Commit Graph

1473528 Commits

Author SHA1 Message Date
Linus Torvalds
7f063b2f17 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost
Pull vhost,vdpa,virtio updates from Michael Tsirkin:

 - transport v3 support in virtio-mmio

 - suspend support in vduse

 - fixes, cleanups all over the place

* tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: (54 commits)
  vduse: Add suspend
  vduse: do not take rwsem at reset work flush
  vduse: add F_QUEUE_READY feature
  vduse: add VDUSE_SET_FEATURES ioctl
  vduse: add VDUSE_GET_FEATURES ioctl
  vduse: store control device pointer
  tools/virtio: Fix control typo in trace agent comment
  tools/virtio: Fix userspace typo in vringh test comment
  vhost: reject zero-size IOTLB INVALIDATE
  vdpa: Remove redundant dev_err()
  virtio_ring: fix infinite loop in virtnet_poll_cleantx when device is broken
  vdpa/mlx5: roll back MR update after VQ setup failure
  MAINTAINERS: remove Gabriel from LiteX and fw-cfg drivers
  virtio_mem: fix typo in comment
  vdpa/solidrun: fix typos in snet_ctrl comments
  virtio: fix article before virtio in dma-buf comment
  vhost: fix inaccurate kdoc in iotlb helpers
  virtio: rtc: time out alarm requests
  vdpa/mlx5: fix wrong MLX5_ADDR_OF struct type in alloc_inout()
  vdpa: octeon_ep: add missing MODULE_DEVICE_TABLE()
  ...
2026-08-20 17:07:50 -07:00
Linus Torvalds
a625b2a387 Merge tag 'vfio-v7.3-rc1' of https://github.com/awilliam/linux-vfio
Pull VFIO updates from Alex Williamson:

 - Add nv_falcon vfio selftest driver.

   The Falcon is a general-purpose microcontroller embedded within
   NVIDIA GPUs, presenting a relatively simple DMA programming
   interface.

   This adds another selftest target for vfio-pci with real DMA
   transfers (Rubin Du, Alex Williamson)

 - Add allocation assertion helpers to vfio selftests and use them to
   avoid variable length arrays and the compiler errors they generate
   (Alex Mastro)

 - Fix use-after-free hazard where an init path error in MSI support
   leaves a stray pointer that can later be reused or double-freed
   (Xiang Mei)

 - Fix previous refactor of PCI BAR mappings to honor non_mappable_bars
   flag, which otherwise generates a warning when trying to pci_iomap()
   a 256TiB BAR on ISM devices on s390 (Farhan Ali)

 - Add igb vfio selftest driver.

   Like nv_falcon, this provides another target for DMA testing with
   vfio selftests, but importantly this driver supports both physical
   82576 NICs and the emulation model in QEMU.

   This therefore enables a vfio selftest vector with no physical
   hardware requirements (Josh Hilke, Alex Williamson)

 - Mark selftest fixture objects __maybe_unused to accommodate builds
   with clang -Wunused-but-set-global (David Matlack)

 - Add error recovery for vfio-pci devices on s390x.

   This expands devices which expose the existing error eventfd and
   introduces a device feature for reporting firmware defined error
   state information to the user, allowing recovery through hypervisor
   channels (Farhan Ali)

* tag 'vfio-v7.3-rc1' of https://github.com/awilliam/linux-vfio:
  vfio/pci: Remove the pcie check for VFIO_PCI_ERR_IRQ_INDEX
  vfio-pci/zdev: Add a device feature for error information
  s390/pci: Store PCI error information for passthrough devices
  PCI/MSI: Enable memory decoding before restoring MSI-X messages
  PCI: Fail FLR when config space is inaccessible
  PCI: Avoid saving config space state if inaccessible
  PCI: Allow per function PCI slots to fix slot reset on s390
  PCI: Introduce PCI_SLOT_PLACEHOLDER constant for slot_nr placeholder value
  selftests: harness: Mark test fixture objects __maybe_unused
  vfio: selftests: Retry on EAGAIN during device reset
  vfio: selftests: igb: Add driver for Intel 82576 device
  vfio: selftests: Add helpers to re-enable interrupts
  vfio/pci: Avoid mapping BARs for devices with non-mappable BARs
  vfio/pci: clear vdev->msi_perm after freeing it on init failure
  vfio: selftests: Avoid VLAs
  vfio: selftests: Add allocation assert helpers
  vfio: selftests: Add NVIDIA Falcon driver for DMA testing
  vfio: selftests: Allow drivers without send_msi() support
  vfio: selftests: Add generic PCI command register helpers
  vfio: selftests: Add memcpy chunking to vfio_pci_driver_memcpy()
2026-08-20 16:57:59 -07:00
Linus Torvalds
77ae27fd98 Merge tag 'printk-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux
Pull printk updates from Petr Mladek:

 - Prevent a possible out-of-bound access and a use-after-free in rather
   theoretical situations

 - Make no_hash_pointers take effect early

 - Some fixes and clean up of the ratelimit KUnit test

* tag 'printk-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux:
  printk: Handle pre-enabled consoles in the top-level register_console()
  printk: Fix possible console use-after-free
  lib/tests: test_ratelimit: fix stress test thread lifecycle and leak
  lib/vsprintf: Make no_hash_pointers take effect early
2026-08-20 15:34:31 -07:00
Linus Torvalds
6439079365 Merge tag 'probes-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull probes updates from Masami Hiramatsu:
 "BTF typecasting and variable fetch enhancements:

   - Typecast support across probe events: Extended BTF typecasting
     syntax (e.g., (STRUCT)PARAM->MEMBER) to kprobes, uprobes, and
     fprobes on function entry and return

   - Nested typecasts: Added support for chaining and nesting typecasts
     up to 3 levels, including casting registers and stack variables

   - Field specifier option: Added (STRUCT,FIELD) syntax to emulate
     container_of(), allowing retrieval of parent structures from member
     pointers

   - $current variable support: Introduced $current special variable to
     access the running task_struct via BTF dereferencing

   - Per-CPU variable access: Added this_cpu_read() and this_cpu_ptr()
     fetcharg methods to trace CPU-local data safely

   - Fetcharg bytecode dumper: Added CONFIG_PROBE_EVENTS_DUMP_FETCHARG
     to dump the compiled fetcharg bytecode instructions as comments in
     dynamic_events

   - Extended symbol name handling: Removed the MAX_COMMON_HEAD_LEN
     limit and extended MAX_ARGSTR_LEN to 256 bytes, enabling probing of
     long symbols, mangled Rust symbols and complex BTF expressions

   - eprobe variable syntax: Allowed eprobes to reference event fields
     directly without requiring a '$' prefix

   - Cleanup unused parameters, redundant codes, duplicate macros and
     pointer arithmetic

   - Use a ternary operator for simplifying fetch_type_from_btf_type()

  Expanded boot time dynamic probe support:

   - Add boot-time tracing configuration support for event probes
     (eprobes), function probes (fprobes), and tracepoint probes
     (tprobes)

   - Allow comment lines ('#') in dynamic_events file

  Optimization, robustness, and cleanups:

   - Simplify fprobe_remove_ips() by reusing graph and ftrace helpers

   - Remove __packed attribute from struct __fprobe_header to avoid
     unaligned memory access penalties on RISC architectures

   - Remove redundant memset() calls in perf event probe handlers

   - Replace legacy __ASSEMBLY__ with __ASSEMBLER__ in header files

  Selftests & refactoring:

   - Refactor parse_probe_arg() and parse_probe_vars(), and eliminate
     recursion in probe argument parsing to protect kernel stack depth

   - Add selftests for BTF typecasts and module probing without module
     prefixes

   - Force LC_ALL=C in ftracetest to prevent test failures on localized
     systems

   - Refactor btf_type_skip_modifiers() to remove ignored id parameter

   - Sort ERRORS list in trace_probe.h alphabetically

   - Fix typo in fprobe docs, and trace_fprobe function name

   - Rename FETCH_OP_DATA to FETCH_OP_IMMSTR

   - Make file offset error message probe-agnostic"

* tag 'probes-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (37 commits)
  fprobe: Simplify fprobe_remove_ips() by reusing existing helpers
  tracing/boot: Add support for eprobe, fprobe, and tprobe events
  selftests/ftrace: Force C locale in ftracetest
  tracing/probes: Treating longer symbol name on event comparation
  docs: trace: fprobe: fix 'thos' spelling
  tracing/probes: Fix extra whitespace in trace_probe_kernel.h
  tracing/kprobe: Remove redundant memset in kprobe_perf_func()
  tracing/fprobe: Remove redundant memset in fentry_perf_func()
  tracing/fprobe: Remove redundant snprintf in trace_fprobe_match_command_head()
  tracing/probes: Simplify BTF_KIND_PTR case in fetch_type_from_btf_type()
  tracing/probes: Cleanup pointer arithmetic in store_trace_entry_data()
  tracing/probes: Remove unused parameter from parse_probe_var_retval()
  tracing/probes: Remove redundant bounds check in trace_probe_compare_arg_type()
  tracing/probes: Remove redundant boolean conversion in trace_probe_has_single_file()
  tracing/probes: Remove duplicate MAX_ARRAY_LEN macro definition
  selftests/ftrace: Add test case for a symbol in a module without module name
  tracing/probes: Eliminate recursion in parse_probe_arg()
  tracing/probes: Extend max length of argument string
  tracing/probes: Sort ERRORS list in trace_probe.h alphabetically
  tracing/probes: Refactor parse_probe_arg()
  ...
2026-08-20 15:11:52 -07:00
Linus Torvalds
920f27122c Merge tag 'cxl-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl
Pull CXL updates from Dave Jiang:
 "This includes the remaining patches to complete the basic support for
  CXL type2 (accelerators) drivers by the CXL core. A set of unit
  testing support to catch regressions for the CXL core type2 exported
  functions has also been added. The actual CXL type 2 driver support
  for the AMD Solarflare NIC driver has been picked up by net-dev.

  A set of preparatory patches has been picked up from the CXL port
  error handling series in order to reduce the number of patches in that
  series for review. The rest of that series is getting close to be
  merged but was not ready for the 7.3 merge window.

  There are also a number of misc patches and a large number of bug
  fixes against pre-existing issues flagged by sashiko reviews as
  contributors post new patches on the mailing list. We will continue to
  work through the sashiko raised issues as they show up."

* tag 'cxl-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: (35 commits)
  cxl/Documentation: Spell out globbed sysfs attribute names
  cxl: Rename find_cxl_port() to find_cxl_port_by_dport()
  cxl: Tighten CPER kfifo registration API and symbol visibility
  acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locks
  cxl/ras: Fix cxl_rch_get_aer_severity() wrong severity register
  cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read
  cxl/test: Assign one mock memdev a full-width serial number
  cxl/core: Format the memdev serial number as unsigned in TP_printk
  cxl/pmem: Format the nvdimm serial number as unsigned decimal
  cxl: Use %pe to print error pointers
  cxl/region: Use __free(put_device) in find_pos_and_ways()
  cxl/region: Fix use-after-free in find_pos_and_ways() error path
  cxl: Deny Features commands on the RAW mailbox path
  cxl/features: Clamp Get Feature output size to the remaining buffer
  cxl/features: Reject Set Features output buffer smaller than the header
  cxl/features: Reject Get Feature count larger than the output buffer
  cxl/port: Restart port enumeration when a sibling adds the dport first
  cxl/features: Serialize multi-part Get/Set Feature transfers
  cxl/pci: Honor -EPROBE_DEFER from component register setup
  cxl/mbox: Break poison list loop on an empty payload
  ...
2026-08-20 15:02:09 -07:00
Linus Torvalds
073e62fd33 Merge tag 'riscv-for-linus-7.3-mw1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux
Pull RISC-V updates from Paul Walmsley

 - Add initial definitions and discovery for the Smcsrind, Sscsrind,
   Smcntrpmf, Ssccfg, Smcdeleg, Zicclsm, Ziccamoa, Ziccif, Ziccrse,
   Za64rs, and Ssqosid RISC-V ISA extensions

 - Improve the RISC-V update_mmu_cache_range() implementation by using
   flush-by-ASID, enabling performance improvements on
   microarchitectures that support related optimizations; and by taking
   advantage of the Svinval RISC-V ISA extension on microarchitectures
   that support it

 - Shrink CFI shadow stack allocation further (to 512MB) to save virtual
   address space (and physical memory on systems with strict overcommit
   policies)

 - Add initial CPU context switch support for QoS tagging (Ssqosid)

 - Change our vector misaligned access speed test code to be
   synchronous, avoiding a bunch of bugs related to unnecessary
   asynchronicity

 - Enable ARCH_HAS_ACPI_TABLE_UPGRADE for RISC-V to help with ACPI table
   debugging (similar to ARM64 and x86)

 - Extract vDSO section offsets at build time, rather than run time, to
   avoid the boot time overhead

 - Use assembler directives to control the use of instructions from the
   RISC-V ISA extensions Zacas and Zabha, rather than compiler -march
   flags that could affect the whole kernel (similar to ARM64)

 - Add a kselftest for kprobes support for the c.jal instruction on
   RISC-V

 - When UEFI runtime services are available, use them to restart and
   power off

 - Fix ARCH_HAS_ACPI_TABLE_UPGRADE for RISC-V by adding a missing
   include file to the ACPI code

 - Move contiguous DMA memory reservation later in the boot, to ensure
   that the correct global and per-node pools are allocated when
   CONFIG_CMA_SIZE_PERNUMA is enabled

 - Disallow probes on breakpoint handlers to avoid recursing
   indefinitely into do_trap_break()

 - Patch the compat vDSO during runtime alternatives processing, not
   only the standard vDSO

 - Remove some leftover XIP support elements missed by commit
   9b3a2be848 ("riscv: Remove support for XIP kernel")

 - Fix broadcast timer switching in ACPI LPI power states by
   implementing a RISC-V version of arch_get_idle_state_flags()

 - Miscellaneous fixes, including: vDSO makefile simplification; marking
   our default_power_off() as __noreturn; error path fixes in the PMU
   SBI perf driver; RISC-V extension capitalization consistency; the use
   of BIT() macros in one of our include files; and some documentation
   fixes

* tag 'riscv-for-linus-7.3-mw1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: (39 commits)
  RISC-V: hwprobe: Use BIT macro to avoid warnings
  riscv: alternative: Also patch the compat vDSO
  riscv: alternative: Use the statically extracted vDSO section offsets
  riscv: vdso: Add symbols for the alternative section boundaries
  riscv: Add Ziccamoa, Ziccif, Ziccrse, and Za64rs to cpufeature and hwprobe
  riscv: Add Zicclsm to cpufeature and hwprobe
  riscv: cpufeature: Clarify ISA spec version for canonical order
  riscv: Standardize extension capitalization
  riscv: kprobes: Prevent probes in breakpoint handlers
  riscv: cmpxchg: Use .option arch for Zacas and Zabha
  riscv: acpi: Handle LPI architectural context loss flags
  riscv: further remove XIP
  riscv: Add support for srmcfg CSR from Ssqosid extension
  riscv: Detect the Ssqosid extension
  dt-bindings: riscv: Add Ssqosid extension description
  dt-bindings: riscv: add Counter delegation ISA extensions description
  RISC-V: Add Ssccfg/Smcdeleg ISA extension definition and parsing
  RISC-V: Add Ssccfg extension CSR definition
  dt-bindings: riscv: add Smcntrpmf ISA extension description
  RISC-V: Add Smcntrpmf extension parsing
  ...
2026-08-20 14:53:54 -07:00
Linus Torvalds
73cc4da385 Merge tag 'm68k-for-v7.3-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k
Pull m68k updates from Geert Uytterhoeven:

