summaryrefslogtreecommitdiff
path: root/arch
AgeCommit message (Collapse)Author
2026-08-21Merge branch 'pci/controller/dwc-rcar-gen4'Bjorn Helgaas
- When MSI is enabled but iMSI-RX is not used, configure AXIINTC to allow GIT ITS to handle MSI (Marek Vasut) - Refactor GIC600 implementation to make it easier to add platforms that only support 32-bit addressing (Marek Vasut) - Add Renesas R-Car Gen4 S4/V4H/V4M to the list of GIC600 integrations that only support 32-bit addressing (Marek Vasut) * pci/controller/dwc-rcar-gen4: irqchip/gic-v3: Add Renesas R-Car Gen4 erratum workaround irqchip/gic-v3: Refactor GIC600 limited to 32bit PA erratum handling PCI: rcar-gen4: Configure AXIINTC if iMSI-RX is not used PCI: dwc: Move iMSI-RX check before calling 'pp->ops->init()'
2026-08-21Merge tag 'modules-7.3-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux Pull module updates from Petr Pavlu: - Remove unnecessary module::args. Nowadays, no parameter-handling code points into the module::args buffer. The last user of module::args in xtensa/simdisk is updated and the data is then removed - Add Rust support for boolean parameters. This will initially be used by the Rust null block driver - Fix clearing the current charp parameter value when setting a new one fails due to an allocation failure - Improve the debugging code for kmod (request_module()) duplicates. Fix a potential use-after-free when waiting on a duplicate request and make several general improvements to the code - Fix the symbol size returned when looking up a data symbol through kallsyms - Smaller fixes and cleanups * tag 'modules-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux: params: fix charp corruption on allocation failure module: validate string table section types module/dups: Clean up includes module/dups: Use strcmp() to compare module names module/dups: Use scope-based cleanup helpers module/dups: Avoid unnecessary kmod_dup_req allocations module/dups: Fix use-after-free in kmod_dup_req lifetime handling module/dups: Inform duplicate requests about the result directly rust: module_param: support bool parameters rust: module_param: return value by copy from `value` module: Remove unnecessary module::args xtensa/simdisk: Avoid referring to module::args module: Remove unused DISCARD_EH_FRAME definition from module.lds.S module: procfs: use matching type for accumulator in module_total_size() module: use strscpy() to copy module names in stats and dup tracking params: fix path of /sys/module/XYZ/parameters/ in comment module/kallsyms: fix nextval for data symbol lookup
2026-08-21Merge tag 'mips_7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linuxLinus Torvalds
Pull MIPS updates from Thomas Bogendoerfer: - switch gpio code to use swnodes - rework of TXX9 gpio code - enable multi-vpe for econet - cleanups and fixes * tag 'mips_7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: mips: dts: econet: Describe dual-VPE 34Kc processor mips: econet: add multi-vpe capability to EN751221 MIPS: ptrace: Fix syscall skipping via PTRACE_SYSCALL mips: remove dead select MIPS: BCM47XX: Convert buttons to software nodes ssb: gpio: Add and register software node for GPIO controller bcma: gpio: Add and register software node for GPIO controller MIPS: ip22-gio: Drop #include of <linux/mod_devicetable.h> MIPS: TXX9: Clean up txx9_iocled_init() MIPS: TXX9: Convert gpio_txx9 to dynamic GPIO base allocation MIPS: TXX9: Drop GPIOLIB_LEGACY select MIPS: TXX9: Use GPIO lookup table for iocled LEDs MIPS: TXX9: Reduce TXX9_IOCLED_MAXLEDS to 3 MIPS: TXX9: rbtx4927: Use GPIO lookup table for TXx9 LEDs MIPS: TXX9: rbtx4927: Use GPIO lookup table for SIO DTR MIPS: TXX9: Remove txx9_7segled_*() forward declarations MIPS: TXX9: Remove tx4938_spi_init() and txx9_spi_init() MIPS: kernel: proc: Use two seq_putc() calls in show_cpuinfo()
2026-08-21Merge tag 'mmc-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmcLinus Torvalds
Pull MMC updates from Ulf Hansson: "MMC core: - Reject invalid perdev_minors for the block device before division - Document DT fixed-layout NVMEM provider support for eMMC cards MMC host: - Convert a couple of plain text DT bindings to the yaml format - bcm2835: DMA mapping improvements - cqhci: Fix sparse warnings for endian conversions - dw_mmc: Stop and complete DMA also in busy state - dw_mmc-rockchip: Add support for the RV1106 variant - litex_mmc: Add dynamic bus width support - moxart: Propagate error for DMA completion timeout - pxamci: Remove PXA remnants for the PXA93x support - rtsx_usb_sdmmc: Avoid USB I/O in runtime autosuspend - rtsx_usb_sdmmc: Suppress false CD after init timeout - sdhci_am654: Add Judith Mendez as maintainer - sdhci-esdhc-mcf: Do not use readl()/writel() on ColdFire - sdhci-msm: Extend the DT bindings for ICE - sdhci-tegra: Add support for Tegra264/Tegra238 variants - sunxi: Add support for the Allwinner A733 variant - via-sdmmc: Clean up card detect work at remove and in probe error path" * tag 'mmc-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: (35 commits) ARM: PXA: Fix build error for PXA93x dt-bindings: mmc: sunxi: add compatible string for Allwinner A733 MMC0/1/2 dt-bindings: mmc: Document fixed-layout NVMEM provider support mmc: sdhci-tegra: Add Tegra264 SoC data dt-bindings: mmc: tegra: Document Tegra264 SDHCI mmc: sdhci-tegra: Add Tegra238 SoC data dt-bindings: mmc: tegra: Document Tegra238 SDHCI mmc: omap_hsmmc: use platform_get_irq_optional for wake IRQ mmc: via-sdmmc: cancel card-detect work on remove mmc: via-sdmmc: stop card-detect handling on probe failure mmc: moxart: use platform helpers for resource and IRQ mmc: host: Remove redundant dev_err()/dev_err_probe() mmc: bcm2835: DMA mapping improvements mmc: dw_mmc: move declaration of dw_mci_pmops dt-bindings: mmc: rockchip-dw-mshc: Add RV1106 compatible mmc: rtsx_usb_sdmmc: suppress false CD after init timeout misc: rtsx_usb: avoid USB I/O in runtime autosuspend mmc: sdhci-of-dwcmshc: Log eMMC reset calls mmc: block: reject invalid perdev_minors before division mmc: sdhci-of-ma35d1: add missing MODULE_DEVICE_TABLE() ...
2026-08-20Merge tag 'mm-stable-2026-08-18-18-39' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull MM updates from Andrew Morton: - "mm: drop "sub" prefix from various places" (Dev Jain) page->folio conversion and a naming cleanup - "mm/kasan: remove redundant initialization for kasan_flag_write_only" (Igor Putko) KASAN cleanup work - "mm/filemap: reduce unnecessary xarray lookups" (Chi Zhiling) Small speedup in the pagecaache read code - "mm/percpu: Fix possible NOFS/NOIO reclaim recursion" (Kaitao Cheng) Improve the vmalloc code - mainly the avoidance of GFP_KERNEL allocations when the caller asked for GFP_NOFS or GFP_NOIO - "mm/kmemleak: avoid soft lockup when scanning task stacks" (Breno Leitao) Avoid a soft lockup watchdog trigger from the kmemleak scanning code in extreme situations - "mm/page_owner: misc cleanups" (Ye Liu) Cleanups to the page_owner code. For some reason lots of people have been working on the page_owner code this cycle. - "mm: convert to walk_page_range_vma() to eliminate find_vma()" (Kefeng Wang) Simplify and accelerate the page walking library function - "mm/migrate: preparatory cleanups for batch copy and offload" (Shivank Garg) Cleanups in the migration code - "mm/page_owner: add per-fd filter infrastructure for print_mode and NUMA filtering" (Zhen Ni) Per-fd filtering to page_owner in order to reduce the sometimes vast amount of output it can produce - "mm: Refactor bootmem gigantic hugepage allocation" (Muchun Song) Fixes and preparatory cleanups around bootmem HugeTLB handling, sparse initialization ordering, and related vmemmap setup - "mm/zsmalloc: reduce lock contention in zs_free()" (Wenchao Hao) Reduce lock contention in zs_free(), which dominates the unmap path under memory pressure on Android (LMK kills) and on x86 servers running zswap-heavy workloads. Up to 1.83x improvement in microbenchmarking. - "move alloc_tag.c file under mm/" (Suren Baghdasaryan) - "samples/damon: handle damon_{start,stop}() failures" (SJ Park) Fix improper handling of damon_start(), damon_stop(), and damon_call() failures across DAMON sample modules to prevent potential memory leaks, operation disruptions and use-after-free bugs - "mm/damon/sysfs: kobject_del() directories that users can create/remove" (SJ Park) Fix delayed sysfs directory removal under DEBUG_KOBJECT_RELEASE causeing creation failures due to duplicate directory names by adding missing kobject_del() calls before creating new directories - "mm: cleanup clear_not_present_full_ptes()" (David Hildenbrand) Clean up the core pte handling code - "selftests/damon: misc fixes for test bugs" (Kunwu Chan) Fix several bugs in the DAMON selftests - "selftests/damon: fix memcg_path staging handling" (Cheng Nie) Fix a bug in _damon_sysfs.py for damos_filter memcg_path setup, and add a test case for it in sysfs.py. - "selftests/damon: test kdamond refresh_ms" (Ruslan Valiyev) Selftest coverage for DAMON's refresh_ms sysfs feature by updating the test control module and verifying that scheme stats update automatically without manual intervention - "mm/damon: five misc fixups" (Akinobu Mita) Miscellaneous DAMON fixups. - "mm/damon/core: detect internal variation above max_nr_regions/2" (Jiayuan Chen) Fix DAMON's region splitting behavior when region counts exceed half the maximum budget by dynamically scaling down the split fraction as the limit approaches, preventing large regions from staying un-split, and add corresponding KUnit test coverage - "mm: preparatory patches for PMD level swap entries" (Usama Arif) Refactor and clean up PMD softleaf helpers, call sites, and architecture flags to lay the groundwork for a follow-up series that introduces PMD page table swap entries - "mm/damon: update, optimize, and clean up doc, tests, and code" (SJ Park) Update DAMON design and ABI documentation, expands unit and selftest coverage, optimize damon_commit_target_regions(), and clean up recently added sysfs interface code for better readability - "mm/vmpressure: reduce CPU, memory and code overhead on cgroup v2" (Usama Arif) Optimize vmpressure() by skipping unnecessary work on cgroup v2 for userspace event notifications and refactor v1-only eventfd handling into mm/memcontrol-v1.c to reduce memory overhead and code complexity - "selftests/mm: refactor pkey helpers and fix mmap error handling" (Hongfu Li) Refactor pkeys shared tracing and assertion helpers into a common file, unify protection key selftests to use consistent diagnostic logging and assertions, and enforce standardized MAP_FAILED return checks for mmap() calls across the tests - "mm/damon: optimize out nr_accesses_bp" (SJ Park) Replace the error-prone, continuously updated nr_accesses_bp field in damon_region with an on-demand moving sum function, reducing structure memory overhead and avoiding state corruption bugs - "Open HugeTLB allocation routine for more generic use" (Ackerley Tng) Decouple HugeTLB folio allocation from VMA dependencies by introducing hugetlb_alloc_folio(), enabling subsystems like guest_memfd to allocate HugeTLB folios without standard VMA reservations or pseudo-VMAs - "mm/damon: provide pseudo moving sum probe_hits" (SJ Park) Integrate DAMON's probe_hits attribute counter into the pseudo moving sum infrastructure, enabling real-time, online monitoring without waiting for full aggregation intervals - "mm: Some cleanups for page allocator APIs" (Brendan Jackman) Simplify and refactor the page allocator entry points and flags by unifying allocation paths, adding internal alloc_flags arguments, and eliminating redundant __ prefixed alloc_pages variants. - "Fix incorrect access of hugetlb pte entries" (Dev Jain) Enforce the consistent use of huge_ptep_get() instead of ptep_get() for HugeTLB entries and fixes an unaligned address issue in arm64's huge_ptep_get() implementation - "mm/damon: validate all parameters in the core" (SJ Park) Consolidate parameter validation into the DAMON core specifically within damon_start() and damon_commit_ctx() to centralize error checking, eliminate caller-side redundant checks and to improve maintenance efficiency - "tools/mm/page_owner_sort: fix filtering and cleanup issues" (Yichong Chen) Rename is_need() to filter_record() for clearer return semantics, fix per-record allocation memory leaks and bound output copies in search_pattern() to address an existing buffer issue - "memcg: bail out reclaim when memcg is dying" (Jiayuan Chen) Mitigate a system-wide stall which occurs when a cgroup is removed while one of its memory control files is doing synchronous reclaim - "mm/memory-failure: add panic option for unrecoverable pages" (Breno Leitao) Introduce an opt-in vm.panic_on_unrecoverable_memory_failure sysctl that immediately panics the kernel on unrecoverable memory errors in kernel-owned pages to preserve error context and prevent delayed, silent data corruption - "mm/damon: refactor damon_{start,stop,commit}() for simple error handling" (SJ Park) Refactor the DAMON core API functions