that pid in self->grandchild_pid so that
FIXTURE_TEARDOWN() can kill the grandchild. A garbage pid leaves the real
grandchild alive in pause(), holding the test runner's TAP pipe open and
hanging the whole collection.

The grandchild has nothing to report, so drop its write() and leave the
child as the sole writer.

Fixes: fdb48976b6 ("selftests/namespaces: Kill grandchild in nsid fixture teardown")
Signed-off-by: Ricardo B. Marlière (SUSE) <ricardo@marliere.net>
Link: https://patch.msgid.link/20260810-selftests-namespaces_race-v1-1-4307e833783e@marliere.net
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-08-13 12:20:42 +02:00
Oleg Nesterov
ab018b7733
selftests/epoll: add a regression test for pipe->poll_usage
pipe->poll_usage was added to ensure that edge-triggered epoll consumers
get a wakeup on every write, even if the pipe was already non-empty.
However, none of the existing epoll_wakeup_test cases cover this; the
test suite passes even with WRITE_ONCE(pipe->poll_usage, true) removed.

Add a test that writes twice to a pipe and verifies that epoll_wait with
EPOLLET reports data each time. This covers the pipe-specific per-write
wakeup behavior that edge-triggered consumers depend on.

Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Link: https://patch.msgid.link/amnlGZesXu-SUK2H@redhat.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-08-13 12:19:27 +02:00
Kumar Kartikeya Dwivedi
d7842e98ca selftests/bpf: Test resolve_btfids arena argument suffixes
Add a suffix-only kfunc declaration with arena annotations on all five
arguments. Verify that resolve_btfids emits address_space(1) type tags
for every position without KF_ARENA_ARG flags in the BTF ID sets.

Represent expected arena arguments as a per-parameter bitmap so the
test covers suffixes beyond the two positions expressible by flags.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://patch.msgid.link/20260812193842.2879226-3-memxor@gmail.com
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-08-12 18:28:49 -07:00
Kumar Kartikeya Dwivedi
5e31d32843 resolve_btfids: Emit arena attributes from kfunc parameter suffixes
Kfunc declarations can identify arena arguments through parameter name
suffixes without repeating KF_ARENA_ARG flags in their BTF ID sets.
resolve_btfids currently misses those arguments when synthesizing the
address_space(1) attributes used by generated vmlinux.h files.

Teach the arena prototype rewrite to recognize __arena and
__arena__nullable directly on each parameter. Keep KF_ARENA_ARG1 and
KF_ARENA_ARG2 handling for explicitly flagged kfuncs, while allowing
suffixes on any argument without synthesizing kfunc flags.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://patch.msgid.link/20260812193842.2879226-2-memxor@gmail.com
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-08-12 18:28:49 -07:00
Kumar Kartikeya Dwivedi
5cb481e139 selftests/bpf: Test subprogram instruction statistics
Add small verifier programs with deterministic instruction streams to
exercise per-subprogram self and inclusive instruction accounting. Use
assembly for normal call chains and straight-line callback bodies containing
only moves, calls, and returns or exits, so control-flow pruning does not make
the expected counts unstable. Pass callback arguments as explicit assembly
operands so the compiler keeps their registers live across the asm block.

Cover asynchronous callback attribution separately: main verification-root
totals include all callback exploration, while static and callback totals
remain local to their synchronous paths.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://patch.msgid.link/20260812221925.3358041-7-memxor@gmail.com
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-08-12 17:45:07 -07:00
Kumar Kartikeya Dwivedi
b961cf3171 selftests/bpf: Test stack depth stats without BTF subprog names
Test the per-program insns_self, insns_total, and stack depth statistics
emitted when BTF function info does not provide subprogram names. Check that
the subprog 0 main record and static-subprogram records use <unknown>.

Make VERBOSE_ACCEPT request verifier statistics so the raw-insn test can
validate the output without a test-specific log level.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://patch.msgid.link/20260812221925.3358041-6-memxor@gmail.com
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-08-12 17:45:07 -07:00
Kumar Kartikeya Dwivedi
5026862334 selftests/bpf: Adjust veristat stack depth parsing
The verifier now reports instruction and stack depth statistics using
uniform "subprog <id> (<name>) <kind>" records. Subprogram 0 is classified
as main, while other records are global or static. Each record carries
insns_self, insns_total, and stack depth.

Teach veristat to parse the new records while retaining support for the
legacy one-line stack depth format used by older kernels. Skip both
instruction counts and match only through the stack value so fields can
still be appended without breaking parsing.

Increase the bounded backward scan so it can include all 256 per-subprogram
records.

Zero-initialize the legacy stack buffer because logs using the new format do
not populate it before the trailing tokenizer loop. This makes the loop see
an empty string instead of reading uninitialized data.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://patch.msgid.link/20260812221925.3358041-5-memxor@gmail.com
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-08-12 17:45:07 -07:00
Kumar Kartikeya Dwivedi
c2e6c7de88 bpf: Show more useful info in stack depth stats
Stack depth statistics list captured depths in subprogram-number order,
while per-verification instruction counts are reported separately. Since
libbpf determines subprogram numbers, it is hard to associate either
statistic with its subprogram name or see where verifier work is spent.

Now that self and inclusive instruction counts are available for every
subprogram, keep the combined maximum stack depth on its own line and print
one uniform record for each subprogram. Represent the main program as
subprog 0, then classify each record as main, global, or static before
reporting insns_self, insns_total, and stack depth.

The aggregate processed count is the sum of all self counts, while each
total shows verifier work rooted at that subprogram.

When no subprogram name is available, print <unknown>. Keep the existing
aggregate "processed ... insns" record unchanged for compatibility.

Suggested-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://patch.msgid.link/20260812221925.3358041-4-memxor@gmail.com
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-08-12 17:45:07 -07:00
Willem de Bruijn
dbf34acdfb selftests: drv-net: so_txtime: fix qdisc replace with handle
The blamed commit updated a tc replace command by adding a handle.

  -    tc(f"qdisc replace dev {ifname} root {qdisc} {optargs}")
  +    tc(f"qdisc replace dev {ifname} root handle 1: {qdisc} {optargs}")

This breaks the test if the root qdisc already has that handle and is of
different kind, with

  "Invalid qdisc name: must match existing qdisc."

If no handle is asked, or the kind differs, tc replace removes the old
qdisc and grafts a new one.

If a handle is asked and exists, tc replace tries to change the qdisc
in place, for which the kind must be the same.

It does not trigger in all setups, like netdevsim or debian 13, which
do not have root handle 1:. But it is a common root handle.

Solve the bug by first deleting the existing root qdisc if one exists.

Wrap that command in a try block, because it will fail for default
qdiscs with handle 0: with

  "Error: Cannot delete qdisc with handle of zero."

Reported-by: Jakub Kicinski <kuba@kernel.org>
Closes: https://lore.kernel.org/netdev/20260810183118.32d5c06a@kernel.org/
Fixes: ef3d6cca02 ("selftests: drv-net: so_txtime: only send test traffic to sch_etf")
Signed-off-by: Willem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/20260811182856.2702163-1-willemdebruijn.kernel@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-12 17:20:07 -07:00
Josh Poimboeuf
7df1638df9 objtool/klp: Fix .kcfi_traps special section extraction
create_fake_symbols() creates a symbol per entry for special sections.
It does so in two steps: first for the sections which have
ANNOTATE_DATA_SPECIAL annotations, then for the rest, using entsize or
the reloc count to infer the entry size.  The second step skips the
sections already handled by the first one by looking for a symbol at
offset 0.

That heuristic is too fuzzy: with Clang and CONFIG_CFI, it misfires on
.kcfi_traps because Clang emits a .Ltmp* assembler-local label at the
start of the section, so no symbols are created and
clone_special_sections() extracts nothing.  klp-build still reports
SUCCESS, but the livepatch module has no __kcfi_traps section and the
traps for the patched functions are lost.

Look for the actual fake symbols created by the first step instead.

Fixes: da4326573a ("objtool/klp: Fix kCFI trap handling")
Reported-by: Joe Lawrence <joe.lawrence@redhat.com>
Closes: https://lore.kernel.org/r/akQNqlfFC0T5pcMa@redhat.com
Acked-by: Song Liu <song@kernel.org>
Link: https://patch.msgid.link/8faaead205b219607b6fc2359ae743be824056eb.1786230311.git.jpoimboe@kernel.org
Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
2026-08-12 13:52:07 -07:00
Puranjay Mohan
6656cf1e97 objtool/klp: Fix vmlinux .klp.symid link error for .exitcall.exit symbols
Building a kernel via klp-build fails to link:

  `__exitcall_aes_mod_exit' referenced in section `.klp.symid' of vmlinux.o: defined in discarded section `.exitcall.exit' of vmlinux.o
  `__exitcall_dax_exit' referenced in section `.klp.symid' of vmlinux.o: defined in discarded section `.exitcall.exit' of vmlinux.o
  `__exitcall_hid_exit' referenced in section `.klp.symid' of vmlinux.o: defined in discarded section `.exitcall.exit' of vmlinux.o
  `__exitcall_usb_serial_module_exit' referenced in section `.klp.symid' of vmlinux.o: defined in discarded section `.exitcall.exit' of vmlinux.o

module_exit() on a built-in emits a static __exitcall_$fn pointer into
.exitcall.exit, which vmlinux.lds.h discards unconditionally via
EXIT_CALL.  When two built-in translation units define a module_exit()
function of the same name, the resulting local symbols collide,
symid_needed() sees a duplicate and emits a .klp.symid entry for each,
referencing symbols the linker then throws away.

Same-named module_exit() functions are not rare:

  dax_exit                drivers/dax/device.c, drivers/dax/fsdev.c
  hid_exit                drivers/hid/hid-core.c, drivers/hid/usbhid/hid-core.c
  aes_mod_exit            arch/arm64/crypto/aes-ce-ccm-glue.c, lib/crypto/aes.c
  usb_serial_module_exit  module_usb_serial_driver() expands to this fixed
                          name in each of its ~49 users

The last one makes the collision structural rather than accidental: any
kernel with two built-in USB serial drivers has it.  This is not arch
specific either; it only requires the objects to be built in rather than
modular, which is why a monolithic config trips it while a typical
distro config does not.

Add .exitcall.exit to the discarded section list so its symbols don't get
symids.

This is the same failure mode as "objtool/klp: Fix vmlinux .klp.symid
link error for .no_trim_symbol symbols", for another unconditionally
discarded allocated section.

Fixes: 029223d301 ("objtool/klp: Add .klp.symid for sympos disambiguation")
Signed-off-by: Puranjay Mohan <puranjay@kernel.org>
Link: https://patch.msgid.link/m24igzlbxf.fsf@kernel.org
Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
2026-08-12 13:33:32 -07:00
Tejun Heo
a05c5b5cb5 sched_ext: Convert scx_bpf_cid_override() to __arena array arguments
scx_bpf_cid_override() predates the cid-form arena transition and takes its
arrays as verifier-checked mem+size buffers, forcing scx_qmap to keep the
cpu_to_cid and shard_start arrays in writable bss while the rest of its
state lives in the arena. Unify on arena arguments before cid-form
schedulers start seeing real use.

BPF now translates between BPF and kernel arena addresses for __arena
arguments. Take the arrays as __arena arguments, with the counts passed in
entries. The counts now size the snapshot copies and are bounds-checked
before them.

scx_qmap moves the arrays into struct qmap_arena. As the arena is mmapped at
load, the loader populates them between load and attach instead of before
load.

The arena argument address translation is currently implemented only on
x86-64. Schedulers calling this kfunc load only there for now.

Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-12 09:55:33 -10:00
Tejun Heo
a8dc810968 sched_ext: Convert sub-cap kfuncs to __arena cmask arguments
The sub-cap kfuncs take their cmask arguments as __ign pointers. The values
cross the kfunc boundary as unchecked scalars and scx_cmask_ref_init()
rebases them into the arena by hand.

BPF now translates between BPF and kernel arena addresses for __arena
arguments. Tag the cmask arguments __arena so the kfuncs receive kernel
addresses and scx_cmask_ref_init() loses the hand-rolled conversion. The
optional denied_out keeps its NULL not-provided signal via
__arena__nullable. The mandatory masks use plain __arena.

scx_qmap's call sites drop the (void *)(long) casts since the BPF-side
declarations type the cmask arguments __arena and take arena pointers
directly.

The arena argument address translation is currently implemented only on
x86-64. Schedulers calling these kfuncs load only there for now.

Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-12 09:55:33 -10:00
Tejun Heo
294d95ff25 Merge branch 'for-7.3' into for-7.3-arena-args 2026-08-12 09:55:20 -10:00
Vineet Gupta
3a59f11e0f selftests/bpf: vmtest.sh: Preserve command quoting when running in the VM
vmtest.sh captures the trailing command with command="$@", which flattens
the arguments into a single space-separated string, and then pastes it
into the generated guest init script:

        cd /root/bpf
        echo ${command}
        stdbuf -oL -eL ${command}

That here-doc is unquoted, so the host expands ${command} and the
flattened text lands in the script verbatim. The guest bash then parses
those lines as shell source, re-splitting the text on whitespace and
glob-expanding it against /root/bpf. As a result any command with a glob
or an argument containing spaces is corrupted before it reaches the test
binary. For example:

        vmtest.sh -- ./test_progs -a 'verifier_*'

has 'verifier_*' expanded in the guest into the matching object/skeleton
files (verifier_align.bpf.o verifier_align.skel.h ...), so test_progs is
handed a list of filenames instead of the intended name filter and runs no
matching tests.

Quote each argument with printf '%q ' so the command is reproduced
verbatim inside the VM: the escaped text goes through exactly one round
of quote removal when the guest parses the init script, yielding the
original argv with globs and special characters intact. The common case
(e.g. -t <name>) is unaffected.

Only do this when there is a command to quote. printf '%q ' with no
arguments still applies the format once and emits '', which the -s
(debug shell) path would take for a real command and try to run.

Note this makes the trailing command strictly an argv rather than a shell
snippet: passing it pre-quoted as one word, e.g.

        vmtest.sh -- "./test_progs -t foo"

no longer works, and neither does embedding guest-side shell syntax such
as ';' or a redirection. 'sh -c ...' still works.

The RV64 recipe in README.rst does depend on the old double parse: it
wraps the denylist in \" so the literal quotes reach the guest, whose
second parse of the init script removes them. Under %q those quotes now
survive into argv, and parse_test_list() strtok_r()s on ',' turns them
into junk filters:

        -d ",exceptions,"  ->  ["] [exceptions] ["]

That is harmless for DENYLIST.riscv64 only because its first line is a
comment, so the leading field is empty. A denylist starting with a real
entry would silently lose it - ["*arena*] never matches - so drop the
backslashes and let the host consume the quotes instead.

Fixes: c9709f5238 ("bpf: Helper script for running BPF presubmit tests")
Signed-off-by: Vineet Gupta <vineet.gupta@linux.dev>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20260807204434.1036279-5-vineet.gupta@linux.dev
2026-08-12 20:25:31 +02:00
Vineet Gupta
7bd1dd3fb8 selftests/bpf: Report failed subtest count in test_progs summary
The final summary line is asymmetric: the PASSED field reports both the
number of top-level tests and the number of subtests within them, while
the FAILED field reports only top-level tests:

  Summary: 640/5750 PASSED, 7760 SKIPPED, 100 FAILED

There is no way to tell whether those 100 failing tests amount to 100
broken subtests or 1000. So count subtests with a non-zero error_cnt
into a new sub_fail_cnt and print it alongside fail_cnt:

  Summary: 640/5750 PASSED, 7760 SKIPPED, 100/342 FAILED
                                             ^^^^^

This is correct for -j runs, as subtest_states[] is populated both in
sequential and parallel modes.

A test that fails without declaring any subtests contributes 0 to
sub_fail_cnt. That mirrors the existing behaviour of sub_succ_cnt for
tests that pass without subtests, keeping the two numerators
comparable.

Also emit the new count as a "failed_subtest" field in the JSON output,
for parity with the existing "success_subtest".

Note that this changes the trailing field of the summary line from a bare
integer to "A/B", so anything scraping "N FAILED" out of it needs updating.
While here, fix the fail_cnt comment in struct test_env, which claims it
counts "total failed tests + sub-tests".

Signed-off-by: Vineet Gupta <vineet.gupta@linux.dev>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20260807204434.1036279-4-vineet.gupta@linux.dev
2026-08-12 20:25:31 +02:00
Vineet Gupta
2614285f32 selftests/bpf: Add --no-error-summary to skip end-of-run error log dump
By default test_progs re-prints the aggregated error logs of all failed
tests at the end of the run (when not in verbose mode), starting with
"All error logs:".

With bpf-gcc the current failures and a couple runaway 1M fails cause a
huge print overhead/delay at the end.

Add a subtractive --no-error-summary flag, gated on a new
env.error_summary field which defaults to true, so the default behavior
is unchanged. Passing --no-error-summary suppresses the final
"All error logs:" dump.

Only the human readable output is elided. dump_test_log() also emits the
per-test and per-subtest entries of the --json-summary "results" array,
so it keeps being called (via a new @quiet argument) and the JSON report
is bit for bit what it was before.

Signed-off-by: Vineet Gupta <vineet.gupta@linux.dev>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20260807204434.1036279-3-vineet.gupta@linux.dev
2026-08-12 20:25:31 +02:00
Vineet Gupta
e28b492267 selftests/bpf: map_kptr: Expect BPF_ST reject msg on cpuv4 toolchains
reject_scalar_store_to_kptr stores a scalar constant to a kptr field:

        *(volatile u64 *)&v->unref_ptr = 0xBADC0DE;

Compilers generate one of two encodings for that:

 1. Materialize the constant into a register and emit BPF_STX:

        r1 = 0xbadc0de
        *(u64 *)(r0 + 0x8) = r1

 2. Or fold it into a single BPF_ST (store immediate):

        *(u64 *)(r0 + 0x8) = 0xbadc0de

These go through different rejection paths and output different
messages.
 - BPF_STX goes through map_kptr_match_type(), which prints
   "invalid kptr access, R...".
 - BPF_ST only gets the immediate check printing
   "BPF_ST imm must be 0 when storing to kptr"

The test only expects the BPF_STX message, so it fails on a toolchain
that folds the constant - bpf-gcc, and clang -mcpu=v4:

  7: (7a) *(u64 *)(r0 +8) = 195936478
  BPF_ST imm must be 0 when storing to kptr at off=8
  ...
  EXPECTED   SUBSTR: 'invalid kptr access, R'

Pick the expected message with __BPF_FEATURE_ST, which clang and bpf-gcc
both define exactly when BPF_ST codegen is available - cpuv4 for clang,
and by default for bpf-gcc, whose default cpu is v4.

  bpf-gcc, before: #229/20 map_kptr/reject_scalar_store_to_kptr:FAIL
  bpf-gcc, after : #229/20 map_kptr/reject_scalar_store_to_kptr:OK

Two caveats worth noting:

- On a BPF_ST toolchain the test now only exercises the imm != 0 check
  and never reaches map_kptr_match_type(), so the scalar-vs-PTR_TO_BTF_ID
  rejection the test is named for is only covered by the non-ST builds.
  The imm path itself is already covered compiler-independently by
  verifier/map_kptr.c ("map_kptr: BPF_ST imm != 0").

