summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-06-08x86/xen: Replace generic lazy tracking with cpu specific oneJuergen Gross
Now that lazy mmu state tracking no longer relies on the Xen specific one, cpu lazy mode is the only user of the Xen generic lazy tracking. Replace the Xen generic lazy tracking with a cpu lazy specific one. Signed-off-by: Juergen Gross <jgross@suse.com> Message-ID: <20260526150514.129330-6-jgross@suse.com>
2026-06-08x86/xen: Get rid of last XEN_LAZY_MMU usesJuergen Gross
There are only very few use cases of XEN_LAZY_MMU left. Get rid of them in order to avoid having to call enter_lazy(XEN_LAZY_MMU) and leave_lazy(XEN_LAZY_MMU). The query in xen_batched_set_pte() can be replaced by using is_lazy_mmu_mode_active() instead. As xen_flush_lazy_mmu() will be called only with lazy MMU mode being active, the test for the lazy mode can just be dropped. In xen_start_context_switch() and xen_end_context_switch() use __task_lazy_mmu_mode_pause() and __task_lazy_mmu_mode_resume(), allowing to drop xen_enter_lazy_mmu() and xen_leave_lazy_mmu() completely. Call arch_flush_lazy_mmu_mode() from arch_leave_lazy_mmu_mode(), as this is the only required action now. Drop the lazy mmu enter and leave paravirt hooks, leaving the flush hook as the only needed one. Signed-off-by: Juergen Gross <jgross@suse.com> Message-ID: <20260526150514.129330-5-jgross@suse.com>
2026-06-08mm: Refactor lazy_mmu_mode_pause() and lazy_mmu_mode_resume()Juergen Gross
In order to allow pausing and resuming MMU lazy mode for other tasks than current, refactor lazy_mmu_mode_pause() and lazy_mmu_mode_resume(). This will be needed when dropping the Xen PV private lazy MMU bookkeeping. Acked-by: "David Hildenbrand (Arm)" <david@kernel.org> Signed-off-by: Juergen Gross <jgross@suse.com> Message-ID: <20260526150514.129330-4-jgross@suse.com>
2026-06-08x86/xen: Change interface of xen_mc_issue()Juergen Gross
Today xen_mc_issue() is deciding whether to call xen_mc_flush() or not based on the lazy mode input parameter passed. Modify this interface to pass a boolean indicating whether the flush should be done. For querying lazy mmu mode use the is_lazy_mmu_mode_active() helper. This is done in preparation for dropping the xen_lazy_mode percpu variable. Signed-off-by: Juergen Gross <jgross@suse.com> Message-ID: <20260526150514.129330-3-jgross@suse.com>
2026-06-08x86/xen: Drop lazy mode from trace entriesJuergen Gross
Drop the lazy mode (cpu or mmu) from the xen_mc_batch and xen_mc_issue trace entries. This is done in preparation of removing the xen_lazy_mode percpu variable. Signed-off-by: Juergen Gross <jgross@suse.com> Message-ID: <20260526150514.129330-2-jgross@suse.com>
2026-06-08x86/xen: Remove Xen debugfs supportJuergen Gross
The only Xen file in debugfs is for dumping the p2m table when running as a Xen PV guest. This might have been useful when the PV code was young, but there haven't been any p2m related bugs requiring the p2m dump since ages. Remove the code and the related config option. Signed-off-by: Juergen Gross <jgross@suse.com> Message-ID: <20260522152114.77319-4-jgross@suse.com>
2026-06-08x86/xen: Cleanup Xen related trace pointsJuergen Gross
Since dropping Xen-PV support for 32-bit, include/trace/events/xen.h contains several stale trace point definitions. Remove them. Signed-off-by: Juergen Gross <jgross@suse.com> Message-ID: <20260522152114.77319-3-jgross@suse.com>
2026-06-08x86/xen: Guard PV-only stuff in xen-ops.h with CONFIG_XEN_PVJuergen Gross
A lot of arch/x86/xen/xen-ops.h is meant to be for PV only. Guard all of it with CONFIG_XEN_PV in order to avoid someone misusing it in non-PV builds. Additionally any 64-bit tests for now guarded items can be dropped. Move the enum pt_level definition to mmu_pv.c, as it is used only there. Signed-off-by: Juergen Gross <jgross@suse.com> Message-ID: <20260522152114.77319-2-jgross@suse.com>
2026-06-08xen: balloon: Replace sprintf() with sysfs_emit()Yash Suthar
Replace sprintf() calls with sysfs_emit() to follow current kernel coding standards. sysfs_emit() is the preferred method for formatting sysfs output as it provides better bounds checking and is more secure. Signed-off-by: Yash Suthar <yashsuthar983@gmail.com> Reviewed-by: Juergen Gross <jgross@suse.com> Signed-off-by: Juergen Gross <jgross@suse.com> Message-ID: <20260517133817.29691-1-yashsuthar983@gmail.com>