to guarantee that all contexts are fully stopped when damon_start(), damon_stop(), or damon_commit() fail, eliminating the need for complex and error-prone caller-side cleanup code - "Keep tail page private zero at free and folio split" (Zi Yan) Add checks to ensure tail_page->private is zero when freeing compound or high-order pages and when promoting tail pages during large folio splits. By validating these fields at free and split time, it allows the removal of redundant private field clearing inside prep_compound_tail() - "mm: drop redundant lru_add_drain in anon folio reuse paths" (Barry Song) Eliminate redundant lru_add_drain() calls in wp_can_reuse_anon_folio() and do_swap_page() to reduce LRU lock contention and system overhead By validating folio refcounts against the LRU cache before draining and removing unnecessary drains in the swap path, it achieves up to a 30.5% reduction in drain calls during heavy swap workloads - "mm: clean up folio LRU and swap declarations" (Jianyue Wu) Reorganize folio LRU and swap code by relocating page-cluster state to mm/swap_state.c, renaming mm/swap.c to mm/folio.c, and moving MM-internal reclaim declarations into mm/internal.h. - "userfaultfd: working set tracking for VM guest memory" (Kiryl Shutsemau) Add userfaultfd support for tracking the working set of VM guest memory, so a VMM can identify hot pages and reclaim cold ones to tiered or remote storage - "mm: remove CONFIG_HAVE_BOOTMEM_INFO_NODE (Part 2)" (David Hildenbrand) Remove the remaining pieces of CONFIG_HAVE_BOOTMEM_INFO_NODE, performing some smaller cleanups around freeing of reserved vmemmap pages on the way. - "mm/damon: update probe hits for runtime parameter commits" (SJ Park) Ensure that DAMON's probe_hits attribute counter is properly updated when monitoring intervals are changed at runtime, matching the behavior of nr_accesses. To achieve this, it refactors and renames existing helper functions for shared use, applies the updates to probe_hits, and handles edge cases in damon_probe_hits_mvsum() to maintain measurement accuracy. - "KSM: performance optimizations for rmap_walk_ksm" (xu xin) Resolve a severe KSM reverse-mapping performance bottleneck where thousands of split VMAs sharing a single anon_vma cause extended lock contention. By adding an interval-filtering check during the rmap walk, it reduces worst-case anon_vma lock hold times from over 500ms down to under 2ms, preventing application freezes and latency spikes under memory pressure. - "mm: split a couple of headers from internal.h" (Mike Rapoport) Split declarations related to mm_init, memblock, vmalloc and sparse into new headers - "KSM: use linear_page_index in collect_procs_ksm()" (xu xin) Apply the interval tree optimization from rmap_walk_ksm() to collect_procs_ksm() to avoid iterating over non-matching VMAs during KSM memory error handling. It hoists loop-invariant address initialization and restricts the anon_vma_interval_tree_foreach walk to a targeted page offset range, reducing redundant checks and improving lookup efficiency. - "selftests/mm: avoid false failures in hugetlb and KSM tests" (Sayali Patil) Fix issues in the hugetlb and KSM MM selftest categories that can report failures when the prerequisites for the tests are not satisfied - "mm/damon: introduce data attributes only monitoring" (SJ Park) Introduce attribute-weighted region management in DAMON, allowing users to prioritize specific data attributes (such as page sizes or cgroups) over or instead of access monitoring. By assigning weights to attribute probes, DAMON can completely disable access tracking and adjust monitoring regions based on weighted probe-hit counters to optimize monitoring quality for attribute-focused workloads. - "mm/hmm: Add mmap lock-drop support for userfaultfd-backed mappings" (Stanislav Kinsburskii) Extend hmm_range_fault() to support userfaultfd-backed regions by allowing the mmap lock to be dropped during fault handling via a new hmm_range_fault_locked() helper. By accepting a locked pointer and signaling retry status when lock release occurs, it enables page fault resolution in userfaultfd regions while preserving backward compatibility for existing callers. - "mm: make VMA page offset handling more consistent" (Lorenzo Stoakes) Clean up and standardize how vma->vm_pgoff is accessed and manipulated across file-backed and anonymous mappings in the kernel It introduces dedicated helper functions such as vma_start_pgoff(), vma_end_pgoff(), vma_set_pgoff() and linear_page_delta() while renaming rmap interval tree helpers to better reflect their functionality. These changes establish a cleaner foundation for future work that will unify virtual page offset indexing for all anonymous and CoW'd folios. - "mm: handle device-private PMDs in walk callbacks" (Usama Arif) Address kernel panics and state corruption caused by MM walk callbacks reaching non-present device-private PMD swap entries created during HMM migrations It ensures that functions which acquire pmd_trans_huge_lock() properly recognize device-private PMDs instead of assuming a present THP or a standard migration entry. - "mm/rmap: Refactor try_to_unmap_one" (Dev Jain) Refactor try_to_unmap_one by modularizing Hugetlb, anonymous-lazyfree, and anonymous-swapbacked logic into dedicated functions, laying the structural groundwork for batched anonymous large folio unmapping. - "Docs/ABI/damon: sysfs ABI document fixes and additions" (Song Hu) Fix typos and fills in missing entries in the DAMON sysfs ABI document - "dax/kmem: atomic whole-device hotplug via sysfs" (Gregory Price) Introduce an atomic sysfs state attribute and supporting DAX/MM infrastructure to prevent userland races when offlining and removing entire memory regions By adding an unplugged state alongside standard online modes, it enables whole-device atomic hotplug control while preserving backward compatibility. - "mm: convert more vm_flags_t users to vma_flags_t" (Lorenzo Stoakes) Continue transitioning the kernel from the deprecated vm_flags_t type to vma_flags_t across core memory management infrastructure. It replaces legacy type usage in core functions such as do_mmap(), unmapped area allocation, mm->def_vma_flags, and VMA operations like mlock, mprotect, and mremap. - "Two small patches to clean up mm/mm_slot.h" (xu xin) Refactor mm_slot.h by introducing mm_slot_remove() to unify duplicate slot deletion sequences in khugepaged and KSM. It also adds code documentation explaining why mm_slot_lookup and mm_slot_insert must remain as preprocessor macros rather than static inline functions. - "mm/damon/core: hide core-private struct fields" (SJ Park) Clean up DAMON core structures by consistently marking internal-only fields with private: comment tags to prevent improper direct access from outer layers. It enforces encapsulation across core structures including damon_region, damon_target, and damon_ctx and updates DAMON_SYSFS to interact through approved access APIs instead of exposing raw struct members. - "mm/damon: unurgent fixes for infinite loop, NULL de-ref and races" (SJ Park) Address potential infinite loops, NULL dereferences, and race conditions identified in DAMON It fixes an infinite loop triggered by extreme user configurations, a NULL pointer dereference within unit tests and minor monitoring accuracy degradation caused by subtle runtime races. - "mm/page_alloc: fixes for free_pages_nolock() on RT/UP" (Brendan Jackman) Fix an NMI safety flaw in __free_frozen_pages() where freeing pages on non-SMP or PREEMPT_RT kernels can bypass can_spin_trylock() checks via non-PCP or isolated migration paths. It also resolves potential kernel crashes and privilege escalation risks triggered when BPF tracing runs in NMI context alongside memory hotplug or large allocation frees. - "mm/page_alloc: couple of followups for recent cleanups" (Brendan Jackman) Clean up and update page allocator nomenclature, documentation, and debug assertions. It aligns internal FPI_ flags with the public "nolock" naming convention, removes outdated internal implementation details from high-level page allocator comments, and eliminates obsolete VM_BUG_ON() assertions in allocation paths. - "mm/mseal: further cleanups" (Lorenzo Stoakes) Refactor and simplify the mseal implementation by clarifying API boundaries and removing unnecessary code complexity. It replaces generic do_mseal() usage outside the syscall with a dedicated mseal_mmap_page_zero() helper for MMAP_PAGE_ZERO, eliminates mm_struct parameters to enforce that sealing applies only to current->mm, and streamlines overall logic and comments with no functional changes intended. - "mm/vmscan: fix swappiness=max and clean up per-node proactive reclaim" (Ridong Chen) Resolve reclaim behavior bugs and clean up function parameters across memory reclaim paths It fixes swappiness=max in both standard reclaim and MGLRU so unswappable anonymous memory no longer falls back to evicting page cache, ensures reclaim_store() returns accurate error codes instead of collapsing all failures into -EAGAIN, and removes the obsolete gfp_mask parameter from __node_reclaim(). - "mm: mincore: misc cleanups" (Kefeng Wang) Clean up and simplifies the mincore code. Most importantly, it removes the historical special behavior that always reports VM_PFNMAP pages as non-resident. - "mm/huge_memory: drop dead split helper variants" (Kiryl Shutsemau) Two trivial cleanups in the folio split API - "mm/damon: fix uninitialized DAMOS field and kunit exec expectation bugs" (SJ Park) Resolve minor operational and testing bugs in DAMON identified by Sashiko. It initializes the damos->last_applied field to prevent occasional efficiency degradation and fixes invalid memory accesses in DAMON KUnit tests during test failure handling. - "cleanup for stable_page_flags()" (Jinjiang Tu) Clean up and refactor stable_page_flags() used by /proc/kpageflags without altering functionality. It uses BIT_ULL() to prevent shift-overflow warnings on 64-bit flag bits, converts folio-specific flag checks to standard folio_test_*() helpers, and removes redundant CONFIG_PAGE_IDLE_FLAG handling. - "Batch unmap of uffd-wp file folios" (Dev Jain) Extend batched folio unmapping support to file folios within userfaultfd write-protect (uffd-wp) VMAs by adding batching capabilities to pte_install_uffd_wp_if_needed(). This removes special-case restrictions on uffd-wp VMAs in try_to_unmap_one(), significantly simplifying the function's control flow and complexity. - "mm/early_ioremap: clarify and clean up early_ioremap_reset()" (Sang-Heon Jeon) Clarify and clean up the architecture-specific usage of __late_set_fixmap() and __late_clear_fixmap() after early_ioremap_reset() It adds explicit documentation regarding when early_ioremap_reset() must be called and removes redundant macro definitions and reset calls in the RISC-V and ARM64 architectures. - "mm: fix reclaim storms in defrag_mode" (Johannes Weiner) Address severe performance regressions, swap storms, and spurious OOMs caused by vm.defrag_mode=1 under high memory pressure in Meta production It updates the page allocator slowpath so non-movable allocation requests actively trigger direct reclaim and direct compaction at pageblock_order scale, allowing them to claim whole pageblocks rather than spinning unproductively. - "zram: lockmap tweaks" (Sebastian Siewior) Optimize and fix lockdep tracking for zram devices by consolidating per-entry lockmaps and isolate lock classes across multiple instances This reduces memory overhead by replacing per-entry lockdep_map instances with a single map per struct zram, and assigns a dynamic lock_class_key to each instance to prevent false deadlock reports when different zram devices are backed by distinct filesystems. * tag 'mm-stable-2026-08-18-18-39' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (501 commits) selftests/mm: thuge-gen: fix test_shmget() for PAGE_SIZE check selftests/mm: unpoison pages in memory-failure teardown mm/shmem: downgrade final i_blocks check in shmem_evict_inode() to pr_warn() mm/khugepaged: replace mutex_lock/mutex_unlock usage with guard macro mm/zsmalloc: fix release order of locks in zs_page_migrate() Documentation: zram: remove sections numbering ksm: stop iterating VMAs when ksm_test_exit returns true mm: fold userfaultfd_rwp() to false without CONFIG_ARCH_HAS_PTE_PROTNONE mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch() zram: use a custom key for each zram object zram: move lockmap to be per-zram instead per table selftests/mm: fix gup_longterm EINVAL error message mm: page_alloc: fix non-movable reclaim storm in defrag_mode mm: page_alloc: move capture_control to the page allocator mm: compaction: support non-movable compaction for pageblock requests mm: page_alloc: __GFP_FS lockdep annotation for direct compaction hugetlb: evaluate subpool free state while locked mm/damon: remove trailing semicolons after function definitions mm/damon/ops-common: prevent migration fallback to non-target nodes mm/damon: update outdated comment about DAMOS filter handling ...
