summaryrefslogtreecommitdiff
path: root/include
AgeCommit message (Collapse)Author
2026-08-07scsi: ufs: Add support for the aggregated read query opcodeHyeoncheol Jeong
UFS 5.0 / JEDEC 220H introduces the AGGREGATED READ query opcode (0x9), which retrieves an aggregated data packet in a single query request. The packet may bundle multiple Descriptors, Attributes and Flags as group-headed groups, returned in the Data Segment of the QUERY RESPONSE UPIU. Such a packet can be far larger than a single descriptor (up to a few KiB vs the 255-byte descriptor limit), so its response UPIU buffer must be enlarged. Enlarging the shared utp_transfer_cmd_desc would waste that extra space per tag, so add a dedicated utp_devman_cmd_desc with a 4 KiB response area (ALIGNED_DEVMAN_RSP_SIZE), allocated once for the reserved (device management) tag that aggregated read uses. Regular tags keep the 512-byte descriptor in a pool of (nutrs - UFSHCD_NUM_RESERVED) entries, leaving normal I/O unchanged. ufshcd_init_lrb() and ufshcd_host_memory_configure() pick the devman descriptor for the reserved tag and index the pool at (tag - UFSHCD_NUM_RESERVED) otherwise. The pre-4.1 MCQ tag recovery adds one compare against the devman UCD address and returns the reserved tag (UFSHCI 4.1+ carries the tag in the CQE), and the BSG raw-UPIU and device management paths learn the new opcode, sizing descriptors by QUERY_AGGREGATED_MAX_SIZE. Signed-off-by: Hyeoncheol Jeong <hyenc.jeong@samsung.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/20260728092741epcms2p8c53432ef3c2f0d6a63dd980ad5ef9f00@epcms2p8 Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-07iio: adc: qcom-spmi-adc5-gen3: Share SDAM0 IRQ with ADC_TM auxiliary driverJishnu Prakash
The SDAM0 IRQ can be triggered for both EOC (end of conversion) events for immediate ADC reads done in this driver and for threshold violation events, based on ADC_TM thresholds configured from the auxiliary ADC_TM driver on TM channels on the first SDAM. At present, this interrupt is handled only in the ISR in the main ADC driver. When the ISR is triggered for an ADC_TM event, this driver notifies the ADC_TM driver by calling a notifier callback exposed from it for this purpose. To simplify the interrupt handling in both drivers, share the interrupt between the drivers. With this, ADC_TM interrupts on SDAM0 will be handled directly in the ADC_TM driver, so remove the notifier callback and all TM interrupt handling in the main ADC ISR. Signed-off-by: Jishnu Prakash <jishnu.prakash@oss.qualcomm.com> Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org> Reviewed-by: Jonathan Cameron <jic23@kernel.org> Link: https://patch.msgid.link/20260722-gen3_adc_tm-v4-2-011981f756c8@oss.qualcomm.com
2026-08-07scsi: core: pair EH runtime PM get and putHongjie Fang
shost->eh_noresume is currently consulted twice in one error handling iteration: once before scsi_autopm_get_host() and once again before scsi_autopm_put_host(). That is racy when a PM-triggered error path flips shost->eh_noresume while the SCSI EH thread is still running. The problem flow looks like this: PM path ufshcd_set_dev_pwr_mode() shost->eh_noresume = 1 ufshcd_execute_start_stop <-- trigger EH ... shost->eh_noresume = 0 EH path scsi_error_handler() if (!shost->eh_noresume) scsi_autopm_get_host() <-- skipped ... if (!shost->eh_noresume) scsi_autopm_put_host() <-- executed later In that case one EH iteration can skip autoresume on entry and still drop a runtime PM reference on exit. That leaves an unmatched runtime PM put and can trigger a runtime PM usage count underflow. Fix this by making eh_noresume a regular bool so it can be accessed with READ_ONCE() and WRITE_ONCE(). Snapshot it once per EH iteration and use that snapshot for both runtime PM get and put decisions. Fixes: ae0751ffc77e ("[SCSI] add flag to skip the runtime PM calls on the host") Signed-off-by: Hongjie Fang <hongjiefang@asrmicro.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Peter Wang <peter.wang@mediatek.com> Link: https://patch.msgid.link/20260729111614.2407559-1-hongjiefang@asrmicro.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-08-07regulator: qcom-rpmh: Support RPMH address reads and use it for rpmh-regulatorsMark Brown