2026-06-08xen/mcelog: mark g_physinfo, ncpus and xen_mce_chrdev_device as __ro_after_initLen Bao
The 'g_physinfo' and 'ncpus' variables are initialized only during the init phase in the 'bind_virq_for_mce' function and never changed. So, mark them as __ro_after_init. The 'xen_mce_chrdev_device' variable is initialized only in the declaration and never changed. So, this variable could be 'const', but using the 'misc_register' and 'misc_deregister' functions discards the 'const' qualifier. Therefore, as an alternative, mark it as __ro_after_init. Signed-off-by: Len Bao <len.bao@gmx.us> Reviewed-by: Juergen Gross <jgross@suse.com> Signed-off-by: Juergen Gross <jgross@suse.com> Message-ID: <20260523132802.25391-1-len.bao@gmx.us>
2026-06-08xen: constify xsd_errors arrayLen Bao
The 'xsd_errors' array is initialized in the declaration and never changed. So, constify it to reduce the attack surface. At the same time, use the preferred '__maybe_unused' form over the '__attribute__((unused))' form. Signed-off-by: Len Bao <len.bao@gmx.us> Reviewed-by: Juergen Gross <jgross@suse.com> Signed-off-by: Juergen Gross <jgross@suse.com> Message-ID: <20260523140809.30915-1-len.bao@gmx.us>
2026-06-08wifi: mac80211: bound S1G TIM PVB walk to the TIM elementBryam Vargas
ieee80211_s1g_check_tim() parses the S1G Partial Virtual Bitmap (PVB) of a received TIM element. The TIM is handed in as the element payload: ieee802_11_parse_elems_full() stores elems->tim = elem->data and elems->tim_len = elem->datalen (net/mac80211/parse.c), so the valid bytes are [tim, tim + tim_len). When walking the encoded blocks the function passes the walker an end sentinel of (const u8 *)tim + tim_len + 2, i.e. two bytes past the end of the element. ieee80211_s1g_find_target_block() loops while (ptr + 1 <= end) and dereferences ptr (and the per-mode ieee80211_s1g_len_*() helpers read *ptr), so it can read up to two bytes beyond the TIM element -- an out-of-bounds read of adjacent skb/heap data when the TIM is the last element in the frame. The +2 appears to account for the element id/len header, but tim already points past that header at the element payload, so the addend is wrong. Pass the correct element end, (const u8 *)tim + tim_len. Fixes: e0c47c6229c2 ("wifi: mac80211: support parsing S1G TIM PVB") Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me> Link: https://patch.msgid.link/20260606074341.49135-1-hexlabsecurity@proton.me Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-06-08xen/platform-pci: Simplify initialization of pci_device_id arrayUwe Kleine-König (The Capable Hub)
Instead of using a list initializer---that is hard to read unless you know the structure of struct pci_device_id by heart---use the PCI_VDEVICE macro to assign the needed values and drop all explicit but unneeded zeros. This doesn't introduce any changes to the compiled result of the array. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Reviewed-by: Juergen Gross <jgross@suse.com> Signed-off-by: Juergen Gross <jgross@suse.com> Message-ID: <20260505102909.2380470-2-u.kleine-koenig@baylibre.com>
2026-06-07mshv: add bounds check on vp_index in mshv_intercept_isr()Junrui Luo
mshv_intercept_isr() extracts vp_index from the hypervisor message payload and uses it directly to index into pt_vp_array without validation. handle_bitset_message() and handle_pair_message() already validate vp_index against MSHV_MAX_VPS before array access. Add the same MSHV_MAX_VPS bounds check for consistency with the other message handlers. Fixes: 621191d709b1 ("Drivers: hv: Introduce mshv_root module to expose /dev/mshv to VMMs") Reported-by: Yuhao Jiang <danisjiang@gmail.com> Signed-off-by: Junrui Luo <moonafterrain@outlook.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-06-07hv_balloon: Simplify data output in hv_balloon_debug_show()Markus Elfring
Move the specification for a line break from a seq_puts() call to a seq_printf() call. The source code was transformed by using the Coccinelle software. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Reviewed-by: Sahil Chandna <sahilchandna@linux.microsoft.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-06-07x86/hyperv: Cosmetic changes in irqdomain.c for readabilityMukesh R