2026-08-20Merge tag 'vfio-v7.3-rc1' of https://github.com/awilliam/linux-vfioLinus Torvalds
Pull VFIO updates from Alex Williamson: - Add nv_falcon vfio selftest driver. The Falcon is a general-purpose microcontroller embedded within NVIDIA GPUs, presenting a relatively simple DMA programming interface. This adds another selftest target for vfio-pci with real DMA transfers (Rubin Du, Alex Williamson) - Add allocation assertion helpers to vfio selftests and use them to avoid variable length arrays and the compiler errors they generate (Alex Mastro) - Fix use-after-free hazard where an init path error in MSI support leaves a stray pointer that can later be reused or double-freed (Xiang Mei) - Fix previous refactor of PCI BAR mappings to honor non_mappable_bars flag, which otherwise generates a warning when trying to pci_iomap() a 256TiB BAR on ISM devices on s390 (Farhan Ali) - Add igb vfio selftest driver. Like nv_falcon, this provides another target for DMA testing with vfio selftests, but importantly this driver supports both physical 82576 NICs and the emulation model in QEMU. This therefore enables a vfio selftest vector with no physical hardware requirements (Josh Hilke, Alex Williamson) - Mark selftest fixture objects __maybe_unused to accommodate builds with clang -Wunused-but-set-global (David Matlack) - Add error recovery for vfio-pci devices on s390x. This expands devices which expose the existing error eventfd and introduces a device feature for reporting firmware defined error state information to the user, allowing recovery through hypervisor channels (Farhan Ali) * tag 'vfio-v7.3-rc1' of https://github.com/awilliam/linux-vfio: vfio/pci: Remove the pcie check for VFIO_PCI_ERR_IRQ_INDEX vfio-pci/zdev: Add a device feature for error information s390/pci: Store PCI error information for passthrough devices PCI/MSI: Enable memory decoding before restoring MSI-X messages PCI: Fail FLR when config space is inaccessible PCI: Avoid saving config space state if inaccessible PCI: Allow per function PCI slots to fix slot reset on s390 PCI: Introduce PCI_SLOT_PLACEHOLDER constant for slot_nr placeholder value selftests: harness: Mark test fixture objects __maybe_unused vfio: selftests: Retry on EAGAIN during device reset vfio: selftests: igb: Add driver for Intel 82576 device vfio: selftests: Add helpers to re-enable interrupts vfio/pci: Avoid mapping BARs for devices with non-mappable BARs vfio/pci: clear vdev->msi_perm after freeing it on init failure vfio: selftests: Avoid VLAs vfio: selftests: Add allocation assert helpers vfio: selftests: Add NVIDIA Falcon driver for DMA testing vfio: selftests: Allow drivers without send_msi() support vfio: selftests: Add generic PCI command register helpers vfio: selftests: Add memcpy chunking to vfio_pci_driver_memcpy()
2026-08-20Merge tag 'riscv-for-linus-7.3-mw1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V updates from Paul Walmsley - Add initial definitions and discovery for the Smcsrind, Sscsrind, Smcntrpmf, Ssccfg, Smcdeleg, Zicclsm, Ziccamoa, Ziccif, Ziccrse, Za64rs, and Ssqosid RISC-V ISA extensions - Improve the RISC-V update_mmu_cache_range() implementation by using flush-by-ASID, enabling performance improvements on microarchitectures that support related optimizations; and by taking advantage of the Svinval RISC-V ISA extension on microarchitectures that support it - Shrink CFI shadow stack allocation further (to 512MB) to save virtual address space (and physical memory on systems with strict overcommit policies) - Add initial CPU context switch support for QoS tagging (Ssqosid) - Change our vector misaligned access speed test code to be synchronous, avoiding a bunch of bugs related to unnecessary asynchronicity - Enable ARCH_HAS_ACPI_TABLE_UPGRADE for RISC-V to help with ACPI table debugging (similar to ARM64 and x86) - Extract vDSO section offsets at build time, rather than run time, to avoid the boot time overhead - Use assembler directives to control the use of instructions from the RISC-V ISA extensions Zacas and Zabha, rather than compiler -march flags that could affect the whole kernel (similar to ARM64) - Add a kselftest for kprobes support for the c.jal instruction on RISC-V - When UEFI runtime services are available, use them to restart and power off - Fix ARCH_HAS_ACPI_TABLE_UPGRADE for RISC-V by adding a missing include file to the ACPI code - Move contiguous DMA memory reservation later in the boot, to ensure that the correct global and per-node pools are allocated when CONFIG_CMA_SIZE_PERNUMA is enabled - Disallow probes on breakpoint handlers to avoid recursing indefinitely into do_trap_break() - Patch the compat vDSO during runtime alternatives processing, not only the standard vDSO - Remove some leftover XIP support elements missed by commit 9b3a2be84803 ("riscv: Remove support for XIP kernel") - Fix broadcast timer switching in ACPI LPI power states by implementing a RISC-V version of arch_get_idle_state_flags() - Miscellaneous fixes, including: vDSO makefile simplification; marking our default_power_off() as __noreturn; error path fixes in the PMU SBI perf driver; RISC-V extension capitalization consistency; the use of BIT() macros in one of our include files; and some documentation fixes * tag 'riscv-for-linus-7.3-mw1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: (39 commits) RISC-V: hwprobe: Use BIT macro to avoid warnings riscv: alternative: Also patch the compat vDSO riscv: alternative: Use the statically extracted vDSO section offsets riscv: vdso: Add symbols for the alternative section boundaries riscv: Add Ziccamoa, Ziccif, Ziccrse, and Za64rs to cpufeature and hwprobe riscv: Add Zicclsm to cpufeature and hwprobe riscv: cpufeature: Clarify ISA spec version for canonical order riscv: Standardize extension capitalization riscv: kprobes: Prevent probes in breakpoint handlers riscv: cmpxchg: Use .option arch for Zacas and Zabha riscv: acpi: Handle LPI architectural context loss flags riscv: further remove XIP riscv: Add support for srmcfg CSR from Ssqosid extension riscv: Detect the Ssqosid extension dt-bindings: riscv: Add Ssqosid extension description dt-bindings: riscv: add Counter delegation ISA extensions description RISC-V: Add Ssccfg/Smcdeleg ISA extension definition and parsing RISC-V: Add Ssccfg extension CSR definition dt-bindings: riscv: add Smcntrpmf ISA extension description RISC-V: Add Smcntrpmf extension parsing ...
2026-08-20Merge tag 'm68k-for-v7.3-tag1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k Pull m68k updates from Geert Uytterhoeven: - Fix backtraces for non-running tasks - Fix deadlock in show_cons_active() - defconfig updates * tag 'm68k-for-v7.3-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k: m68k: nfcon: Do not call console_is_registered() in nfcon_device() m68k: Fix backtraces for non-running tasks m68k: defconfig: Update defconfigs for v7.2-rc1 m68k: amiga: Remove redundant amiga_reset() prototype
2026-08-20Merge tag 'loongarch-7.3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch updates from Huacai Chen: - Add DIRECT_MAP_PHYSMEM_END definition - Expand module virtual address space to 2GB - Use current_stack_pointer in current_pt_regs() - BPF JIT enhancements such as kptr_xchg and timed may_goto - Some bug fixes and other small changes * tag 'loongarch-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: selftests/bpf: Enable kptr_xchg_inline test on LoongArch LoongArch: BPF: Add arch_bpf_stack_walk() implementation LoongArch: BPF: Add timed may_goto implementation LoongArch: BPF: Resolve per-CPU addrs for internal-only MOV LoongArch: BPF: Advertise JIT support for kptr xchg inline LoongArch: BPF: Align value-returning atomics with LKMM LoongArch: BPF: Split unconditional branch JA paths statically LoongArch: BPF: Remove dead move_imm() call in BPF_NEG path LoongArch: BPF: Remove redundant zext jumping in move_imm() LoongArch: BPF: Implement branchless conditional move for TCC LoongArch: BPF: Refactor jump offset calculation in tail call LoongArch: BPF: Move arena register slot below TCC context LoongArch: BPF: Optimize redundant TCC loads in epilogue LoongArch: Use current_stack_pointer in current_pt_regs() LoongArch: Use generic cmp_int() instead of custom cmp_3way() LoongArch: Expand module virtual address space to 2GB LoongArch: Add DIRECT_MAP_PHYSMEM_END definition LoongArch: Fix acpi_package_ids[] array overflow
2026-08-20Merge tag 'fs_for_v7.3-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull ext2, udf, isofs, and quota updates from Jan Kara: - Remove deprecated quota code printing warnings about exceeded quota directly to console - Various udf & isofs hardening for handling of corrupted filesystems - Fix a possible data loss in udf when converting files from inline to out-of-line format - Simplify EIO error handling in ext2 xattr code * tag 'fs_for_v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: udf: Fix data loss when converting inline inodes to out of line udf: Move udf_map_block() up ext2: Simplify error handling of IO error when adding xattr isofs: Drop support of directory entries straddling blocks isofs: validate directory records consistently quota: remove CONFIG_PRINT_QUOTA_WARNING code udf: Fix i_lenExtents truncation on 32-bit kernels isofs: release zisofs block pointer buffer head udf: Fix bh leak for unallocated space entries udf: bound lengthAllocDescs from unallocated space entry UDF symlink pathComponent header OOB read isofs: fix out-of-bounds page array access on empty zisofs block udf: reject VAT indexes equal to the entry count udf: Mark LVID buffer as uptodate before marking it dirty udf: avoid recursive s_alloc_mutex deadlock when freeing AED blocks udf: validate extent partition references in udf_current_aext()
2026-08-20Merge tag 'execve-v7.3-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull execve update from Kees Cook: - x86/elf: Correct comment for STACK_RND_MASK() (Lorenzo Stoakes) * tag 'execve-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: x86/elf: Correct comment for STACK_RND_MASK()
2026-08-20Merge tag 'bitmap-for-7.3' of https://github.com/norov/linuxLinus Torvalds
Pull bitmap updates from Yury Norov: "The usual set of fixes, cleanups and performance improvements together with a couple of new tests: - bitmap_find_next_zero_area_off() optimization (Sunyi) - bitmap_find_next_zero_area_off(): return size when no zero area is found (Yury) - bitmap vs IDA vs Maple Tree performance test (Yury) - get rid of cpumap_print_to_pagebuf() (Yury) - use nr_node_ids in __nodemask_pr_numnodes() (Li RongQing) - bitops: make the *_bit_le functions use unsigned long (Benjamin) - bitmap scatter & gather test fix (Christophe) - use __ASSEMBLER__ in bitmap header files (Thomas)" * tag 'bitmap-for-7.3' of https://github.com/norov/linux: (25 commits) lib: test bitmap vs IDA vs Maple Tree performance for region allocations bitmap: Return size when no zero area is found media: s5p-mfc: Treat bitmap size as allocation failure crypto: ccp: Treat bitmap size as allocation failure powerpc/msi: Treat bitmap size as allocation failure ARM: dma-mapping: Treat bitmap size as allocation failure bitmap: drop bitmap_next_set_region() nodemask: reduce bitmap width to nr_node_ids in __nodemask_pr_numnodes() bitmap: Properly initialise destination bitmap for scatter & gather test lib/bitmap-str: get rid of cpumap_print_to_pagebuf() perf: Use sysfs_emit() for cpumask show callbacks PCI/sysfs: Use sysfs_emit() for cpumask show callbacks RDMA/hfi1: Use sysfs_emit() for cpumask show helper hwtracing: hisi_ptt: Use sysfs_emit() for cpumask show fpga: dfl-fme-perf: Use sysfs_emit() for cpumask show devfreq: Use sysfs_emit() for cpumask show callbacks cpu: Use sysfs_emit() for cpumask show callback x86/events: Use sysfs_emit() for cpumask show callbacks powerpc: Use sysfs_emit() for cpumask show callbacks arm: Use sysfs_emit() for cpumask show callbacks ...