- __BPF_FEATURE_ST says the compiler *can* emit BPF_ST, not that it will.
  The encoding also depends on the optimization level: clang -mcpu=v4 -O0
  still emits BPF_STX, which would send the #ifdef down the wrong branch
  and fail the test. Selftests always build BPF objects at -O2 so this
  does not bite today, but it is a latent failure mode if that changes.

Signed-off-by: Vineet Gupta <vineet.gupta@linux.dev>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
Link: https://lore.kernel.org/bpf/20260807204434.1036279-2-vineet.gupta@linux.dev
2026-08-12 20:25:31 +02:00
David Matlack
37ffa24c9d selftests: harness: Mark test fixture objects __maybe_unused
Mark _##fixture_name##_##test_name##_object __maybe_unused since it may
not ever be read. This pointer is only read in XFAIL_ADD(), which tests
are not required to use.

clang made a change to -Wunused-but-set-variable (split out into its own
subwarning, -Wunused-but-set-global) that causes this warning to be
emitted for various selftests and can be upgraded to an error in
selftest that set -Werror.

VFIO selftests have been broken since commit ff556bd983 ("vfio:
selftests: Add -Wall and -Werror to the Makefile"), and the net
selftests builds have been noisy due to -Wall.

Fixes: 24cf65a622 ("selftests/harness: Share _metadata between forked processes")
Reported-by: Kuniyuki Iwashima <kuniyu@google.com>
Reported-by: Aaron Lewis <aaronlewis@google.com>
Reviewed-by: Alex Williamson <alex@shazbot.org>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Signed-off-by: David Matlack <dmatlack@google.com>
Reviewed-by: Nathan Chancellor <nathan@kernel.org>
Link: https://lore.kernel.org/r/20260706183154.2660394-1-dmatlack@google.com
Signed-off-by: Alex Williamson <alex@shazbot.org>
2026-08-12 12:00:05 -06:00
Daniel Borkmann
611a9f0d3d selftests/bpf: Add arena fault tests for atomics with fetch
Add stream_arena_xchg_fault and stream_arena_cmpxchg_fault next to the
existing read, write and load-acquire fault tests, covering the two
places a read-modify-write can deposit the old value: src_reg for a
BPF_XCHG and r0 for a BPF_CMPXCHG. Both cover both halves of the JIT
bug that left the fetch destination alone when a RMW on an arena pointer
faulted:

  - the fault has to be reported as a WRITE, and at the address held by
    the destination register, which __stderr() and test_address() check
  - the register receiving the fetched value has to be cleared by the
    fault handler, which the programs check by poisoning it before the
    atomic and returning it, so __retval(0) fails if it is left untouched

The __stderr() annotation can only wildcard the faulting address since
the arena base is not known until runtime, hence the two test_address()
subtests on top, which pin it to the address held by dst_reg rather than
src_reg.

Note, the atomics are open coded since linux/filter.h cannot be included
alongside vmlinux.h.

  # LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh -- ./test_progs -t stream
  [...]
  #464/1   stream_arena_fault_address/read_fault:OK
  #464/2   stream_arena_fault_address/write_fault:OK
  #464/3   stream_arena_fault_address/load_acquire_fault:OK
  #464/4   stream_arena_fault_address/xchg_fault:OK
  #464/5   stream_arena_fault_address/cmpxchg_fault:OK
  #464     stream_arena_fault_address:OK
  [...]
  #466/5   stream_success/stream_arena_write_fault:OK
  #466/6   stream_success/stream_arena_read_fault:OK
  #466/7   stream_success/stream_arena_load_acquire_fault:OK
  #466/8   stream_success/stream_arena_xchg_fault:OK
  #466/9   stream_success/stream_arena_cmpxchg_fault:OK
  [...]
  Summary: 4/22 PASSED, 0 SKIPPED, 0 FAILED

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Acked-by: Puranjay Mohan <puranjay@kernel.org>
Link: https://patch.msgid.link/20260811131600.506721-6-daniel@iogearbox.net
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-08-12 10:33:53 -07:00
Tejun Heo
1be10bb070 sched_ext: Merge branch 'for-7.2-fixes' into for-7.3
Pull to receive:

 c10b216a07 ("sched/core: Handle pick_task() releasing the rq lock")
 f3629c63a4 ("sched/core: Make core-sched flips wait for in-flight selections")
 ffaab58d21 ("sched_ext: Replace SCX_RQ_BAL_KEEP with a dispatch verdict return")
 3dd52416e4 ("sched_ext: Fix this_rq() assumptions in dispatch kfuncs")
 f2da958711 ("sched_ext: Count rq lock releases in rq->scx.lock_drop_seq")
 d954004205 ("sched_ext: Fix rq->core_pick corruption under core scheduling")

for the pending core scheduling follow-ups and to resolve the conflicts
with the code reorganization and cap gate work on for-7.3.

ffaab58d21 converts scx_dispatch_sched() to a dispatch verdict return
which for-7.3 moved from ext.c into inlines.h. Resolved by applying the
conversion to the relocated copy and combining balance_one()'s verdict
returns with the scx_task_can_stay_on_cpu() gate from the cap work.

ffaab58d21 and 3dd52416e4 update scx_bpf_sub_dispatch() which
for-7.3 moved into sub.c. Resolved by applying the scx_locked_rq()
switch and the verdict test to the sub.c copy.

f2da958711 instruments the open-coded lock releases in
consume_remote_task() which for-7.3 folded into switch_rq_lock().
Resolved by keeping the accounting in switch_rq_lock() which covers all
its callers.

d954004205 widens the put_prev_task_scx() WARN suppression to all
core-sched rqs on the same condition that for-7.3 gated with
scx_task_can_stay_on_cpu(). Resolved by combining both.

Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-12 06:46:28 -10:00
Mohammad Abu-Khader
dea754ded9 kunit: tool: fix _list_tests filtering wrong variable when list has TAP prefix
`_list_tests()` runs the kernel to list tests, strips printk timestamp
lines via `extract_tap_lines()`, then drops the dummy TAP header from
the cleaned `lines`.  However the subsequent regex filter mistakenly
operates on the original `output` instead of the cleaned `lines`.  When
the kernel output includes timestamp prefixes (common with UML or slower
setups), e.g.:

  [    0.100000] suite.test1
  [    0.100000] suite.test2

the anchored regex `^[^\s.]+\.[^\s.]+$` rejects them and `--list_tests`
returns an empty list.

Filter `lines` instead of `output`, matching the behavior of the
adjacent `_list_tests_attr()` which already returns the cleaned list.

Add a regression test with timestamp-prefixed input to verify the fix.

Link: https://lore.kernel.org/r/20260803190059.36491-1-mohammad.abukhader@hotmail.com
Fixes: 723c8258c8 ("kunit: tool: Add command line interface to filter and report attributes")
Signed-off-by: Mohammad Abu-Khader <mohammad.abukhader@hotmail.com>
Reviewed-by: David Gow <david@davidgow.net>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
2026-08-12 10:42:53 -06:00
Arnaldo Carvalho de Melo
d17c5b7709 perf build: install-build-deps: add RHEL family devel package mapping
With the Fedora mapping in place, this patch extends it to the RHEL
family (RHEL, CentOS Stream, Rocky Linux, AlmaLinux, Oracle Linux),
which shares most Fedora package names and runs dnf (RHEL 8 and
later).  The names that differ are handled by probing the enabled
repos:

  - zlib.h comes from zlib-ng-compat-devel on the RHEL 10 family,
    zlib-devel on RHEL 9 and earlier;
  - there is no java-latest-openjdk-devel: the JDK devel package is
    versioned per release, java-21-openjdk-devel on the RHEL 10
    family, java-17-openjdk-devel on RHEL 9, java-11-openjdk-devel
    on RHEL 8;
  - libbpf-devel and capstone-devel live in the CRB repo on RHEL and
    CentOS Stream 10, in EPEL on RHEL 9 and earlier;
  - libbabeltrace2-devel is not packaged on the RHEL 10 family.

Packages not available on the enabled repos are skipped instead of
aborting the dnf transaction, and are listed at the end of the run, with
the repo that provides them pointed out in the header comment and help
text: a distro with CRB/EPEL enabled gets the full set, one without them
still installs what it can.

This also holds for the base set: e.g.  'rust' exists only as the
rust-toolset AppStream module on RHEL 8 and 9, where it is not
installable as a plain package, so it is skipped and noted there instead
of failing the whole dnf transaction.

The base set lists pkgconf-pkg-config instead of pkgconfig: both
families have been on pkgconf since Fedora 26 / RHEL 8, where
'pkgconfig' lives only as a virtual Provides of that subpackage, and
a minimal RHEL-family container may not have it preinstalled.

Validated on a fresh CentOS Stream 10 distrobox container, with the
CRB repo enabled, so the host system is not modified:

    distrobox create --image quay.io/centos/centos:stream10
    distrobox enter centos-stream10
    dnf config-manager --set-enabled crb
    make -C tools/perf install-build-deps

which installed the 28 available mapped packages; libbabeltrace2-devel, the
only mapped package with no RHEL 10 package, is reported at the end
of the run.

A subsequent 'make -C tools/perf feature-dump' enabled every feature
with an external dependency the RHEL 10 family provides, including
libbpf and libcapstone from the CRB repo, with only
babeltrace2-ctf-writer left out along with the deliberately unmapped
opt-in features.

Re-running the target is a no-op (dnf reports "Nothing to do"); with the
CRB repo disabled, the skipped packages are instead listed in the
end-of-run note, whose header comment and help text point out which repo
provides them.

Members of the family without dnf (RHEL 7 and earlier, e.g. Oracle
Linux 7, a yum-only distro) are rejected with an explicit error while
the dnf-based members get the full mapping.

Example of its --list:

  $ grep PRETTY_NAME /etc/os-release
  PRETTY_NAME="Fedora Linux 44 (Toolbx Container Image)"
  $ tools/perf/scripts/install-build-deps.sh --list --distro rhel
  bison
  capstone-devel
  clang-devel
  elfutils-debuginfod-client-devel
  elfutils-devel
  elfutils-libelf-devel
  flex
  gcc
  gcc-c++
  glibc-devel
  java-latest-openjdk-devel
  kernel-headers
  libbabeltrace2-devel
  libbpf-devel
  libpfm-devel
  libstdc++-devel
  libtraceevent-devel
  libzstd-devel
  llvm-devel
  make
  numactl-devel
  openssl-devel
  pkgconf-pkg-config
  python3-devel
  python3-setuptools
  rust
  slang-devel
  systemtap-sdt-devel
  xz-devel
  zlib-ng-compat-devel
  $

Assisted-by: opencode:deepseek-v4-flash-free
Assisted-by: claude:claude-opus-4-7
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-12 06:17:49 -07:00
Arnaldo Carvalho de Melo
b60f6bc128 perf build: Remove leftover feature tests for removed cxx and clang support
56b11a2126 ("perf bpf: Remove support for embedding clang for
compiling BPF events (-e foo.c)") removed the test-cxx.cpp and
test-clang.cpp sources, but left behind their entries in the feature
test FILES list, the build rules and the cxx and clang entries in
FEATURE_TESTS_EXTRA.

Since the sources no longer exist, those rules would always fail,
making the artificial feature-cxx and feature-clang results to be
perpetually disabled/absent, remove the leftover entries, making the
feature test scripts list match the available sources.

Fixes: 56b11a2126 ("perf bpf: Remove support for embedding clang for compiling BPF events (-e foo.c)")
Cc: Ian Rogers <irogers@google.com>
Assisted-by: opencode:deepseek-v4-flash-free
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-12 06:17:49 -07:00
Arnaldo Carvalho de Melo
01c7a389d1 perf build: install-build-deps: add Debian devel package mapping
With the Fedora and Ubuntu mappings in place, this patch adds Debian
support: Debian installs the same devel packages, under the same
names, as the Ubuntu mapping, so it reuses debian_pkg_for() and
debian_base_pkgs as-is, with only auto-detection in detect_distro()
(and the shared apt-get install path) added, keeping the script's
per-distro dispatch ready for distros with their own package names.

Validated on a fresh Debian 13 (trixie) container so the host system
is not modified:

    distrobox create --image debian:trixie
    distrobox enter debian-trixie
    make -C tools/perf install-build-deps

which installed the 29 mapped packages; re-running the target is a
no-op (apt-get reports "0 newly installed").  A subsequent clean build
enabled the same feature set as Ubuntu: 'perf version --build-options'
shows every feature with an external dependency Debian has a package
for [on], including the BPF skeletons compiled with clang/llvm
(libLLVM), the python binding and the C++-based features, with only
the deliberately unmapped libbfd family, libperl, libunwind and the
CoreSight (libopencsd) packages [OFF].

RHEL, whose package mapping is largely similar to Fedora's, is the
remaining planned distro, to be enabled once that mapping is
validated on it.

Example of its --list:

  $ grep PRETTY_NAME /etc/os-release
  PRETTY_NAME="Fedora Linux 44 (Toolbx Container Image)"
  $ tools/perf/scripts/install-build-deps.sh --list --distro debian
  bison
  clang
  default-jdk
  flex
  g++
  gcc
  libbabeltrace2-dev
  libbpf-dev
  libc6-dev
  libcapstone-dev
  libdebuginfod-dev
  libdw-dev
  libelf-dev
  liblzma-dev
  libnuma-dev
  libpfm4-dev
  libslang2-dev
  libssl-dev
  libtraceevent-dev
  libzstd-dev
  linux-libc-dev
  llvm-dev
  make
  pkg-config
  python3-dev
  python3-setuptools
  rustc
  systemtap-sdt-dev
  zlib1g-dev
  $

Assisted-by: opencode:deepseek-v4-flash-free
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-12 06:17:48 -07:00
Arnaldo Carvalho de Melo
1331bb5106 perf build: install-build-deps: add Ubuntu devel package mapping
With the framework and Fedora mapping in place, this patch adds the
Ubuntu (apt) mapping: same feature-to-package correspondence as the
Fedora one, adapted to Debian packaging conventions (libfoo-dev), on
a per-distro dispatch so future distros can pick their own mapping or
reuse one of these (Debian shares the Ubuntu mapping).

Notable differences from Fedora:

  - base set: g++ (ships libstdc++-*-dev, covering cxa-demangle),
    pkg-config (installed implicitly by Fedora's default toolchain
    metapackage, but not by Ubuntu's), linux-libc-dev and libc6-dev
    instead of kernel-headers and glibc-devel, and rustc for rust;
  - cxa-demangle maps to nothing, covered by g++'s libstdc++;
  - the clang-bpf-co-re test needs the clang compiler binary (Fedora's
    clang-devel provides it transitively), and llvm-dev, which also
    brings llvm-config (deps on the llvm package), used by the
    llvm/llvm-perf tests;
  - libslang maps to libslang2-dev and jvmti to default-jdk;
  - the install command runs 'apt-get update' first since a fresh
    container has no package indexes, unlike dnf.

Validated on a fresh Ubuntu 26.04 distrobox container so the host
system is not modified:

    distrobox create --image ubuntu:26.04
    distrobox enter ubuntu-26-04
    make -C tools/perf install-build-deps

which installed the 29 mapped packages; a subsequent clean O= build
enabled every feature with an external dependency Ubuntu has a
package for: perf's build-options then showed all of them [on],
including the BPF skeletons requiring clang/llvm, the python binding
and the C++-based features, with only the deliberately unmapped
(deprecated) libbfd family, libperl and libunwind [OFF], and the
build linked libpfm, libbabeltrace2-ctf-writer, libcapstone,
libtraceevent, libslang, libnuma, libdw and libssl.  Re-running the
target is a no-op (apt-get reports "0 newly installed").

Debian (trixie) is the next planned distro: it shares this Ubuntu
mapping, so enabling it reuses it as-is, once it gets validated on a
Debian release.

Example of its --list:

  $ grep PRETTY_NAME /etc/os-release
  PRETTY_NAME="Fedora Linux 44 (Toolbx Container Image)"
  $ tools/perf/scripts/install-build-deps.sh --list --distro ubuntu
  bison
  clang
  default-jdk
  flex
  g++
  gcc
  libbabeltrace2-dev
  libbpf-dev
  libc6-dev
  libcapstone-dev
  libdebuginfod-dev
  libdw-dev
  libelf-dev
  liblzma-dev
  libnuma-dev
  libpfm4-dev
  libslang2-dev
  libssl-dev
  libtraceevent-dev
  libzstd-dev
  linux-libc-dev
  llvm-dev
  make
  pkg-config
  python3-dev
  python3-setuptools
  rustc
  systemtap-sdt-dev
  zlib1g-dev
  $

Assisted-by: opencode:deepseek-v4-flash-free
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-12 06:17:48 -07:00
Arnaldo Carvalho de Melo
9f83597eb5 perf build: install-build-deps: add Fedora devel package mapping
With the framework from the previous commit in place, this patch adds
the per-feature mapping for Fedora/dnf: for each feature test in
tools/build/feature/, the Fedora devel package providing the headers
or library the test compiles against, kept explicit in the script
next to the test that requires it.

Special cases:

  - test-libdebuginfod.c includes <elfutils/debuginfod.h>, provided
    by elfutils-debuginfod-client-devel, not elfutils-devel;
  - the cxa-demangle test links against libstdc++'s builtin demangler,
    pulling in libstdc++-devel;
  - the BPF-oriented features (bpf, clang-bpf-co-re) get their headers
    from the base packages and clang-devel.

Tests with no Fedora equivalent (bionic, compile-32, compile-x32) and
the opt-in/deprecated ones (libbfd disassembler family, GTK2, LIBPERL,
LIBUNWIND, CoreSight, and the tests perf itself doesn't check, like
libcpupower) are deliberately not mapped.

Validated on a fresh Fedora 44 toolbx container, so the host OS is not
modified:

    toolbox create fedora:44
    toolbox enter fedora:44
    make -C tools/perf install-build-deps

which installed the 29 mapped packages; a subsequent clean O= build
enabled every feature with an external dependency Fedora provides
(feature tests went to 1, except bionic/compile-32/compile-x32, which
have no Fedora equivalent, and the libunwind-debug-frame tests, whose
symbols Fedora's libunwind does not export), linking libpfm,
libbabeltrace2-ctf-writer, libcapstone, libtraceevent, libslang and
libnuma, as well as building the BPF skeletons requiring clang/llvm.
Re-running the target is a no-op (dnf reports "Nothing to do").

