github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-10-25 16:45:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
1,486,431 Commits 2 Branches 953 Tags 16 GiB
542fed2ef2
Commit Graph

16581 Commits

Author SHA1 Message Date
Linus Torvalds
4cbdd58dfa Perf events updates: 
- Support SIMD/eGPRs/SSP register sampling in perf
    (Dapeng Mi, Kan Liang)
 
  - Turn amd_uncore_ctx events into a flexible array (Rosen Penev)
 
  - Finish the work related to fixing the guest PEBS path to not
    set unwanted PERF_GLOBAL_CTRL bits, for which urgent fixes
    are upstream already (Sean Christopherson)
 
  - Drop redundant counter slot searches in the AMD uncore
    driver (Usama Arif)
 
  - Don't WARN when the ext_regs_buf allocation fails (vineash)
 
  - Annotate x86_pmu::hybrid_pmu with __counted_by_ptr (Thorsten Blum)
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmrUmW4RHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1hhcA/9GLLMd5OOBjw8i2ckWMOoi5UgmflkApBa
 BiAV9jEaIt3AaOS4hUe1Ttnrk02rWuq1NppwJm4n4foxysEI54ZwMfsWYeXLjdQ7
 Lw5Q+4/NwvuMPkE8pcasyM+OYE7BOnNRZijjqcDycYHcx0E464n4/sWFG9HQxhVa
 mNTLNvix9tIQTLjBTWWJdBDWYMvMlqvkjqCYNAf3CPDWP718pc29ilvZ3HW/qh2w
 iLELMP2+wPInfB7mDNy5aSdv0nLuSZHtmFshYSMK0d1MfIYd1a8p7XEYQ61iOCMz
 ZXKO3h21Ri0Ze7c3v6URlu3JsDv6lWiFyqW+ZyG9XFkmzam0Lk/HqFEg84QKUbPt
 9qiMxpLKQFhjumJRacZiswb/pKHGPbYQGkjt3wl5J5wSikiB57VnF+yPqwXFAlmx
 LIa7qLThGSy9Ju6dqbbpEkiiRkl7+Gb9zPAISbTjse9BdXiCUCKihUT689nAfmqT
 t7bTwocrYvSZiNK1ipEf+ARRb9lqLBF6LZ59WsFlVddMfiBb/f1x0b0M5sVEKucv
 JMOywESH6SFE0j533WA6WY6+iRG+FFa+k7mu78RO2nnKSXEXsLDQ5o3iyhQ2B4uD
 xaUq7J4DTRfu6XU1bK4HpBnKDgWzdkLrD+m8mTKPeNW5kMZC6QYakjQtqpC3Qks4
 liX/+yGieJs=
 =+I0p
 -----END PGP SIGNATURE-----

Merge tag 'perf-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull perf events updates from Ingo Molnar:

 - Support SIMD/eGPRs/SSP register sampling in perf
   (Dapeng Mi, Kan Liang)

 - Turn amd_uncore_ctx events into a flexible array (Rosen Penev)

 - Finish the work related to fixing the guest PEBS path to not
   set unwanted PERF_GLOBAL_CTRL bits, for which urgent fixes
   are upstream already (Sean Christopherson)

 - Drop redundant counter slot searches in the AMD uncore
   driver (Usama Arif)

 - Don't WARN when the ext_regs_buf allocation fails (vineash)

 - Annotate x86_pmu::hybrid_pmu with __counted_by_ptr (Thorsten Blum)

* tag 'perf-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (34 commits)
  perf/x86: Don't WARN when the ext_regs_buf allocation fails
  perf/x86/amd/uncore: Free counter slot by index
  perf/x86/amd/uncore: Remove redundant event slot scan
  perf/x86/intel: Check only PMC bits in PEBS_ENABLED when detecting host PEBS usage
  KVM: VMX: Only tell perf to enable PEBS counters for fully enabled PMCs
  KVM: VMX: Drop a redundant pmu->global_ctrl check when processing pebs_enable
  perf/x86/intel: KVM: Handle cross-mapped PEBS PMCs entirely within KVM
  perf/x86: KVM: Have perf define a dedicated struct for getting guest PEBS data
  perf/x86/intel: Invert names of intel_ctrl_{guest,host}_mask
  perf/x86/intel: Annotate x86_pmu::hybrid_pmu with __counted_by_ptr
  perf/x86/amd/uncore: Turn amd_uncore_ctx events into a flexible array
  perf/x86/intel: Add sanity check for PEBS record/fragment size
  perf/x86: Activate back-to-back NMI detection for arch-PEBS induced NMIs
  perf/x86/intel: Advertise PERF_PMU_CAP_SIMD_REGS capability
  perf/x86/intel: Support arch-PEBS based SIMD/eGPRs sampling
  perf/x86: Support SSP sampling using sample_regs_* fields
  perf/x86: Support eGPRs sampling using sample_regs_* fields
  perf: Enhance perf_reg_validate() with simd_enabled argument
  perf/x86: Support OPMASK sampling using sample_simd_pred_reg_* fields
  perf/x86: Support ZMM sampling using sample_simd_vec_reg_* fields
  ...
 2026-10-20 13:00:41 -10:00
Linus Torvalds
cb95904b47 Scheduler updates: 
Kconfig updates:
 
  - Simplify PREEMPT_DYNAMIC (Mark Rutland)
 
 Fair scheduler updates:
 
  - Remove redundant RUN_TO_PARITY check (Elif Topuz)
 
  - Declare augmented callbacks per field, fix rb_add_augmented_cached()
    descent (Yiwei Lin, Peter Zijlstra)
 
  - Restart fair hrtick after same-task repicks (Shubhang Kaushik)
 
  - Improve the scheduling latency of short slice tasks (Vincent Guittot)
 
 Deadline/RT scheduler updates:
 
  - Check start_dl_timer expiry with ktime_before()
    (Liang Hao)
 
  - irq_work: CPU-hotplug improvements on PREEMPT_RT (Sebastian Andrzej
    Siewior)
 
 Energy-aware scheduling updates:
 
  - Implement the steal_governor, introduce preferred CPUs and
    steal-driven vCPU backoff (Shrikanth Hegde)
 
 Multi-processor load-balancing updates:
 
  - Enable preferred SMT siblings on NVIDIA Olympus (Andrea Righi)
 
  - Randomize equally shallow idle CPU picks (Christian Loehle)
 
  - Remove redundant core_sched_seq (Hui Su)
 
 Cache-aware scheduling updates:
 
  - Avoid publishing partial LLC utilization (Jemmy Wong)
 
 NUMA-balancing updates:
 
  - Reset NUMA fault locality after scan period update (Eric Kim)
 
 Proxy execution updates:
 
  - Ongoing work to implement sleeping owner handling for proxy
    execution (John Stultz, Vasily Gorbik)
 
  - Preparatory steps to make sched_ext compatible with proxy
    execution (Andrea Righi)
 
 Scheduler infrastructure updates & fixes:
 
  - Remove the RCU wait from PSI trigger destruction (Shakeel Butt)
 
  - Avoid modifying wait-entry on failed priority registration
    (Hui Su)
 
  - Use the new static key API for sched_feat (Hongyan Xia)
 
  - Convert paravirt_steal to new static key APIs (Hongyan Xia)
 
  - cputime: Don't account idle time twice after dyntick-idle
    (Stian Halseth)
 
 Scheduler debugging updates:
 
  - Set TIF_NEED_RESCHED before calling __trace_set_need_resched()
    (Sechang Lim)
 
  - Fix context analysis errors in non-preferred CPU push (Shrikanth
    Hegde)
 
 Misc cleanups and fixes by Christian Loehle, Shubhang Kaushik,
 Thomas Huth and Vladimir Zapolskiy.
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmrUomIRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1ik+Q/+Jx0tXmwOm/wk1ba50zz/tkUL17APJzD1
 0TdHSf0sqssyVnQVmGBNWoKfp30zzrnd8Yf46PH5kUmyIxX0LqazAXsPA/0lxAY6
 jB2b5ZGosyQQPqyjM1q48K/BMB+GGO9xDKlFxxkBsICi+vS+6diBzXM70xla9M4O
 CcAO5DHb50otN/TljfnkmbxG7vgssCVZyS7XG6bSyhd6tUrcr4DVD7gYOMbSVcaL
 8Cgu+b54rOAcrcWU1454YKHI5etUOTjblCbFgISrdw7lwf4dKVtTAKSanFX9n522
 q9sQ1vzuRz6JfSak9nxFkCy5SMjuHJ53DkVNR4eUXNmM0tHdAcVd8jOexmQVBrug
 Yjloo/WydUqGT2TYYEVQPi4J+jMqMRyDIp3TL9UuQjwcjHRnUpd8EVmoNme0TOi+
 e3SoS+xOSVBLgbMFwrjJR/tQuqDPjgBrgIyg8wL+ed5cY6Equ+J3467wp8lO7RBN
 uGwChvxQAOaMlkh5tIR38Zjq9kzs79y85vz3uD2SNk17TcvijVw9UsmQKfAkpdZo
 5FUDM2AdyOhOtZkzMNLHfjjBLSMVCBRo726c6WbELibhuWN7xTAJSJx8o8JNOCrC
 vOBcNNAHpU7BwqA0gFIA3lL1uMXvKn9npKKjnB2C4WxhFGf23NF6uPapyA4sMZ00
 YwRGvOeDvu4=
 =cPCx
 -----END PGP SIGNATURE-----

Merge tag 'sched-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull scheduler updates from Ingo Molnar:
 "Kconfig updates:

   - Simplify PREEMPT_DYNAMIC (Mark Rutland)

  Fair scheduler updates:

   - Remove redundant RUN_TO_PARITY check (Elif Topuz)

   - Declare augmented callbacks per field, fix
     rb_add_augmented_cached() descent (Yiwei Lin, Peter Zijlstra)

   - Restart fair hrtick after same-task repicks (Shubhang Kaushik)

   - Improve the scheduling latency of short slice tasks (Vincent
     Guittot)

  Deadline/RT scheduler updates:

   - Check start_dl_timer expiry with ktime_before() (Liang Hao)

   - irq_work: CPU-hotplug improvements on PREEMPT_RT (Sebastian Andrzej
     Siewior)

  Energy-aware scheduling updates:

   - Implement the steal_governor, introduce preferred CPUs and
     steal-driven vCPU backoff (Shrikanth Hegde)

  Multi-processor load-balancing updates:

   - Enable preferred SMT siblings on NVIDIA Olympus (Andrea Righi)

   - Randomize equally shallow idle CPU picks (Christian Loehle)

   - Remove redundant core_sched_seq (Hui Su)

  Cache-aware scheduling updates:

   - Avoid publishing partial LLC utilization (Jemmy Wong)

  NUMA-balancing updates:

   - Reset NUMA fault locality after scan period update (Eric Kim)

  Proxy execution updates:

   - Ongoing work to implement sleeping owner handling for proxy
     execution (John Stultz, Vasily Gorbik)

   - Preparatory steps to make sched_ext compatible with proxy execution
     (Andrea Righi)

  Scheduler infrastructure updates & fixes:

   - Remove the RCU wait from PSI trigger destruction (Shakeel Butt)

   - Avoid modifying wait-entry on failed priority registration
     (Hui Su)

   - Use the new static key API for sched_feat (Hongyan Xia)

   - Convert paravirt_steal to new static key APIs (Hongyan Xia)

   - cputime: Don't account idle time twice after dyntick-idle
     (Stian Halseth)

  Scheduler debugging updates:

   - Set TIF_NEED_RESCHED before calling __trace_set_need_resched()
     (Sechang Lim)

   - Fix context analysis errors in non-preferred CPU push (Shrikanth
     Hegde)

  Misc cleanups and fixes by Christian Loehle, Shubhang Kaushik,
  Thomas Huth and Vladimir Zapolskiy"

* tag 'sched-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (64 commits)
  sched: Replace nr_iowait_cpu() with a bool accessor
  Revert "sched/fair: Remove dead code on enqueue_task_fair()"
  sched/cache: Avoid publishing partial LLC utilization
  sched/cputime: Don't account idle time twice after dyntick-idle
  sched/psi: Remove the RCU wait from trigger destruction
  sched/eevdf: Remove redundant RUN_TO_PARITY check
  sched/wait: Avoid modifying entry on failed priority registration
  rbtree_test: Use rb_add_augmented_cached() for the cached augmented test
  rbtree: Update augmented data on the way down in rb_add_augmented_cached()
  rbtree: Declare augmented callbacks per field with RB_AUG()
  rbtree_test: Use rb_add() and rb_add_cached() for the basic tests
  smpboot: Don't park the thread if work is pending
  irq_work: Flush lazy work CPU down on PREEMPT_RT
  irq_work: Update a comment regarding CPU hotplug invocation
  sched/topology: Add asymmetric SMT packing override
  sched/fair: Honor asymmetric SMT priority in idle selection
  sched: Set TIF_NEED_RESCHED before calling __trace_set_need_resched()
  sched/core: Fix context analysis errors in non-preferred CPU push
  virt/steal_governor: Enable the driver
  virt/steal_governor: Implement steal_governor policy loop
  ...
 2026-10-20 12:35:35 -10:00
Linus Torvalds
a6656aefd3 vfs-7.4-rc1.shared.net-next.pidfd 
Please consider pulling these changes from the signed vfs-7.4-rc1.shared.net-next.pidfd tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCatHrlwAKCRCRxhvAZXjc
 ooS3AP9/x0Naa93wtIOgcrAYPdb61lcqtH9ktLlKMsi5jhE64wEAiFS7qzGjZMJ4
 H7sq/Qmjt63nyB44LFrHI0z0K62IHAQ=
 =Z9oc
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.4-rc1.shared.net-next.pidfd' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull pidfd updates from Christian Brauner:
 "This adds thread specific pidfds to af_unix sockets.

  SO_PASSPIDFD and SO_PEERPIDFD hand out a pidfd for the thread-group
  leader. A coredump server on the coredump socket can't get a handle on
  the thread that took the signal and is writing the dump, and anything
  doing per-thread authentication has the same problem. The sending and
  the connecting thread are recorded in addition to the thread-group
  leader and sk_peer_pid becomes an array indexed by pid type.

  SO_PASSPIDFD_THREAD works like SO_PASSPIDFD but delivers an
  SCM_PIDFD_THREAD cmsg for the sending thread. Both options are
  independent so a receiver can ask for both. On SOCK_STREAM sockets
  recvmsg() only stops merging data at a thread boundary when the
  receiver asked for a thread pidfd. SO_PEERPIDFD_THREAD returns a pidfd
  for the thread that called connect(), listen() or socketpair(). pidfs
  records the coredump on the dumping thread's struct pid too so its
  pidfd reports it like the leader's does. Selftests for af_unix and the
  coredump socket are included"

* tag 'vfs-7.4-rc1.shared.net-next.pidfd' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  selftests/coredump: check the dumping thread's pidfd
  pidfs: record the coredump on the dumping thread's pid too
  selftests/net: SO_PEERPIDFD_THREAD
  net: add SO_PEERPIDFD_THREAD to get a thread-specific pidfd
  af_unix: record the pid of the connecting thread
  net: turn sk_peer_pid into an array indexed by pid type
  selftests/net: SO_PASSPIDFD_THREAD
  net: add SO_PASSPIDFD_THREAD to get a thread-specific SCM_PIDFD
  af_unix: record the pid of the sending thread
  pid: add helpers to operate on a struct pid array
 2026-10-19 20:32:52 -10:00
Linus Torvalds
0cbcaf75a1 vfs-7.4-rc1.mount 
Please consider pulling these changes from the signed vfs-7.4-rc1.mount tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCatHrlwAKCRCRxhvAZXjc
 okTnAP42ymJnRxXT0sSaNQ8Sk9PIRQ+1evElkdr0LfGkBp5ApAEAjtRL+o4LCjd9
 WRE1+n+xwuQyPHUv9UghlPi8Qnr7ggU=
 =nfhQ
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.4-rc1.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull mount updates from Christian Brauner:
 "This adds OPEN_TREE_DROP_MNTNS_MOUNTS.

  crun started using OPEN_TREE_NAMESPACE to set up the container's mount
  namespace and open_tree(OPEN_TREE_CLONE) for the sources of its bind
  mounts. That fails on any host with a mount namespace pinned below
  such a source. The recursive clone picks the pinned namespace up and
  move_mount() refuses to attach the tree with ELOOP. Only a younger
  mount namespace may ever be bound into an older one or mount namespace
  references could form a loop. A namespace created with
  OPEN_TREE_NAMESPACE is younger than everything else on the system so
  from inside it every pinned namespace is older. By the time this fails
  setns() has run and the host tree is out of reach, so the runtime has
  to predict the situation beforehand and lose the optimization. snapd
  pins mount namespaces under /run/snapd/ns so on Ubuntu that is any
  container bind mounting the host root.

  Every other path crossing a mount namespace boundary already leaves
  these mounts behind, copy_mnt_ns() and create_new_namespace() both do.
  Only get_detached_copy() asks for them.

  The new flag lets a caller get a clone without them. It stays opt-in
  because open_tree(OPEN_TREE_CLONE) plus move_mount() is mount --rbind
  through a file descriptor and dropping them by default would silently
  lose /run/snapd/ns/*.mnt on a live system. It requires AT_RECURSIVE,
  is a no-op with OPEN_TREE_NAMESPACE and skips locked nsfs mounts the
  way copy_mnt_ns() does, so nothing new is exposed. Selftests are
  included"

* tag 'vfs-7.4-rc1.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  selftests/filesystems: test OPEN_TREE_DROP_MNTNS_MOUNTS
  mount: add OPEN_TREE_DROP_MNTNS_MOUNTS
 2026-10-19 20:06:27 -10:00
Linus Torvalds
7ed37e9d5c vfs-7.4-rc1.misc 
Please consider pulling these changes from the signed vfs-7.4-rc1.misc tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCatHrlgAKCRCRxhvAZXjc
 oiocAQDQrd6xDocGA55sJ45KSw1tHYQh5CYH8zml+T9D1agMmwEA5oGUQWEJAoN3
 Y2zXG7WoZcdnKQv3FWRYWhjRmXNxUQk=
 =dbn3
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.4-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull misc vfs updates from Christian Brauner:
 "Fixes:

   - aio: a keyed poll completion on an epoll instance could recurse
     into the same epoll waitqueue lock when the result eventfd is
     watched by that very instance. An unprivileged process could make a
     CPU spin on the recursive lock. eventfd-backed poll completions are
     always deferred now.

   - fsnotify_inoderemove() is only called once the inode is really
     dead, no nlink and no aliases, and open_by_handle_at() can't add an
     alias to a dead inode anymore. The race could crash fsnotify or
     lose inode mark notifications.

   - devtmpfs: the conversion of the public instance to ->get_tree()
     broke reconfiguring the shared superblock's options on later mounts
     which made the boot time defaults permanent. A reconfigure context
     is kept in fc->fs_private so the parse ops can forward options to
     the underlying filesystem.

   - ufs truncated the 64-bit directory size to an unsigned int in
     ufs_last_byte(). A crafted image with a 4 GiB directory produced an
     out-of-folio read in ufs_find_entry() and, with
     CONFIG_UFS_FS_WRITE, a write into an adjacent page.

   - devpts rejects max=0 instead of silently lifting the per-instance
     pty limit. The value wrapped into ida_alloc_max() and became
     unlimited.

   - fs_pin publishes pins with the rcu list helpers so the kill paths
     reading the lists under rcu see the initialization.

   - dentry_kill() reports a Tasks-RCU quiescent state. Its
     cond_resched() is the only reschedule point on the dentry teardown
     path and cond_resched() isn't a quiescent state for Tasks-RCU, so
     Meta kept seeing rcu_tasks stalls in btrfs subvolume deletion.