2026-08-20x86/bpf: Make arch_bpf_trampoline_size allocate from EXECMEM_MODULE_DATAMike Rapoport (Microsoft)
Jiri Olsa reports slowdown of tracing_multi benchmark that allocates huge number of trampolines [1]. The slowdown caused by extra protection changes in execmem_alloc_rw() and execmem_free(). With ROX caches enabled, all execmem allocations except EXECMEM_MODULE_DATA are ROX after the allocation. execmem_alloc_rw() temporarily sets them to W+NX and execmem_free() resets them back to ROX. The only user of bpf_jit_alloc_exec_rw() is x86::arch_bpf_trampoline_size() that only needs a temporary writable buffer in the modules address space. On x86 executable memory and module data are constrained to the same address range, so x86::arch_bpf_trampoline_size() can directly use execmem_alloc(EXECMEM_MODULE_DATA) Replace the call to bpf_jit_alloc_exec_rw() with a call to execmem_alloc(EXECMEM_MODULE_DATA) in x86::arch_bpf_trampoline_size() and drop bpf_jit_alloc_exec_rw() helper. Fixes: 5bf02dbf39fa ("bpf, x86: Make sure allocation in arch_bpf_trampoline_size() is writable") Reported-by: Jiri Olsa <olsajiri@gmail.com> Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Tested-by: Jiri Olsa <jolsa@kernel.org> Link: https://lore.kernel.org/all/an8r7EODLIL-bZM3@krava Link: https://lore.kernel.org/bpf/20260818130510.3110054-1-rppt@kernel.org
2026-08-20Merge tag 'sysctl-7.03-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl Pull sysctl updates from Joel Granados: - Fix kernel-doc warnings by adjusting in file documentation - Consolidate do_proc_* function into do_proc_vec Consolidate three slightly different implementations of applying a converter on all elements of a vector. Fixes to this function now propagate to the three types. - Replace CONFIG_PROC_SYSCTL with CONFIG_SYSCTL (they were the same) and restrict cad_pid modifications to global root (GLOBAL_ROOT_UID) * tag 'sysctl-7.03-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl: sysctl: remove CONFIG_PROC_SYSCTL, it just mirrors CONFIG_SYSCTL sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[] sysctl: repair some kernel-doc comments sysctl: add Returns: kernel-doc for all functions sysctl: Update API function documentation sysctl: Rename proc_doulongvec_minmax_conv to proc_doulongvec_conv sysctl: Group proc_handler declarations and document sysctl: Replace do_proc_do{int,ulong,uint}vec with do_proc_vec sysctl: Add negp parameter to douintvec converter functions sysctl: Move default converter assignment out of do_proc_dointvec
2026-08-20Merge tag 'net-next-7.3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next Pull networking updates from Jakub Kicinski: "One of the 'small improvements all over the place' releases for us. It's hard to draw any direct comparisons because summer vacations disrupted our patch processing (and presumably - generation) quite a bit. Quick and dirty count suggests we (Paolo and I) merged a very similar number of net (632) and net-next (648) patches. This is not telling the full story either because 1/3 to 1/2 of the net-next patches also *seem* like AI-driven low priority fixes, cleanups and clarifications. We are completely overwhelmed, of course. The glimmer of hope is that we secured sufficient LLM budget and access (thank you Meta!) to run reviews with multiple frontier models on each patch. This eliminates some hallucinations. That said, in terms of review, the LLMs can only do so much. The sad truth is that our APIs (especially for rare events like PCIe errors, timeouts etc) have always been racy, and now LLMs don't let us ignore that. I expect our direction for the next release will be to tweak the reviews a little bit more, but start shifting focus to letting the LLMs take care of the busy work - managing patchwork, automating common process complaints, editing commit messages, and maybe applying patches which already got "reviewed-by" tags from people we trust... Core & protocols: - A few steps lowering rtnl_lock dependence: - per-netns netdev unregistration for select SW drivers (e.g. veth, ipvlan, tunnels) - rtnl_lock-less FIB rule changes (RTM_NEWRULE and RTM_DELRULE) - prepare software drivers and TC qdiscs for rtnl_lock-less GET - Support BIG TCP (>64kB TSO) in UDP tunnels (vxlan, geneve) - Support buffers larger than PAGE_SIZE in devmem zero-copy API - Improve MPTCP handling of extreme memory pressure handling, when out-of-order queue had to be pruned - Report the per-group user count via RTM_GETMULTICAST - Expose the route deletion reason in RTM_DELROUTE - Add a SO_RIGHTS_NOTRUNC option to UNIX sockets to enable more useful handling of LSM denials when receiving SCM_RIGHTS messages: instead of truncating the message at the first blocked fd, keep every fd slot and store the LSM errno in the blocked slot - IPv6 Segment Routing - support looking up the post-encap SID (address) in a different/specified routing table - Support PRP RedBox (interlink) creation - Support per-nexthop UDP dst port in VXLAN - Continue converting getsockopt callbacks in a number of protocols to iov_iter Ethernet: - Merge initial CXL support for AMD/Solarflare NICs (shared branch with the CXL tree) - New drivers: - ADIN1140 10BASE-T1S MACPHY - Initial skeleton of Intel iXD and ZTE Dinghai drivers - High-speed NICs: - AMD/Pensando: - support firmware flashing - Cisco (enic): - SR-IOV V2 admin channel and MBOX protocol - Huawei (hns3): - support for ethtool pfc_prevention_tout - nVidia/Mellanox: - support sharing bandwidth control across interfaces of the same device - Marvell (octeontx2-pf): - link RQ page pools to netdev for Netlink stats - Google vNIC: - XDP metadata support for DQ RDA - Microsoft vNIC: - support forcing full-page RX buffers - Other NICs: - Synopsys IP: - eic7700: support for eth1 - Microchip (lan743x): - support for RMII interface - Wangxun: - support for ethtool -G and -C for VFs - add Tx timeout and PCIe error handling - Intel (igb/igc): - RSS key get/set support - support for forcing link speed without auto-negotiation - Switches: - NXP (dpaa2): - support bonding/LAG offload - Mediatek: - mt7530: EN7528 support - initial support for MT7628 - Micrel (ksz8/9): - refactoring work to move towards library model - PTP support for KSZ8463 - nVidia/Mellanox: - support rtnl-lock-less ethtool callbacks - Realtek: - rtl8366rb: use generic RTL83xx code - support SGMII and HSGMII for RTL8367S - PHYs: - Airoha: - EcoNet EN7528 PHY support - DAPU Telecom - DAPU Telecom DAP8211R(I) Gigabit PHY support - Realtek: - support RTL8261C_CG - support RTL8261D Wireless: - nl80211: per-link statistics support for multi-link operation - mac80211: AQL/airtime-fairness support for multicast - Merge Peripheral Authentication Service (PAS) / TEE support for ath12k (shared branch with the firmware/qcom tree) - New drivers: - mm81x for Morse Micro Long-Range S1G devices - nxpwifi for NXP devices (mostly forked off from mwifiex) - Driver changes: - Broadcom (brcmfmac): - DPP support, some Cypress part update - MediaTek (mt76): - mt7928 support - mt7925 NAN support - mt7996 AP powersave improvements - Qualcomm (ath12k): - much kernel infrastructure integration work - AHB platform MultiPD support - Realtek (rt89): - LED support - RTL8922DE support - dual-BT coex for RTL8922D - Intel: - new FW version support Bluetooth: - HCI: add support for Shorter Connection Interval (SCI) feature - af_bluetooth: add minimal context analysis annotations - Driver changes: - Intel: - add Bluetooth SAR revision 2 support - add vendor_reset PCI sysfs for PLDR - Mediatek: - add USB IDs for MT7902 and MT7922 devices - Realtek: - add USB IDs for 8761CU and 8852BE devices - NXP: - add M.2 Bluetooth device support using pwrseq Misc: - DPLL support for manual/numerical oscillator control (NCO) (implement in zl3073x) - MCTP support for MCTP over USB v1.1 (DMTF DSP0283) - Power-over-Ethernet: support Realtek PSE controllers - Remove the IBM EHEA driver - Remove tulip/xircom_cb driver" * tag 'net-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next: (1433 commits) net/mlx5e: do not HW-GRO coalesce small frames net: openvswitch: fix nf_connlabels leak in ovs_ct_init net: add missing ref_tracker_dir_exit() to alloc_netdev_mqs() net: openvswitch: fix flow mask use-after-free on flow deletion sctp: stop processing a packet once its association is deleted dpll: zl3073x: add PTP clock support dpll: zl3073x: add channel ToD, phase step and TIE operations dpll: zl3073x: scale poll interval proportionally to timeout ptp: vmclock: prevent read-only mappings from becoming writable ipv4: reject undersized MTUs in ip_do_fragment() bonding: initialize err for empty target lists net: dsa: initial support for MT7628 embedded switch net: dsa: initial MT7628 tagging driver net: phy: mediatek: add phy driver for MT7628 built-in Fast Ethernet PHYs dt-bindings: net: dsa: add MT7628 ESW net: pse-pd: realtek-pse-mcu: add UART transport net: pse-pd: realtek-pse-mcu: add I2C transport net: pse-pd: add Realtek PSE MCU core dt-bindings: net: pse-pd: add bindings for Realtek PSE MCU vsock: use sock_error() to consume sk_err after a failed connect ...
2026-08-20Merge tag 'bpf-next-7.3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next Pull bpf updates from Daniel Borkmann: "Major changes: - Redesign the verifier error reporting: failures now carry source and instruction annotations along with the causal event history that led to them, making program rejections far easier to debug and repair (Kumar Kartikeya Dwivedi) - Add arena argument support to kfuncs and struct_ops through the new __arena and __arena__nullable suffixes (Tejun Heo, Puranjay Mohan, Kumar Kartikeya Dwivedi, Ihor Solodrai) - Signed BPF program loader rework to accommodate both BPF and security community needs where the kernel runs the signature verification at BPF_PROG_LOAD time before the LSM admission hook (Daniel Borkmann) - Add a set of ksock kfuncs which let BPF LSM and syscall programs create, connect and send on UDP sockets in order to emit telemetry data (Mahe Tardy) - Unify helper and kfunc call argument verification and classify kfunc arguments purely from BTF into a generated bpf_func_proto which is computed once at add-call time (Amery Hung) Other features and fixes: - Enable EXECMEM_ROX_CACHE for BPF allocations on x86 (Mike Rapoport) - Add bidirectional VLAN support to bpf_fib_lookup() through the new BPF_FIB_LOOKUP_VLAN and BPF_FIB_LOOKUP_VLAN_INPUT flags (Avinash Duduskar) - Infer zext_dst from static register liveness analysis to fix 32-bit zero-extension semantics, and remove the artificial limitations on pointer types eligible for spilling (Eduard Zingerman) - Inline the numeric open-coded iterator kfuncs so that bpf_for() loops no longer pay a kfunc call on every iteration (Puranjay Mohan) - Add an arena-based bitmap data structure to libarena along with serial and parallel selftests (Emil Tsalapatis) - Teach resolve_btfids to discover kfuncs from the kernel's BTF ID sets and to emit kfunc BTF decl tags, reducing the kernel build's dependency on pahole features (Ihor Solodrai) - Add BPF_F_ADJ_ROOM_DECAP_* flags to bpf_skb_adjust_room() so that tunnel decapsulation can update the GSO and encapsulation state of the skb (Nick Hudson) - Fix the ring buffer pending_pos walk and the available-data accounting on 32-bit position wrap (Israel Téllez García) - Add memory usage accounting for arena maps and fix an mmap_lock deadlock on arena lock failure (Jiayuan Chen) - Add tracing_multi link info support to the kernel UAPI and bpftool, and refactor the stack map code to run with preemption disabled (Jiri Olsa) - Support BPF_F_EGRESS in bpf_redirect_peer() to emit the skb in the egress direction of the target's peer device (Jordan Rife) - Add a KF_SPINLOCK_SAFE kfunc flag so that providers, in particular modules, can declare kfuncs safe to call under bpf_spin_lock instead of relying on the verifier's hard-coded allowlist (Kaitao Cheng) - Introduce global percpu data for BPF programs with libbpf probing and bpftool skeleton support, and stop exposing uninitialized kernel heap memory when copying per-CPU map values (Leon Hwang) - Add s390 JIT support for load-acquire and store-release instructions (Maxim Khmelevskii) - Fix a CFI mismatch in the task work callback and an arm64 KASAN false positive after bpf_throw() (Mykyta Yatsenko) - Reject writes through untrusted BTF pointers and bound the rdonly/rdwr_buf_size kfunc arguments (Nicholas Dudar) - Invalidate RCU pointers only after the final spin unlock and account for preempt and IRQ disabled regions as overlapping RCU protection (Ning Ding) - Support mixing bpf2bpf calls and tail calls on RV64, add signed operations and 32-bit atomics to the RV32 JIT, and add timed may_goto support (Pu Lehui, Kuan-Wei Chiu, Feng Jiang) - Fix a use-after-free on mm_struct in bpf_find_vma() for foreign tasks and an mmap_lock leak in the irq_work path (Sanghyun Park) - Populate mmap-able BPF array map memory lazily which makes mmap() O(1) instead of proportional to the map size (Song Liu) - Introduce a jit_required flag and reject programs with inlined helpers when no JIT is available, where the interpreter would otherwise jump into an invalid address (Tiezhu Yang) - Fix the x86 JIT per-CPU address resolution into an extended register where the REX prefix dropped the high destination register bit (Vineet Gupta) - Reject MEM_ALLOC BTF accesses past object bounds, arena frees below the arena base, and mixed arena and ordinary atomic paths (Yiyang Chen) - Fix the trampoline handling of 128-bit arguments and of return values larger than 8 bytes (Yonghong Song) - Ensure that any fault prone load is rewritten with exception table handling, and fix the arena load-acquire and atomic fetch handling in the x86, arm64, riscv and s390 JITs (Daniel Borkmann) - Many more fixes and cleanups across the verifier, arena, trampolines, sockmap, cgroup, ring buffer, x86/arm64/riscv/s390 JITs, libbpf, bpftool, resolve_btfids and selftests" * tag 'bpf-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: (373 commits) selftests/bpf: Add tests for a store on a fault prone qdisc pointer selftests/bpf: Add tests for fault prone loads out of RCU pointers selftests/bpf: Add tests for pointer type merge at a shared load selftests/bpf: Remove duplicate copies of the arena spinlock qnodes selftests/bpf: Retry stat generation in cgroup_iter_memcg selftests/bpf: Test pseudo-function policy diagnostics bpf: Distinguish function references in policy diagnostics bpf: Preserve source attribution without source text selftests/bpf: Test kfunc argument diagnostics bpf: Correct kfunc argument diagnostics bpf: Use canonical stack argument names in diagnostics bpf: Preserve R0 lineage across helper calls selftests/bpf: Exercise negative optlen in cgroup getsockopt hook bpf: Reject negative optlen in cgroup getsockopt hook selftests/bpf: tc_tunnel - validate decap GSO and encapsulation state bpf: Clear decap state on skb_adjust_room shrink path bpf: Allow new DECAP flags and add guard rails bpf: Add BPF_F_ADJ_ROOM_DECAP_* flags for tunnel decapsulation bpf: Refactor masks for ADJ_ROOM flags and encap validation bpf: Name the enum for BPF_FUNC_skb_adjust_room flags ...
