summaryrefslogtreecommitdiff
path: root/include
AgeCommit message (Collapse)Author
2026-08-18Merge tag 'for-linus-7.3-rc1-tag' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen updates from Juergen Gross: - Small cleanups for the Xen ACPI pad driver and the gnttab driver - Fix an issue with Xen PV device initialization seen with QubesOS tests - Fixes for the Xen balloon driver and the xenbus driver - Simplify Xen related kernel configuration * tag 'for-linus-7.3-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xenbus: Unregister reboot notifier on init failure x86/xen: Drop CONFIG_XEN_PVHVM_SMP xen: Drop CONFIG_XEN_AUTO_XLATE xen: Drop CONFIG_XEN_PVHVM x86/xen: Remove redundant config dependency on X86_LOCAL_APIC x86/xen: fix init of balloon stats again xen/xenbus: check otherend_id only after it has been initialized xen/xenbus: log more information when device state got reset Xen/gnttab: adjust two uses of sizeof() ACPI: PAD: xen: Stop setting acpi_device_name/class()
2026-08-18Merge tag 'liveupdate-v7.3-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux Pull liveupdate updates from Mike Rapoport: "Kexec Handover: - Fix size calculation in kho_preserved_memory_reserve() for preservations larger than 2 GiB Live Update Orchestrator: - move liveupdate selftest utilities into a library so that selftests of subsystems participating in liveupdate, e.g. PCI and VFIO, can use them and drop direct ioctl calls from the tests - add end to end liveupdate test infrastructure that allows running the tests across a kexec in QEMU - remove redundant INIT_LIST_HEAD in luo_session_alloc() - remember the error status of an FLB retrieve() and return it on subsequent attempts rather than retrying retrieve() with an FLB in an unexpected state - reference count the outgoing FLB so that it cannot be freed while a caller is using it, the same way it's done for the incoming FLB - reject nonzero reserved field in LIVEUPDATE_SESSION_FINISH so that it can be reused by a future extension" * tag 'liveupdate-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux: kho: fix size calculation in kho_preserved_memory_reserve() selftests/liveupdate: Move luo_test_utils.* into a reusable library selftests/liveupdate: Use luo_test_utils.c for liveupdate ioctl APIs liveupdate: Remember FLB retrieve() status liveupdate: Reference count outgoing FLB data liveupdate: reject nonzero reserved value for SESSION_FINISH liveupdate: Remove redundant INIT_LIST_HEAD in luo_session_alloc selftests/liveupdate: add end to end test infrastructure and scripts
2026-08-18Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski
Merge in late fixes in preparation for the net-next PR. Conflicts: drivers/dpll/dpll_core.c drivers/dpll/dpll_netlink.c 33f016b23a219 ("dpll: fix NULL deref in dpll_device_ops() during teardown race") b1d0c412088e3 ("dpll: add STATE_CONNECTED_OVERRIDE pin capability") https://lore.kernel.org/aoR9YYY2P5--3x0N@sirena.org.uk https://lore.kernel.org/aoR9VmKllVGwmQn_@sirena.org.uk No adjacent changes. Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-18Merge tag 'kexec-v7.3-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux Pull kexec updates from Mike Rapoport: - Deduplicate crash memory allocation and the exclusion of reserved crash kernel regions from architecture specific code into a generic crash_prepare_headers() and enable crashkernel CMA reservation on arm64 and riscv reservation on arm64 and riscv. - Skip purgatory checksum verification when the kexec segments cannot be corrupted by DMA, which saves about 250ms on kexec. - Replace __ASSEMBLY__ with the compiler provided __ASSEMBLER__ in include/linux/kexec.h. - Fix a keyring refcount imbalance in the kdump kernel's dm-crypt key restore path, which over-dropped the user keyring reference when more than one key was restored. * tag 'kexec-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux: crash_dump: release keyring reference at the correct time kexec: Replace __ASSEMBLY__ with __ASSEMBLER__ in header file kexec_file: skip checksum verification when safe riscv: kexec_file: Add support for crashkernel CMA reservation arm64: kexec_file: Add support for crashkernel CMA reservation powerpc/kexec_file: Use crash_exclude_core_ranges() helper LoongArch: kexec_file: Use crash_prepare_headers() helper to simplify code riscv: kexec_file: Use crash_prepare_headers() helper to simplify code x86/crash: Use crash_prepare_headers() helper to simplify code arm64: kexec_file: Use crash_prepare_headers() helper to simplify code crash: Add crash_prepare_headers() to exclude crash kernel memory powerpc/crash: sort crash memory ranges before preparing elfcorehdr riscv: kexec_file: Fix crashk_low_res not exclude bug
2026-08-18Merge tag 'memblock-v7.3-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock Pull memblock updates from Mike Rapoport: "Non-urgent fixes: - Fix calculation of node_spanned_pages when running with 'kernelcore=mirror' - Properly handle failure to allocate per_cpu_nodestats in free_area_init_core_hotplug() - Fix deferred initialization of the memory map for configurations where node's RAM end is not aligned on PAGES_PER_SECTION Cleanups: - Remove redundant pageblock_align() call in free_unused_memmap() - Remove unnecessary invalid range checks in users of memblock iterators. Some users of for_each_mem_range() and for_each_mem_pfn_range() verify that start < end for each range. This is redundant because memblock iterators guarantee to never return an invalid range - Stop overlapping zones with 'kernelcore=mirror' and align behaviour of 'kernelcore=mirror' with other variants of kernelcore and movablecore - Remove redundant updates of numa_nodes_parsed mask in the callers of numa_add_memblk(), the latter always updates the mask anyway - Remove unnecessary initialization of pgdat->per_cpu_nodestats to NULL, the variable is reset to the actual value a few lines below" * tag 'memblock-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock: (25 commits) mm/mm_init: deferred_grow_zone(): fix out-of-range first_deferred_pfn mm/mm_init: remove unnecessary initialization of pgdat->per_cpu_nodestats mm/mm_init: remove redundant memset in free_area_init() mm: numa_memblks: use numa_add_reserved_memblk() in numa_cleanup_meminfo() arch_numa: remove redundant node_possible_map assignment mm: numa_memblks: remove redundant numa_nodemask_from_meminfo() LoongArch: remove redundant numa_nodes_parsed node_set() arch_numa: remove redundant numa_nodes_parsed node_set() x86/numa: remove redundant numa_nodes_parsed node_set() of/numa: remove redundant numa_nodes_parsed node_set() ACPI: NUMA: remove redundant numa_nodes_parsed node_set() mm: numa_memblks: set numa_nodes_parsed in numa_add_memblk() mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug mm/mm_init: drop overlap_memmap_init() mm/mm_init: don't overlap NORMAL and MOVABLE zones with kernelcore=mirror mm/hugetlb: remove unnecessary empty range check in hugetlb_bootmem_set_nodes() mm: remove unnecessary empty range check in early_calculate_totalpages() powerpc64/kasan: Remove unreachable invalid range check in kasan_init_phys_region() ARM: remove unreachable invalid range check in kasan_init() riscv: remove unreachable invalid range check in kasan_init() ...
2026-08-18Merge tag 'pm-7.3-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management updates from Rafael Wysocki: "As has been the case for quite some time, this set of changes is dominated by cpufreq updates including intel-pstate and amd-pstate driver updates, minor fixes and cleanups of other assorted cpufreq drivers, schedutil governor updates, fixes of the Rust bindings, new hardware support (IPQ5210 in qcom-nvmem), and some updates of self tests related to cpufreq. The second largest group of changes are cpuidle updates consisting of intel_idle driver updates and ACPI processor idle driver updates, both mostly related to ACPI _LPI support. There are also updates related to system sleep, mostly in the hibernation core code, two operating performance points (OPP) updates, one runtime PM framework update, one power capping update, and some tools updates including the addition of ACPI CPPC support to cpupower. Specifics: - Minor fixes and cleanups in assorted cpufreq drivers (Dan Carpenter, Guru Das Srinagesh, Haoxiang Li, Karl Mehltretter, Sasha Finkelstein, and Pan Chuang) - Fix cpufreq table creation and bios_limits() callback in the Rust bindings (Priya Bala Govindasamy) - Add IPQ5210 support to qcom-nvmem driver (Varadarajan Narayanan) - Adjust the .adjust_perf() cpufreq driver callback to allow the maximum performance value to be passed to drivers and update the intel_pstate driver to use it (Rafael Wysocki) - Set policy->cur to the actual requested frequency in the intel_pstate driver when the performance policy is used (Rafael Wysocki) - Simplify HWP handling on Broadwell processors in intel_pstate (Rafael Wysocki) - Fix setting minimum P-state at init time in intel_pstate (Rafael Wysocki) - Consolidate frequency values computation in intel_pstate and clean up code in that driver (Rafael Wysocki) - Add missing kernel-doc descriptions for structure and union members in the amd-pstate driver (David Vernet) - Handle missing policy in dynamic EPP callbacks in the amd-pstate driver (EDAMAMEX) - Introduce EXPORT_SYMBOL_FOR_PSTATE_UT() to export amd-pstate driver symbols to the amd-pstate-ut subdriver (K Prateek Nayak) - Add dynamic EPP as an "energy_performance_preference" mode in amd-pstate, remove the "amd_dynamic_epp" kernel command line option and the "dynamic_epp" sysfs attribute, and update the dynamic_epp documentation accordingly (K Prateek Nayak) - Add unit tests for CPPC Performance Priority and the "dynamic" EPP mode in the amd-pstate driver (K Prateek Nayak) - Set min_limit_freq based on bios_min_perf in amd-pstate and remove the defensive check for bios_min_perf from it (K Prateek Nayak) - Fix EPP return type and handle errors in amd-pstate during initialization, toggle auto_sel in active mode on shared memory systems, and cache the firmware programmed EPP value (Marco Scardovi) - Skip tests in amd-pstate-ut if the amd-pstate driver is not in active use (Qianheng Peng) - Replace sprintf() with sysfs_emit() in sysfs show in the cpufreq schedutil governor and fix a self-contradictory comment in sugov_iowait_apply() (Zhongqiu Han) - Fix the usage example for the sampling_rate tunable of the ondemand cpufreq governor in admin-guide (wangxiaodong) - Avoid using deep idle states during initialization in the intel_idle driver to work around device handling issues (Rafael Wysocki) - Fix and refactor the ACPI processor driver code related to ACPI _LPI support and add ACPI _LPI support to intel_idle based on that ACPI processor driver update (Rafael Wysocki) - Backup and restore governor for cpufreq sptests (Yiwei Lin) - Remove unnecessary sudo from quick_shuffle() and remove unused local variables from switch_show_governor() in cpufreq selftests (Jinseok Kim) - Rename the PM core module parameter prefix to "pm" and allow the PM transition (DPM) watchdog to be disabled by default (Tzung-Bi Shih) - Fix off-by-one in wakelocks number limit check in the system sleep sysfs interface (Haowen Tu) - Remove kernel-doc markings from helper descriptions in the core hibernation code (Adi Nata) - Use %pe to print error pointer values in the hibernation core (Ronan Marchal) - Fix memory leak in snapshot_write_next() error path (Malaya Kumar Rout) - Delay allocating and linking the next swap_map_page in the hibernation image saving code until another image page actually needs to be recorded (Haesung Kim) - Fix cleanup ordering around scope-based pointers in OPP (Gregor Herburger). - Use clk_get_optional() for optional clocks in OPP (Praveen Talari). - Stop setting runtime_error on runtime resume callback failures to allow drivers to recover from resume issues (Praveen Talari) - Handle PMU registration failure during probe in the intel_rapl_tpmi driver (Sumeet Pawnikar) - Avoid optional imports in intel_pstate_tracer unless they are really needed (Yousef Alhouseen) - Add generic CPPC performance display to the cpupower utility, build and call CPPC information on non-AMD processors, make cpupower print kernel and hardware frequency information, and add libm to cpupower for generic CPPC view (Jeremy Linton) - Remove conditional return with no effect from cpupower (Sang-Heon Jeon)" * tag 'pm-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (76 commits) cpufreq: imx6q: fix out-of-bounds write when probed more than once cpufreq: imx6q: fix devres accumulation across driver rebind rust: cpufreq: Fix temporary write in Registration::bios_limit_callback rust: cpufreq: Add CPUFREQ_TABLE_END as last table entry in TableBuilder::to_table opp: Use clk_get_optional() to avoid leaving opp_table->clk as an error pointer intel_idle: Avoid using deep idle states during initialization cpupower: remove conditional return with no effect cpufreq: intel_pstate: Adjust policy->cur in active mode to policy cpufreq/amd-pstate: Document missing kernel-doc members cpufreq/amd-pstate-ut: Add unit test for CPPC Performance Priority cpufreq/amd-pstate-ut: Add unit test for "dynamic" EPP mode cpufreq/amd-pstate: Reduce the scope of exported symbols Documentation/amd-pstate: Update dynamic_epp documentation with new behavior cpufreq/amd-pstate: Remove "amd_dynamic_epp" cmdline and "dynamic_epp" sysfs cpufreq/amd-pstate: Add dynamic EPP as an "energy_performance_preference" mode cpufreq/amd-pstate: Extract platform profile to EPP conversion into a helper cpufreq/amd-pstate: Remove the defensive check for bios_min_perf cpufreq/amd-pstate: Set min_limit_freq based on bios_min_perf powercap: intel_rapl_tpmi: Handle PMU registration failure during probe PM: sleep: Allow disabling DPM watchdog by default ...