   - writeback sizes foreign flushes by the target wb's dirty pages
     instead of the memcg-wide count which over or undersized a single
     bdi flush.

   - nfsd READ emitted two fsnotify access events on the iterator path
     since vfs_iocb_iter_read() already sends one. A READ on a krb5i or
     krb5p mount showed up twice in inotify.

   - pipe and splice pass a poll key when waking readers and writers so
     epoll, poll() and select() waiters only wake for the event they
     asked for.

   - the iso8859-14 Unicode to charset tables had page01 duplicated as
     page1e so 29 code points mapped to the wrong bytes and 22 that
     aren't in the charset were accepted.

   - orangefs doesn't wait for an unmount service operation that never
     returns on system shutdown and uses ssize_t for strscpy() errors.

   - __register_chrdev() checks the kobject_set_name() return value.

   - selftest fixes: the openat2 tests hardcoded O_LARGEFILE to 0x8000
     which is O_NOFOLLOW on powerpc, resolve_test makes /tmp a
     mountpoint so RESOLVE_NO_XDEV has a boundary to trip over,
     file_stressor moves into its own directory with a 30 minute
     timeout, the kernfs listxattr test skips when SELinux exposes
     security.selinux, the namespaces active reference tests wait for
     the thread via a PIDFD_THREAD pidfd since pthread_join() returns
     before exit_nsproxy_namespaces(), the idmapped_tmpfile test chowns
     its directory into the mapped range, the clone3 CLONE_CLEAR_SIGHAND
     test adds CLONE_VM so it fails for the intended reason, the pidfd
     PPID error message prints the values it compares and fscontext_ns
     gets a .gitignore.

  Cleanups:

   - vmcore prints the release of the crashed kernel from the VMCOREINFO
     note so a kdump that dies before the dump lands still says which
     kernel it was for.

   - initramfs allocates hardlink hash entries with the validated cpio
     name length instead of PATH_MAX, which put every entry in
     kmalloc-8k.

   - the unused dax_layout_busy_page() is removed,
     dax_layout_busy_page_range() becomes static and dax_folio_init()
     drops a redundant list initialization.

   - vfs_empty_path() is removed, it has had no callers since
     getname_maybe_null().

   - comment and documentation fixes in aio, bpf_fs_kfuncs,
     fs-writeback, inode, read_write, squashfs and the vfs.rst copy of
     struct file_system_type"

* tag 'vfs-7.4-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (38 commits)
  selftests/filesystems: Fix idmapped_tmpfile layer dir ownership
  selftests/namespaces: Wait for thread exit via pidfd in active-ref tests
  writeback: size foreign flushes by target wb dirty pages
  initramfs: Reduce hardlink hash allocation sizes
  fs: remove unused vfs_empty_path()
  dcache: report a Tasks-RCU quiescent state in dentry_kill()
  vmcore: report the release of the crashed kernel
  splice: pass a poll key when waking pipe readers and writers
  pipe: pass a poll key when waking writers after a resize
  orangefs: use ssize_t instead of size_t for error codes...
  orangefs_super: don't wait on service operation on system shutdown.
  docs/vfs: Fix the struct file_system_type copy
  nls: fix the Unicode to charset tables of iso8859-14
  selftests/filesystems/openat2: make /tmp a mountpoint inside private namespace
  selftests/filesystems/openat2: fix O_LARGEFILE definitions for non-arm64 architectures
  fs: fix misleading comments in read_write.c
  squashfs: fix inode number description in documentation
  fs: fix typos in comments
  fs/dax: Make dax_layout_busy_page_range() static
  fs/dax: Remove unused dax_layout_busy_page()
  ...
 2026-10-19 19:30:45 -10:00
Linus Torvalds
ada21d495c vfs-7.4-rc1.coredump 
Please consider pulling these changes from the signed vfs-7.4-rc1.coredump tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCatHrlgAKCRCRxhvAZXjc
 ouhIAP9q03aGe3fMs3tnLWC+JzSc1D48MMmo71rPxGnV6G6V+AEAzZV6Xkq8eFTU
 Zbwq6FhYvhptWeNGyNa9phUDFcBQIw4=
 =Pt3z
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.4-rc1.coredump' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull coredump updates from Christian Brauner:
 "This adds sparse coredumps and per-request memory type selection to
  the coredump socket protocol.

  A coredump sent over the socket transfers every zero of every hole in
  every mapping. For a process with 128 threads that's 1 GB of mostly
  thread stacks, 8 MB reservations with a few pages touched, and the
  holes sit in the middle of the dump rather than at the end. The
  coredump_filter bit that was proposed for this stops each PT_LOAD at
  the last populated page. But that mask says which kinds of memory to
  include and propagates across fork and exec, whereas what is selected
  here is an encoding. The usermodehelper isn't salvagable for this
  either. The coredump socket already has a handshake for exactly this.

  A server that raises COREDUMP_RECORDS in coredump_ack->mask gets the
  coredump as a sequence of records, each a struct
  coredump_record_header followed by what it describes. The stream ends
  explicitly with an end record that reports the size, so a missing one
  means truncation.

  With COREDUMP_SPARSE holes cross the socket as a bare header that says
  how many zero bytes were skipped. Reassembling the records gives back
  the same coredump, so a debugger and everything else still see an
  ordinary core file. Numbers from the selftests: the 128 thread process
  sends 1424153 bytes for a coredump of 1075150848 bytes, a 256 MB
  mapping with the first and the last page touched sends 188793 bytes
  for 268890112 bytes, and with COREDUMP_RECORDS alone the record
  overhead is under one percent.

  The selftests also simulate a server uploading to a blob store that
  can't seek and rewrites the program headers so the object is an
  ordinary ELF core file without the holes.

  COREDUMP_MEMORY_TYPES lets the server choose what memory to dump per
  request instead of relying on the static /proc/<pid>/coredump_filter
  of the crashing task. The request carries the default types and a mask
  of every type the kernel knows about, the ack carries the selection.
  Zero is valid and dumps the program headers and notes and nothing but
  the mappings that are always dumped.

  Preparatory cleanups refuse negative skips in dump_skip_to(), chunk
  every write at a page so a pipe or a socket never takes a short write
  in the middle of a record, make the dump helpers return bool and
  replace the core_dumped integer with COREDUMP_STATE_STARTED and
  COREDUMP_STATE_TRUNCATED flags.

  Also included is a fix for coredump_parse() reading core_pattern while
  it is being modified. The sysctl handler now validates a copy and
  publishes it under a spinlock and the parser works on a snapshot, so a
  rejected pattern is never visible and the rollback logic goes away.
  And to_kthread()'s lockless flags read is annotated with READ_ONCE()"

* tag 'vfs-7.4-rc1.coredump' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (29 commits)
  kthread: Annotate lockless to_kthread() flags access
  coredump: parse a snapshot of core_pattern
  selftests/coredump: test failed handshakes
  selftests/coredump: improve coredump size negotiation tests
  selftests/coredump: test COREDUMP_MEMORY_TYPES
  selftests/coredump: simplify the refusal tests
  tools: sync coredump.h header
  coredump: select memory types to include
  selftests/coredump: show how to inspect the task to decide how the coredump should be sent
  selftests/coredump: simulate a blob store
  selftests/coredump: put a hole in the middle of a sparse mapping
  selftests/coredump: hand the record stream to a sink
  selftests/coredump: test COREDUMP_RECORDS and COREDUMP_SPARSE
  coredump: describe the holes when COREDUMP_SPARSE is negotiated
  coredump: send the coredump in records if requested
  tools: sync coredump.h header
  coredump: add COREDUMP_SPARSE to the coredump socket protocol
  coredump: add COREDUMP_RECORDS to the coredump socket protocol
  coredump: clean up coredump state handling
  coredump: always chunk writes
  ...
 2026-10-19 17:21:24 -10:00
Linus Torvalds
4effd80841 vfs-7.4-rc1.close_range 
Please consider pulling these changes from the signed vfs-7.4-rc1.close_range tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCatHrlgAKCRCRxhvAZXjc
 ouFoAP9oJWCJRlKwbki5KP0P3O6/gnQXUz8gR07qxzWk8Gz/NgD/V3+MHkU8fX2w
 oTOGPuwrbbRNBTK/cmRG2kF6xxOPSw8=
 =jDl8
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.4-rc1.close_range' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull close_range updates from Christian Brauner:
 "This adds two new close_range() flags.

  CLOSE_RANGE_EXCEPT makes close_range() operate on all file descriptors
  outside of [fd, max_fd] instead of the ones inside. Alone it closes
  everything but the range. With CLOSE_RANGE_CLOEXEC it marks everything
  but the range close-on-exec. With CLOSE_RANGE_UNSHARE dup_fd() never
  takes a reference on what is dropped. So a task between
  clone(CLONE_FILES | CLONE_VM | CLONE_VFORK) and execve() that has the
  descriptors for the child in one window can shed the rest of the
  shared table in one call and nothing outside of the window is
  referenced by the child at any point.

  CLOSE_RANGE_CLOEXEC_ONLY closes the close-on-exec descriptors in the
  range and leaves everything else alone. Whatever the caller
  deliberately passes down, stdio, LISTEN_FDS, an inherited pipe, stays
  where it is. Combined with CLOSE_RANGE_EXCEPT it names the handful of
  close-on-exec descriptors that have to survive, the executable or an
  error pipe, and closes every other close-on-exec descriptor.

  Along the way dup_fd() stops copying a range in the middle of the
  table only to close it again. close_range(CLOSE_RANGE_UNSHARE) only
  avoided the copy when the range sat at the end of the table.

  Descriptors in a skipped range are never copied and no reference is
  taken on them, so ->flush() isn't called anymore for files from a
  table they were never part of. The flags are turned into an enum and
  selftests cover the window positions, the shared and the private table
  and the unshare form"

* tag 'vfs-7.4-rc1.close_range' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  selftests/core: test CLOSE_RANGE_CLOEXEC_ONLY
  file: add CLOSE_RANGE_CLOEXEC_ONLY
  file: let dup_fd() drop only close-on-exec descriptors
  selftests/core: test CLOSE_RANGE_EXCEPT
  file: add CLOSE_RANGE_EXCEPT
  close_range: turn the flags into an enum
  file: let dup_fd() drop everything outside of the range
  file: rename dup_fd()'s punch_hole to range
  selftests/core: test the hole CLOSE_RANGE_UNSHARE leaves behind
  file: let dup_fd() leave the punched hole behind
 2026-10-19 17:11:41 -10:00
Peter Zijlstra
840e23085b Merge branch 'tip/sched/urgent' 
Pickup dependencies; notably the RB-tree fix.

Signed-off-by: Peter Zijlstra <peterz@infradead.org>
 2026-10-13 13:51:24 +02:00
Kir Kolyshkin
73b40395c7
mount: add OPEN_TREE_DROP_MNTNS_MOUNTS 
A recursive open_tree(OPEN_TREE_CLONE) copies the nsfs mounts of any
mount namespaces pinned below the source.  When the clone is attached
inside a mount namespace younger than a pinned one, move_mount(2) fails
with ELOOP from check_for_nsfs_mounts(), per the rule from commit
8823c079ba ("vfs: Add setns support for the mount namespace") that
prevents mount namespace reference loops.

This breaks container runtimes that use OPEN_TREE_NAMESPACE, such as
crun [1].  The new namespace is younger than everything else, so bind
mounting e.g. the host root fails on any host that pins a mount namespace
(snapd does, under /run/snapd/ns).  By the time it fails, setns() has
already run and userspace cannot recover: the host tree is out of reach,
and the offending mounts cannot be unmounted from the detached copy.

copy_mnt_ns() and create_new_namespace() already leave these mounts
behind; only get_detached_copy() copies them.  Add an open_tree() flag to
drop them from the clone, as suggested by Aleksa [2].  Locked nsfs mounts
are dropped the same way copy_mnt_ns() does it, so nothing new is exposed.

Keep it opt-in: open_tree(OPEN_TREE_CLONE) plus move_mount(2) is how
mount --rbind works through a file descriptor, and in the caller's own
or an older namespace such mounts remain usable.

The flag requires AT_RECURSIVE, since a non-recursive clone has no
submounts to drop, and OPEN_TREE_CLONE or OPEN_TREE_NAMESPACE.  With the
latter it is a no-op, so a runtime can pass it with any recursive
open_tree() call.

Link: https://github.com/containers/crun/issues/2262 [1]
Link: https://lore.kernel.org/all/2026-01-07-oldest-grim-captions-spills-ywC2O3@cyphar.com/ [2]
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Link: https://patch.msgid.link/20261006-nsfs-prune-rfc-v3-1-adb97ea52868@gmail.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
 2026-10-12 11:33:19 +02:00
Christian Brauner
e10899b2a0
net: add SO_PEERPIDFD_THREAD to get a thread-specific pidfd 
SO_PEERPIDFD hands out a pidfd for the thread-group that called
connect() or socketpair(). Enable workloads such as the coredump server
or a broker to get a pidfd of the specific thread that connected to the
socket.

Reviewed-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@futurfusion.io>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Signed-off-by: Andrew Halaney <andrew@amutable.com>
Link: https://patch.msgid.link/20261005-work-unix-passpidfd-v4-7-350183b6e02a@amutable.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
 2026-10-12 10:58:21 +02:00
Christian Brauner
be3a5e06b9
net: add SO_PASSPIDFD_THREAD to get a thread-specific SCM_PIDFD 
Currently, SCM_PIDFD carries a pidfd for the thread-group leader. A
broker or the coredump server cannot learn the identity of the specific
thread that sent a given message. Now that both struct pids are recorded
a receiver can ask for the specific identity it needs.

So add SO_PASSPIDFD_THREAD as a sibling of SO_PASSPIDFD.
SO_PASSPIDFD_THREAD delivers an SCM_PIDFD_THREAD, i.e. scoped
to the specific thread sending. This is completely independent of
SO_PASSPIDFD, meaning you can use both options and get both cmsgs.

On SOCK_STREAM sockets recvmsg() only stops merging data at a thread
boundary when the receiver asked for a thread pidfd. For SO_PASSCRED and
SO_PASSPIDFD receivers all threads of one process remain a single
writer.

Co-developed-by: Andrew Halaney <andrew@amutable.com>
Signed-off-by: Andrew Halaney <andrew@amutable.com>
Link: https://patch.msgid.link/20261005-work-unix-passpidfd-v4-3-350183b6e02a@amutable.com
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
 2026-10-12 10:58:20 +02:00
Christian Brauner
06074fbbf0
file: add CLOSE_RANGE_CLOEXEC_ONLY 
CLOSE_RANGE_CLOEXEC marks a range close-on-exec. Nothing happens to
these fds unless an exec happens. Add CLOSE_RANGE_CLOEXEC_ONLY which
closes the close-on-exec file descriptors in the range.

When combined with CLOSE_RANGE_EXCEPT it names the close-on-exec file
descriptors that are supposed to survive. Every close-on-exec fd outside
of the range is closed. File descriptors without that flag are left
alone. Whatever the caller deliberately passes down, stdio, LISTEN_FDS,
an inherited pipe, remains where it is.

The handful of close-on-exec descriptors the caller still needs for the
exec such as the executable, an error pipe, sit in a specific range.
That is what a task between clone(CLONE_FILES) and execve() actually
wants:

	clone(CLONE_FILES | CLONE_VM | CLONE_VFORK)
	child: close_range(lo, hi, CLOSE_RANGE_UNSHARE |
				   CLOSE_RANGE_CLOEXEC_ONLY |
				   CLOSE_RANGE_EXCEPT)
	child: rearrange descriptors in the now private table
	child: execve()

Between the clone and the close_range() the child holds no reference of
its own on any file because copy_files() only bumps the fdtable
refcount. So a close() in the parent takes effect immediately. The
unshare also never takes a reference on the fds it leaves behind either.

The range is expressed in the parent's numbering. So a caller that
cannot name the file descriptors it keeps contiguously picks a range
wide enough to cover them, unshares, and tidies up with a second
close_range() on the table it now owns alone. That one is cheap. To keep
nothing, name a range that cannot hold an open descriptor, e.g.
close_range(~0U, ~0U, ...).

CLOSE_RANGE_CLOEXEC and CLOSE_RANGE_CLOEXEC_ONLY are mutually exclusive.

Link: https://patch.msgid.link/20260921-work-file-close_range_except-v1-9-c20d0b49270d@kernel.org
Reviewed-by: Jann Horn <jannh@google.com>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
 2026-10-05 13:02:41 +02:00
Christian Brauner
6939539684
file: add CLOSE_RANGE_EXCEPT 
close_range() operates on [fd, max_fd]. Add CLOSE_RANGE_EXCEPT. This new
flag instructs it to operate on all file descriptors outside of the
range instead.

Without any other flags that means it closes everything except the file
descriptors in the specified range. Together with CLOSE_RANGE_CLOEXEC it
marks every file descriptor except the ones in the range as
close-on-exec. With CLOSE_RANGE_UNSHARE dup_fd() never takes a reference
on what is dropped.

A task between clone(CLONE_FILES | CLONE_VM | CLONE_VFORK) and execve()
that has the descriptors for the child in one window can shed the rest
of the shared table in one call:

	close_range(lo, hi, CLOSE_RANGE_UNSHARE | CLOSE_RANGE_EXCEPT)

Nothing outside of the window is referenced by the child at any point.

Link: https://patch.msgid.link/20260921-work-file-close_range_except-v1-6-c20d0b49270d@kernel.org
Reviewed-by: Jann Horn <jannh@google.com>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
 2026-10-05 13:02:40 +02:00
Christian Brauner
48629a6115
close_range: turn the flags into an enum 
Turn the close_range() flags into an enum. Makes debugging a lot easier.

No functional changes.

Link: https://patch.msgid.link/20260921-work-file-close_range_except-v1-5-c20d0b49270d@kernel.org
Reviewed-by: Jann Horn <jannh@google.com>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
 2026-10-05 13:02:40 +02:00
Linus Torvalds
ac7445c28e Random number generator fixes for Linux 7.3-rc6. 
-----BEGIN PGP SIGNATURE-----
 
 iQJPBAABCAA5FiEEq5lC5tSkz8NBJiCnSfxwEqXeA64FAmq/uGEbFIAAAAAABAAO
 bWFudTIsMi41KzEuMTIsMiwyAAoJEEn8cBKl3gOumEgQAK0gjA0n40rHWGlmgIJO
 WTqMZGcbTvVXpPRyEXuNE7tTRsDDopen4UnmDqDGafXkBO1vU1LaxN72JonPjp7O
 sg4EqCi0iciuiDvLrjwQ1oPtpkL/feyjcNuNzSH/h2E4hJCUcEnyhTpeaRHCm3t4
 IGDXqqYYqjAQV4N6dWrzwN5K2oM75IOzccr0hyROkN/DBrqNZtupOco725MKxSsr
 FGTgoh0a6GlN3Yp+AIjqaHcPca/aUZApPUKmBzoWeqZmSqAmpzUIJgaHsBZAQS88
 oMcSh71Fzi2tOepiazjaAK9nZC3Nh2xeRU8cwUtvLvluzYA6wnBhcuTBOqThJmp3
 gEYz8yPbvil0aDIhfXB3xW2dxxsHaJrKJDLz0Smhi43D2lLKteQT3BE/2jQQ7OSa
 6FcV905hys3lIxlHeCa2wE/7NgiNAy3qE1aazkIKRfI8dRJxIuhogvW3VpKGCAue
 TwvjfvuoVtkaPAW/gLyDGRsMzrUvGPFa8yVvP5JTPrYQh5P+bEIM8CozWO2ScVcH
 Cdu0/TDe9TTS5mIwh0CrSX3shV/80bvHTINL14sTAKBGtN0N0vJgA8NSdIYt8OaF
 8qDDMg/XV5LY7sbMB3/Kru//wyfUw4LJdYhZSIJ0tZvzaRRIRiZGL1lT+X12PCrq
 uoaJ4AoDCf/ZiDaVTXEVf+28
 =GmSm
 -----END PGP SIGNATURE-----

Merge tag 'random-7.3-rc6-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/crng/random

Pull random number generator fixes from Jason Donenfeld:

 - VMGENID memory needs to be mapped with the decrypted tag, so that
   SEV-SNP machines can boot

 - A fix for an initialization race in VMGENID, followed by a cleanup

 - Trivial kernel doc cleanups in siphash and random.c

 - A fix for a new compilation failure with recent clang on PPC and
   RISC-V, due to generating an out-of-line memset in the vDSO

* tag 'random-7.3-rc6-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/crng/random:
  random: vDSO: avoid call to memset() when zeroing reserved parameter
  random: fix vgetrandom_opaque_params kernel-doc
  random: vDSO: fix repeated word 'to' in comment
  siphash: clean up kernel-doc comments
  virt: vmgenid: move to using dev_set/get_drvdata
  virt: vmgenid: set driver_data before registering notification handlers
  virt: vmgenid: remap memory as decrypted
 2026-10-02 11:28:45 -07:00
Arnd Bergmann
347c6ed8cf alloc_tag: avoid implicit padding in uapi 
The implied padding causes a harmless warning when testing the uapi
headers with -Wpadded that could in theory indicate incompatibilities
or data leaks:

./usr/include/linux/alloc_tag.h:41:1: error: padding struct size to alignment boundary with 7 bytes [-Werror=padded]

The code here is fine, but it's better to make the padding explicit and
avoid the warning here.