Make cosmetic changes: o Rename struct pci_dev *dev to *pdev since there are cases of struct device *dev in the file and all over the kernel o Rename hv_build_pci_dev_id to hv_build_devid_type_pci in anticipation of building different types of device ids o Fix checkpatch.pl issues with return and extraneous printk o Replace spaces with tabs o Rename struct hv_devid *xxx to struct hv_devid *hv_devid given code paths involve many types of device ids o Fix indentation in a large if block by using goto. There are no functional changes. Reviewed-by: Souradeep Chakrabarti <schakrabarti@linux.microsoft.com> Reviewed-by: Anirudh Rayabharam (Microsoft) <anirudh@anirudhrb.com> Signed-off-by: Mukesh R <mrathor@linux.microsoft.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-06-07iommu/hyperv: Create hyperv subdirectory under drivers/iommuMukesh R
Create hyperv subdirectory under drivers/iommu in anticipation of more Hyper-V related files from upcoming PCI passthrough and PV-IOMMU patches. Also, the current file hyperv-iommu.c actually implements irq remapping on x86, so rename to more appropriate hv-irq-remap-x86.c and move it under the new hyperv subdirectory. Since this file implements irq_remap_ops exposed by drivers/iommu/irq_remapping.h, it cannot be relocated to the irq directory. This is in sync with other backend directories like amd and intel there. Lastly, this file should not be tied to CONFIG_HYPERV_IOMMU, but to CONFIG_HYPERV and CONFIG_IRQ_REMAP. Signed-off-by: Mukesh R <mrathor@linux.microsoft.com> Reviewed-by: Jacob Pan <jacob.pan@linux.microsoft.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-06-08Merge tag 'amd-drm-fixes-7.1-2026-06-04' of ↵Dave Airlie
https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-7.1-2026-06-04: amdgpu: - UserQ fix - Userptr fix - MCCS freesync fix amdkfd: - Fix an event information leak - Events bounds check fix - Trap cleanup fix Signed-off-by: Dave Airlie <airlied@redhat.com> From: Alex Deucher <alexander.deucher@amd.com> Link: https://patch.msgid.link/20260604230955.19629-1-alexander.deucher@amd.com
2026-06-08cpufreq: ti: Add EPROBE_DEFER for K3 SoCsAkashdeep Kaur
On K3 SoCs, ti-cpufreq relies on k3-socinfo to register the SoC device before soc_device_match() can return valid revision information. If ti-cpufreq probes before k3-socinfo, soc_device_match() returns NULL, leading to incorrect CPU frequency scaling behavior. Add a needs_k3_socinfo flag to ti_cpufreq_soc_data (similar to the existing multi_regulator pattern) to defer probe when k3-socinfo hasn't registered the SoC device yet. Signed-off-by: Akashdeep Kaur <a-kaur@ti.com> Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com> Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
2026-06-08cpufreq: qcom: Add cpufreq scaling support for Qualcomm Shikra SoCTaniya Das
The Qualcomm Shikra cpufreq hardware is functionally identical to EPSS, but supports only up to 12 frequency lookup table (LUT) entries. When all 12 entries are populated, the existing repetitive LUT entry check may read beyond valid entries and expose incorrect frequencies. Hence, introduce shikra_epss_soc_data that reuses EPSS configuration with appropriate LUT entries limit. Signed-off-by: Taniya Das <taniya.das@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Imran Shaik <imran.shaik@oss.qualcomm.com> Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
2026-06-08dt-bindings: cpufreq: Document Qualcomm Shikra SoC EPSSImran Shaik
The Qualcomm Shikra cpufreq hardware is functionally identical to EPSS, but supports only up to 12 frequency lookup table (LUT) entries. Introduce Shikra specific bindings to represent this constrained EPSS variant. Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Imran Shaik <imran.shaik@oss.qualcomm.com> Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
2026-06-08m68k: coldfire: use ColdFire specifc IO access in SoC codeGreg Ungerer
Convert all ColdFire specific SoC/board setup code to only use the newly created internal register access methods. This is replacing the mixed and inconsistent use of readx/writex and __raw_readx/__raw_writex for internal SoC registers. Reviewed-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
2026-06-08m68k: coldfire: use ColdFire specifc IO access in system codeGreg Ungerer
Convert all ColdFire specific system setup code to only use the newly created internal register access methods. This is replacing the mixed and inconsistent use of readx/writex and __raw_readx/__raw_writex for internal SoC registers. Reviewed-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