2026-08-20efi/runtime-wrappers: factor out efi_rts_park_worker()Breno Leitao
x86's efi_crash_gracefully_on_page_fault() ends in an infinite schedule() loop so the kworker that faulted in firmware never runs efi_rts_wq again. A later change needs the same "park this worker forever" primitive on the runtime service timeout path, so factor the loop into a shared efi_rts_park_worker() and call it from the x86 page-fault handler. No functional change. Signed-off-by: Breno Leitao <leitao@debian.org> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
2026-08-20ARM: Fix get_cycles() after delay_read_timer() conversionNathan Chancellor
After commit dfc256dac54c ("calibrate: Rework delay timer calibration"), certain ARM configurations (such as multi_v5_defconfig) hang during boot. The use of read_current_timer() in arch/arm's get_cycles() was improperly converted to delay_read_timer(), resulting in get_cycles() returning 0 even when the timer has been read or an uninitialized stack value when delay_read_timer() returns false. Flip the branches of the ternary condition to fix get_cycles(). Fixes: dfc256dac54c ("calibrate: Rework delay timer calibration") Signed-off-by: Nathan Chancellor <nathan@kernel.org> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Reviewed-by: Jinjie Ruan <ruanjinjie@huawei.com> Cc: Thomas Gleixner <tglx@kernel.org> Cc: linux-arm-kernel@lists.infradead.org Link: https://patch.msgid.link/20260819-fix-arm-get_cycles-v1-1-208bf07ac540@kernel.org
2026-08-19Merge tag 'v7.3-p1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto update from Herbert Xu: "API: - Add af_alg_restrict sysctl and white list - Fix potential suspend/resume races in hwrng Algorithms: - Optimize vli additive operations using compiler builtins in ecc Drivers: - Remove unsafe/deprecated algorithms from qce - Mark qce as BROKEN - Add runtime PM and interconnect bandwidth scaling support to qce - Remove crypto_rng from qcom, sun8i and caam - Fix SG list issues in iaa - Fix SEV init path bugs in ccp" * tag 'v7.3-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (122 commits) crypto: lskcipher - propagate errors from unaligned crypt crypto: keembay - use crypto_memneq() to compare CCM AEAD tags crypto: keembay - use crypto_memneq() to compare GCM AEAD tags crypto: sa2ul - use crypto_memneq() to compare AEAD tag hwrng: drivers - use named initializers for acpi_device_id crypto: qce - fix CCM AAD buffer underallocation crypto: iaa - unmap dst before software fallback on decompress crypto: iaa - use bounce buffer for multi-sg decompress input crypto: iaa - avoid counting fallback decompression bytes crypto: iaa - fall back to software for multi-entry scatterlists hwrng: core - Stop/start hwrng_fillfn() kthread before/after suspend-resume crypto: hisilicon/sec2 - fix CCM algorithm long packet failure crypto: eip93 - use struct_size() and flexible array for ring allocation crypto: krb5 - use kfree_sensitive() for derived key buffers crypto: af_alg - Stop after finding name in allowlist crypto: af_alg - Replace 'bool privileged' with flags crypto: af_alg - Make cbc(paes) privileged-only hwrng: imx-rngc - Disable clock on registration failure crypto: qat - remove dead ADF_HEX code crypto: qce - simplify qce_handle_request ...
2026-08-19Merge branch 'kvm-arm64/misc-7.3' into nextOliver Upton
* kvm-arm64/misc-7.3: : Miscellaneous fixes for KVM/arm64, 7.3 : : - Fixes for saving invalid table entries as part of saving the ITS : tables (Fuad Tabba) : : - Don't reallocate the SPI array for re-attempted vgic_init(), avoiding : a memory leak (Fuad Tabba) : : - Hold a reference on an LPI when saving the pending state (Qihang) : : - Don't WARN for out-of-range, guest-supplied INTID (Karl) : : - Avoid corrupting GPRs for 32-bit CP64 reads (Karl) : : - Reset 'in kernel' VGIC state when private IRQ allocation fails (Fuad) : : - Avoid kallsyms lookup in nVHE panic unless the host stage-2 is also : disabled (Vincent) : : - Disregard Pending+Active state when computing maintenance IRQ for : ICH_MISR_EL2.NP (Kajetan) : : - Various Sashiko-identified issues dealing with GICv5 (Sascha) : : - Fix CPU onlining in pKVM due to mismatched accesses when the MMU is : disabled (Will) KVM: arm64: Validate GICv5 timer PPIs before claiming ownership KVM: arm64: vgic: Reject out-of-range GICv5 PPI IDs KVM: arm64: vgic: Prevent speculative SPI array underflow KVM: arm64: vgic: Free gic_kvm_info on initialization failure KVM: arm64: Avoid mismatched accesses to 'struct kvm_nvhe_init_params' KVM: arm64: vgic: Fix detection of MI on no pending LR KVM: arm64: Drop %pB on nVHE panic when stage-2 is active KVM: arm64: vgic: Reset in_kernel on private IRQ allocation failure KVM: arm64: GICv2: Don't WARN on out-of-range GICV_DIR INTID KVM: arm64: Preserve GPRs for AArch32 CP64 reads generating an UNDEF KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables KVM: arm64: vgic-its: Point saved ITEs at the next valid entry KVM: arm64: vgic-its: Don't save collections the table cannot hold KVM: arm64: vgic: Don't leak the SPI array when init is retried KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save Signed-off-by: Oliver Upton <oupton@kernel.org>
2026-08-19Merge branch 'kvm-arm64/vtr-patch' into nextOliver Upton
* kvm-arm64/vtr-patch: : Inline patching of ICH_VTR_EL2 constant, courtesy of Marc Zyngier : : Unify readers of ICH_VTR_EL2 on an instruction-patched constant value, : avoiding system register accesses known to trap under nested : virtualization and sharing the implementation between pKVM and 'regular' : KVM. KVM: arm64: vgic-v3: Kill kvm_vgic_global_state.ich_vtr_el2 KVM: arm64: vgic-v3: Simplify initial GICv3 configuration sampling KVM: arm64: Convert most ICH_VTR_EL2 accesses to inlined literal value KVM: arm64: Add a helper providing an inlined literal value for ICH_VTR_EL2 KVM: arm64: Move GICv3 broken SEIS implementation detection to a CPU errrata KVM: arm64: vgic-v3: Make vtr_to_* helpers use architectural field symbols Signed-off-by: Oliver Upton <oupton@kernel.org>
2026-08-19Merge tag 'iommu-updates-v7.3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux Pull iommu updates from Joerg Roedel: "ARM SMMUv2: - Device-tree binding updates for Qualcomm Eliza, Maili, Shikra and IPQ9650 SoCs - Add support for Qualcomm SM8450 - Numerous fixes for lifetime and ordering issues found by Sashiko in the Qualcomm driver ARM SMMUv3: - Fix interrupt type in device-tree binding example for NVIDIA CMDQV - Numerous fixes for issues identified by Sashiko in the NVIDIA CMDQV driver - Work around TLB erratum T264-SMMU-3 on Tegra264 by repeating the invalidation sequence - Add support for HAFT (hardware access flag in table entries) when using SVA - Probe for 52-bit addressing with a page size smaller than 64k ('DS') but don't do anything with it for now - Minor driver improvements (remove sort_nonatomic(), use readl_relaxed_poll_timeout_atomic(), fix IOPF teardown ordering) Intel VT-d: - Consolidation of complex enablement logic into a clean, priority-based state machine - Support for the DMA_REMAP_OPT_OUT flag from the VT-d v5.2 specification - An update to cache_tag_flush_devtlb_psi() to use full-range constants instead of modifying shared variables for CACHE_TAG_NESTING_DEVTLB - A fix for the UCTP context-table slot when copying root entries - Fixes for several pre-existing issues reported by Sashiko - General code cleanup and refinement AMD IOMMU: - Add SNP page-mode-0 support, enabling passthrough, v2 DMA page tables and host SVA on supporting systems - Fix invalid PPR handling, COMPLETE_PPR responses and guest-mode reporting - Improve Southbridge IOAPIC validation and remove the dependency on hard-coded device IDs - Fix PCI-device lifetime, debugfs and diagnostic issues IOMMU core and IOMMUFD: - Restore serialization of the shared MSI-page list - Fix SVA-handle publication and several IOMMUFD reference and error path leaks - Return the expected zero result for invalid generic page-table translations - Allocate per-CPU IOVA magazines lazily to reduce memory use on large systems PCI ATS: - Make VF support checks account for the associated PF and validate that VF and PF Smallest Translation Unit settings agree Platform drivers: - Fix Qualcomm runtime-PM, probe unwind, fault reporting and page table initialization races - Rework Rockchip state handling and fix clock, probe and stale-fault handling - Fix smaller issues in the MSM and MediaTek drivers Device-tree bindings: - Add new Qualcomm SMMU compatibles, convert the OMAP IOMMU binding to YAML, and fix the Tegra264 CMDQV interrupt example Various smaller cleanups, documentation fixes and a Rust IOMMU safety/readability improvement" * tag 'iommu-updates-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: (93 commits) iommu/amd: Add SNP page mode 0 support iommu/amd: Fix GN bit setting in COMPLETE_PPR_REQUEST command iommu/amd: Rate limit INVALID_PPR_REQUEST error logging iommu/amd: Fix missing CMD_COMPLETE_PPR response for invalid PPR requests iommu/amd: Introduce PPR_TAG_LAST_PAGE() macro iommu/amd: Fix incorrect device ID in invalid PASID error message iommu/vt-d: Flush context cache with correct SID when tearing down aliases iommu/vt-d: Tear down scalable-mode context on probe failure iommu/vt-d: Fix iopf_refcount leak on RID domain replacement iommu/vt-d: Clear Present bit before tearing down copied context entry iommu/vt-d: Fix copied_tables bitmap leak on error in copy_translation_tables iommu/vt-d: Cache max domain ID to avoid redundant calculation iommu/vt-d: Support the new DMA_REMAP_OPT_OUT flag bit iommu/vt-d: Remove dmar_disabled iommu/vt-d: Remove the 'force_on' variable iommu/vt-d: Call dmar_can_force_on() for tboot opt-in iommu/vt-d: Use dmar_can_force_on() for platform opt-in iommu/vt-d: Consolidate dmar policy management and force_on logic iommu/vt-d: Remove dead code when CONFIG_INTEL_IOMMU is not set iommu/vt-d: Force requesting ACS when tboot is enabled ...
2026-08-19Merge branch 'kvm-arm64/vncr-fixes' into nextOliver Upton
* kvm-arm64/vncr-fixes: : Fixes for handling L1 VNCR mappings, courtesy of Marc Zyngier : : - Recompute the VNCR software TLB when the MMU is toggled at stage-1 : : - Improve TLB invalidation intersection to handle TLBIs affecting the : end of the VA space : : - Fix race to invalidate the VNCR fixmap between TLBI emulation and : vcpu_put() : : - Add missing sign extension for computing TLBI ranges : : - Make VNCR invalidation participate in the MMU notifier seqcount, : preventing a concurrent VNCR TLB fill from consuming a stale : translation KVM: arm64: Correctly cap TLBI Range to the architural limit KVM: arm64: Add VNCR TLB tracking again KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry KVM: arm64: Sign-extend VA for range-based TLBI invalidation KVM: arm64: Handle VNCR TLB invalidation race with vcpu_put() VNCR unmapping KVM: arm64: Correctly handle end of VA space TLBI invalidation KVM: arm64: Consider SCTLR_EL2.M when mapping the L1 VNCR page KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation KVM: arm64: Remove VM-wide VNCR mapping counter Signed-off-by: Oliver Upton <oupton@kernel.org>
2026-08-19Merge branch 'kvm-arm64/feat-nv3' into nextOliver Upton
* kvm-arm64/feat-nv3: (29 commits) : Support for FEAT_NV2p1 and FEAT_NV3, courtesy of Marc Zyngier : : Couple of accelerations for nested virtualization: : : - Elide traps for EL1 alias registers when hardware guarantees that : EL2-only bits are stateful (NV2p1) : : - Use TGE-aware hardware to avoid unnecesary ERET/TLBI traps that : remain 'in-context' (i.e. L1 kernel/userspace) arm64: Add override for ID_AA64MMFR4_EL1.NV_frac KVM: arm64: selftest: Add NVHCR_EL2 to get-reg-list KVM: arm64: Expose FEAT_NV3 to guests KVM: arm64: Add FEAT_NV3 detection KVM: arm64: Engage NV3 TLBI trap elision KVM: arm64: Engage NV3 ERET trap elision KVM: arm64: Add NVHCR_EL2 context switching KVM: arm64: Add routing for NVHCR_EL2 trap KVM: arm64: Add NVHCR_EL2 handling to the sysreg array KVM: arm64: Add sanitisation for NVHCR_EL2 KVM: arm64: Make HCR_EL2 a non-VNCR register KVM: arm64: Add kvm_has_nv{2,3}() predicates KVM: arm64: Add NV3 control bits to HCRX_EL2 sanitisation KVM: arm64: Split NV-specific exit fixups from the non-NV handling arm64: Add ARM64_HAS_NV3 capability arm64: sysreg: Add HCRX_EL2 bits related to FEAT_NV3 arm64: sysreg: Add NVHCR_EL2 description as a mirror of HCR_EL2 arm64: Add FEAT_NV2p1 detection KVM: arm64: Expose FEAT_NV2p1 to NV guests KVM: arm64: Relax CNTHCTL_EL2 handling when FEAT_NV2p1 is present ... Signed-off-by: Oliver Upton <oupton@kernel.org>
2026-08-19Merge branch 'kvm-arm64/pkvm-7.3' into nextOliver Upton
* kvm-arm64/pkvm-7.3: (26 commits) : pKVM updates for 7.3 : : - Avoid name collision on trace_clock() when CONFIG_NVHE_EL2_TRACING is : disabled (Mostafa Saleh) : : - Clean up state tracking for whether the EL2 shadow VM has been : created (Fuad Tabba) : : - Synchronize SCTLR_EL1 when injecting an exception to use current : PAN/SSBS state (Fuad Tabba) : : - Avoid unnecessary cache maintenance when I/D-cache are known to be : coherent in pKVM (Mostafa Saleh) : : - Lazy vCPU context save/restore for pKVM (Fuad Tabba) : : - Various fixes to the stage-2 MMU for pKVM (Fuad Tabba) : : - Allow counter offsetting of non-protected guests in protected mode : (Mostafa Saleh) : : - Condition the 'broken CNTVOFF' mitigation on a VM actually having a : nonzero offset, fixing boot failures of pVMs on affected hardware : (Mostafa Saleh) KVM: arm64: Fix hvhe and broken CNTVOFF_EL2 KVM: arm64: Fix timer offsets for non-protected VMs KVM: arm64: Make timer_get_offset() work in all contexts KVM: arm64: selftests: Add stage-2 block transition test KVM: arm64: Don't advertise eager page splitting under pKVM KVM: arm64: Don't WARN on pKVM stage-2 map failures KVM: arm64: Skip pKVM stage-2 flush when FWB is enabled KVM: arm64: Top up stage-2 memcache for dirty logging faults KVM: arm64: Top up the memcache for pKVM permission faults KVM: arm64: Skip cache maintenance for non-cacheable pKVM mappings KVM: arm64: Implement lazy vCPU state sync for non-protected guests KVM: arm64: Add primitives to flush/sync the VGIC state at EL2 KVM: arm64: Minimise EL2's exposure of host VGIC state during world switch KVM: arm64: Add host and hypervisor vCPU lookup primitives KVM: arm64: Move PSCI helper functions to a shared header KVM: arm64: Factor out reusable vCPU reset helpers KVM: arm64: Make vcpu_{read,write}_sys_reg available to HYP code KVM: arm64: Extract MPIDR computation into a shared header KVM: arm64: selftests: Add a userspace watchpoint test KVM: arm64: Flush external_mdscr_el1 to the pKVM hyp vCPU ... Signed-off-by: Oliver Upton <oupton@kernel.org>