 - Fix backtraces for non-running tasks

 - Fix deadlock in show_cons_active()

 - defconfig updates

* tag 'm68k-for-v7.3-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k:
  m68k: nfcon: Do not call console_is_registered() in nfcon_device()
  m68k: Fix backtraces for non-running tasks
  m68k: defconfig: Update defconfigs for v7.2-rc1
  m68k: amiga: Remove redundant amiga_reset() prototype
2026-08-20 14:49:34 -07:00
Linus Torvalds
caf325ab81 Merge tag 'loongarch-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson
Pull LoongArch updates from Huacai Chen:

 - Add DIRECT_MAP_PHYSMEM_END definition

 - Expand module virtual address space to 2GB

 - Use current_stack_pointer in current_pt_regs()

 - BPF JIT enhancements such as kptr_xchg and timed may_goto

 - Some bug fixes and other small changes

* tag 'loongarch-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson:
  selftests/bpf: Enable kptr_xchg_inline test on LoongArch
  LoongArch: BPF: Add arch_bpf_stack_walk() implementation
  LoongArch: BPF: Add timed may_goto implementation
  LoongArch: BPF: Resolve per-CPU addrs for internal-only MOV
  LoongArch: BPF: Advertise JIT support for kptr xchg inline
  LoongArch: BPF: Align value-returning atomics with LKMM
  LoongArch: BPF: Split unconditional branch JA paths statically
  LoongArch: BPF: Remove dead move_imm() call in BPF_NEG path
  LoongArch: BPF: Remove redundant zext jumping in move_imm()
  LoongArch: BPF: Implement branchless conditional move for TCC
  LoongArch: BPF: Refactor jump offset calculation in tail call
  LoongArch: BPF: Move arena register slot below TCC context
  LoongArch: BPF: Optimize redundant TCC loads in epilogue
  LoongArch: Use current_stack_pointer in current_pt_regs()
  LoongArch: Use generic cmp_int() instead of custom cmp_3way()
  LoongArch: Expand module virtual address space to 2GB
  LoongArch: Add DIRECT_MAP_PHYSMEM_END definition
  LoongArch: Fix acpi_package_ids[] array overflow
2026-08-20 14:46:50 -07:00
Linus Torvalds
55ab7e1422 Merge tag 'for-7.3/block-20260819' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull block updates from Jens Axboe:

 - NVMe updates via Keith:
     - Enable Clang context analysis for the nvme host driver, adding
       context annotations across core, fabrics, rdma, tcp and pci
     - nvmet reservation state exposed through a new namespace-level
       debugfs directory, plus ABI documentation for the host sysfs and
       target configfs interfaces
     - nvme-tcp host memory disclosure fixes on the read path: reject a
       read that transferred too few bytes, don't accept C2HData based
       on blk_rq_payload_bytes() alone, and fix the R2T case for a read
       command
     - Parallelize nvme-rdma I/O queue allocation and startup (Surabhi)
     - Apple nvme fixes and quirks: page aligned admin queue buffers,
       destroy the admin queue on removal, and various DMA/NVMMU
       correctness fixes
     - A large pile of nvmet and host fixes for out-of-bounds reads,
       refcount/resource leaks, and NULL derefs across auth, zns,
       passthru, pci-epf, rdma and configfs
     - Various other fixes and cleanups

 - MD updates via Yu Kuai:
     - llbitmap reshape support, the large series wiring exact bitmap
       mapping and reshape lifecycle through raid5 and raid10, growing
       the page cache in place, and remapping checkpointed bits as
       reshape progresses
     - raid5 fixes for lockless max_nr_stripes and recovery_offset
       accesses, a reshape deadlock with more failed devices than max
       degraded, and bitmap batch counter consistency
     - Atomic write handling for raid1/raid10, and removal of the
       REQ_NOWAIT support from raid1/10/456
     - raid5-ppl use-after-free fix in ppl_do_flush()
     - A batch of smaller fixes across md core and the bitmap code

 - s390/dasd ESE full-track write support and the surrounding
   infrastructure, plus enabling CONTEXT_ANALYSIS for s390/block

 - RWF_DONTCACHE support for block devices, built on new task-context
   bio completion infrastructure, and wiring it up for the iomap and
   buffer dropbehind writeback paths

 - Async io_uring zone reset all, plus zone management command cleanups
   allowing REQ_NOWAIT and tightening conventional zone rejection

 - Block integrity refactoring: lift BIP_CHECK_FLAGS to the shared
   header, handle nogenerate/noverify properly in fs-integrity, and drop
   the blk-integrity.h include from bdev.c

 - Split out a new blk_plug.h header

 - ublk improvements: add UBLK_F_IO_DESC_SIZE, split request validation
   from io_desc init, reject non-power-of-2 zone sizes in SET_PARAMS,
   and a series of hardening fixes around map/unmap and auto buf reg

 - null_blk cleanups and configfs serialization fixes

 - nbd queue freeze removal on the setup paths, and a new
   pre_defined_connections module parameter for pre-created devices

 - blk-cgroup fixes for the race between policy activation and blkg
   destruction, and accounting per-cpu stats over possible CPUs across
   blk-stat, iolatency, iocost and kyber

 - Various dio fixes: leak on metadata mapping error, validate user
   space vectors during extraction, and set dma_alignment from the
   backing file for loop and zloop direct I/O

 - bio cleanups

 - Various other fixes and cleanups all over

* tag 'for-7.3/block-20260819' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (241 commits)
  nbd: add pre_defined_connections module parameter for pre-created devices
  nbd: remove queue freeze for newly created nbd from netlink path
  nbd: factor out a nbd_genl_foreach_sock
  nbd: skip queue freeze when setting size at device startup
  nbd: remove queue freeze in nbd_add_socket
  nbd: clear queue limits on disconnect
  nbd: disallow NBD_SET_SOCK on an active device
  nbd: simplify find_fallback() by removing redundant logic
  blk-mq: add missing call to srcu_barrier() in blk_mq_free_tag_set()
  block: mtip32xx: synchronize ioctls with device removal
  ublk: avoid teardown retry loop on xarray allocation failure
  null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows
  block: don't include blk-integrity.h in bdev.c
  xfs: avoid double deferrals for RWF_DONTCACHE writes
  loop: Fix recently introduced lock inversion
  block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead()
  swim3: Add missing MODULE_DESCRIPTION
  selftests: ublk: add SET_PARAMS validation test
  selftests: ublk: add helper for SET_PARAMS
  ublk: reject non-power-of-2 zone sizes in SET_PARAMS
  ...
2026-08-20 13:55:16 -07:00
Linus Torvalds
f5437ff729 Merge tag 'for-7.3/io_uring-20260819' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull io_uring update from Jens Axboe:
 "On top of the usual cleanups and fixes, the bigger items in here are:

   - zcrx work, most of it centered around adding dynamic area
     provisioning, plus a bunch of prep and cleanups leading up to it:
     scale refilling with large pages, coalesce same-niov RQEs on
     refill, separate the RQ head/tail cache lines and cache the RQ
     tail, and rework the area creation locking.

   - Fix the futex inflight accounting so that only private futex waits
     are marked inflight, and don't mark wake requests as inflight at
     all.

   - Drop the custom iov copy in the buffer select prep and msg header
     copy paths, using the generic helpers instead.

   - Fix a folio size overflow in io_vec_fill_bvec(), and account the
     pages a compound region really uses in the memmap path.

   - Fix an iovec leak in uring_cmd when the async cmd isn't recycled,
     skip the blocking task work for io_uring_cmd_issue_blocking(), and
     don't skip completion for a synchronous multishot cmd

   - Defer eventfd signaling when queued from a wakeup handler

   - Fix io-wq worker accounting when canceling creation callbacks

   - Annotate remote tasks for kcoverage"

* tag 'for-7.3/io_uring-20260819' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (30 commits)
  io_uring: Add missing include for ITER_SOURCE and ITER_DEST
  io_uring/uring_cmd: don't skip completion for a synchronous multishot cmd
  io_uring/memmap: account the pages a compound region really uses
  io_uring/zcrx: add dynamic area provisioning
  io_uring/zcrx: lock area creation with pp_lock
  io_uring/zcrx: keep array of areas
  io_uring/zcrx: move freelist lock to struct zcrx
  io_uring/zcrx: unmap under netdev lock
  io_uring/zcrx: split dmabuf unmap and release
  io_uring/zcrx: don't pass ifq_reg to area creation
  io_uring/zcrx: add helper for deriving area token
  io_uring/zcrx: don't reload skb_shinfo
  io_urint/zcrx: narrow var scope in io_zcrx_recv_skb()
  io_uring/zcrx: constify area_reg on import
  io_uring/zcrx: coalesce same-niov RQEs on refill
  io_uring/zcrx: cache RQ tail
  io_uring/zcrx: add RQ iterator
  io_uring/zcrx: move RQ head/tail to separate cache lines
  io_uring/zcrx: scale refilling with large pages
  io_uring/io-wq: fix worker accounting when canceling creation callbacks
  ...
2026-08-20 13:47:56 -07:00
Linus Torvalds
c84d3e3130 Merge tag 'ext4_for_linus-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4
Pull ext4 updates from Ted Ts'o:

 - Improve performance by allowing parallel DIO writes when we were
   previously being overly conservative when checking whether it was
   safe to avoid requiring an exclusive lock

 - Improve the performance of ext4_mb_prefetch() used by fallocate() by
   avoiding work when it is not needed

 - Remove the unnecessary custom end_io function
   ext4_end_buffer_io_sync()

 - Improve performance when performing an overwrite to an already
   uptodate folio

 - Clean up how we handle deallocating EA inodes to avoid a potential
   lock ordering issue when there is a failed mount while an EA inode is
   still being evicted

 - Use str_plural() instead of a custom macro

 - Avoid soft lockups or RCU stalls if there are many busy buffers
   (caused by heavy I/O) while checkpointing

 - Use scoped NOFS when starting a handle in nojournal mode

 - Align fields in handle structure to optimize setting and getting the
   h_type and h_line_no fields

 - Fix documentation of the meta_bg block group layout

 - Bug fixes:
    - Fix a potential out-of-bounds read in ext4_read_inline_dir()
    - Fix a potential deadlock when concurrent xattr operations are
      racing with each other when some of the xattrs are using the
      ea_inode feature
    - Fix a spurious warning with data=journal that can be triggered
      when writeback races with remounting the file system read-only
    - Fix a potential deadlock when EXT4_IOC_MIGRATE races with a file
      system freeze operation
    - Make sure all in-flight direct I/O operations are complete before
      falling back to buffered I/O
    - Handle IOCB_NOWAIT properly when performing a extending DAX write
    - Prevent potentially sleeping on a block allocation when
      IOCB_NOWAIT is set
    - Fix potential races when racing an inline data write with a page
      fault
    - Propagate errors when adding or removing extent ranges during a
      fast commit replay
    - Avoid trying to expand an inode's extra size when it is being
      evicted to avoid a number of corner case or deadlocks
    - Avoid spurious error when retrying inode extra size expansion
    - Fix corner cases where we underestimate the number of journal
      credits needed
    - Avoid hangs/crashes/WARNINGS caused by maliciously corrupted file
      systems
    - Don't issue spurious orphan clean message on RO file systems
    - Avoid leaving the file system in an inconsistent state after a
      crash when a WRITE_ZEROS in progress converting an unwritten
      extent to a written extent
    - Handle WRITE_ZEROS correctly when there are some partially dirtied
      regions in the page cache
    - Pass errors during zero-rage, truncate, or punch hole to the
      caller if ext4_get_block() fails
    - Wait for writeback to finish when triggered by zero-range or
      zero-range for those devices that require stable writes
    - If the reserved gid superblock field is set, set the reserved gid
      instead of the reserved uid

* tag 'ext4_for_linus-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: (56 commits)
  ext4: fix estimate extent index blocks in ext4_ext_index_trans_blocks()
  ext4: fix transaction overflow during writeback
  ext4: teach ext4_meta_trans_blocks() about number of allocated extents
  ext4: guard against NULL s_group_info in ext4_get_group_info
  ext4: fix spurious message about orphan cleanup on RO fs
  ext4: stop retrying saturated xattr cache entries
  ext4: don't enable DAX on new encrypted files
  ext4: protect WRITE_ZEROES written extents with orphan list
  ext4: export converted block count from ext4_convert_unwritten_extents()
  ext4: fix incorrect function call when initializing s_resgid
  ext4: validate EA inode i_nlink in ext4_xattr_inode_iget
  jbd2: align h_type and h_line_no in the handle structure on byte boundaries
  ext4: enable scoped NOFS when starting a handle in nojournal mode
  ext4: write back partial-zeroed edges in WRITE_ZEROES
  ext4: zero out whole block for clean edges in WRITE_ZEROES
  ext4: track partial-zero outcome per edge in ext4_zero_partial_blocks()
  ext4: clarify return semantics of ext4_load_tail_bh()
  ext4: move partial block zeroing earlier in ext4_zero_range()
  ext4: check return value of ext4_get_block() in ext4_load_tail_bh()
  ext4: skip tail block zeroing for inline data files
  ...
2026-08-20 13:17:11 -07:00
Linus Torvalds
50c44fea13 Merge tag 'for-7.3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux
Pull btrfs updates from David Sterba:
 "This is the summer edition of btrfs changes, smaller than usual. Yet,
  there are performance improvements in various areas or for specific
  workloads and some notable changes like removing space cache v1 code
  or mount option reduction.