RHEL and its derivatives share most Fedora package names but are
refused by the script until this mapping is validated on them.

Example of its --list option:

  $ grep PRETTY_NAME /etc/os-release
  PRETTY_NAME="Fedora Linux 44 (Toolbx Container Image)"
  $ tools/perf/scripts/install-build-deps.sh --list
  bison
  capstone-devel
  clang-devel
  elfutils-debuginfod-client-devel
  elfutils-devel
  elfutils-libelf-devel
  flex
  gcc
  gcc-c++
  glibc-devel
  java-latest-openjdk-devel
  kernel-headers
  libbabeltrace2-devel
  libbpf-devel
  libpfm-devel
  libstdc++-devel
  libtraceevent-devel
  libzstd-devel
  llvm-devel
  make
  numactl-devel
  openssl-devel
  python3-devel
  python3-setuptools
  rust
  slang-devel
  systemtap-sdt-devel
  xz-devel
  zlib-devel
  $

Assisted-by: opencode:deepseek-v4-flash-free
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-12 06:17:48 -07:00
Arnaldo Carvalho de Melo
bc3fdd6adb perf build: Add install-build-deps framework to install devel packages
Installing the development packages needed to build perf is
error-prone on a fresh distro install: the packages are scattered
across the feature tests in tools/build/feature/, each checking for a
specific header/library, and the build only tells you what's missing
after failing a check.

This series adds a 'make -C tools/perf install-build-deps' target to
install them in one go, deriving the package list from the feature tests
themselves.

This commit adds the framework, on top of the parse-time compiler
probe guard from the previous commit:

- the install-build-deps target in tools/perf/Makefile.perf, exempted
  from the config/feature detection pass, since it must run in a fresh
  container, before gcc or pkg-config exist, to install them;
- the install-build-deps.sh script, with --list, --dry-run and
  --distro options, distro detection (Fedora and Ubuntu), dnf and
  apt-get drivers, root/passwordless-sudo handling, and the base
  packages common to any build: compiler, C++ compiler, make, flex,
  bison, libc and kernel headers, python3-setuptools (needed by the
  python binding) and rust (checked by the rust feature test);
- the parse-time probes for optional tools, like pkg-config, use
  'command -v' with stderr discarded, so a fresh container without
  them gets no 'which: no pkg-config in (...)' spew from make;
- the script does not rely on 'set -e': its error paths are explicit,
  since the make target runs it via $(SHELL), where a shebang option
  would be ignored anyway, so direct and make-driven runs behave the
  same.

The per-feature mappings, from each feature test to the devel package
providing its headers on a given distro, are added by the follow-up
patches, one per distro, together with the validation of each mapping
in a fresh container: until then the target installs just the base
toolchain.

Assisted-by: opencode:deepseek-v4-flash-free
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-12 06:17:48 -07:00
Arnaldo Carvalho de Melo
380e3f23bb tools build: Only probe the compiler at parse time when it is installed
Two parse-time probes still invoke $(CC) unconditionally:

- LP64 in tools/scripts/Makefile.arch, probing with
  $(CC) -E -x c, pulled in twice by tools/perf/Makefile.perf;
- CC_NO_CLANG in tools/scripts/Makefile.include, probing with
  $(CC) -dM -E -x c /dev/null.

In the corner case where gcc is not yet installed, the very setup the
install-build-deps target, added in the next patch of this series, is
meant for, these probes make even targets that never compile parse-time
spew errors like:

    /bin/sh: 1: gcc: not found
    /bin/sh: 1: gcc: not found
    /bin/sh: 1: gcc: not found

Guard both probes with 'command -v' using the first word of CC so a
missing compiler is handled silently with the same result as a failing
probe (CC_NO_CLANG and LP64 unset/0), and with no behavior change when
the compiler is installed.

Only the first word is consulted because CC may carry arguments such as
'ccache gcc', and shell implementations differ in how 'command -v'
handles multiple words (dash only checks the first, bash any of them),
so validating the whole CC value would silently disable both probes on
some make SHELLs.

Assisted-by: opencode:deepseek-v4-flash-free
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-12 06:17:48 -07:00
Michalis Niarchos
65785fb650 perf kvm: Fix memory leak in cmd_kvm()
Set the thread private data destructor.

Signed-off-by: Michalis Niarchos <michael.niarchos@gmail.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-12 06:04:18 -07:00
Michalis Niarchos
8564e01efb perf kvm: Fix memory leak in process_sample_event()
machine__resolve() indirectly acquires a thread reference via
machine__findnew_thread(). Release it, as suggested by the documentation
of the former.

Signed-off-by: Michalis Niarchos <michael.niarchos@gmail.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-12 06:04:16 -07:00
Shaojie Sun
44f57a2b1b cgroup/cpuset: Add test for partition root invalidation returning wrong CPUs
Add a test case to REMOTE_TEST_MATRIX covering the bug fixed by
commit 345f401666 ("cgroup/cpuset: Return only actually allocated
CPUs during partition invalidation"). The test verifies that when a
sibling partition root changes its cpuset.cpus to overlap with another
partition root, only actually allocated CPUs (effective_xcpus) are
returned to the parent, not all CPUs in cpus_allowed.

Signed-off-by: Shaojie Sun <sunshaojie@kylinos.cn>
Reviewed-by: Waiman Long <longman@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-11 15:59:35 -10:00
Tejun Heo
ffaab58d21 sched_ext: Replace SCX_RQ_BAL_KEEP with a dispatch verdict return
SCX_RQ_BAL_KEEP tells the pick to keep running the previous task, a leftover
from when balancing and picking were separate operations. An rq-level flag
only works while dispatches and picks pair up one to one, which core
scheduling breaks: selections interleave through dispatch's lock drops and a
pick can consume a stale flag, keeping a task that has since been dequeued.
Fixing core scheduling support requires the decision to travel with the
dispatch that made it. Make scx_dispatch_sched() and balance_one() return an
explicit verdict instead and drop the flag's plumbing from the tools autogen
enum headers.

Also factor the pick-side invocation, its follow-up queueing and the
post-dispatch checks out of do_pick_task_scx() into dispatch_pick(). No
functional changes intended.

v2: Drop the SCX_RQ_BAL_KEEP plumbing from the tools autogen enum headers
    as well (Andrea).

Fixes: 4c95380701 ("sched/ext: Fold balance_scx() into pick_task_scx()")
Cc: stable@vger.kernel.org # v6.19+
Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-11 15:34:36 -10:00
Jakub Kicinski
878b56de01 selftests: drv-net: hide the devlink port_split test
The devlink port_split test has limited applicability.
NICs (as opposed to switches) require at least a re-probe
to apply the split configuration.

On top of that the test is not compatible with our driver env,
it just splits all ports on the system, not only what NETIF
points at.

Long term we may want to add some indication in devlink whether
the port splitting is runtime (cmode of sorts), and fix the
test to follow driver env. But since no (known) NIC driver can
support runtime anyway let's just hide the test from the selftest
framework by moving it to extra files.

Having this test randomly break unrelated NICs within the DUT
makes people implement allow-lists for ksft, which then means
their setups don't run new tests. It's very useful during test
review to see whether the test works across all the runners.

Reviewed-by: Petr Machata <petrm@nvidia.com>
Link: https://patch.msgid.link/20260811004645.1072124-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-11 18:31:19 -07:00
Marcelo Mendes Spessoto Junior
b5d24f6045 selftests: net: adopt harness for flow label mgr
The kselftest_harness.h file contains modern helpers to build tests
for kselftest. Dropping the custom test helpers in ipv6_flowlabel_mgr
in favor of the harness makes tests more legible and conforms to the
structure of the latest selftests. It also enforces the TAP standard.

Another change made to the structure of the ipv6_flowlabel_mgr test
file was the removal of parse_opts. The supported opts were already
unused: the binary is listed in TEST_GEN_FILES, and is driven solely
by ipv6_flowlabel.sh via "./ipv6_flowlabel_mgr", which never passed -l
or -v. Dropping the -l gate means the two checks it previously guarded
(each with a 13-second sleep, ~26 seconds total) are now
unconditionally enabled on every run instead of never running at all.
The TH_LOG calls and code comments now cover the information that the
removed, custom -v flag used to print.

Finally, FIXTURE_SETUP(flowlabel) ensures each test gets its own
isolated network namespace. The previously added setup() helper was
dropped to conform to the netns setup pattern used in icmp_rfc4884.c.
disable_flowlabel_consistency() was moved next to reflect_flag, the
only test that calls it, and now uses SKIP() instead of an ad hoc
[INFO] message when the sysctl cannot be disabled.

Signed-off-by: Marcelo Mendes Spessoto Junior <marcelomspessoto@gmail.com>
Link: https://patch.msgid.link/20260807220942.421382-6-marcelomspessoto@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-11 18:24:56 -07:00
Marcelo Mendes Spessoto Junior
b2690523a7 selftests: net: test IPV6_FL_F_REFLECT
According to the source code, flowlabel_consistency must be
deactivated for the IPV6_FL_F_REFLECT flag to work. Since
ipv6_flowlabel_mgr now runs in its own network namespace, do this
directly from the test binary. Attempt to disable
net.ipv6.flowlabel_consistency and skip the reflect test if that
fails. A disabled flowlabel_consistency does not affect the remaining
features being tested on the file, and failing to disable is not fatal
and skips the reflect test only.

The previously defined tcp_listen and tcp_connect helpers were reused,
since the connection flow required for REFLECT validation is very
similar to REMOTE.

Signed-off-by: Marcelo Mendes Spessoto Junior <marcelomspessoto@gmail.com>
Link: https://patch.msgid.link/20260807220942.421382-5-marcelomspessoto@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-11 18:24:56 -07:00
Marcelo Mendes Spessoto Junior
03df0d155b selftests: net: create own netns in ipv6_flowlabel_mgr
Have ipv6_flowlabel_mgr create and configure its own network
namespace (unshare(CLONE_NEWNET) + bring up lo), the same way
ipv6_fragmentation.c and icmp_rfc4884.c already do, instead of
relying on the in_netns.sh wrapper script.

The setup can then be reused across tests through fixtures and
provide isolated network environments for each test in the case
of a future adoption of kselftest_harness.

It also avoids the leak of modifications to the netns in case the
user runs the test file directly, outside the wrapper and without
the in_netns.sh file.

Signed-off-by: Marcelo Mendes Spessoto Junior <marcelomspessoto@gmail.com>
Link: https://patch.msgid.link/20260807220942.421382-4-marcelomspessoto@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-11 18:24:55 -07:00
Marcelo Mendes Spessoto Junior
39dd045c15 selftests: net: test IPV6_FL_F_REMOTE
This flag retrieves the flow label seen by the socket at connection
setup via a getsockopt query. Therefore, the validation of this flag
requires a brief connection setup (source code for flow label shows
it must be TCP).

The simple TCP connection logic was wrapped inside two simple helpers,
because there are other uncovered features of flow label mgr that
could benefit from it (such as IPV6_FL_F_REFLECT).

Signed-off-by: Marcelo Mendes Spessoto Junior <marcelomspessoto@gmail.com>
Link: https://patch.msgid.link/20260807220942.421382-3-marcelomspessoto@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-11 18:24:55 -07:00
Marcelo Mendes Spessoto Junior
bfad9937de selftests: net: test IPV6_FL_A_RENEW
RENEW was the only flow label action without selftests coverage.

Assert renew returns no error on correct usage and fails for labels
that do not exist.

This test is based on the previously implemented EXCL share test,
which demonstrates that a new flow label with the same value can be
created after the linger period. Renew is used here to show that a
flow label can last longer and block a new flow label creation after
the previous linger time. This test, however, demands sleep during
execution, and should be placed as a conditional test under the -l
option.

The addition of the expect_fail_errno helper is necessary to assert
the corresponding error when a function can fail in multiple ways.

Signed-off-by: Marcelo Mendes Spessoto Junior <marcelomspessoto@gmail.com>
Link: https://patch.msgid.link/20260807220942.421382-2-marcelomspessoto@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-11 18:24:55 -07:00
Josh Poimboeuf
51c1de1348 objtool/klp: Fix line numbers in Module.symvers parse errors
read_exports() reports the offending line number when it fails to parse
Module.symvers.  The counter is initialized to 1 but never incremented,
so every error blames line 1 regardless of where the bad line is.

Acked-by: Joe Lawrence <joe.lawrence@redhat.com>
Acked-by: Song Liu <song@kernel.org>
Link: https://patch.msgid.link/133e16bb0c7cb916f10bbfb017eba525449ad1d6.1786138493.git.jpoimboe@kernel.org
Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
2026-08-11 16:10:58 -07:00
Josh Poimboeuf
4cd3cfb8b5 objtool/klp: Fix relocations for EXPORT_SYMBOL_FOR_MODULES() symbols
EXPORT_SYMBOL_FOR_MODULES() puts a symbol in a "module:<names>"
namespace, which the module loader grants access to by matching the
importing module's name against that list.

klp_reloc_needed() only creates a klp reloc for module-owned exports; a
vmlinux export gets a normal reloc.  For a vmlinux symbol exported with
EXPORT_SYMBOL_FOR_MODULES(), using a normal reloc results in a modpost
failure in klp-build:

  ERROR: modpost: module livepatch-foo uses symbol mpol_shared_policy_lookup from namespace module:kvm, but does not import it.

And the modpost error is correct: even with that error removed, the
patch module would fail to load:

  livepatch_foo: module uses symbol (mpol_shared_policy_lookup) from namespace module:kvm, but does not import it.
  livepatch_foo: Unknown symbol mpol_shared_policy_lookup (err -22)

Treat it like an unexported symbol by using a klp reloc.

Note this only affects "module:" namespaces.  Ordinary namespaced
exports continue to work with normal relocs thanks to copy_import_ns(),
which propagates the patched object's import_ns tags to the patch
module.

Fixes: dd590d4d57 ("objtool/klp: Introduce klp diff subcommand for diffing object files")
Reported-by: Joe Lawrence <joe.lawrence@redhat.com>
Link: https://lore.kernel.org/6a6608f4-0a05-4d75-8b7f-edddfac9c5d4@redhat.com
Acked-by: Joe Lawrence <joe.lawrence@redhat.com>
Acked-by: Song Liu <song@kernel.org>
Link: https://patch.msgid.link/fe5a00818e06ec613344d41d5944de054fcd8832.1786138493.git.jpoimboe@kernel.org
Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
2026-08-11 16:10:51 -07:00
Joe Lawrence
72d76d0c18 objtool/klp: Allow new references to module exports
klp_reloc_needed() returns true for module exports to support
late-module patching.  However, clone_reloc_klp() unconditionally
rejects symbols without a twin (i.e., new references added by the
patch), even when the symbol is a known export from Module.symvers.

Relax the check: allow new references to exported symbols by only
erroring on !twin when there is no export.  The export metadata from
Module.symvers provides sufficient context to emit the klp-relocation
without a twin.

For a module export that isn't sufficient on its own though, as the
resulting klp relocation will only be resolved at patch-enable time if
the exporting module is loaded.

If the original (unpatched) module already depends on the exporting
module, the dependency is safe: the module loader ensures the dependency
is satisfied before the patched module can be loaded, so the
klp relocation target will exist.

However, if the patch introduces a reference to a module that the
original doesn't depend on, there is no such guarantee.  The exporting
module could be absent or could be unloaded at any time, leading to a
relocation failure or use-after-free.

So also add a build-time check: when a new symbol reference (no twin)
targets a module export, verify that the original module already has at
least one UNDEF symbol resolving to that same exporting module.  If not,
error out with a diagnostic message.

Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
Acked-by: Song Liu <song@kernel.org>
Acked-by: Joe Lawrence <joe.lawrence@redhat.com>
Link: https://patch.msgid.link/e0d725acb4774747f0e271308b4ca33daae2d5db.1786138493.git.jpoimboe@kernel.org
Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
2026-08-11 16:10:51 -07:00
Josh Poimboeuf
86a697572c objtool/klp: Don't match local symbols against exports
While cloning a reloc, klp diff calls find_export() to determine whether
the referenced symbol is exported.  That decides whether the reference
needs a klp reloc, which object the klp symbol belongs to, and whether
the symbol's data needs to be copied into the patch module.

But find_export() matches purely on symbol name, so a static function or
variable which happens to share its name with an export is mistaken for
a reference to that export:

  - klp_reloc_needed() creates a klp reloc pointing at the exporting
    module's symbol rather than the local one.  For a vmlinux export it
    skips the klp reloc altogether, leaving a normal reloc which the
    module loader resolves to the vmlinux symbol.

  - clone_reloc() treats the symbol as external and clones it without
    its data, leaving a dangling reference.

  - validate_special_section_klp_reloc() attributes a static branch or
    call key to the wrong module, and for a vmlinux export skips the
    unsupported-key check entirely.

Exports are always global, so ignore local symbols in find_export().

Fixes: dd590d4d57 ("objtool/klp: Introduce klp diff subcommand for diffing object files")
Acked-by: Song Liu <song@kernel.org>
Acked-by: Joe Lawrence <joe.lawrence@redhat.com>
Link: https://patch.msgid.link/dafc7c017d1f62e2190a20dc84a52fbfc4c70210.1786138493.git.jpoimboe@kernel.org
Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
2026-08-11 16:10:51 -07:00
Josh Poimboeuf
07f14d6af9 objtool/klp: Fix cross-module klp relocation section naming
A klp relocation section is .klp.rela.<objname>.<secname>, where objname
is the object being patched.

klp-build wrongly derives objname from where the referenced symbol
lives, not where it's referenced.  For a cross-module reference like
patched can_isotp code calling can.ko's can_rx_unregister(), that gives
.klp.rela.can..text rather than .klp.rela.can_isotp..text.  Unless the
patch happens to patch can.ko as well, the relocation never gets applied
and the call goes off into the weeds.

Name the intermediate section __klp_relocs.<objname> so post-link can
read the patched object's name from there.

Fixes: dd590d4d57 ("objtool/klp: Introduce klp diff subcommand for diffing object files")
Reported-by: Joe Lawrence <joe.lawrence@redhat.com>
Link: https://lore.kernel.org/20260720145658.1103243-2-joe.lawrence@redhat.com
Acked-by: Song Liu <song@kernel.org>
Acked-by: Joe Lawrence <joe.lawrence@redhat.com>
Link: https://patch.msgid.link/ee93a08f3e55e76ffa67d04e283917ddaa893f09.1786138493.git.jpoimboe@kernel.org
Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
2026-08-11 16:10:51 -07:00
Josh Poimboeuf
69f361b8a7 objtool/klp: Explicitly disallow patching or referencing init code/data
Explicitly disallow the patching and referencing of init code/data.
Otherwise it could potentially introduce some odd edge cases depending
on whether the target object's init section has been freed yet (note
that the init code still exists in the target module when doing late
module patching).