Link: https://lore.kernel.org/20260916065830.1619425-1-arnd@kernel.org
Link: https://lore.kernel.org/20260915202404.3568029-1-arnd@kernel.org
Fixes: 1d581ab234 ("alloc_tag: add ioctl to /proc/allocinfo")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Suren Baghdasaryan <surenb@google.com>
Acked-by: SJ Park <sj@kernel.org>
Acked-by: Hao Ge <hao.ge@linux.dev>
 2026-09-26 13:55:10 -07:00
Ingo Molnar
df53fbc909 Merge branch 'perf/urgent' into perf/core, to resolve conflict 
Conflicts:
	include/linux/perf_event.h

Signed-off-by: Ingo Molnar <mingo@kernel.org>
 2026-09-23 13:27:20 +02:00
Christian Brauner
757ebc30a3
coredump: select memory types to include 
Currently /proc/<pid>/coredump_filter determines what types of memory
are included in a coredump produced by <pid>. This is fairly static. The
coredump server has no easy way to configure what memory to dump even
though it can figure out all the necessary details to make an informed
decision.

Add a new COREDUMP_MEMORY_TYPES feature bit. If the coredump server
raises it the kernel will dump memory types raised in the
coredump_ack->memory_types member. Zero is valid and causes the creation
of a coredump that just includes the program headers and notes but no
memory apart from the mappings that are always dumped.

struct coredump_req gains @memory_types which is set to the default
memory types that are included in the coredump. This can be overridden by
raising bits in coredump_ack->memory_types. It also gains
@memory_types_mask which contains a bitmask of all memory types the
kernel knows about. A coredump server may only raise bits in
coredump_ack->memory_types that are raised in
coredump_req->memory_types_mask.

struct coredump_ack grows too. If COREDUMP_MEMORY_TYPES is raised in
@mask the kernel dumps the memory types set in the @memory_types mask.
Zero is valid and dumps no memory apart from the mappings that are
always dumped. A coredump server wanting to add or drop memory types
instead of outright replacing it should simply copy
coredump_req->memory_types and then mask off or raise types as needed.

@memory_types must be zero if COREDUMP_MEMORY_TYPES isn't raised.
COREDUMP_MEMORY_TYPES requires COREDUMP_KERNEL and an ack of at least
COREDUMP_ACK_SIZE_VER1 bytes.

Link: https://patch.msgid.link/20260821-work-coredump-filter-v1-1-91f9a73ef03e@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
 2026-09-22 13:25:05 +02:00
Christian Brauner
ac3a5a750e
coredump: add COREDUMP_SPARSE to the coredump socket protocol 
A coredump with a lot of unpopulated mappings sends useless amounts of
zero data to userspace. This is nonsensical. While __dump_skip() can
seek over them when the target is a regular file a socket cannot do
this. COREDUMP_RECORDS put the zeroes in records but it didn't get rid
of them.

Add a COREDUMP_SPARSE feature bit and a COREDUMP_RECORD_ZERO record
type. A zero record is a bare header that tells userspace how many zero
bytes were skipped.

So a hole crosses the socket as one header no matter how long it is. The
coredump server can recreate this sparsely. Zero records only exist
inside a record stream. COREDUMP_SPARSE requires COREDUMP_RECORDS.

Link: https://patch.msgid.link/20260820-work-coredump-sparse-v2-14-ba32dd718c51@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
 2026-09-22 13:25:01 +02:00
Christian Brauner
a769e2e711
coredump: add COREDUMP_RECORDS to the coredump socket protocol 
Currently a coredump sent over a socket is raw data. The kernel knows
things about the data it's sending that are useful for a coredump
server. For example, it knows where the unpopulated parts of a mapping
are. We can't communicate this to userspace currently though.

Add a COREDUMP_RECORDS feature bit and a struct coredump_record_header
so userspace can negotiate that feature. Instead of a byte stream it
gets a header plus data. Reassembling the records yields the same
coredump that would have been sent without them.

The record itself is also versioned and thus extensible with the same
protocol as the ack-req sync.

A record stream ends explicitly. A COREDUMP_RECORD_END record closes it,
carries no data and reports the size of the coredump. It is only sent
once the whole coredump has been written. If it's missing the coredump
should be treated as truncated.

This just adds the infrastructure.

Link: https://patch.msgid.link/20260820-work-coredump-sparse-v2-13-ba32dd718c51@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
 2026-09-22 13:25:01 +02:00
Christian Brauner
dbaf323ace
coredump: pin the protocol struct sizes 
COREDUMP_REQ_SIZE_VER0 and COREDUMP_ACK_SIZE_VER0 define the initial
struct sizes.

Assert that both published sizes still match their structs. While at it
fix some issues with docs.

Link: https://patch.msgid.link/20260820-work-coredump-sparse-v2-7-ba32dd718c51@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
 2026-09-22 13:24:57 +02:00
Thomas Huth
a9b3c75705 sched/headers: Replace __ASSEMBLY__ with __ASSEMBLER__ in the <uapi/linux/sched.h> header 
While the GCC and Clang compilers already define __ASSEMBLER__ auto-
matically when compiling assembly code, __ASSEMBLY__ is a macro that
only gets defined by the Makefiles in the kernel. This can be very
confusing when switching between userspace and kernelspace coding, or
when dealing with uapi headers that rather should use __ASSEMBLER__
instead. Let's standardize now on the __ASSEMBLER__ macro to avoid
this confusion.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: https://patch.msgid.link/20260922064641.61120-1-thuth@redhat.com
 2026-09-22 10:08:38 +02:00
Linus Torvalds
b12dd0fa48 Input updates for v7.3-rc3 
- Fixes for evdev and input compat handling to zero-initialize on-stack
   absinfo and force-feedback effect structures before partial or compat
   copies from userspace, preventing kernel stack memory disclosure
 
 - Fixes for the Synaptics RMI4 driver to prevent an out-of-bounds read
   when writing multi-chunk blocks over SMBus and to avoid a NULL pointer
   dereference during suspend/resume when the RMI device is unbound
 
 - Fixes for the soc_button_array driver to propagate -EPROBE_DEFER on
   non-Bay Trail/Cherry Trail platforms (fixing broken power and volume
   buttons on the Microsoft Surface Pro 11) and to validate the ACPI
   package element count before dereferencing
 
 - A fix for the adp5588-keys driver to cache the initial GPIO hardware
   state before registering the gpiochip so pre-configured pin states are
   not clobbered by GPIO hogs during registration
 
 - A fix for the cyttsp5 touchscreen driver to clamp the device-supplied
   HID report size before copying into the response buffer, preventing a
   buffer overflow
 
 - A fix for the HP SDC serio driver to use timer_shutdown_sync() on
   module exit so the periodic kicker timer cannot rearm itself during
   teardown
 
 - A fix for the eeti_ts touchscreen driver to export its OF module alias
   so the module autoloads on Device Tree platforms
 
 - Updates to the xpad joystick driver adding support for the Victrix Pro
   BFG controller and Azeron devices, and fixing the device type
   classification for the PDP Marvel Xbox 360 controller
 
 - Quirks for the i8042 and atkbd drivers to keep the built-in keyboards
   functional on the Acer Aspire Go 15 AG15-42P and Xiaomi Redmi Book Pro
   16 2026
 
 - A quirk for the Synaptics PS/2 touchpad driver disabling SMBus
   InterTouch on the Lenovo ThinkPad T440p (board ID 2722) so the
   touchpad and TrackPoint respond immediately at boot
 
 - Other minor updates and documentation fixes, including reading the
   "ti,poll-period" property as u32 in tsc2007, adding the mt6572
   compatible to the MediaTek keypad Device Tree binding, fixing an
   attribute name typo in the trackpoint sysfs ABI documentation, and
   documenting that no new LED codes should be added to the input
   subsystem.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQST2eWILY88ieB2DOtAj56VGEWXnAUCaq9j+gAKCRBAj56VGEWX
 nJ5KAQDnTOivIghgIGnlKTIYLSV4cJ0fWJh7J1/ubx9soK+9RwD/bDUdyryAaSTr
 x95U7/fEvq/lXBFyK2LXyahuTC6vNQY=
 =Vsfi
 -----END PGP SIGNATURE-----

Merge tag 'input-for-v7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

Pull input fixes from Dmitry Torokhov:

 - Fixes for evdev and input compat handling to zero-initialize on-stack
   absinfo and force-feedback effect structures before partial or compat
   copies from userspace, preventing kernel stack memory disclosure

 - Fixes for the Synaptics RMI4 driver to prevent an out-of-bounds read
   when writing multi-chunk blocks over SMBus and to avoid a NULL
   pointer dereference during suspend/resume when the RMI device is
   unbound

 - Fixes for the soc_button_array driver to propagate -EPROBE_DEFER on
   non-Bay Trail/Cherry Trail platforms (fixing broken power and volume
   buttons on the Microsoft Surface Pro 11) and to validate the ACPI
   package element count before dereferencing

 - A fix for the adp5588-keys driver to cache the initial GPIO hardware
   state before registering the gpiochip so pre-configured pin states
   are not clobbered by GPIO hogs during registration

 - A fix for the cyttsp5 touchscreen driver to clamp the device-supplied
   HID report size before copying into the response buffer, preventing a
   buffer overflow

 - A fix for the HP SDC serio driver to use timer_shutdown_sync() on
   module exit so the periodic kicker timer cannot rearm itself during
   teardown

 - A fix for the eeti_ts touchscreen driver to export its OF module
   alias so the module autoloads on Device Tree platforms

 - Updates to the xpad joystick driver adding support for the Victrix
   Pro BFG controller and Azeron devices, and fixing the device type
   classification for the PDP Marvel Xbox 360 controller

 - Quirks for the i8042 and atkbd drivers to keep the built-in keyboards
   functional on the Acer Aspire Go 15 AG15-42P and Xiaomi Redmi Book
   Pro 16 2026

 - A quirk for the Synaptics PS/2 touchpad driver disabling SMBus
   InterTouch on the Lenovo ThinkPad T440p (board ID 2722) so the
   touchpad and TrackPoint respond immediately at boot

 - Other minor updates and documentation fixes, including reading the
   "ti,poll-period" property as u32 in tsc2007, adding the mt6572
   compatible to the MediaTek keypad Device Tree binding, fixing an
   attribute name typo in the trackpoint sysfs ABI documentation, and
   documenting that no new LED codes should be added to the input
   subsystem

* tag 'input-for-v7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: hp_sdc - shut down kicker timer on module exit
  Input: xpad - add support for Victrix Pro BFG Controller
  Input: tsc2007 - read "ti,poll-period" as u32
  Input: trackpoint - fix the inertia attribute name in the ABI document
  Input: eeti_ts - publish the OF module alias
  Input: xpad - add support for Azeron devices
  Input: xpad - fix PDP Marvel Xbox 360 controller
  Input: document that no new LED codes should be added
  Input: soc_button_array - check btns_desc->package.count
  Input: soc_button_array - fix MS Surface Pro 11 probe failure
  Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P
  Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722)
  Input: cyttsp5 - clamp the HID report size before memcpy
  Input: zero ff_effect before compat copy in input_ff_effect_from_user
  Input: evdev - zero absinfo before partial copy in EVIOCSABS
  Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound
  Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()
  Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026
  dt-bindings: input: mediatek,mt6779-keypad: add mt6572
  Input: adp5588-keys - cache GPIO state before registering the gpiochip
 2026-09-20 07:02:34 -07:00
Karl Mehltretter
703749b069 random: fix vgetrandom_opaque_params kernel-doc 
struct vgetrandom_opaque_params contains size_of_opaque_state, but its
kernel-doc describes size_per_opaque_state. This leaves the real member
undescribed and adds a nonexistent member to the generated
documentation.

Use the member's actual name.

Fixes: 4ad10a5f5f ("random: introduce generic vDSO getrandom() implementation")
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2026-09-16 11:52:34 +02:00
Linus Torvalds
01414b70cb RDMA v7.3 first rc pull 
Lots of bug fixes from the last weeks:
 
 - Various error unwind bugs
 
 - Several more races and bugs in siw and rxe, including remote triggerable
 
 - HFI1 corruption with its credit scheme
 
 - Remove a bogus user triggerable dev_warn
 
 - Lock __ethtool_get_link_ksettings() properly
 
 - Fix a lockdep loop with diassociation
 
 - Several storage related bugs, some triggerable remotely
 
 - Do no leak physical addresses to userspace in bnxt_re
 
 - Fix wrong irq context for the xarrays in erdma
 
 - User triggerable race in ucma with multicast
 
 - Race in ipoib with multicast flushing and destruction
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRRRCHOFoQz/8F5bUaFwuHvBreFYQUCaqfmFwAKCRCFwuHvBreF
 YfkUAP9+/5LQUpCcX4mVtuXsFz+ZOno8g4gC/xbCsFpt/KdjBQEAxmRWOXTdmrce
 cSFNY7eibNChLB4rVaj1VirVMtGtWQ4=
 =5QAG
 -----END PGP SIGNATURE-----

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma

Pull rdma fixes from Jason Gunthorpe:
 "Lots of bug fixes from the last weeks:

   - Various error unwind bugs

   - Several more races and bugs in siw and rxe, including remote
     triggerable

   - HFI1 corruption with its credit scheme

   - Remove a bogus user triggerable dev_warn

   - Lock __ethtool_get_link_ksettings() properly

   - Fix a lockdep loop with diassociation

   - Several storage related bugs, some triggerable remotely

   - Do no leak physical addresses to userspace in bnxt_re

   - Fix wrong irq context for the xarrays in erdma

   - User triggerable race in ucma with multicast

   - Race in ipoib with multicast flushing and destruction"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (28 commits)
  RDMA/siw: Bound fragmented header copies by the remaining length
  RDMA/efa: Keep EQ resources alive while IRQ is registered
  RDMA/efa: Keep admin queues alive while IRQ is registered
  RDMA/core: fix refcount bug in iwpm_get_nlmsg_request()
  IB/IPoIB: Avoid restoring OPER_UP after multicast flush
  RDMA/ucma: Serialize join and leave on copy_to_user failure
  RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted
  RDMA/irdma: Enforce local fence for IB_WR_REG_MR
  RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables
  RDMA/mad: Fix receive buffer leak when PKey enforcement fails
  RDMA/uverbs: Fix potential leak of resources->collection in flow_resources_alloc()
  RDMA/bnxt_re: Avoid exposing umdbr to userspace
  RDMA/rtrs: guard against null kobj name
  RDMA/bnxt_re: check create_singlethread_workqueue() in DCB setup
  IB/isert: wait for deferred control PDU completions before releasing the connection
  IB/iser: reject a remote invalidation of an unregistered direction
  RDMA/srp: Fix srp_remove_target()
  IB/mlx4: Fix use-after-free on pkey sysfs registration failure
  RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency
  RDMA/core: Reject unregistering netdevs in ib_get_eth_speed
  ...
 2026-09-14 09:58:12 -07:00
Dmitry Torokhov
ea48250a0d Input: document that no new LED codes should be added 
Add a comment to input-event-codes.h clarifying that no new LED
definitions should be added to the input subsystem. The existing
LED_* definitions are legacy and grandfathered for backwards
compatibility with userspace via evdev. Any new LED indicators
should instead use the dedicated LED subsystem.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
 2026-09-13 17:25:16 -07:00
Hemanth Selam
21a62663d4
fs: fix typos in comments 
Fix typos in comments, reported by scripts/checkpatch.pl using the
misspelling list in scripts/spelling.txt.  Only touches comments, no code
changes.

Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com>
Link: https://patch.msgid.link/20260907063252.21433-1-hemanth.selam@gmail.com
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
 2026-09-10 10:06:16 +02:00
Linus Torvalds
4d7d9486c0 integrity-v7.3-rc2 
-----BEGIN PGP SIGNATURE-----
 
 iIoEABYKADIWIQQdXVVFGN5XqKr1Hj7LwZzRsCrn5QUCapsP/BQcem9oYXJAbGlu
 dXguaWJtLmNvbQAKCRDLwZzRsCrn5b2gAQC3ms2HRoZolscMWqnUNoi5SmPpwcV2
 v/ojwDc1TnS9HAEA/604QYihEvRQzKQwEyF6W6b83w22tyWKhDW1a0d7KQ4=
 =/Hd6
 -----END PGP SIGNATURE-----

Merge tag 'integrity-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity

Pull IMA fixes from Mimi Zohar:

 - Instantiating the ima_file_truncate and ima_path_truncate LSM hooks
   resulted in configfs locking issues.

   configfs files should not be measured, appraised, or audited in the
   first place, so the builtin policies are updated to exclude them.

 - IMA audit messages include the filename, which could result in a page
   fault when the filename doesn't exist

 - Un-hide the IMA_MEASURE_PCR_IDX Kconfig prompt

* tag 'integrity-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity:
  ima: allow users to specify the pcr index with IMA_MEASURE_PCR_IDX
  ima: Check for ERR_PTR from dentry_path() in validate_hash_algo()
  ima: don't measure/appraise files on configfs
  configfs: move CONFIGFS_MAGIC definition to magic.h
 2026-09-04 19:36:11 -07:00
Yogesh Mohan Marimuthu
13af55f713 drm/amdgpu/userq: fix struct drm_amdgpu_info_device padding for 32bit compile 
need to pad before __u64 tcc_disabled_mask variable.

This patch fixes 64bit Kernel + 32 bit mesa combination. But at the same
time it will break 32bit Kernel(using this patch) + older 32bit mesa(not
using this patch).

This issue was discussd with alexander.deucher@amd.com,
christian.koenig@amd.com and pierre-eric.pelloux-prayer@amd.com.
Currently today 32 bit kernel + 32 bit userspace and 64 bit kernel and
64 bit userspace work.  Mixed 64 bit kernel and 32 bit userspace is
currently broken.  Since 32 bit kernel and userspace is probably pretty
rare these days and the data affected by this is not critical, Hence
we can go ahead with this patch.