Kamal Wadhwa <kamal.wadhwa@oss.qualcomm.com> says: This patch series adds a new `rpmh_read()` API to allow reading RPMH addresses. Using this API enhances the RPMH regulator driver by adding readback of the voltage/bypass/mode settings as they have been applied by APPS during the bootloader stage, so regulator framework can get them via `get_mode`, `get_bypass` & `get_voltage_selector` callbacks during regulator registration. This is needed because currently regulator framework does a unnecessary write with `min-microvolt` DT setting for all the RPMH regulators during regulator registration, because the first time after boot the value is seen as -ENOTRECOVERABLE, as there is no option to read these regulator settings. With this change this unnecessary write can be avoided and regulator framework gets a sense of the initial state set during the bootloader stage for all regulator settings. NOTE - During discussion on the v2 series - PATCH 3/4, reviewer had inquired about possible need for the use of the sync_state() to handle the "multiple" client case - for maintaining the regulator settings till all the clients are probed. This case was not covered in my previous series and had originally planned to do that series separately. But after the discussion decided to merge the 2 series as it seemed this would be a better approach. But after working on sync_state change. I realized a basic issue with using sync_state() for regulators - that its per-driver and not per-regulator resource. But we needed a sync_state callback for each regulator separately. I had been experimenting with few ideas but seems its going to need more time for me to close on the equivalent solution that has per-regulator sync_state or something to that effect. So I thought to close on this series and attend to that separately. Link: https://patch.msgid.link/20260801-b4-read-rpmh-v5-v6-0-9fcb54928523@oss.qualcomm.com
2026-08-07soc: qcom: rpmh: Add support to read back resource settingsMaulik Shah
All rpmh_*() APIs so far have supported placing votes for various resource settings but the H/W also have option to read resource settings. Add new rpmh_read() API to allow clients to read back resource setting from H/W. This will be useful for clients like regulators, which currently don't have a way to know the settings applied during bootloader stage. Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Maulik Shah <maulik.shah@oss.qualcomm.com> Signed-off-by: Kamal Wadhwa <kamal.wadhwa@oss.qualcomm.com> Link: https://patch.msgid.link/20260801-b4-read-rpmh-v5-v6-1-9fcb54928523@oss.qualcomm.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-07Merge tag 'mhi-for-v7.3' of ↵Greg Kroah-Hartman
ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mani/mhi into char-misc-next Manivannan writes: MHI Host -------- - Add SAHARA channel support in the pci_generic driver for Foxconn products. This allows capturing crashdump (ramdump) using the in-kernel sahara client driver. - Add support for devices with no M3 state. Some devices do not support the M3 power state due to hardware issues. For those devices, MHI bus will now run the full host-side suspend/resume sequence but skip the device-side M3/M0 handshake, so any transfer queued by clients during suspend is deferred until resume. - Set 'mhi_cntrl->no_m3' flag in the pci_generic driver for the QDU100 device so that the MHI bus also skips the M3 transition during system suspend. Earlier, the flag was only used to disable runtime PM, but the system suspend path was still transitioning the device to M3. - Fix sys error transition latency by polling for the state transition in mhi_pm_sys_error_transition() instead of waiting up to 24 seconds for an interrupt from the device. Since a device that has been reset (e.g., via AT!RESET) is not guaranteed to raise one. - Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET in mhi_soc_reset() so that the reset actually reaches the device before the caller's post-reset delay begins. - Fix controller cleanup on EDL sysfs failure in mhi_register_controller(). The error path was leaving the device registered when sysfs_create_file() failed. MHI Endpoint ------------ - Add mhi_cntrl->flush_async() callback to drain the in-flight