2026-06-08m68k: coldfire: rename timer register access definesGreg Ungerer
With the basic ColdFire IO register functions now consistently named with a "mcf_read"/"mcf_write" prefix it makes sense to name the timers internal access defines the same way. Convert the local __raw_readtrr and __raw_writetrr defines to use the consistent prefixes too. Thus the change is: __raw_readtrr --> mcf_readtrr __raw_writetrr --> mcf_writetrr Reviewed-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
2026-06-08m68k: coldfire: use ColdFire specifc IO access in timer codeGreg Ungerer
Convert all ColdFire specific timer setup code to only use the newly created internal register access methods. This is replacing the mixed and inconsistent use of readx/writex and __raw_readx/__raw_writex for internal SoC registers. Reviewed-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
2026-06-08m68k: coldfire: use ColdFire specifc IO access in interrupt codeGreg Ungerer
Convert all ColdFire specific interrupt setup code to only use the newly created internal register access methods. This is replacing the mixed and inconsistent use of readx/writex and __raw_readx/__raw_writex for internal SoC registers. Reviewed-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
2026-06-08m68k: coldfire: use ColdFire specific IO access in headersGreg Ungerer
Convert all m68k/ColdFire specific header file code to only use the newly created internal register access methods. This is replacing the mixed and inconsistent use of readx/writex and __raw_readx/__raw_writex for internal SoC registers. Reviewed-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
2026-06-08m68k: coldfire: create IO access functions for internal registersGreg Ungerer
The internal peripheral registers contained in all varieties of ColdFire SoCs require simple big endian access ranging in sizes from 8, 16 and 32 bit. Currently there is a mixture of IO access methods used across the various CPU support code, some using readx/writex and some using the simpler __raw_readx/__raw_writew. The readx/writex use cases are particularly kludgy in that they contain code to differentiate internal register access and other general attached peripheral register access - say on a PCI bus. In effect this means that the readx/writex family for ColdFire is non-standard. This ultimately ends up causing problems with definitions of other IO access support functions like ioreadx/ioreadxbe/iowritex/iowritexbe which in the generic case are defined in terms of readx/writex. Create a set of internal only register access methods to ultimately replace all internal register access code. The new access functions mirror the existing readx/writex family but using the preferred 8/16/32 suffixes. Reviewed-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
2026-06-08m68k: defconfig: update all ColdFire defconfigsGreg Ungerer
Refresh all ColdFire base defconfig files, making sure that modules is turned on for all targets. Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
2026-06-08m68k: defconfig: add config for SnapGear/NETtel boardGreg Ungerer
Add a default configuration for a basic M5307 based NETtel board. This is primarily to improve defconfig build coverage. This platforms uses the SMSC ethernet drivers for network ports, and has a few other minor quirks that make it different from other ColdFire platforms. Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
2026-06-08m68k: defconfig: add config for M54418EVB boardGreg Ungerer
Add a default configuration for a basic M54418 based EVB board. The SoC has been supported for a long time but there is no default configuration. Create one to improve build and test coverage. Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
2026-06-08m68k: defconfig: add config for M5329EVB boardGreg Ungerer
Add a default configuration file for the Freescale M5329EVB board. Although the SoC type has been supported for a long time there has been no defconfig for the base platform. Create one to give better build and test coverage. Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
2026-06-08m68k: coldfire: select legacy gpiolib interface for mcfqspiArnd Bergmann
The common coldfire code uses the old GPIO number based interfaces for at least the QSPI chipselect lines. Select the required Kconfig symbol to keep it building when that becomes optional. Apparently there are no devices attached to a QSPI controller in any of the coldfire boards, so this is not actually used in upstream kernels. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