Fixes: cf21e76a60 ("drm/amdgpu: return tcc_disabled_mask to userspace")
Signed-off-by: Yogesh Mohan Marimuthu <yogesh.mohanmarimuthu@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 497b5090f2)
 2026-09-02 17:02:23 -04:00
Sriharsha Basavapatna
23d7e03a52 RDMA/bnxt_re: Avoid exposing umdbr to userspace 
The umdbr field in struct bnxt_re_db_region returns the raw
unmapped PCI BAR address of the doorbell region. Avoid sharing
this field to the userspace. Change this to a reserved field
and stop populating it, keeping the ABI layout and size
unchanged for existing binaries.

Fixes: 1234a9d8ae ("RDMA/bnxt_re: Support doorbell extensions")
Signed-off-by: Sriharsha Basavapatna <sriharsha.basavapatna@broadcom.com>
Link: https://patch.msgid.link/20260824172443.33943-1-sriharsha.basavapatna@broadcom.com
Reviewed-by: Selvin Xavier <selvin.xavier@broadcom.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
 2026-09-02 09:27:35 -04:00
Kan Liang
918b7d6d17 perf: Add sampling support for SIMD registers 
Users may be interested in sampling SIMD registers during profiling.
The current sample_regs_* structure does not have sufficient space
for all SIMD registers.

To address this, new attribute fields sample_simd_{pred,vec}_reg_* are
added to struct perf_event_attr to represent the SIMD registers that are
expected to be sampled.

Currently, the perf/x86 code supports XMM registers in sample_regs_*.
To unify the configuration of SIMD registers and ensure a consistent
method for configuring XMM and other SIMD registers, a new event
attribute field, sample_simd_regs_enabled, is introduced. When
sample_simd_regs_enabled is set, it indicates that all SIMD registers,
including XMM, will be represented by the newly introduced
sample_simd_{pred|vec}_reg_* fields. The original XMM space in
sample_regs_* is reserved for future uses.

Since SIMD registers are wider than 64 bits, a new output format is
introduced. The number and width of SIMD registers are dumped first,
followed by the register values. The number and width are based on the
user's configuration.

A new ABI, PERF_SAMPLE_REGS_ABI_SIMD, is added to indicate the new format.
The enum perf_sample_regs_abi is now a bitmap. This change should not
impact existing tools, as the version and bitmap remain the same for
values 1 and 2.

Additionally, two new __weak functions are introduced:
- perf_simd_reg_value(): Retrieves the value of the requested SIMD
  register.
- perf_simd_reg_validate(): Validates the configuration of the SIMD
  registers.

A new flag, PERF_PMU_CAP_SIMD_REGS, is added to indicate that the PMU
supports SIMD register dumping. An error is generated if
sample_simd_{pred|vec}_reg_* is mistakenly set for a PMU that does not
support this capability.

Suggested-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
Co-developed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://patch.msgid.link/20260824082731.1013973-13-dapeng1.mi@linux.intel.com
 2026-09-02 13:10:43 +02:00
Frederick Lawler
ab84c31441 configfs: move CONFIGFS_MAGIC definition to magic.h 
IMA shouldn't measure or appraise configfs, but currently does because
it's missing from the default exclusion policies. Move CONFIGFS_MAGIC to
magic.h to expose the file system's magic to IMA, as well as other userland
applications.

Suggested-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Frederick Lawler <fred@cloudflare.com>
Acked-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
 2026-09-01 22:28:55 -04:00
Linus Torvalds
a99d741df7 drm next/fixes for 7.3-rc1 
core:
 - use drm_warn instead of warn
 
 msm:
 - Bindings:
   - Added Shikra support
   - Document a840, a704, a722
 - Core:
   - Use drm_client buffers for fbdev emulation
   - teardown fixes
   - ARM32 DMA fixup
   - Remove objects from evict list when re-validated
   - Bunch of corner case and error path fixes
 - DPU:
   - Dropped dev_pm_opp_set_rate(0) preventing burnout
   - Fixed SSPP offsets of Kaanapali
 - DP:
   - Dropped dev_pm_opp_set_rate(0) preventing burnout
   - Cleaned up core code in preparation for MST support
   - Fixed prepare() to let Pipewire continue in case of the unplugged cable
 - GPU:
   - Add support for a704
   - Add support for a722
 - HDMI:
   - Simplifed register access
 
 amdgpu:
 - eGPU fixes
 - Runtime PM fix
 - UserQ fixes
 - Backlight fix
 - Discovery sysfs fix
 - Reset handling fixes
 - Buffer func handling fix for xgmi
 - VCN boundary check fix
 - DC lut handling fixes
 - MES fixes
 - UVD fix
 - VCE 3 fix
 - Enforce isolation fix
 - HPD fix for VGA/LVDS
 - DML fix
 - DCN 6 fixes
 - DC gpu reset fix
 
 amdkfd:
 - Fix return value
 - CU occupancy for GFX 11
 - CU occupancy for GFX 12/12.1
 - Queue bounds checking fix
 - SVM fixes
 - CRIU bounds checking fix
 
 radeon:
 - iMac display fix
 
 xe:
 - error message cleanups
 - i2c global register definitions as dependency for xe/i2c fixes
 - Media workardound
 - Add CCS to gt_idle debugfs print
 - Page fault related fix
 - i2c related fixes
 - System Controller mailbox bit fix
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmqR+2wACgkQDHTzWXnE
 hr5VPRAAhJpCnUEOUnhiBRfQB3lqHuKV4N9XQGVoaAZHYLxNkZD6I99ScpIznEr9
 sHG0ViBqz2PHyM2XoJzPZDzm8Us0moVUMMdV56IH7h11l8E7Az2Sd/Ji+AQvZEBT
 /qh9Py0/fjibfDm0ueMROFRhuD8RA2sJqzkGMZUBvErh+zmEQvkIDkIT6A5RpHD8
 B3XEGN+UCxPBzCnKNixyNDgY2i4ipFAe0MDj9+Mh0b9BM9BoV8+Eb7sjkBz+ROMH
 tl57Mjjd37FaYM9MgtEt9m7eOBf266V9Xb9tbIfqShwO1aZa0Vfzuih/3Ck53Nwc
 VkwepP7NHZZKFHIxFgcRCVjzyA3HpZJmLot8YYOyZDJOG6KKp2X0ZUFBog5Uiv8o
 7exd95FLUtIsnUtmLxlermOYJwrokgcVoigcalhLCB2+KZ5/BznutzcCSvrd8vI2
 LzEGnLMgzuEKeOmiWZjagID51TYwHfPogULUlwWT4XB62dKih7/uselCObj4m/Lc
 kRSbiXWz1pxisfiFRsK2GECwsbEb/8qOYgSOQBgppuPbSWpX+2P4IApomRBesQ8E
 Db+i6hptauOwT0/1ZBo8gkOfb0XIWsjg9iV6pVuUIS80hOlr7Zj1MR7mMrWgL0nM
 Chs4/Nq8jWU1ESbmKPBINIXCGOGuev4lJO/pBjfySLpTUhWOQcw=
 =wbEZ
 -----END PGP SIGNATURE-----

Merge tag 'drm-next-2026-08-29' of https://gitlab.freedesktop.org/drm/kernel

Pull more drm updates from Dave Airlie:
 "As mentioned last week, an msm pull request fell down the side of the
  couch or whatever the email equivalent of that is. This has the msm
  next stuff + the usual fixes for amd/intel.

  core:
   - use drm_warn instead of warn

  msm:
   - Bindings:
      - Added Shikra support
      - Document a840, a704, a722
   - Core:
      - Use drm_client buffers for fbdev emulation
      - teardown fixes
      - ARM32 DMA fixup
      - Remove objects from evict list when re-validated
      - Bunch of corner case and error path fixes
   - DPU:
      - Dropped dev_pm_opp_set_rate(0) preventing burnout
      - Fixed SSPP offsets of Kaanapali
   - DP:
      - Dropped dev_pm_opp_set_rate(0) preventing burnout
      - Cleaned up core code in preparation for MST support
      - Fixed prepare() to let Pipewire continue in case of the unplugged cable
   - GPU:
      - Add support for a704
      - Add support for a722
   - HDMI:
      - Simplifed register access

  amdgpu:
   - eGPU fixes
   - Runtime PM fix
   - UserQ fixes
   - Backlight fix
   - Discovery sysfs fix
   - Reset handling fixes
   - Buffer func handling fix for xgmi
   - VCN boundary check fix
   - DC lut handling fixes
   - MES fixes
   - UVD fix
   - VCE 3 fix
   - Enforce isolation fix
   - HPD fix for VGA/LVDS
   - DML fix
   - DCN 6 fixes
   - DC gpu reset fix

  amdkfd:
   - Fix return value
   - CU occupancy for GFX 11
   - CU occupancy for GFX 12/12.1
   - Queue bounds checking fix
   - SVM fixes
   - CRIU bounds checking fix

  radeon:
   - iMac display fix

  xe:
   - error message cleanups
   - i2c global register definitions as dependency for xe/i2c fixes
   - Media workardound
   - Add CCS to gt_idle debugfs print
   - Page fault related fix
   - i2c related fixes
   - System Controller mailbox bit fix"

* tag 'drm-next-2026-08-29' of https://gitlab.freedesktop.org/drm/kernel: (121 commits)
  drm/xe/sysctrl: Read mailbox phase bit from hardware
  drm/xe/i2c: Keep the i2c controller always enabled
  drm/xe/i2c: Fix the interrupt handling
  i2c: designware: Global register definitions
  drm/xe: Reject page faults from non-fault-mode scratch VMs
  drm/xe/xe_gt_idle: Add CCS to the powergating info print
  drm/xe: Do not apply WA 14025883347 to media 3503
  drm/amd/display: fix dc_lock leak on GPU reset error paths
  drm/amd/display: Fix redundant GPUVMEnable checks in dcn6 flip schedule
  drm/amd/display: Fix wrong bytes-per-pixel value for dml2_422_packed_10
  drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore
  drm/amdgpu/userq: fix lock missing for userq fence error set
  drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram
  drm/amdkfd: Fix error path at svm_migrate_copy_to_ram
  drm/amd/display: Log details when failing to register HPD IRQ
  drm/amd/display: Fix HPD consideration for VGA/LVDS connectors on DCE
  drm/amdgpu: clamp the isolation index for rings outside a partition
  drm/amdkfd: Reject zero-sized AQL queue allocations after size halving
  drm/amdgpu: Fix VCE 3 ring align_mask
  drm/kfd: Add CU occupancy support to GFX12.1
  ...
 2026-08-28 16:37:55 -07:00
Linus Torvalds
ce727a090b This pull request contains updates for UBI and UBIFS: 
UBI:
 - Support for a per-device wear-leveling threshold
 - Various fixes and cleanups of error paths
 - Correctly preserve torture flag up wear-leveling
 
 UBIFS:
 - Various fixes and cleanups of error paths and kernel-doc
 -----BEGIN PGP SIGNATURE-----
 
 iQJmBAABCABQFiEEdgfidid8lnn52cLTZvlZhesYu8EFAmqRnEsbFIAAAAAABAAO
 bWFudTIsMi41KzEuMTEsMiwyFhxyaWNoYXJkQHNpZ21hLXN0YXIuYXQACgkQZvlZ
 hesYu8HaKhAAuU11eCVhmQk9jpIdaOnFKwokE/PIj23SRz13jc7PWmFbAIHiaVt4
 0p1Xd59kPfdFqsfBo6ZgSr+f0cQu2N1MjzZYSmaklG5iJk2+IuMOIvNdve/GFzNg
 X86J7yxLtrCq+ULNNgGv0m89G/uYoFP27Su0rAid4D2T5gYEOisXpPw5AhAL6+bS
 FLRMlt0QWCAtb66FmSeDgTW042NPoSCZNOsxF35X9hQ6RxvftB8mbggmTummmlgb
 K9Nsuwkarterq7JhS4X+RL6aZG7yDPfHVpdCDD6Ui4W0SP59W0oSokikm1myw6Yg
 9NH67jUD03s0y/z3QaNiTVPuQXz5dpUyxGzK/FCT8y2aiycCDmwWF0VG8MVMhC0j
 TmNiuSWAljweaPSsgF176ISRG63++zwMGtz/JclVlkUwkVKYFbpEv5lcT0EzfCqh
 ahBlpM2aCLgJaYExd6LSVKEu0tT3+x+2MJDnRWcZM2OPMuL65IQw5V2lbdJN78Gb
 XFX6bfolhneptc2JwQKJx8E72iW7zuFovprTyS/J+TNcceFbfQTTcFt9EFZaXWnh
 +wiWm7rL7Xp9t8MA4Sc979oKFJMkAMl3Z6WTUHJWUZicX2hK+3OQaCVNO8LO/izu
 nPanrTeBnRiBKuAc5skQN5ywaAD3GgG/5ERWP/tdHkdsx34pcvuPnHQ=
 =+fCs
 -----END PGP SIGNATURE-----

Merge tag 'ubifs-for-linus-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs

Pull UBI and UBIFS updates from Richard Weinberger:
 "UBI:
   - Support for a per-device wear-leveling threshold
   - Various fixes and cleanups of error paths
   - Correctly preserve torture flag up wear-leveling

  UBIFS:
   - Various fixes and cleanups of error paths and kernel-doc"

* tag 'ubifs-for-linus-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs:
  UBI: support per-device wear-leveling threshold
  UBI: fix two issues in the ubi.mtd MODULE_PARM_DESC
  mtd: ubi: Release device reference on busy detach
  ubi: Fix rollback for explicit UBI device numbers
  ubifs: fix out-of-bounds read in signature length check
  UBI: fastmap: Pass to_be_tortured when reusing old fastmap PEBs
  UBI: Preserve torture flag when rescheduling failed erasures
  ubifs: ubifs.h: clean up kernel-doc comments
  ubifs: key.h: use correct function parameter name
  ubifs: debug.h: fix kernel-doc struct prototypes
 2026-08-28 10:59:07 -07:00
Linus Torvalds
115bd364ab f2fs-for-7.3-rc1 
In this round, key enhancements focus on reducing inode management memory
 overhead, introducing resizable tail sections with unified pinned allocation,
 and boosting I/O throughput via parallel multi-device flushes and asynchronous
 f2fs_write_end_io() execution. We also add dynamic device alias reservations to
 allow on-the-fly space donation from user partitions.
 
 Alongside these features, critical bug fixes resolve folio race conditions,
 lingering dirty flags, dentry and block counter leaks, and potential deadloops
 in f2fs_fsync_node_pages(). Additional stability patches address error-path
 handling across symlink, sync, and rename/unlink operations, prevent pinned file
 fragmentation, and correct segment migration and free section accounting in
 free_segment_range.
 
 Enhancement:
  - reduce memory footprint of ino management
  - support dynamic reserve/release for device aliasing
  - issue multi-device flushes in parallel
  - add a way to run f2fs_write_end_io() asynchronously
  - support resizable tail section and unify pinned allocation
 
 Bug fix:
  - fix to pass folio->index to f2fs_sanity_check_node_footer()
  - fix folio_nr_pages() race after put in large folio invalidate
  - fix to clear dirty flag on folio in error path
  - accurately adjust free_sections during free_segment_range
  - fix to avoid potential deadloop in f2fs_fsync_node_pages()
  - fix the error path in symlink, device alias in rename/unlink,
    f2fs_sync_fs,
  - fix to migrate all curseg types during free_segment_range
  - fix to avoid pinfile fragment on fragment:{block, segment} mode
  - fix valid block count leak on data block allocation failure
  - fix dentry folio leak in find_in_level
  - reject overlapping move range after len expansion
  - fix some bugs related to file pinning, GC functions, i_size.
 
 And, the series includes a number of minor bug fixes.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE00UqedjCtOrGVvQiQBSofoJIUNIFAmqPybMACgkQQBSofoJI
 UNKp2g/+OP6XZi56hNTqscnKyKrDdVJnOcS/YOe7d1BR+070qmPTpyFjLgjng05K
 exu55rz9vJ3DlpFLsjMEo60DRlDEc5rR4AqymMjqFJH9424ZlxPpdDn6ofCVT0Ck
 D6RTf3y1HFSi4x7//gPQofR9y4MlDrH2Q7NPDriipqbymuNXEjrx/vdr2nq/kHUu
 2lbf7QQs08qYiyDxQcxOFdCdxUTrsEW/tkYZiwgbU2nCJ/eG2R59amgtYJg3SlVt
 xdrf+IaSS7kE5+mGCoBm0WooPpB507kHaoQpZYDj2uueFvEw7nFcSfOCXapOvg8U
 wFkRR0F/rZ4+AW/u4n8Ye7N4a7WjWMTBwfR3WJ2j+arhfn87vJZK6LQQlYwq16l4
 tRcQFcCrKsXHh5HY2OGj8DzTd40zryXujH566YioBCAXU312My1yFjeTJzjobbUW
 TclkfMl689iTr9pqBhIjKT2tTvZFLROYSLk5UBNFNSfA4PtsAAhqlUrE1ck3AuTA
 8kIjLmppfZEBqVuZCF0T1z9TXk0Bg0eM8qHbl/8SdDavmf1pF1BupLqchfdZp6Jr
 4iV1weK4dzmCF6++YDsNlvnBGyTbhiFdN7C5cMlv89PTSTUQZ45Me6JmNwrRDqyU
 MSTyiSSpI+3rAMO0h58PHi+QAOtM0f+S7C24ySkBBerBCbMTK6A=
 =xQ77
 -----END PGP SIGNATURE-----

Merge tag 'f2fs-for-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs

Pull f2fs updates from Jaegeuk Kim:
 "In this round, key enhancements focus on reducing inode management
  memory overhead, introducing resizable tail sections with unified
  pinned allocation, and boosting I/O throughput via parallel
  multi-device flushes and asynchronous f2fs_write_end_io() execution.
  We also add dynamic device alias reservations to allow on-the-fly
  space donation from user partitions.

  Alongside these features, critical bug fixes resolve folio race
  conditions, lingering dirty flags, dentry and block counter leaks, and
  potential deadloops in f2fs_fsync_node_pages(). Additional stability
  patches address error-path handling across symlink, sync, and
  rename/unlink operations, prevent pinned file fragmentation, and
  correct segment migration and free section accounting in
  free_segment_range.