async DMA read/write operations issued through the MHI controller driver. This is used by the MHI EP stack before disconnect to avoid UAF where a late DMA completion could invoke a now-invalid xfer_cb(). - Implement the flush_async() callback in the PCI EPF MHI controller driver by waiting for the in-flight DMA operations to complete and then flushing the DMA workqueue. Since I'm the maintainer for this PCI EPF driver, I'm taking this patch through MHI tree due to dependency. - Flush the in-flight async transfers before notifying disconnect in mhi_ep_abort_transfer() to fix a UAF, where a success callback delivered after the -ENOTCONN notification could reference resources already freed by the client. - Fix device refcount leak in the error path of mhi_ep_create_device() when dev_set_name() or device_add() fails. Common ------ - Clean up kernel-doc warnings in include/linux/mhi.h. - Add Jeff Hugo as the Reviewer of MHI bus. * tag 'mhi-for-v7.3' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mani/mhi: PCI: epf-mhi: Implement mhi_cntrl->flush_async() to flush DMA read/write bus: mhi: ep: Flush async transfers before notifying disconnect in mhi_ep_abort_transfer() bus: mhi: ep: Add mhi_cntrl->flush_async() callback to flush the async read/write bus: mhi: Clean up some kernel-doc warnings bus: mhi: host: Fix controller cleanup on EDL sysfs failure bus: mhi: pci_generic: Add SAHARA channel support for Foxconn products bus: mhi: host: pci_generic: Set 'mhi_cntrl->no_m3' flag bus: mhi: host: Add support for devices with no M3 state bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET MAINTAINERS: Add Jeff Hugo as the Reviewer of MHI bus bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation bus: mhi: core: Fix sys error transition latency
2026-08-07Merge tag 'thermal-7.2-rc7' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull thermal control fixes from Rafael Wysocki: "Revert three thermal core updates, two recent ones and one older. The recent ones attempted to fix a design issue in the thermal core and simplify code on top of that, but they made changes visible to user space and made it unhappy. The older one is a misguided code cleanup that introduced a (potentially nasty) bug" * tag 'thermal-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: Revert "thermal/drivers/hwmon: Cleanup coding style a bit" Revert "thermal: hwmon: Register a hwmon device for each thermal zone" Revert "thermal: hwmon: Use extra_groups for adding temperature attributes"
2026-08-07Merge tag 'sound-7.2-rc7' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of small fixes since the last pull request. More than few, but an enough-manageable amount at this time. USB-audio: - UAF, OOB and such hardening fixes for USB-audio, usx2y and us144mkii - Mixer regression fixes for Logitech PRO X 2 LIGHTSPEED headset and M-Audio Fast Track Ultra HD-audio: - Fix for an ACPI reference leak in TAS2781 HDA side-codec ASoC: - Fixes the default tables for Cirrus Logic codecs - Fixes for invalid enum accesses for Qualcomm LPASS - Error handling and robustness fixes for Intel SOF & Soundwire - DMI quirks for a few AMD devices" * tag 'sound-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (22 commits) ALSA: usb-audio: Fix sticky mixer regressions on M-Audio Fast Track Ultra ASoC: cs4265: sort the register default table ASoC: cs35l45: sort the register default table ASoC: cs35l41: sort the register default table ASoC: amd: yc: Add DMI quirk for MSI Raider A18 HX A7VHG ASoC: amd: yc: Add DMI quirk for Xiaomi RedmiBook 16 2025 ALSA: usx2y: bound the hwdep mmap fault offset ALSA: usb-audio: fix OOB write on Type II inbound URBs ALSA: us144mkii: re-anchor capture URBs on resubmission ALSA: FCP: fix OOB write in fcp_meter_ctl_get() MAINTAINERS: add SpacemiT K1/K3 I2S entry ASoC: rt5645: Make the Kconfig symbol user selectable ALSA: usb-audio: Add QUIRK_FLAG_MIXER_GET_CUR_BROKEN for Logitech PRO X 2 LIGHTSPEED ALSA: hda/tas2781: fix ACPI reference handling ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout ASoC: amd: yc: Add DMI quirk for HP Victus Laptop 16-e1xxx ASoC/soundwire: Intel: reset the PCMSyCM registers in hda_sdw_bpt_close ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() ...