2026-08-18Merge tag 'acpi-7.3-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI support updates from Rafael Wysocki: "The most significant change here is the elimination of struct acpi_driver that has no more users in the tree now along with some documentation related to it, and a follow-up update to set the "no PM" flag for all ACPI devices that are now only going to play the role of other devices' "companions" (in analogy with DT nodes). There is also a significant update of irqchip code related to ACPI done in order to enable GICv5 IWB ACPI probe ordering detection on ARM, which involves RISC-V interrupt controller management code refactoring to extract generic code from it into the common ACPI IRQ code. The rest is mostly fixes, including some fallout of the _OSC handling rework in 7.0, ACPI CPPC library fixes, a workaround for registering ACPI platform devices with overlapping I/O or memory resources, an ACPI EC driver fix related to probe deferral on platforms using HW-reduced ACPI, two ACPI battery driver fixes and a workaround for handling model numbers with unprintable characters in it, probe error cleanup and driver unload code path fixes, hardware error reporting fixes, documentation fixes, and assorted code cleanups all over. Specifics: - Eliminate struct acpi_driver whose users have all been converted to bind to platform devices or auxiliary devices and set the "no power management" flag for all struct acpi_device objects (Rafael Wysocki) - Avoid complaints regarding missing _OSC features on platforms where OSC_CAPABILITIES_MASK_ERROR is set in _OSC error bits even though all of the requested features are actually acknowledged (Rafael Wysocki) - Avoid printing confusing _OSC messages for non-PCIe host bridges without _OSC which is a valid configuration (Kazuma Kondo) - Use correct region struct for BERT region size check and properly map BERT and CCEL data to their ACPI tables (Thomas Renninger) - Add acpi_device_clear_deps(), refactor RISC-V interrupt controller management code to extract generic code from it into the common ACPI IRQ code, and enable GICv5 IWB ACPI probe ordering detection on ARM on top of that (Lorenzo Pieralisi) - Stop using acpi_device_name() in the PNP core, stop setting acpi_device_name/class() in the Xen variant of the ACPI PAD (Processor Aggregator Device) driver, and make the Loongarch laptop driver stop setting acpi_device_class() (Rafael Wysocki) - Fix issues related to the desired_perf register access in the ACPI CPPC library and update it to avoid unnecessary overhead (Christian Loehle) - Simplify acpi_get_pci_dev() with the help of a mutex guard, introduce acpi_dev_get_pci_dev() for code that has a struct ACPI device for which it wants to get the struct pci_dev pointer of the associated PCI device, and use it in the ACPI video bus driver (Rafael Wysocki) - Avoid registering platform devices with resource overlaps in the ACPI core device enumeration code (Rafael Wysocki) - Clean up the list of included header files in the NHLT table parser and validate the table and record lengths in the FPDT parser (Andy Shevchenko and Pengpeng Hou) - Unregister the cpufreq notifier on init failure in the ACPI processor driver (Can Peng) - Validate MADT IOAPIC entry bounds during IOAPIC hotplug lookup in the ACPI processor driver (Pengpeng Hou) - Avoid _REG disconnect on probe deferrals related to GPIO IRQ in the ACPI EC driver (Zhu Ling) - Update kerneldoc comments of two structures in the ACPI bus type code to use correct struct member names to avoid warnings (Randy Dunlap) - Use a correct function parameter name in kernel-doc in the ACPI fan driver (Randy Dunlap) - Update ACPI fan IDs to follow modern style and clean up header file inclusions in the ACPI fan driver (Andy Shevchenko) - Use devm_acpi_install_notify_handler() to replace a custom open-coded devres-based management of an ACPI notify handler in the ACPI fan driver (Rafael Wysocki) - Adjust charging status validation check in the ACPI battery driver to avoid incorrect status reporting (Rafael Wysocki) - Merge consecutive battery notifications in the ACPI battery driver to reduce the pressure on STA, _BST and _BIX/_BIF ACPI control methods and make that driver use kstrtoul() instead of sscanf("%lu\n") (Rong Zhang) - Sanitise model_number in the ACPI battery driver by dropping unprintable characters (Kate Hsuan) - Remove a node_set() call that is redundant from acpi_parse_memory_affinity() (Sang-Heon Jeon) - Prevent kernel-doc warnings by converting 2 function description comments to kernel-doc format (Randy Dunlap) - Fix docs build error in the ACPI admin-guide documentation (Randy Dunlap) - Replace __get_free_page() with kmalloc() in the code handling ACPI NVS memory during system suspend/resume (Mike Rapoport) - Fix card device cleanup on registration failure in the core PNP code (Yuho Choi) - Drop an unused assignment of pnp_device_id driver data (Uwe Kleine-König) - Clear driver_data on all paths that free acpi_pci_root in acpi_pci_root_add() (Chen Pei) - Add locking around evaluation of ACPI control methods in the ACPI TAD driver to avoid race conditions (Rafael Wysocki) - Handle repeated SEA error storms in APEI (Junhao He) - Fix ERST timeout unit conversion in APEI (Nirmoy Das) - Fix ARM section length accounting after header in the ACPI APEI GHES driver (TanZheng) - Mark ghes_in_nmi_spool_from_list() as maybe unused (Rui Qi) - Introduce helper function acpi_dev_is_video_device() and use it in the core ACPI device enumeration code, in the ACPI video bus driver, in the ACPI support code for I2C, in the PCI VGA driver, and in the x86 platform thinkpad_acpi driver (Andy Shevchenko) - Add a quirk to use the native backlight on Acer Nitro AN515-46 to the ACPI video bus driver (Marcos Paulo Medeiros) - Release PCI device reference after lookup in video_detect_portege_r100() in the ACPI video bus driver (Yuho Choi)" * tag 'acpi-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (61 commits) ACPI: scan: Avoid registering platform devices with resource overlaps ACPI: APEI: Handle repeated SEA error storms ACPI: APEI: Fix ERST timeout unit conversion ACPI: APEI: GHES: fix ARM section length accounting after header ACPI: video: Release PCI device reference after lookup ACPI: PCI: Avoid misleading _OSC messages for non-PCIe host bridges without _OSC ACPI: TAD: Add locking around AML evaluations ACPI: video: force native backlight on Acer Nitro AN515-46 ACPI: CPPC: Evaluate performance-control PCC use once ACPI: CPPC: Avoid locking standalone full-width registers ACPI: CPPC: Avoid unnecessary reads for full-width writes ACPI: CPPC: Stop reading desired_perf in cppc_get_perf() ACPI: CPPC: Skip desired_perf read in cppc_get_perf() ACPI: CPPC: Reject desired_perf reads on _CPC revision 4+ ACPI: processor: Unregister cpufreq notifier on init failure ACPI: bus: Avoid confusing complaints regarding missing _OSC features ACPI: battery: Adjust charging status validation check ACPI: pmtmr: Convert to kernel-doc format ACPI: bus: Use correct struct member names ACPI: fan: Use correct function parameter name in kernel-doc ...
2026-08-18net: dsa: initial MT7628 tagging driverJoris Vaisvila
Add support for the MT7628 embedded switch's tag. The MT7628 tag is merged with the VLAN TPID field when a VLAN is appended by the switch hardware. It is not installed if the VLAN tag is already there on ingress. Due to this hardware quirk the tag cannot be trusted for port 0 if we don't know that the VLAN was added by the hardware. As a workaround for this the switch is configured to always append the port PVID tag even if the incoming packet is already tagged. The tagging driver can then trust that the tag is always accurate and the whole VLAN tag can be removed on ingress as it's only metadata for the tagger. On egress the MT7628 tag allows precise TX, but the correct VLAN tag from tag_8021q is still appended or the switch will not forward the packet. Signed-off-by: Joris Vaisvila <joey@tinyisr.com> Link: https://patch.msgid.link/20260813190241.789323-4-joey@tinyisr.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-18vsock: remove the now-unused rejected flagNguyen Dinh Phi
After previous patch, the branch marking a socket rejected in vsock_accept() is unreachable, and nothing ever sets vsk->rejected elsewhere. In fact, since commit d021c344051a ("VSOCK: Introduce VM Sockets"), where `rejected` was introduced, there has never been a path that sets sk_err on a listening socket, so that branch has been dead code since the beginning. Therefore, we can remove the `rejected` field from vsock_sock structure. Suggested-by: Stefano Garzarella <sgarzare@redhat.com> Signed-off-by: Nguyen Dinh Phi <phind.uet@gmail.com> Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Link: https://patch.msgid.link/20260813173024.2362935-3-phind.uet@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-18Merge tag 'v7.2' of ↵Bartosz Golaszewski
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux into gpio/for-next Linux 7.2
2026-08-18Merge tag 'regmap-irq-reqrel' of ↵Bartosz Golaszewski
https://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap into gpio/for-next regmap-irq: Provide IRQ resource request and release callbacks The users which rely on regmap IRQ to create the IRQ chip may also want to have an additional tracking of the IRQ requests and releases. Provide a callback for them.