  Enhancements:
   - reduce memory footprint of ino management
   - support dynamic reserve/release for device aliasing
   - issue multi-device flushes in parallel
   - add a way to run f2fs_write_end_io() asynchronously
   - support resizable tail section and unify pinned allocation

  Bug fixes:
   - fix to pass folio->index to f2fs_sanity_check_node_footer()
   - fix folio_nr_pages() race after put in large folio invalidate
   - fix to clear dirty flag on folio in error path
   - accurately adjust free_sections during free_segment_range
   - fix to avoid potential deadloop in f2fs_fsync_node_pages()
   - fix the error path in symlink, device alias in rename/unlink,
     f2fs_sync_fs
   - fix to migrate all curseg types during free_segment_range
   - fix to avoid pinfile fragment on fragment:{block, segment} mode
   - fix valid block count leak on data block allocation failure
   - fix dentry folio leak in find_in_level
   - reject overlapping move range after len expansion
   - fix some bugs related to file pinning, GC functions, i_size

  And, the series includes a number of minor bug fixes"

* tag 'f2fs-for-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (51 commits)
  f2fs: support resizable tail section and unify pinned allocation
  f2fs: don't leave the hashed inode while it's unlinked
  f2fs: accurately adjust free_sections during free_segment_range
  f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages()
  f2fs: use adjusted write range after f2fs_write_checks()
  f2fs: fix to propagate error from f2fs_sync_fs()
  f2fs: return symlink writeback errors
  f2fs: fix error handling on device alias check in rename and unlink
  f2fs: fix to reset all pinned status during fggc
  f2fs: use f2fs_{down, up}_(read, write}_trace() for nat_tree_lock
  f2fs: reduce memory footprint of ino management
  f2fs: fix i_size when pinned fallocate partially fails
  f2fs: fix to migrate all curseg types during free_segment_range
  f2fs: avoid setting SBI_NEED_FSCK on transient resize failure
  f2fs: fix to avoid pinfile fragment on fragment:{block, segment} mode
  f2fs: cleanup w/ f2fs_need_rand_{blk, seg, seg_blk}
  f2fs: fix to shrink gc_lock coverage in f2fs_gc_range()
  f2fs: fix to reclaim space in f2fs_allocate_pinning_section()
  f2fs: unify add/remove ino entry API for all ino types
  f2fs: fix to zero post-EOF data when extending file size
  ...
 2026-08-28 10:48:48 -07:00
Linus Torvalds
1b78070aae Including fixes from Bluetooth, IPSec and Netfilter. 
Current release - fix to a fix:
 
  - netfilter: ipset: remove need to allocate memory on delete operations
 
 Current release - regressions:
 
  - macb: drop CONFIG_OF #if block, fix build
 
 Previous releases - always broken:
 
  - stream of fixes for SCTP continues
 
  - inet: frags: strip GSO state from fragments before reassembly
 
  - virtio-net: ensure that TCP packets don't overflow gso_segs
 
  - tcp-ao: fix use-after-free of current_key on reconnect to another peer
 
  - page_pool: remove zone/policy GFP flags when allocating XArray entries
 
  - Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN
 
  - tls: device: fix out-of-bounds write in tls_append_frag()
 
  - eth: bnxt:
    - ring the doorbell when SW USO exits early, avoid packets stuck in Tx
    - gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check, avoid users
      of older NICs seeing non-actionable warning messages
 
  - eth: qede: fix NULL pointer dereference in TPA fragment processing
 
 Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE6jPA+I1ugmIBA4hXMUZtbf5SIrsFAmqQojwACgkQMUZtbf5S
 Irv2kg//anC58qIya/Tx3BZkpPgtbS+ki0bqb+J0a8axbItgSGEdclVtiLJn/ex0
 zz9AR4Pt2DSbSUHPa7nRpdMQ2x7ZmNwNR2zqs1xClgOm5QD/2JAc53Pv81GaEKa4
 O4A4TDJZfyTDsk6c0cjI3yz9uMqBt2U6pyAT6JMBIPy7/MgV+as0ETAWQlezL0sF
 ZnXVg9tM3hG/8a3M88+/S1VODVJYLMucXS6pD1mqlry01SUj91elEXKiac5vCaHI
 DAZaiCOmv4WV3hs7941VijPchLO64L0J+0qjGRpXiPJXQEAn4XU8QX/YNc1njgZH
 tmjRWEEtLoBFcLRDUPAK9niuB5F9N3/6nnydLPLu16+exKQuCB8Bh78YHLmlrJIW
 utY5ek7GtPOl31M9a5TdEGLUg5wPHSO62FhiBmTiIG4PKQym616TmOHbYJWBqFry
 EPNtZ1vEJoPFNOsT1VdeD4DKVBq2UDnj/3fnphUhfvU5z+dEDdIn03+kQykwmVQT
 kTuMaW4/zxR3VFjHalsI+4bvhFOEmu+/KZE07aKKm99jssDsewQHGXgYJkCPWQUk
 gpnN8IVNw16ex9sfrvqje6/tshiPJJn9y/b/nGt5mq9ofgwXGmpzCPwcDgyzZKQ5
 y+zVPJ0/XILHAHOBxdCklim5xiaPDYKdEI+zcEXrx/g6FraZZuI=
 =1DXR
 -----END PGP SIGNATURE-----

Merge tag 'net-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Jakub Kicinski:
 "Including fixes from Bluetooth, IPSec and Netfilter.

  Current release - fix to a fix:

   - netfilter: ipset: remove need to allocate memory on delete operations

  Current release - regressions:

   - macb: drop CONFIG_OF #if block, fix build

  Previous releases - always broken:

   - stream of fixes for SCTP continues

   - inet: frags: strip GSO state from fragments before reassembly

   - virtio-net: ensure that TCP packets don't overflow gso_segs

   - tcp-ao: fix use-after-free of current_key on reconnect to another
     peer

   - page_pool: remove zone/policy GFP flags when allocating XArray
     entries

   - Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN

   - tls: device: fix out-of-bounds write in tls_append_frag()

   - eth: bnxt:
      - ring the doorbell when SW USO exits early, avoid packets stuck
        in Tx
      - gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check, avoid
        users of older NICs seeing non-actionable warning messages

   - eth: qede: fix NULL pointer dereference in TPA fragment processing"

* tag 'net-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (216 commits)
  inet: frags: strip GSO state from fragments before reassembly
  net/sched: sch_htb: limit htb_classify inner-class filter hops
  selftests/net: packetdrill: add tcp_urg_ptr_retransmit
  tcp: fix corruption of urgent data on multi-segment retransmit
  usb: atm: usbatm: fix invalid ci_range initialization
  net: fec: only stop PTP if it was initialized
  slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()
  net: bridge: mcast: fix use-after-free of a master VLAN's multicast context
  net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup
  net: dsa: mxl862xx: enable assisted learning on CPU port
  net: stmmac: restore NET_IP_ALIGN in the RX DMA offset
  net: stmmac: drop gso_enabled_types and rely on netdev features
  net: stmmac: selftests: Don't test flow control for small rx fifos
  net: stmmac: selftests: Account for the UC filter list for filtering tests
  net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering
  net: stmmac: dwmac4: Account for the primary MAC address for UC filtering
  net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering
  net: stmmac: selftests: Check multiple MMC counters
  selftests: net: Fix slow configurations in big_tcp_tunnels.sh
  selftests: net: Lower threshold with csum offload off in big_tcp_tunnels.sh
  ...
 2026-08-27 13:53:43 -07:00
Linus Torvalds
18fbf5151d mm.git review status for linus..mm-stable 
Everything:
 
 Total patches:       171
 Reviews/patch:       1.83
 Reviewed rate:       82%
 
 Excluding selftests:
 
 Total patches:       149
 Reviews/patch:       1.77
 Reviewed rate:       80%
 
 Excluding selftests and maple_tree:
 
 Total patches:       129
 Reviews/patch:       1.99
 Reviewed rate:       89%
 
 Summary of patch series in this merge:
 
 - "mm/rmap: index MAP_PRIVATE file-backed folios by anonymous pgoff"
   (Lorenzo Stoakes):
 
   Index MAP_PRIVATE file-backed folios by their anonymous page offset to
   resolve confusion around reverse mapping for zeroed and CoW'd
   file-backed memory.
 
   Use this new VMA anonymous page offset tracking to eliminate index
   conflicts and lay the foundation for scalable CoW performance
   improvements.
 
 - "promote mapped executable folios after first usage for MGLRU" (Baolin
   Wang):
 
   Make MGLRU's protection of mapped executable file folios more
   reliable.  Follow the classical LRU's logic, promoting mapped executable
   file folios after their first usage to give executable code a better
   chance to stay in memory and improve workload performance.
 
 - "mm: vmscan: fix node reclaim ignoring swappiness parameter" (Ridong Chen):
 
   Fix per-node proactive reclaim interface's ignoring the swappiness
   parameter when CONFIG_MEMCG is disabled by consolidating sc_swappiness()
   into a single function that checks proactive_swappiness regardless of
   kernel configuration.
 
 - "mm/vmscan: reduce lru_lock contention via vmstat-derived scan-balance
   cost" (Usama Arif):
 
   Reduce lru_lock contention in the reclaim path by deriving
   scan-balance costs from vmstat counters rather than lock-acquired
   producer updates.
 
   Read and decay these cost signals on the reclaim side under a
   dedicated per-lruvec lock, reducing total LRU lock wait time by over 60%
   without impacting scan throughput.
 
 - "zram: fix zram issues reported by sashiko" (Sergey Senozhatsky):
 
   Fix two low-risk zram bugs which Sashiko spotted in drive-by review.
 
 - "Honor XA_FLAGS_ACCOUNT in xas_split_alloc() and charge to folio's
   memcg" (Zi Yan):
 
   Fix xas_split_alloc() by enabling target folio memcg charging during
   splits and adding the missing __GFP_ACCOUNT flag for proper XArray node
   memory accounting.
 
 - "selftests/mm: use pattern matching in .gitignore" (Pratyush Mallick):
 
   Replace hardcoded binary names in selftests/mm/.gitignore with a
   generic pattern-matching rule to automatically ignore generated test
   files and avoid manual updates when adding new tests.
 
 - "mm/page_ext: remove pgdat_page_ext_init()" (Sang-Heon Jeon):
 
   Make the incompatibility between FLATMEM and NUMA explicit in
   mm/Kconfig and remove the unused pgdat_page_ext_init() function.
 
 - "zram: fix zstd error paths and add parameter validation" (Haoqin Huang):
 
   Clean up zram compression backends by removing redundant error
   cleanup, adding parameter and dictionary validation, auto-prefixing
   algorithm error logs, and resetting parameters prior to
   reinitialization.
 
 - "zram: fix stale scan bounds after reinitialization" (Longlong Xia):
 
   Prevent out-of-bounds slot accesses during concurrent zram resets by
   moving table scan bound calculations under dev_lock in writeback_store()
   and read_block_state().
 
 - "add anon mTHP collapse test cases" (Baolin Wang):
 
   Extend selftests helper functions to support arbitrary page orders and
   add new test cases and options for mTHP collapse in khugepaged.
 
 - "selftests/mm: Handle unsupported and transient test conditions"
   (Muhammad Usama Anjum):
 
   Update MM selftests to report a SKIP status instead of a failure when
   required kernel or filesystem features are unsupported, while adding
   retry logic for transient page migration errors.
 
 - "mm/zswap: Fixes and improves the zswap shrink" (Hao Jia):
 
   Fix the missing zswap global shrinker when CONFIG_MEMCG is disabled
   and extend shrink_memcg() to support batch writeback for improved
   writeback efficiency.
 
 - "alloc_tag: introduce IOCTL-based filtering for MAP" (Suren Baghdasaryan):
 
   Introduce an IOCTL-based binary interface for memory allocation
   profiling that enables kernel-side filtering before per-CPU counter
   aggregation.
 
   This eliminates the text-parsing overhead of /proc/allocinfo and
   provides up to a 20x speedup by transferring only filtered allocation
   data to userspace.
 
 - "better block swap batching and a different take on swap_ops v5"
   (Christoph Hellwig):
 
   Refactor block swap I/O to use swap_iocb for batching instead of
   single-bio requests and rebase the swap_ops interface, achieving faster
   swap throughput during kernel builds.
 
 - "mm: kmemleak: reduce transient false positives by confirming leaks"
   (Catalin Marinas):
 
   Reduce false-positive kmemleak reports by combining two kmemleak
   enhancements that add a second confirmation scan and a configurable
   minimum unreferenced scan count module parameter.
 
 - "mm: kmemleak: default min_unref_scans to 2 for verbose kernels"
   (Breno Leitao):
 
   Auto-scanning kernels can generate false-positive memory leak reports
   on single scans, so this patch defaults min_unref_scans to 2 when
   CONFIG_DEBUG_KMEMLEAK_VERBOSE is enabled to require a second confirming
   scan.
 
 - "swap_ops updates" (Christoph Hellwig):
 
   Batching I/O for synchronous swap devices causes performance
   regressions and filesystem-based swap suffers from double-indirection
   overhead.  This series resolves both issues by reintroducing per-folio
   writes for synchronous swap and allowing filesystems to directly export
   their own swap_ops.
 
 - "mm/khugepaged: several cleanups" (Nico Pache):
 
   khugepaged accumulated redundant state-checking patterns and outdated
   comments following mTHP integration.  Introduce dedicated helpers for
   PTE validation and event counting while refreshing the internal
   documentation.
 
 - "maple_tree: lock checking and clean ups" (Liam Howlett):
 
   Syzbot reports incorrectly blame memory management exit paths for
   locking bugs, maple tree erase operations risk allocation failures
   without gfp flags and internal documentation lacks clarity.
 
   Improve lock error detection, update docs, fix race and allocation
   edge cases and optimize erase allocations using a fallback to GFP_KERNEL
   | GFP_NOFAIL.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCao9nJQAKCRDdBJ7gKXxA
 jk/9AQDlfevYJuSJmzAI8bt8ISG+/TfXMtIZC/MdbHqtQVYWPQD8Cvm3DUZsdGB/
 Gloq/HBFuMPgE8p2pwUIthdgnTPNvAc=
 =c+Nb
 -----END PGP SIGNATURE-----

Merge tag 'mm-stable-2026-08-26-15-22' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Pull more MM updates from Andrew Morton:

 - "mm/rmap: index MAP_PRIVATE file-backed folios by anonymous pgoff"
   (Lorenzo Stoakes)

   Index MAP_PRIVATE file-backed folios by their anonymous page offset
   to resolve confusion around reverse mapping for zeroed and CoW'd
   file-backed memory.

   Use this new VMA anonymous page offset tracking to eliminate index
   conflicts and lay the foundation for scalable CoW performance
   improvements.

 - "promote mapped executable folios after first usage for MGLRU"
   (Baolin Wang)

   Make MGLRU's protection of mapped executable file folios more
   reliable. Follow the classical LRU's logic, promoting mapped
   executable file folios after their first usage to give executable
   code a better chance to stay in memory and improve workload
   performance.

 - "mm: vmscan: fix node reclaim ignoring swappiness parameter" (Ridong
   Chen)

   Fix per-node proactive reclaim interface's ignoring the swappiness
   parameter when CONFIG_MEMCG is disabled by consolidating
   sc_swappiness() into a single function that checks
   proactive_swappiness regardless of kernel configuration.

 - "mm/vmscan: reduce lru_lock contention via vmstat-derived
   scan-balance cost" (Usama Arif)

   Reduce lru_lock contention in the reclaim path by deriving
   scan-balance costs from vmstat counters rather than lock-acquired
   producer updates.

   Read and decay these cost signals on the reclaim side under a
   dedicated per-lruvec lock, reducing total LRU lock wait time by over
   60% without impacting scan throughput.

 - "zram: fix zram issues reported by sashiko" (Sergey Senozhatsky)

   Fix two low-risk zram bugs which Sashiko spotted in drive-by review.

 - "Honor XA_FLAGS_ACCOUNT in xas_split_alloc() and charge to folio's
   memcg" (Zi Yan)

   Fix xas_split_alloc() by enabling target folio memcg charging during
   splits and adding the missing __GFP_ACCOUNT flag for proper XArray
   node memory accounting.

 - "selftests/mm: use pattern matching in .gitignore" (Pratyush Mallick)

   Replace hardcoded binary names in selftests/mm/.gitignore with a
   generic pattern-matching rule to automatically ignore generated test
   files and avoid manual updates when adding new tests.

 - "mm/page_ext: remove pgdat_page_ext_init()" (Sang-Heon Jeon)

   Make the incompatibility between FLATMEM and NUMA explicit in
   mm/Kconfig and remove the unused pgdat_page_ext_init() function.

 - "zram: fix zstd error paths and add parameter validation" (Haoqin
   Huang)

   Clean up zram compression backends by removing redundant error
   cleanup, adding parameter and dictionary validation, auto-prefixing
   algorithm error logs, and resetting parameters prior to
   reinitialization.

 - "zram: fix stale scan bounds after reinitialization" (Longlong Xia)

   Prevent out-of-bounds slot accesses during concurrent zram resets by
   moving table scan bound calculations under dev_lock in
   writeback_store() and read_block_state().

 - "add anon mTHP collapse test cases" (Baolin Wang)

   Extend selftests helper functions to support arbitrary page orders
   and add new test cases and options for mTHP collapse in khugepaged.

 - "selftests/mm: Handle unsupported and transient test conditions"
   (Muhammad Usama Anjum)

   Update MM selftests to report a SKIP status instead of a failure when
   required kernel or filesystem features are unsupported, while adding
   retry logic for transient page migration errors.

 - "mm/zswap: Fixes and improves the zswap shrink" (Hao Jia)

   Fix the missing zswap global shrinker when CONFIG_MEMCG is disabled
   and extend shrink_memcg() to support batch writeback for improved
   writeback efficiency.

 - "alloc_tag: introduce IOCTL-based filtering for MAP" (Suren
   Baghdasaryan)

   Introduce an IOCTL-based binary interface for memory allocation
   profiling that enables kernel-side filtering before per-CPU counter
   aggregation.

   This eliminates the text-parsing overhead of /proc/allocinfo and
   provides up to a 20x speedup by transferring only filtered allocation
   data to userspace.

 - "better block swap batching and a different take on swap_ops v5"
   (Christoph Hellwig)

   Refactor block swap I/O to use swap_iocb for batching instead of
   single-bio requests and rebase the swap_ops interface, achieving
   faster swap throughput during kernel builds.

 - "mm: kmemleak: reduce transient false positives by confirming leaks"
   (Catalin Marinas)

   Reduce false-positive kmemleak reports by combining two kmemleak
   enhancements that add a second confirmation scan and a configurable
   minimum unreferenced scan count module parameter.

 - "mm: kmemleak: default min_unref_scans to 2 for verbose kernels"
   (Breno Leitao)

   Auto-scanning kernels can generate false-positive memory leak reports
   on single scans, so this patch defaults min_unref_scans to 2 when
   CONFIG_DEBUG_KMEMLEAK_VERBOSE is enabled to require a second
   confirming scan.

 - "swap_ops updates" (Christoph Hellwig)

   Batching I/O for synchronous swap devices causes performance
   regressions and filesystem-based swap suffers from double-indirection
   overhead. This series resolves both issues by reintroducing per-folio
   writes for synchronous swap and allowing filesystems to directly
   export their own swap_ops.

 - "mm/khugepaged: several cleanups" (Nico Pache)

   khugepaged accumulated redundant state-checking patterns and outdated
   comments following mTHP integration. Introduce dedicated helpers for
   PTE validation and event counting while refreshing the internal
   documentation.

 - "maple_tree: lock checking and clean ups" (Liam Howlett)

   Syzbot reports incorrectly blame memory management exit paths for
   locking bugs, maple tree erase operations risk allocation failures
   without gfp flags and internal documentation lacks clarity.

   Improve lock error detection, update docs, fix race and allocation
   edge cases and optimize erase allocations using a fallback to
   GFP_KERNEL | GFP_NOFAIL.

* tag 'mm-stable-2026-08-26-15-22' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (172 commits)
  selftests/proc: make proc-maps-race work with READ_IMPLIES_EXEC
  memcg: move LRU size accounting on reparenting instead of copying it
  mm/vmscan: fix comment logic in balance_pgdat
  maple_tree: add helper mas_make_walkable()
  maple_tree: avoid extra gap calculation
  maple_tree: fix argument name in header
  maple_tree: change two GFP flags in tests
  maple_tree: document erase and allocations better
  maple_tree: avoid mas_erase() and mtree_erase() failures
  maple_tree: document that erase may use GFP_KERNEL for allocations
  maple_tree: catch race in mas_alloc_cyclic()
  maple_tree: add bulk parent set helper
  maple_tree: micro optimisation of mas_wr_store_type()
  maple_tree: optimise mas_wr_node_store() when not in rcu mode
  maple_tree: use prefetched value in mas_wr_store_type()
  maple_tree: clarify comments on mas_nomem()
  maple_tree: drop MAPLE_ALLOC_SLOTS
  maple_tree: drop dead code from mas_extend_spanning_null()
  maple_tree: documentation fix
  maple_tree: add write lock checking with lockdep sequence numbers
  ...
 2026-08-27 09:17:06 -07:00
Linus Torvalds
7bb6284aa7 Arm: 
* Add support for 'slot' based PMU events, paired with new UAPI that
   compels the user to select a specific PMU implementation
 
 * Lazy save/restore of vCPU state for pKVM, along with various fixes
   and cleanups to the management of vCPU state between the untrusted
   host and pKVM hypervisor
 
 * Disable traps of EL1 registers for nested hypervisors when FEAT_NV2p1
   is present, guaranteeing that EL2-specific register bits are stateful
   in the EL1 counterpart
 
 * Leverage FEAT_NV3 to avoid unnecessary ERET/TLBI traps when the scope
   of those instructions remains 'in host' (i.e. L1 kernel/userspace)
 
 * Pile of fixes for the management of the VNCR pseudo-TLB, such as
   under-invalidations and races with concurrent TLBIs on other vCPUs
 
 * Consolidate the non-protected and pKVM view of ICH_VTR_EL2 to a
   runtime-patched constant, allowing the same data to be shared with
   pKVM prior to dropping host privileges
 
 * Considerable pile of LLM-assisted fixes around the shop but mostly in
   the VGIC, our in-kernel generator of bugs (and sometimes interrupts)
 
 LoongArch:
 
 * Advertise already-supported capabilities.
 