  User visible changes:

   - free space v1 disabled by default; the v2 (free space tree) is mkfs
     default since 5.15, filesystems with v1 still work but could be
     slightly slower due to lack of block group caching

   - mount option 'rescue=usebackuproot' requires read-only mount, it's
     too risky to allow writable mount

   - remove standalone mount option 'usebackuproot', deprecated in 5.9

   - preserve constraints of NODATASUM and NODATACOW when chattr and
     mount options may change the attributes

   - remove arbitrary limitation of 4KiB for page size when allowing
     block sizes smaller than page

   - print messages when pinned block groups affect swap activation

  Performance improvements:

   - use iomap bounce buffer for direct io instead of a fall back to
     buffered io; past correctness vs speed trade-offs dropped
     performance to ~50% of theoretical maximum, now it's ~95%,
     effectively doubled

   - replace xarray with local LRU list for tracking inhibited
     extent buffers, restored performance to pre-inhibition state
     (relatively ~3x)

   - remove unnecessary 1 jiffy delay in "non-SSD" mode with multiple
     logging tasks, decrease latency, throughput increased ~5x on sample
     workload

   - skip hole detection during full fsync for files without holes
     and lots of extents, reduce run time ~5x on sample workload
     (microsecond ranges)

   - reduce locking around extent readahead so it does not slow down
     other tasks using an overlapping range

   - enhance extent buffer allocation modes to allow NOWAIT semantics
     in some cases

  Notable fixes:

   - write-protect folios during writeback, prevent concurrent mmap
     and compress/checksumming/etc undesired interactions

   - in zoned mode, handle transient overcommit full instead of going
     read-only

   - fix possible deadlock between defragmentation and delayed
     allocation reservations

   - handle remaining iputs at umount time

   - fix lockdep warning between device scan locking and log mutex

   - add workaround for degenerate RAID56 device count modes (2 and 3)
     not supported by the parity calculation library

   - restore check that subvolume is not read-only when changing ACLs

   - retry reading verity data colliding with up-to-date status changes

  Core:

   - simplify raid56 stripe handling by using contiguous virtual
     allocations

   - in zoned mode, fix various metadata write issues in writeback or
     unmount

   - space reservation fixes

   - remove unused data structure members

   - more auto-freeing conversions

   - error pointer values are printed using %pe format"

* tag 'for-7.3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: (72 commits)
  btrfs: skip hole detection during full fsync for files without holes
  btrfs: add extra ASSERT()s to make sure the folio size is correct
  btrfs: use GFP_NOWAIT for tree block readahead
  btrfs: enable unlocked NOFAIL retry for eb allocations
  btrfs: add struct btrfs_eb_prealloc
  btrfs: factor init_extent_buffer from __alloc_extent_buffer
  btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data()
  btrfs: add validation for extent states
  btrfs: use aligned range for locking in reflink
  btrfs: use aligned range for locking in extent_fiemap()
  btrfs: zoned: don't clobber the extent buffer when zeroing it out
  btrfs: zoned: drop stranded dirty metadata buffers at unmount
  btrfs: zoned: drop stranded dirty metadata on transaction abort
  btrfs: zoned: flush active metadata block group at btree_writepages() start
  btrfs: convert reflink.c to use btrfs_inode as parameters
  btrfs: use simple booleans for log_commit field in struct btrfs_root
  btrfs: check for exit condition after waking in wait_log_commit()
  btrfs: move condition for log commit wait into wait_log_commit()
  btrfs: remove log batch counter use for fsync
  btrfs: stop sleeping for one jiffy in non-ssd mounts during log commit
  ...
2026-08-20 13:00:40 -07:00
Linus Torvalds
9328b3b03b Merge tag 'fs_for_v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs
Pull ext2, udf, isofs, and quota updates from Jan Kara:

 - Remove deprecated quota code printing warnings about exceeded quota
   directly to console

 - Various udf & isofs hardening for handling of corrupted filesystems

 - Fix a possible data loss in udf when converting files from inline to
   out-of-line format

 - Simplify EIO error handling in ext2 xattr code

* tag 'fs_for_v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
  udf: Fix data loss when converting inline inodes to out of line
  udf: Move udf_map_block() up
  ext2: Simplify error handling of IO error when adding xattr
  isofs: Drop support of directory entries straddling blocks
  isofs: validate directory records consistently
  quota: remove CONFIG_PRINT_QUOTA_WARNING code
  udf: Fix i_lenExtents truncation on 32-bit kernels
  isofs: release zisofs block pointer buffer head
  udf: Fix bh leak for unallocated space entries
  udf: bound lengthAllocDescs from unallocated space entry
  UDF symlink pathComponent header OOB read
  isofs: fix out-of-bounds page array access on empty zisofs block
  udf: reject VAT indexes equal to the entry count
  udf: Mark LVID buffer as uptodate before marking it dirty
  udf: avoid recursive s_alloc_mutex deadlock when freeing AED blocks
  udf: validate extent partition references in udf_current_aext()
2026-08-20 12:52:35 -07:00
Linus Torvalds
81e51378b7 Merge tag 'fsnotify_for_v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs
Pull fsnotify updates from Jan Kara:
 "A couple of assorted fixes (mostly stuff spotted by Sashiko) for
  fsnotify subsystem.

  I'm also removing Matt as a reviewer because he was not active in
  fsnotify in last years and after he stopped working for Google I don't
  have a working contact to him"

* tag 'fsnotify_for_v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
  fsnotify: Fix stale object mask after concurrent mark updates
  fanotify: report full event length for FIONREAD
  fanotify: fix use-after-free of file range info
  fanotify: stop permission watchdog when timeout is zero
  fsnotify: Remove Matt Bobrowski as a reviewer
  fanotify: initialize permission event watchdog state
2026-08-20 12:47:41 -07:00
Linus Torvalds
d141ec2825 Merge tag 'nfsd-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux
Pull nfsd updates from Chuck Lever:

 - CB_NOTIFY support for NFSD's NFSv4.1 directory delegations

   The server used to recall a delegation as soon as the directory
   changed. NFSD now watches delegated directories through fsnotify and
   reports adds, removes, renames, and directory attribute changes,
   carrying the filehandle and attributes of the affected entry, so
   clients can keep their caches. Some of the NOTIFY4 flags come from
   RFC 8881bis (Jeff Layton)

 - Continued netlink work

   A new server-stats-get operation reports what /proc/net/rpc/nfsd
   publishes, plus NFSv4 callback counts, and SUNRPC now keeps its
   per-procedure call counts per network namespace, so a container sees
   its own numbers. nfsstat reads all of this over netlink, with a
   procfs fallback for older kernels (Jeff Layton)

 - Remove SUNRPC service thread pool mode selection

   Per node is the right choice on any host we run today, so the auto,
   global, and percpu modes have been removed. A single-node host still
   gets one pool. A multi-NUMA host now gets a pool per node.

   sunrpc.pool_mode accepts the old names but no longer selects
   anything.

 - Bug fixes, clean-ups, and small optimizations:
    - async COPY offload rework (Jeff Layton)
    - more use-after-free fixes in the NFSv4 state revocation paths
    - percpu counter contention removed from the reply cache and IO
      accounting
    - a long list of hardening fixes (Chris Mason)

Sincere thanks to all contributors, reviewers, testers, and bug
reporters who participated in the v7.3 NFSD development cycle.

* tag 'nfsd-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: (182 commits)
  nfsd: export NFSv4 callback op stats via netlink
  nfsd: count NFSv4 callback operations per netns
  sunrpc: remove unused svc_version vs_count field
  nfsd: implement server-stats-get netlink handler
  sunrpc: use per-net counts in svc_seq_show()
  sunrpc: add per-netns per-procedure call counts to svc_stat
  NFSD: Document reply_cache_stats ABI
  NFSD: Eliminate percpu counter contention in IO byte accounting
  NFSD: Eliminate percpu counter contention in reply cache statistics
  NFSD: Eliminate percpu counter contention in DRC memory accounting
  NFSD: Fix off-by-one in DRC bucket pruning limit
  NFSD: Relocate NFSv4 "supported attributes" to new header
  NFSD: Relocate nfsd4_set_netaddr()
  NFSD: Relocate nfsd_user_namespace()
  NFSD: Move struct readdir_cd
  NFSD: Move the export.h include from nfsd.h to auth.c
  NFSD: Remove '#include "nfsd.h"' from fs/nfsd/cache.h
  NFSD: include "netns.h"
  NFSD: Explicitly include "stats.h"
  NFSD: Make "stats.h" self-contained
  ...
2026-08-20 12:39:56 -07:00
Linus Torvalds
ada9ccfb81 Merge tag 'for-linus-7.3-ofs1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux
Pull orangefs updates from Mike Marshall:
 "Fixes:
   - fix double-free of trailer_buf
   - skip leading spaces before parsing client debug masks

  Cleanup:
   - Remove commented out code

  New:
   - use folio_pos() and folio_size() in orangefs_page_mkwrite()"

* tag 'for-linus-7.3-ofs1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux:
  orangefs: skip leading spaces before parsing client debug masks
  orangefs: Remove commented out code in find_cached_xattr
  orangefs: use folio_pos() and folio_size() in orangefs_page_mkwrite()
  orangefs: fix double-free of trailer_buf on readdir copy failure
2026-08-20 12:36:26 -07:00
Linus Torvalds
dc83d18cdd Merge tag 'ntfs3_for_7.3' of https://github.com/Paragon-Software-Group/linux-ntfs3
Pull ntfs3 updates from Konstantin Komarov:
 "Added:
    load ATTR_BITMAP run extents from $MFT extension records
    initialize err in attr_wof_frame_info
    reserve NUL byte when converting UTF-16 names
    reject restart table growth beyond U16_MAX entries
    validate dirty page table on log replay
    basic support for alternative data streams
    validate ef->size covers the record's name and value

  Fixed:
    slab-out-of-bounds write in ni_create_attr_list()
    out-of-bounds read of INDEX_ROOT in reparse/objid init
    boundary check in ntfs_dir_count()
    info-leak in ntfs_rename()
    lseek EINVAL on sparse/compressed files with 64-bit clusters
    info-leak on partial LZNT decompress in ni_read_frame()
    bound page_lcns[] index by the log record
    memory leak in indx_find_sort()
    integer overflow in MFT cluster validation
    reject out-of-range evcn in mi_enum_attr()
    out-of-bounds read in read_log_rec_buf()

  Changed;
    widen inode/record number storage to u64
    cosmetic fixes and improvements
    rename 'err' to 'ret' in read paths"

* tag 'ntfs3_for_7.3' of https://github.com/Paragon-Software-Group/linux-ntfs3: (21 commits)
  fs/ntfs3: validate ef->size covers the record's name and value
  fs/ntfs3: fix out-of-bounds read in read_log_rec_buf()
  fs/ntfs3: reject out-of-range evcn in mi_enum_attr()
  fs/ntfs3: fix integer overflow in MFT cluster validation
  fs/ntfs3: Add basic support for alternative data streams
  fs/ntfs3: Rename 'err' to 'ret' in read paths
  fs/ntfs3: Fix memory leak in indx_find_sort()
  fs/ntfs3: bound page_lcns[] index by the log record
  fs/ntfs3: validate dirty page table on log replay
  fs/ntfs3: reject restart table growth beyond U16_MAX entries
  fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()
  fs/ntfs3: reserve NUL byte when converting UTF-16 names
  ntfs3: initialize err in attr_wof_frame_info
  fs/ntfs3: fix lseek EINVAL on sparse/compressed files with 64-bit clusters
  fs/ntfs3: load ATTR_BITMAP run extents from $MFT extension records
  ntfs3: fix info-leak in ntfs_rename()
  ntfs3: fix boundary check in ntfs_dir_count()
  fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init
  fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()
  fs/ntfs3: cosmetic fixes and improvements
  ...
2026-08-20 12:27:02 -07:00
Linus Torvalds
8f421dfec2 Merge tag 'erofs-for-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs
Pull erofs updates from Gao Xiang:
 "The most notable enhancement is to allow passing source fds via
  fsconfig() for composefs. The others are all various fixes:

   - Allow source fds via fsconfig(), in addition to source paths

   - Use dedicated metadata inodes for file-backed mounts

   - Disallow invalid interlaced ztailpacking pclusters

   - Validate on-disk compression algorithm IDs against supported ones

   - Fix unused pcluster pools on higher page-size platforms"

* tag 'erofs-for-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs:
  erofs: fix unused pcluster_pools for higher page sizes
  erofs: guard on-disk algorithm IDs against Z_EROFS_COMPRESSION_MAX
  erofs: fix interlaced ztailpacking pclusters
  erofs: use dedicated meta inodes for file-backed mounts
  erofs: accept source file descriptor via fsconfig
  erofs: fix typo in error messages
2026-08-20 12:24:48 -07:00
Linus Torvalds
62abb6cffd Merge tag 'libnvdimm-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm
Pull NVDIMM and DAX updates from Alison Schofield:
 "Most are DAX preparatory patches for FAMFS support, along with a few
  NVDIMM fixes and documentation cleanups.

   - Documentation cleanup, removing kernel-doc warnings

   - preparing DAX for FAMFS

   - misc NVDIMM fixups with cleanups for issues reported by Coccinelle"

* tag 'libnvdimm-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm:
  nvdimm-btt: clean up kernel-doc warnings
  libnvdimm: nd.h: clean up kernel-doc warnings
  dax: fsdev.c minor formatting cleanup
  dax: fix holder_ops race in fs_put_dax()
  dax: read holder_ops once in dax_holder_notify_failure()
  dax/fsdev: fail probe on invalid pgmap offset
  dax/fsdev: use __va(phys) for kaddr in direct_access
  dax/fsdev: clear pgmap ops and owner on unbind
  dax/fsdev: don't leave a dangling dev_dax->pgmap on probe failure
  dax/fsdev: clear vmemmap_shift when binding static pgmap
  dax/fsdev: fix multi-range offset in memory_failure handler
  dax: fix misleading comment about share/index union in dax_folio_reset_order()
  nvdimm/btt: reject an arena whose nfree is below the lane count
  libnvdimm/labels: Bound the on-media label size before the shift
  libnvdimm/labels: Prevent integer overflow in __nd_label_validate()
  nvdimm: ndtest: remove redundant NULL check before vfree()
  nvdimm: nfit: remove redundant NULL check before vfree()
2026-08-20 12:17:36 -07:00
Linus Torvalds
cf62c7084a Merge tag 'execve-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux
Pull execve update from Kees Cook:

 - x86/elf: Correct comment for STACK_RND_MASK() (Lorenzo Stoakes)

* tag 'execve-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  x86/elf: Correct comment for STACK_RND_MASK()
2026-08-20 12:03:45 -07:00
Linus Torvalds
ae814200e8 Merge tag 'bitmap-for-7.3' of https://github.com/norov/linux
Pull bitmap updates from Yury Norov:
 "The usual set of fixes, cleanups and performance improvements together
  with a couple of new tests:

   - bitmap_find_next_zero_area_off() optimization (Sunyi)

   - bitmap_find_next_zero_area_off(): return size when no zero area is
     found (Yury)

   - bitmap vs IDA vs Maple Tree performance test (Yury)

   - get rid of cpumap_print_to_pagebuf() (Yury)

   - use nr_node_ids in __nodemask_pr_numnodes() (Li RongQing)

   - bitops: make the *_bit_le functions use unsigned long (Benjamin)

   - bitmap scatter & gather test fix (Christophe)

   - use __ASSEMBLER__ in bitmap header files (Thomas)"

* tag 'bitmap-for-7.3' of https://github.com/norov/linux: (25 commits)
  lib: test bitmap vs IDA vs Maple Tree performance for region allocations
  bitmap: Return size when no zero area is found
  media: s5p-mfc: Treat bitmap size as allocation failure
  crypto: ccp: Treat bitmap size as allocation failure
  powerpc/msi: Treat bitmap size as allocation failure
  ARM: dma-mapping: Treat bitmap size as allocation failure
  bitmap: drop bitmap_next_set_region()
  nodemask: reduce bitmap width to nr_node_ids in __nodemask_pr_numnodes()
  bitmap: Properly initialise destination bitmap for scatter & gather test
  lib/bitmap-str: get rid of cpumap_print_to_pagebuf()
  perf: Use sysfs_emit() for cpumask show callbacks
  PCI/sysfs: Use sysfs_emit() for cpumask show callbacks
  RDMA/hfi1: Use sysfs_emit() for cpumask show helper
  hwtracing: hisi_ptt: Use sysfs_emit() for cpumask show
  fpga: dfl-fme-perf: Use sysfs_emit() for cpumask show
  devfreq: Use sysfs_emit() for cpumask show callbacks
  cpu: Use sysfs_emit() for cpumask show callback
  x86/events: Use sysfs_emit() for cpumask show callbacks
  powerpc: Use sysfs_emit() for cpumask show callbacks
  arm: Use sysfs_emit() for cpumask show callbacks
  ...
2026-08-20 11:41:46 -07:00
Linus Torvalds
216b3f432a Merge tag 'kcsan-20260817-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/melver/linux
Pull Kernel Concurrency Sanitizer (KCSAN) update from Marco Elver:

 - Avoid unintended access checking in NMIs

* tag 'kcsan-20260817-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/melver/linux:
  kcsan: avoid unintended access checking in NMIs
2026-08-20 11:32:27 -07:00
Linus Torvalds
11260c335e Merge tag 'sched_ext-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext
Pull sched_ext updates from Tejun Heo:
 "Most of this cycle completes the enqueue-path support for hierarchical
  sub-scheduling, which makes sub-scheduler support feature complete: a
  root BPF scheduler can now hand a cgroup subtree over to a nested
  sub-scheduler together with revocable CPU grants, and the
  sub-scheduler owns all scheduling decisions for its tasks on those
  CPUs.