2026-08-07bpf, riscv: Add and use bpf_atomic_is_load_acq() helperDaniel Borkmann
A load-acquire is the only BPF_STX class instruction that reads from src_reg into dst_reg, that is, it has the operand roles of a BPF_LDX. JIT code which tells loads from stores apart by instruction class alone has to special case it, for example when deciding which register holds the faulting address and which one to clear from an exception handler. riscv64 already does so, open coded as a bare insn->imm test. Add a bpf_atomic_is_load_acq() helper and convert riscv64 over to it, so that the x86-64 and arm64 JITs can use the same helper in subsequent patches. Unlike bpf_atomic_is_load_store(), which presumes that its argument is already known to be a BPF_ATOMIC instruction, the new helper is called from code which still sees all instruction classes, so it checks class and mode itself. Also, move bpf_atomic_is_load_store() to filter.h next to BPF_ATOMIC_OP, so that both helpers stay together. No functional change intended. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20260806201047.333389-2-daniel@iogearbox.net Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-08-07soc: fsl: guts: implement the RCW override procedureVladimir Oltean
Add support for the RCW override procedure which enables runtime reconfiguration of the protocol running on a SerDes lane. The procedure is done through the DCFG DCSR space which now can be defined as the second memory region of the guts DT node. Support is added on the following SoCs: LS1046A, LS1088A, LS2088A. The procedure is exported to the "client" driver - the Lynx10G SerDes PHY driver - through the following functions: - fsl_guts_lane_validate() used to validate that changing the protocol on a specific lane is supported. - fsl_guts_lane_set_mode() which can be used to request the RCW procedure be executed for a specific lane. Since the RCW override procedure is different depending on the SoC, the private fsl_soc_data structure is updated with two new per SoC callbacks (.serdes_get_rcw_override() and .serdes_init_rcwcr()) which get used from the generic fsl_guts_lane_set_mode() function. These two callbacks hide all the SoC specific register offsets, masks and values so that the _set_mode() procedure is straightforward. Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com> Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com> Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com> Link: https://lore.kernel.org/r/20260721231603.67865-9-vladimir.oltean@nxp.com Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
2026-08-07soc: fsl: dpio: fix kernel-doc typosRandy Dunlap
Correct spelling of 2 words. Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Cc: Li Yang <leoyang.li@nxp.com> Cc: linuxppc-dev@lists.ozlabs.org Cc: linux-arm-kernel@lists.infradead.org Cc: Frank Li <Frank.Li@nxp.com> Cc: Guanhua Gao <guanhua.gao@nxp.com> Cc: Roy Pledge <Roy.Pledge@nxp.com> Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com> Link: https://lore.kernel.org/r/20260728004938.905415-1-rdunlap@infradead.org Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
2026-08-07soc: fsl: fix kernel-doc warnings and typosRandy Dunlap
Correct spelling of "list". Fix a kernel-doc warning by describing the nested structure completely: include/soc/fsl/dpaa2-fd.h:52: warning: Function parameter or member 'simple' not described in 'dpaa2_fd' Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Cc: Li Yang <leoyang.li@nxp.com> Cc: linuxppc-dev@lists.ozlabs.org Cc: linux-arm-kernel@lists.infradead.org Cc: Frank Li <Frank.Li@nxp.com> Cc: Guanhua Gao <guanhua.gao@nxp.com> Cc: Roy Pledge <Roy.Pledge@nxp.com> Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com> Link: https://lore.kernel.org/r/20260728004924.904210-1-rdunlap@infradead.org Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