2026-08-19Merge branch 'kvm-arm64/pmu-7.3' into nextOliver Upton
* kvm-arm64/pmu-7.3: : vPMU updates for 7.3 : : - Support for slot-based PMU events, relying on new UAPI that makes : selection of a vPMU implementation mandatory (Congkai Tan) KVM: arm64: Add KVM_ARM_VCPU_PMU_V3_STRICT vCPU feature KVM: arm64: Ignore writes to PMCR_EL0.N when using strict UAPI KVM: arm64: Advertise STALL_SLOT* in PMCEID1 under strict PMUv3 UAPI KVM: arm64: Expose PMMIR_EL1.SLOTS under strict PMUv3 UAPI Signed-off-by: Oliver Upton <oupton@kernel.org>
2026-08-19KVM: arm64: Validate GICv5 timer PPIs before claiming ownershipSascha Bischoff
With GICv5, timer PPIs use architecturally defined IDs, and therefore we require userspace to use the architected IDs too. We perform this validation in timer_irqs_are_valid(), which validates the configured PPI after claiming it with kvm_vgic_set_owner(). This is obviously the wrong order, and could both result in a NULL pointer dereference for an ID >= 64 and in an incorrect ownership claim. Switch the order to first validate the PPI before setting the owner. This both prevents an invalid GICv5 timer PPI from reaching the IRQ lookup, and avoids claiming an IRQ for a timer configuration that will be rejected. Fixes: 06c85b58e0b1 ("KVM: arm64: Move GICv5 timer PPI validation into timer_irqs_are_valid()") Link: https://sashiko.dev/#/message/20260810111614.DDC731F000E9%40smtp.kernel.org Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Reviewed-by: Joey Gouly <joey.gouly@arm.com> Reviewed-by: Marc Zyngier <maz@kernel.org> Link: https://patch.msgid.link/20260811150941.941295-5-sascha.bischoff@arm.com Signed-off-by: Oliver Upton <oupton@kernel.org>
2026-08-19KVM: arm64: vgic: Reject out-of-range GICv5 PPI IDsSascha Bischoff
GICv5 supports up to 128 PPIs, but KVM currently implements only the first 64, which contain the architected PPIs it supports. An encoded PPI with an ID outside that range passes irq_is_ppi(), which only checks the encoded interrupt type. vgic_get_vcpu_irq() therefore looks it up in private_irqs[], where array_index_nospec() clamps the out-of-range index to zero and aliases PPI 0. Include the supported PPI range in irq_is_ppi() so that KVM interfaces reject unsupported PPIs. Also reject an out-of-range PPI in the lookup as a safeguard against callers bypassing the predicate. Fixes: 4d591252bacb ("KVM: arm64: gic-v5: Implement PPI interrupt injection") Fixes: eb8bce08ecb1 ("KVM: arm64: gic: Introduce interrupt type helpers") Link: https://sashiko.dev/#/patchset/20260724104819.1296803-1-sascha.bischoff@arm.com?part=27 Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Reviewed-by: Joey Gouly <joey.gouly@arm.com> Reviewed-by: Marc Zyngier <maz@kernel.org> Link: https://patch.msgid.link/20260811150941.941295-4-sascha.bischoff@arm.com Signed-off-by: Oliver Upton <oupton@kernel.org>
2026-08-19KVM: arm64: vgic: Prevent speculative SPI array underflowSascha Bischoff
For a non-GICv5 VM, SPI interrupt IDs include the private-interrupt offset, while KVM's SPI array is indexed from zero. The lookup applies array_index_nospec() to the absolute interrupt ID and subtracts the private-interrupt offset afterwards. On a speculative bypass of the range check for an interrupt ID below the private range, the clamp preserves the small absolute value and the subtraction underflows to an out-of-bounds SPI array index. Convert the interrupt ID to a zero-based index into the SPI array before applying array_index_nospec(). This way, we ensure that we clamp to a reachable SPI ID, rather than an out-of-range SPI index. Fixes: 41b87599c743 ("KVM: arm/arm64: vgic: fix possible spectre-v1 in vgic_get_irq()") Link: https://sashiko.dev/#/patchset/20260724104819.1296803-1-sascha.bischoff@arm.com?part=27 Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Reviewed-by: Joey Gouly <joey.gouly@arm.com> Reviewed-by: Marc Zyngier <maz@kernel.org> Link: https://patch.msgid.link/20260811150941.941295-3-sascha.bischoff@arm.com Signed-off-by: Oliver Upton <oupton@kernel.org>
2026-08-19KVM: arm64: vgic: Free gic_kvm_info on initialization failureSascha Bischoff
vgic_set_kvm_info() allocates gic_kvm_info for use by kvm_vgic_hyp_init(). When a maintenance interrupt is mandatory but not provided, kvm_vgic_hyp_init() returns -ENXIO before reaching the common cleanup path, leaking said allocation. Route this error through that cleanup path so that gic_kvm_info is freed and the global pointer is cleared. Fixes: 0e5cb7770684 ("irqchip/gic: Split vGIC probing information from the GIC code") Link: https://sashiko.dev/#/patchset/20260724104819.1296803-1-sascha.bischoff@arm.com?part=1 Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Reviewed-by: Joey Gouly <joey.gouly@arm.com> Reviewed-by: Marc Zyngier <maz@kernel.org> Link: https://patch.msgid.link/20260811150941.941295-2-sascha.bischoff@arm.com Signed-off-by: Oliver Upton <oupton@kernel.org>
2026-08-19KVM: arm64: Avoid mismatched accesses to 'struct kvm_nvhe_init_params'Will Deacon
When running with hVHE enabled, ___kvm_hyp_init() calls __kvm_init_el2_state() on the CPU initialisation path during onlining and resume from suspend. In order to avoid clobbering the link register across this call, it is stashed away in the 'tmp' member of 'struct kvm_nvhe_init_params', however this save/restore operation is performed with the stage-1 MMU disabled at EL2 and therefore gives rise to coherency problems because the field is not aligned or padded to the CWG. For example, a cacheable write to a physically-adjacent structure sharing the same cacheline could lead to an eviction and subsequent write-back, overwriting the saved LR while the incoming CPU is executing __kvm_init_el2_state(). Save the lr in far_el2 and remove the 'tmp' member from 'struct kvm_nvhe_init_params' altogether. Cc: Oliver Upton <oupton@kernel.org> Cc: Marc Zyngier <maz@kernel.org> Fixes: afa9b48f327c ("KVM: arm64: Shave a few bytes from the EL2 idmap code") Signed-off-by: Will Deacon <will@kernel.org> Reviewed-by: Marc Zyngier <maz@kernel.org> Link: https://patch.msgid.link/20260813131717.5885-1-will@kernel.org Signed-off-by: Oliver Upton <oupton@kernel.org>
2026-08-19Merge tag 'driver-core-7.3-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core Pull driver core updates from Danilo Krummrich: "container_of: - Apply typeof_member(), remove the local __mptr variable to eliminate variable shadowing warnings on nested container_of() calls, and remove unnecessary parentheses core: - Add driver name to probe debug print for initcall_debug - Avoid repeatedly printing the same 'Fixed dependency cycle' log - Unwind device_add() on attribute creation failure in attribute_container_add_class_device() - Remove statistics group if encryption group creation fails in transport_add_class_device() debugfs: - Fix lockdown check for mmap_prepare() - Warn if file creation failed due to uninitialized debugfs device property: - Implement fw_devlink support for software nodes by adding software_node_add_links(), which creates fwnode links from DEV_PROP_REF properties to enable automatic probe ordering. Add kunit-managed fwnode helpers and test coverage - Fix infinite loop in fwnode_for_each_child_node() when the secondary fwnode has more than one child. Add test cases - Fix out-of-bounds access in software_node_get_reference_args() when called with index -1 (UINT_MAX) - Refactor to use RAII approach with __free() - Add Bartosz Golaszewski as software node reviewer firmware loader: - Fix race where a sysfs fallback request can complete before being queued as pending, leading to a use-after-free on the next fallback request - Reject 0-size built-in firmware and fail the build on empty firmware files in CONFIG_EXTRA_FIRMWARE kobject: - Provide __KOBJ_ATTR() and __KOBJ_ATTR_RO/WO() initialization macros and allow the constification of kobject attributes, enabling them to reside in read-only memory platform: - Provide platform_device_set_of_node(), platform_device_set_fwnode(), and platform_device_set_of_node_from_dev() helpers that encapsulate firmware node reference counting for dynamically allocated platform devices Convert all in-tree users that manually assigned dev.of_node or dev.fwnode, fixing a pre-existing refcount bug in powermac. Switch to counting references of all firmware node types, not only OF nodes - Unify the release path for dynamically allocated platform devices by removing platform_device_release_full(). Amend the fwnode setter API contract to warn if a primary software node is overwritten. Add KUnit tests for correct software node removal on device unregistration Rust: - Auxiliary: - Add registration_data_with() closure-based API for invariant ForLt types - Debugfs: - Migrate BinaryWriter and BinaryReaderMut trait requirements from kernel::transmute traits to zerocopy traits - Device: - Add BoundInternal device context and InternalBoundContext trait for bus abstractions that need internal access to a bound device. - Make the lifetime on Core and CoreInternal invariant to prevent coercion to shorter lifetimes - Devres: - Fix race between concurrent revokers where the losing revoker could return before the winning revoker finished dropping the inner data, causing use-after-free. - Ensure revocation is complete before the device finishes unbinding by making the synchronization bidirectional. - Add DevresLt<F: ForLt>, a wrapper around Devres that shortens 'static back to the caller's borrow scope. Implement ForLt and CovariantForLt for Bar, IoMem, and ExclusiveIoMem - Driver: - Switch from index-based to pointer-based device ID info lookup, storing static references in driver_data. Centralize device ID handling in device_id.rs, removing the open-coded ACPI/OF matching logic and duplicate ID table from driver.rs - I/O: - Make I/O regions typed (with a dynamically-sized Region type for the existing untyped case), create view types representing subregions of a mapped I/O region, and add io_project!() for safely creating subviews. - Split Io into a base trait (IoBase) and an extension trait (Io) with a blanket implementation, preventing implementers from overriding provided methods that unsafe code relies on. - Add a SysMem backend for shared system memory with volatile access, and make Coherent implement Io via an I/O view type. Add IoSysMap as sum type of Mmio and SysMem. Add copying methods (memcpy_{from,to}io()) and read_val()/write_val() for typed access. - Replace dma_read!()/dma_write!() with io_read!()/io_write!() for primitives and copying methods for aggregates; drop the old macros. Convert nova-core to use I/O projection. - Fix internal shortcut rule dispatch in the register!() macro, remove unused rule arguments, and use path fragments for alias destinations - IRQ: - Make irq::Registration compatible with lifetime-bound drivers by removing the 'static bound on Handler/ThreadedHandler and replacing Devres<RegistrationInner> with direct request_irq()/free_irq() calls. Handlers can now directly own lifetime-bound device resources - PCI: - Convert IrqVectorRegistration to a lifetime-annotated owning type, giving drivers explicit control over the allocation lifetime. IrqVector embeds a resolved IrqRequest, making the conversion infallible. Remove the redundant request_irq()/request_threaded_irq() wrappers from pci::Device. - Add pci_irq_type() C helper and expose it via irq_type() on IrqVectorRegistration and IrqVector, returning PCI_IRQ_MSIX, PCI_IRQ_MSI, or PCI_IRQ_INTX. - Mark pci::Device refcount methods inline - Serdev: - Add Rust abstractions for the serial device bus, including serdev::Driver trait, serdev::Device wrapping struct serdev_device, and serdev::Adapter implementing RegistrationOps. Includes a sample driver. Markus Probst takes over as serdev maintainer for both C and Rust code - Misc: - Split ForLt into a base trait (providing the Of<'a> GAT) and an unsafe CovariantForLt subtrait guaranteeing covariance, enabling invariant types (e.g. those containing Mutex<&'bound T>) to participate in the ForLt abstraction. - Fix Coherent read past EOF returning -ERANGE instead of zero. - Fix firmware example UB by avoiding null-pointer ARef misc: - Avoid iattr allocation in kernfs listxattr by using kernfs_iattrs_noalloc(). - Unregister SoC bus on early device registration failure. - Remove unused DMA_FENCE_TRACE Kconfig symbol. - Fix /sys/module path in comment. - Refactor ISA bus init to remove nested blocks. - Remove redundant nodemask clears in numa_init(). - Add kernel-doc for fwnode_operations and sys_soc.h, mark internal property data as private for kernel-doc, and add property.h/fwnode.h to driver-api infrastructure docs. - Add MAINTAINERS entry for sys_soc.h" * tag 'driver-core-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: (129 commits) rust: pci: expose the allocated interrupt type PCI: Add pci_irq_type() to query the allocated interrupt type rust: pci: remove request_irq() and request_threaded_irq() from Device rust: pci: resolve IRQ in index() and embed IrqRequest in IrqVector rust: pci: convert IrqVectorRegistration to a lifetime-managed owning type kernfs: avoid iattr allocation in listxattr rust: serdev: use ThisModule::as_ptr() instead of field access ACPI/IORT: use platform_device_set_fwnode() ACPI/APMT: use platform_device_set_fwnode() firmware_loader: do not queue completed sysfs fallback requests rust: pci: Mark Device refcount methods inline rust: irq: make Registration compatible with lifetime-bound drivers rust: net/phy: remove expansion from doc rust: dma: return zero for Coherent reads past EOF rust: io: register: use path fragment for alias destination rust: io: register: remove unused rule arguments rust: io: register: dispatch shortcut rules internally MAINTAINERS: add sys_soc.h to DRIVER CORE rust: debugfs: remove unsafe blocks from traits impl for Vec rust: debugfs: migrate debugfs traits requirements to zerocopy ...