  Development volume was high and a number of changes plugging holes in
  the new support landed late in the cycle. Also included are core
  scheduling fixes that were completed too late for the v7.2 release and
  are routed through this pull request.

  Sub-scheduler CPU delegation:

   - Parent schedulers now grant and revoke per-CPU capabilities
     (enqueueing, preemption, CPU frequency control) on their children,
     enforced on every path a scheduler can reach a CPU through.
     Previously only dispatching could be delegated; this lets
     sub-schedulers fully schedule their CPUs.

   - Rescue execution: a task whose scheduler doesn't have access to the
     CPUs the task needs to run on starved until the watchdog ejected
     the whole scheduler. The kernel now runs such tasks directly on a
     small bandwidth budget, turning a scheduler-killing failure into
     bounded degradation.

   - Cgroup integration: tasks migrating across a sub-scheduler boundary
     weren't re-homed to the new owner, causing wrong-scheduler
     scheduling and a use-after-free. Sub-schedulers now take over their
     cgroup subtree and receive its cgroup callbacks.

   - Arena objects now cross the kernel/BPF boundary as typed pointer
     arguments, translated transparently by the BPF tree's new arena
     argument support, replacing untyped arguments with manual
     translation.

   - scx_qmap now demonstrates full hierarchical sub-scheduling.

  Other fixes and updates:

   - Robustness improvements: the abort path is now NMI-safe, fixing
     deadlocks when errors are raised from NMI context and making
     hardlockup recovery direct. Reenqueue loops that could monopolize a
     CPU ahead of the watchdog now eject the offending scheduler, and
     stalls are blamed on the scheduler actually responsible.

   - Hardening: BPF-writable arena memory is validated before kernel
     use, and task slice and vtime writes got explicit synchronization
     rules, closing corruption vectors open to buggy or malicious
     schedulers.

   - Core scheduling: sched_ext dispatching can drop the rq lock inside
     the core-wide pick, which let interleaving selections corrupt each
     other's state and hard-hang the machine. The selection now restarts
     when the lock was released. The task ordering callback was also
     invoked with its arguments swapped, and the default ordering is
     updated to work across sub-scheduler boundaries. The fixes are
     marked for stable.

   - Other fixes headed for stable: a task init leak on fork failure
     during enable, tooling compat macros that silently failed to detect
     newer kernels, and a crash on reenqueueing against a destroyed
     dispatch queue.

   - Tooling: scx_pair moves off deprecated callbacks, and the
     deprecated scx_bpf_cpu_rq() kfunc is removed"

* tag 'sched_ext-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: (144 commits)
  sched_ext: Drop the dead SCX_DEQ_CORE_SCHED_EXEC test in dequeue_task_scx()
  sched_ext: Make core-sched task ordering hierarchy-aware
  sched_ext: Use runnable_at for the default core-sched task ordering
  sched_ext: Fix inverted ops.core_sched_before() invocation
  sched_ext: Move the config-off sub-cap kfunc stubs into sub.c
  sched_ext: Rename balance-era identifiers to dispatch terms
  sched_ext: Drop the stale keep_prev fixup in dispatch_pick()
  sched_ext: Keep kick_sync waiting on the rq's own CPU
  sched_ext: Make SCHED_CLASS_EXT select GENERIC_ALLOCATOR
  sched_ext/scx_flatcg: Fix cvtime true-up on slice expiry
  sched_ext: Don't BUG_ON a destroyed DSQ in process_deferred_reenq_users
  sched_ext: Fix scx_bpf_dsq_move_to_local___v2 compat detection
  sched_ext: Make scx_bpf_events() read the calling scheduler's counters
  sched_ext: Drop unlocked scx_rq_clock_invalidate() from scx_root_disable()
  selftests/sched_ext: Fix flaky ddsp failure tests on busy systems
  selftests/sched_ext: Make numa idle validation race-free
  sched_ext: Fix scx_bpf_dsq_reenq___compat kfunc extern prototype
  sched_ext/scx_flatcg: expire cached hweights on weight changes
  sched_ext: Fix exit_task leak on fork failure during enable
  sched_ext: fix stale references in doc comments
  ...
2026-08-20 11:01:37 -07:00
Linus Torvalds
40d8c81577 Merge tag 'cgroup-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
Pull cgroup updates from Tejun Heo:

 - Attach path bug fixes: migrations spanning multiple source or
   destination cpusets were mishandled, most visibly leaving thread
   affinities stale when the controller is disabled in a threaded
   subtree. Configuration writes could also race an in-flight attach and
   apply stale state, and the deadline task count could get corrupted by
   concurrent updates, skewing SCHED_DEADLINE admission decisions.

 - Memory binding bug fixes: which node masks get applied differed
   between the binding update paths, and tasks cloned with
   CLONE_INTO_CGROUP skipped rebinding entirely. Rebinding also now runs
   once per process instead of repeating for every thread sharing the
   mm.

 - Overhead removals with no behavior change: CPU hotplug iterated tasks
   of cpusets that just inherit the parent's effective masks, and the
   slab-spreading task flag was still being maintained although the SLAB
   allocator that consumed it is long gone.

 - Data-race annotations for benign races so that KCSAN reports stay
   meaningful, selftest coverage for the fixes above along with
   flakiness and portability fixes, and documentation corrections.

* tag 'cgroup-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: (34 commits)
  selftests/cgroup: Remove redundant chown in test_cgcore_lesser_ns_open
  selftests/cgroup: Preserve CPU hotplug write errors
  cgroup/cpuset: Add test for partition root invalidation returning wrong CPUs
  cgroup/cpuset: Remove obsolete PFA_SPREAD_SLAB task flag
  docs: cgroup-v2: fix stale "io" controller introduction
  selftests/cgroup: Avoid awk -e in cpuset tests
  cgroup/cpuset: Use WRITE_ONCE() for shared prs_err updates
  selftests/cgroup: add user_usec sanity check in test_cpucg_nice
  cgroup: drop unneeded semicolon
  docs: cgroup-v2: mark memory.pressure and io.pressure as read-write
  selftests/cgroup: Fix minor defects in test_cpuset
  Docs/admin-guide/cgroup-v2: fix delay_nsec unit in io.latency doc
  selftests/cgroup: Remove redundant cg_enter_current() call in test_core
  selftests/cgroup: Add test for cpuset affinity on controller disable
  cgroup/cpuset: Handle the special case of non-moving tasks in cpuset_can_attach()
  cgroup/cpuset: Support multiple destination cpusets for cpuset_*attach()
  selftests/cgroup: fix missing TAP output in test_hugetlb_memcg
  cgroup/cpuset: Support multiple source cpusets for cpuset_*attach()
  cgroup/cpuset: Move mpol_rebind_mm/cpuset_migrate_mm() calls inside cpuset_attach_task()
  cgroup/cpuset: Make attach_ctx.old_cs track task group leader
  ...
2026-08-20 10:37:42 -07:00
Linus Torvalds
39e34e88ec Merge tag 'wq-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq
Pull workqueue updates from Tejun Heo:

 - Worker wakeups moved out of pool->lock on the hot paths, shortening
   lock hold times. The wakeup can be expensive on arm64 due to the idle
   wakeup IPI, and the change improves the workqueue microbenchmark
   there by up to 10%

 - Stall diagnostics now report pools stuck with no running worker, with
   a backtrace of what the CPU is executing and the likely culprit
   worker, instead of dumping every in-flight worker

 - Preparation for turning per-cpu workqueues into an affinity scope of
   unbound workqueues instead of a separate backend

 - Race annotations for KCSAN and sparse warnings, and doc and
   monitoring script fixes

* tag 'wq-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: (23 commits)
  workqueue: annotate racy p->wake_cpu accesses in kick_pool_pick()
  workqueue: BUG_ON() instead of returning NULL in wq_node_nr_active()
  workqueue: use RCU accessors when populating wq->cpu_pwq
  workqueue: use rcu_dereference_sched() in workqueue_congested()
  workqueue: skip the node_nr_active update for non-unbound workqueues
  workqueue: rename alloc_unbound_pwq() to alloc_pwq()
  workqueue: allocate attrs for all workqueues
  workqueue: rename wq->unbound_attrs to wq->attrs
  workqueue: test WQ_UNBOUND explicitly in the hotplug loops
  workqueue: account nr_active by the backing pool
  workqueue: release pwq pools by pool type
  workqueue: factor out alloc_and_link_percpu_pwqs()
  workqueue: factor out get_percpu_pool()
  docs: workqueue: Fix bracket
  workqueue: annotate racy sum_exec_runtime reads for CPU-intensive detection
  workqueue: annotate racy PWQ_STAT_CPU_TIME update in wq_worker_tick()
  workqueue: dump the last woken worker for stalled pools
  workqueue: trigger a single-CPU backtrace for stalled pools
  workqueue: only show running workers in stall diagnostics
  workqueue: defer the worker wakeup outside pool->lock in process_one_work()
  ...
2026-08-20 10:34:25 -07:00
Linus Torvalds
72fdff1416 Merge tag 'docs-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/docs/linux
Pull documentation updates from Jonathan Corbet:
 "It has been a not-too-busy cycle for docs; here's the highlights:

   - A (hopefully) consensus change to our LLM-attribution requirements,
     removing the specific model name from the Assisted-by tag

   - A couple of new realtime documents

   - Various docs-build-system fixes

   - Ongoing work with the Chinese, Portuguese, and Japanese
     translations

  ...and lots of typo fixes, grammar tweaks, etc"

* tag 'docs-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/docs/linux: (85 commits)
  Doc: admin-guide: pm: Remove unnecessary backticks and fix a spell
  Documentation: Extend the real-time hardware bits with some firmware bits
  docs: pt_BR: Reorganize process/index.rst to follow english structure
  docs: conf.py: fix the 'utf-8' typo
  doc tools: fix 'path' typos
  Documentation: real-time: Add kernel configuration guide
  docs: python: abi_regex: convert adjacent index placeholders
  docs: python: abi_regex: catch the right exception for a bad regex
  docs: sphinx-build-wrapper: include localversion in kernel version string
  Documentation: html: adjust sidebar section titles styling
  Documentation: html: show sections in the sidebar
  checkpatch.pl: adapt to new Assisted-by: format
  MAINTAINERS: update Traditional Chinese documentation maintainers
  docs: pt_BR: process: Translate CVE documentation
  docs: pt_BR: translate the management-style.rst to Brazilian Portuguese
  docs: xforms_lists: support DEFINE_IDTENTRY_IRQ()
  coding-assistants: simplify attribution
  docs: translations: pt_BR: translate email-clients.rst
  docs: pt_BR: process: Translate the security-bugs.rst
  doc:it_IT: align doc-guide translation
  ...
2026-08-20 10:31:50 -07:00
Linus Torvalds
9d2ed026f0 Merge tag 'sysctl-7.03-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl
Pull sysctl updates from Joel Granados:

 - Fix kernel-doc warnings by adjusting in file documentation

 - Consolidate do_proc_* function into do_proc_vec

   Consolidate three slightly different implementations of applying a
   converter on all elements of a vector. Fixes to this function now
   propagate to the three types.

 - Replace CONFIG_PROC_SYSCTL with CONFIG_SYSCTL (they were the same)
   and restrict cad_pid modifications to global root (GLOBAL_ROOT_UID)

* tag 'sysctl-7.03-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl:
  sysctl: remove CONFIG_PROC_SYSCTL, it just mirrors CONFIG_SYSCTL
  sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[]
  sysctl: repair some kernel-doc comments
  sysctl: add Returns: kernel-doc for all functions
  sysctl: Update API function documentation
  sysctl: Rename proc_doulongvec_minmax_conv to proc_doulongvec_conv
  sysctl: Group proc_handler declarations and document
  sysctl: Replace do_proc_do{int,ulong,uint}vec with do_proc_vec
  sysctl: Add negp parameter to douintvec converter functions
  sysctl: Move default converter assignment out of do_proc_dointvec
2026-08-20 08:46:41 -07:00
Linus Torvalds
91ec203513 Merge tag 'net-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next
Pull networking updates from Jakub Kicinski:
 "One of the 'small improvements all over the place' releases for us.

  It's hard to draw any direct comparisons because summer vacations
  disrupted our patch processing (and presumably - generation) quite a
  bit.

  Quick and dirty count suggests we (Paolo and I) merged a very similar
  number of net (632) and net-next (648) patches. This is not telling
  the full story either because 1/3 to 1/2 of the net-next patches also
  *seem* like AI-driven low priority fixes, cleanups and clarifications.

  We are completely overwhelmed, of course. The glimmer of hope is that
  we secured sufficient LLM budget and access (thank you Meta!) to run
  reviews with multiple frontier models on each patch. This eliminates
  some hallucinations. That said, in terms of review, the LLMs can only
  do so much.

  The sad truth is that our APIs (especially for rare events like PCIe
  errors, timeouts etc) have always been racy, and now LLMs don't let us
  ignore that. I expect our direction for the next release will be to
  tweak the reviews a little bit more, but start shifting focus to
  letting the LLMs take care of the busy work - managing patchwork,
  automating common process complaints, editing commit messages, and
  maybe applying patches which already got "reviewed-by" tags from
  people we trust...