2026-08-06Merge tag 'mm-hotfixes-stable-2026-08-06-18-44' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull MM fixes from Andrew Morton: "17 hotfixes. 15 are cc:stable. 16 are for MM. There's a patch series from Lorenzo "mm: fix UAF caused by race between ptdump and vmap pgtable freeing" which addresses a quite old bug in the ptdump code. And another series also from Lorenzo which fixes a four year old bug in the huge_zero_folio handling. A series from SJ fixes a few possible divide-by-zero issues which Sashiko sniffed out. And a series which fixes handling of the commit_inputs parameters. The remainder are singletons, please see their changelogs for details" * tag 'mm-hotfixes-stable-2026-08-06-18-44' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mm/damon: adjust isolated pages stat for DAMOS_MIGRATE_{HOT,COLD} mm/damon/ops-common: putback folios on invalid migrate nid mm/huge_memory: initialise workingset state before folio split mm/page_table_check: skip special zero mappings mm/damon/lru_sort: skip damon_call() if ctx has not started mm/damon/reclaim: skip damon_call() if ctx has not started mm/damon/lru_sort: error out for >10000 active_mem_bp samples/damon/mtier: error out for zero quota goal target values mailmap: map old addresses to Danila Tikhonov mm/huge_memory: separate out CONFIG_PERSISTENT_HUGE_ZERO_FOLIO logic mm/huge_memory: fix huge_zero_pfn race MAINTAINERS: update address for Brendan Jackman mm/filemap: __filemap_add_folio() restore index before retrying microblaze: restore the page alignment of swapper_pg_dir arm64: remove redundant concurrent ptdump UAF mitigation mm/ptdump: always stabilise against page table freeing using init_mm mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF
2026-08-06mm: fold userfaultfd_rwp() to false without CONFIG_ARCH_HAS_PTE_PROTNONEKiryl Shutsemau (Meta)
RWP tracks accesses by installing PAGE_NONE (protnone) PTEs, so its code paths are gated on userfaultfd_rwp(). Without CONFIG_ARCH_HAS_PTE_PROTNONE there is no PAGE_NONE -- <linux/pgtable.h> defines it to a BUILD_BUG() stub, relying on callers folding such paths to dead code via IS_ENABLED(CONFIG_ARCH_HAS_PTE_PROTNONE). userfaultfd_rwp() was not a compile-time constant, so the compiler could not fold those paths. With an older compiler (gcc 8.5.0, sparc64) the PAGE_NONE reference in move_pages_huge_pmd() survived to codegen: mm/huge_memory.c:2874: _dst_pmd = pmd_modify(_dst_pmd, PAGE_NONE); compiler_types.h:702: error: call to '__compiletime_assert_501' declared with attribute error: BUILD_BUG failed RWP cannot exist without protnone, so return a compile-time false when CONFIG_ARCH_HAS_PTE_PROTNONE is unset; every RWP path then folds away. Link: https://lore.kernel.org/amcitKvUvFYr8W38@thinkstation Signed-off-by: Kiryl Shutsemau (Meta) <kas@kernel.org> Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202607250853.VaJWGLeA-lkp@intel.com/ Cc: Andrea Arcangeli <aarcange@redhat.com> Cc: David Hildenbrand <david@kernel.org> Cc: James Houghton <jthoughton@google.com> Cc: Jonathan Corbet <corbet@lwn.net> Cc: Liam Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Mike Rapoport (Microsoft) <rppt@kernel.org> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Peter Xu <peterx@redhat.com> Cc: Sean Christopherson <seanjc@google.com> Cc: SeongJae Park <sj@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Cc: Zi Yan <ziy@nvidia.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06mm: page_alloc: move capture_control to the page allocatorVlastimil Babka (SUSE)
The compaction capturing code assumes the allocation request order and compaction target order are the same. That won't be true once defrag_mode promotes sub-block allocations to pageblock-order compaction: compaction targets the larger order, while capture should remain at the original allocation order. Move the capture_control to the page allocator and give it its own copies of what the page freeing path matches against - zone, migratetype and the allocation order - rather than reaching into compaction's live compact_control. __alloc_pages_direct_compact() fills in migratetype and order, and installs and hides current->capture_control around the whole compaction call; try_to_compact_pages() aims capc->zone at each zone while it is being compacted. compact_zone_order() no longer deals with capture at all. Pass the capture_control through try_to_compact_pages() / compact_zone_order() in place of the bare struct page **. No functional change. Link: https://lore.kernel.org/20260722150006.3848560-4-hannes@cmpxchg.org Fixes: e3aa7df331bc ("mm: page_alloc: defrag_mode") Signed-off-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Co-developed-by: Johannes Weiner <hannes@cmpxchg.org> Signed-off-by: Johannes Weiner <hannes@cmpxchg.org> Reviewed-by: Gregory Price <gourry@gourry.net> Cc: Brendan Jackman <brendan.jackman@linux.dev> Cc: Brendan Jackman <jackmanb@google.com> Cc: David Hildenbrand <david@kernel.org> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Shakeel Butt <shakeel.butt@linux.dev> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Zi Yan <ziy@nvidia.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06mm/damon: update outdated comment about DAMOS filter handlingSong Hu