2026-08-19Merge tag 'gpio-updates-for-v7.3-rc1-v2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio updates from Bartosz Golaszewski: "GPIO core: - extend the gpio-regmap abstraction layer with more features allowing users to override configuration setting, translate register values and masks and enable/disable interrupts - extend GPIO kunit tests with suites verifying probe ordering by software node devlink support and software node hogs - shrink GPIO kunit initialization code - coding style updates (remove commas from sentinels where applicable) - with all users now converted treewide to using real firmware node links for software node GPIO lookup: remove the deprecated label-matching mechanism from from GPIO core - drop redundant return value check of nonseekable_open() in gpiolib-cdev - use IRQ trigger helpers where applicable Driver updates: - refactor error paths and logging in gpio-nomadik - use more modern interfaces for getting resources in gpio-rockchip, gpio-bt8xx and gpio-pca9570 - add missing MODULE_DEVICE_TABLE() to gpio-sifive and gpio-vf610 - drop unused FILONOFF macro from gpio-rcar - extend build coverage of ioport GPIO drivers with COMPILE_TEST=y - only enable the gpio-rtd driver by default with ARCH_REALTEK=y to avoid bloating the build - refactor coding style in several drivers - use correct endianess translation in gpio-pcf85x - add wake-up interrupt support to gpio-mvebu - apply initial value in direction output setter in gpio-by-pinctrl Misc: - replace linux/gpio.h inclusions treewide with linux/gpio/legacy.h which now exports all the deprecated APIs - select GPIOLIB_LEGACY in Kconfig where required treewide - use software nodes for gpio-keys in MFD drivers Devicetree bindings: - describe the realtek rtd1625 GPIO controller - document new models for gpio-pca95xx and gpio-cadence - document new property in gpio-rockchip" * tag 'gpio-updates-for-v7.3-rc1-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (61 commits) gpio: gpio-by-pinctrl: Apply initial value in direction output wrapper dt-bindings: gpio: rockchip,gpio-bank: Add rockchip,grf property gpio: Use IRQ trigger mask helpers gpio: allow COMPILE_TEST for IOPORT drivers gpio: realtek: Add driver for Realtek DHC RTD1625 SoC gpio: regmap: Add IRQ enable/disable helpers gpio: regmap: Add set_config callback gpio: regmap: Add value_xlate callback gpio: regmap: Add gpio_regmap_operation to extend reg_mask_xlate callback gpio: regmap: Order kernel-doc descriptions with the actual appearance gpio: regmap: Apply default resource callbacks for regmap IRQ chip gpio: regmap: Provide default IRQ resource request and release callbacks Revert "gpio: realtek: Add driver for Realtek DHC RTD1625 SoC" gpib: gpio: replace linux/gpio.h inclusion Input: matrix_keyboard - replace linux/gpio.h inclusion phy: replace linux/gpio.h inclusions pcmcia: replace linux/gpio.h inclusions ASoC: replace linux/gpio.h inclusions mfd: replace linux/gpio.h inclusions sh: replace linux/gpio.h inclusions ...
2026-08-18Merge tag 'soc-arm-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/socLinus Torvalds
Pull ARM SoC platform updates from Arnd Bergmann: "The 32-bit Arm platforms are a bit more interesting this time: I refreshed an earlier series to mark code as deprecated that does have the tendency of getting in the way of cleanups and new features but has close to zero users. Among these are: - 22 of the remaining 28 legacy board files that predate the current devicetree based descriptions, using old chips from Intel and Marvell. The remaining six board files are for TI OMAP1 and Samsung s3c64xx chips and all still have known users. - support for Cortex-M3/M4/M7 and ARM1136r0 CPU cores and the 25 machines based on these. These all use devicetree but the CPU support causes disproportional work. Most of them are just reference boards, the notable exceptions being the Nokia N800/N810 tablet and the Buglabs BUG platform. - be8, be32, oabi and iwmmxt userspace binaries, which were mostly associated with the platforms now scheduled for removal and are increasingly problematic to support with modern toolchains. Nothing is actually removed at this point, to ensure that any remaining users continue to have the 7.3-LTS for a while longer. Patches for removal are currently being tested. Other updates include a continued work to convert GPIO number based interfaces to descriptors, a patch to restore little-endian mode on the one Arm platform (ixp4xx) that only worked in big-endian mode recently, and some minor cleanups and bugfixes" * tag 'soc-arm-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (41 commits) MAINTAINERS: Drop redundant lists from various Samsung entries ARM: tegra: Replace __ASSEMBLY__ with __ASSEMBLER__ ARM: tegra: Fix OF node reference leaks in IRQ init ARM: lpc32xx: remove a few manually populated OF devices ARM: lpc32xx: only run SoC init on LPC32xx hardware firmware: imx: scu: manage mailbox channels and global handle ARM: sa1100: h3xxx: convert gpio-keys to use software nodes ARM: sa1100: collie: convert gpio-keys to use software nodes ARM: sa1100: assabet: convert gpio-keys to use software nodes gpio: sa1100: register software node for GPIO controller ARM: ixp4xx: Relax endianness ARM: replace linux/gpio.h inclusions soc: imx9: devm_kasprintf error handling ARM: mark mv78xx0 support as deprecated ARM: mark axxia platform as deprecated ARM: mark Cortex-M3/M4/M7 based boards as deprecated ARM: mark footbridge as deprecated ARM: mark RiscPC as deprecated ARM: mark mach-sa1100 as deprecated ARM: orion5x: mark all board files as deprecated ...
2026-08-18Merge tag 'soc-defconfig-7.3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC defconfig updates from Arnd Bergmann: "Just the usual updates to the main defconfig files as well as the omap2 specific one, to enable more loadable modules for better default hardware support" * tag 'soc-defconfig-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: riscv: defconfig: thead: enable PCA953X GPIO driver arm64: defconfig: Enable drivers for BeagleBadge arm64: defconfig: Enable Qualcomm BAM-DMUX WWAN driver arm64: defconfig: Enable Sound DMIC driver arm: omap2plus_defconfig: Enable multi-LED arm64: defconfig: Enable Qualcomm reference device EC driver ARM: omap2plus_defconfig: enable things required by iwd arm: multi_v7_defconfig: Enable BRIDGE and DP83848_PHY for TI AM57xx, AM437x and AM335x arm64: defconfig: Enable Allwinner LRADC input driver
2026-08-18Merge tag 'soc-drivers-7.3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC driver updates from Arnd Bergmann: "The SoC driver changes once more consist of many small fixes and cleanups, that are to a large part the result of automated testing. On platform specific drivers, this includes SoC specific code for xilinx, freescale/nxp, qualcomm, TI, aspeed, omap, tegra, samsung, rockchip, renesas, ixp4xx. In firmware drivers, we see a similar picture for SCMI and qcomtee. Aside from these, we see actual new hardware support in a few areas: - The Apple platform gets a new driver for low power states - Updates to Qualcomm platform drivers add several new hardware specific features and additional SoCs. - Amlogic SoC support for A1 and T7 is added - The Mediatek MMSYS driver is refactored as a cleanup" * tag 'soc-drivers-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (157 commits) soc: qcom: make QCOM_PDR_MSG selectable soc: qcom: ubwc: Fix missing include soc: qcom: ubwc: Fix link error when QCOM_SMEM=n media: iris: Guard the QCOM_UBWC_CONFIG select with QCOM_SMEM drm/msm: Guard the QCOM_UBWC_CONFIG select with QCOM_SMEM dt-bindings: arm: qcom,ids: Add SoC ID for Snapdragon SDM 850 firmware: xilinx: Clear firmware notifiers across kexec transitions firmware: xilinx: Release all peripheral devices from firmware firmware: xilinx: Add support to clear EL3 PM state firmware: xilinx: Propagate actual error from feature check firmware: xilinx: Use TF-A feature check for TF-A-specific APIs bus: fsl-mc: drop unused assignment of acpi_device_id::driver_data soc: fsl: qe: check platform_driver_register() in qe_ic_of_init() phy: lynx-10g: use RCW override procedure for dynamic protocol change soc: fsl: guts: implement the RCW override procedure dt-bindings: fsl: layerscape-dcfg: define DCFG_DCSR region soc: fsl: guts: make fsl_soc_data available after fsl_guts_init() soc: fsl: guts: make it easier to determine on which SoC we are running soc: fsl: guts: add a central fsl_guts_read() function soc: fsl: guts: add a global structure to hold state ...
2026-08-18Merge tag 'soc-dt-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/socLinus Torvalds
Pull SoC devicetree updates from Arnd Bergmann: "There are two new mystery SoCs with very little public information about them so far, Qualcomm's Cortex-A78C based "Shikra" and Altera's Cortex-A720 based Agilex72 SOCFPGA. We have also gained support for a couple of SoCs from the 2023/2024 timeframe that have been in the making for a while: - The Apple platform gains support for M3 Pro, Max and Ultra SoC, following the basic M3 support from 7.2. - Samsung Exynos 1580 is a high-end mobile phone SoC from 2024 - Canaan K230 is a RISC-V based 64-bit AI SoC, based on the earlier K210 chip - Sophgo SG2000 is a mixed Arm/RISC-V chip that was already supported using the Arm core but is now also added for RISC-V along with several other variants of the cv18xx series In terms of newly added machines we have reference platforms for all the chips above, plus - Only four 32-bit Arm boards: two older phones and two older industrial/embedded boards; using Allwinner, Qualcomm and Rockchip SoCs - Three laptops und three phones using Qualcomm SoCs - Ten 64-bit Rockchips based single-board computers, along with one NAS box and a game console. - Seven industrial/embedded boards and modules using NXP i.MX8/9 SoCs. - A Lenovo desktop box based on NVIDIA Jetson Xavier NX - A few more single-board computers based on Allwinnner A133, Spacemit K1 and TI AM62. As usual, there is a constant stream of minor cleanups and fixes towards addressing the 'dt-check-style --mode strict' warnings, and everyone is expected to address those warnings for new submissions now" * tag 'soc-dt-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (864 commits) Revert "riscv: dts: spacemit: k3: add i2s0-i2s5 nodes" Documentation/process: maintainer-soc: Mention expectation about dt-check-style ARM: dts: helios4: add SATA regulator supplies ARM: dts: helios4: add vcc-supply to GPIO expander ARM: dts: helios4: add vcc-supply to EEPROM arm64: dts: turris-mox: fix usb3 phys arm64: dts: ti: Correct white-space style arm64: dts: ti: k3-am64: Fix MDIO clock reference for ICSSG0 node arm64: dts: qcom: talos-evk: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: sa8155p-adp: Fix swapped USB and UFS QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: eliza-mtp: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: lemans: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: glymur: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: kaanapali: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: sar2130p: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: sm8750: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: sm8650: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: purwa: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: hamoa: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: sc8180x: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies ...