Such edge cases include sympos calculation and the patching and/or
referencing of non-existent (init-freed) code/data.  Not to mention the
inherent differences in behavior that occur when the init code is only
patched *some* of the time depending on module loading order or kernel
config.

Acked-by: Joe Lawrence <joe.lawrence@redhat.com>
Acked-by: Song Liu <song@kernel.org>
Link: https://patch.msgid.link/516e14f84cfbffa27dc19d3dcf35097504097966.1786138493.git.jpoimboe@kernel.org
Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
2026-08-11 16:10:38 -07:00
Josh Poimboeuf
636f230ce2 objtool/klp: Ignore replacement offset of empty x86 alternatives
An x86 alternative with an empty replacement, e.g. the second entry of

  ALTERNATIVE_2("orig", "repl", ft1, "", ft2)

has a replacementlen of zero.  Its replacement offset still gets a
relocation, but the label it points at is the end of the previous
replacement, which is also the beginning of the *next* alternative's
replacement.  The value is meaningless; get_alt_entry() already ignores
it for that reason.

klp diff doesn't ignore it.  When such an alternative belongs to a
changed function, cloning its relocations drags in the unrelated
neighboring replacement, along with everything that replacement
references.  On an x86 clang/lto build an empty alternative in
meminfo_proc_show() pulled in the replacement of an alternative in
proc_kcore_init(), silently emitting a klp relocation against init text
which has long since been freed by the time the patch is applied.

Add arch_alt_ignore_new_reloc() and skip such relocations when cloning.
This has to be arch specific: on arm64 a zero-length replacement instead
identifies an alternative callback, whose replacement offset points at
the callback function and must be preserved.

Fixes: dd590d4d57 ("objtool/klp: Introduce klp diff subcommand for diffing object files")
Acked-by: Song Liu <song@kernel.org>
Acked-by: Joe Lawrence <joe.lawrence@redhat.com>
Link: https://patch.msgid.link/7a885b70974795c3417f3358869e62aafd4ef783.1786138493.git.jpoimboe@kernel.org
Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
2026-08-11 15:04:57 -07:00
Josh Poimboeuf
1ea786097c objtool/klp: Fix size of empty special section entries
create_fake_symbols() sizes each ANNOTATE_DATA_SPECIAL entry from the
offset of the next annotation, falling back to the end of the section
for the last entry.  But the last entry is detected by a zero size,
which also happens for an *empty* entry: ALTERNATIVE(oldinstr, "", ft)
still annotates its zero-length replacement, at the same offset as the
next entry's annotation.

So every empty replacement gets a fake symbol spanning the entire rest
of .altinstr_replacement.  That's harmless today only because
find_symbol_containing() picks the smaller of two overlapping symbols.

Track whether a next annotation was found rather than inferring it from
the size.  A zero-length fake symbol is fine: find_symbol_containing()
skips those, so the properly sized symbol at the same offset still wins.

Fixes: dd590d4d57 ("objtool/klp: Introduce klp diff subcommand for diffing object files")
Acked-by: Song Liu <song@kernel.org>
Acked-by: Joe Lawrence <joe.lawrence@redhat.com>
Link: https://patch.msgid.link/913e691c5009397df832c7c9a18cd5cf71b42737.1786138493.git.jpoimboe@kernel.org
Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
2026-08-11 15:04:57 -07:00
Josh Poimboeuf
3a83d9cd3d objtool/klp: Fix vmlinux .klp.symid link error for .no_trim_symbol symbols
Testing klp-build with arm64 produced the following linker error during
the original kernel build:

  `__notrim.1' referenced in section `.klp.symid' of vmlinux.o: defined in discarded section `.no_trim_symbol' of vmlinux.o

symbol_get() puts a static __notrim[] in .no_trim_symbol, which GCC
names __notrim.1, __notrim.2, etc.  Two or more built-in translation
units calling symbol_get() thus produce duplicate names, resulting in
corresponding .klp.symid references which trigger the above error.

Add .no_trim_symbol to the discarded section list so its symbols don't
get symids.

Note this issue is not specific to arm64: it just needs two built-in
symbol_get() callers.  arm64 trips over it easily because it has KVM
always compiled in vmlinux, whereas on x86 it's typically a module.

Fixes: 029223d301 ("objtool/klp: Add .klp.symid for sympos disambiguation")
Acked-by: Song Liu <song@kernel.org>
Acked-by: Joe Lawrence <joe.lawrence@redhat.com>
Link: https://patch.msgid.link/5a3cc4cded743167dd0878220201d80f7e48e5d7.1786138493.git.jpoimboe@kernel.org
Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
2026-08-11 15:04:57 -07:00
Ning Ding
81f209d5f7 selftests/bpf: Test RCU iterator state pruning
Add a path where RCU protection reaches zero and then starts again.
The iterator is untrusted after this gap and must be rejected.

Signed-off-by: Ning Ding <dingning04@gmail.com>
Link: https://patch.msgid.link/20260811035955.132989-3-dingning04@gmail.com
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-08-11 14:57:00 -07:00
Randy Dunlap
0c56db4610 doc tools: fix 'path' typos
Correct "patch" or "patches" to "path" or "paths" in comments.

Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20260806055634.1293294-1-rdunlap@infradead.org>
2026-08-11 10:43:16 -06:00
Alison Schofield
47646ce123 docs: python: abi_regex: convert adjacent index placeholders
While validating recent CXL ABI documentation updates with
get_abi.py, every decoderX.Y entry was reported as undocumented.

The placeholder conversion mishandles adjacent index placeholders,
producing patterns that cannot match the corresponding sysfs paths.
As a result, valid ABI entries are reported as undocumented.

Handle adjacent placeholders independently so generated patterns match
the documented paths. This fixes decoderX.Y entries in the CXL ABI and
other ABI documentation that uses the same naming convention.

Signed-off-by: Alison Schofield <alison.schofield@intel.com>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <cc893dca3aaa3ec833ba70d1f32c3e7342b7faf2.1786139549.git.alison.schofield@intel.com>
2026-08-11 10:36:28 -06:00
Alison Schofield
02299dcd20 docs: python: abi_regex: catch the right exception for a bad regex
While validating recent CXL ABI documentation updates with
get_abi.py, the 'undefined' mode was found to abort instead of
reporting undocumented ABI entries.

Older Python releases raise re.error, while newer releases expose
re.PatternError. Catching the compatible re.error exception handles
both cases.

Use re.error so the scan continues and reports the remaining
results.

Signed-off-by: Alison Schofield <alison.schofield@intel.com>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <9f6fa7a9aa6ba9a26b484b911976713356b3fd44.1786139549.git.alison.schofield@intel.com>
2026-08-11 10:36:28 -06:00
Thomas Weißschuh (Schneider Electric)
4fa377c19e selftests: timers: nsleep-lat: Check all calls to clock_nanosleep() and clock_gettime()
Both these functions can fail.

The first calls to those functions are already checked and result in
KSFT_SKIP.

If they start failing afterwards unexpectedly, report a hard error.

Signed-off-by: Thomas Weißschuh (Schneider Electric) <thomas.weissschuh@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Acked-by: John Stultz <jstultz@google.com>
Link: https://patch.msgid.link/20260803-auxclock-nanosleep-prep-v2-17-910cbd485390@linutronix.de
2026-08-11 18:11:21 +02:00
Thomas Weißschuh (Schneider Electric)
0f474ee80c selftests: timers: nsleep-lat: Reuse kselftest error numbers
The test currently defines its own custom error numbers.
These mirror the semantics from the standard KFST_* constants.

To make the code easier to read, use the standard result constants.

Signed-off-by: Thomas Weißschuh (Schneider Electric) <thomas.weissschuh@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Acked-by: John Stultz <jstultz@google.com>
Link: https://patch.msgid.link/20260803-auxclock-nanosleep-prep-v2-16-910cbd485390@linutronix.de
2026-08-11 18:11:21 +02:00
Thomas Weißschuh (Schneider Electric)
187ac443ed selftests: timers: nsleep-lat: Explicitly list the tested clocks
The test relies on the numeric values of the clockids.
As not all clocks are meant to be tested, this requires skipping some
clocks unconditionally, cluttering the result.

Use an equivalent, explicit list instead.

In addition to CLOCK_PROCESS_CPUTIME_ID, CLOCK_THREAD_CPUTIME_ID and
CLOCK_HWSPECIFIC which were unconditionally skipped before, this also
unconditionally skips CLOCK_MONOTONIC_RAW, CLOCK_MONOTONIC_COARSE and
CLOCK_REALTIME_COARSE. clock_nanosleep() is not supported for those.

Signed-off-by: Thomas Weißschuh (Schneider Electric) <thomas.weissschuh@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Acked-by: John Stultz <jstultz@google.com>
Link: https://patch.msgid.link/20260803-auxclock-nanosleep-prep-v2-15-910cbd485390@linutronix.de
2026-08-11 18:11:21 +02:00
Thomas Weißschuh (Schneider Electric)
a00f90877d selftests: timers: nsleep-lat: Use NSEC_PER_MSEC define for unreasonable latency
Use the predefined symbol to make the code easier to understand.

Signed-off-by: Thomas Weißschuh (Schneider Electric) <thomas.weissschuh@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Acked-by: John Stultz <jstultz@google.com>
Link: https://patch.msgid.link/20260803-auxclock-nanosleep-prep-v2-14-910cbd485390@linutronix.de
2026-08-11 18:11:21 +02:00
Thomas Weißschuh (Schneider Electric)
a121128823 selftests: timers: nanosleep: Report each test separately
Currently the test for the sleep functionality itself and the one for
the remaining time are reported together. This makes the test output a
bit confusing, especially as the upcoming tests for auxiliary clocks
will have different results between the two parts.

Report each test part on its own.

This also allows continuing testing other clocks after a single one
has failed.

Signed-off-by: Thomas Weißschuh (Schneider Electric) <thomas.weissschuh@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260803-auxclock-nanosleep-prep-v2-13-910cbd485390@linutronix.de
2026-08-11 18:11:21 +02:00
Thomas Weißschuh (Schneider Electric)
f2ff28a522 selftests: timers: nanosleep: Explicitly handle timer_delete() failure
An upcoming patch will remove the early exit on failure of a single
testcase. If a test fails because a timeout timer could not be deleted,
then that timeout timer might interfere with the following tettcases.

Exit the whole test case with a clear error message in this case.

Other failures are not problematic:
* If timer_settime() fails, a harmless unarmed timer is left around.
* The SIGALRM handler reconfigured for each call to
  nanosleep_test_remaining() anyways.

Signed-off-by: Thomas Weißschuh (Schneider Electric) <thomas.weissschuh@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260803-auxclock-nanosleep-prep-v2-12-910cbd485390@linutronix.de
2026-08-11 18:11:21 +02:00
Thomas Weißschuh (Schneider Electric)
061341a568 selftests: timers: nanosleep: Move all single clock tests out of the loop in main()
Make the code easier to read by avoiding a goto.

Signed-off-by: Thomas Weißschuh (Schneider Electric) <thomas.weissschuh@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Acked-by: John Stultz <jstultz@google.com>
Link: https://patch.msgid.link/20260803-auxclock-nanosleep-prep-v2-11-910cbd485390@linutronix.de
2026-08-11 18:11:20 +02:00
Thomas Weißschuh (Schneider Electric)
bfe5bf0c5f selftests: timers: nanosleep: Reuse kselftest error numbers
The test currently defines its own custom error numbers.
These mirror the semantics from the standard KFST_* constants.

To make the code easier to read, use the standard result constants.

Signed-off-by: Thomas Weißschuh (Schneider Electric) <thomas.weissschuh@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Acked-by: John Stultz <jstultz@google.com>
Link: https://patch.msgid.link/20260803-auxclock-nanosleep-prep-v2-10-910cbd485390@linutronix.de
2026-08-11 18:11:20 +02:00
Thomas Weißschuh (Schneider Electric)
2999620932 selftests: timers: nanosleep: Explicitly list the tested clocks
The test relies on the numeric values of the clockids.
As not all clocks are meant to be tested, this requires skipping some
clocks unconditionally, cluttering the result.

Use an equivalent, explicit list instead.

In addition to CLOCK_PROCESS_CPUTIME_ID, CLOCK_THREAD_CPUTIME_ID and
CLOCK_HWSPECIFIC which were unconditionally skipped before, this also
unconditionally skips CLOCK_MONOTONIC_RAW, CLOCK_MONOTONIC_COARSE and
CLOCK_REALTIME_COARSE. clock_nanosleep() is not supported for those.

Signed-off-by: Thomas Weißschuh (Schneider Electric) <thomas.weissschuh@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Acked-by: John Stultz <jstultz@google.com>
Link: https://patch.msgid.link/20260803-auxclock-nanosleep-prep-v2-9-910cbd485390@linutronix.de
2026-08-11 18:11:20 +02:00
Thomas Weißschuh (Schneider Electric)
142a2d312e selftests: timers: nanosleep: Drop output alignment
The padding of the clock name is pointless as nothing else is printed.

Signed-off-by: Thomas Weißschuh (Schneider Electric) <thomas.weissschuh@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260803-auxclock-nanosleep-prep-v2-8-910cbd485390@linutronix.de
2026-08-11 18:11:20 +02:00
Thomas Weißschuh (Schneider Electric)
54200b8748 selftests: timers: Use clock_name() and constants from clock-helpers.h
Replace the many repetitions of custom clockid_t to string translation
with the clock_name() helper from clock-helpers.h.
Also drop the custom ?SEC_PER_?SEC definitions.

Signed-off-by: Thomas Weißschuh (Schneider Electric) <thomas.weissschuh@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Acked-by: John Stultz <jstultz@google.com>
Link: https://patch.msgid.link/20260803-auxclock-nanosleep-prep-v2-7-910cbd485390@linutronix.de
2026-08-11 18:11:20 +02:00
Thomas Weißschuh (Schneider Electric)
431012dd0a selftests: Add clock-helpers.h
Multiple selftests duplicate various clock-related functionality.
Add a new header to collect and deduplicate those.

Signed-off-by: Thomas Weißschuh (Schneider Electric) <thomas.weissschuh@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Acked-by: John Stultz <jstultz@google.com>
Link: https://patch.msgid.link/20260803-auxclock-nanosleep-prep-v2-6-910cbd485390@linutronix.de
2026-08-11 18:11:20 +02:00
Randy Dunlap
22a42ee5da docs: sphinx-build-wrapper: include localversion in kernel version string
Add any localversion* text to the kernel version string
so that the docs index (home) page accurately indicates what
the docs build version is.

E.g.:
  7.2.0-rc6-next-20260807

Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20260808045331.326769-1-rdunlap@infradead.org>
2026-08-11 09:44:20 -06:00
Linus Torvalds
f5bbbfec59 Probes fixes for v7.2-rc7:
- selftests/ftrace: Convert ELF entry point to file offset in uprobe test
   Convert the ELF entry point address (e_entry) to a file offset using LOAD
   segment headers in add_remove_uprobe test. This fixes uprobe registration
   failures (-EINVAL) on non-PIE executables where vaddr exceeds file size.
 -----BEGIN PGP SIGNATURE-----
 
 iQFPBAABCgA5FiEEh7BulGwFlgAOi5DV2/sHvwUrPxsFAmp63LIbHG1hc2FtaS5o
 aXJhbWF0c3VAZ21haWwuY29tAAoJENv7B78FKz8bDDMIAKEY/q+W2mOy44zPVbVD
 Sbs9j4GvoprWTkJcAv2eXfA43264xoc9wn+49LzQLEaT8Jgw7gpWyIi3/2A4pPR9
 aQjZGZmHwjeJ3ewq/2fEdNfA3VKJjMgg/6c5H7inVIc+YDF1m2eSI8svFDEn2qDR
 xJHqF6c350ZGFi04ejB2AefW8JX2KGbIdqiCNlvhJzjDgRLBNR5cfblUX/JST6QT
 H4ZddjX3YDcbcX50KR6Z7Y+Y+og1vwZ8XJ2N6gLCPI8owwm4NgJ5IdewLbpTI7wX
 Yon66cDtbKBJoT0SA1DFnho58iKLKZx1MCz09z9Gg2FBsRhg0hKHe5RhJq40VQYb
 1+k=
 =4dpN
 -----END PGP SIGNATURE-----

Merge tag 'probes-fixes-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Pull probes fix from Masami Hiramatsu:

 - Convert ELF entry point to file offset in uprobe test

   Convert the ELF entry point address (e_entry) to a file offset using
   LOAD segment headers in add_remove_uprobe test. This fixes uprobe
   registration failures (-EINVAL) on non-PIE executables where vaddr
   exceeds file size.

* tag 'probes-fixes-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  selftests/ftrace: Convert ELF entry point to file offset in uprobe test
2026-08-11 06:51:46 -07:00
Chuck Lever
8a42229739 selftests: tls: cover splice after a failed decrypt
Nothing in this file splices a socket whose last decrypt failed, so
the check that fails tls_sw_splice_read() on a broken connection can
be removed without a test noticing. Such a splice hands the
application plaintext that recvmsg() and read_sock() already refuse
to return.

Extend the bad_auth pattern. Corrupt an authenticated record, confirm
recvmsg() reports EBADMSG, then splice the same socket and require
EBADMSG again. A synchronous decrypt fails again on the still-queued
record, so only an async decrypt reaches EBADMSG through the
recorded-failure check alone.

bad_auth builds the same corrupted record, so its construction moves
into a helper the two tests share.

Signed-off-by: Chuck Lever <cel@kernel.org>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Link: https://patch.msgid.link/20260806-tls-splice-crypto-fix-v1-2-a2624005a286@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-11 15:39:00 +02:00
Feng Tang
88b8d85e88 selftests: net: reuseport_bpf_numa: consider cpuless numa node
reuseport_bpf_numa case failed when testing on a platform with CXL
memory:

    #./reuseport_bpf_numa
    ---- IPv4 UDP ----
    send node 0, receive socket 0
    ./reuseport_bpf_numa: failed to pin to node: Invalid argument

The root cause is that the platform has 2 numa nodes: node 0 has
both cpu and memory, while node 1 is a CXL node which only has
memory, and caused numa_run_on_node() to fail.

Add sanity check to skip cpuless numa node for the numa binding test.

Signed-off-by: Feng Tang <feng.tang@linux.alibaba.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260807002436.43991-1-feng.tang@linux.alibaba.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-11 10:54:15 +02:00
Ingo Molnar
6e70aef598 objtool/headers: Sync tools/include/linux/objtool_types.h with include/linux/objtool_types.h
Sync up the kernel and tooling headers to fix this build warning:

  Warning: Kernel ABI header at 'tools/include/linux/objtool_types.h' differs from latest version at 'include/linux/objtool_types.h'

Fixes: 6e5716b187 ("objtool: Replace __ASSEMBLY__ with __ASSEMBLER__ in header files")
Cc: Thomas Huth <thuth@redhat.com>
Cc: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2026-08-11 10:44:38 +02:00
Thaison Phan
153f709c86 tools: ynl: check alloc fails in generated getter code
Generated YNL getter code does not check the return value of malloc() and
calloc() before passing the resulting pointer to memcpy(). This could lead
to a NULL pointer dereference on memory allocation failure.