The kernel-doc comment above enum damos_filter_type states that only the anon and memcg type filters are handled by damon_operations (and therefore accounted as 'tried'), and that DAMON_OPS_VADDR and DAMON_OPS_FVADDR do not support those two filter types. Neither is accurate anymore. damos_filter_for_ops() routes every filter type except ADDR and TARGET to the operations layer, and the VADDR and FVADDR operations (the latter being a copy of the former) handle all of those types through damos_folio_filter_match() / damos_va_filter_out(). Update the comment to match the code. Link: https://lore.kernel.org/20260721140011.269802-1-sj@kernel.org Signed-off-by: Song Hu <husong@kylinos.cn> Reviewed-by: SJ Park <sj@kernel.org> Signed-off-by: SJ Park <sj@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06mm/memory: move pte_install_uffd_wp_if_needed() into memory.cDev Jain
Patch series "Batch unmap of uffd-wp file folios", v2. Currently, batched unmapping is supported if: 1) folio is a file folio, not belonging to uffd-wp VMA 2) folio is anonymous and not swapbacked (lazyfree), not belonging to uffd-wp VMA So the cases which are not supported are 1) folio belonging to uffd-wp VMA 2) folio is anonymous and swapbacked It is easy to see that this adds a lot of cognitive load while reading try_to_unmap_one - we need to remember throughout whether nr_pages == 1 or > 1. The uffd-wp handling in try_to_unmap_one is regarding preserving the uffd-wp state for file folios via pte_install_uffd_wp_if_needed (for anon folio, we handle that while constructing the swap pte). Stop special casing on uffd-wp VMAs by simply adding batching support to pte_install_uffd_wp_if_needed. This patch (of 3): pte_install_uffd_wp_if_needed() has grown too large for mm_inline.h. Move it to memory.c. This helper is only used inside mm/, so declare it in mm/internal.h instead of a public header. While at it, convert the comment to kerneldoc and rename the local arguments from pte/pteval to ptep/pte so the pointer and PTE value are easier to distinguish. Link: https://lore.kernel.org/20260720065508.2695106-1-dev.jain@arm.com Link: https://lore.kernel.org/20260720065508.2695106-2-dev.jain@arm.com Signed-off-by: Dev Jain <dev.jain@arm.com> Acked-by: David Hildenbrand (Arm) <david@kernel.org> Cc: Anshuman Khandual <anshuman.khandual@arm.com> Cc: Axel Rasmussen <axelrasmussen@google.com> Cc: Barry Song <baohua@kernel.org> Cc: Harry Yoo <harry@kernel.org> Cc: Jann Horn <jannh@google.com> Cc: Kairui Song <kasong@tencent.com> Cc: Lance Yang <lance.yang@linux.dev> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Rik van Riel <riel@surriel.com> Cc: Ryan Roberts <ryan.roberts@arm.com> Cc: Shakeel Butt <shakeel.butt@linux.dev> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Cc: Wei Xu <weixugc@google.com> Cc: Yuanchu Xie <yuanchu@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06mm/huge_memory: fold split_folio_to_list_to_order() into split_folio_to_order()Kiryl Shutsemau (Meta)
split_folio_to_list_to_order() had no direct callers; its only user was split_folio_to_order(), which always passed a NULL list. Fold it into split_folio_to_order() and call split_huge_page_to_list_to_order() directly. No functional change. Link: https://lore.kernel.org/20260716100345.473473-3-kirill@shutemov.name Signed-off-by: Kiryl Shutsemau (Meta) <kas@kernel.org> Acked-by: Usama Arif <usama.arif@linux.dev> Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org> Reviewed-by: Zi Yan <ziy@nvidia.com> Acked-by: David Hildenbrand (Arm) <david@kernel.org> Cc: Baolin Wang <baolin.wang@linux.alibaba.com> Cc: Barry Song <baohua@kernel.org> Cc: Dev Jain <dev.jain@arm.com> Cc: Lance Yang <lance.yang@linux.dev> Cc: Liam R. Howlett <liam@infradead.org> Cc: Nico Pache <npache@redhat.com> Cc: Ryan Roberts <ryan.roberts@arm.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06mm/huge_memory: remove unused can_split_folio()Kiryl Shutsemau (Meta)