2026-08-18Merge tag 'kvm-x86-misc-7.3' of https://github.com/kvm-x86/linux into HEADPaolo Bonzini
KVM x86 misc changes for 7.3 - Fix VPID virtualization bugs where KVM would fail to flush hardware TLBs. - Harden the SNP and TDX "populate" ioctls against bad input, and to prepare for supporting in-place private<=>shared conversion. - Fix a variety of #DB priority bugs. - Fix a class of races related to enabling Hyper-V emulation on a vCPU after the vCPU is visible to the rest of KVM. - Use static calls for nested virtualization ops. - Move more KVM-internal code out of x86's kvm_host.h. - Enumerate support for a variety of Zhaoxin instructions that don't require explicit virtualization. - Fix missing EFER validation bugs, including in the KVM_SET_SREGS* path. - Harden kvm_vcpu_map() against double-mapping and thus leaking references. - Misc fixes and cleanups, e.g. for largely benign syzkaller splats.
2026-08-18net: ip_tunnel: remove unused non-strict __ip_tunnel_change_mtuIlya Maximets
The last user of this function was the recently removed vport-gre module from openvswitch. Let's drop the function. All other modules use the strict variant. Signed-off-by: Ilya Maximets <i.maximets@ovn.org> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260815001942.1089545-1-i.maximets@ovn.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-18Merge tag 'kvm-x86-coco-7.3' of https://github.com/kvm-x86/linux into HEADPaolo Bonzini
KVM guest_memfd and x86 CoCo changes for 7.3 - Forcefully invalidate SNP VMSA pages if their backing guest_memfd page is zapped/invalidated, e.g. due to a PUNCH_HOLE in response to a Page-State Change request. - Rework the so called "prepare" and "invalidate" guest_memfd hooks to prepare for in-place private<=>shared conversion, and clean up a few warts along the way.
2026-08-18Merge tag 'kvm-x86-generic-7.3' of https://github.com/kvm-x86/linux into HEADPaolo Bonzini
KVM arch-neutral and documentation changes for 7.3 - Remove kvm_debugfs_dir if kvm_init() fails after creating KVM's debugfs. - Document some of the "fun" gotchas with the APIC base when creating IRQCHIPs on x86. - Add a per-VM bitmap to track which vCPU IDs have been "claimed" but for which the vCPU isn't yet online, and use the bitmap to reject duplicate IDs before calling into arch code. This allows arch code to consume vcpu_id without having to worry about cross-vCPU clobbering (at least s390 and x86 have had related bugs). - Zero a vCPU's entry in VMX's Posted Interrupt Descriptor table used for IPI virtualization when the vCPU is freed to fix a use-after-free where hardware will write to a freed vCPU's PID.
2026-08-18net: cap advertised IP tunnel headroomZhiling Zou
IP tunnel devices derive their advertised needed_headroom from lower output devices. A stack of user-created devices can make the derived value larger than the 16-bit skb header offsets can represent. Once IP output reserves it, skb head expansion can wrap those offsets. The runtime transmit path already caps a growing needed_headroom at 512. Apply the same cap when tunnel configuration publishes needed_headroom derived from a lower output device. Capping the advertised value is safe: IP tunnel transmit still expands the skb when a packet needs more headroom. A nonsensical stacked configuration can therefore incur an extra reallocation, but it cannot publish an unbounded reservation to upper layers. Fixes: 1a37e412a022 ("net: Use 16bits for *_headers fields of struct skbuff") Cc: stable@vger.kernel.org Reported-by: Vega <vega@nebusec.ai> Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/ba04a1fd6bfae2377607fad5d8f80f7eb80fd4c4.1786542637.git.zhilinz@nebusec.ai Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-18soc: qcom: ubwc: Fix missing includeDaniel Baluta
When CONFIG_QCOM_UBWC_CONFIG=n, compiler needs to know the definition of ERR_PTR otherwise there will be a compilation error: In file included from drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp_v13.c:7: ./include/linux/soc/qcom/ubwc.h: In function ‘qcom_ubwc_config_get_data’: ./include/linux/soc/qcom/ubwc.h:45:16: error: implicit declaration of function ‘ERR_PTR’ [-Wimplicit-function-declaration] Fix this by including <linux/err.h> Fixes: 1924272b9ce1 ("soc: qcom: Add UBWC config provider") Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Daniel Baluta <daniel.baluta@nxp.com> Tested-by: Nathan Chancellor <nathan@kernel.org> # build Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-08-18Merge tag 'asoc-v7.3' of ↵Takashi Iwai
https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Updates for v7.3 A very busy release, a combination of a lot of new device work and more people than usual doing various subsystem wide improvements in the code. The main subsystem level change is the work Morimoto-san has been doing to get automatic DAI format selection more widely deployed, and even that is largely changes in the drivers to enable use of the feature rather than framework work. - Conversions of a lot of drivers to use the automatic DAI format selection code from Morimoto-san. - Many fixes and code improvements from bui duc phuc and Morimoto-san. - Fixes for ordering problems in register default tables from Peter Ujfalusi. - Changes to use auto-cleanup for firmware to improve robustness from Takashi Iwai. - Support for firmware on more Awinc devices. - Many changes in the Qualcomm driver stack, mostly around new platform support. - Support for AMD ACP7.B/F, Cirrus Logic CS35L62, Loongson 2K0300, Meson GX formatter and interface, Qualcomm LPI MI2S, SM8475 and WSA855 and Realtek RT1321 VA1/2 and RT766/7.
2026-08-17Merge tag 'linux_kselftest-kunit-7.3-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kunit updates from Shuah Khan: "Fixes and new kunit and tools, enable new configs: - configs: enable GPIO kunit test cases in all_tests.config - string-stream: Replace strlcat() with strscpy() and seq_buf - configs: enable GPIO kunit test cases in all_tests.config Documentation: - Test config entries shouldn't select other configs - Fix outdated FAQ entries Add the ability to skip entire test suites and an example test suite that can be skipped at runtime: - Add ability to skip entire test suites - Add example of test suite that can be skipped at runtime" * tag 'linux_kselftest-kunit-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: kunit: tool: fix _list_tests filtering wrong variable when list has TAP prefix kunit: configs: enable GPIO kunit test cases in all_tests.config kunit: string-stream: Replace strlcat() with strscpy() and seq_buf Documentation: kunit: Fix outdated FAQ entries Documentation: kunit: Test Kconfig entries shouldn't select other configs kunit: Add example of test suite that can be skipped at runtime kunit,rust: Add ability to skip entire test suites
2026-08-17Merge tag 'libcrypto-tests-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull crypto library test updates from Eric Biggers: - Add comprehensive KUnit test suites for the new AES-GCM and AES-CCM library APIs - Add FIPS self-tests for all the AES encryption modes. This is needed for parity with the traditional crypto API - Fix a couple more issues in the IRQ test helper * tag 'libcrypto-tests-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: lib/crypto: aes-cmac: Use __cleanup() instead of memzero_explicit() kunit: irq: Unregister on-stack timer and work from debugobjects kunit: irq: Continue increasing hrtimer interval for longer lib/crypto: tests: Add KUnit test suite for AES-GCM lib/crypto: tests: Add KUnit test suite for AES-CCM lib/crypto: tests: Add aead-test-template.h lib/crypto: tests: Use per-test-case buffers in hash tests lib/crypto: tests: Create test-utils.h lib/crypto: aes: Add FIPS self-tests for GCM and CCM lib/crypto: aes: Add FIPS self-tests for unauthenticated modes lib/crypto: fips: Split fips.h into fips-aes.h and fips-sha.h
2026-08-17Merge tag 'libcrypto-updates-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull crypto library updates from Eric Biggers: "Add library APIs for most AES encryption modes that are used in the kernel (ECB, CBC, CBC-CTS, CTR, XCTR, XTS, GCM, CCM). These AES modes have many in-kernel users that are currently using the crypto_skcipher or crypto_aead APIs. These existing APIs are difficult to use and inefficient. Until now, the lack of proper library support for these has been the main gap in the crypto library. This set of changes is the next stage of addressing it: - Implement the new APIs on top of the existing support for single-block AES in the library. - Fully document the new APIs. - Migrate the only user of the old AES-GCM library API to the new, more flexible API; then remove the old API and its implementation. - Wire up the new APIs to the traditional crypto API by adding crypto_skcipher and crypto_aead algorithms. This makes the new APIs be covered by the traditional crypto API's self-tests. It also makes them be already used for real on systems that don't have architecture-optimized code for these modes. But most importantly, this is a prerequisite for migrating the architecture-optimized code for these AES modes (i.e. arch/*/crypto/aes*) into the library, which as usual will eliminate a lot of redundant "glue" code. Note that unlike some of the other algorithms that have been migrated to the library, e.g. SHA-512, for these AES modes there was too much to get done in one cycle. Nor did it make sense to handle these modes one at a time, because they tend to be coupled together or depend on each other, especially in the architecture-optimized AES code. Thus, most of the benefits (reductions in lines of code, performance improvements, etc.) will follow in later cycles when architecture-optimized code is migrated into the library and users of crypto_skcipher and crypto_aead are updated to use the new APIs. The design of the new APIs was informed by writing proof-of-concept patches for many kernel subsystems currently accessing these same algorithms via crypto_skcipher or crypto_aead (patches 18-33 of https://lore.kernel.org/r/20260707053503.209874-1-ebiggers@kernel.org/). While those patches will be resent for real later, the total diffstat for them was negative 1905 lines. So clearly the new APIs are quite a bit easier to use and align better with what users actually need. Besides the new AES encryption APIs, there are also a few changes for improved AES-CMAC key and context zeroization" * tag 'libcrypto-updates-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: mac80211: fils_aead: Use __cleanup() instead of memzero_explicit() Bluetooth: SMP: clear the aes_cmac_key when done smb: clear the aes_cmac_key and aes_cmac_ctx when done lib/crypto: aes-cmac: Add zeroization functions lib/crypto: aesgcm: Remove old AES-GCM library x86/sev: Remove obsolete virtual address check x86/sev: Use new AES-GCM library crypto: aes - Add CCM support using library crypto: aes - Add GCM support using library crypto: aes - Add XTS support using library crypto: aes - Add CTR and XCTR support using library crypto: aes - Add CBC and CBC-CTS support using library crypto: aes - Add ECB support using library lib/crypto: aes: Add CCM support lib/crypto: aes: Add GCM support lib/crypto: aes: Add XTS support lib/crypto: aes: Add CTR and XCTR support lib/crypto: aes: Add CBC and CBC-CTS support lib/crypto: aes: Add ECB support crypto: xts - Split out __xts_verify_key() helper
2026-08-17Merge tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linuxLinus Torvalds
Pull fscrypt updates from Eric Biggers: "The main change this cycle is a significant simplification that's been overdue for a while now: standardizing on a single file contents encryption implementation in ext4 and f2fs, instead of having two. Specifically, the original filesystem-layer file contents encryption implementation is removed, and the blk-crypto implementation is now used unconditionally. blk-crypto delegates either to inline crypto hardware or to the CPU via blk-crypto-fallback. The latter is functionally equivalent to the original filesystem-layer code. The blk-crypto implementation already existed, but previously it was used only when the filesystem was mounted with "-o inlinecrypt". Now, "-o inlinecrypt" just selects whether inline crypto hardware is used. To allow maintaining that user control over hardware use, the blk-crypto API is extended with a new flag BLK_CRYPTO_CFG_ALLOW_HW. Overall, this removes quite a bit of redundant code from ext4, f2fs, and fs/crypto/. It should make things easier for ongoing filesystem efforts such as iomap support, large folios, and btrfs encryption (btrfs had already been planning to use blk-crypto exclusively.) There are two small behavior changes of note: - Direct I/O now works on encrypted files even without "-o inlinecrypt", rather than falling back to buffered I/O. This is effectively a bugfix, though I'll continue to keep an eye out for any user that may have been depending on the buffered I/O fallback. - IV_INO_LBLK_32 policies are no longer supported in certain cases that didn't make sense and have no known uses. This has been in linux-next since July 22 with no reported issues. All encryption xfstests pass on ext4 and f2fs. As usual I've also been using it on a system with an fscrypt-encrypted home directory. Of course, the blk-crypto code paths also aren't new and were already being used on many systems via the inlinecrypt mount option. In addition to the main change described above, there are a few other cleanups such as using lock guards for mutexes, improving documentation, and removing a workaround for outdated gcc versions" * tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux: (29 commits) blk-crypto: Update docs for blk-crypto-fallback motivation blk-crypto: Remove unused function blk_crypto_config_supported() fscrypt: Update docs for data path fscrypt: Remove unused function fscrypt_finalize_bounce_page() f2fs: Update outdated comment in f2fs_write_begin() fs: Update outdated comment for SB_INLINECRYPT fscrypt: Update encryption policy version docs fscrypt: Replace some variable-size memsets with fixed-size fscrypt: Add safety checks to non-block-based en/decryption fscrypt: Merge bio.c and inline_crypt.c into block.c fscrypt: Remove unused functions and workqueue fscrypt: Remove fs-layer zeroout code fscrypt: Remove fscrypt_dio_supported() fscrypt: Replace calls to fscrypt_inode_uses_inline_crypto() fs/buffer: Remove fs-layer decryption code f2fs: Remove fs-layer file contents en/decryption code ext4: Further de-generalize the bio postprocessing code ext4: Make ext4_bio_write_folio() return void ext4: Remove fs-layer file contents en/decryption code Documentation: fscrypt: Update docs for inlinecrypt ...