Updated the C code generator to check for allocation failures and to return
an error code in getters.

Signed-off-by: Thaison Phan <thaisonphan@google.com>
Link: https://patch.msgid.link/20260807171500.7188-3-thaisonphan@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-10 18:23:11 -07:00
Thaison Phan
7c62c481bb tools: ynl: check for null ptr on dump free
Static analysis detected code paths where freeing a dump list after early
errors when creating the corresponding dump list like in ynl_exec_dump()
can result in a null pointer dereference since the first node in the
ynl_dump_state would still be zero initialized. To prevent this potential
problem updated the ynl c generation script to check for a NULL pointer
before continuing to free the nodes in a dump list.

Signed-off-by: Thaison Phan <thaisonphan@google.com>
Link: https://patch.msgid.link/20260807171500.7188-2-thaisonphan@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-10 18:23:11 -07:00
Andrey Grodzovsky
88b3e7fedc selftests/livepatch: update test-ftrace.sh for deprecated ftrace_enabled
kernel.ftrace_enabled=0 is now refused on kernels that deprecate the
knob, so the old disable/reload flow no longer applies there. Probe
for this with ftrace_disable_supported() and keep the full original
scenario (disable, fail to load a livepatch, re-enable, load, confirm
disable is refused while loaded) on kernels where it still works;
otherwise just confirm the write is refused.

Link: https://patch.msgid.link/20260806153000.4184871-3-andrey.grodzovsky@crowdstrike.com
Suggested-by: Steven Rostedt <rostedt@goodmis.org>
Suggested-by: Joe Lawrence <joe.lawrence@redhat.com>
Assisted-by: Claude:claude-sonnet-5
Signed-off-by: Andrey Grodzovsky <andrey.grodzovsky@crowdstrike.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2026-08-10 21:21:18 -04:00
Jakub Kicinski
30dbc21f63 selftests: bonding: disable DAD for IPv6 addresses
bond_reset() waits up to 2 seconds for IPv6 connectivity.
With default settings DAD itself may take almost 2 seconds,
causing flakes on debug builds. It used to flake once or
twice a week, recently it started failing once a day.
Probably some downstream changes to scheduler, or our machines
go busier.

A lot of selftests already use nodad, let's use nodad in bonding, too.
I don't see an obvious reason why DAD would be important to the test.

Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>
Link: https://patch.msgid.link/20260808162345.2442594-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-10 18:14:01 -07:00
Willem de Bruijn
ef3d6cca02 selftests: drv-net: so_txtime: only send test traffic to sch_etf
The ETF qdiscs drops traffic without a socket or txtime. Even with
parameter skip_sock_check regular traffic is affected by ETF.

This test ran fine when run manually in a pure software environment.
But with drv-net across two hosts tests fail as early as when calling
cfg.remote.deploy due to effectively losing connectivity.

Isolate the intended test traffic:
- mark that with SO_MARK 100
- install a regular permissive root prio qdisc for background traffic
- install the ETF qdisc as leaf
- install a filter that only directs SO_MARK 100 traffic to this leaf

Technically other high prio traffic will map onto this leaf based on
ToS band mapping too. But that is immaterial in practice.

Fixes: 5c6baef388 ("selftests: drv-net: convert so_txtime to drv-net")
Signed-off-by: Willem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/20260808160129.890119-1-willemdebruijn.kernel@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-10 17:47:18 -07:00
Jakub Kicinski
855631afe0 selftests: drv-net: let ethtool stats settle before reading
Some devices refresh the statistics exposed via ethtool only
periodically, every stats-block-usecs (as reported by ethtool -c).
ethtool_std_stats and ethtool_rmon sample the counters immediately
after generating traffic, so on such devices they can read stale
values and fail with a delta short of the packets just sent.

Add a hw_stats_settle() helper which sleeps for 1.25x the configured
stats-block-usecs (defaulting to 20ms when the device reports no, or
a zero, period). Use it for ethtool std stats and RMON.
The 1.25x/20msec heuristic matches what the Python tests do.

Reviewed-by: Petr Machata <petrm@nvidia.com>
Link: https://patch.msgid.link/20260808163653.2460381-2-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-10 16:47:49 -07:00
Jakub Kicinski
f4cf605687 selftests: drv-net: pace ethtool_std_stats packet generation
mausezahn defaults to sending packets back to back at the maximum rate,
which can cause packet loss, especially if receiver is running a debug
kernel. Space the generated packets out (-d 10usec), like ethtool_rmon
already does.

Reviewed-by: Petr Machata <petrm@nvidia.com>
Link: https://patch.msgid.link/20260808163653.2460381-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-10 16:47:38 -07:00
Jakub Kicinski
4d2cbd620a selftests: netdevsim: fix SIGPIPE flake in ethtool-coalesce
The adaptive-rx and adaptive-tx checks use 'ethtool -c | grep -q' under
'set -o pipefail'. grep -q exits as soon as it finds a match, which can
happen before ethtool finishes writing its output. When that occurs,
ethtool receives SIGPIPE causing (uninformative):

 # selftests: drivers/net/netdevsim: ethtool-coalesce.sh
 # FAILED 1/22 checks
 not ok 1 selftests: drivers/net/netdevsim: ethtool-coalesce.sh # exit=1

This happens on debug kernels in NIPA, ~4% of the time.

Link: https://patch.msgid.link/20260808163416.2456810-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-10 16:46:14 -07:00
Hyunjung Ko
f1b3416cea selftests: tc-testing: add act_ct test for malformed header handling
Add a tdc case covering the leak fixed by the previous patch.

The test attaches "action ct" to a clsact ingress chain and injects ten
IPv6 frames whose nexthdr says hop-by-hop but which carry nothing after
the 40-byte header, so ipv6_find_hdr() fails and
tcf_ct_ipv6_is_fragment() returns -EPROTO.

Before the fix act_ct returned TC_ACT_CONSUMED for these packets, so
tc_run() never reached its TC_ACT_SHOT arm and the clsact drop counter
stayed at zero while the skbs leaked. After the fix the packets are
dropped properly and the counter reflects them, which is what the test
matches on:

  before:  Sent 476 bytes 11 pkt (dropped 0, overlimits 0 requeues 0)
  after:   Sent 400 bytes 10 pkt (dropped 10, overlimits 0 requeues 0)

Signed-off-by: Hyunjung Ko <hj351016@gmail.com>
Reviewed-by: Victor Nogueira <victor@mojatatu.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/20260806101235.809370-2-hj351016@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-10 16:37:07 -07:00
Tejun Heo
872a8f6b08 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next into for-7.3-arena-args
Pull bpf-next d114bb9893 ("Merge branch
'add-arena-argument-support-to-kfuncs-and-struct_ops'") to make the __arena
and __arena__nullable kfunc and struct_ops argument suffixes available. The
suffixed arguments will be used to convert sched_ext kfuncs and struct_ops
callbacks that currently pass arena pointers as scalars and rebase them by
hand.
2026-08-10 12:38:03 -10:00
Brian Grech
2373107782 selftests/net: fin_ack_lat: fix latency threshold typo
The commit message for af8c8a450b ("selftests: net: Add FIN_ACK
processing order related latency spike test") states: "if the latency
is larger than 1 second (spike), print a message". However the code
uses a threshold of 100000 us (100 ms), not 1000000 us (1 s).

The lower threshold causes false positives on slower hardware where
normal connection latency occasionally exceeds 100 ms but never
approaches the 1 s spike that indicates the actual FIN/ACK race bug.

Fix the threshold to match the documented intent.

Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Brian Grech <bgrech@redhat.com>
Link: https://patch.msgid.link/20260806151645.4172900-1-bgrech@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-10 15:22:44 -07:00
Breno Leitao
f784d9ce8d workqueue: allocate attrs for all workqueues
The attrs are where the affinity scope lives, and a per-cpu workqueue
will need one once per-cpu becomes a scope rather than a separate
backend. Allocate them unconditionally.

wq_dump.py used a non-NULL wq->attrs as its test for an unbound
workqueue, which no longer holds; test WQ_UNBOUND there instead.

Signed-off-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-10 11:47:20 -10:00
Breno Leitao
464e454e1c workqueue: rename wq->unbound_attrs to wq->attrs
The unbound prefix says which workqueues currently have the field rather
than what it holds, and the next patch allocates it for every workqueue.
Rename it first so that change stays a single line.

tools/workqueue/wq_dump.py reads the field by name, so rename it there
too.

wq_sysfs_unbound_attrs[] keeps its name: it is the set of sysfs files
that only unbound workqueues expose.

No functional change.

Signed-off-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-10 11:47:20 -10:00
Liang Luo
4dc310b41a selftests/sched_ext: Check skeleton open failure in exit test
exit.c does not check the return value of exit__open(). If it returns
NULL, which happens when the skeleton wrapper fails to allocate the
object or open the BPF ELF, the very next line dereferences it via
SCX_ENUM_INIT(). That macro expands to SCX_ENUM_SET(), which accesses
skel->rodata, causing a NULL pointer dereference.

Every other selftest guards this with SCX_FAIL_IF(!skel, ...); exit.c
is the only one missing it.

Fixes: a5db7817af ("sched_ext: Add selftests")
Signed-off-by: Liang Luo <luoliang@kylinos.cn>
Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-10 09:39:35 -10:00
Rui Qi
75e79a2019 selftests/cgroup: Avoid awk -e in cpuset tests
The cpuset selftests use awk -e to parse cgroup mount points. This
works with gawk, but mawk rejects the option. In test_cpuset_prs.sh,
this leaves CGROUP2 empty and causes the test to skip as if cgroup v2
were not mounted. The same non-portable invocation exists in the cpuset
v1 hotplug test.

The scripts only need to pass a single awk program. Use the standard awk
invocation without -e so mount point detection works with awk
implementations that do not support the gawk extension.

Fixes: a8c52eba88 ("kselftest/cgroup: Add cpuset v2 partition root state test")
Fixes: 812c5945bd ("cgroup/cpuset: Add test_cpuset_v1_hp.sh")
Signed-off-by: Rui Qi <qirui.001@bytedance.com>
Acked-by: Waiman Long <longman@redhat.com>
Reviewed-by: Ridong Chen <ridong.chen@linux.dev>
Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-10 09:28:03 -10:00
Josh Hilke
28ca5f67e1 vfio: selftests: Retry on EAGAIN during device reset
Add retry logic to vfio_pci_device_reset() to handle the case where PCI
resets fail due to lock contention, in which case
pci_try_reset_function() returns -EAGAIN.

Suggested-by: David Matlack <dmatlack@google.com>
Signed-off-by: Josh Hilke <jrhilke@google.com>
Acked-by: David Matlack <dmatlack@google.com>
Link: https://lore.kernel.org/r/20260805-igb_v3_b4-v10-3-9c86dc849c0d@google.com
Signed-off-by: Alex Williamson <alex@shazbot.org>
2026-08-10 13:24:40 -06:00
Josh Hilke
1583ef1175 vfio: selftests: igb: Add driver for Intel 82576 device
Add a VFIO selftest driver for the Intel Gigabit Ethernet controller
(IGB), specifically targeting the 82576 device. IGB is fully virtualized
in QEMU which makes it easy to run VFIO selftests without needing any
specific hardware.

Since IGB is an Ethernet device, it cannot support DMA transfers smaller
than the minimum Ethernet payload size (60 bytes) without hardware padding
corrupting adjacent memory. The driver asserts that the transfer size is
at least 60 bytes to prevent this.

All VFIO selftest drivers must implement DMA/memcpy operations, but IGB
doesn't have a native memcpy feature, so the loopback feature (described
in section 3.5.6.3 of IGB specification) is used to implement it. To
support testing on both QEMU and physical hardware, the driver uses PHY
internal loopback with some QEMU-specific fallbacks. The driver also
supports MSI-X routing and interrupt management, and disables PCIe
completion timeout retries to ensure clean recovery during invalid-DMA
tests.

Users can verify the driver works in QEMU by building the kernel,
building VFIO selftests, and then running the vfio_pci_driver_test using
this command:

vng \
--run arch/x86/boot/bzImage \
--user root \
--disable-microvm \
--memory 32G \
--cpus 8 \
--qemu-opts="-M q35,accel=kvm,kernel-irqchip=split" \
--qemu-opts="-device intel-iommu,intremap=on,caching-mode=on,device-iotlb=on" \
--qemu-opts="-netdev user,id=net0 -device igb,netdev=net0,addr=09.0" \
--append "console=ttyS0 earlyprintk=ttyS0 intel_iommu=on iommu=pt" \
--exec "modprobe vfio-pci && \
  ./tools/testing/selftests/vfio/scripts/setup.sh 0000:00:09.0 && \
  ./tools/testing/selftests/vfio/scripts/run.sh ./tools/testing/selftests/vfio/vfio_pci_driver_test"

Assisted-by: Claude:claude-opus-4-7
Assisted-by: Gemini:gemini-3.1-pro-preview
Co-developed-by: Alex Williamson <alex.williamson@nvidia.com>
Signed-off-by: Alex Williamson <alex.williamson@nvidia.com>
Signed-off-by: Josh Hilke <jrhilke@google.com>
Acked-by: David Matlack <dmatlack@google.com>
Link: https://lore.kernel.org/r/20260805-igb_v3_b4-v10-2-9c86dc849c0d@google.com
Signed-off-by: Alex Williamson <alex@shazbot.org>
2026-08-10 13:24:40 -06:00
Alex Williamson
aabaf84560 vfio: selftests: Add helpers to re-enable interrupts
Selftest drivers that recover from a fault by issuing VFIO_DEVICE_RESET
need to re-arm device interrupts afterwards.  VFIO_DEVICE_RESET tears
down the kernel-side IRQ trigger so a subsequent VFIO_DEVICE_SET_IRQS
is required, but the user-side eventfds (and any fd cached in a test
fixture) are still valid and must be preserved.

vfio_pci_irq_enable() refuses to be called for vectors that already
have an eventfd (VFIO_ASSERT_LT), and vfio_pci_irq_disable() closes
all eventfds before resetting the trigger, so neither is suitable.

Add vfio_pci_irq_reenable(device, index, vector, count) which asserts
that the requested range has existing eventfds and re-issues
VFIO_DEVICE_SET_IRQS using them.  Signature mirrors vfio_pci_irq_enable().

Add vfio_pci_msi{,x}_reenable() wrappers around vfio_pci_irq_reenable()
for additional ease of use and readability.

Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Alex Williamson <alex.williamson@nvidia.com>
Reviewed-by: David Matlack <dmatlack@google.com>
Acked-by: David Matlack <dmatlack@google.com>
Link: https://lore.kernel.org/r/20260805-igb_v3_b4-v10-1-9c86dc849c0d@google.com
Signed-off-by: Alex Williamson <alex@shazbot.org>
2026-08-10 13:24:40 -06:00
Qingshuang Fu
736fb86322 selftests: netfilter: conntrack_dump_flush: remove unused variables and fix typo
Remove unused 'rplnlh' in conntrack_data_insert(), and remove unused
'rplnlh' and 'nest' variables in conntrack_count_zone() and
conntrack_flush_zone(). These variables were declared but never used
since their introduction.

Also fix typo: rename misspelled conntracK_count_zone() to
conntrack_count_zone().

Signed-off-by: Qingshuang Fu <fuqingshuang@kylinos.cn>
Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>
Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2026-08-10 21:20:44 +02:00
Sean Christopherson
4fe8b4e154 KVM: selftests: Create one VM with many vCPUs for each major PMU counters test
To reduce the runtime of the PMU counters test by an order of magnitude,
create one VM per category of test (arch events, GP PMCs, fixed PMCs),
with N vCPUs per VM, where 'N' is the number of testscases to run per
category.  The vast majority of the test's runtime is spent creating VMs,
because while creating a VM only takes a few milliseconds, the total time
adds up when creating hundreds of VMs.  The only reason the test creates
so many VMs is because KVM disallows changing the virtual PMU model after
a vCPU runs, so rather than create an entirely new VM just to get a "fresh"
vCPUs, simply use a different vCPU.

On an Emerald Rapids host, this reduces the runtime from 75+ seconds to
less than 6 seconds.

Opportunistically fix a typo in the comment about unavailable_masks pointed
out by Like Xu[1].

Link: https://lore.kernel.org/all/20260625090155.6326-1-likexu@tencent.com[1]
Link: https://patch.msgid.link/20260804210046.3413149-3-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-08-10 08:04:13 -07:00
Chuck Lever
1663ea5b24 xdrgen: Reject out-of-range program, version, and procedure numbers
RFC 5531 assigns only unsigned constants to program, version, and
procedure numbers (Section 12.3) and encodes each as an unsigned
32-bit integer (Section 9), so a valid number falls within
[0, 2**32 - 1]. RFC 4506 Section 6.2 permits a signed decimal constant
for XDR constants in general and sets no ceiling on magnitude, so the
grammar accepts an out-of-range value without complaint. It reaches
generated code -- a negative procedure number emerges as an enumerator
such as "FOO = -5", valid C that compiles cleanly even though the wire
field is an unsigned 32-bit integer. Thus the xdrgen front end is the
only place that can reject the malformed value.

Extend the semantic checks to require each program, version, and
procedure number to fall within [0, 2**32 - 1].

Link: https://patch.msgid.link/20260712203451.124902-6-cel@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
2026-08-10 09:54:35 -04:00
Chuck Lever
69b89515b1 xdrgen: Enforce RFC 5531 name and number scoping for RPC programs
The duplicate-identifier check enforces the RFC 4506 name space
for XDR type and constant identifiers but ignores what an RPC
program definition adds. RFC 5531 Section 12.3 completes the
model: a program identifier shares the specification-wide name
space with constant and type identifiers, a version name and
number are unique within their program, and a procedure name and
number are unique within their version.

xdrgen currently accepts a specification that breaks any of these
rules, and the symptom depends on which rule. A duplicate procedure
name reaches the generated header as a redeclared enumerator,
which the C compiler rejects. A duplicate procedure number is
more dangerous because it is silent: the two procedures emit
enumerators of equal value -- valid C that compiles cleanly --
leaving a dispatch collision to surface only at run time. A
duplicate program name shares the specification-wide name space
with constants and types and is caught alongside them.

Extend the check to enforce RFC 5531 scoping in full.