  Core & protocols:

   - A few steps lowering rtnl_lock dependence:
      - per-netns netdev unregistration for select SW drivers (e.g.
        veth, ipvlan, tunnels)
      - rtnl_lock-less FIB rule changes (RTM_NEWRULE and RTM_DELRULE)
      - prepare software drivers and TC qdiscs for rtnl_lock-less GET

   - Support BIG TCP (>64kB TSO) in UDP tunnels (vxlan, geneve)

   - Support buffers larger than PAGE_SIZE in devmem zero-copy API

   - Improve MPTCP handling of extreme memory pressure handling, when
     out-of-order queue had to be pruned

   - Report the per-group user count via RTM_GETMULTICAST

   - Expose the route deletion reason in RTM_DELROUTE

   - Add a SO_RIGHTS_NOTRUNC option to UNIX sockets to enable more
     useful handling of LSM denials when receiving SCM_RIGHTS messages:
     instead of truncating the message at the first blocked fd, keep
     every fd slot and store the LSM errno in the blocked slot

   - IPv6 Segment Routing - support looking up the post-encap SID
     (address) in a different/specified routing table

   - Support PRP RedBox (interlink) creation

   - Support per-nexthop UDP dst port in VXLAN

   - Continue converting getsockopt callbacks in a number of protocols
     to iov_iter

  Ethernet:

   - Merge initial CXL support for AMD/Solarflare NICs (shared branch
     with the CXL tree)

   - New drivers:
      - ADIN1140 10BASE-T1S MACPHY
      - Initial skeleton of Intel iXD and ZTE Dinghai drivers

   - High-speed NICs:
      - AMD/Pensando:
         - support firmware flashing
      - Cisco (enic):
         - SR-IOV V2 admin channel and MBOX protocol
      - Huawei (hns3):
         - support for ethtool pfc_prevention_tout
      - nVidia/Mellanox:
         - support sharing bandwidth control across interfaces
           of the same device
      - Marvell (octeontx2-pf):
         - link RQ page pools to netdev for Netlink stats
      - Google vNIC:
         - XDP metadata support for DQ RDA
      - Microsoft vNIC:
         - support forcing full-page RX buffers

   - Other NICs:
      - Synopsys IP:
         - eic7700: support for eth1
      - Microchip (lan743x):
         - support for RMII interface
      - Wangxun:
         - support for ethtool -G and -C for VFs
         - add Tx timeout and PCIe error handling
      - Intel (igb/igc):
         - RSS key get/set support
         - support for forcing link speed without auto-negotiation

   - Switches:
      - NXP (dpaa2):
         - support bonding/LAG offload
      - Mediatek:
         - mt7530: EN7528 support
         - initial support for MT7628
      - Micrel (ksz8/9):
         - refactoring work to move towards library model
         - PTP support for KSZ8463
      - nVidia/Mellanox:
         - support rtnl-lock-less ethtool callbacks
      - Realtek:
         - rtl8366rb: use generic RTL83xx code
         - support SGMII and HSGMII for RTL8367S

   - PHYs:
      - Airoha:
         - EcoNet EN7528 PHY support
      - DAPU Telecom
         - DAPU Telecom DAP8211R(I) Gigabit PHY support
      - Realtek:
         - support RTL8261C_CG
         - support RTL8261D

  Wireless:

   - nl80211: per-link statistics support for multi-link operation

   - mac80211: AQL/airtime-fairness support for multicast

   - Merge Peripheral Authentication Service (PAS) / TEE support for
     ath12k (shared branch with the firmware/qcom tree)

   - New drivers:
      - mm81x for Morse Micro Long-Range S1G devices
      - nxpwifi for NXP devices (mostly forked off from mwifiex)

   - Driver changes:
      - Broadcom (brcmfmac):
         - DPP support, some Cypress part update
      - MediaTek (mt76):
         - mt7928 support
         - mt7925 NAN support
         - mt7996 AP powersave improvements
      - Qualcomm (ath12k):
         - much kernel infrastructure integration work
         - AHB platform MultiPD support
      - Realtek (rt89):
         - LED support
         - RTL8922DE support
         - dual-BT coex for RTL8922D
      - Intel:
         - new FW version support

  Bluetooth:

   - HCI: add support for Shorter Connection Interval (SCI) feature

   - af_bluetooth: add minimal context analysis annotations

   - Driver changes:
      - Intel:
         - add Bluetooth SAR revision 2 support
         - add vendor_reset PCI sysfs for PLDR
      - Mediatek:
         - add USB IDs for MT7902 and MT7922 devices
      - Realtek:
         - add USB IDs for 8761CU and 8852BE devices
      - NXP:
         - add M.2 Bluetooth device support using pwrseq

  Misc:

   - DPLL support for manual/numerical oscillator control (NCO)
     (implement in zl3073x)

   - MCTP support for MCTP over USB v1.1 (DMTF DSP0283)

   - Power-over-Ethernet: support Realtek PSE controllers

   - Remove the IBM EHEA driver

   - Remove tulip/xircom_cb driver"

* tag 'net-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next: (1433 commits)
  net/mlx5e: do not HW-GRO coalesce small frames
  net: openvswitch: fix nf_connlabels leak in ovs_ct_init
  net: add missing ref_tracker_dir_exit() to alloc_netdev_mqs()
  net: openvswitch: fix flow mask use-after-free on flow deletion
  sctp: stop processing a packet once its association is deleted
  dpll: zl3073x: add PTP clock support
  dpll: zl3073x: add channel ToD, phase step and TIE operations
  dpll: zl3073x: scale poll interval proportionally to timeout
  ptp: vmclock: prevent read-only mappings from becoming writable
  ipv4: reject undersized MTUs in ip_do_fragment()
  bonding: initialize err for empty target lists
  net: dsa: initial support for MT7628 embedded switch
  net: dsa: initial MT7628 tagging driver
  net: phy: mediatek: add phy driver for MT7628 built-in Fast Ethernet PHYs
  dt-bindings: net: dsa: add MT7628 ESW
  net: pse-pd: realtek-pse-mcu: add UART transport
  net: pse-pd: realtek-pse-mcu: add I2C transport
  net: pse-pd: add Realtek PSE MCU core
  dt-bindings: net: pse-pd: add bindings for Realtek PSE MCU
  vsock: use sock_error() to consume sk_err after a failed connect
  ...
2026-08-20 08:16:04 -07:00
Linus Torvalds
5a8cd539ac Merge tag 'bpf-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next
Pull bpf updates from Daniel Borkmann:
 "Major changes:

   - Redesign the verifier error reporting: failures now carry source
     and instruction annotations along with the causal event history
     that led to them, making program rejections far easier to debug and
     repair (Kumar Kartikeya Dwivedi)

   - Add arena argument support to kfuncs and struct_ops through the new
     __arena and __arena__nullable suffixes (Tejun Heo, Puranjay Mohan,
     Kumar Kartikeya Dwivedi, Ihor Solodrai)

   - Signed BPF program loader rework to accommodate both BPF and
     security community needs where the kernel runs the signature
     verification at BPF_PROG_LOAD time before the LSM admission hook
     (Daniel Borkmann)

   - Add a set of ksock kfuncs which let BPF LSM and syscall programs
     create, connect and send on UDP sockets in order to emit telemetry
     data (Mahe Tardy)

   - Unify helper and kfunc call argument verification and classify
     kfunc arguments purely from BTF into a generated bpf_func_proto
     which is computed once at add-call time (Amery Hung)

  Other features and fixes:

   - Enable EXECMEM_ROX_CACHE for BPF allocations on x86 (Mike Rapoport)

   - Add bidirectional VLAN support to bpf_fib_lookup() through the new
     BPF_FIB_LOOKUP_VLAN and BPF_FIB_LOOKUP_VLAN_INPUT flags (Avinash
     Duduskar)

   - Infer zext_dst from static register liveness analysis to fix 32-bit
     zero-extension semantics, and remove the artificial limitations on
     pointer types eligible for spilling (Eduard Zingerman)

   - Inline the numeric open-coded iterator kfuncs so that bpf_for()
     loops no longer pay a kfunc call on every iteration (Puranjay
     Mohan)

   - Add an arena-based bitmap data structure to libarena along with
     serial and parallel selftests (Emil Tsalapatis)

   - Teach resolve_btfids to discover kfuncs from the kernel's BTF ID
     sets and to emit kfunc BTF decl tags, reducing the kernel build's
     dependency on pahole features (Ihor Solodrai)

   - Add BPF_F_ADJ_ROOM_DECAP_* flags to bpf_skb_adjust_room() so that
     tunnel decapsulation can update the GSO and encapsulation state of
     the skb (Nick Hudson)

   - Fix the ring buffer pending_pos walk and the available-data
     accounting on 32-bit position wrap (Israel Téllez García)

   - Add memory usage accounting for arena maps and fix an mmap_lock
     deadlock on arena lock failure (Jiayuan Chen)

   - Add tracing_multi link info support to the kernel UAPI and bpftool,
     and refactor the stack map code to run with preemption disabled
     (Jiri Olsa)

   - Support BPF_F_EGRESS in bpf_redirect_peer() to emit the skb in the
     egress direction of the target's peer device (Jordan Rife)

   - Add a KF_SPINLOCK_SAFE kfunc flag so that providers, in particular
     modules, can declare kfuncs safe to call under bpf_spin_lock
     instead of relying on the verifier's hard-coded allowlist (Kaitao
     Cheng)

   - Introduce global percpu data for BPF programs with libbpf probing
     and bpftool skeleton support, and stop exposing uninitialized
     kernel heap memory when copying per-CPU map values (Leon Hwang)

   - Add s390 JIT support for load-acquire and store-release
     instructions (Maxim Khmelevskii)

   - Fix a CFI mismatch in the task work callback and an arm64 KASAN
     false positive after bpf_throw() (Mykyta Yatsenko)

   - Reject writes through untrusted BTF pointers and bound the
     rdonly/rdwr_buf_size kfunc arguments (Nicholas Dudar)

   - Invalidate RCU pointers only after the final spin unlock and
     account for preempt and IRQ disabled regions as overlapping RCU
     protection (Ning Ding)

   - Support mixing bpf2bpf calls and tail calls on RV64, add signed
     operations and 32-bit atomics to the RV32 JIT, and add timed
     may_goto support (Pu Lehui, Kuan-Wei Chiu, Feng Jiang)

   - Fix a use-after-free on mm_struct in bpf_find_vma() for foreign
     tasks and an mmap_lock leak in the irq_work path (Sanghyun Park)

   - Populate mmap-able BPF array map memory lazily which makes mmap()
     O(1) instead of proportional to the map size (Song Liu)

   - Introduce a jit_required flag and reject programs with inlined
     helpers when no JIT is available, where the interpreter would
     otherwise jump into an invalid address (Tiezhu Yang)

   - Fix the x86 JIT per-CPU address resolution into an extended
     register where the REX prefix dropped the high destination register
     bit (Vineet Gupta)

   - Reject MEM_ALLOC BTF accesses past object bounds, arena frees below
     the arena base, and mixed arena and ordinary atomic paths (Yiyang
     Chen)

   - Fix the trampoline handling of 128-bit arguments and of return
     values larger than 8 bytes (Yonghong Song)

   - Ensure that any fault prone load is rewritten with exception table
     handling, and fix the arena load-acquire and atomic fetch handling
     in the x86, arm64, riscv and s390 JITs (Daniel Borkmann)

   - Many more fixes and cleanups across the verifier, arena,
     trampolines, sockmap, cgroup, ring buffer, x86/arm64/riscv/s390
     JITs, libbpf, bpftool, resolve_btfids and selftests"

* tag 'bpf-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: (373 commits)
  selftests/bpf: Add tests for a store on a fault prone qdisc pointer
  selftests/bpf: Add tests for fault prone loads out of RCU pointers
  selftests/bpf: Add tests for pointer type merge at a shared load
  selftests/bpf: Remove duplicate copies of the arena spinlock qnodes
  selftests/bpf: Retry stat generation in cgroup_iter_memcg
  selftests/bpf: Test pseudo-function policy diagnostics
  bpf: Distinguish function references in policy diagnostics
  bpf: Preserve source attribution without source text
  selftests/bpf: Test kfunc argument diagnostics
  bpf: Correct kfunc argument diagnostics
  bpf: Use canonical stack argument names in diagnostics
  bpf: Preserve R0 lineage across helper calls
  selftests/bpf: Exercise negative optlen in cgroup getsockopt hook
  bpf: Reject negative optlen in cgroup getsockopt hook
  selftests/bpf: tc_tunnel - validate decap GSO and encapsulation state
  bpf: Clear decap state on skb_adjust_room shrink path
  bpf: Allow new DECAP flags and add guard rails
  bpf: Add BPF_F_ADJ_ROOM_DECAP_* flags for tunnel decapsulation
  bpf: Refactor masks for ADJ_ROOM flags and encap validation
  bpf: Name the enum for BPF_FUNC_skb_adjust_room flags
  ...
2026-08-20 07:36:20 -07:00
Linus Torvalds
a4ff2be345 Merge tag 'v7.3-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
Pull crypto update from Herbert Xu:
 "API:
   - Add af_alg_restrict sysctl and white list
   - Fix potential suspend/resume races in hwrng

  Algorithms:
   - Optimize vli additive operations using compiler builtins in ecc

  Drivers:
   - Remove unsafe/deprecated algorithms from qce
   - Mark qce as BROKEN
   - Add runtime PM and interconnect bandwidth scaling support to qce
   - Remove crypto_rng from qcom, sun8i and caam
   - Fix SG list issues in iaa
   - Fix SEV init path bugs in ccp"

* tag 'v7.3-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (122 commits)
  crypto: lskcipher - propagate errors from unaligned crypt
  crypto: keembay - use crypto_memneq() to compare CCM AEAD tags
  crypto: keembay - use crypto_memneq() to compare GCM AEAD tags
  crypto: sa2ul - use crypto_memneq() to compare AEAD tag
  hwrng: drivers - use named initializers for acpi_device_id
  crypto: qce - fix CCM AAD buffer underallocation
  crypto: iaa - unmap dst before software fallback on decompress
  crypto: iaa - use bounce buffer for multi-sg decompress input
  crypto: iaa - avoid counting fallback decompression bytes
  crypto: iaa - fall back to software for multi-entry scatterlists
  hwrng: core - Stop/start hwrng_fillfn() kthread before/after suspend-resume
  crypto: hisilicon/sec2 - fix CCM algorithm long packet failure
  crypto: eip93 - use struct_size() and flexible array for ring allocation
  crypto: krb5 - use kfree_sensitive() for derived key buffers
  crypto: af_alg - Stop after finding name in allowlist
  crypto: af_alg - Replace 'bool privileged' with flags
  crypto: af_alg - Make cbc(paes) privileged-only
  hwrng: imx-rngc - Disable clock on registration failure
  crypto: qat - remove dead ADF_HEX code
  crypto: qce - simplify qce_handle_request
  ...
2026-08-19 17:25:42 -07:00
Linus Torvalds
a51ec5e8e5 Merge tag 'integrity-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity
Pull integrity updates from Mimi Zohar:

 - TPM initialization is sometimes delayed until deferred_probe_initcall

   Since ordering is not guaranteed within the same initcall level, IMA
   may initialize before the TPM and fall back to TPM-bypass mode. A new
   config option, CONFIG_IMA_INIT_LATE_SYNC, allows those building the
   kernel to defer IMA initialization to late_initcall_sync, accepting
   the integrity risk of missing early measurements in exchange for
   avoiding TPM-bypass mode.

 - The raw policy rules are now measured, as well as the complete
   policy, closing a gap in integrity measurement coverage

* tag 'integrity-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity:
  ima: measure userspace policy writes before parsing
  ima: add critical data measurement for loaded policy
  security: ima: rename boot_aggregate when ima is initialised at late_sync
  security: ima: introduce IMA_INIT_LATE_SYNC option
  security: lsm: allow LSMs to register for late_initcall_sync init
2026-08-19 17:17:17 -07:00
Linus Torvalds
cbad8981fa Merge tag 'Smack-for-7.3' of https://github.com/cschaufler/smack-next
Pull smack updates from Casey Schaufler:

 - Spelling fix

 - Code optimization in smackfs

 - Fix credential mis-uses

 - Place limits on two of the smackfs interfaces

* tag 'Smack-for-7.3' of https://github.com/cschaufler/smack-next:
  smack: fix cred UAF in smack_file_send_sigiotask()
  smack: restrict smackfs/{direct,mapped} values to 0-255
  smack: deduplicate smackfs/{direct,mapped} file_operations
  smack: show msgrcv() subject task in audit
  smack: fix incorrect task context in smack_msg_queue_msgrcv
  security: smack: fix spelling mistake
  smack: simplify write handlers of sysfs entries
  Smack: Fix error in capability bypass
2026-08-19 16:51:39 -07:00
Linus Torvalds
09005a6398 Merge tag 'lsm-pr-20260814' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm
Pull LSM updates from Paul Moore:

 - Remove task_euid()

   The task_euid(), and Rust counterpart, was never widely used, for
   good reason, and now that the only user is gone we're removing it to
   rid ourselves of both dead and funky code.

 - Documentation improvements

   Correct some of the kdoc comments for security_task_prctl() and
   clarify the rust comments on task UID accessors.

