kernel/git/next/linux-next.git/drivers/vhost, branch master

Merge branch 'linux-next' of https://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost.git

2026-08-28T13:13:02+00:00

Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost

2026-08-21T00:07:50+00:00

Pull vhost,vdpa,virtio updates from Michael Tsirkin: - transport v3 support in virtio-mmio - suspend support in vduse - fixes, cleanups all over the place * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: (54 commits) vduse: Add suspend vduse: do not take rwsem at reset work flush vduse: add F_QUEUE_READY feature vduse: add VDUSE_SET_FEATURES ioctl vduse: add VDUSE_GET_FEATURES ioctl vduse: store control device pointer tools/virtio: Fix control typo in trace agent comment tools/virtio: Fix userspace typo in vringh test comment vhost: reject zero-size IOTLB INVALIDATE vdpa: Remove redundant dev_err() virtio_ring: fix infinite loop in virtnet_poll_cleantx when device is broken vdpa/mlx5: roll back MR update after VQ setup failure MAINTAINERS: remove Gabriel from LiteX and fw-cfg drivers virtio_mem: fix typo in comment vdpa/solidrun: fix typos in snet_ctrl comments virtio: fix article before virtio in dma-buf comment vhost: fix inaccurate kdoc in iotlb helpers virtio: rtc: time out alarm requests vdpa/mlx5: fix wrong MLX5_ADDR_OF struct type in alloc_inout() vdpa: octeon_ep: add missing MODULE_DEVICE_TABLE() ...

vhost: reject zero-size IOTLB INVALIDATE

2026-08-19T10:38:47+00:00

Reject VHOST_IOTLB_INVALIDATE messages with size == 0 to prevent iova + size - 1 from underflowing to U64_MAX, which would incorrectly delete the entire IOTLB. Signed-off-by: xiongweimin Signed-off-by: Michael S. Tsirkin Message-ID: <20260716030236.124322-1-xiongwm2026@163.com>

vhost: fix inaccurate kdoc in iotlb helpers

2026-08-19T10:38:47+00:00

Correct missing "if" in the add_range_ctx return description, and align vhost_iotlb_alloc documentation with its NULL return on allocation failure. Signed-off-by: xiongweimin Signed-off-by: Michael S. Tsirkin Message-ID: <20260714024434.188302-1-15927021679@163.com>

vhost/net: fix clear_user start address in VHOST_GET_FEATURES_ARRAY

2026-08-19T10:38:45+00:00

The clear_user() call in VHOST_GET_FEATURES_ARRAY incorrectly starts at argp, which is the beginning of the features array, overwriting the data just written by copy_to_user(). It should start after the copied elements at argp + copied * sizeof(u64) to only zero the trailing unused space. Use size_mul() for both the offset and length calculations so the arithmetic stays consistent with the surrounding code and remains overflow-safe. Fixes: 333c515d1896 ("vhost-net: allow configuring extended features") Signed-off-by: Yufeng Wang Acked-by: Eugenio Pérez Signed-off-by: Michael S. Tsirkin Message-ID: <20260626070438.59149-1-r4o5m6e8o@163.com>

vhost-net: wake queue of tun/tap after ptr_ring consume

2026-08-08T00:29:15+00:00

Add tun_wake_queue() to tun.c and export it for use by vhost-net. The function validates that the file belongs to a device implemented by drivers/net/tun.c, in IFF_TUN as well as in IFF_TAP mode, and that the tfile exists, dereferences the tun_struct under RCU, and delegates to __tun_wake_queue(). vhost_net_buf_produce() now calls tun_wake_queue() after a successful batched consume of the ring to allow the netdev subqueue to be woken up. The point is to allow the queue to be stopped when it gets full, which is required for traffic shaping, implemented by the following "stop tail-drop when IFF_BACKPRESSURE is set". As __tun_wake_queue() returns early unless IFF_BACKPRESSURE is set, a tun/tap device that does not opt in only pays for the added check. macvtap and ipvtap rings, which get_tap_ptr_ring() accepts too, are unaffected: their producer is the tap_handle_frame() rx_handler and not ndo_start_xmit, so stopping a netdev TX queue would not hold it back. drivers/net/tap.c has no netdev_ops of its own either. No tap_wake_queue() is needed. cons_cnt and the wake decision are best-effort and are not reverted by ptr_ring_unconsume(), so vhost_net_buf_unproduce() can leave the subqueue woken over a full ring. The producer re-stops it on the next packet, and that path only runs from vhost_net_stop_vq() and vhost_net_set_backend(), when the consumer is going away, so a stopped queue is the correct end state rather than a stall. Co-developed-by: Tim Gebauer Signed-off-by: Tim Gebauer Signed-off-by: Simon Schippers Link: https://patch.msgid.link/20260803183641.96882-4-simon.schippers@tu-dortmund.de Signed-off-by: Jakub Kicinski

vhost: reject zero-size IOTLB INVALIDATE

2026-08-04T03:08:19+00:00

vhost: fix inaccurate kdoc in iotlb helpers

2026-08-04T03:08:19+00:00

vhost/net: fix clear_user start address in VHOST_GET_FEATURES_ARRAY

2026-08-04T03:08:17+00:00

vhost/vsock: add VHOST_RESET_OWNER ioctl

2026-08-04T03:08:16+00:00

This ioctl is needed for QEMU's CPR (checkpoint-restore) migration of the guest with vhost-vsock device. For this to work, we need to reset the device ownership on the source side by calling RESET_OWNER, and then claim it on the dest side by calling SET_OWNER. We expect not to lose any AF_VSOCK connection while this happens. To that end, unlike the release path, RESET_OWNER keeps the guest CID hashed: established connections survive, and host sends issued while the device is between owners simply stay on send_pkt_queue until the next device start drains them. Since the device stays reachable through the CID hash, the lockless send/cancel paths can race with the worker teardown in vhost_workers_free(). The previous commit ("vhost: synchronize with RCU readers when freeing workers") makes that safe. Signed-off-by: Pavel Tikhomirov Signed-off-by: Andrey Drobyshev Reviewed-by: Stefano Garzarella Message-ID: <20260720102241.371610-6-andrey.drobyshev@virtuozzo.com> Signed-off-by: Michael S. Tsirkin