Link: https://patch.msgid.link/20260712203451.124902-5-cel@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
2026-08-10 09:54:35 -04:00
Chuck Lever
b75e1a256d xdrgen: Reject specifications that define a name twice
When an RPC specification defines the same type or constant name
more than once, currently xdrgen emits every definition without
complaint. The duplication surfaces later as a C compiler error
about a redefined struct or function that points at generated code
instead of the actual offending line in the .x source.

RFC 4506 Section 6.4 places constant and type identifiers in a
single name space that must be unique within a specification. Add
a semantic check that enforces this rule.

Link: https://patch.msgid.link/20260712203451.124902-4-cel@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
2026-08-10 09:54:35 -04:00
Chuck Lever
e1391920c6 xdrgen: Record the source position of each declared identifier
In preparation for semantic checks that reject a malformed
specification, record where each declared identifier appears in the
source so a diagnostic can point at the name in error.

The transformer keeps each identifier's spelling but discards its
position, retaining only the position of the enclosing definition.
A caret built from that position falls on the definition keyword
rather than on the identifier, because the definition production
begins at the keyword.

Store the identifier's own line and column on every named
construct: constants, enumerated types and their enumerators,
structs, unions, pointers, typedef declarations, and RPC program,
version, and procedure names. The fields live on the AST base node
and are keyword-only, so lark's positional construction of each
node is unaffected; a construct whose position is not recorded
leaves them zero.

Link: https://patch.msgid.link/20260712203451.124902-3-cel@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
2026-08-10 09:54:35 -04:00
Chuck Lever
883fe9a7ac xdrgen: Align the error caret under tab-indented source
When xdrgen reports a parse or transform error, it prints the
offending source line followed by a caret marking the column. The
source line is emitted with its tab characters intact, but the caret
offset is computed from a tab-expanded copy of the text ahead of the
column. A terminal expands the line's leading tabs relative to the
four-space output indent, while the caret math expands the same tabs
from column zero, so the two disagree whenever the line is indented
with tabs and the caret lands past the token it should mark.

Render the displayed line with its tabs already expanded so the line
and the caret share one tab origin and the four-space indent cancels.
Fold the now-identical line-and-caret formatting out of both error
handlers into a single helper, so every caller reports the same
aligned output.

Link: https://patch.msgid.link/20260712203451.124902-2-cel@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
2026-08-10 09:54:35 -04:00
Chuck Lever
daa52e3785 xdrgen: Fix opaque and string encoders for unbounded members
The variable-length opaque and string encoder templates emit an
unconditional bound check, "if (value->NAME.len > MAXSIZE) return
false". XDR represents an unbounded specifier (opaque foo<>, string
foo<>) as a maxsize of 0, so for an unbounded member the check
degenerates to "len > 0" and the generated encoder refuses every
non-empty value.

The decoder does not share this defect. It delegates to
xdrgen_decode_opaque() and xdrgen_decode_string(), which treat a
maxlen of 0 as unbounded and skip the length check. The sibling
variable-length array templates already guard their bound check
with maxsize != "0".

Guard the bound check the same way in each affected template -- the
struct and pointer forms of both the opaque and string encoders --
so an unbounded member encodes a payload of any length while a
bounded member keeps its limit.

An explicit zero-length bound (foo<0>) parses to the same maxsize of
0 and so also skips the check; xdrgen does not distinguish it from
the unbounded form, matching the decoder and the array encoders.

Fixes: 4b132aacb0 ("tools: Add xdrgen")
Link: https://patch.msgid.link/20260712193122.116845-6-cel@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
2026-08-10 09:54:35 -04:00
Chuck Lever
d4ca0b0a6c xdrgen: Do not declare union XDR functions in the definitions header
Unlike the struct, enum, typedef, and pointer templates, the union
definitions template also emits xdrgen_decode_*() and
xdrgen_encode_*() prototypes for a public union into that header.
Those prototypes name struct xdr_stream, which the definitions
header neither includes nor forward-declares, so any translation
unit that includes the definitions header without xdr.h already in
scope draws -Wvisibility warnings. The same public prototypes are
emitted into the declarations header, which does include
<linux/sunrpc/xdr.h>, making the definitions-header copies
redundant.

Drop the prototype emission from the union definitions template so
it matches the other type templates. Public unions keep their
encode and decode prototypes through the declarations header.

Fixes: 4b132aacb0 ("tools: Add xdrgen")
Link: https://patch.msgid.link/20260712193122.116845-4-cel@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
2026-08-10 09:54:35 -04:00
Chuck Lever
0cfead4c11 xdrgen: Share void RPC procedure handlers across programs
The generated server-side decoder and encoder for a void procedure
argument or result are named after the RPC program (for example,
nfs_svc_decode_void). xdrgen derives that prefix from the program
name alone, not the version, so two versions of one program built
into the same module emit the identical symbol. NFSv2 and NFSv3
both declare program NFS_PROGRAM; once both are converted, fs/nfsd
fails to link with multiple definitions of nfs_svc_decode_void and
nfs_svc_encode_void.

A void handler carries no program- or version-specific behavior:
each merely forwards to xdrgen_decode_void() or xdrgen_encode_void().
Define one shared pair, xdrgen_svc_decode_void() and
xdrgen_svc_encode_void(), in the xdrgen builtins, and stop the
program generator from emitting a per-program void handler.

lockd is the one in-tree consumer that already emits per-program
void handlers, so regenerate the NLMv3 and NLMv4 XDR code to drop
nlm_svc_{decode,encode}_void() and nlm4_svc_{decode,encode}_void()
and point both procedure tables at the shared handlers. The shared
handlers are identical to the generated ones they replace, so no
wire behavior changes.

Only the server (svc) handlers are affected. The client-side void
stubs remain static and per-program, so they do not collide.

Link: https://patch.msgid.link/20260712193122.116845-3-cel@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
2026-08-10 09:54:35 -04:00
Chuck Lever
ec5a7c2dce xdrgen: Emit a blank line ahead of enum declarations
Clean up.

The declaration templates for structs, pointers, and typedefs each
begin with a blank line, which keeps successive declarations and the
include block above them visually separated. The enum declaration
template omits that blank line. trim_blocks collapses the template's
lone comment line to nothing, so the omission stayed invisible as
long as every generated header happened to lead with a non-enum
declaration.

Fixes: 4329010ad9 ("xdrgen: Address some checkpatch whitespace complaints")
Link: https://patch.msgid.link/20260712193122.116845-2-cel@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
2026-08-10 09:54:35 -04:00
Rafael J. Wysocki
ccda015d76 - Move thermal_zone_device_enable() to the right place in order to
prevent calling it if the thermal zone registration failed (Dan
   Carpenter)
 
 - Improve bitfield manipulations on Armada (Bryan B. Lima)
 
 - Remove unneeded 'fast_io' on Sun8i and Armada (Wolfram Sang)
 
 - Fix wrong boundary when clamping the low values in the set_trips()
   callback and fix wrong mask when setting the temperature interval on
   Airoha (Christian Marangi)
 
 - Make use of the regmap API in order to support the Airoha AN7583
   (Christian Marangi)
 
 - Fix adc_tm5_get_temp() return check value on the QCom SPMI ADC
   sensor (Rakesh Kota)
 
 - Fix unbalanced clock enablement when the resume fails on the iMX
   driver (Can Peng)
 
 - Add Qualcomm Master BandGap thermal monitor support (Satya Priya
   Kakitapalli)
 
 - Add Maili Temperature bindings compatible (Haritha S K)
 
 - Add a devm action to clean hardware interrupts, sampling, and
   control registers on Spacemit K1 (Pei Xiao)
 
 - Fix trivial typo in an OF code comment (Marek Vasut)
 
 - Remove unecessary print on Qcom SPMI ADC driver when a call to
   devm_request_threaded_irq() fails as this one already prints a
   message (Jishnu Prakash)
 
 - Add support for QCom PMIC5 Gen3 ADC by using auxialiary driver and
   shared interrupt with the IIO driver (Jishnu Prakash)
 
 - Make resets optional on MT8196 and add the corresponding property in
   the DT bindings (AngeloGioacchino Del Regno)
 
 - Fix clock staying enabled with the resume operation fails on Qoriq
   (Can Peng)
 
 - Fix wrong closing brace position in thermal library header (Andreas
   Haufler)
 
 - Fix low and high trip point validation by moving the check after the
   clamp on the spacemit driver (surendra)
 
 - Remove redundant error messages on IRQ request failure (Pan Chuang)
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCAAdFiEEGn3N4YVz0WNVyHskqDIjiipP6E8FAmp2NLQACgkQqDIjiipP
 6E98UAf/SqeabRuCefz1qn4zdjQHL4jiIEHrhRvXLSPb2ooVhzZYpOP5sUXFG1W5
 XxncjSyo7ZJKhVXrCd7II7GW6+3TqujM+MWpcYBerGsrLH0YudcOkAl8gTkhSXfV
 ZfuKbSYR+mrLyWbszIzbyknaGFFt4xdkusTldhWA80dHb1G5o055/unVtVEDDn65
 ciLmZqHBW+r0ureVhu6FJ5FNozCKfX4hXZOsX95FvIJEBvlDORHZmCEsaxbD1bem
 mMcs2tU74s2eJtRmKuq7A2ddw23dUTxTUciiCh6r5h/dI0MTxaEZUpF5TjXvfEQE
 Ick0gsWEc77263AS/2WAoTodQfBP5A==
 =8Vte
 -----END PGP SIGNATURE-----

Merge tag 'thermal-v7.3-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/thermal/linux

Pull thermal driver updates for 7.3-rc1 from Daniel Lezcano:

"- Move thermal_zone_device_enable() to the right place in order to
   prevent calling it if the thermal zone registration failed (Dan
   Carpenter)

 - Improve bitfield manipulations on Armada (Bryan B. Lima)

 - Remove unneeded 'fast_io' on Sun8i and Armada (Wolfram Sang)

 - Fix wrong boundary when clamping the low values in the set_trips()
   callback and fix wrong mask when setting the temperature interval on
   Airoha (Christian Marangi)

 - Make use of the regmap API in order to support the Airoha AN7583
   (Christian Marangi)

 - Fix adc_tm5_get_temp() return check value on the QCom SPMI ADC
   sensor (Rakesh Kota)

 - Fix unbalanced clock enablement when the resume fails on the iMX
   driver (Can Peng)

 - Add Qualcomm Master BandGap thermal monitor support (Satya Priya
   Kakitapalli)

 - Add Maili Temperature bindings compatible (Haritha S K)

 - Add a devm action to clean hardware interrupts, sampling, and
   control registers on Spacemit K1 (Pei Xiao)

 - Fix trivial typo in an OF code comment (Marek Vasut)

 - Remove unecessary print on Qcom SPMI ADC driver when a call to
   devm_request_threaded_irq() fails as this one already prints a
   message (Jishnu Prakash)

 - Add support for QCom PMIC5 Gen3 ADC by using auxialiary driver and
   shared interrupt with the IIO driver (Jishnu Prakash)

 - Make resets optional on MT8196 and add the corresponding property in
   the DT bindings (AngeloGioacchino Del Regno)

 - Fix clock staying enabled with the resume operation fails on Qoriq
   (Can Peng)

 - Fix wrong closing brace position in thermal library header (Andreas
   Haufler)

 - Fix low and high trip point validation by moving the check after the
   clamp on the spacemit driver (surendra)

 - Remove redundant error messages on IRQ request failure (Pan Chuang)

* tag 'thermal-v7.3-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/thermal/linux: (26 commits)
  thermal/drivers: Remove redundant error messages on IRQ request failure
  thermal/drivers/spacemit: Validate clamped trip thresholds
  tools/lib/thermal: Fix misplaced extern "C" closing brace
  thermal/drivers/qoriq: Disable clock on resume failure
  thermal/drivers/mediatek/lvts_thermal: Make reset optional for MT8196
  dt-bindings: thermal: mediatek: Make resets optional for MT8196
  thermal/drivers/qcom: add support for PMIC5 Gen3 ADC thermal monitoring
  iio: adc: qcom-spmi-adc5-gen3: Share SDAM0 IRQ with ADC_TM auxiliary driver
  iio: adc: qcom-spmi-adc5-gen3: Remove an unnecessary print
  thermal/of: Fix trivial enabled typo
  thermal/drivers/spacemit/k1: Add shutdown action and reorder registration order
  dt-bindings: thermal: qcom-tsens: Document the Maili Temperature Sensor
  thermal/drivers/qcom: Add support for Qualcomm MBG thermal monitoring
  dt-bindings: thermal: Add Qualcomm MBG thermal monitor support
  thermal/drivers/imx: Disable clock on runtime resume failure
  thermal/drivers/qcom-spmi-adc-tm5: Drop IIO_VAL_INT check in adc_tm5_get_temp
  thermal/drivers/airoha: Add support for AN7583 Thermal Sensor
  dt-bindings: arm: airoha: Add the chip-scu node for AN7583 SoC
  thermal/drivers/airoha: Generalize get_thermal_ADC and set_mux function
  thermal/drivers/airoha: Generalize probe function
  ...
2026-08-10 12:53:41 +02:00
Christian Brauner
d64ba78b74
selftests/filesystems: test completing a context from another user namespace
fsopen() records the caller's user namespace in fc->user_ns and hands
back an ordinary file descriptor, so the task that issues
FSCONFIG_CMD_CREATE need not be the one that created the context.
mount_capable() authorizes that for a caller holding CAP_SYS_ADMIN in an
ancestor of fc->user_ns, which any unprivileged user has over a user
namespace it just created.

binfmt_misc and overlayfs used to WARN_ON() the mismatch. Add a test for
both. Also cover the handover within one user namespace. That is a
supported thing to do and has to keep working.

Link: https://patch.msgid.link/20260802-work-fill_super-warn-v1-3-4e987911a39a@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-08-10 09:35:54 +02:00
Ian Rogers
16a12a54e9 perf synthetic-events: Fix divide by zero in perf_event__synthesize_threads
If scandir() finds no matching tasks in /proc, n is 0. If thread_nr is > 1,
we bypass the single-thread fast path and then clamp thread_nr to n, making
it 0. This results in a divide by zero when calculating num_per_thread.

Handle n <= 1 early to use the single-thread fast path and prevent the
crash.

Fixes: 340b47f510 ("perf top: Implement multithreading for perf_event__synthesize_threads")
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-09 22:02:42 -07:00
Ian Rogers
1ec13016ba perf python: Fix memory leak in pyrf__metrics_cb
In pyrf__metrics_cb, PyDict_SetItem does not steal the reference of the
key and value, so they need to be decref'ed after successful insertion
to avoid memory leaks.

Fixes: 47b3e95728 ("perf python: Add metrics function")
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-09 22:02:41 -07:00
Ian Rogers
cb45ede21d perf python: Fix count_values memory leak in pyrf_evsel__read
In pyrf_evsel__read, if PyArg_ParseTuple fails, the allocated count_values
is leaked. Move the allocation of count_values after the PyArg_ParseTuple
call to prevent the memory leak.

Fixes: 739621f657 ("perf python: Add evsel read method")
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-09 22:02:41 -07:00
Ian Rogers
b9514a9a13 perf python: Fix MetricGroup return type in perf.pyi
The metrics() function can return a dictionary where the value is either
a string or a list of strings, so the type signature in the stub file
should be Union[str, List[str]].

Fixes: 430da3cd03b4 ("perf python: Add perf.pyi stubs file")
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-09 22:02:41 -07:00
Ian Rogers
b3d7c6c1a9 perf python: Add thread and PMU uninitialized checks
Add CHECK_INITIALIZED checks to the thread attribute getters
(get_pid, get_tid, get_ppid) to prevent crashes if they are accessed
before being properly initialized.

Fixes: 3b96bf7af60d ("perf python: Add python session abstraction wrapping perf's session")
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-09 22:02:38 -07:00
Ian Rogers
b365402cd5 perf python: Zero initialize perf_data in pyrf_data__init
Replace path clearing with memset so the entire struct is zeroed,
preventing uninitialized fields from causing errors later.

Fixes: 4cd0142f7dec ("perf python: Add wrapper for perf_data file abstraction")
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-09 21:58:11 -07:00
Ian Rogers
0b274050c4 perf python: Validate attribute setters in pyrf_evsel
If val is NULL when setting an attribute, PyErr_SetString should be
called as deleting the attribute isn't supported. In addition, ensure
PyErr_Occurred is checked before setting the attribute to avoid setting
a garbage value.

Fixes: 877108e42b ("perf tools: Initial python binding")
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-09 21:58:11 -07:00
Ian Rogers
9a142beb1e perf python: Validate CPU and thread maps in pyrf_evsel__open
Add explicit Py_TYPE checks to ensure the arguments passed are
actually of the correct pyrf_thread_map and pyrf_cpu_map types.

Fixes: 877108e42b ("perf tools: Initial python binding")
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-09 21:58:11 -07:00
Ian Rogers
612aca22a9 perf python: Check counts_values size in set_values
The set_values function incorrectly assumed the list contained exactly
5 elements. Add a check to prevent out-of-bounds access.

Fixes: 877108e42b ("perf tools: Initial python binding")
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-09 21:58:11 -07:00
Ian Rogers
44e82c4d2f perf test: Fix skiplist leak in cmd_test
Fix a memory leak in cmd_test() where skiplist was not freed on
exit paths.

Assisted-by: Antigravity:gemini-3.1-pro
Fixes: 2ae828786c ("perf test: Allow skipping tests")
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-09 21:58:11 -07:00
Ian Rogers
54ba44db4d perf synthetic-events: Fix uninitialized pthread_join
In perf_event__synthesize_threads(), fix an uninitialized pthread_join()
call when thread creation fails by only joining the successfully
created threads.

Assisted-by: Antigravity:gemini-3.1-pro
Fixes: 340b47f510 ("perf top: Implement multithreading for perf_event__synthesize_threads")
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-09 21:58:11 -07:00
Ian Rogers
38d778acbe perf python: Fix memory leak in pyrf_evlist__get_pollfd
Fix a Python list object leak in pyrf_evlist__get_pollfd() by adding
a missing Py_DECREF on the error exit path.

Assisted-by: Antigravity:gemini-3.1-pro
Fixes: 877108e42b ("perf tools: Initial python binding")
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-09 21:58:11 -07:00
Ian Rogers
08e96e3c73 perf tools: Fix sb_evlist leaks in top and record
Fix a memory leak in cmd_top() where top.sb_evlist was not freed if
evlist__add_bpf_sb_event() fails. Note that evlist__start_sb_thread() and
evlist__stop_sb_thread() take ownership of the evlist and free it, so
we must only free it if we fail before starting the thread. Also set
top.sb_evlist to NULL to prevent use-after-free bugs.

Apply the same fix to builtin-record.c to avoid leaking rec->sb_evlist
and calling pthread_join on uninitialized threads in the error path.