 - Fix a memory leak in the LSM syscall selftests

* tag 'lsm-pr-20260814' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm:
  selftests/lsm: Fix memory leak in attr_lsm_count
  cred: delete task_euid()
  rust: task: clarify comments on task UID accessors
  lsm: clarify security_task_prctl() hook documentation
2026-08-19 16:28:23 -07:00
Linus Torvalds
4253eb09d2 Merge tag 'selinux-pr-20260814' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux
Pull selinux updates from Paul Moore:

 - Convert a __get_free_page() call into a kmalloc() call

   We had some very old code that called out to __get_free_page() for
   allocating a pathname. There is no reason this couldn't be done with
   a call to kmalloc() so we've done the conversion and now there is one
   less __get_free_page() caller in the kernel.

 - Limit the number of retired/unknown DCCP netlink messages

   While DCCP is gone from the kernel, there are still userspace tools
   which try to talk to the kernel about DCCP sockets which were
   generating SELinux related log noise (unrecognized netlink message).
   This pull request both limits the log messages to just the first
   instance and also explains to the user that DCCP support has been
   removed.

 - Convert the SELinux strlcat() calls to seq_buf_XXX() calls

   As part of the effort to drop the strlcat() API from the kernel, the
   SELinux/IMA code was converted over to using seq_buf_XXX() calls.

 - Only calculate the SELinux IMA configuration string length once

   Previously each call to generate a SELinux configuration string for
   IMA would have to calculate the length of the string. While the
   contents of the string will likely change over the lifetime of the
   system, the length of the string will not. Calculate the string
   length once at boot and reuse the length value throughout the
   lifetime of the system.

 - Further validation of the SELinux policy at policy load time

   Perform additional sanity checks on the policy constraints and types.

 - Proper cleanup and error handling for selinuxfs init failures

   We were not properly cleaning up some state in the case where
   selinuxfs fails to initialize properly. It's somewhat of an academic
   exercise as a failure to initialize selinuxfs will cause the system
   to fail on boot, but it's arguably better to make sure we do things
   the proper way.

 - Various code cleanups

   Convert integer flags to boolean types and drop an uncessary goto
   from the SELinux code.

* tag 'selinux-pr-20260814' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:
  selinux: validate constraint expression attr and op at load time
  selinux: compute the IMA configuration settings string length once at boot
  selinux: replace strlcat() with seq_buf in selinux_ima_collect_state()
  selinux: suppress warning flood for retired DCCP netlink messages
  selinux: tighten type validation during policy load
  selinux: drop unnecessary goto and label from avc_alloc_node()
  selinux: convert int flags to bool flags in ss/services.c
  selinux: clean up selinuxfs resources on init failure
  selinux: hooks: use kmalloc() to allocate path buffer
2026-08-19 16:24:46 -07:00
Linus Torvalds
83453b6f51 Merge tag 'audit-pr-20260814' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit
Pull audit updates from Paul Moore:

 - Drop BUG_ON() assertions from two functions

   While I don't recall any bug reports from either of these assertions
   in recent memory, neither of these checks warrant the kernel panic
   that could result from BUG_ON(). One of the BUG_ON() calls is
   converted to a WARN_ON_ONCE() and the other to a lockdep assertion.

 - Fix an audit tree reference counting problem

   Fix a corner case where audit could end up unintentionally dropping
   the last reference to an audit tree while the tree was still in use.

   We should probably revisit the audit tree handling code in full, but
   this patch works, and should be easy to backport to stable trees and
   downstream kernels.

 - Update the audit syscall classification tables

   Add some missing syscalls to the PERM class

* tag 'audit-pr-20260814' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:
  audit: avoid dropping live tree ref on fsnotify rule autoremove
  audit: drop BUG_ON() from audit_signal_info_syscall()
  audit: drop BUG_ON() from audit_add_to_parent()
  audit: add missing syscalls to PERM class tables
2026-08-19 16:21:32 -07:00
Linus Torvalds
cb8a75eec0 Merge tag 'trace-ringbuffer-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull ring-buffer updates from Steven Rostedt:

 - Remove unneeded semicolon

   A macro ended with a semicolon that wasn't needed.

 - Fix freeing cpu_buffer extra subbuffer with order greater than zero

   When the cpu_buffer was being freed, its "free" page, was using
   free_page() to free it when it could be more than one page.

 - Hold the cpu_buffer lock when resizing the subbuffer

   The freeing of the "free" page of the cpu_buffer was done without
   locking. The order of the data was being saved and then the "free"
   page was set to NULL. But there is a race that the "free" page could
   have been updated between those two operations. Add locking around it
   to prevent the race.

 - Save the order of the data along with the data in the free page

   The cpu_buffer would store just the data portion of the subbuffer
   page in its descriptor. But it did not store the order of the data
   pages. The order was being saved in the global buffer descriptor. But
   this leads to races.

   Have the cpu_buffer save the subbuf data along with its metadata
   (which includes the order of the page) to make sure when it frees it,
   it frees the correct order along with it.

 - Remove the subbuf_size and use the order directly when needed

   Having a size field for the size of the subbufer along with its order
   allowed for races to have them get out of sync. Remove the
   subbuf_size and use the order from the subbuf meta data directly
   under locks.

   Use the subbuf_order for other calculations in the ring buffer.

 - Remove the useless "cpus" field of trace_buffer

   The code has been restructured and the "cpus" field is no longer
   used. Remove it.

 - Remove the "mapped" field of the ring buffer and use a helper
   function instead.

   The "mapped" field has become a bit overused and made the code come
   complex in using a counter for what is denoted as being mapped or
   not. There are other fields that are set when the ring buffer is
   considered mapped. Add a helper function to check those fields and
   use that instead of keeping track of a counter.

* tag 'trace-ringbuffer-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  ring-buffer: Remove ring_buffer_per_cpu::mapped
  ring-buffer: Remove trace_buffer::cpus
  ring-buffer: Dynamically calculate max_data_size
  ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page()
  ring-buffer: Fix subbuf resize race with ring buffer readers
  ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page
  ring-buffer: Hold cpu_buffer::lock when resizing a subbuf
  ring-buffer: Free cpu_buffer::free_page with subbuf_order
  ring-buffer: drop unneeded semicolon
2026-08-19 14:22:07 -07:00
Linus Torvalds
1484625c59 Merge tag 'tracefs-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull tracefs updates from Steven Rostedt:

 - Define event fields before directory creation

   Move the event_define_fields() call in event_create_dir() before the
   eventfs directory creation. Previously, a failure after directory
   creation wouldn't clean up eventfs_inode because the error path
   didn't call eventfs_remove_dir(). This eliminates the need to clean
   up the eventfs directories if event_define_fields() fails.

 - Add warning for out of bounds pos in __eventfs_iterate()

   Sashiko complains about the ctx->pos causing issues if it is less
   than 2 or greater than MAX_INT in __eventfs_iterate(). The thing is,
   the logic prevents that from happening. But to make Sashiko happy,
   add a WARN_ON() and exit safely if the function ever does get input
   that is out of the range the function expects.

* tag 'tracefs-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  eventfs: Add warning for out of bounds pos in __eventfs_iterate()
  eventfs: Define event fields before directory creation
2026-08-19 14:18:45 -07:00
Linus Torvalds
081e5bf2a9 Merge tag 'trace-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull tracing updates from Steven Rostedt:

 - Expose btf_ids to trace events

   In order to allow BPF programs to attach to system call trace events
   (which are actually pseudo trace events built on top of raw_syscall
   events), expose the BTF ID of the events. This will allow BPF
   programs better precision in attaching to events.

 - Use "u64" to assign to hist_field->type

   Instead of using kstrdup("u64", GFP_KERNEL) to assign the
   hist_field->type, just point it to "u64" instead. The
   hist_field->type is freed via kfree_const().

 - Replace kmalloc()/strcpy() with kstrdup() for trace_printk

   Instead of having two calls to copy the module format string, just
   use kstrdup().

 - Use __free() in trace event histograms and triggres where possible

 - Use seq_buf in trace event code instead of strcat()

   Instead of calculating the size of the buffer to use and filling it
   with strcat(), use the seq_buf infrastructure that takes care of
   making sure not to overflow the string size.

 - Reject invalid preemptirq_delay_test CPU affinity

   The preempt_delay_test module can take an invalid CPU affinity mask
   and create confusing output. Simply have the module reject invalid
   affinity masks.

 - Prevent division by zero in ftrace_ops sample module code

   If the ftrace_ops sample module code receives the module parameter
   nr_function_calls set to zero, it can cause a division by zero error.

 - Warn when an event dereferences a parameter in TP_printk()

   On boot up and module load, the trace event TP_printk() is scanned
   for possible bugs. As the TP_printk() code is executed when the user
   reads the "trace" file and processes the data written when the
   trace_event executed, the data it reads can be literally days old.
   The scan currently checks for dereferencing printk formats like
   "%pI6". But it does not check if the parameters themselves have a
   dereference like:

	TP_printk("offset %08x: value %08x",
		(u32)(__entry->addr - __entry->edma->membase), __entry->value)

   __entry represents the pointer to the event on the ring buffer. The
   __entry->edma->membase is dereferencing a pointer on the ring buffer
   to find membase, but the __entry->edma may no longer be a valid
   pointer.

   Warn on this case too.

 - Replace some strcpy() with strscpy()

 - Clean up mmiotrace events to use assign_type() macro

   The assign_type() macro makes sure the event type is indeed the type
   that is being parsed. The mmiotrace trace was written before that
   macro was created so it just simply typecasted the pointer.

   Replace the typecasting with the macro.

 - Have the ENUM processing to numbers only process what is added

   The code that converts ENUMs to their numbers in the trace events
   scanned all events to do the processing. This was true when a module
   was loaded too. That is, instead of processing just the events for
   the module, it processed *all* events. Even the builtin ones that
   were processed at boot up.

   Add a check for the event->module matching mod if it is a module
   before processing it.

* tag 'trace-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (21 commits)
  tracing: Have trace_event_update_all() only handle module that is loading
  tracing: Cleanup event_enable_trigger_parse() by using __free()
  tracing: Report every TP_printk double dereference
  tracing/mmiotrace: Use trace_assign_type() in mmio_print_mark()
  tracing: Make per-template BTF id lists file-local
  tracing: Use seq_buf for string concatenation
  tracing: Use strscpy() instead of strcpy() in trace_sched_switch
  tracing: Warn when an event dereferences a pointer in TP_printk()
  samples/ftrace: Prevent division by zero when nr_function_calls is zero
  tracing: Reject invalid preemptirq_delay_test CPU affinity
  fgraph: Use trace_seq_putc() in print_graph_return()
  tracing/user_events: Replace a seq_printf() call by seq_puts() in user_seq_show()
  tracing/user_events: Use seq_putc() in two functions
  tracing: Bound histogram expression strings with seq_buf
  tracing: Return ERR_PTR() from expr_str()
  tracing: Use __free() for expr_str() buffer
  kernel/trace/trace_printk: Use kstrdup() instead of kmalloc() and strcpy()
  tracing: Point constant hist field type to string literal
  selftests/bpf: Add test for tracepoint btf_ids tracefs file
  tracing: Expose tracepoint BTF ids via tracefs
  ...
2026-08-19 14:06:14 -07:00
Linus Torvalds
00d66b29a6 Merge tag 'ftrace-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull ftrace updates from Steven Rostedt:

 - Deprecrate ftrace_enabled in disabling ftrace

   The file /proc/sys/kernel/ftrace_enabled was created when ftrace was
   first introduced back in 2008. It was to be a "kill switch" if
   something was to go wrong. It was also used as a way to turn off
   function tracing for the latency tracers that would have it on by
   default. But in 2013 (Linux 3.10) the option "function-trace" was
   introduced to disable function tracing for the latency tracers as the
   "ftrace_enabled" file was considered too big of a hammer and caused
   too many side effects.

   When live kernel patching came along, disabling ftrace via the
   ftrace_enabled file would put the system into an unstable state if a
   live kernel patch was installed. This created the need to mark some
   function hooks as "PERMANENT".

   Now there's a need for BPF usage marked as PERMANENT for the same
   reasons.

   The file "ftrace_enabled" usage is no longer viable. It doesn't do
   what it says it does and there is no reason to use it.

   Make writing '0' to it a nop and print a message saying its usage is
   deprecated. The return value of writing '0' is -EOPNOTSUPP so that
   user space will error on that write (hopefully to inform any
   developer that it no longer works).

   Eventually the file should be removed completely, but for now just
   making it not do anything is the path forward to that.

 - Update the livepatch tests to handle ftrace_enabled being disabled

   Because in the past, livepatch was broken by ftrace_enabled being
   turned off, there's a test case that checks to make sure it still
   doesn't break. But having the write of '0' return an error caused
   that test to break. Updated the test to handle the new change.

* tag 'ftrace-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  selftests/livepatch: update test-ftrace.sh for deprecated ftrace_enabled
  ftrace: deprecate disabling via ftrace_enabled sysctl
2026-08-19 14:01:58 -07:00
Linus Torvalds
3793b558ff Merge tag 'trace-tools-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull RTLA updates from Steven Rostedt:

 - Extend support for unsetting CLI options

   libsubcmd auto-generates "--no-<option>" to unset options, provided
   the option callback supports it. Implement this for RTLA CLI beyond
   boolean options, and document the few exceptions that are left out.

 - Test all tracer options in runtime tests

   Verify that RTLA sets osnoise/timerlat options correctly by reading
   them from tracefs during runtime tests.

 - Improve range validation for option arguments

   Make CLI range validation consistent with the kernel limits and unify
   implementation and error messages between options.

 - Improve invalid option argument parsing

   Consistently reject invalid values for numeric option arguments with
   a unified error message for all options.

* tag 'trace-tools-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  rtla/cli: Unify and improve handling of invalid option arguments
  rtla/cli: Unify and improve range validation logic
  rtla/tests: Test all tracer options in runtime tests
  Documentation/rtla: Document unsetting options
  rtla: Add unit tests for CLI with unset
  rtla: Add unit tests for unset in opt callbacks
  rtla: Allow unsetting non-list custom-callback CLI options
2026-08-19 14:00:15 -07:00
Linus Torvalds
55ee4b931a Merge tag 'trace-rv-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull Real-time Verifier updates from Steven Rostedt:

 - Switch LTL and DOT parsers to Lark in code generation tool

   The rvgen code generation tool originally parsed DOT files and LTL
   specifications using custom string parsing and Ply, which is no
   longer maintained. The DOT parser was fragile and prone to failure on
   minor format variations. Both LTL and DOT parsers have been rewritten
   to use the Lark parsing library.

 - Simplify Hybrid Automata clock variables

   The clock variables in hybrid automata monitors now use a single
   representation of the elapsed time since the clock was reset, rather
   than converting between invariant and guard representations. This
   allows simpler code generation for the newly refactored parser.

 - Generate cleanup hook for per-obj monitor

   The code generation scripts now adds a cleanup function to per-obj
   monitors for the user to wire to the appropriate event (e.g.
   sched_process_exit for tasks).

 - Reduce read_lock scope during per-task cleanup

   Take the tasklist_lock only when necessary, that is when iterating
   over for_each_process_thread().

 - Simplify task monitor slot management

   Only rely on the slot array for per-task slot management to avoid
   inconsistency with the unused counter.

 - Improve rvgen code robustness and templates

   Use pathlib in rvgen and improve kernel path discovery. Also improve
   consistency across templates when generating code (e.g. author
   placeholder and monitor struct name).