 * Some bug fixes about timer and MMIO.
 
 * Some hardening about interrupt injection.
 
 * Replace kvm_err() with kvm_pr_unimpl().
 
 * Add FPU/LSX/LASX test cases for selftests.
 
 RISC-V:
 
 * Svadu/Zicfiss/Zicfilp FWFT support for Guest
 
 * Use try_cmpxchg for IMSIC MRIF RMW
 
 * More arch-specific tracepoints in KVM RISC-V
 
 * Eager page splitting when enabling dirty logging
 
 * Optimize hfence request handling for SMP Guests
 
 * Improve dirty log clearing by skipping zero bits in mask
 
 * Guard HFENCE range loops against overflow
 
 * CPU PM notifiers in KVM RISC-V for non-retentive idle states
 
 * Fix kernel-mode vector context save/restore for Guest
 
 s390:
 
 * Fixes for vfio-ap
 
 * Fixes for the gmap rework
 
 * Fixes for vsie
 
 * AI triggered fixes all over
 
 * diag9c tracing
 
 * code move preparation for the additional arm64 support
 
 * enable CONTEXT_ANALYSIS
 
 x86:
 
 * Perform spring cleaning on x86.{c,h} and asm/kvm_host.h, by adding regs.c
   (the kvm_cache_regs.h => regs.h is already applied) and msrs.{c,h}, and moving
   relevant code out of x86.c.
 
 * Split kvm_mmu in three parts, respectively to describe the format of page
   tables, walking the guest page tables and building the page tables.  Always
   use the same page table walker kvm->arch.gva_walk as the entry point to
   convert a guest's virtual address, where the previous code used two
   different kvm_mmu structs depending on whether the walk included nested
   EPT/NPT or not.  Make page fault vmexits reuse the permission checking
   machinery that is used for guest page faults.  This is both a cleanup
   and a baby step towards supporting XS/XU memory permissions.
 
 * Document some of the "fun" gotchas with the APIC base when creating IRQCHIPs
   on x86.
 
 * Remove a defunct masterclock update from kvm_xen_shared_info_init().  It
   could result in incorrect kvmclock due to triggering an unnecessary
   switch to/from masterclock mode.
 
 * Skip Xen runstate time updates if time has effectively gone backwards, so
   that the guest doesn't report 100% steal time for a very, very long time.
 
 * Drop KVM's runtime updates of the Xen PV timing CPUID leaf, as KVM was
   updating the wrong sub-leaf, and upstream KVM will soon provide all the
   information needed by userspace to populate the CPUID field itself.
 
 * Fix a bug where KVM would walk a newly created rmap without holding the rmap
   lock (or mmu_lock) during aging.
 
 * Fix a bug where aging TDP MMU SPTEs could clobber FROZEN SPTEs.
 
 * Fix a variety of #DB priority bugs.
 
 * Fix a class of races related to enabling Hyper-V emulation on a vCPU after
   the vCPU is visible to the rest of KVM.
 
 * Use static calls for nested virtualization ops.
 
 * Move more KVM-internal code out of x86's kvm_host.h.
 
 * Enumerate support for a variety of Zhaoxin instructions that don't require
   explicit virtualization.
 
 * Fix missing EFER validation bugs, including in the KVM_SET_SREGS* path.
 
 * Harden kvm_vcpu_map() against double-mapping and thus leaking references.
 
 * Misc fixes and cleanups, e.g. for largely benign syzkaller splats.
 
 x86 (Intel):
 
 * Zero a vCPU's entry in VMX's Posted Interrupt Descriptor table used for IPI
   virtualization when the vCPU is freed, to fix a use-after-free where hardware
   will write to a freed vCPU's PID.
 
 * Service local TLB flushes on a failed nested VM-Enter to fix a bug where KVM
   could miss a TLB on a future, successful VM-Enter with the same L2 VPID.
 
 * Cap the maximum value shoved into the VMX Preemption Timer to workaround an
   erratum that affects all existing Intel CPUs that support CPUID 0x15.
 
 * Fix VPID virtualization bugs where KVM would fail to flush hardware TLBs.
 
 * Harden the TDX "populate" ioctls against bad input, and to prepare
   for supporting in-place private<=>shared conversion.
 
 x86 (AMD):
 
 * Forcefully invalidate SNP VMSA pages if their backing guest_memfd page is
   zapped/invalidated, e.g. due to a PUNCH_HOLE in response to a Page-State
   Change request.
 
 * Remove a dying VM from the GA Log notifier list before the VM is actually
   destroyed, to fix a potential use-after-free.
 
 * While FOLL_WRITE was needed in the past to trigger CoW unsharing, nowadays
   FOLL_LONGTERM does that already even without FOLL_WRITE, and in fact,
   get_user_pages() actually disallows FOLL_WRITE together with FOLL_LONGTERM.
   So don't pass FOLL_WRITE when registering encrypted memory regions, i.e. when
   pinning SEV/SEV-ES guest memory, to fix a regression with file-backed memory
   introduced by KVM's (correct) usage of long-term pins.
 
   (This was reviewed by mm maintainers; for more information, see commit
   ee1a586dd1).
 
 * Allocate full pages for SEV/SEV-ES {DE,EN}CRYPT ops on SNP-enabled hosts to
   fix a data corruption issue due to the PSP driver assigning to-be-written
   pages to firmware (as required by the SNP specs).
 
 * Unconditionally intercept ICBEP so that KVM generates the correct guest RIP
   when handling an ICEBP-induced TASK_SWITCH #VMEXIT.
 
 * Harden the SNP "populate" ioctls against bad input, and to prepare
   for supporting in-place private<=>shared conversion.
 
 Generic:
 
 * Remove kvm_debugfs_dir if kvm_init() fails after creating KVM's debugfs.
 
 * Add a per-VM bitmap to track which vCPU IDs have been "claimed" but for
   which the vCPU isn't yet online, and use the bitmap to reject duplicate IDs
   before calling into arch code.  This allows arch code to consume vcpu_id
   without having to worry about cross-vCPU clobbering (at least s390 and x86
   have had related bugs).
 
 * Rework the so called "prepare" and "invalidate" guest_memfd hooks to prepare
   for in-place private<=>shared conversion, and clean up a few warts along the
   way.
 
 Selftests:
 
 * Automatically allocate a full page for L2 guest stacks on x86 instead of
   requiring test-specific L1 guest code to carve out a portion of the L1
   stack for L2 usage, and to ensure the L2 stack also adheres to the x86-64
   calling convention ABI.
 
 * Add a selftest to verify {Guest,Host}-Only behavior in x86's mediated PMU.
 
 * Clean up nested SVM's handling of GPRs on L2<=>L1 transitions, reuse the
   functionality for nested VMX, and drop the ucall hack that was fudging
   around the lack of GPR switching on nVMX.
 
 * Add a stress test to verify KVM doesn't clobber/drop #PF state, e.g. CR2,
   across save/restore, including when L2 is active.
 
 * Add a test to verify KVM_CREATE_VM accepts exactly what is reported by
   KVM_CAP_VM_TYPES.
 
 * Misc selftests fixes and cleanups
 
 * Fix several issues with seeding the pRNG, and rework the pRNG APIs to that
   the pRNG can be sanely used in host code, not just guest code.
 
 * Add an IRQ test to validate virtual IRQ deliverty for IRQs wired up via
   KVM_IRQFD + KVM_SET_GSI_ROUTING, with optional support for triggering IRQs
   via writes to an assigned VFIO device.
 
 * Add syscall wrappers to assert success on a variety of pthreads and CPU
   affinity APIs.
 
 * Set vCPU pthread affinity as early as possible to reduce contention issues
   that were surfaced by PREEMPT_LAZY, which result in runtimes of over a
   minute on large hosts, versus the expected ~5 seconds.
 
 * Rework the PMU counters test to run each testcase using a single VM with
   many vCPUs for each sub-testcase, instead of using a unique VM for each
   sub-testcase.  This cuts the runtime by ~20x.
 
 Miscellaneous:
 
 * MAINTAINERS updates for vfio-ap, guest_memfd, kvm-x86.  Mostly representing
   the status quo more accurately, but also... welcome David Hildenbrand
   as guest_memfd reviewer!
 -----BEGIN PGP SIGNATURE-----
 
 iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmqMgosUHHBib256aW5p
 QHJlZGhhdC5jb20ACgkQv/vSX3jHroP8bwf+ORImBMDM3QEmybZM3I+N2+xqSuHP
 QHttbmqGbsFK/RUeH96/X/+P9waqaz3uVeUQ6Qp2r0ryqwKtLt8YvIxKDp+M0vVJ
 n+iukk1xulBEc28aGdKHn9G4wayAwDA/9f7CvJ23hojaJfLScbF3OlFkDd7y5DpO
 x15Rtg9folYUjjop3LDML4N9/9Qmk4KRvVZ4ZVv6IB4uGJJ72fLd5dbBMyDk+BLl
 Lz9N1xVTXcnJXJmrjMB4/QNt/HiQJdun8LcokJZyykta7Xx6aY7OGZv+VmCeq47K
 e9Hk8mD4AyAdVbVvIntROSeBJOrlsgWJXAPHea6wEdRQnS3XVEBuZC0yDA==
 =rfLh
 -----END PGP SIGNATURE-----

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

Pull kvm updates from Paolo Bonzini:
 "ARM64:

   - Add support for 'slot' based PMU events, paired with new UAPI that
     compels the user to select a specific PMU implementation

   - Lazy save/restore of vCPU state for pKVM, along with various fixes
     and cleanups to the management of vCPU state between the untrusted
     host and pKVM hypervisor

   - Disable traps of EL1 registers for nested hypervisors when
     FEAT_NV2p1 is present, guaranteeing that EL2-specific register bits
     are stateful in the EL1 counterpart

   - Leverage FEAT_NV3 to avoid unnecessary ERET/TLBI traps when the
     scope of those instructions remains 'in host' (i.e. L1
     kernel/userspace)

   - Pile of fixes for the management of the VNCR pseudo-TLB, such as
     under-invalidations and races with concurrent TLBIs on other vCPUs

   - Consolidate the non-protected and pKVM view of ICH_VTR_EL2 to a
     runtime-patched constant, allowing the same data to be shared with
     pKVM prior to dropping host privileges

   - Considerable pile of LLM-assisted fixes around the shop but mostly
     in the VGIC, our in-kernel generator of bugs (and sometimes
     interrupts)

  LoongArch:

   - Advertise already-supported capabilities

   - Some bug fixes about timer and MMIO

   - Some hardening about interrupt injection

   - Replace kvm_err() with kvm_pr_unimpl()

   - Add FPU/LSX/LASX test cases for selftests

  RISC-V:

   - Svadu/Zicfiss/Zicfilp FWFT support for Guest

   - Use try_cmpxchg for IMSIC MRIF RMW

   - More arch-specific tracepoints in KVM RISC-V

   - Eager page splitting when enabling dirty logging

   - Optimize hfence request handling for SMP Guests

   - Improve dirty log clearing by skipping zero bits in mask

   - Guard HFENCE range loops against overflow

   - CPU PM notifiers in KVM RISC-V for non-retentive idle states

   - Fix kernel-mode vector context save/restore for Guest

  s390:

   - Fixes for vfio-ap

   - Fixes for the gmap rework

   - Fixes for vsie

   - AI triggered fixes all over

   - diag9c tracing

   - code move preparation for the additional arm64 support

   - enable CONTEXT_ANALYSIS

  x86:

   - Perform spring cleaning on x86.{c,h} and asm/kvm_host.h, by adding
     regs.c (the kvm_cache_regs.h => regs.h is already applied) and
     msrs.{c,h}, and moving relevant code out of x86.c

   - Split kvm_mmu in three parts, respectively to describe the format
     of page tables, walking the guest page tables and building the page
     tables. Always use the same page table walker kvm->arch.gva_walk as
     the entry point to convert a guest's virtual address, where the
     previous code used two different kvm_mmu structs depending on
     whether the walk included nested EPT/NPT or not. Make page fault
     vmexits reuse the permission checking machinery that is used for
     guest page faults. This is both a cleanup and a baby step towards
     supporting XS/XU memory permissions

   - Document some of the "fun" gotchas with the APIC base when creating
     IRQCHIPs on x86

   - Remove a defunct masterclock update from kvm_xen_shared_info_init().
     It could result in incorrect kvmclock due to triggering an
     unnecessary switch to/from masterclock mode

   - Skip Xen runstate time updates if time has effectively gone
     backwards, so that the guest doesn't report 100% steal time for
     a very, very long time

   - Drop KVM's runtime updates of the Xen PV timing CPUID leaf, as KVM
     was updating the wrong sub-leaf, and upstream KVM will soon provide
     all the information needed by userspace to populate the CPUID field
     itself

   - Fix a bug where KVM would walk a newly created rmap without holding
     the rmap lock (or mmu_lock) during aging

   - Fix a bug where aging TDP MMU SPTEs could clobber FROZEN SPTEs

   - Fix a variety of #DB priority bugs

   - Fix a class of races related to enabling Hyper-V emulation on a
     vCPU after the vCPU is visible to the rest of KVM

   - Use static calls for nested virtualization ops

   - Move more KVM-internal code out of x86's kvm_host.h

   - Enumerate support for a variety of Zhaoxin instructions that don't
     require explicit virtualization

   - Fix missing EFER validation bugs, including in the KVM_SET_SREGS*
     path

   - Harden kvm_vcpu_map() against double-mapping and thus leaking
     references

   - Misc fixes and cleanups, e.g. for largely benign syzkaller splats

  x86 (Intel):

   - Zero a vCPU's entry in VMX's Posted Interrupt Descriptor table used
     for IPI virtualization when the vCPU is freed, to fix a
     use-after-free where hardware will write to a freed vCPU's PID

   - Service local TLB flushes on a failed nested VM-Enter to fix a bug
     where KVM could miss a TLB on a future, successful VM-Enter with
     the same L2 VPID

   - Cap the maximum value shoved into the VMX Preemption Timer to
     workaround an erratum that affects all existing Intel CPUs that
     support CPUID 0x15

   - Fix VPID virtualization bugs where KVM would fail to flush hardware
     TLBs

   - Harden the TDX "populate" ioctls against bad input, and to prepare
     for supporting in-place private<=>shared conversion

  x86 (AMD):

   - Forcefully invalidate SNP VMSA pages if their backing guest_memfd
     page is zapped/invalidated, e.g. due to a PUNCH_HOLE in response to
     a Page-State Change request

   - Remove a dying VM from the GA Log notifier list before the VM is
     actually destroyed, to fix a potential use-after-free

   - While FOLL_WRITE was needed in the past to trigger CoW unsharing,
     nowadays FOLL_LONGTERM does that already even without FOLL_WRITE,
     and in fact, get_user_pages() actually disallows FOLL_WRITE
     together with FOLL_LONGTERM. So don't pass FOLL_WRITE when
     registering encrypted memory regions, i.e. when pinning SEV/SEV-ES
     guest memory, to fix a regression with file-backed memory
     introduced by KVM's (correct) usage of long-term pins

     (This was reviewed by mm maintainers; for more information, see
     commit ee1a586dd1 "KVM: SEV: Drop FOLL_WRITE for encrypted region
     registration")

   - Allocate full pages for SEV/SEV-ES {DE,EN}CRYPT ops on SNP-enabled
     hosts to fix a data corruption issue due to the PSP driver
     assigning to-be-written pages to firmware (as required by the SNP
     specs)

   - Unconditionally intercept ICBEP so that KVM generates the correct
     guest RIP when handling an ICEBP-induced TASK_SWITCH #VMEXIT

   - Harden the SNP "populate" ioctls against bad input, and to prepare
     for supporting in-place private<=>shared conversion

  Generic:

   - Remove kvm_debugfs_dir if kvm_init() fails after creating KVM's
     debugfs

   - Add a per-VM bitmap to track which vCPU IDs have been "claimed" but
     for which the vCPU isn't yet online, and use the bitmap to reject
     duplicate IDs before calling into arch code. This allows arch code
     to consume vcpu_id without having to worry about cross-vCPU
     clobbering (at least s390 and x86 have had related bugs)

   - Rework the so called "prepare" and "invalidate" guest_memfd hooks
     to prepare for in-place private<=>shared conversion, and clean up a
     few warts along the way

  Selftests:

   - Automatically allocate a full page for L2 guest stacks on x86
     instead of requiring test-specific L1 guest code to carve out a
     portion of the L1 stack for L2 usage, and to ensure the L2 stack
     also adheres to the x86-64 calling convention ABI

   - Add a selftest to verify {Guest,Host}-Only behavior in x86's
     mediated PMU

   - Clean up nested SVM's handling of GPRs on L2<=>L1 transitions,
     reuse the functionality for nested VMX, and drop the ucall hack
     that was fudging around the lack of GPR switching on nVMX

   - Add a stress test to verify KVM doesn't clobber/drop #PF state,
     e.g. CR2, across save/restore, including when L2 is active

   - Add a test to verify KVM_CREATE_VM accepts exactly what is reported
     by KVM_CAP_VM_TYPES

   - Misc selftests fixes and cleanups

   - Fix several issues with seeding the pRNG, and rework the pRNG APIs
     to that the pRNG can be sanely used in host code, not just guest
     code

   - Add an IRQ test to validate virtual IRQ deliverty for IRQs wired up
     via KVM_IRQFD + KVM_SET_GSI_ROUTING, with optional support for
     triggering IRQs via writes to an assigned VFIO device

   - Add syscall wrappers to assert success on a variety of pthreads and
     CPU affinity APIs

   - Set vCPU pthread affinity as early as possible to reduce contention
     issues that were surfaced by PREEMPT_LAZY, which result in runtimes
     of over a minute on large hosts, versus the expected ~5 seconds

   - Rework the PMU counters test to run each testcase using a single VM
     with many vCPUs for each sub-testcase, instead of using a unique VM
     for each sub-testcase. This cuts the runtime by ~20x

  Miscellaneous:

   - MAINTAINERS updates for vfio-ap, guest_memfd, kvm-x86. Mostly
     representing the status quo more accurately, but also... welcome
     David Hildenbrand as guest_memfd reviewer!"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (413 commits)
  KVM: arm64: Validate GICv5 timer PPIs before claiming ownership
  KVM: arm64: vgic: Reject out-of-range GICv5 PPI IDs
  KVM: arm64: vgic: Prevent speculative SPI array underflow
  KVM: arm64: vgic: Free gic_kvm_info on initialization failure
  KVM: arm64: Avoid mismatched accesses to 'struct kvm_nvhe_init_params'
  s390/vfio-ap: Fix NULL deref in status_show() during queue probe
  s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed
  s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap
  s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove
  s390/vfio-ap: Fix required lock not held during update of ap_matrix_mdev object
  s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects
  s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL
  s390/vfio-ap: Fix stale do_remove flag across iterations in vfio_ap_mdev_cfg_remove
  RISC-V: KVM: fix vcpu vector context handling for kernel-mode vector
  riscv: vector: allow non-preemptible kernel-mode vector with IRQs off
  riscv: vector: refactor riscv_v_start_kernel_context
  KVM: s390: gmap: Make prefix handling optional
  KVM: s390: gmap: Make CMMA optional
  KVM: s390: gmap: Make storage keys optional
  KVM: s390: Prepare gmap for a second KVM implementation
  ...
 2026-08-25 11:48:04 -07:00
Linus Torvalds
70f5376dbd TTY / Serial driver updates for 7.3-rc1 
Here is the "big" set of tty and serial driver updates for 7.3-rc1.  Not
 really all that much happened this development cycle for this subsystem,
 changes in here are:
   - removal of the ipwireless driver as it's no longer used or needed
   - new 8250_mxpcie driver added
   - qcom serial driver updates and additions
   - vt mode validation addition
   - lots of other small serial driver updates and additions
 
 All of these have been in linux-next for weeks with no reported issues.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCao2mTw8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+yk34ACdFfyDYJ0n1JcdskTxdNMBSPRkj7UAoJtMC/2y
 jxCfyfkM18YIuwZD6CvO
 =MlfE
 -----END PGP SIGNATURE-----

Merge tag 'tty-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

Pull TTY / serial driver updates from Greg KH:
 "Here is the "big" set of tty and serial driver updates for 7.3-rc1.