2026-06-08m68k: update boards company nameAngelo Dureghello
Sysam name has changed to Kernelspace, updating each reference. Signed-off-by: Angelo Dureghello <angelo@kernel-space.org> Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
2026-06-08config: stmark2: defconfig updatesAngelo Dureghello
Various updates, mainly to reduce kernel size. Signed-off-by: Angelo Dureghello <angelo@kernel-space.org> Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
2026-06-07kunit:tool: Don't write to stdout when it should be disabledDavid Gow
The kunit_parser module accepts a 'printer' object which is used as a destination for all output. This is typically set to stdout, so that the parsed results are visible, but can be set to a special 'null_printer' to implement options where not all results are always printed. However, there are a few places where use of stdout is hardcoded, notably in handling crashed tests and in outputting the colour escape sequences. Properly use the specified printer for all output. This is okay for the colour handling (as this is already gated behind isatty() anyway), and also for the crash handling, as cases where printer != stdout are separately printed afterwards. Link: https://lore.kernel.org/r/20260606020317.264178-1-david@davidgow.net Fixes: 062a9dd9bad7 ("kunit: tool: Only print the summary") Signed-off-by: David Gow <david@davidgow.net> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
2026-06-07kunit: tool: Add (primitive) support for outputting JUnit XMLDavid Gow
This is used by things like Jenkins and other CI systems, which can pretty-print the test output and potentially provide test-level comparisons between runs. The implementation here is pretty basic: it only provides the raw results, split into tests and test suites, and doesn't provide any overall metadata. However, CI systems like Jenkins can ingest it and it is already useful. Link: https://lore.kernel.org/r/20260606013827.240790-2-david@davidgow.net Reviewed-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Signed-off-by: David Gow <david@davidgow.net> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
2026-06-07kunit: tool: Parse and print the reason tests are skippedDavid Gow
When a KUnit test (or other KTAP test) is skipped, a "skip reason" can be provided. kunit.py has never done anything with this, ignoring anything included in the KTAP output after the 'SKIP' directive. Since we have it, and it's used, print it in a nice friendly yellow in parentheses after a skipped test's name. (And, by parsing it, it can be included in the JUnit results as well.) Link: https://lore.kernel.org/r/20260606013827.240790-1-david@davidgow.net Signed-off-by: David Gow <david@davidgow.net> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
2026-06-07Merge branch 'bpf-fix-lru-nmi-tracepoint-re-entry-deadlock'Alexei Starovoitov
Mykyta Yatsenko says: ==================== bpf: Fix LRU NMI/tracepoint re-entry deadlock This series fixes AA-deadlocks where NMI and tracepoint BPF programs re-enter the per-CPU or global LRU lock already held on the same CPU (syzbot c69a0a2c816716f1e0d5, 18b26edb69b2e19f3b33). Patch 1 converts every LRU lock site to rqspinlock_t and adds explicit recovery for some failures so no node leaks. Patch 2 refreshes Documentation/bpf/map_lru_hash_update.dot to show the new rqspinlock failure exits and recovery routes. Patch 3 introduces a stress test. Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com> --- Changes in v3: - Removed RFC tag - Link to v2: https://patch.msgid.link/20260603-lru_map_spin-v2-0-7060cfb6cdac@meta.com Changes in v2: - Patch 1: __bpf_lru_node_move_in() now clears pending_free only when moving to the FREE list. - Patch 3: address sashiko's feedback. - Link to v1: https://patch.msgid.link/20260528-lru_map_spin-v1-0-4f52223170cf@meta.com ==================== Link: https://patch.msgid.link/20260607-lru_map_spin-v3-0-bcd9332e911b@meta.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-07selftests/bpf: Stress LRU rqspinlock recovery pathsMykyta Yatsenko