 - Update rtapp sleep monitor

   Simplify the sleep monitor by excluding kernel threads and updating
   the nanosleep check to focus only on CLOCK_REALTIME. Also switch to
   use the sched_exit tracepoint to run in the context of the offending
   (wakee) task.

 - Add wakeup monitor

   Add the new rtapp/wakeup monitor to detect when lower-priority tasks
   wake up higher-priority ones, complementing the existing sleep
   monitor by running in the waker context and capturing its stack
   trace.

 - Fix tools/rv exit status on failure

   Ensure the rv tool returns a failure exit code when a monitor fails
   to start because it was already running.

 - Add automated selftests for tools/rv and rvgen

   Introduced automated bash selftests to validate rv monitor listing
   and execution under different configurations. Added tests for the
   rvgen code generator, validating generated files against expected
   output (golden). Tests are reachable via make check.

 - Add KUnit test coverage for verification monitors

   Added comprehensive KUnit tests to validate the functionality of
   deterministic, hybrid, and LTL monitors by emulating event sequences
   and timing in a mock environment without affecting the running kernel
   while expecting mock reactions to fire. Ensure real RV monitors
   cannot run during KUnit tests to avoid state corruption.

 - Mock current in rv monitors

   Mock the call to current in rv monitors when the KUnit tests are
   built to allow them to run the test on dummy tasks. No overhead is
   expected when KUnit tests aren't running.

 - Introduce rvgen kunit subcommand

   Added a new 'kunit' subcommand to rvgen to automatically patch an
   already generated monitor with KUnit integration templates by parsing
   its event handlers and creating the required mock structures and
   initializations.

 - Refine kernel verification selftests

   Added new selftests for the deadline and stall monitors and
   rearranged the existing wwnr_printk test to resolve flakiness.
   Additionally, fixed an issue in the selftests framework where
   negative assertion failures were not correctly propagated due to
   shell rules.

 - Fix 32-bit build of nomiss KUnit test

   A previous commit introduced a division between an u64 and a constant
   value and that doesn't build on 32-bit systems. Use div_u64()
   instead.

 - Document changes in sleep monitor

   The sleep monitor introduced some changes in the past like allowing
   epoll_wait() as a valid sleep and a task going to runnable before
   scheduling as a valid wakeup. Document both.

* tag 'trace-rv-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (40 commits)
  Documentation/rv: Explain epoll and aborted sleeps
  rv: Fix 32-bit build of nomiss KUnit test
  selftests/verification: Add selftests for deadline and stall monitors
  selftests/verification: Rearrange the wwnr_printk test
  selftests/verification: Fix wrong errexit assumption
  rv: Add KUnit tests for some LTL monitors
  rv: Add KUnit mock for current
  rv: Add KUnit tests for some DA/HA monitors
  rv: Export task monitor slot and react symbols
  verification/rvgen: Add selftests for rvgen kunit
  verification/rvgen: Add the rvgen kunit subcommand
  verification/rvgen: Add selftests
  verification/rvgen: Add golden and spec folders for tests
  tools/rv: Add selftests
  verification/rvgen: Improve consistency in template files
  verification/rvgen: Use pathlib instead of os.path
  verification/rvgen: Improve rv_dir discovery in RVGenerator
  tools/rv: Fix exit status when monitor execution fails
  rv: Use generic rv_this for the rv_monitor variable in LTL
  rv/rtapp: Add wakeup monitor
  ...
2026-08-19 13:29:22 -07:00
Linus Torvalds
98f21c54f9 Merge tag 'for-linus-fwctl' of git://git.kernel.org/pub/scm/linux/kernel/git/fwctl/fwctl
Pull fwctl updates from Jason Gunthorpe:

 - Support more commands in bnxt, this completes what they originally
   wanted to do

 - Rust bindings for fwctl. The Nova GPU is expected to use them next
   cycle

* tag 'for-linus-fwctl' of git://git.kernel.org/pub/scm/linux/kernel/git/fwctl/fwctl:
  rust: introduce abstractions for fwctl
  fwctl/bnxt: Add DMA buffer support for HWRM commands
  bnxt_en: Update bnxt firmware spec
2026-08-19 12:51:36 -07:00
Linus Torvalds
85e0d1de36 Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd
Pull iommufd updates from Jason Gunthorpe:
 "One small feature this cycle, the noiommu mode is useful in
  single-purpose VMs running something like DPDK. It avoids the double
  translation overhead and it seems to be commonly used with some hacks.

  Summary:

   - Formal API for "no iommu" mode in VFIO. iommufd now works in this
     environment and provides page pinning and phyiscal address services
     to userspace. This avoids nasty fragile tricks with mprotect and
     pgmap

   - Fix sykzaller crash racing change_process with map_pages

   - Various skyzkaller/AI fixes for the selftests"

* tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd:
  iommufd: Fix UAF in selftest IOPF reporting
  iommu/iommufd: Fix NULL pointer deref in iommufd_ioas_change_process when racing with iopt_map_file_pages
  Documentation: Update VFIO NOIOMMU mode
  vfio: Enable cdev noiommu mode under iommufd
  iommufd: Add an ioctl to query PA from IOVA for noiommu mode
  iommufd: Allow binding to a noiommu device
  iommufd: Move igroup allocation to a function
  iommufd: Support a HWPT without an iommu driver for noiommu
  iommufd: Simplify iommufd_device_remove_vdev()
  iommufd: Fix grammar and spelling in comments
  iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add
  iommufd/selftest: Fix dmabuf leak in iommufd_test_dmabuf_get()
  iommufd/selftest: Avoid selftest dirty bitmap size wrap
2026-08-19 12:42:58 -07:00
Linus Torvalds
4994ef0fe0 Merge tag 'iommu-updates-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux
Pull iommu updates from Joerg Roedel:
 "ARM SMMUv2:
   - Device-tree binding updates for Qualcomm Eliza, Maili, Shikra and
     IPQ9650 SoCs
   - Add support for Qualcomm SM8450
   - Numerous fixes for lifetime and ordering issues found by Sashiko in
     the Qualcomm driver

  ARM SMMUv3:
   - Fix interrupt type in device-tree binding example for NVIDIA CMDQV
   - Numerous fixes for issues identified by Sashiko in the NVIDIA CMDQV
     driver
   - Work around TLB erratum T264-SMMU-3 on Tegra264 by repeating the
     invalidation sequence
   - Add support for HAFT (hardware access flag in table entries) when
     using SVA
   - Probe for 52-bit addressing with a page size smaller than 64k
     ('DS') but don't do anything with it for now
   - Minor driver improvements (remove sort_nonatomic(), use
     readl_relaxed_poll_timeout_atomic(), fix IOPF teardown ordering)

  Intel VT-d:
   - Consolidation of complex enablement logic into a clean,
     priority-based state machine
   - Support for the DMA_REMAP_OPT_OUT flag from the VT-d v5.2
     specification
   - An update to cache_tag_flush_devtlb_psi() to use full-range
     constants instead of modifying shared variables for
     CACHE_TAG_NESTING_DEVTLB
   - A fix for the UCTP context-table slot when copying root entries
   - Fixes for several pre-existing issues reported by Sashiko
   - General code cleanup and refinement

  AMD IOMMU:
   - Add SNP page-mode-0 support, enabling passthrough, v2 DMA page
     tables and host SVA on supporting systems
   - Fix invalid PPR handling, COMPLETE_PPR responses and guest-mode
     reporting
   - Improve Southbridge IOAPIC validation and remove the dependency on
     hard-coded device IDs
   - Fix PCI-device lifetime, debugfs and diagnostic issues

  IOMMU core and IOMMUFD:
   - Restore serialization of the shared MSI-page list
   - Fix SVA-handle publication and several IOMMUFD reference and error
     path leaks
   - Return the expected zero result for invalid generic page-table
     translations
   - Allocate per-CPU IOVA magazines lazily to reduce memory use on
     large systems

  PCI ATS:
   - Make VF support checks account for the associated PF and validate
     that VF and PF Smallest Translation Unit settings agree

  Platform drivers:
   - Fix Qualcomm runtime-PM, probe unwind, fault reporting and page
     table initialization races
   - Rework Rockchip state handling and fix clock, probe and stale-fault
     handling
   - Fix smaller issues in the MSM and MediaTek drivers

  Device-tree bindings:
   - Add new Qualcomm SMMU compatibles, convert the OMAP IOMMU binding
     to YAML, and fix the Tegra264 CMDQV interrupt example

  Various smaller cleanups, documentation fixes and a Rust IOMMU
  safety/readability improvement"

* tag 'iommu-updates-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: (93 commits)
  iommu/amd: Add SNP page mode 0 support
  iommu/amd: Fix GN bit setting in COMPLETE_PPR_REQUEST command
  iommu/amd: Rate limit INVALID_PPR_REQUEST error logging
  iommu/amd: Fix missing CMD_COMPLETE_PPR response for invalid PPR requests
  iommu/amd: Introduce PPR_TAG_LAST_PAGE() macro
  iommu/amd: Fix incorrect device ID in invalid PASID error message
  iommu/vt-d: Flush context cache with correct SID when tearing down aliases
  iommu/vt-d: Tear down scalable-mode context on probe failure
  iommu/vt-d: Fix iopf_refcount leak on RID domain replacement
  iommu/vt-d: Clear Present bit before tearing down copied context entry
  iommu/vt-d: Fix copied_tables bitmap leak on error in copy_translation_tables
  iommu/vt-d: Cache max domain ID to avoid redundant calculation
  iommu/vt-d: Support the new DMA_REMAP_OPT_OUT flag bit
  iommu/vt-d: Remove dmar_disabled
  iommu/vt-d: Remove the 'force_on' variable
  iommu/vt-d: Call dmar_can_force_on() for tboot opt-in
  iommu/vt-d: Use dmar_can_force_on() for platform opt-in
  iommu/vt-d: Consolidate dmar policy management and force_on logic
  iommu/vt-d: Remove dead code when CONFIG_INTEL_IOMMU is not set
  iommu/vt-d: Force requesting ACS when tboot is enabled
  ...
2026-08-19 12:38:26 -07:00
Linus Torvalds
7fa7d4c603 Merge tag 'for-7.3/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm
Pull device mapper updates from Mikulas Patocka:

 - minor cleanups found by Claude Opus 4.6

 - small cleanups in dm core, dm-cache, dm-switch, dm-inlinecrypt,
   dm-vdo

 - improve validation of metadata in dm-pcache

 - fix resume-vs-remove ioctl race condition

 - fix race condition when issuing table load ioctls concurrently

 - fix dm-raid1 and dm-io, so that they work with unaligned bio vectors

 - dm-integrity: use keyed markers as discard fillers

 - improve metadata validation in dm-array

 - fix dm-stats crash on memory allocation failure

 - fix dm-dust, so that it works if it is not the first target in a
   table

 - dm-era: fix superblock refcount leak on snapshot failure

* tag 'for-7.3/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: (46 commits)
  dm-era: fix shadowed superblock leak on take-snap failure
  dm dust: make badblock messages target-relative
  dm-stats: fix a crash if allocation of per-cpu data fails
  dm array: reject an array block whose value size is not the caller's
  dm array: validate array block headers on read
  dm-integrity: replace forgeable discard filler with a keyed sector marker
  dm vdo indexer: embed geometry in parent structures
  dm vdo indexer: simplify sub-index parameter calculations
  dm-pcache: remove unused 'cache' parameter from cache_key_gc()
  docs: device-mapper: dm-inlinecrypt: fix 'bellow' spelling
  dm-pcache: remove unused miss_read_end_work_fn declaration
  dm-io: report non-retryable errors separatedly
  dm-io: clone the source bio instead of copying its biovec
  dm: fix race when loading and unloading a table
  dm: fix resume-vs-remove race
  dm-pcache: remove unused 'allocated' variable in cache_data_alloc()
  dm-pcache: replace tabs with spaces in comments to fix ASCII diagram alignment
  dm-pcache: fix use-after-free and invalid seg operations in kset_replay()
  dm-pcache: fix implicit u8 truncation of gc_percent in message handler
  dm raid1: reserve space for NUL-terminator in build_constructor_string()
  ...
2026-08-19 12:35:15 -07:00
Linus Torvalds
faabe2db71 Merge tag 'ata-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux
Pull ata updates from Damien Le Moal:

 - Some code cleanups to rename the function used to identify ZAC
   devices and declare some local functions static (me)

 - Refactoring and improvement of the translation of the SCSI REPORT
   SUPPORTED OPCODES command to allow users access to the entire list of
   supported commands (me)

 - Fix the translation of the WRITE SAME command with UNMAP bit set (DSM
   TRIM) for devices with a sector size larger than 2K and devices that
   support multiple TRIM segments (Niklas)

 - Add support detecting support for and translating the SCSI commands
   related to the storage elements depopulation feature (GET PHYSICAL
   ELEMENT STATUS, REMOVE ELEMENT AND TRUCATE, REMOVE ELEMENT AND MODIFY
   ZONES and RESTORE ELEMENTS AND REBUILD) (me)

 - Improvements to the sata_mv driver probe code (clocks and IRQ
   initialization) (Rosen)

 - Improve resource initialization in the pata_rb532_cf, pata_pxa,
   sata_highbank and ahci_da850 drivers (Rosen)

 - Improve PIO data-in command completions to better hndle slow devices,
   e.g. CF cards (Richard)

 - Improve the DMA channel management using device resources in the
   pata_pxa driver (Rosen)

 - Fix the pata_ep93xx driver to correctly fallback to PIO mode if DMA
   initialization fails (Rosen)

 - Use named initializers to define the match tables of the ahci_xgene,
   ahci_qoriq and ahci_platform drivers (Pawel)

* tag 'ata-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux: (28 commits)
  ata: use named initializers for acpi_device_id
  ata: pata_ep93xx: fix PIO fallback when DMA init fails
  ata: pata_pxa: use devres for DMA channel management
  ata: libata-sff: don't busy-wait for PIO data-in command completion
  ata: ahci_da850: use devm_platform_ioremap_resource()
  ata: sata_highbank: use devm_platform_ioremap_resource
  ata: pata_pxa: use devm_platform_ioremap_resource
  ata: pata_rb532_cf: use devm_platform_ioremap_resource()
  ata: sata_mv: use devm clock helpers
  ata: sata_mv: Use platform_get_irq() to get interrupt
  ata: pata_mpc52xx: Remove redundant dev_err()
  ata: libata-eh: make ata_eh_qc_complete() and ata_eh_qc_retry() static
  ata: libata-scsi: add support for the REMOVE ELEMENT AND MODIFY ZONES command
  ata: libata-scsi: add support for the RESTORE ELEMENTS AND REBUILD command
  ata: libata-scsi: add support for the REMOVE ELEMENT AND TRUNCATE command
  ata: libata-scsi: add support for the GET PHYSICAL ELEMENT STATUS command
  ata: libata-core: detect support for depopulation capabilities
  ata: libata-scsi: improve ata_get_xlat_func
  ata: libata: improve the definition of device flags
  scsi: define depopulation capabilities related service actions
  ...
2026-08-19 12:31:50 -07:00
Linus Torvalds
59e6295fac Merge tag 'driver-core-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core
Pull driver core updates from Danilo Krummrich:
 "container_of:

   - Apply typeof_member(), remove the local __mptr variable to
     eliminate variable shadowing warnings on nested container_of()
     calls, and remove unnecessary parentheses

  core:

   - Add driver name to probe debug print for initcall_debug

   - Avoid repeatedly printing the same 'Fixed dependency cycle' log

   - Unwind device_add() on attribute creation failure in
     attribute_container_add_class_device()