  Not really all that much happened this development cycle for this
  subsystem, changes in here are:

   - removal of the ipwireless driver as it's no longer used or needed

   - new 8250_mxpcie driver added

   - qcom serial driver updates and additions

   - vt mode validation addition

   - lots of other small serial driver updates and additions

  All of these have been in linux-next for weeks with no reported issues"

* tag 'tty-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (97 commits)
  serial: imx: serialize imx_uart_ports[] lifetime
  tty: clear cdev pointer after cdev_add() failure
  tty: skip cdev_del() when no cdev is registered
  serial: core: clear freed pointers on uart_register_driver() failure
  serial: core: do fallible allocations before the console can be registered
  serial: 8250_mxpcie: implement rx_trig_bytes callbacks via MUEx50 RTL
  serial: 8250_mxpcie: introduce per-port private data structure
  serial: 8250: allow UART drivers to override rx_trig_bytes handling
  serial: 8250_mxpcie: add break support for RS485 using MUEx50 features
  serial: 8250: allow low-level drivers to override break control
  serial: 8250_mxpcie: support serial interface mode switching
  serial: 8250_mxpcie: speed up TX using memory-mapped FIFO window
  serial: 8250_mxpcie: speed up RX using memory-mapped FIFO window
  serial: 8250_mxpcie: add custom handle_irq callback
  serial: 8250_mxpcie: offload XON/XOFF flow control to MUEx50 hardware
  serial: 8250_mxpcie: enable automatic RTS/CTS flow control
  serial: 8250_mxpcie: enable enhanced mode and program FIFO trigger levels
  serial: 8250: add Moxa MUEx50 UART port type
  serial: 8250: split Moxa PCIe serial board support out of 8250_pci
  serial: qcom-geni: Use geni_se_set_perf_level() for baud rate perf level
  ...
 2026-08-25 10:59:12 -07:00
Linus Torvalds
f4d50813c0 USB / Thunderbolt changes for 7.3-rc1 
Here is the big set of USB and Thunderbolt driver updates for 7.3-rc1.
 
 Lots of driver work for new devices and systems, and many other minor
 fixes and updates.  Included in here are:
   - Thunderbolt subsystem driver updates and additions
   - typec driver updates and additions
   - usb gadget fixes all over the place, seems like people are finally
     paying attention to these drivers for some reason
   - xhci driver updates and fixes based on lots of reports
   - usb-serial driver updates and additions
   - new device ids
   - other minor USB driver updates and fixes
 
 All of these have been in linux-next for a while with no reported issues
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCao2lJA8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ynK3QCeLQdHatZ2d5sJdvssiLKREZeND4EAnj+V1K1O
 PcVJzKAiC4dgSZ5SOwn1
 =OJea
 -----END PGP SIGNATURE-----

Merge tag 'usb-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB / Thunderbolt updates from Greg KH:
 "Here is the big set of USB and Thunderbolt driver updates for 7.3-rc1.

  Lots of driver work for new devices and systems, and many other minor
  fixes and updates. Included in here are:

   - Thunderbolt subsystem driver updates and additions

   - typec driver updates and additions

   - usb gadget fixes all over the place, seems like people are finally
     paying attention to these drivers for some reason

   - xhci driver updates and fixes based on lots of reports

   - usb-serial driver updates and additions

   - new device ids

   - other minor USB driver updates and fixes

  All of these have been in linux-next for a while with no reported issues"

* tag 'usb-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (163 commits)
  usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()
  usb: typec: hd3ss3220: fix VBUS regulator error message
  usb: usbfs: fix use-after-free of usb_device in usbdev_release()
  usb: gadget: u_audio: Fix use-after-free on sound card disconnect
  usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition
  usb: gadget: f_tcm: keep port count until LUN teardown completes
  usb: usbtest: disable dynamic ID support
  usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive()
  USB: c67x00: fix use-after-free in c67x00_add_iso_urb()
  usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion
  usb: gadget: snps_udc_plat: clean up PHY on probe deferral
  usb: gadget: f_tcm: fix deadlock in usbg_make_tpg()
  usb: dwc2: gadget: Exit partial power down state when changing USB pull-up
  usb: gadget: f_fs: Fix Use-After-Free in AIO error path
  usb: gadget: f_fs: Prevent deadlock during ep0 read loop
  usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed
  usb: gadget: midi2: remove default configfs groups on teardown
  usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init()
  usb: typec: thunderbolt: Disable work before freeing tbt on remove
  usb: xhci: Handle bogus TRB pointers in Missed Service Error events
  ...
 2026-08-25 10:44:46 -07:00
Linus Torvalds
93e4b3076b Char/Misc/IIO/etc driver update for 7.3-rc1 
Here is the big set of char, misc, iio, counter, fpga, and other small
 driver subsystems for 7.3-rc1.
 
 Overall, due to some driver removals we only added a bit more code than
 removed, which was a nice change.  Highlights in this merge request are:
   - Loads of IIO driver updates and additions
   - binder driver updates (more on that below...)
   - Removal of the SGI XP and GRU drivers as they are not used anymore
     and turn out to be pretty insecure overall
   - Removal of the obsolete ibmasm driver as it's not being used anymore
   - Coresight driver updates and additions
   - Mei driver udpates
   - Counter driver updates
   - FPGA driver updates
   - ICC driver updates
   - lots and lots of other tiny driver updates to resolve reported
     issues
 
 All of these have been in linux-next for a while, with the only reported
 issues being some major merge conflicts.  Miguel pointed out some of
 these with the Rust tree merge, which is the majority of them.  I'll
 follow up with a diffstat of the merge resolution I made against your
 most recent tree, which works for me.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCao143A8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ymtUgCeKB62gT1JfA86cg3NDB1opp+10N0An3oBBegQ
 IJLqJgK45dTNtMGBwGFV
 =68af
 -----END PGP SIGNATURE-----

Merge tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

Pull char/misc/IIO/etc driver updates from Greg KH:
 "Here is the big set of char, misc, iio, counter, fpga, and other small
  driver subsystems for 7.3-rc1.

  Overall, due to some driver removals we only added a bit more code
  than removed, which was a nice change. Highlights in this merge
  request are:

   - Loads of IIO driver updates and additions

   - binder driver updates (more on that below...)

   - Removal of the SGI XP and GRU drivers as they are not used anymore
     and turn out to be pretty insecure overall

   - Removal of the obsolete ibmasm driver as it's not being used
     anymore

   - Coresight driver updates and additions

   - Mei driver udpates

   - Counter driver updates

   - FPGA driver updates

   - ICC driver updates

   - lots and lots of other tiny driver updates to resolve reported
     issues

  All of these have been in linux-next for a while"

* tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (513 commits)
  iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF
  iio: adc: pac1921: fix wrong channel used in trigger handler read
  iio: light: gp2ap002: re-enable irq if runtime suspend fails
  iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes
  iio: light: apds9306: fix PM reference leak in apds9306_read_data()
  iio: gyro: mpu3050: fix sign of raw angular velocity readings
  iio: srf04: fix pm_runtime handling on probe error path
  iio: adc: ad4080: configure backend data size
  iio: adc: adi-axi-adc: add data size support for AD408X backend
  iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable
  iio: dac: ad5446: fix OF module device table
  iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask
  iio: light: opt4001: Reject integration times with a non-zero seconds part
  iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem()
  iio: light: opt4001: Fix power down clearing bits of the wrong register
  iio: light: opt4060: Fix incorrect register name in threshold read error message
  iio: light: opt4060: Fix pointer type passed to div_u64_rem()
  iio: light: opt4060: Reject integration times with a non-zero seconds part
  iio: light: ltrf216a: fix runtime PM reference leak in error path
  iio: pressure: dps310: fix NULL pointer dereference on ACPI probe
  ...
 2026-08-25 09:38:50 -07:00
Linus Torvalds
9cebfe6504 fuse update for 7.3 
-----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQSQHSd0lITzzeNWNm3h3BK/laaZPAUCao1RzQAKCRDh3BK/laaZ
 PJ2EAP9dfslni4sFYqtXv/43Wk2iVwwdGRRSy5Tfoq8nCeNXpQEAygIv9BuJYpl6
 DL861AOn/NfDBXpeU0vX4WQpTgtFIgc=
 =Av0t
 -----END PGP SIGNATURE-----

Merge tag 'fuse-update-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse

Pull fuse updates from Miklos Szeredi:

 - Improve performance of the io-uring transport by introducing buffer
   pools and zero-copy (Joanne)

 - Fix lots of bugs (Baokun Li)

 - Fix io-uring initialization issues (Joanne, Bernd)

 - More prep work for large folios (Joanne)

 - Don't limit buffered read to 128k (Jim Harris)

 - Fix zeroing of page end (dirtied with mmap) on file size extension
   (Jimmy Zuber)

 - Improve performance in certain cases with wake_up_sync() when queuing
   request (Xuewen Yan)

 - Misc fixes and cleanups (Xuewen Yan)

* tag 'fuse-update-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse: (35 commits)
  fuse: zero the partial EOF page when extending a file
  io_uring: Add missing include for ITER_SOURCE and ITER_DEST
  fuse: Fix the condition to enable over-io-uring
  fuse: invalidate the correct range after O_APPEND direct write
  selftests/fuse: test post-EOF page zeroing when a file is extended
  fuse: wake one waiter per freed slot when raising max_background
  fuse: use min_not_zero() in fuse_init_server_timeout()
  fuse: copy request headers via a stack buffer for io-uring
  fuse: give wakeup hints to the scheduler for synchronous requests
  fuse: check for NULL root inode in fuse_fill_super_submount
  fuse: reject a duplicate fd= mount option
  cuse: wait for pending RCU callbacks on module exit
  fuse: fix invalidate lock leak on open O_TRUNC DAX failure
  fuse: fix invalidate lock leak on setattr writeback failure
  fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free
  fuse: make dentry_tree_work static
  docs: fuse: document io-uring buffer pool and zero-copy uapi
  fuse: add zero-copy over io-uring
  fuse: support registered buffer pools in io-uring
  fuse: add io-uring buffer pools
  ...
 2026-08-25 07:59:44 -07:00
Abhishek Bapat
33588e0b81 alloc_tag: add accuracy based filtering to ioctl 
Extend the allocinfo filtering mechanism to allow users to filter tags
based on their accuracy.

[abhishekbapat@google.com: move `inaccurate` filtering criteria from `struct allocinfo_tag` to `struct allocinfo_filter`]
  Link: https://lore.kernel.org/e4e49ec4a5960292aeeb9e196526c18dc95228a2.1785867739.git.abhishekbapat@google.com
Link: https://lore.kernel.org/396a5e4bc3b2990223ab355f2cd3ceb6aa15499e.1783532853.git.abhishekbapat@google.com
Signed-off-by: Abhishek Bapat <abhishekbapat@google.com>
Acked-by: Hao Ge <hao.ge@linux.dev>
Acked-by: Suren Baghdasaryan <surenb@google.com>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Kent Overstreet <kent.overstreet@linux.dev>
Cc: Sourav Panda <souravpanda@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 2026-08-24 18:43:13 -07:00
Abhishek Bapat
6f6769ea88 alloc_tag: add size-based filtering to ioctl 
Extend the allocinfo filtering mechanism to allow users to filter tags
based on the total number of bytes allocated [min_size, max_size].  The
size range is inclusive.

Filtering by size involves retrieving allocinfo per-CPU counters, which is
an expensive operation.  Hence, the performance of size-based filtering
will be worse than other filters.

Link: https://lore.kernel.org/0a7653b70ae0d64e967fbea0e933bc35f8ac656e.1783532853.git.abhishekbapat@google.com
Signed-off-by: Abhishek Bapat <abhishekbapat@google.com>
Acked-by: Hao Ge <hao.ge@linux.dev>
Acked-by: Suren Baghdasaryan <surenb@google.com>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Kent Overstreet <kent.overstreet@linux.dev>
Cc: Sourav Panda <souravpanda@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 2026-08-24 18:43:12 -07:00
Abhishek Bapat
5732a4e4c1 alloc_tag: add ioctl filters to /proc/allocinfo 
Extend the capability of the IOCTL mechanism to filter allocations based
on tag's module name, function name, file name and line number.

Link: https://lore.kernel.org/6a6100c0c58cb2911f39126b9fe177a8c17db16f.1783532853.git.abhishekbapat@google.com
Signed-off-by: Abhishek Bapat <abhishekbapat@google.com>
Acked-by: Hao Ge <hao.ge@linux.dev>
Acked-by: Suren Baghdasaryan <surenb@google.com>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Kent Overstreet <kent.overstreet@linux.dev>
Cc: Sourav Panda <souravpanda@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 2026-08-24 18:43:12 -07:00
Suren Baghdasaryan
1d581ab234 alloc_tag: add ioctl to /proc/allocinfo 
Patch series "alloc_tag: introduce IOCTL-based filtering for MAP", v8.

Currently, memory allocation profiling data is primarily exposed through
/proc/allocinfo.  While useful for manual inspection, this text-based
interface poses challenges for production monitoring and large-scale
analysis:

1. Userspace must parse large amounts of text to extract specific
fields.
2. To find specific tags, userspace must read the entire dataset,
requiring many context switches and high data copying.
3. The kernel currently aggregates per-CPU counters for every allocation
size, even those the user intends to filter out immediately.

This series introduces a new IOCTL-based binary interface for allocinfo
that supports kernel-side filtering.  By allowing the user to specify a
filter mask, we significantly reduce the work performed in-kernel and the
amount of data transferred to userspace.  The IOCTL mechanism was chosen
for allocinfo to address the per-CPU counter aggregation bottleneck.  A
traditional read() operation must report the total allocation count and
sizes for every code tag in the system.  Doing so requires iterating
across all CPUs to sum their per-CPU counters for thousands of tags, which
introduces substantial runtime overhead.

The IOCTL interface allows userspace to push selective filtering criteria
directly into the kernel before the per-CPU counter aggregation.  The
kernel aggregates per-CPU counters only for a small subset of tags that
match the filter.  This results in significant performance improvement.

Beyond fast filtered retrieval, the IOCTL foundation allows introducing a
context capture mechanism in the future to capture the context for
specific allocations.

Performance measurements were conducted on an Intel Xeon Platinum 8481C
(224 CPUs) with caches dropped before each run.

The IOCTL mechanism shows a ~20x performance improvement for
filtered queries. The kernel avoids the expensive per-CPU counter
aggregation (alloc_tag_read) for any tags that fail the initial string
or location filters.

Scenario 1: Specific File Filtering (arch/x86/events/rapl.c)
1. Traditional (cat /proc/allocinfo | grep): 22ms (sys)
2. IOCTL Interface: 1ms (sys)

Scenario 2: Compound Filtering (Filename + Size)
1. Traditional: (cat ... | grep | awk): 21ms (sys)
2. IOCTL Interface: 1ms (sys)

Scenario 3: Size-Based Filtering (min_size = 1MB)
1. Traditional: (cat ... | awk): 21ms (sys)
2. IOCTL Interface: 14ms (sys)


This patch (of 6):

Add the following ioctl commands for /proc/allocinfo file:

ALLOCINFO_IOC_CONTENT_ID - gets content identifier which can be used to
check whether the file content has changed specifically due to module
load/unload.  Every time a module is loaded / unloaded, the returned value
will be different.  By comparing the identifier value at the beginning and
at the end of the content retrieval operation, users can validate
retrieved information for consistency.

ALLOCINFO_IOC_GET_AT - gets the record at the specified position.  This is
the position of a record in /proc/allocinfo.

ALLOCINFO_IOC_GET_NEXT - gets the record next to the last retrieved one. 
If no records were previously retrieved, returns the first record.

Note, function file and module names often have the same prefixes,
therefore when filtering for them, we compare the last 64 characters to
minimize the chances of name collisions.

[akpm@linux-foundation.org: include compat.h, per Suren]
  Closes: https://lore.kernel.org/oe-kbuild-all/202607091820.qbjlGhKK-lkp@intel.com/
Link: https://lore.kernel.org/cover.1783532853.git.abhishekbapat@google.com
Link: https://lore.kernel.org/15596de2607ef13e7c77c6d74763f4ae992ec475.1783532853.git.abhishekbapat@google.com
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Signed-off-by: Abhishek Bapat <abhishekbapat@google.com>
Acked-by: Hao Ge <hao.ge@linux.dev>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Kent Overstreet <kent.overstreet@linux.dev>
Cc: Sourav Panda <souravpanda@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 2026-08-24 18:43:12 -07:00
Stanislav Fomichev
bd7d30bd1d xsk: align TX metadata layout across ABIs 
Add explicit padding before launch_time so xsk_tx_metadata has the same
layout on 32-bit and 64-bit systems.