2026-08-17net: af_unix: useful handling of LSM denials on SCM_RIGHTSJori Koolstra
Right now if some LSM such as Smack denies an AF_UNIX socket peer to receive an SCM_RIGHTS fd, the SCM_RIGHTS fd array will be cut short at that point, and MSG_CTRUNC is set on return of recvmsg(). This is highly problematic behaviour, because it leaves the receiver wondering what happened. As per man page MSG_CTRUNC is supposed to indicate that the control buffer was sized too short, but suddenly a permission error might result in the exact same flag being set. Moreover, the receiver has no chance to determine how many fds got originally sent and how many were suppressed.[1] Add a SO_RIGHTS_NOTRUNC option to UNIX sockets to enable more useful handling of LSM denials when receiving SCM_RIGHTS messages: instead of truncating the message at the first blocked fd, keep every fd slot and store the LSM errno in the blocked slot. The socket option is inherited by the child accept() socket if set on the listen() socket. [1]: https://github.com/uapi-group/kernel-features#useful-handling-of-lsm-denials-on-scm_rights Reviewed-by: Christian Brauner (Amutable) <brauner@kernel.org> Signed-off-by: Jori Koolstra <jkoolstra@xs4all.nl> Link: https://patch.msgid.link/20260813162818.149248-4-jkoolstra@xs4all.nl Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-17Merge tag 'hfs-v7.3-tag1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/hfs Pull HFS updates from Viacheslav Dubeyko: "This contains several fixes in HFS/HFS+ of syzbot reported issues and HFS/HFS+ fixes of xfstests failures. - b-tree bitmap corruption check (Aditya Prakash Srivastava) During b-tree open (hfs_btree_open()), the code verifies that the allocation map bit for the tree header (node 0) is set. If not, it indicates a corrupted map record/bitmap and mounts the volume as read-only (SB_RDONLY) to prevent further damage. - Validate catalog CNIDs before instantiating inodes (David Maximiliano Hermitte) The hfs_cat_find_brec() first resolves a catalog thread record by CNID and then looks up the corresponding catalog record by parent/name. On a corrupted filesystem image, the second lookup may find a record whose CNID does not match the CNID that was requested. Finally, corrupted catalog records are rejected. - Validate B-tree record offset table (Jiaming Zhang) A crafted HFS+ image can contain a corrupted B-tree node. The node descriptor may contain a record count that does not fit in the node, and record offsets may be unordered, unaligned, outside the node, or point into the offset table itself. Validate num_recs against the node size before walking the record offset table. Reject record ranges that are unordered, unaligned, outside the node, or overlapping the offset table. Reject invalid record indexes before reading their offset entries, and avoid decrementing an already-zero leaf_count. - Refactoring of hfsplus_delete_cat() logic (Kyle Zeng). The hfsplus_delete_cat() is called with str == NULL when the last open reference to an unlinked HFS+ hardlink backing inode is closed. In that case, the function finds the catalog thread by CNID and rebuilds the catalog key from thread.nodeName. A corrupted image can therefore provide an oversized thread name length and make hfs_bnode_read() write past the catalog search-key allocation. Read the CNID record through hfsplus_brec_read_cat(), which bounds the record read to sizeof(hfsplus_cat_entry) and verifies that a thread record's size exactly matches nodeName.length. - Cleanup in KUnit test (Mohammad Shahid) The kfree() safely handles NULL pointers, so the explicit NULL check in free_mock_str_env() before calling kfree() is unnecessary. The rest contain fixes of generic/564 xfstests' test-case failure for the case of HFS+ file system, syzbot reported issue in hfs_mdb_commit() and hfs_mdb_close() methods of HFS file system, and reworking the MDB locking scheme in HFS file system" * tag 'hfs-v7.3-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/hfs: hfsplus: validate extent record length before writing it back hfsplus: validate B-tree record offset table hfs: rework MDB locking scheme fs: hfsplus: remove redundant NULL check before kfree() hfs: port HFS+ b-tree bitmap corruption check hfs: don't re-dirty MDB buffers after a write failure hfsplus: fix error code when writing beyond volume capacity hfs: fix error code when writing beyond volume capacity hfsplus: validate thread record before delete key rebuild hfs: validate catalog CNIDs before instantiating inodes
2026-08-17Merge branch '200GbE' of ↵Jakub Kicinski
git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue Tony Nguyen says: ==================== Introduce iXD driver Larysa Zaremba says: This patch series adds the iXD driver, which supports the Intel(R) Control Plane PCI Function on Intel E2100 and later IPUs and FNICs. It facilitates a centralized control over multiple IDPF PFs/VFs/SFs exposed by the same card. The reason for the separation is to be able to offload the control plane to the host different from where the data plane is running. This is the first phase in the release of this driver where we implement the initialization of the core PCI driver. Subsequent phases will implement advanced features like usage of idpf ethernet aux device, link management, NVM update via devlink, switchdev port representors, data and exception path, flow rule programming, etc. The first phase entails the following aspects: 1. Additional libie functionalities: Patches 1-5 introduce additional common library API for drivers to communicate with the control plane through mailbox communication. A control queue is a hardware interface which is used by the driver to interact with other subsystems (like firmware). The library APIs allow the driver to setup and configure the control queues to send and receive virtchnl messages. The library has an internal bookkeeping (XN API) mechanism to keep track of the send messages. It supports both synchronous as well as asynchronous way of handling the messages. The library also handles the timeout internally for synchronous messages using events. This reduces the driver's overhead in handling the timeout error cases. The current patch series supports only APIs that are needed for device initialization. These include APIs in the libie_pci module: * Allocating/freeing the DMA memory and mapping the MMIO regions for BAR0, read/write APIs for drivers to access the MMIO memory and libie_cp module: * Control queue initialization and configuration * Transport initialization for bookkeeping * Blocking and asynchronous mailbox transactions Once the mailbox is initialized, the drivers can send and receive virtchnl messages to/from the control plane. The modules above are not supposed to be linked with the main libie library, but do share the folder with it. 2. idpf: Patches 6-11 refactor the idpf driver to use the libie APIs for control queue configuration, virtchnl transaction, device initialization and reset and adjust related code accordingly. 3. ixd: Patches 12-15 add the ixd driver and implement multiple pieces of the initialization flow as follows: * Add the ability to load * A reset is issued to ensure a clean device state, followed by initialization of the mailbox * Device capabilities: As part of initialization, the driver has to determine what the device is capable of (ex. max queues, vports, etc). This information is obtained from the firmware and stored by the driver. * Enable initial support for the devlink interface * '200GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue: ixd: add devlink support ixd: add the core initialization ixd: add reset checks and initialize the mailbox ixd: add basic driver framework for Intel(R) Control Plane Function idpf: print a debug message and bail in case of non-event ctlq message idpf: make mbx_task queueing and cancelling more consistent idpf: refactor idpf to use libie control queues idpf: refactor idpf to use libie_pci APIs idpf: remove unused code for getting RSS info from device idpf: remove 'vport_params_reqd' field libie: add bookkeeping support for control queue messages libie: add control queue support libeth: allow to create fill queues without NAPI libie: add PCI device initialization helpers to libie virtchnl: move virtchnl and virtchnl2 headers to 'include/linux/net/intel' ==================== Link: https://patch.msgid.link/20260812212532.905873-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-17mptcp: remove unused data_ack from struct mptcp_extGeliang Tang
The data_ack and data_ack32 fields in struct mptcp_ext are no longer used anywhere. Remove them from the structure and update mptcp_dump_mpext() trace helper accordingly. Drop the data_ack field from the trace entry and the corresponding output in TP_printk(). Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn> Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260812-net-next-mptcp-misc-feat-7-3-v1-2-1905a818f6cb@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-18netfilter: nf_tables: move set_update_list to nftables per-netnsPablo Neira Ayuso
This list is used to invoke the set .commit and .abort ops for the rbtree and pipapo to run GC on expired elements and replace the current datastructure view by the clone. For the rbtree, this also rebuild the datapath b-search array. From abort path, remove the set from the update_list if it is already bound to rule, then the rule itself takes care of releasing the set and its elements, otherwise, memleak is possible because set ops .abort only deals with removing the set data structure, not the elements. This is a preparation patch to call set .commit before processing the transaction list for the rbtree, no functional changes are intended. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2026-08-17Merge tag 'vfs-7.3-rc1.sync' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs writeback updates from Christian Brauner: "This makes sync_inode_metadata() and writeback_single_inode() persist not only the inode but all metadata associated with it. A new .sync_inode_metadata superblock operation is called from __writeback_single_inode(). Alongside it a new I_METADATA_WRITEBACK state flag is added. Filesystems no longer need their own mmb_fsync() implementations and can just use simple_fsync(). All metadata is now written for IS_SYNC and IS_DIRSYNC inodes. Races where several fsyncs raced and mmb_sync() could return before all buffers were really persisted are fixed since I_SYNC now serializes properly. The I_METADATA_WRITEBACK scheme also fixes the case where a WB_SYNC_NONE writeback landing between write(2) and fsync(2) left fsync(2) failing to persist the inode. That problem is not specific to filesystems using the generic metadata bh tracking, and the ones that do not are left alone. ext2, udf, bfs, minix, fat and ext4 in nojournal mode have their data integrity writeout fixed and are converted. affs drops metadata bh tracking and mmb_fsync() is removed. A few other fixes came out of this: - a UAF in mark_buffer_write_io_error() - missed inode writeback when racing with __writeback_single_inode() - ext4 allocating the mapping_metadata_bhs struct on demand - three fat fixes: a lost inode update in do_msdos_rename() with DIRSYNC, inode buffer write errors not propagating out of fat_sync_inode_metadata() and directory entries not being persisted on fsync(2) of the root directory" * tag 'vfs-7.3-rc1.sync' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (24 commits) writeback: Export __inode_attach_wb() fat: Fix persisting directory entries on fsync(2) of the root directory fat: Propagate inode buffer write errors from fat_sync_inode_metadata() fat: Fix lost inode update in do_msdos_rename() with DIRSYNC vfs: Remove mmb_fsync() fat: Replace fat_sync_inode() with sync_inode_metadata() fat: Fix missed inode writeback during fsync(2) ext4: Fix data integrity writeout issues in nojournal mode minix: Fix data integrity writeout issues bfs: Fix data integrity writeout issues udf: Fold udf_update_inode() into udf_write_inode() udf: Use sync_inode_metadata() in udf_evict_inode() udf: Drop udf_sync_inode() udf: Use sync_inode_metadata() to writeout IS_SYNC inode udf: Fix data integrity writeout issues ext2: Fix data integrity writeout issues ext2: Avoid unnecessary inode buffer writeback for sync(2) ext2: Drop __ext2_write_inode() ext2: Fix lost inode updates for IS_SYNC inodes fs: Provide way for filesystem to wait for metadata writeback ...