Assisted-by: Antigravity:gemini-3.1-pro
Fixes: b38d85ef49 ("perf bpf: Decouple creating the evlist from adding the SB event")
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-09 21:58:10 -07:00
Ian Rogers
340641a4b5 perf stat: Fix evsel_list leak in cmd_stat
Fix a memory leak in cmd_stat() where evsel_list is leaked if an error
occurs while opening the output file.

Assisted-by: Antigravity:gemini-3.1-pro
Fixes: 361c99a661 ("perf evsel: Introduce perf_evlist")
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-09 21:58:10 -07:00
Ian Rogers
d4171c7740 perf script: Fix metric_evlist leak in script_find_metrics
Fix a memory leak in script_find_metrics() where metric_evlist is leaked
when returning early on error paths.

Assisted-by: Antigravity:gemini-3.1-pro
Fixes: 3622990efa ("perf script: Change metric format to use json metrics")
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-09 21:58:10 -07:00
Bibo Mao
c5959723aa KVM: LoongArch: selftests: Add FPU/LSX/LASX test cases
Add FPU/LSX/LASX test cases and verify FPU register get and set APIs,
the FPU width supports 64/128/256 bits.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2026-08-10 12:21:58 +08:00
Bibo Mao
7513f2298c KVM: LoongArch: selftests: Enable LSX/LASX by auto detection
Add LSX and LASX features when VM is created. These features are detected
firstly, enable it if it is available on host machine.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2026-08-10 12:21:58 +08:00
Boqun Feng
9634d860ac preempt: Introduce HARDIRQ_DISABLE_BITS
In order to support preempt_disable()-like interrupt disabling, that is,
using part of preempt_count() to track interrupt disabling nesting
level, change the preempt_count() layout to contain 8-bit
HARDIRQ_DISABLE count.

Signed-off-by: Boqun Feng <boqun@kernel.org>
Signed-off-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Boqun Feng <boqun@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://patch.msgid.link/20260121223933.1568682-2-lyude@redhat.com
Link: https://patch.msgid.link/20260804161447.84806-3-boqun@kernel.org
2026-08-08 22:44:06 +02:00
Joel Fernandes
b54aa0edf0 preempt: Track NMI nesting to separate per-CPU counter
Move NMI nesting tracking from the preempt_count bits to a separate
per-CPU counter (nmi_nesting). This is to free up the NMI bits in the
preempt_count, allowing those bits to be repurposed for other uses.

Reduce NMI_BITS from 4 to 1, using it only to detect if we're in an NMI.
The per-CPU counter currently caps nesting at 15.

[boqun: Address Steven Rostedt's comment on the BUG_ON() condition]
[boqun: Use preempt_count_set() in __nmi_exit() to avoid underflow]

Suggested-by: Boqun Feng <boqun@kernel.org>
Signed-off-by: Joel Fernandes <joelagnelf@nvidia.com>
Signed-off-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Boqun Feng <boqun@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://patch.msgid.link/20260121223933.1568682-3-lyude@redhat.com
Link: https://patch.msgid.link/20260804161447.84806-2-boqun@kernel.org
2026-08-08 22:44:05 +02:00
Kumar Kartikeya Dwivedi
4976cce08b selftests/bpf: Test attach rejection for struct_ops arena programs
Exercise fentry, fexit, and freplace programs that target a struct_ops
callback with an arena context argument. Verify each load is rejected with
-EOPNOTSUPP and the arena-specific verifier diagnostic.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://patch.msgid.link/20260808003938.3486067-15-memxor@gmail.com
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-08-08 03:03:26 -07:00
Tejun Heo
2d4de9a493 selftests/bpf: Test stack-passed struct_ops arena arguments
Add a test_arena_stack member with eight leading scalar arguments so the
arena pointer is passed on the stack.

The callback validates the first and last scalar ctx slots before
dereferencing the pointer in ctx[8]. This exercises the indirect
trampoline stack layout and arena conversion together, and prevents a
regression where stack arguments are read one slot late.

Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Tested-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://patch.msgid.link/20260808003938.3486067-13-memxor@gmail.com
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-08-08 03:03:26 -07:00
Tejun Heo
ba04841971 selftests/bpf: Add struct_ops __arena and __arena__nullable argument tests
Add test_arena and test_arena_nullable members to bpf_testmod_ops3 with
arena-tagged stub arguments and kfuncs that forward a caller-provided
pointer to them. The kfuncs take arena-tagged arguments, so each round
trip exercises both conversion directions end to end: the kfunc receives
a kernel arena address and the trampoline converts it back to an arena
pointer for the callback.

The non-nullable callback dereferences its argument with no NULL branch
and captures the raw ctx value, which the trigger program compares
against the arena offset of the passed object, pinning the exact
(u32)(kaddr - kern_vm_start) conversion. The nullable callback verifies
that only a true kernel NULL arrives as NULL. Failure coverage: a
program with no arena is rejected when it loads. The tests run on x86-64
and skip elsewhere, as the programs fail verification where the JIT
lacks arena argument support.

Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://patch.msgid.link/20260808003938.3486067-11-memxor@gmail.com
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-08-08 03:03:26 -07:00
Tejun Heo
25818556ed selftests/bpf: Add JIT-sequence tests for __arena kfunc arguments
Pin the exact rebase sequences the JITs emit for __arena and
__arena__nullable kfunc arguments with __jited assertions on x86-64: the
unconditional truncate-and-add, the nullable test-and-skip variant, and
all five argument registers in one call, which also covers the
REX-prefixed encoding of r8 on x86. The capture kfuncs take the argument
without dereferencing, so only the emitted code is under test. The
tests skip without LLVM disassembler support.

Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://patch.msgid.link/20260808003938.3486067-10-memxor@gmail.com
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-08-08 03:03:26 -07:00
Tejun Heo
0996e93691 selftests/bpf: Add kfunc __arena and __arena__nullable argument tests
Add arena-argument kfuncs to bpf_testmod, which also exercises the
argument rebasing on module kfuncs, and tests covering the accepted
argument forms (arena pointer, low 32 bits as a scalar, full user
address as a scalar), the exact rebase semantics via capture kfuncs
returning the raw argument (zero low 32 bits arrive as the arena kernel
base under __arena and as NULL under __arena__nullable), five arena
arguments in one call, a mixed __arena plus __arena__nullable call
exercising both bitmasks on one call site, a kernel-side dereference of
an unpopulated page recovering through the scratch page, and the
rejections (no arena in the program, incompatible register type).

The tests run on x86-64 and skip elsewhere, as programs with
arena-tagged kfunc args fail verification where the JIT lacks support.

Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://patch.msgid.link/20260808003938.3486067-9-memxor@gmail.com
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-08-08 03:03:26 -07:00
Eduard Zingerman
8b365b3c68 selftests/bpf: Verify zext_dst annotations for various instructions
Includes the following test cases:

- a test showing that zero extension flags do not propagate through
  state pruning in the unpatched kernel.
- a 32-bit subregister consumed by MOV32 and ALU32 operations
  (never zext'ed);
- a 64-bit MOV (never zext'ed);
- a narrow (32-bit) BPF_LDX load whose result is read as 64-bit;
- 32-bit atomic fetch_add and cmpxchg whose result is read as 64-bit;
- a CFG case where a 32-bit definition's upper half is used only on one
  of two branches;
- no zext for dead registers;
- LD_ABS defines only lower 32 bits, hence needs zext when the result
  is used as 64-bits;
- helper, kfunc and subprogram parameters are considered to use full
  64 bits;
- a 32-bit subregister consumed by JMP32 (X/K) operations;
- a 32-bit subregister consumed by JMP (X/K) operations;
- a 64-bit register consumed by both JMP and JMP32 operations
  (never zext'ed);
- ALU64 and address space cast operations on arena pointers;
- memory loads using BPF_PROBE_MEM instructions.

Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20260807-static-zext-v4-7-b6c270013c77@gmail.com
2026-08-08 11:06:24 +02:00
Eduard Zingerman
483a1bb0b6 bpf: Do not print a newline after disassembly in bpf_verbose_insn()
At the moment there are more callsites that want bpf_verbose_insn() to
not print a newline after the instruction, than callsites that want a
newline. Drop '\n' from disasm.c. Non-functional change.

The changes in bpftool are verified by writing a bpf program using a
variety of instructions and comparing `prog dump xlated` output in the
following modes: plain, opcodes, visual, visual opcodes. The output
before and after the changes is identical.

Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Quentin Monnet <qmo@kernel.org>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20260807-static-zext-v4-1-b6c270013c77@gmail.com
2026-08-08 11:05:49 +02:00
Bobby Eshleman
8ac4255c1e selftests/net: devmem.py: add check_rx_large_niov
Add a new devmem test case for binding the dmabuf with rx-page-size=16K.
The test sweeps RX payload sizes straddling the niov boundary to cover
the sub-niov, exact-niov, and multi-niov RX paths.

Silence pylint invalid-name (`with open() as f`) and too-many-arguments
(ncdevmem_rx grew to 6 args) at file scope.

Acked-by: Stanislav Fomichev <sdf@fomichev.me>
Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>
Signed-off-by: Bobby Eshleman <bobbyeshleman@meta.com>
Link: https://patch.msgid.link/20260805-tcpdm-large-niovs-v8-3-3e0225e2808c@meta.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-07 18:32:40 -07:00
Bobby Eshleman
3e8c9ec4eb selftests/net: ncdevmem: add -b option to set rx-page-size on bind
Add -b <bytes> to request a non-default niov size via
NETDEV_A_DMABUF_RX_PAGE_SIZE. When the value exceeds PAGE_SIZE,
udmabuf_alloc() switches to an MFD_HUGETLB-backed memfd so each 2 MB
hugepage produces one naturally-aligned sg entry.

Acked-by: Stanislav Fomichev <sdf@fomichev.me>
Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>
Signed-off-by: Bobby Eshleman <bobbyeshleman@meta.com>
Link: https://patch.msgid.link/20260805-tcpdm-large-niovs-v8-2-3e0225e2808c@meta.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-07 18:32:39 -07:00
Bobby Eshleman
b27a8560ee net: devmem: allow rx-page-size > PAGE_SIZE per dmabuf binding
Every devmem dmabuf binding today hands the page_pool PAGE_SIZE niovs.
This caps a single RX descriptor at PAGE_SIZE, burning CPU on buffer
churn for large flows.

Add a bind-time netlink attribute, NETDEV_A_DMABUF_RX_PAGE_SIZE, that
lets userspace request a larger niov size. The value must be a power of
two >= PAGE_SIZE.

The TX path is changed to always pass PAGE_SIZE.

Measurements:
Setup: kperf in devmem RX/TX cuda mode, 4 flows, 64 MB messages, 60s,
dctcp, num-rx-queues=4, dmabuf-rx/tx-size-mb=2048, 10 runs per niov
size, mlx5.

CPU Util:

   niov        net sirq %        net idle %         app sys %        app idle %
  -----  ----------------  ----------------  ----------------  ----------------
     4K   62.38 +/-  8.27   33.40 +/-  7.51   54.15 +/- 10.23   43.67 +/- 10.53
    16K   58.91 +/-  5.35   35.23 +/-  5.88   41.05 +/-  8.87   56.42 +/-  9.24
    32K   64.12 +/-  0.68   31.09 +/-  1.48   44.54 +/-  3.51   52.63 +/-  3.65
    64K   54.69 +/-  5.54   39.67 +/-  5.81   35.47 +/-  3.11   61.97 +/-  3.27

RX app sys % drops ~19% from 4K to 64K.

Throughput:

   niov       RX dev Gbps   RX flow avg Gbps
  -----  ----------------  -----------------
     4K  300.63 +/- 53.21    75.16 +/- 13.30
    16K  321.35 +/- 28.20    80.34 +/-  7.05
    32K  347.63 +/-  2.20    86.91 +/-  0.55
    64K  332.11 +/- 14.26    83.03 +/-  3.56

Throughput seems to increase, but the stdev is pretty wide so could just
be noise.

kperf support (not yet merged):
8837577f92

Acked-by: Stanislav Fomichev <sdf@fomichev.me>
Reviewed-by: Mina Almasry <almasrymina@google.com>
Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>
Signed-off-by: Bobby Eshleman <bobbyeshleman@meta.com>
Link: https://patch.msgid.link/20260805-tcpdm-large-niovs-v8-1-3e0225e2808c@meta.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-07 18:32:39 -07:00
Jakub Kicinski
edabb0da73 tools/ynl: add ovs_packet uapi header in Makefile.deps
ovs_packet spec needs to fetch the right uAPI header,
like other ovs specs already do. Otherwise build breaks
on very old distros (Ubuntu 22.04).

Spec was added by commit b82bfddc46 ("netlink: specs: add OVS packet
family specification").

Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>
Link: https://patch.msgid.link/20260807001918.61957-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-07 18:26:16 -07:00
Simon Schippers
485e38995c tun/tap: add IFF_BACKPRESSURE flag
Add the IFF_BACKPRESSURE flag to the UAPI header and to its tools/ copy.
The flag has no effect yet, it is the opt-in switch for the qdisc
backpressure logic added by the following patches.

It is added to TUN_FEATURES only in the last patch of the series, once the
implementation is complete. Until then TUNSETIFF silently masks it off, as
it does for any flag outside TUN_FEATURES.

Keeping the flag and its users in separate patches would either leave a
window where backpressure is unconditional, or make the opt-in a later
add-on. Adding the flag first lets every following patch be a no-op
unless it is set.

Signed-off-by: Simon Schippers <simon.schippers@tu-dortmund.de>
Link: https://patch.msgid.link/20260803183641.96882-2-simon.schippers@tu-dortmund.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-07 17:29:15 -07:00
Mohsin Bashir
e09d72c1c8 selftests: net: shaper: Cover recursive node cleanup
Exercise cleanup of nested nodes after deleting their last queue leaf. The
test builds a two-level node hierarchy and checks that removing the queue
also removes both now-empty node shapers.

Signed-off-by: Mohsin Bashir <hmohsin@meta.com>
Link: https://patch.msgid.link/20260805030936.1092907-15-mohsin.bashr@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-07 16:42:59 -07:00
Mohsin Bashir
ca157503b5 selftests: net: shaper: Cover mixed-parent grouping
Add coverage for grouping leaves that currently belong to different parent
nodes. The test verifies that an implicit parent is rejected, an explicit
parent succeeds, and the old empty parent nodes are cleaned up.

Signed-off-by: Mohsin Bashir <hmohsin@meta.com>
Link: https://patch.msgid.link/20260805030936.1092907-14-mohsin.bashr@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-07 16:42:59 -07:00
Mohsin Bashir
3651c7e18c selftests: net: shaper: Reject invalid set requests
Verify that invalid set requests fail without corrupting existing queue
shaper state. The test covers invalid node creation through set and invalid
queue identifiers, then confirms the original queue configuration remains
unchanged.

Signed-off-by: Mohsin Bashir <hmohsin@meta.com>
Link: https://patch.msgid.link/20260805030936.1092907-13-mohsin.bashr@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-07 16:42:58 -07:00
Mohsin Bashir
83731be090 selftests: net: shaper: Cover scalar attributes
Exercise queue-scope scalar shaper attributes reported by the device,
including rate limits, burst, priority and weight. Build the set request
from advertised capabilities so devices are tested for the attributes they
claim rather than skipped for missing unrelated fields.

Signed-off-by: Mohsin Bashir <hmohsin@meta.com>
Link: https://patch.msgid.link/20260805030936.1092907-12-mohsin.bashr@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-07 16:42:58 -07:00
Mohsin Bashir
4f197c4498 selftests: net: shaper: Add reparenting rejection test
Add reject_reparenting to verify that the group operation rejects attempts
to change an existing node's parent. The test creates two node shapers
under netdev and verifies that re-grouping the first node under the second
fails with EOPNOTSUPP. It also verifies that updating the node with the
same parent succeeds, and that updating the node without specifying a
parent keeps the queue leaves under the original node while updating their
weights.

Signed-off-by: Mohsin Bashir <hmohsin@meta.com>
Link: https://patch.msgid.link/20260805030936.1092907-11-mohsin.bashr@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-07 16:42:58 -07:00
Mohsin Bashir
aa05d8096a selftests: net: shaper: Add queue migration between nodes test
Add move_queue_between_nodes to verify that a queue can be moved
from one node to another via re-grouping. Creates N1 with Q1,Q2
and N2 with Q3, then re-groups N2 with Q1,Q3 to steal Q1 from
N1. Verifies Q1 moved to N2 and Q2 remains under N1.

Signed-off-by: Mohsin Bashir <hmohsin@meta.com>
Link: https://patch.msgid.link/20260805030936.1092907-10-mohsin.bashr@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-07 16:42:58 -07:00
Mohsin Bashir
5c84926ef7 selftests: net: shaper: Add child node deletion reparent test
Add delete_child_reparent to verify that deleting a child node
reparents its queue leaves to the parent node. Creates a two-level
hierarchy (N1 with Q1,Q2 and child N2 with Q3), deletes N2, and
verifies Q3's parent becomes N1.

Signed-off-by: Mohsin Bashir <hmohsin@meta.com>
Link: https://patch.msgid.link/20260805030936.1092907-9-mohsin.bashr@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-07 16:42:58 -07:00
Mohsin Bashir
1e89d0d743 selftests: net: shaper: Add nested depth limit discovery test
Add nested_depth_limit to incrementally create deeper nesting
levels until the driver rejects. Reports the maximum supported
nesting depth on both pass and fail. A device advertising nesting
support must support at least depth 2, otherwise nesting is
meaningless.

Signed-off-by: Mohsin Bashir <hmohsin@meta.com>
Link: https://patch.msgid.link/20260805030936.1092907-8-mohsin.bashr@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-07 16:42:58 -07:00
Mohsin Bashir
047735744d selftests: net: shaper: Add .group rate update test
Add group_update_rate to test updating an existing node's rate
via the .group callback. Creates a node with bw_max=10000,
re-groups with bw_max=50000, and verifies the rate changed while
leaves remain under the same node.

Signed-off-by: Mohsin Bashir <hmohsin@meta.com>
Link: https://patch.msgid.link/20260805030936.1092907-7-mohsin.bashr@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-07 16:42:58 -07:00
Mohsin Bashir
212410dc81 selftests: net: shaper: Add node scope .set rate update test
Add set_node_shaper to test updating a NODE scope shaper's rate
via the .set callback. Creates a node group with bw_max=10000,
updates to 20000 via .set, and verifies the change.

Signed-off-by: Mohsin Bashir <hmohsin@meta.com>
Link: https://patch.msgid.link/20260805030936.1092907-6-mohsin.bashr@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-07 16:42:57 -07:00
Mohsin Bashir
ff0c37b8c1 selftests: net: shaper: Add basic_groups_with_rate test
Add a test that groups queues under the netdev parent with rate
limiting enabled. Extract the common group-under-netdev flow into
_group_under_netdev helper to share with basic_groups.