On several architectures (csky, i386, nios2, m65k, openrisc, sh), the old
native 32-bit layout put launch_time at offset 12 and had a natural size of
20 bytes. Using sizeof(struct xsk_tx_metadata) as tx_metadata_len was already
rejected because the length must be a multiple of eight, so the
straightforward use of the interface was broken on those ABIs. Userspace
could still register a padded length of 24 bytes, though; mixing the old and
new layouts then silently reads launch_time from the wrong offset and
misprograms packet launch times. This intentionally replaces that
incompatible layout because the affected architectures are unlikely to
have any notable users. (x86_64 and arm64 have the most users and are _not_
affected)

Fixes: ca4419f15a ("xsk: Add launch time hardware offload support to XDP Tx metadata")
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Stanislav Fomichev <sdf@fomichev.me>
Link: https://patch.msgid.link/20260819160535.1472459-2-sdf@fomichev.me
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2026-08-24 11:11:59 -07:00
Linus Torvalds
5b05bb3f6c platform-drivers-x86 for v7.3-1 
Highlights:
 
 - amd/halo: Add Halo RGB LED driver
 
 - amd/hsmp:
   - Properly serialize probe, remove, and data paths
   - Add support for protocol v7 used by Family 1AH Model 80H
   - Fix error checking corner cases (largely from AI review)
   - Reject negative power cap
 
 - amd/pmc:
   - Improve behavior on platforms that do not support STB
   - Add T14 Gen2 AMD (20XL) to s2idle quirk list
 
 - amd/pmf:
   - Add ioctl interface to retrieve device metrics
   - Add support for new metrics tables used by Family 1AH Model 80H
 
 - arm64: qcom-hamoa-ec: Reject short responses
 
 - asus-nb-wmi: Support ProArt key on ASUS ProArt PX13
 
 - asus-armoury:
   - Gate PPT writes behind active fan curve
   - Add power limits for more models
 
 - dell-wmi-base: Fix handling of ultra performance key
 
 - dell-wmi-sysman: Don't hex dump attribute security buffer
 
 - hp-bioscfg:
   - Various fixes
   - Improve reduced ACPI packages support (necessary for HP EliteBook 840 G2)
 
 - lg-laptop:
   - Fix LED resource handling
   - Add support for events used in newer models
   - Fix keyboard backlight support on LG Gram 16T90SP
 
 - hp-wmi:
   - Generalize thermal params to board params
   - Manage CPU and GPU PWM independently
   - Add GPU MUX switch support
   - Add Victus 15-fb0xxx support
   - Add OMEN MAX 16-ak0xxx, OMEN 16-n0xxx, OMEN 16-wd0xxx, OMEN
     16-wf0xxx, and OMEN board ID 8D88 support
   - Add OMEN Transcend 16-u0xxx support
 
 - huawei: Add support for Fn-lock ACPI interface found on newer Huawei
           laptops such as MateBook 14 2024
 
 - ISST:
   - Improve input validation (many fixes)
   - Disallow SST-CP (core-power) feature if perf profile add fails
 
 - lenovo/yb9-kbdock: Add driver for Yoga Book 9 14IAH10
 
 - lenovo/ymc:
   - Extend hinge switch query to support Yoga 9 2-in-1 14IPH11
   - Prevent loading on Yoga Book 9 14IAH10 to avoid duplicated input
     nodes
 
 - msi-ec: Add MSI Raider A18 HX A9WJG and MSI Katana GF76 11UEK support
 
 - msi-wmi: Add MSI Claw M-Center keys support
 
 - oxpec: Add support for OneXPlayer X2 Mini Pro
 
 - redmi-wmi: Report kbd backlight cycle, OEM preset power mode, and FnLock
              toggle events to userspace
 
 - samsung-galaxybook: Add Samsung Galaxy Book6 Pro support
 
 - thinkpad_acpi: Add USB-C Security support
 
 - uniwill-laptop:
   - Add keyboard backlight, AC auto boot, and USB powershare support
   - Add MACHENIKE L16 Pro, AiStone X4SP4NAL, and Avell A60 MUV support
   - Make lightbar max brightness configurable and add support for
     LAPQC71A/B
 
 - Major refactoring efforts:
   - Stop setting acpi_device_name/class() and pnp.device_class to
     faciliate their eventual removal
 
 - Many rollback/remove path fixes (presumably mostly found by AI)
 
 - Miscellaneous cleanups / refactoring / improvements
 
 The following is an automated shortlog grouped by driver:
 
 acer-wmi:
  -  reject missing gaming WMI results
 
 amd/hsmp:
  -  ACPI HSMP refcounted sockets and coordinated release
  -  Add HSMP messages for Family 1Ah, Model 50h-5Fh
  -  Add IOCTL_GET_TELEMETRY_DATA for metric table reads
  -  Clear mdev.this_device on deregister
  -  Enable protocol version 7 metric tables on the ACPI driver
  -  Gate the data plane on a fully initialized socket
  -  Map the metric table with ioremap() and unmap it explicitly
  -  Pass struct device explicitly to ACPI mailbox parsers
  -  Reject negative power cap writes in hwmon
  -  Serialize ACPI HSMP probe and remove with an rwsem
  -  Serialize per-socket metric table reads with a mutex
  -  Serialize the data plane against socket teardown
  -  Source metric-table size from firmware
  -  Unify response_sz validation to an upper-bound check
  -  Validate ACPI UID before parsing socket index
  -  Validate _DSD mailbox sub-package element count
 
 amd:
  -  Introduce Halo Box RGB LED driver
 
 amd/pmc:
  -  Add T14 Gen2 AMD (20XL) to s2idle quirk list
  -  Do not fail probe when STB init fails
  -  Fix LPS0 and debugfs leaks when STB init fails
  -  Fix msg_port restoration in amd_stb_debugfs_open_v2()
  -  Only expose stb_read after telemetry buffer is mapped
  -  Propagate SMU errors and validate S2D address
  -  Restore msg_port on amd_stb_s2d_init() error paths
 
 amd/pmf:
  -  Add 1AH_M80H device IDs and extended SMU mailbox registers
  -  Add 1AH_M80H metrics table and NPU metrics support
  -  Add missing newline in dev_err message
  -  Add util layer and userspace character device interface
  -  Implement util layer ioctl handler
  -  Introduce AMD PMF testing tool for driver metrics and features
  -  Move debug helper functions to UAPI header
  -  Move metrics code to dedicated file
  -  Refactor NPU metrics for platform extensibility
  -  store BIOS output values for user-space metrics via util IOCTL
  -  Store commonly used enums in the header file
  -  Use per-SoC smu_regs struct for SMU mailbox registers
  -  Use upper/lower_32_bits() in amd_pmf_set_dram_addr()
 
 arm64: qcom-hamoa-ec:
  -  reject incomplete responses
 
 asus-armoury:
  -  Add power limits for ROG Strix SCAR 16 (G635LX)
  -  Add power limits quirk for FA401KM
  -  Add power limits quirk for FA608WV
  -  add support for FX517ZR
  -  add support for HN7306EA and HN7306EAC
  -  fix Use-After-Free and memory leak in driver init
  -  gate PPT writes behind active fan curve
  -  use cleanup.h to manage tunables
 
 asus-laptop:
  -  Stop setting acpi_device_name/class()
 
 asus-nb-wmi:
  -  map ProArt key (0x8b) to KEY_PROG3
 
 asus-wireless:
  -  Fail probe when there is no ACPI match
 
 asus-wmi:
  -  fix resource leaks on probe failure
 
 dell-ddv:
  -  Use no_free_ptr() to simplify error handling
 
 dell-privacy:
  -  Fix race condition
 
 dell-smbios:
  -  Pass device to callbacks
 
 dell-smbios-wmi:
  -  Fix chardev resource management
  -  Replace global list with single item
 
 dell-wmi-base:
  -  Fix handling of ultra performance key
  -  Fix resource leak on module load failure
 
 dell-wmi-sysman:
  -  Don't hex dump attribute security buffer
  -  Fix instance ID bounds
 
 Documentation/ABI:
  -  add testing entry for AMD PMF character device interface
 
 eeepc-laptop:
  -  Stop setting acpi_device_name/class()
 
 fujitsu-laptop:
  -  Stop setting acpi_device_name/class()
 
 fujitsu-tablet:
  -  Stop setting acpi_device_name/class()
 
 hp-bioscfg:
  -  accept reduced ACPI packages from older HP BIOS
  -  advance elem past consumed array elements
  -  bound ordered-list parsing by the package count
  -  fix heap OOB read in sk_store() and kek_store()
  -  fix heap OOB read on empty password write
  -  fix new_password_store() overwriting current_password
  -  fix off-by-one write in hp_get_string_from_buffer()
  -  fix ORD_LIST_ELEMENTS never being parsed
  -  fix password encoding bounds check
  -  pass validated element count to package parsers
  -  warn on element type mismatch instead of failing
 
 hp-wmi:
  -  Add dual-channel PWM fan control
  -  Add GPU MUX switch support
  -  Add OMEN board 8A43 thermal profile support
  -  Add OMEN board 8BA9 thermal profile support
  -  Add OMEN board 8BAA thermal profile support
  -  Add OMEN board 8D88 thermal profile support
  -  Add OMEN Transcend 16 8BB3 support
  -  Add support for OMEN MAX 16-ak0xxx (8DD6)
  -  Add Victus 15-fb0xxx support
  -  Drive fan control from board data
  -  Introduce board-specific feature data
 
 huawei-wmi:
  -  add ACPI fallback for Fn-lock on newer models
 
 ideapad-laptop:
  -  Fix driver unregistration order
 
 int1092:
  -  Fix info leak in parse_package()
  -  Fix potential memory leak in sar_probe()
 
 intel/pmc:
  -  initialize empty PMT read result
 
 ishtp_eclite:
  -  Fix ACPI device reference leak in probe error path
 
 ISST:
  -  Add a NULL check for sst_inst[]
  -  Just allow 2 bits for SST feature enable
  -  Return error during profile addition
  -  Use PP level enable mask
  -  Validate level in perf mask ioctls
  -  Validate logical CPU id and clos id
  -  Validate max level for set feature
  -  Validate parameter for core power state
  -  Validate parameter for frequency and priority
  -  Validate socket ID in clos_assoc ioctl
 
 lenovo:
  -  Add Yoga Book 9 keyboard dock detection driver
 
 lenovo: lenovo-ymc:
  -  Suppress probe on Yoga Book 9 14IAH10
 
 lenovo/ymc:
  -  Only match lower byte in WMI lid switch query response
 
 lg-laptop:
  -  Add support for additional events
  -  Add support for native ACPI events
  -  Fix keyboard backlight support on LG Gram 16T90SP
  -  Fix LED resource handling
  -  Improve WMAB control method support
 
 MAINTAINERS:
  -  update Intel PMC Core maintainer contact
 
 mlxbf-bootctl:
  -  fix the build error with FIELD_PREP()
 
 mlxbf-pmc:
  -  Check ACPI_COMPANION() against NULL
 
 msi-ec:
  -  Add MSI Katana GF76 11UEK EC firmware
  -  Add MSI Raider A18 HX A9WJG EC firmware
 
 msi-wmi:
  -  Add MSI Claw M-Center keys
  -  Reformat msi_wmi_notify()
 
 oxpec:
  -  Add support for OneXPlayer X2 Mini Pro
 
 panasonic-laptop:
  -  Fix sentinel write past pcc->sinf[]
  -  Stop setting acpi_device_name/class()
 
 power: supply: surface_{battery,charger}:
  -  Consistently define ssam_device_ids using named initializers
 
 redmi-wmi:
  -  report EC state change events
 
 samsung-galaxybook:
  -  Add SAMB430 device ID
 
 sony-laptop:
  -  Stop setting acpi_device_class()
 
 sonypi:
  -  Stop setting acpi_device_name/class()
 
 surface: acpi-notify:
  -  Check ACPI companion before use
 
 surface: aggregator:
  -  Consistently define ssam_device_ids using named initializers
 
 surface: surfacepro3_button:
  -  Stop setting acpi_device_name()
 
 think-lmi:
  -  Fix certificate thumbprint sysfs output
  -  Fix current password length check
  -  Free system certificate signatures
 
 thinkpad_acpi:
  -  Add USB-C Security (USCS) support
  -  Fix fan speed reporting on Edge E330
  -  Fix USB-C Security probe failure on unsupported platforms
  -  Stop setting acpi_device_class()
 
 topstar-laptop:
  -  Stop setting acpi_device_name/class()
 
 toshiba_acpi:
  -  Do not use uninitialized device_class
 
 toshiba_bluetooth:
  -  Use more common error handling code in toshiba_bt_rfkill_probe()
 
 toshiba_haps:
  -  Do not use uninitialized device_class
 
 uniwill-laptop:
  -  Add 2 new feature defines for TUXEDO devices
  -  Add AC auto boot support
  -  Add Avell A60 MUV support
  -  Add keyboard backlight support
  -  Add lightbar support for LAPQC71A/B
  -  Add support for the AiStone X4SP4NAL
  -  Add support for the MACHENIKE L16 Pro
  -  Add support for USB powershare
  -  Handle screen-related events
  -  Remove single color keyboard detection
  -  Split uniwill_kbd_led_init()
 
 x86/platform/olpc: xo15:
  -  Stop setting acpi_device_name/class()
 
 xo15-ebook:
  -  Stop setting acpi_device_name/class()
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQSCSUwRdwTNL2MhaBlZrE9hU+XOMQUCaow0EgAKCRBZrE9hU+XO
 MRvYAP412gjYokIoj6ncE2OD897gX2d5BwUVKkraQHoevxLm8wEAikY+iYbdOv3a
 fqhPeCDZSRBn6yEBHewY7cdotNDn2go=
 =d/Uf
 -----END PGP SIGNATURE-----

Merge tag 'platform-drivers-x86-v7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86

Pull x86 platform driver updates from Ilpo Järvinen
 "Highlights:

  Major refactoring effort: stop setting acpi_device_name/class() and
  pnp.device_class to facilitate their eventual removal

  Many rollback/remove path fixes (presumably mostly found by AI)

  Miscellaneous cleanups / refactoring / improvements

  amd/halo:
   - Add Halo RGB LED driver

  amd/hsmp:
   - Properly serialize probe, remove, and data paths
   - Add support for protocol v7 used by Family 1AH Model 80H
   - Fix error checking corner cases (largely from AI review)
   - Reject negative power cap

  amd/pmc:
   - Improve behavior on platforms that do not support STB
   - Add T14 Gen2 AMD (20XL) to s2idle quirk list

  amd/pmf:
   - Add ioctl interface to retrieve device metrics
   - Add support for new metrics tables used by Family 1AH Model 80H

  qcom-hamoa-ec (arm64):
   - Reject short responses

  asus-nb-wmi:
   - Support ProArt key on ASUS ProArt PX13

  asus-armoury:
   - Gate PPT writes behind active fan curve
   - Add power limits for more models

  dell-wmi-base:
   - Fix handling of ultra performance key

  dell-wmi-sysman:
   - Don't hex dump attribute security buffer

  hp-bioscfg:
   - Various fixes
   - Improve reduced ACPI packages support (necessary for HP EliteBook 840 G2)

  lg-laptop:
   - Fix LED resource handling
   - Add support for events used in newer models
   - Fix keyboard backlight support on LG Gram 16T90SP

  hp-wmi:
   - Generalize thermal params to board params
   - Manage CPU and GPU PWM independently
   - Add GPU MUX switch support
   - Add Victus 15-fb0xxx support
   - Add OMEN MAX 16-ak0xxx, OMEN 16-n0xxx, OMEN 16-wd0xxx, OMEN
     16-wf0xxx, and OMEN board ID 8D88 support
   - Add OMEN Transcend 16-u0xxx support

  huawei:
   - Add support for Fn-lock ACPI interface found on newer Huawei
     laptops such as MateBook 14 2024

  ISST:
   - Improve input validation (many fixes)
   - Disallow SST-CP (core-power) feature if perf profile add fails

  lenovo/yb9-kbdock:
   - Add driver for Yoga Book 9 14IAH10

  lenovo/ymc:
   - Extend hinge switch query to support Yoga 9 2-in-1 14IPH11
   - Prevent loading on Yoga Book 9 14IAH10 to avoid duplicated input
    nodes

  msi-ec:
   - Add MSI Raider A18 HX A9WJG and MSI Katana GF76 11UEK support

  msi-wmi:
   - Add MSI Claw M-Center keys support

  oxpec:
   - Add support for OneXPlayer X2 Mini Pro

  redmi-wmi:
   - Report kbd backlight cycle, OEM preset power mode, and FnLock
     toggle events to userspace

  samsung-galaxybook:
   - Add Samsung Galaxy Book6 Pro support

  thinkpad_acpi:
   - Add USB-C Security support

  uniwill-laptop:
   - Add keyboard backlight, AC auto boot, and USB powershare support
   - Add MACHENIKE L16 Pro, AiStone X4SP4NAL, and Avell A60 MUV support
   - Make lightbar max brightness configurable and add support for
     LAPQC71A/B"

* tag 'platform-drivers-x86-v7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (152 commits)
  platform/x86: think-lmi: Fix current password length check
  platform/x86: redmi-wmi: report EC state change events
  MAINTAINERS: update Intel PMC Core maintainer contact
  platform/x86: oxpec: Add support for OneXPlayer X2 Mini Pro
  platform/x86: thinkpad_acpi: Fix fan speed reporting on Edge E330
  platform/x86: msi-ec: Add MSI Katana GF76 11UEK EC firmware
  platform/x86: think-lmi: Fix certificate thumbprint sysfs output
  mlxbf-bootctl: fix the build error with FIELD_PREP()
  platform/x86: think-lmi: Free system certificate signatures
  platform/x86: ISST: Add a NULL check for sst_inst[]
  platform/x86: ISST: Return error during profile addition
  platform/x86: ISST: Just allow 2 bits for SST feature enable
  platform/x86: ISST: Use PP level enable mask
  platform/x86: ISST: Validate parameter for frequency and priority
  platform/x86: ISST: Validate parameter for core power state
  platform/x86: ISST: Validate max level for set feature
  platform/x86: ISST: Validate logical CPU id and clos id
  platform/x86: ISST: Validate level in perf mask ioctls
  platform/x86: ISST: Validate socket ID in clos_assoc ioctl
  platform/x86/amd/hsmp: Reject negative power cap writes in hwmon
  ...
 2026-08-24 10:16:35 -07:00
Dave Airlie
e91d58cb2f Merge tag 'drm-msm-next-2026-08-01' of https://gitlab.freedesktop.org/drm/msm into drm-next 
Changes for v7.3

Bindings:
- Added Shikra support
- Document a840, a704, a722

Core:
- Use drm_client buffers for fbdev emulation
- teardown fixes
- ARM32 DMA fixup
- Remove objects from evict list when re-validated
- Bunch of corner case and error path fixes

DPU:
- Dropped dev_pm_opp_set_rate(0) preventing burnout
- Fixed SSPP offsets of Kaanapali

DP:
- Dropped dev_pm_opp_set_rate(0) preventing burnout
- Cleaned up core code in preparation for MST support
- Fixed prepare() to let Pipewire continue in case of the unplugged cable

GPU:
- Add support for a704
- Add support for a722

HDMI:
- Simplifed register access

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Rob Clark <rob.clark@oss.qualcomm.com>
Link: https://patch.msgid.link/CACSVV02Kp=J+w_RjEJbBbQnBYRb+SWdwMvVbCaAL70bq9EBagQ@mail.gmail.com
 2026-08-24 11:21:12 +10:00
Linus Torvalds
b6b019a1d9 parisc architecture fixes and updates for kernel v7.3-rc1: 
- Drop PER_HPUX personality from UAPI headers
 - Infinite loop fix when parsing IRQ value in eisa code
 - Switch to use asm-generic/serial.h
 - Prevent possible unaligned asm code in head.S
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQS86RI+GtKfB8BJu973ErUQojoPXwUCaosmlQAKCRD3ErUQojoP
 X6U0AQCDiDmKtBw0lzf3ej4slibydKQTh5vyF45IKTP/RO1hywEA9bt8L/335DGp
 H+feM1LvLjuVvfpdco41UwnTF0HwDQo=
 =7xok
 -----END PGP SIGNATURE-----

Merge tag 'parisc-for-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux

Pull parisc architecture updates from Helge Deller:

 - Drop PER_HPUX personality from UAPI headers

 - Infinite loop fix when parsing IRQ value in eisa code

 - Switch to use asm-generic/serial.h

 - Prevent possible unaligned asm code in head.S

* tag 'parisc-for-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:
  parisc: eisa: Fix infinite loop when parsing invalid IRQ value
  parisc: Fix alignment of asm statements in head.S
  parisc: eisa_eeprom: Add missing MODULE_DESCRIPTION()
  parisc: Use asm-generic/serial.h
  parisc: sba_iommu: Remove dead DEBUG_DMB_TRAP code
  UAPI: Drop PER_HPUX personality
  parisc: superio: Spelling s/Peterson/Petersen/
 2026-08-23 10:30:02 -07:00