2026-08-17sched_ext: Merge branch 'for-7.3-arena-args' into for-7.3Tejun Heo
Pull to receive the __arena argument conversion: 67f1f4a48c24 ("sched_ext: Pass kernel arena pointers to ops_cid callbacks") a8dc810968af ("sched_ext: Convert sub-cap kfuncs to __arena cmask arguments") a05c5b5cb5cf ("sched_ext: Convert scx_bpf_cid_override() to __arena array arguments") along with the bpf-next branch carrying the __arena argument support they depend on. Conflict in kernel/sched/ext/ext.c between: c384ab8a0b13 ("sched_ext: Move the config-off sub-cap kfunc stubs into sub.c") and: a8dc810968af ("sched_ext: Convert sub-cap kfuncs to __arena cmask arguments") which updated the stubs in their old ext.c location. Resolved by keeping ext.c without the stubs and applying the prototype conversion to the relocated stubs in sub.c. Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-17Merge tag 'vfs-7.3-rc1.super' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs superblock updates from Christian Brauner: - Make it possible to share a block device between multiple filesystems. erofs can mount read-only blob devices shared between many superblocks, but because we only tracked a single superblock a freeze, thaw, removal or sync on such a device was never propagated to all the superblocks using it, and there was no way to find them. Add an efficient table to lookup all superblocks using a given block device. - A bunch of pre-existing fixes fell out of this work: A block-device freeze racing a btrfs device change could leave the whole filesystem stuck frozen. A bdev_freeze() issued by "dmsetup suspend" or an LVM snapshot resolves that holder to freeze the filesystem. and bdev_thaw() resolves it again to thaw. A freeze landing while btrfs is adding, removing or replacing a device freezes the filesystem. The membership change then drops that link. So the matching thaw could no longer find the superblock. Forbid freezing a device for the duration of a membership change, modelled on deny_write_access()/allow_write_access(). * tag 'vfs-7.3-rc1.super' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (24 commits) super: fix dying superblock warning messages block: reject block device inodes with i_rdev == 0 in lookup_bdev() selftests/filesystems: add ustat() coverage fs: look up the superblock via the device table in user_get_super() super: make fs_holder_ops private f2fs: open via dedicated fs bdev helpers erofs: open via dedicated fs bdev helpers fs: tolerate per-superblock freeze errors on shared devices fs: look up superblocks via the device table in fs_holder_ops ext4: open via dedicated fs bdev helpers btrfs: open via dedicated fs bdev helpers xfs: port to fs_bdev_file_open_by_path() fs: add dedicated block device open helpers for filesystems fs: maintain a global device-to-superblock table ocfs2: don't reset s_dev on dismount ext4: use anonymous devices for KUnit test superblocks fs, block: move blk_mode_t and fop_flags_t into <linux/types.h> super: take lock after last reference count super: convert s_count to refcount_t s_passive btrfs: deny freezing devices undergoing a replace ...
2026-08-17net_shaper: fix kernel-doc list indentationKarl Mehltretter
Docutils 0.22.4 reports: Documentation/networking/kapi:107: ../include/net/net_shaper.h:82: ERROR: Unexpected indentation. Add the required blank line and correct the list indentation. Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Reviewed-by: Randy Dunlap <rdunlap@infradead.org> Tested-by: Randy Dunlap <rdunlap@infradead.org> Link: https://patch.msgid.link/64f428350ec1450adcd0607f54f30d27a42f129c.1786751700.git.kmehltretter@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-17Merge tag 'vfs-7.3-rc1.netfs' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull cachefiles ondemand removal from Christian Brauner: "This sunsets cachefiles ondemand mode. It was an effort to make fscache usable as a kernel cache for lazy pulling. EROFS over fscache was its only in-tree user. fscache has since become netfslib-oriented while EROFS never acts as a network filesystem and EROFS over fscache has been removed. So this cleans up the netfs, fscache and cachefiles side as well" * tag 'vfs-7.3-rc1.netfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: cachefiles,netfs: sunset ondemand mode
2026-08-17Merge tag 'vfs-7.3-rc1.misc' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull misc vfs updates from Christian Brauner: "Bigger cleanups: - The lockref dead-count handling is tidied up. The open-coded check for a count below zero as the dead marker relies on information the caller should not have. - make put_mnt_ns() leave mounts connected. Destroying a mount namespace disconnected its mounts from their mount points. So a file descriptor still open on the parent of a mount point could be used to peek under it. Locked mounts were already kept connected to prevent exactly that. But a mount is only locked when its tree is copied across a user namespace boundary. So a mount namespace set up by a privileged component had no locked mounts and its mounts were disconnected. Passing UMOUNT_CONNECTED keeps every mount connected and prevents that bug. - vfs_prepare_mode() passes S_IFDIR for directories. I meant to fix that ago but didn't get to it. So now someone finally did it. This kills the exception where the mode could be 0 when a directory was created whereas every other creation operation passed it explicitly already. - move long delayed work for ufs, jffs2, hfsplus, hfs and affs from the per-cpu system_long_wq to the new unbound system_dfl_long_wq. None of that work relies on per-cpu state and the work item is enqueued with queue_delayed_work() whose timer is global anyway. So it may as well benefit from scheduler task placement. Smaller fixes and cleanups: - unlock_buffer() and journal_end_buffer_io_sync() use clear_and_wake_up_bit() - the pipe page pools are unified into a single per-pipe pool and the extra wake_up(rd_wait) is limited to EPOLLET consumers - eventpoll now computes its timer slack lazily in ep_poll() - shrink_dcache_for_umount() keeps making progress on busy roots - excess xarray nodes are freed in clear_inode() - romfs detects hard link cycles - the user path of nested backing files is fixed - pidfd holds exec_update_lock around the namespace ioctl - non-memcg-aware nr_cached_objects is skipped during memcg slab shrink - iomap_write_iter() always returns status - mangle_path() is renamed to seq_mangle_path() - inode timestamp accessors are annotated - new regression test for pipe->poll_usage. - a few documentation, kernel-doc and selftest fixes" * tag 'vfs-7.3-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (67 commits) selftests/namespaces: Fix racy pipe handshake in timens and pidns_separate selftests/epoll: add a regression test for pipe->poll_usage pipe: only enable the extra wake_up(rd_wait) for EPOLLET consumers pidfd: hold exec_update_lock around namespace ioctl fs: fix user path of nested backing files fs: remove stale inode_insert5() kernel-doc parameter fs: fix switch/case indentation in sysfs() syscall fs: document semantics of kstat::{uid,gid} fields dcache: keep shrink_dcache_for_umount() making progress on busy roots seq_file: rename mangle_path to seq_mangle_path nstree: add/fix struct ns_id_req kernel-doc member fields dcache: use lockref routines for dead count checks lockref: tidy up dead count handling initramfs: fix typo in reserve_initrd_mem comment fs/pipe: unify the page pools into a single per-pipe pool fs: annotate inode timestamp accessors eventpoll: compute timer slack lazily in ep_poll() selftests/filesystems: add mntns cleanup test put_mnt_ns(): leave mounts connected affs: Move long delayed work on system_dfl_long_wq ...
2026-08-17Merge tag 'vfs-7.3-rc1.lookup' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs lookup updates from Christian Brauner: "This refactors lookup_open() and adds vfs_lookup_open() for nfsd. mnt_want_write() and parent locking are moved into lookup_open() itself. audit_inode_child() is also now called in lookup_open() on failure. That is the calling convention in vfs_create() and vfs_mkdir(), but lookup_open() made no such call when atomic_open() should have created a file and did not. And neither did the regular ->create() path fwiw. This also contains work to remove the unneeded excl argument from the ->create() inode op" * tag 'vfs-7.3-rc1.lookup' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: fs/namei.c: fix coding style in atomic_open() and lookup_open() fs/namei.c: fix kerneldoc of atomic_open() and vfs_lookup_open() fs/namei.c: update stale comments in lookup_open() Remove excl arg to ->create inode_operation fs/namei.c: update kerneldoc of atomic_open() vfs: call audit_inode_child() in lookup_open() on failure vfs: move create error && negative dentry case in lookup_open() up VFS: add vfs_lookup_open() for nfsd VFS: move delegated_inode retry loop into lookup_open() VFS: move mnt_want_write() and locking into lookup_open()
2026-08-17Merge tag 'vfs-7.3-rc1.kthread' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull kthread vfs updates from Christian Brauner: "This stops kernel threads from sharing filesystem state with userspace. This work is about 3 cycles old and has been in -next for about that time. When the kernel boots init_task creates PID 1 and then kthreadd. From that point every kthread and PID 1 share the same fs_struct. That is why pivot_root() has to rewrite the fs_struct of all kthreads. The rewriting exists so that kthreads can use init's filesystem state when they want to. It also means userspace can move the ground out from under the kernel. PID 1 now gets a completely separate fs_struct. All kthreads are anchored in a private SB_KERNMOUNT instance of nullfs that cannot be mounted on and cannot be used to follow other mounts. Userspace init can no longer affect kthread filesystem state and kthreads can no longer affect userspace fs state without explicit opting in to that. Path lookup from a kthread now fails by default. It makes it deliberately hard to offload security sensitive operations into init's filesystem state from a kthread. Places that legitimately need to look something up there opt in through the new scoped_with_init_fs() which temporarily overrides the caller's fs_struct with init's. usermodehelpers remain the only kernel tasks that genuinely share init's filesystem state, since they execute random binaries in the root filesystem (excellent...). The visible result is that /proc/2/root is a nullfs with an empty mountinfo while /proc/1/root is the real root" * tag 'vfs-7.3-rc1.kthread' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (26 commits) initramfs_test: use test init/exit hooks to override init fs fs: stop rewriting paths for PF_EXITING | PF_DUMPCORE fs: stop rewriting kthread fs structs fs: start all kthreads in nullfs nullfs: make nullfs multi-instance devtmpfs: create private mount namespace fs: add umh argument to struct kernel_clone_args fs: stop sharing fs_struct between init_task and pid 1 af_unix: use scoped_with_init_fs() for coredump socket lookup initramfs: use scoped_with_init_fs() for rootfs unpacking pnfs/blocklayout: use scoped_with_init_fs() for SCSI device lookup ksmbd: use scoped_with_init_fs() for VFS path operations ksmbd: use scoped_with_init_fs() for filesystem info path lookup ksmbd: use scoped_with_init_fs() for share path resolution fs: use scoped_with_init_fs() for kernel_read_file_from_path_initns() coredump: use scoped_with_init_fs() for coredump path resolution btrfs: use scoped_with_init_fs() for update_dev_time() scsi: target: use scoped_with_init_fs() for APTPL metadata scsi: target: use scoped_with_init_fs() for ALUA metadata crypto: ccp: use scoped_with_init_fs() for SEV file access ...