2026-08-18Merge tag 'alpha-for-v7.3-tag' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/lindholm/alpha Pull alpha updates from Magnus Lindholm: "This contains two fixes for Alpha floating-point exception handling, two clang-related fixes, the preparatory changes from the generic-entry series, an interrupt-entry lockdep fix, two Marvel/EV7 IRQ fixes, an RTC fix, and one header cleanup. The generic-entry preparation adds regset-based ptrace and core dumps, ARCH_STACKWALK and lockdep hardirq-state tracking. These changes are useful independently and enable previously missing debugging facilities on Alpha. The final patch switching Alpha to GENERIC_ENTRY is intentionally not included in this pull request. I am deferring that change to allow further testing and to reduce the risk of conflicts with ongoing entry-path work elsewhere in the kernel" * tag 'alpha-for-v7.3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/lindholm/alpha: alpha: read $gp and $sp explicitly for clang alpha: pass -Wa,-mev6 only when using GNU as alpha: annotate hardirqs-off on IPL 7 interrupt entry alpha: run the remote RTC access in a worker, not an IPI callback alpha: don't leak hardware-fabricated FP exception bits to user space alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally alpha: enable lockdep hardirq state tracking alpha: use raw spinlocks for low-level platform locks alpha: provide ftrace return address support for lockdep alpha: make irqflags helpers operate on IPL state alpha: add ARCH_STACKWALK-based stacktrace support alpha: enable regset-based ptrace and core dumps alpha: marvel: Fix lock ordering in init_io7_irqs() alpha: marvel: Fix irq_set_status_flags to use correct IRQ number alpha: remove unnecessary architecture-specific <asm/device.h>
2026-08-18Merge tag 'csky-for-linus-7.3' of https://github.com/c-sky/csky-linuxLinus Torvalds
Pull csky update from Guo Ren: - Fix a4/a5 restoration in syscall trace path * tag 'csky-for-linus-7.3' of https://github.com/c-sky/csky-linux: csky: Fix a4/a5 restoration in syscall trace path
2026-08-18Merge tag 'x86_cpu_for_v7.3_rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cpuid updates from Borislav Petkov: - Get rid of static_cpu_has() - one less API to care about testing CPU features - Unify the handling of CPU core types (performance, efficient, etc) by mapping the vendor-specific types to Linux ones - Continuation of the work of Ahmed Darwish to centralize CPUID leaf representation * tag 'x86_cpu_for_v7.3_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/CPU: Rename struct cpuid_read_output to struct cpuid_output x86/cpu/scattered: Sort it properly x86/cpu: Use parsed CPUID(0x1) x86/lib: Add CPUID(0x1) family and model calculation x86/cpu: Use parsed CPUID(0x0) x86/cpu/transmeta: Rescan CPUID(0x1) after modifying capabilities x86/topology: Add TOPO_CPU_TYPE_LOW_POWER x86/topology: Name the AMD core-type values x86/topo: Map vendor CPU types to generic Linux such types x86/bugs: Don't use cpu-type matching in cpu_vuln_blacklist x86/cpu: Hide and rename static_cpu_has()
2026-08-18Merge tag 'x86_cleanups_for_v7.3_rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cleanups from Borislav Petkov: - The usual pile of smallish cleanups and fixlets all over the place * tag 'x86_cleanups_for_v7.3_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/cpu: Remove unnecessary __maybe_unused annotations x86/msr: Document the I/O-like write semantics in the msr driver x86/apic: Ensure ICR register write value is handled as 32 bits x86/boot/compressed/head_64.S: Clean up SEV-related comments Documentation/arch/x86/amd-memory-encryption.rst: Fix typo x86/platform/quark: Fix kernel-doc warnings in imr.c x86/ras: Move contents from arch/x86/ras/Kconfig into drivers/ras/Kconfig x86/cpu: Move intel_get_platform_id() to cpu/intel.c x86/mm: Fix typo in comment x86/fpu: Fix kernel-doc formatting above fpu_enable_guest_xfd_features() x86/cfi: Use symmetric SYM_START and SYM_END in __CFI_TYPE() x86/cfi: Add __init_or_module annotations for fineibt
2026-08-18Merge tag 'x86_cache_for_v7.3_rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 resource control updates from Borislav Petkov: - How refreshing: no new features but a whole pile of fixes to more or less serious issues reported by Sashiko along with miscellaneous cleanups all over the place. All except one by Reinette Chatre, the one by Tony Luck. * tag 'x86_cache_for_v7.3_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: fs/resctrl: Inform user space when status buffer overflowed fs/resctrl: Communicate resource group deleted error via last_cmd_status fs/resctrl: Add last_cmd_status support for writes to max_threshold_occupancy fs/resctrl: Change last_cmd_status custom during input parsing fs/resctrl: Use accurate and symmetric exit flows fs/resctrl: Pass error reading event through to user space fs/resctrl: Use accurate type for rdt_resource::rid fs/resctrl: Change pattern used to track number of entries in enum resctrl_conf_type x86/resctrl: Protect against bad shift fs/resctrl: Use correct format specifier for printing error pointers fs/resctrl: Fix UAF from worker threads when domains are removed x86/resctrl: Ensure domain fully initialized before placed on RCU list fs/resctrl: Prevent deadlock and use-after-free in info file handlers fs/resctrl: Prevent use-after-free in rdtgroup_kn_put() fs/resctrl: Fix deadlock on errors during mount fs/resctrl: Move functions to avoid forward references in subsequent fixes x86,fs/resctrl: Document safe RCU list traversal
2026-08-18Merge tag 'x86_alternatives_for_v7.3_rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 alternatives update from Borislav Petkov: - Remove the smp_locks alternatives machinery which was used to patch out lock prefixes when running a SMP kernel on a uniprocessor machine * tag 'x86_alternatives_for_v7.3_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/alternative: Drop smp_locks glue
2026-08-18Merge tag 'x86_mm_for_7.3-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 mm updates from Dave Hansen: "There are two things in here of note. First, there are fixes to reduce the time that the TLB flushing code sits around with interrupts disabled. It should be well tested, but it's certainly something to keep an eye on. Second is a little back-and-forth in the interactions between the set_memory*() locking and DEBUG_PAGEALLOC. There was a slightly painful re-discovery of why DEBUG_PAGEALLOC has special locking rules, but the code did end up better for it. Summary: - Fix pkey_alloc() return value when pkeys are not supported - Allow preemption during IPI completion waiting to improve wakeup latency - Convert more x86 page table code to ptdescs - Fixes and cleanups for set_memory*() locking, mostly around large pages" * tag 'x86_mm_for_7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/pkeys: Fix pkey_alloc() return value when pkeys are not supported x86/mm: Fix and document DEBUG_PAGEALLOC x86/mm: Use guard() for pgd_lock x86/mm: Use guard() in cpa_collapse_large_pages() x86/mm: Re-enable preemption before flush_tlb_multi() x86/kvm: Disable preemption in kvm_flush_tlb_multi() x86/mm: Move flush_tlb_info back to the stack x86/mm: Cap flush_tlb_info alignment at 64 bytes x86/mm: Factor out flush_tlb_info initialization x86/mm/pat: Take cpa_lock around large-page collapse x86/mm/pat: Don't gate cpa_lock on debug_pagealloc_enabled() x86/xen: Convert xen_mm_unpin_all() to ptdescs x86/xen: Convert xen_mm_pin_all() to ptdescs x86/mm: Convert pgd_page_get_mm() to ptdescs x86/mm: Convert sync_global_pgds_l4() to ptdescs x86/mm: Convert sync_global_pgds_l5() to ptdescs x86/mm: Convert arch_sync_kernel_mappings() to ptdescs x86/mm/pat: Convert collapse_pmd_page() to ptdescs x86/mm/pat: Convert __set_pmd_pte() to ptdescs x86/mm/pat: Use IS_ENABLED() instead of ifdef
2026-08-18Merge tag 'x86_tdx_for_7.3-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 TDX updates from Dave Hansen: "TDX guests cause #VE exceptions whenever they do port I/O. The guest then does some instruction decoding and makes a call up to the host for help. That decoding had a couple of bugs. Fix those bugs. Use an existing and now shared KVM helper for one of them" * tag 'x86_tdx_for_7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/tdx: Fix zero-extension for 32-bit port I/O x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg() x86/tdx: Fix off-by-one in port I/O handling
2026-08-18Merge tag 'x86_misc_for_7.3-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull misc x86 updates from Dave Hansen: "Just adding some documentation and removing a super stale comment about an LED driver that was moved long ago: - Document the intricacies of GS context switching - Remove old TODO message about Geode LED driver" * tag 'x86_misc_for_7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/platform/geode: Remove old TODO message about leds-net5501.c Documentation/x86: Document the intricacies of GS context switching
2026-08-18Merge tag 'x86_entry_for_7.3-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 entry update from Dave Hansen: "Fix frame pointer unwinder when it encounters FRED stack frames" * tag 'x86_entry_for_7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/entry/fred: Encode frame pointer on entry
2026-08-18Merge tag 'timers-vdso-2026-08-17' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull VDSO updates from Thomas Gleixner: - Consolidate the VDSO datastore further and provide support for mlock_all() and prefaulting. - Provide 32-bit legacy time related functionality only if CONFIG_COMPAT_32BIT_TIME is enabled. The config switch exists, but architecture code still exposes the legacy functionality even disabled. Clean this up by adding the missing guards and validating at build time that the VDSO is legacy free if disabled. - Consolidate the VDSO related config options in core and drivers, which removes some non-sensical dependencies and quite an amount of #ifdeffery. - Clean up the PAGE_SIZE definition maze * tag 'timers-vdso-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (30 commits) random: vDSO: Drop custom PAGE_SIZE definitions LoongArch: Remove CONFIG_GENERIC_GETTIMEOFDAY ifdeffery clocksource/drivers/timer-riscv: Remove CONFIG_GENERIC_GETTIMEOFDAY ifdeffery clocksource/drivers/arm_arch_timer: Remove CONFIG_GENERIC_GETTIMEOFDAY ifdeffery clocksource/drivers/mips-gic-timer: Remove CONFIG_GENERIC_GETTIMEOFDAY ifdeffery MIPS: csrc-r4k: Remove CONFIG_GENERIC_GETTIMEOFDAY ifdeffery vDSO: Make clockmode constants available without CONFIG_GENERIC_GETTIMEOFDAY kbuild: Support generated asm-headers in subdirectories vdso: Rename HAVE_GENERIC_VDSO to VDSO_DATASTORE vdso: Drop HAVE_GENERIC_VDSO from architecture kconfig files vdso: Automatically select HAVE_GENERIC_VDSO if necessary MIPS: vdso: Stop using CONFIG_HAVE_GENERIC_VDSO vdso: Remove the dependency on HAVE_GENERIC_VDSO from ARCH_HAS_VDSO_ARCH_DATA futex: Remove dependency on HAVE_GENERIC_VDSO from FUTEX_ROBUST_UNLOCK vdso/gettimeofday: Verify COMPAT_32BIT_TIME interactions sparc: vdso: Respect COMPAT_32BIT_TIME MIPS: VDSO: Respect COMPAT_32BIT_TIME powerpc/vdso: Respect COMPAT_32BIT_TIME ARM: VDSO: Respect COMPAT_32BIT_TIME arm64: vdso32: Respect COMPAT_32BIT_TIME ...
2026-08-18Merge tag 'timers-core-2026-08-17' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer and timekeeping core updates from Thomas Gleixner: - Fix a subtly inconsistency in the timekeeping code, which fails to account for the monotonicity adjustment in ntp_error. For small changes of the clocksource multiplicator (+/-1) which are typically used by the NTP PLL this is hard to observe. But for larger adjustments, e.g. caused by a direct frequency setting through adjtimex() the one-time uncompensated offset is significant. Cure this by adjusting ntp_error with the resulting offset so that the discrepancy is smoothed away over time - Make tick length calculations correct in NTP. The timekeeping core takes the quantisation of the clocksource into account when calculating the tick length to compensate for the deviation of the nominal NTP_INTERVAL_LENGTH. While timekeeping gets this right, NTP is not aware of that, which means it operates on the nominal value and not on the actual value which is determined by the clock source frequency. The rounding of a coarse clocksource like the ACPI PM timer results in a +127 PPM deviation. Cure this by exposing the deviation to the NTP code so that it can operate on the same data as the timekeeping core. This is purely kernel internal. User space still sees the nominal tick lenght via adjtimex(). - The accuracy of the NTP adjustments is fairly approximate as the code assumes that the invocations are precisely in NTP interval frequency ticks and the final adjustment can over and under-run. Cure this by adjusting ntp_error by the intended skew on each tick to achieve the desired rate. - Handle the two competing skews of time offset and time adjustment correctly by calculating the conflict portion between the skews and adjusting both accordingly. - A set of updates and improvements for the selftests - The usual small fixes and improvements all over the place * tag 'timers-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (58 commits) selftests: timers: nsleep-lat: Check all calls to clock_nanosleep() and clock_gettime() selftests: timers: nsleep-lat: Reuse kselftest error numbers selftests: timers: nsleep-lat: Explicitly list the tested clocks selftests: timers: nsleep-lat: Use NSEC_PER_MSEC define for unreasonable latency selftests: timers: nanosleep: Report each test separately selftests: timers: nanosleep: Explicitly handle timer_delete() failure selftests: timers: nanosleep: Move all single clock tests out of the loop in main() selftests: timers: nanosleep: Reuse kselftest error numbers selftests: timers: nanosleep: Explicitly list the tested clocks selftests: timers: nanosleep: Drop output alignment selftests: timers: Use clock_name() and constants from clock-helpers.h selftests: Add clock-helpers.h timer_list: Use ktime_t over nanoseconds timer_list: Use standard 'long long' format placeholders hrtimer: Add a lockdep assertion to hrtimer_update_base() timekeeping: Use u32 for clock_was_set_seq timekeeping: Rename clockid_aux_valid() to clockid_is_aux_clock() hrtimer: Account nr_retries on recovered interrupt retries timers/itimer: Zero-init old itimerval before copy to userspace nohz: Replace dead select with choice default ...
2026-08-18Merge tag 'timers-cleanups-2026-08-17' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull treewide timer related cleanups from Thomas Gleixner: - Remove the leftover CLOCK_TICK_RATE which has been scheduled for removal more than a decade ago along with some now empty asm/timex.h files. - Consolidate delay timer calibration The construct of having a define in a header requires that architectures provided asm/timex.h for no reason. Also the function name for reading the delay timer is confusing at best. Use a config switch to enable that functionality and rename the function to delay_read_timer() to make the purpose clear. This removes some more now empty asm/timex.h files as well. * tag 'timers-cleanups-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: calibrate: Rework delay timer calibration treewide: Remove CLOCK_TICK_RATE x86: Use PIT_TICK_RATE instead of CLOCK_TICK_RATE