   - Remove statistics group if encryption group creation fails in
     transport_add_class_device()

  debugfs:

   - Fix lockdown check for mmap_prepare()

   - Warn if file creation failed due to uninitialized debugfs

  device property:

   - Implement fw_devlink support for software nodes by adding
     software_node_add_links(), which creates fwnode links from
     DEV_PROP_REF properties to enable automatic probe ordering. Add
     kunit-managed fwnode helpers and test coverage

   - Fix infinite loop in fwnode_for_each_child_node() when the
     secondary fwnode has more than one child. Add test cases

   - Fix out-of-bounds access in software_node_get_reference_args() when
     called with index -1 (UINT_MAX)

   - Refactor to use RAII approach with __free()

   - Add Bartosz Golaszewski as software node reviewer

  firmware loader:

   - Fix race where a sysfs fallback request can complete before being
     queued as pending, leading to a use-after-free on the next fallback
     request

   - Reject 0-size built-in firmware and fail the build on empty
     firmware files in CONFIG_EXTRA_FIRMWARE

  kobject:

   - Provide __KOBJ_ATTR() and __KOBJ_ATTR_RO/WO() initialization macros
     and allow the constification of kobject attributes, enabling them
     to reside in read-only memory

  platform:

   - Provide platform_device_set_of_node(), platform_device_set_fwnode(),
     and platform_device_set_of_node_from_dev() helpers that encapsulate
     firmware node reference counting for dynamically allocated platform
     devices

     Convert all in-tree users that manually assigned dev.of_node or
     dev.fwnode, fixing a pre-existing refcount bug in powermac. Switch
     to counting references of all firmware node types, not only OF
     nodes

   - Unify the release path for dynamically allocated platform devices
     by removing platform_device_release_full(). Amend the fwnode setter
     API contract to warn if a primary software node is overwritten. Add
     KUnit tests for correct software node removal on device
     unregistration

  Rust:

   - Auxiliary:
       - Add registration_data_with() closure-based API for invariant
         ForLt types

   - Debugfs:
       - Migrate BinaryWriter and BinaryReaderMut trait requirements
         from kernel::transmute traits to zerocopy traits

   - Device:
       - Add BoundInternal device context and InternalBoundContext trait
         for bus abstractions that need internal access to a bound
         device.
       - Make the lifetime on Core and CoreInternal invariant to prevent
         coercion to shorter lifetimes

   - Devres:
       - Fix race between concurrent revokers where the losing revoker
         could return before the winning revoker finished dropping the
         inner data, causing use-after-free.
       - Ensure revocation is complete before the device finishes
         unbinding by making the synchronization bidirectional.
       - Add DevresLt<F: ForLt>, a wrapper around Devres that shortens
         'static back to the caller's borrow scope. Implement ForLt and
         CovariantForLt for Bar, IoMem, and ExclusiveIoMem

   - Driver:
       - Switch from index-based to pointer-based device ID info lookup,
         storing static references in driver_data. Centralize device ID
         handling in device_id.rs, removing the open-coded ACPI/OF
         matching logic and duplicate ID table from driver.rs

   - I/O:
       - Make I/O regions typed (with a dynamically-sized Region type
         for the existing untyped case), create view types representing
         subregions of a mapped I/O region, and add io_project!() for
         safely creating subviews.
       - Split Io into a base trait (IoBase) and an extension trait (Io)
         with a blanket implementation, preventing implementers from
         overriding provided methods that unsafe code relies on.
       - Add a SysMem backend for shared system memory with volatile
         access, and make Coherent implement Io via an I/O view type.
         Add IoSysMap as sum type of Mmio and SysMem. Add copying
         methods (memcpy_{from,to}io()) and read_val()/write_val() for
         typed access.
       - Replace dma_read!()/dma_write!() with io_read!()/io_write!()
         for primitives and copying methods for aggregates; drop the old
         macros. Convert nova-core to use I/O projection.
       - Fix internal shortcut rule dispatch in the register!() macro,
         remove unused rule arguments, and use path fragments for alias
         destinations

   - IRQ:
       - Make irq::Registration compatible with lifetime-bound drivers
         by removing the 'static bound on Handler/ThreadedHandler and
         replacing Devres<RegistrationInner> with direct
         request_irq()/free_irq() calls. Handlers can now directly own
         lifetime-bound device resources

   - PCI:
       - Convert IrqVectorRegistration to a lifetime-annotated owning
         type, giving drivers explicit control over the allocation
         lifetime. IrqVector embeds a resolved IrqRequest, making the
         conversion infallible. Remove the redundant
         request_irq()/request_threaded_irq() wrappers from pci::Device.
       - Add pci_irq_type() C helper and expose it via irq_type() on
         IrqVectorRegistration and IrqVector, returning PCI_IRQ_MSIX,
         PCI_IRQ_MSI, or PCI_IRQ_INTX.
       - Mark pci::Device refcount methods inline

   - Serdev:
       - Add Rust abstractions for the serial device bus, including
         serdev::Driver trait, serdev::Device wrapping struct
         serdev_device, and serdev::Adapter implementing
         RegistrationOps. Includes a sample driver. Markus Probst takes
         over as serdev maintainer for both C and Rust code

   - Misc:
       - Split ForLt into a base trait (providing the Of<'a> GAT) and an
         unsafe CovariantForLt subtrait guaranteeing covariance,
         enabling invariant types (e.g. those containing Mutex<&'bound T>)
         to participate in the ForLt abstraction.
       - Fix Coherent read past EOF returning -ERANGE instead of zero.
       - Fix firmware example UB by avoiding null-pointer ARef

  misc:
   - Avoid iattr allocation in kernfs listxattr by using
     kernfs_iattrs_noalloc().
   - Unregister SoC bus on early device registration failure.
   - Remove unused DMA_FENCE_TRACE Kconfig symbol.
   - Fix /sys/module path in comment.
   - Refactor ISA bus init to remove nested blocks.
   - Remove redundant nodemask clears in numa_init().
   - Add kernel-doc for fwnode_operations and sys_soc.h, mark
     internal property data as private for kernel-doc, and add
     property.h/fwnode.h to driver-api infrastructure docs.
   - Add MAINTAINERS entry for sys_soc.h"

* tag 'driver-core-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: (129 commits)
  rust: pci: expose the allocated interrupt type
  PCI: Add pci_irq_type() to query the allocated interrupt type
  rust: pci: remove request_irq() and request_threaded_irq() from Device
  rust: pci: resolve IRQ in index() and embed IrqRequest in IrqVector
  rust: pci: convert IrqVectorRegistration to a lifetime-managed owning type
  kernfs: avoid iattr allocation in listxattr
  rust: serdev: use ThisModule::as_ptr() instead of field access
  ACPI/IORT: use platform_device_set_fwnode()
  ACPI/APMT: use platform_device_set_fwnode()
  firmware_loader: do not queue completed sysfs fallback requests
  rust: pci: Mark Device refcount methods inline
  rust: irq: make Registration compatible with lifetime-bound drivers
  rust: net/phy: remove expansion from doc
  rust: dma: return zero for Coherent reads past EOF
  rust: io: register: use path fragment for alias destination
  rust: io: register: remove unused rule arguments
  rust: io: register: dispatch shortcut rules internally
  MAINTAINERS: add sys_soc.h to DRIVER CORE
  rust: debugfs: remove unsafe blocks from traits impl for Vec
  rust: debugfs: migrate debugfs traits requirements to zerocopy
  ...
2026-08-19 10:42:18 -07:00
Linus Torvalds
c6cf4441a3 Merge tag 'devicetree-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux
Pull devicetree updates from Rob Herring:

 - Add a DT maintainer profile document

 - Various dt-check-style improvements

 - Add a devres managed reserved memory region init function

 - Print node name on any skipped reserved memory regions

 - Correctly handle optional argument in
   of_parse_phandle_with_args_map()

 - Convert ti,keystone-reset, ti,da850-vpif, TI L4 interconnect, TI
   SmartReflex, microchip,pic32mzda-dmt, microchip,pic32mzda-wdt, TI
   DA8XX MSTPRI bus, and Xen VM bindings to DT schema format

 - Add bindings for StarFive JHB100 plic, Allwinner A733 NMI controller,
   MediaTek MT8173 GPU, QCom Shikra, Eliza, and Maili cpu-bwmon, and
   QCom Shikra SCM firmware

 - A couple of syntax fixes found using PoC Rust implementation of
   dtschema tools

 - Clean-ups for typos, brackets, incorrect "::" usages, and
   white-space style

* tag 'devicetree-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (40 commits)
  dt-bindings: interconnect: qcom-bwmon: Add Maili cpu-bwmon compatible
  dtc: dt-check-style: Simplify setting depth of DtsLine
  dtc: dt-check-style: Add missing /dts-v1/ to few test cases
  dt-bindings: power: reset: ti,keystone-reset: Convert to DT schema
  media: dt-bindings: ti,da850-vpif: Convert to dt-schema
  dt-bindings: devfreq: samsung,exynos-ppmu: Use standard regex syntax
  dt-bindings: interrupt-controller: mediatek,mt6577-sysirq: Drop invalid JSON pointer
  dt-bindings: arm: omap: Convert L4 interconnect to DT schema
  dt-bindings: power: Convert TI SmartReflex to DT schema
  of: reserved_mem: Introduce devres-managed initialization function
  dt-bindings: interrupt-controller: Add StarFive JHB100 plic
  dt-bindings: irq: sun7i-nmi: Document the Allwinner A733 NMI controller
  dt-bindings: Correct white-space style
  dt-bindings: fix typos and brackets
  docs: dt: submitting-patches: Mention expectation about dt-check-style
  docs: dt: maintainer: Add Devicetree and OF maintainer profile document
  docs: dt: writing-schema: Extend expectations about example part of binding
  dt-bindings: gpu: powervr-rogue: Add MediaTek MT8173 GPU
  of: base: Handle optional argument in of_parse_phandle_with_args_map()
  dt-bindings: update Sudeep Holla's email address
  ...
2026-08-19 10:32:34 -07:00
Linus Torvalds
f4cdf7ca9a Merge tag 'media/v7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media
Pull media updates from Mauro Carvalho Chehab:

 - v4l2-core: added ISP statistics support and per-block validation

 - v4l2-core: Allow unknown HDR10 white point and luminance

 - New camera sensors: Sony IMX678 and IMX471m, Himax HM1092 IR sensor

 - New codec: Milos: VPU v2.0 codec support

 - isp driver: gained support for Dreamchip RPPX1 ISP framework

 - vsp1 driver: gained support for RZ/T2H and RZ/N2H

 - Novalake driver: gained CVS support for new NVL hardware

 - dvb-core: fix feed leak on failed DMX_ADD_PID

 - several driver fixes, cleanups and minor improvements

* tag 'media/v7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (308 commits)
  media: ipu-bridge: check all DMI entries when overriding sensor rotation
  media: v4l2-async: avoid deleting unlinked ASC entry on link error
  media: rzg2l-cru: Align bytesperline to hardware DMA stride requirement
  media: intel/ipu6: fix async notifier cleanup leak on parse error
  media: staging/ipu7: fix async notifier UAF on probe error path
  media: amd: isp4: fix self-deadlock in isp4sd_pwron_and_init() error path
  media: amd: isp4: release partial allocations in isp4if_alloc_fw_gpumem()
  media: rcar-isp: Fix VSPX reference leaks
  media: rcar-isp: Release ISPCORE resources
  media: i2c: imx415: Release runtime PM reference on VBLANK error
  media: i2c: imx415: Return test pattern write errors
  media: renesas: vsp1: Declare index variables in for loop statement
  media: renesas: vsp1: Make reset control optional to support platforms without a reset line
  media: dt-bindings: media: renesas,vsp1: Document RZ/T2H and RZ/N2H SoCs
  media: dt-bindings: media: renesas,fcp: Document RZ/T2H and RZ/N2H SoCs
  media: nxp: imx8-isi: Add additional 32-bit RGB format support
  media: nxp: imx8-isi: Add 16-bit raw Bayer format support
  media: nxp: imx8-isi: Implement per-stream reference counting for multiplexed streams
  media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks
  media: nxp: imx8-isi: Correct color map between V4L2 and ISI
  ...
2026-08-19 10:09:22 -07:00
Linus Torvalds
e5c91aac49 Merge tag 'sound-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound updates from Takashi Iwai:
 "It was a fairly busy development cycle - the changes spread over from
  the core side to leaf drivers, with lots of cleanups and enhancements.
  Here we go, some highlights:

  ALSA core:
   - Extension of ALSA control component list ABI
   - Locking optimization and RCU conversion of ALSA sequencer core
   - A few hardening fixes for UMP and sequencer core
   - Drop __bitwise and __force prefix from UAPI definitions

  ASoC:
   - Automatic DAI format selection code deployment across many drivers
   - Sorting of register default tables to prevent ordering issues in
     many drivers
   - Lots of code cleanups and refactoring
   - Updates in Qualcomm driver stack
   - New platforms: AMD ACP7.B/F, Cirrus Logic CS35L62, Loongson
     2K0300, Meson GX, Qualcomm LPI MI2S, SM8475, WSA855X, Realtek
     RT1321 VA1/2 and RT766/7

  HD-audio:
   - Support for AW88399 HD-audio side codec for Lenovo Legion laptops
   - Support for Hygon and Lisuan HDMI controllers
   - Robustness fixes for wild device binding
   - Lots of quirks/fixups: Realtek and Conexant codecs for ASUS,
     Lenovo, Acer, etc

  USB-audio:
   - Support for Pioneer DJ DJM-S11
   - Scarlett2/FCP private URB notification fixes
   - Extended quirk_flags to 64bit
   - Hardening fixes for 6fire, bcd2000, usx2y
   - Device-specific quirks for Mackie, Valeton, SPACETOUCH

  General:
   - Auto-cleanup for put_device() and firmware loading across multiple
     platforms"

* tag 'sound-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (791 commits)
  ALSA: hda: Fix connection list comparison in proc output
  ALSA: docs: fix dead link to Intel HD-audio spec
  ALSA: usb-audio: Add delay quirk for SPACETOUCH USB Audio
  ALSA: hda: Add Lisuan HDMI controller and codec support
  ALSA: hda/realtek: Fix Lenovo Yoga Slim 7 14AKP10 quirk ordering
  ALSA: hda/tas2781: Add hardware stabilization delay during firmware load retries
  ALSA: hda/realtek: Fix mute LED for HP Victus 15-fa1xxx (MB 8C3F)
  ALSA: hda/realtek: Add micmute LED quirk for Acer Aspire A515-57
  ASoC: tas2783-sdw: do not treat read-only Controls as writable
  ASoC: SOF: validate topology volume range before allocation
  ASoC: cs35l56: Use IRQ provided by the SoundWire core
  soundwire: bus_type: Create IRQ mapping before calling driver probe()
  ASoC: cs35l56: Move cs35l56_irq_request() after cs35l56_irq()
  ASoC: cs35l56: Request IRQ in cs35l56_common_probe()
  ALSA: core: Fix use-after-free in snd_card_do_free()
  ALSA: hda/realtek: Drop duplicate quirk for Lenovo 0x17aa:0x38df
  ALSA: usb-audio: Rename the Audient iD14 monitor mix volume control
  ASoC: tas2781: Refactor calibration start kcontrol creation to separate helper
  ASoC: dt-bindings: es8316: Fix supply property constraints
  ALSA: seq: midi: Serialize input teardown with event_input
  ...
2026-08-19 10:04:59 -07:00