2026-08-17Merge tag 'vfs-7.3-rc1.kfunc' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs bpf access updates from Christian Brauner: "This adds a bpf_sock_read_xattr() kfunc so a BPF LSM program can read a user.* extended attribute from a socket's sockfs inode locklessly. userspace already uses user.* xattrs on sockets to implement socket rate limiting and to tag sockets for other purposes such as a varlink registry. There has been no efficient way for a BPF program to read those labels back. With this a listening socket marked from userspace with fsetxattr() can be read back during bind or connect and acted upon on the connecting socket. That lets userspace mark sockets and later rediscover them or implement policy on them" * tag 'vfs-7.3-rc1.kfunc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: selftests/bpf: Add test for bpf_sock_read_xattr() kfunc fs: Add bpf_sock_read_xattr() kfunc to read socket xattrs
2026-08-17net: add READ_ONCE()/WRITE_ONCE() annotations for dev->prio_tc_mapEric Dumazet
Concurrent fast-path readers access dev->prio_tc_map (e.g. via skb_tx_hash(), netdev_get_prio_tc_map(), and qdiscs) while writers update entries in dev->prio_tc_map or reset/clear the map via netdev_reset_tc() and netdev_unbind_sb_channel(). Furthermore, memset() in netdev_reset_tc() and netdev_unbind_sb_channel() provides no guarantee of performing atomic word/byte stores. Add READ_ONCE() and WRITE_ONCE() annotations to netdev_get_prio_tc_map() and netdev_set_prio_tc_map(), replace memset() in dev.c with explicit WRITE_ONCE() loops, and update direct array accesses in qdiscs to use netdev_get_prio_tc_map(). Signed-off-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20260812085440.3917924-4-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-17net: add READ_ONCE()/WRITE_ONCE() annotations for dev->num_tcEric Dumazet
Several fast-path and control-path lockless readers access dev->num_tc (e.g., skb_tx_hash(), netdev_txq_to_tc(), netdev_get_num_tc(), and qdisc/driver lookups) while concurrent writers update dev->num_tc during TC setup, device reset, or channel configuration. Add READ_ONCE() and WRITE_ONCE() annotations to prevent compiler reordering and load/store tearing when accessing dev->num_tc. Update inline helpers in netdevice.h (netdev_get_num_tc(), netdev_set_prio_tc_map(), and netdev_get_sb_channel()) as well as writers and lockless readers in core networking code and drivers. Signed-off-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20260812085440.3917924-3-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-17net: prevent torn reads in netdev_tc_txqEric Dumazet
netdev_set_tc_queue() (and related helpers/drivers such as netdev_bind_sb_channel_queue(), netdev_reset_tc(), and netdev_unbind_sb_channel()) perform separate 16-bit writes to dev->tc_to_txq[tc].count and dev->tc_to_txq[tc].offset. Furthermore, memset() in netdev_reset_tc() and netdev_unbind_sb_channel() provides no guarantee of performing full 32-bit word stores. Concurrent lockless readers (e.g. skb_tx_hash(), netdev_txq_to_tc(), ixgbe_select_queue(), taprio, mqprio, FPE drivers) can observe torn values where offset and count belong to inconsistent configurations. Redefine struct netdev_tc_txq to embed count and offset inside a union with a u32 combined field, allowing atomic manipulation via READ_ONCE() and WRITE_ONCE(). Update all lockless readers and writers across the kernel to use READ_ONCE() and WRITE_ONCE() on the combined field. Signed-off-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20260812085440.3917924-2-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-17Merge tag 'vfs-7.3-rc1.iomap' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull iomap updates from Christian Brauner: "The bulk of this is the conversion of iomap to a single ->iomap_next() callback and thus finishing the move to an iterator model. Every iomap operation drove its iteration through a struct iomap_ops holding ->iomap_begin() and ->iomap_end(). iomap_iter() only ever sees those as pointers. That means every step of every iteration is an indirect call. This collapses both into one ->iomap_next() callback that finishes the previous mapping and produces the next one. This lets callers inline the iteration loop and pass its ->iomap_next() as a compile time constant. That means the compiler can turn it into a direct and hence inlineable call. This also allows future callers to express custom logic to drive the iteration forward better. xfs, btrfs, ext4, ext2, erofs, f2fs, gfs2, hpfs, fuse, exfat, zonefs, ntfs, ntfs3 and the block device mapping are all converted. No functional changes are intended. This also adds a simple direct I/O path for small reads. On Gen5 NVMe the __iomap_dio_rw() dominates 4K random reads. The same single-core io_uring poll mode workload reaches ~3.2M IOPS against the raw block device but only ~1.92M through ext4 or XFS. __iomap_dio_rw(), iomap_iter(), iomap_dio_bio_iter() and kfree() were at the top of the profile. The new path is very lightweight if no special behavior is requested. The bio comes from a dedicated bioset and laid out so the whole request is a single cacheline aligned allocation. Completion runs inline. That takes ext4 from 1.92M to 2.19M IOPS in the original workload. fio shows around: - 4% at libaio queue depths of 64 and up - around 5% for io_uring - up to 10% for io_uring poll mode at depth 256 on both ext4 and xfs. A few other patches: - iomap_folio_mark_uptodate() lets a filesystem that writes into the page cache outside the iomap read and write paths keep iomap's internal uptodate bitmap in sync, which fuse needs for server-pushed notify stores before it can enable large folios; - two fixes for iomap_bio_read_folio_range_sync(): a potential crash when device integrity behavior is changed and a missing bio_uninit(). - a folio batch release fix on iomap callback failures - FGP_NOFS is dropped from iomap_get_folio() - documentation fix" * tag 'vfs-7.3-rc1.iomap' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (29 commits) iomap: iomap_bio_read_folio_range_sync is missing a call to bio_uninit iomap: don't free integrity payload that doesn't exist docs: fix grammatical error in iomap docs exfat: convert iomap ops to ->iomap_next() fuse: convert iomap ops to ->iomap_next() hpfs: convert iomap ops to ->iomap_next() gfs2: convert iomap ops to ->iomap_next() f2fs: convert iomap ops to ->iomap_next() block: convert iomap ops to ->iomap_next() ext2: convert iomap ops to ->iomap_next() zonefs: convert iomap ops to ->iomap_next() erofs: convert iomap ops to ->iomap_next() ext4: convert iomap ops to ->iomap_next() ntfs: convert iomap ops to ->iomap_next() ntfs3: convert iomap ops to ->iomap_next() btrfs: convert iomap ops to ->iomap_next() xfs: convert iomap ops to ->iomap_next() iomap: add ->iomap_next() iomap: use GFP_NOWAIT when application for iomap_dio_simple allocations iomap: decouple simple direct I/O reads from iomap_dio_rw ...
2026-08-17Merge tag 'clk-misc-round-two-for-v7.3' of ssh://github.com/masneyb/linux ↵Stephen Boyd
into clk-pile Pull clk patches from Brian Masney: - New clock controller drivers for the Cix Sky1 audio subsystem (AUDSS), UltraRISC DP1000, and MediaTek MT8173 MFG_TOP, along with their devicetree bindings. Si549 support was added to the existing si544 driver. - New clock and reset support for the Aspeed AST2700 PECI controller and Airoha EN7523 PCIe PERSTOUT reset lines. - The clk core gains devm_clk_bulk_get_enable() as the mandatory counterpart to the existing optional variant, and exports devm_clk_hw_register_composite_pdata() for modular drivers. - Tegra gets a proper EMC clock implementation for Tegra114, 48MHz pll_p_out1 support needed for UEFI on Surface2, and the Xilinx clocking-wizard gains PLL charge pump/lock parameter programming during dynamic reconfiguration. - Bug fixes for a NULL pointer dereference from uninitialized clk_init_data in the eswin driver, an IO remap leak in the MediaTek pllfh error path, inverted gate control for MT8135 devapc_ck, a missing OF node put in tegra124-emc on registration failure, a prepare reference leak in the palmas driver, unregistered PLLs on MT6735 probe failure, a missing kasprintf NULL check in pmc_atom, PCIe warm boot instability in the Airoha EN7523 driver, and a clocking-wizard clock difference detection bug. - Various cleanups across tegra, st, and mvebu providers to stop misusing the consumer clock API, along with other minor fixes and improvements. Signed-off-by: Brian Masney <bmasney@redhat.com> * tag 'clk-misc-round-two-for-v7.3' of ssh://github.com/masneyb/linux: (45 commits) clk: tegra: set up proper EMC clock implementation for Tegra114 clk: clocking-wizard: remove 20kHz restriction clk: clocking-wizard: optimize clock search clk: clocking-wizard: fix clock difference detection clk: mediatek: mt8135: Fix inverted gate control for devapc_ck clk: clocking-wizard: Program PLL CP/RES and lock parameters on reconfig clk: tegra: support 48MHz clock for pll_p_out1 clk: aspeed: add AST2700 PECI clock dt-bindings: clock: ast2700: add PECI clock clk: mediatek: Add mt8173-mfgtop driver dt-bindings: clock: mediatek: Add mt8173 mfgtop clk: tegra: clean-up simple provider misuse of the consumer API clk: st: clean-up simple provider misuse of the consumer API clk: mvebu: clean-up simple provider misuse of the consumer API clk: remove conditional return with no effect clk: Add devm_clk_bulk_get_enable() clk: en7523: add support for dedicated PCIe PERSTOUT reset dt-bindings: clock: airoha: Add additional reset for PCIe PERSTOUT arm64: dts: cix: sky1: add audss cru reset: cix: add sky1 audss auxiliary reset driver ...