Introduces stress test for bpf_lru_list that exercises lock-failures and orphan-recovery, added by the LRU rqspinlock conversion. Runs three subtests: common LRU, per-CPU LRU lists (BPF_F_NO_COMMON_LRU), and per-CPU LRU map. Each pins one userspace hammer per CPU and attaches the perf_event NMI BPF prog (update+delete mix) on every online CPU. Pre-fix, lockdep fires the "INITIAL USE -> IN-NMI" splat during stress. After stress test, drain_then_verify_capacity() drains every key and refills the lru map. A stranded node on any CPU's pool would have forced eviction of a just-inserted key on that CPU, surfacing here as a missing lookup. Marked serial_ because per-CPU pinning and high-rate HW perf events would perturb parallel tests. Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com> Link: https://lore.kernel.org/r/20260607-lru_map_spin-v3-3-bcd9332e911b@meta.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-07Documentation/bpf: Refresh map_lru_hash_update.dot for rqspinlockMykyta Yatsenko
Reflect the rqspinlock conversion and orphan-recovery paths added in the previous commit: - All LRU locks are rqspinlock_t; any acquire can fail (AA or timeout). A shared "rqspinlock acquire failed" terminal collapses to the existing -ENOMEM exit. Dashed arrows from each acquire site mark the failure paths. - The per-CPU local freelist is now lockless (free_llist). - Post-steal: re-acquiring loc_l->lock to insert the stolen node into the local pending list can fail; on failure the node is published to free_llist instead of being orphaned, and the call returns -ENOMEM. - Steal-loop victim lock failure is silent: skip the victim and try the next CPU. Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com> Link: https://lore.kernel.org/r/20260607-lru_map_spin-v3-2-bcd9332e911b@meta.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-07bpf: Fix NMI/tracepoint re-entry deadlock on lru locksMykyta Yatsenko
NMI and tracepoint BPF programs can re-enter the per-CPU or global LRU lock that bpf_lru_pop_free()/push_free() already hold on the same CPU, AA-deadlocking. Lockdep reports "inconsistent {INITIAL USE} -> {IN-NMI}" on &l->lock (syzbot c69a0a2c816716f1e0d5) and "possible recursive locking detected" on &loc_l->lock (syzbot 18b26edb69b2e19f3b33). Prior trylock and rqspinlock based fixes (see links) were nacked because compromised on reliability. This patch converts every LRU lock site to rqspinlock_t and adds a recovery path for some failure windows to avoid node leaks. Failure recovery: - *_pop_free top-level: return NULL; prealloc_lru_pop() already treats that as no-free-element (-ENOMEM). - Cross-CPU steal: skip the victim's locked loc_l, try next CPU. - Post-steal local lock fail: publish stolen node to lockless per-CPU free_llist; next pop on this CPU picks it up. - push_free fail: mark node pending_free=1. __local_list_flush(), __local_list_pop_pending() reclaim the node from pending_list. __bpf_lru_list_shrink_inactive() reclaims the node from inactive list. Nodes from active list are reclaimed by __bpf_lru_list_shrink() or after __bpf_lru_list_rotate_active() demotes it to the inactive. Fixes: 3a08c2fd7634 ("bpf: LRU List") Reported-by: syzbot+c69a0a2c816716f1e0d5@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=c69a0a2c816716f1e0d5 Reported-by: syzbot+18b26edb69b2e19f3b33@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=18b26edb69b2e19f3b33 Link: https://lore.kernel.org/bpf/CAPPBnEYO4R+m+SpVc2gNj_x31R6fo1uJvj2bK2YS1P09GWT6kQ@mail.gmail.com/ Link: https://lore.kernel.org/bpf/CAPPBnEZmFA3ab8Uc=PEm0bdojZy=7T_F5_+eyZSHyZR3MBG4Vw@mail.gmail.com/ Link: https://lore.kernel.org/bpf/20251030030010.95352-1-dongml2@chinatelecom.cn/ Link: https://lore.kernel.org/bpf/20260119142120.28170-1-leon.hwang@linux.dev/ Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com> Link: https://lore.kernel.org/r/20260607-lru_map_spin-v3-1-bcd9332e911b@meta.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-08Documentation: rust: testing: add Kconfig guidanceYury Norov
Now that the Rust KUnit tests are protected with Kconfig, update the documentation to mention it. Signed-off-by: Yury Norov <ynorov@nvidia.com> Reviewed-by: David Gow <david@davidgow.net> Acked-by: Gary Guo <gary@garyguo.net> Link: https://patch.msgid.link/20260417031531.315281-4-ynorov@nvidia.com [ Fixed the paragraph by moving the new sentence above. Added gate in the other example as well. Applied proper formatting. Reworded slightly. - Miguel ] Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-06-08rust: tests: add Kconfig for KUnit testYury Norov