The test independently checks for netdev scope bw_max and metric
capabilities before proceeding, and verifies that the netdev
shaper persists after leaf deletion.

Signed-off-by: Mohsin Bashir <hmohsin@meta.com>
Link: https://patch.msgid.link/20260805030936.1092907-5-mohsin.bashr@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-07 16:42:57 -07:00
Mohsin Bashir
1b5c2eb00e selftests: net: shaper: Decouple basic_groups from netdev rate limiting
Decouple basic_groups from the set_nshapers test dependency. The
test was gated on cfg.netdev which is set by set_nshapers. Replace
with direct capability checks: netdev scope support (required for
grouping under netdev handle) and queue scope nesting + weight.

Remove bw-max and metric from the .group call so the test validates
pure queue grouping without rate limiting. The rate-limited variant is
restored in the following patch, which adds a dedicated
basic_groups_with_rate test.

Signed-off-by: Mohsin Bashir <hmohsin@meta.com>
Link: https://patch.msgid.link/20260805030936.1092907-4-mohsin.bashr@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-07 16:42:57 -07:00
Mohsin Bashir
7ea7db704f selftests: net: shaper: Prepare helpers for group tests
dup_leaves expects the kernel to reject a group request that lists the same
queue twice. When that rejection does not happen, ksft_raises only records
a failed check and leaves cm.exception as None, so the following errno
check raises AttributeError. Worse, the accepted group request leaves a
node shaper and queue 0 behind, which makes later tests fail for an
unrelated reason. Handle the negative test explicitly instead. If group
fails, verify that the errno is EINVAL and return. If group succeeds,
delete the node returned by the operation and queue 0 before reporting the
failure.

Give the duplicate leaves different weights so the request still contains
two distinct leaf entries while exercising duplicate handle validation.
This also introduces _delete_shaper(), cached _cap_get(), and
_require_caps() helpers as preparation for the following shaper group
tests. The follow-on tests need the same capability checks for node and
queue scope support. Keeping that logic in one place avoids repeating raw
EOPNOTSUPP handling in each test.

Signed-off-by: Mohsin Bashir <hmohsin@meta.com>
Link: https://patch.msgid.link/20260805030936.1092907-3-mohsin.bashr@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-07 16:42:57 -07:00
Mohsin Bashir
9515a13829 selftests: net: shaper: Drop redundant command timeouts
Commit 57bb59ab6f ("selftests: net: bump default cmd() timeout to 20
seconds") raised the default cmd() timeout to 20 seconds, so the explicit
timeout=10 passed to the ethtool channel commands in queue_update() is
now redundant and, in fact, shorter than the default. Drop it and rely
on the default timeout.

Signed-off-by: Mohsin Bashir <hmohsin@meta.com>
Link: https://patch.msgid.link/20260805030936.1092907-2-mohsin.bashr@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-07 16:42:57 -07:00
Daniel Borkmann
e1d9b82db5 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 7.2-rc7
Cross-merge BPF and other fixes after downstream PR.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2026-08-07 23:04:17 +02:00
Rafael J. Wysocki
7544a367ad Merge branches 'pm-sleep', 'pm-runtime', 'pm-powercap' and 'pm-tools'
Merge updates related to system sleep handling and runtime PM, a power
capping update, and power management tools updates for 7.3-rc1:

 - Rename the PM core module parameter prefix to "pm" and allow the PM
   transition (DPM) watchdog to be disabled by default (Tzung-Bi Shih)

 - Fix off-by-one in wakelocks number limit check in the system sleep
   sysfs interface (Haowen Tu)

 - Remove kernel-doc markings from helper descriptions in the core
   hibernation code (Adi Nata)

 - Use %pe to print error pointer values in the hibernation core (Ronan
   Marchal)

 - Fix memory leak in snapshot_write_next() error path (Malaya Kumar
   Rout)

 - Delay allocating and linking the next swap_map_page in the
   hibernation image saving code until another image page actually
   needs to be recorded (Haesung Kim)

 - Stop setting runtime_error on runtime resume callback failures to
   allow drivers to recover from resume issues (Praveen Talari)

 - Handle PMU registration failure during probe in the intel_rapl_tpmi
   driver (Sumeet Pawnikar)

 - Avoid optional imports in intel_pstate_tracer unless they are really
   needed (Yousef Alhouseen)

 - Add generic CPPC performance display to the cpupower utility, build
   and call CPPC information on non-AMD processors, make cpupower print
   kernel and hardware frequency information, and add libm to cpupower
   for generic CPPC view (Jeremy Linton)

 - Remove conditional return with no effect from cpupower (Sang-Heon
   Jeon)

* pm-sleep:
  PM: sleep: Allow disabling DPM watchdog by default
  PM: sleep: Rename module parameters prefix to "pm"
  PM: hibernate: swap: defer linking the next map page
  PM: hibernate: Fix memory leak in snapshot_write_next() error path
  PM: hibernate: Use %pe to print error pointer values
  PM: hibernate: Remove kernel-doc markings from helper descriptions
  PM: sleep: Fix off-by-one in wakelocks number limit check

* pm-runtime:
  PM: runtime: Only set runtime_error on suspend callback failures

* pm-powercap:
  powercap: intel_rapl_tpmi: Handle PMU registration failure during probe

* pm-tools:
  cpupower: remove conditional return with no effect
  tools/power: intel_pstate_tracer: avoid optional imports for help
  cpupower: Add libm to cpupower for generic CPPC view
  cpupower: Print kernel and hardware frequency information
  cpupower: Build and call CPPC information on non-AMD processors
  cpupower: Add generic CPPC performance display
2026-08-07 22:07:04 +02:00
Rafael J. Wysocki
2d5667b6c3 Merge branches 'thermal-core', 'thermal-hwmon', 'thermal-intel' and 'thermal-tools'
Merge updates of the thermal core, thermal drivers for Intel platforms
and the thermometer utility for 7.3-rc1:

 - Use sysfs_emit_at() in trans_table_show() (Thorsten Blum)

 - Remove hwmon class devices created for thermal zones when the thermal
   zone devices holding them are removed (Rafael Wysocki)

 - Add support for the Directed Package-level Thermal Interrupt to
   the Intel thermal throttling driver to allow package-level thermal
   interrupts to go to one specific CPU in a processor package instead
   of going to all of the CPUs in it (Ricardo Neri)

 - Clean up RFIM groups on DVFS failure and clean up ODVP on probe
   failures in the int340x thermal driver (Pengpeng Hou)

 - Remove redundant dev_err() from the int340x thermal driver and the
   bxt_pmic driver (Pan Chuang)

 - Simplify ptc_temperature_write() in the int340x thermal driver by
   using kstrtou32_from_user() (Dmitry Antipov)

 - Close fd on realloc() failure in the thermometer utility (Amarjeet)

* thermal-core:
  thermal: sysfs: Use sysfs_emit_at() in trans_table_show()

* thermal-hwmon:
  thermal: hwmon: Remove hwmon class device along with its parent

* thermal-intel:
  thermal: intel: int340x: simplify ptc_temperature_write()
  thermal: intel: bxt_pmic: Remove redundant dev_err()
  thermal: intel: int340x: Remove redundant dev_err()
  thermal: intel: int3400: clean up ODVP on probe failures
  thermal: intel: int340x: clean up RFIM groups on DVFS failure
  thermal: intel: Add a syscore shutdown callback for kexec reboot
  thermal: intel: Add syscore callbacks for suspend and resume
  thermal: intel: Enable the Directed Package-level Thermal Interrupt
  thermal: intel: Add resources to handle directed package-level thermal interrupts
  x86/thermal: Add bit definitions for Intel Directed Package Thermal Interrupt

* thermal-tools:
  tools/thermal/thermometer: close fd on realloc() failure
2026-08-07 21:45:08 +02:00
Rafael J. Wysocki
2929c2568c Merge branch 'pm-cpufreq'
Merge cpufreq updates for 7.3-rc1:

 - Minor fixes and cleanups in assorted cpufreq drivers (Dan Carpenter,
   Guru Das Srinagesh, Haoxiang Li, Karl Mehltretter, Sasha Finkelstein,
   and Pan Chuang)

 - Fix cpufreq table creation and bios_limits() callback in the Rust
   bindings (Priya Bala Govindasamy)

 - Add IPQ5210 support to qcom-nvmem driver (Varadarajan Narayanan)

 - Adjust the .adjust_perf() cpufreq driver callback to allow the
   maximum performance value to be passed to drivers and update the
   intel_pstate driver to use it (Rafael Wysocki)

 - Set policy->cur to the actual requested frequency in the intel_pstate
   driver when the performance policy is used (Rafael Wysocki)

 - Simplify HWP handling on Broadwell processors in intel_pstate (Rafael
   Wysocki)

 - Fix setting minimum P-state at init time in intel_pstate (Rafael
   Wysocki)

 - Consolidate frequency values computation in intel_pstate and clean up
   code in that driver (Rafael Wysocki)

 - Add missing kernel-doc desciptions for structure and union members in
   the amd-pstate driver (David Vernet)

 - Handle missing policy in dynamic EPP callbacks in the amd-pstate
   driver (EDAMAMEX)

 - Introduce EXPORT_SYMBOL_FOR_PSTATE_UT() to export amd-pstate driver
   symbols to the amd-pstate-ut subdriver (K Prateek Nayak)

 - Add dynamic EPP as an "energy_performance_preference" mode in
   amd-pstate, remove the "amd_dynamic_epp" kernel command line option
   and the "dynamic_epp" sysfs attribute, and update the dynamic_epp
   documentation accordingly (K Prateek Nayak)

 - Add unit tests for CPPC Performance Priority and the "dynamic" EPP
   mode in the amd-pstate driver (K Prateek Nayak)

 - Set min_limit_freq based on bios_min_perf in amd-pstate and remove
   the defensive check for bios_min_perf from it (K Prateek Nayak)

 - Fix EPP return type and handle errors in amd-pstate during
   initialization, toggle auto_sel in active mode on shared memory
   systems, and cache the firmware programmed EPP value (Marco Scardovi)

 - Skip tests in amd-pstate-ut if the amd-pstate driver is not in active
   use (Qianheng Peng)

 - Replace sprintf() with sysfs_emit() in sysfs show in the cpufreq
   schedutil governor and fix a self-contradictory comment in
   sugov_iowait_apply() (Zhongqiu Han)

 - Fix the usage example for the sampling_rate tunable of the ondemand
   cpufreq governor in admin-guide (wangxiaodong)

* pm-cpufreq: (40 commits)
  cpufreq: imx6q: fix out-of-bounds write when probed more than once
  cpufreq: imx6q: fix devres accumulation across driver rebind
  rust: cpufreq: Fix temporary write in Registration::bios_limit_callback
  rust: cpufreq: Add CPUFREQ_TABLE_END as last table entry in TableBuilder::to_table
  cpufreq: intel_pstate: Adjust policy->cur in active mode to policy
  cpufreq/amd-pstate: Document missing kernel-doc members
  cpufreq/amd-pstate-ut: Add unit test for CPPC Performance Priority
  cpufreq/amd-pstate-ut: Add unit test for "dynamic" EPP mode
  cpufreq/amd-pstate: Reduce the scope of exported symbols
  Documentation/amd-pstate: Update dynamic_epp documentation with new behavior
  cpufreq/amd-pstate: Remove "amd_dynamic_epp" cmdline and "dynamic_epp" sysfs
  cpufreq/amd-pstate: Add dynamic EPP as an "energy_performance_preference" mode
  cpufreq/amd-pstate: Extract platform profile to EPP conversion into a helper
  cpufreq/amd-pstate: Remove the defensive check for bios_min_perf
  cpufreq/amd-pstate: Set min_limit_freq based on bios_min_perf
  cpufreq: apple-soc: Calculate frequency as a 64-bit value
  kselftest: cpufreq: Backup and restore governor for sptests
  selftests/cpufreq: Remove unnecessary sudo from quick_shuffle()
  selftests/cpufreq: Remove unused local variables from switch_show_governor()
  cpufreq/amd-pstate: handle missing policy in dynamic EPP callbacks
  ...
2026-08-07 20:48:50 +02:00
Aaron Tomlin
bf10e6ee2a perf sched latency: Add histogram and time interval options
While 'perf sched latency' reports task runtime and delay statistics
(average and maximum delay), it does not provide a visual representation
of how task wait times are distributed across latency ranges between
snapshots (start and finish of the analysis window).

The --histogram option collects CPU wait latencies (time between when
a task becomes runnable and when it gets scheduled onto a CPU) into 22
latency buckets, displaying an ASCII bar chart distribution.

The --hist-mode option configures the bucketing scheme:
  - log (default). Logarithmic latency buckets ranging from
    sub-microsecond (< 1 us) up to >= 1.05 seconds

  - linear. Equal-width linear latency buckets
    (i.e., 100 us steps up to >= 2.1 ms)

The --time option allows filtering trace event processing to a
specific time interval [start,stop].

Example histogram output excerpt:

    ❯ sudo perf sched latency --histogram --CPU 0

     CPU Wait Latency Distribution Histogram (between snapshots) (total samples: 36114)
     -------------------------------------------------------------------
      Latency Range    |      Count |    Pct | Histogram Graph
     -------------------------------------------------------------------
      < 1 us           |         17 |   0.0% | #
      2 - 4 us         |        673 |   1.9% | #
      4 - 8 us         |       6237 |  17.3% | ######
      8 - 16 us        |       3224 |   8.9% | ###
      16 - 32 us       |       1388 |   3.8% | #
      32 - 64 us       |        709 |   2.0% | #
      64 - 128 us      |        690 |   1.9% | #
      128 - 256 us     |        789 |   2.2% | #
      256 - 512 us     |        541 |   1.5% | #
      512 - 1024 us    |       2256 |   6.2% | ##
      1 - 2 ms         |       3577 |   9.9% | ###
      2 - 4 ms         |      13259 |  36.7% | ##############
      4 - 8 ms         |       2523 |   7.0% | ##
      8 - 16 ms        |        222 |   0.6% | #
      16 - 32 ms       |         10 |   0.0% | #
      >= 1.05 s        |          3 |   0.0% | #
     -------------------------------------------------------------------

Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Aaron Tomlin <atomlin@atomlin.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-07 10:56:23 -07:00
Aaron Tomlin
19ea850c02 perf sched latency: Auto-scale latency and runtime display units
Currently, 'perf sched latency' displays task runtime and delay values
exclusively in milliseconds (ms). This can be hard to read when
latencies are very small (in the microsecond or nanosecond range) or
unusually large (seconds).

Introduce auto-scaling for latency and runtime display columns. Values
are dynamically scaled and output with the most appropriate unit:
nanoseconds (ns), microseconds (us), milliseconds (ms), or seconds (s).

Additionally, rename column headers from "Runtime ms", "Avg delay ms",
and "Max delay ms" to "Runtime", "Avg delay", and "Max delay"
respectively, adjust spacing to maintain column alignment and stripe
redundant prefix strings from each row's format string to produce a
clean, tabular output.

For illustrative purposes, a comparison of the latency table header
before and after this change is shown below:

Before:
 -------------------------------------------------------------------------------------------------------------------------------------------
  Task                  |   Runtime ms  |  Count   | Avg delay ms    | Max delay ms    | Max delay start           | Max delay end          |
 -------------------------------------------------------------------------------------------------------------------------------------------
  kworker/2:2-mm_:154757 |      0.033 ms |        1 | avg:   0.829 ms | max:   0.829 ms | max start: 169486.543205 s | max end: 169486.544034 s

After:
 ------------------------------------------------------------------------------------------------------------------------------------------
  Task                    |    Runtime     |  Count   |    Avg delay    |    Max delay    |      Max delay start  |     Max delay end     |
 ------------------------------------------------------------------------------------------------------------------------------------------
  kworker/2:2-mm_:154757  |      32.873 us |        1 |      829.347 us |      829.347 us |       169486.543205 s |       169486.544034 s |

Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Aaron Tomlin <atomlin@atomlin.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-07 10:56:23 -07:00
Aaron Tomlin
44f8dd1ee1 perf sched: Handle missing trace samples in pipe mode
For pipe mode streams, event attributes are received dynamically during
event processing, meaning session->evlist is not populated prior to
perf_session__process_events(). To handle pipe input correctly:
  - Register the missing .attr, .tracing_data, .build_id, and .feature
    callbacks in cmd_sched()

  - Promote the handlers array to file-scope (latency_handlers[]) and
    dynamically assign matching tracepoint handlers
    (or process_sched_ignore) inside
    perf_sched__process_tracepoint_sample() when evsel->handler is NULL;
    replace process_sched_wakeup_ignore() with process_sched_ignore()

  - Perform the trace check post-processing when handling pipe data

Fixes: 27295592c2 ("perf session: Share the common trace sample_check routine as perf_session__has_traces")
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Aaron Tomlin <atomlin@atomlin.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-07 10:56:22 -07:00
Aaron Tomlin
4a81d59a9d perf sched: Suppress latency table output when trace samples are missing
When 'perf sched latency' is executed on a perf.data file that lacks
tracepoint samples (i.e., a file recorded without the -R flag or
containing only non-tracepoint events), perf_session__has_traces()
correctly outputs an error message. However, perf_sched__read_events()
subsequently falls through and returns 0 (success).

Consequently, caller functions such as perf_sched__lat() assume event
processing succeeded and proceed to render empty latency header tables
and total summary statistics.

Fix this behaviour by ensuring perf_sched__read_events() aborts early and
returns a suitable error code when perf_session__has_traces() evaluates
to false.

Additionally, validate thread__get_runtime() against NULL in
map_switch_event() to prevent potential null-pointer dereferences.

Fixes: 27295592c2 ("perf session: Share the common trace sample_check routine as perf_session__has_traces")
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Aaron Tomlin <atomlin@atomlin.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-07 10:56:22 -07:00
Ian Rogers
006a6f0f6e perf synthetic-events: Fix bounds and union member access in mmap2 build_id synthesis
Modify bounds and union member access in mmap2 build_id synthesis. Bound
max_filename_len against the minimum of filename array capacity and the
outer union stack layout minus sample ID trailers. This prevents both
-E2BIG overruns and _FORTIFY_SOURCE array bounds aborts on strlcpy even
if the enclosing union expands.

Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-07 09:43:36 -07:00
Ian Rogers
b97c535768 perf synthetic-events: Fix bounds, stale state, and misc flags in kernel module synthesis
Clamp long DSO names to mmap/mmap2 filename boundaries accounting for
sample ID headers to prevent buffer overruns in
perf_event__synthesize_modules_maps_cb(). Explicitly clear misc flags and
union padding to prevent stale Build-ID state from leaking between module
synthesis events, and cast event buffer pointers to avoid _FORTIFY_SOURCE
array bounds aborts when zeroing padding trailers.

Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-07 09:43:36 -07:00