2026-08-17Merge tag 'clk-misc-for-v7.3' of ssh://github.com/masneyb/linux into clk-pileStephen Boyd
Pull clk patches picked up by Brian Masney: Here's various improvements and fixes for the clk subsystem that was posted prior to the opening of the last merge window. - Add spread spectrum clock (SSC) support to the clk framework, including a new assigned-clock-sscs devicetree property and clk_hw_set_spread_spectrum() API with KUnit tests (Peng Fan) - Add SCMI clock OEM extensions for the i.MX95 clock driver and introduce a common SCMI clock header (Peng Fan) - Add clock, reset, and devicetree bindings for the ESWIN EIC7700 HSP clock and reset generator (Xuyang Dong) - Add clk_determine_rate_noop() helper for clock drivers that can do any rate, and convert existing open-coded implementations across hisilicon, imx, qcom, renesas, rp1, samsung, scpi, sprd, mediatek phy, and mediatek pmdomain drivers (Brian Masney) - Add kernel-doc documentation for struct clk_core and the core clock flags, and wire up clk identifiers into the documentation build (Brian Masney) - Fix clk_divider_bestdiv() returning the minimum rate instead of the maximum rate for large rate requests, with KUnit tests (Lad Prabhakar) - Fix Nuvoton MA35D1 PLL frequency calculation including ignored div_u64 return values, incorrect PLL_CTL1_FRAC bit field width, and broken determine_rate logic (Joey Lu) - Support unique clock names for multi-socket Tegra platforms (Jon Hunter) - Allow COMPILE_TEST builds for HiSilicon clock drivers (Rosen Penev) - Various fixes and cleanups from Akari Tsuyukusa, Alexander A. Klimov, Brian Masney, David Carlier, David Laight, Min zhang, Myeonghun Pak, Pavel Löbl, Randy Dunlap, Rob Herring, Rosen Penev, Uwe Kleine-König, William Theesfeld, Xuyang Dong, and Yu-Chun Lin Signed-off-by: Brian Masney <bmasney@redhat.com> [sboyd@kernel.org: Fix allmodconfig modpost failure in scmi] * tag 'clk-misc-for-v7.3' of ssh://github.com/masneyb/linux: (53 commits) pmdomain: mediatek: mtk-mfg: use clk_determine_rate_noop() pmdomain: mediatek: airoha: use clk_determine_rate_noop() phy: mediatek: phy-mtk-hdmi-mt2701: use clk_determine_rate_noop() clk: sprd: use clk_determine_rate_noop() clk: scpi: use clk_determine_rate_noop() clk: samsung: acpm: use clk_determine_rate_noop() clk: rp1: use clk_determine_rate_noop() clk: renesas: rzg2l-cpg: use clk_determine_rate_noop() clk: qcom: smd-rpm: use clk_determine_rate_noop() clk: qcom: rpmh: use clk_determine_rate_noop() clk: qcom: rpm: use clk_determine_rate_noop() clk: imx: scu: use clk_determine_rate_noop() clk: hisilicon: hi3660-stub: use clk_determine_rate_noop() clk: add clk_determine_rate_noop() clk: imx: scu: drop redundant init.ops variable assignment clk: test: convert constants to use HZ_PER_MHZ docs: clk: include some identifiers to keep documentation up to date clk: add kernel docs for struct clk_core clk: add kernel docs for the core flags clk: hisilicon: allow COMPILE_TEST builds ...
2026-08-17Merge tag 'vfs-7.3-rc1.failfs' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull failfs filesystem from Christian Brauner: "Add failfs and expose a FD_FAILFS_ROOT sentinel. This allows userspace to shed their filesystem state completely. A process with its root or working directory in failfs must anchor every path lookup at an explicit file descriptor. Absolute paths, absolute symlinks and AT_FDCWD-relative lookups simply fail. Failfs is the counterpart to nullfs. nullfs says adds a permanently empty, immutable directory whose lookups fail with ENOENT but which can be opened, read, stat'd and mounted upon. Failfs on the other hand fails every operation. The root cannot be opened at all. A single instance is mounted during early boot via kern_mount(), which makes it logically distinct from every mount namespace. This is accompanied by a new fchroot() system call which makes chrooting via a file descriptor a first class concept. It's possible to chroot into failfs as an unprivileged user provided the task has no new privileges set" * tag 'vfs-7.3-rc1.failfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: Documentation: add failfs documentation selftests/filesystems: add failfs selftests arch: hookup fchroot() system call fs: support FD_FAILFS_ROOT in fchroot() fs: add fchroot() fs: support FD_FAILFS_ROOT in fchdir() fs: add failfs
2026-08-17NFS/localio: issue IO inline when not in a memory-reclaim contextMike Snitzer
Every LOCALIO read and write is currently bounced through the dedicated !WQ_MEM_RECLAIM nfslocaliod_workqueue. That bounce is only actually required when the submitting context is a memory-reclaim context: LOCALIO issues IO directly into a stacked local filesystem (e.g. XFS) which may in turn flush its own !WQ_MEM_RECLAIM workqueue. Doing that from a WQ_MEM_RECLAIM worker (most importantly writeback's wb_workfn on bdi_wq) or an explicit PF_MEMALLOC reclaim task trips check_flush_dependency() and risks a forward-progress deadlock, which is why commit b9f5dd57f4a5 ("nfs/localio: use dedicated workqueues for filesystem read and write") introduced the intermediate workqueue. Outside of reclaim context -- ordinary application/task submission such as O_DIRECT or fsync-driven writeback -- the workqueue hop buys nothing and merely adds a context switch and scheduling latency per IO while discarding the NFS client's inherent application-context parallelism. Add current_is_workqueue_mem_reclaim(), which reports whether %current is a WQ_MEM_RECLAIM worker using the same predicate check_flush_dependency() warns on. Use it, together with the PF_MEMALLOC check, in the new nfs_local_defer_io() helper to decide per-IO whether nfs_local_do_read() and nfs_local_do_write() must defer to nfslocaliod_workqueue or may issue the IO inline. Buffered writeback continues to bounce (wb_workfn is a WQ_MEM_RECLAIM worker); O_DIRECT and app-context submission now run inline. Running nfs_local_call_write() inline is safe: it already saves and restores current->flags around the PF_LOCAL_THROTTLE|PF_MEMALLOC_NOIO it sets and scopes the file opener's creds. The async O_DIRECT completion path is likewise unaffected: when the underlying filesystem returns -EIOCBQUEUED, the kiocb ki_complete callback (nfs_local_read_aio_complete / nfs_local_write_aio_complete) can run in bottom-half context and so must still defer the pgio completion (nfs_local_pgio_release -> rpc_call_done) to nfsiod_workqueue via nfs_local_pgio_aio_complete(). That completion hop is independent of how the IO was submitted, and this change leaves it as-is; only the submission side stops unconditionally hopping through nfslocaliod_workqueue. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Mike Snitzer <snitzer@kernel.org> Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2026-08-17nfs4.2: open UNCACHEABLE_FILE_DATA files with O_DIRECTMike Snitzer
Honor the per-file UNCACHEABLE_FILE_DATA attribute by transparently opening such regular files with O_DIRECT, so reads and writes bypass the page cache as the attribute requires, without the application having to request O_DIRECT itself. This follows the model the specification describes: the attribute is "similar in intent to O_DIRECT" and clients "retain flexibility in how they satisfy the requirements" (draft-ietf-nfsv4-uncacheable-files Section 4.4, "Relationship to Direct I/O"), and its Implementation Status (Section 6) describes a prototype Linux client that "treats the attribute as an indication to use O_DIRECT-like behavior for file access". Introduce an NFS_CONTEXT_O_DIRECT open-context flag: nfs4_atomic_open() sets it when the resolved inode has uncacheable_file_data set (and the open is not O_APPEND), and the open paths nfs_atomic_open() and nfs4_file_open() apply O_DIRECT to the file when the flag is set. The I/O mode is thus selected at open time and is not changed for an already-open file: a later change to the attribute takes effect on the next open. The specification permits this -- a client that has already opened a file MAY continue with its existing caching behavior and apply the updated attribute to subsequent operations (Section 5). The delegation interaction in Section 4.3 was considered: it permits read caching to remain when another NFSv4.2 mechanism, such as a delegation, already ensures a consistent view of the file. That relaxation is optional ("may remain appropriate") and read-only -- it does not relax write-behind suppression (Section 4.1) or the WRITE durability invariant (Section 4.2). This implementation deliberately does not take it: an uncacheable file is opened O_DIRECT regardless of any delegation held, which is compliant (read caching is simply suppressed more aggressively than the Section 4.3 minimum) and avoids decoupling read vs write caching behind a single open flag. Relaxing reads under a delegation is left as a possible future optimization. Section 6 observes the benefit holds "for applications that issue well-formed I/O requests". That alignment caveat does not constrain the Linux NFS client's over-the-wire path: the client readily issues misaligned I/O using O_DIRECT over SunRPC to the remote NFS server. The only place a fallback from O_DIRECT to buffered I/O for misaligned I/O applies is NFS LOCALIO (fs/nfs/localio.c), which detects non-DIO-aligned I/O and falls back internally; that path is unaffected by this change. Link: https://datatracker.ietf.org/doc/draft-ietf-nfsv4-uncacheable-files/ Signed-off-by: Mike Snitzer <snitzer@kernel.org> Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2026-08-17nfs4.2: add UNCACHEABLE_FILE_DATA attribute supportTom Haynes
Recognize the NFSv4.2 per-file UNCACHEABLE_FILE_DATA attribute (attr 87, draft-ietf-nfsv4-uncacheable-files): decode it via GETATTR, track per- exported-filesystem support, and record on the inode whether a regular file's data must not be cached. Acting on the attribute (opening such files O_DIRECT) is done by a subsequent change. If the NFSv4 server reports a regular file's UNCACHEABLE_FILE_DATA as true, it indicates the file's data must not be cached; the client records this in NFS_I(inode)->uncacheable_file_data for use by the I/O paths. The UNCACHEABLE_FILE_DATA attribute applies only to regular files (NF4REG); per the draft a server MUST reject a query of it on any other object type with NFS4ERR_INVAL. A subsequent commit gates the client accordingly. Link: https://datatracker.ietf.org/doc/draft-ietf-nfsv4-uncacheable-files/ Signed-off-by: Tom Haynes <loghyr@hammerspace.com> [snitzer: adapt Tom's original code focused on metadata for ABE] Co-developed-by: Mike Snitzer <snitzer@hammerspace.com> Signed-off-by: Mike Snitzer <snitzer@hammerspace.com> Signed-off-by: Mike Snitzer <snitzer@kernel.org> Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2026-08-17Merge tags 'vfs-7.3-rc1.efs' and 'vfs-7.3-rc1.freevxfs' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull efs and freevxfs removal from Christian Brauner: "This removes the EFS and freevxfs filesystems: - EFS was the read-only on-disk format SGI used on IRIX before XFS - freevxfs provided compatibility with various old-school Unix systems from the 1990s and was fun 25 years ago. Today it mostly serves as fodder for automated bug checkers. There has been only one known user and contributor in the last 15 years" * tag 'vfs-7.3-rc1.efs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: efs: Remove EFS * tag 'vfs-7.3-rc1.freevxfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: freevxfs: remove the driver
2026-08-17Merge tag 'vfs-7.3-rc1.binfmt' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull binfmt updates from Christian Brauner: "This contains a bunch of work for binfmt_misc. It fixes a bunch of old bugs, reworks the locking, and then extends the format registry so a binary type can be matched programmatically and its interpreter computed per exec instead of being a fixed string recorded at registration time. This allows nixos and other to e.g., implement relocatable binaries meaning the interpreter/dynamic loader can be determined programatically, say found relative to the binary. The mechanism is flexible and can support other policies: - Handler lookup is now an rcu walk. An exec that matches no binfmt_misc entry should now never write to a shared cacheline - remove the VERBOSE_STATUS and USE_DEBUG compile time toggles - convert the entry file to a seq_file which simplifies things quite a bit and kills a lot of custom logic - make flags proper enums - rename struct Node to binfmt_misc_entry - allow entries to be removed with unlink(2) - Add the ability to attach bpf programs to binfmt_misc entries so it's possible to dynamically choose the execution environment such as the loader or interpreter on a per binary basis. A handler is an instance of a binfmt_misc_ops struct_ops with a ->match() and a ->load() program. match() decides from the entry lookup walk whether the handler applies under the same registration-order. It can read file content as needed not only the prefetched 256 bytes in bprm->buf. load() then selects the interpreter and stages it through the new bpf_binprm_set_interp(), bpf_binprm_set_interp_arg() and bpf_binprm_set_flags() kfuncs. Handlers are published in a registry keyed by the registering task's user namespace and activated through the existing text interface with a new 'B' type carrying the handler name: echo ':origin:B::::nix:' > /proc/sys/fs/binfmt_misc/register The permission and namespacing model is unchanged. Activating a handler requires the same write access to an instance as any other registration. A container mounting its own instance escapes the host's entries exactly as before. The computed interpreter is opened with open_exec() under the caller's credentials and goes through full LSM vetting as the next binprm level. A program can only ever redirect the caller to something the caller could exec anyway. - Two dispatch modes are added. So far the chosen interpreter owns the whole process identity (argv[0], /proc/pid/cmdline, /proc/self/exe all name interpreter information). So relocatable find the dynamic linker instead. Also a binary passed to execveat() as an inaccessible O_CLOEXEC fd cannot run at all and gdb trips because AT_ENTRY and AT_PHDR do not match the exe file. So PIE symbols are unrelocated. This adds transparent dispatch which allows the interpreter to load the binary through AT_EXECFD and leaves the argument vector exactly as the caller built it and labels mm->exe_file and comm with the binary. It also raises the AT_FLAGS_TRANSPARENT_INTERP aux vector bit. The interpreter keeps control of mapping the binary. The second mode is loader substitution. This allows a binary to be executed natively and only the interpreter to be changed. - Last, interpreters can be bound at registration time. Each interpreter is opened by its own write with the credentials the entry file was opened with. The program picks one per exec with bpf_binprm_select_interp(). Ucounts are used to properly account for pre-opened interpreters via /proc/sys/user/max_binfmt_misc_interpreters" * tag 'vfs-7.3-rc1.binfmt' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (63 commits) binfmt_misc: document the pre-opened interpreter limit selftests/exec: test the pre-opened interpreter limit binfmt_misc: correctly account pre-opened interpreters binfmt_misc: document interpreters bound by a 'B' entry selftests/exec: test interpreters bound to a 'B' entry binfmt_misc: let a 'B' entry bind its interpreters binfmt_misc: carry pre-opened interpreters in struct binfmt_misc_interp selftests/exec: share the bpf handler preconditions binfmt_misc: document registering an entry disabled selftests/exec: test registering an entry disabled selftests/exec: let binfmt_flag_supported() return a bool selftests/exec: check that a binfmt_misc instance cannot be pinned binfmt_misc: let a register string create an entry disabled binfmt_misc: document loader substitution selftests/exec: test binfmt_misc loader substitution binfmt_misc: let a bpf handler request loader substitution binfmt_misc: add the 'L' loader substitution flag binfmt_elf_fdpic: consume a stashed PT_INTERP substitute binfmt_elf: consume a stashed PT_INTERP substitute exec: carry a PT_INTERP substitute in struct linux_binprm ...