There are 6 individual Rust KUnit test suites (plus the doctests one). All the tests are compiled unconditionally now, which adds ~200 kB to the kernel image for me on x86_64. As Rust matures, this bloating will inevitably grow. Add Kconfig.test which includes a RUST_KUNIT_TESTS menu, and all individual tests under it. As usual, new tests are all enabled if KUNIT_ALL_TESTS=y. Suggested-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Yury Norov <ynorov@nvidia.com> Reviewed-by: David Gow <david@davidgow.net> Acked-by: Gary Guo <gary@garyguo.net> Link: https://patch.msgid.link/20260417031531.315281-3-ynorov@nvidia.com [ Fixed capitalization. Used singular for "API" for consistency. Reworded to clarify these are suites and that there exists the doctests one (which is the biggest at the moment by far). - Miguel ] Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-06-08rust: tests: drop 'use crate' in bitmap and atomic KUnit testsYury Norov
The following patch makes usage of macros::kunit_tests crate conditional on the corresponding configs. When the configs are disabled, compiler warns on unused crate. So, embed it in unit test declaration. Signed-off-by: Yury Norov <ynorov@nvidia.com> Reviewed-by: David Gow <david@davidgow.net> Acked-by: Gary Guo <gary@garyguo.net> Link: https://patch.msgid.link/20260417031531.315281-2-ynorov@nvidia.com Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-06-07Linux 7.1-rc7v7.1-rc7Linus Torvalds
2026-06-07io_uring/wait: fix min_timeout behaviorChristian A. Ehrhardt
The wakeup condition if a min timeout is present and has expired is that at least _one_ CQE was posted. Thus set the cq_tail target to ->cq_min_tail + 1. Without this commit a spurious wakeup can result in a premature wakeup because io_should_wake() will return true even if _no_ CQE was posted at all. Cc: Tip ten Brink <tip@tenbrinkmeijs.com> Fixes: e15cb2200b93 ("io_uring: fix min_wait wakeups for SQPOLL") Cc: stable@vger.kernel.org Signed-off-by: Christian A. Ehrhardt <lk@c--e.de> Link: https://patch.msgid.link/20260606201120.1441447-1-lk@c--e.de Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-06-07io_uring/kbuf: don't truncate end buffer for bundlesJens Axboe
If buffers have been peeked for a bundle receive, the kernel will truncate the end buffer, if the available length is shorter than the buffer itself. This is unnecessary, as applications iterating bundle receives must always use the minimum size of the buffer length and the remaining number of bytes in the bundle. The examples in liburing do that as well, eg examples/proxy.c. If the kernel does truncate this buffer AND the current transfer fails, then the buffer will be left with a smaller size than what is otherwise available. Just remove the buffer truncation, as it's not necessary in the first place. Link: https://lore.kernel.org/io-uring/CAAEr8jbY60noGj1fw_k91UJRBkyiRVoS6=nLhZ7Svwidjn4CAA@mail.gmail.com/ Reported-by: Federico Brasili <federico.brasili@gmail.com> Cc: stable@vger.kernel.org Fixes: 35c8711c8fc4 ("io_uring/kbuf: add helpers for getting/peeking multiple buffers") Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-06-07Merge tag 'x86-urgent-2026-06-07' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: - Add more AMD Zen6 models (Pratik Vishwakarma) - Avoid confusing bootup message by the Intel resctl enumeration code when running on certain AMD systems (Tony Luck) * tag 'x86-urgent-2026-06-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/resctrl: Only check Intel systems for SNC x86/CPU/AMD: Add more Zen6 models
2026-06-07Merge tag 'timers-urgent-2026-06-07' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fixes from Ingo Molnar: - Fix the arch_inlined_clockevent_set_next_coupled() prototype in the !CONFIG_GENERIC_CLOCKEVENTS_MIN_ADJUST case (Naveen Kumar Chaudhary) - Fix an off-by-1 bug in the sys_settimeofday() usecs validation code (Naveen Kumar Chaudhary) - Mark vdso_k_*_data pointers as __ro_after_init (Thomas Weißschuh) - Fix livelock race in tmigr_handle_remote_up() (Amit Matityahu) * tag 'timers-urgent-2026-06-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: timers/migration: Fix livelock in tmigr_handle_remote_up() vdso/datastore: Mark vdso_k_*_data pointers as __ro_after_init time: Fix off-by-one in settimeofday() usec validation clockevents: Fix duplicate type specifier in stub function parameter