2026-08-17fuse: add zero-copy over io-uringJoanne Koong
Implement zero-copy in fuse io-uring to eliminate memory copies between the application, kernel, and server for read/write operations. The server can directly access client pages or page cache folios without copying data through an intermediary buffer. When a fuse request arrives, the kernel registers the relevant pages into a sparse slot in the server's io_uring registered buffer table. The server can then operate on these pages directly using io-uring fixed buffer operations (eg read_fixed/write_fixed) and the kernel unregisters these pages when the request completes. Non-page-backed args (eg op out headers) will go through the payload buffer as normal. The server can specify which open files should have their reads/writes go through zero-copy, by setting the FOPEN_IO_URING_ZERO_COPY flag when servicing opens. This requires CAP_SYS_ADMIN and bufpools. This is gated behind CAP_SYS_ADMIN because zero-copy allows the server direct access to the client's underlying pages, rather than operating on an intermediary buffer that the contents of the client's pages were copied into or on page cache folios. The request flow for the zero-copy direct-io write path (client writes data, server reads it) is as follows: ======================================================================= | Kernel | FUSE server | | | "write(fd, buf, 1MB)" | | | | >sys_write() | | >fuse_file_write_iter() | | >fuse_send_one() | | [req->args->in_pages = true] | | [folios hold client write data] | | | | >fuse_uring_copy_to_ring() | | >copy_header_to_ring(IN_OUT) | | [memcpy fuse_in_header] | | >copy_header_to_ring(OP) | | [memcpy write_in header] | | | | >fuse_uring_args_to_ring() | | >setup_fuse_copy_state() | | [skip_folio_copy = true] | | | | >fuse_uring_set_up_zero_copy() | | [folio_get for each client folio] | | [build bio_vec array from folios] | | >io_buffer_register_bvec() | | [register pages at ent->zero_copy_index] | | [ent->zero_copied = true] | | | | >fuse_copy_args() | | [skip_folio_copy => return 0 | | for page arg, skip data copy] | | | | >copy_header_to_ring(RING_ENT) | | [memcpy ent_in_out] | | >io_uring_cmd_done() | | | | | [CQE received] | | | | [issue io_uring READ at | | ent->zero_copy_index] | | [reads directly from | |client's pages (ZERO_COPY)] | | | | [write data to backing | | store] | | [submit COMMIT AND FETCH] | | | >fuse_uring_commit_fetch() | | >fuse_uring_commit() | | >fuse_uring_copy_from_ring() | | >fuse_uring_req_end() | | >io_buffer_unregister(ent->zero_copy_index) | | [unregister pages from index] | | >fuse_zero_copy_release() | | [folio_put for each folio] | | [ent->zero_copied = false] | | >fuse_request_end() | | [wake up client] | The zero-copy read path is analogous. Some requests may have both page-backed args and non-page-backed args. For these requests, the page-backed args are zero-copied while the non-page-backed args are copied to the buffer selected from the buffer pool: zero-copy: pages registered via io_buffer_register_bvec() non-page-backed: copied to payload buffer via fuse_copy_args() For a request whose payload is zero-copied, the registration/unregistration path looks like: register: fuse_uring_set_up_zero_copy() folio_get() for each folio io_buffer_register_bvec(ent->zero_copy_index) unregister: fuse_uring_req_end() io_buffer_unregister(ent->zero_copy_index) -> fuse_zero_copy_release() callback folio_put() for each folio Please note that on abort for in-flight zero-copied requests that have been sent to userspace, the registered bvec slot remains occupied and its folios remain pinned until the io-uring ring is destroyed, at which point io-uring unregisters all buffers and the fuse_zero_copy_release() callback drops the folio references. Unregistering at teardown would require operating on the ring context directly, whose validity is hard to ascertain; this is deemed not worth the complexity for the abort race, since everything is freed when the ring is torn down. The throughput improvement from zero-copy depends on how much of the per-request latency is spent on data copying vs backing I/O. The gain comes from eliminating the payload-buffer memcpy, but accessing the zero-copied pages requires the server to issue the read/write as an IORING_OP_READ/WRITE_FIXED operation. The benefit is largest when the mempcy is a meaningful fraction of per-request latency while backing i/o is still noticable enough that the extra io-uring op's overhead doesn't dominate. Benchmarked with passthrough_hp (--nopassthrough, q_depth=8) on a 2-socket Intel Xeon Gold 6138 (40 cores / 80 threads), using fio (sync engine, bs=1M, O_DIRECT, numjobs=2, 30s run + 10s ramp, 3 runs) where direct-I/O throughput is against a RAM-backed (tmpfs) source (backing I/O is not the bottleneck): baseline registered-buf zero-copy (zc vs base) direct read ~5.1 GB/s ~5.4 GB/s ~8.9 GB/s (+75%) direct write ~3.4 GB/s ~4.8 GB/s ~5.1 GB/s (+50%) Reads end up higher than writes because the backing store reads faster than it writes (the baseline shows the same read>write gap, and the raw device does too). On a device-bound NVMe (~2 GB/s reads) the read gain shrinks to ~10-16% (and no measurable gains for writes), as backing I/O rather than the eliminated copy dominates latency. The benefit overall scales with how much of the per-request latency is the data copy versus backing I/O. Signed-off-by: Joanne Koong <joannelkoong@gmail.com> Reviewed-by: Bernd Schubert <bernd@bsbernd.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2026-08-17fuse: add io-uring buffer poolsJoanne Koong
Right now, ents and buffers are tightly coupled in fuse io-uring where each entry has its own dedicated payload buffer, requiring N buffers for N entries where each buffer must be large enough to accomodate the maximum payload size. This is suboptimal as most request types (lookup, open, release, getattr, etc) require vastly less bytes than the maximum payload size and some requests (unlink, rmdir, fsync, flush, etc) do not require payload buffers at all. Instead of requiring a 1:1 coupling between ents and payload buffers, allow the server to pass in a buffer pool (a contiguous chunk of memory) that the kernel will use as it wishes for servicing ents/requests. Entries only reserve a "buffer" from the pool while actively processing a request that requires a payload buffer. This decoupling and letting the kernel delegate memory from the pool for requests allows the kernel to optimize memory usage and reduces the memory usage requirements needed to use fuse-over-io-uring. A pool is registered per queue with the new FUSE_IO_URING_CMD_ADD_BUFPOOL command. The server passes the pool's base address and length in fuse_uring_cmd_req.bufpool.{uaddr,len}. Internally, the kernel splits the region into buffers of ring->max_payload_sz bytes each (nr_bufs = pool len / max_payload_sz). A queue commits to a payload mode on first use: registering an entry that carries its own payload selects the legacy per-entry mode, while ADD_BUFPOOL selects pool mode. The two are mutually exclusive, so ADD_BUFPOOL must be issued before any payload-carrying entries are registered on that queue. The queue must have been created before the bufpool is added, through the FUSE_IO_URING_CMD_ADD_QUEUE command. The kernel tracks free buffers with a bitmap (a set bit marks a free buffer). On dispatch, a request that needs a payload claims a free buffer (find_first_bit + clear). A request that needs none claims nothing. The buffer's byte offset within the pool is reported to the server in the new fuse_uring_ent_in_out.offset field so that the server can locate the payload. On completion the buffer is returned to the pool or reused directly if the next request on that entry also has a payload. The FUSE_HAS_IO_URING_BUFPOOL flag advertises kernel support to the server for bufpools. Buffer pool request flow ~~~~~~~~~~~~~~~~~~~~~~~~ | Kernel | FUSE daemon | | | [request arrives] | | [claim a free pool buffer] | | >fuse_uring_select_buffer() | | [copy headers to ring] | | [copy payload to buffer] | | [report buffer offset in ent_in_out] | | >io_uring_cmd_done() | | | [read headers] | | [read/write payload at offset] | | [process request] | | >io_uring_submit() | | COMMIT_AND_FETCH | >fuse_uring_commit_fetch() | | [copy reply from ring] | | [return buffer to the pool] | | >fuse_uring_recycle_buffer() | Reviewed-by: Bernd Schubert <bernd@bsbernd.com> Signed-off-by: Joanne Koong <joannelkoong@gmail.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>