Patch series "mm/huge_memory: drop dead split helper variants". Two trivial cleanups in the folio split API, found while auditing the split helpers for the inode UAF fix [1]: - can_split_folio() is dead: only the !THP stub remains, no definition under CONFIG_TRANSPARENT_HUGEPAGE and no callers. Leftover from an earlier cleanup. - split_folio_to_list_to_order() has no direct callers; its only user is split_folio_to_order(), which always passes a NULL list. Fold it. No functional change. This patch (of 2): can_split_folio() has no callers and no definition under CONFIG_TRANSPARENT_HUGEPAGE; only the !THP stub remains, left behind by an earlier cleanup. Remove it. No functional change. Link: https://lore.kernel.org/20260716100345.473473-1-kirill@shutemov.name Link: https://lore.kernel.org/20260716100345.473473-2-kirill@shutemov.name Link: https://lore.kernel.org/linux-mm/aldjhtfVByHDQXe6@thinkstation [1] Link: https://lore.kernel.org/linux-mm/20260714122344.351895-1-kirill@shutemov.name [2] Signed-off-by: Kiryl Shutsemau (Meta) <kas@kernel.org> Acked-by: Usama Arif <usama.arif@linux.dev> Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org> Reviewed-by: Zi Yan <ziy@nvidia.com> Acked-by: David Hildenbrand (Arm) <david@kernel.org> Cc: Baolin Wang <baolin.wang@linux.alibaba.com> Cc: Barry Song <baohua@kernel.org> Cc: Dev Jain <dev.jain@arm.com> Cc: Lance Yang <lance.yang@linux.dev> Cc: Liam R. Howlett <liam@infradead.org> Cc: Nico Pache <npache@redhat.com> Cc: Ryan Roberts <ryan.roberts@arm.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06mm: introduce pud_is_huge() helperKefeng Wang
Patch series "mm: mincore: misc cleanups", v3. This series cleans up and simplifies the mincore. Most importantly, it removes the historical special behavior that always reports VM_PFNMAP pages as non-resident. This patch (of 6): Introduce the pud_is_huge() helper function to check whether a PUD is a huge PUD or a software leaf entry. Note that, unlike PMD, PUD currently does not support transparent migration entries or device private entries. However, the function still includes `!pud_none()` branches to accommodate potential future implementations. Link: https://lore.kernel.org/20260717091347.1144789-1-wangkefeng.wang@huawei.com Link: https://lore.kernel.org/20260717091347.1144789-2-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com> Acked-by: David Hildenbrand (Arm) <david@kernel.org> Cc: Jann Horn <jannh@google.com> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Pedro Falcato <pfalcato@suse.de> Cc: Vlastimil Babka <vbabka@kernel.org> Cc: Zi Yan <ziy@nvidia.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06mm/mseal: limit scope of mseal address zero to address zeroLorenzo Stoakes (ARM)
Commit 44f65d900698 ("binfmt_elf: mseal address zero") unconditionally provided do_mseal() to any internal kernel caller in order to address a corner case slated for possible removal. It also incorrectly attempts to mseal without checking to see whether the mapping even succeeded. Restrict the scope to the corner case by providing mseal_mmap_page_zero() which asserts the MMAP_PAGE_ZERO personality. Avoid unnecessary checks in the start, end range by abstracting the actual mseal()'ing to mseal_range() and have mseal_mmap_page_zero() call that instead. Also only try to seal the VMA if we mapped the VMA. This isn't strictly necessary as the operation would error out anyway, but it's useless work and could be problematic if me make future changes to mseal semantics. Link: https://lore.kernel.org/20260717-mseal-fixups-v2-2-0daa0014b813@kernel.org Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org> Acked-by: David Hildenbrand (Arm) <david@kernel.org> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: Christian Brauner <brauner@kernel.org> Cc: Jan Kara <jack@suse.cz> Cc: Jann Horn <jannh@google.com> Cc: Kees Cook <kees@kernel.org> Cc: Liam R. Howlett <liam@infradead.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Pedro Falcato <pfalcato@suse.de> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06mm/page_alloc: remove a couple of VM_BUG_ON()stBrendan Jackman
VM_BUG_ON() is out of favour and on the way to removal, since I recently touched alloc_pages_node_noprof() I am removing that invocation, and also removing the __folio_alloc_node_noprof() one for consistency. If this precondition is violated, the system will soon crash anyway. Link: https://lore.kernel.org/20260715-spin-trylock-followup-v3-4-fc4d246f705d@google.com Signed-off-by: Brendan Jackman <jackmanb@google.com> Suggested-by: Zi Yan <ziy@nvidia.com> Link: https://lore.kernel.org/all/7F866265-3F2E-4765-B9D4-9AB898A9C4AC@nvidia.com/ Acked-by: Zi Yan <ziy@nvidia.com> Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Cc: Brendan Jackman <brendan.jackman@linux.dev> Cc: David Hildenbrand <david@kernel.org> Cc: Johannes Weiner <hannes@cmpxchg.org> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Michal Koutný <mkoutny@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Cc: Steven Rostedt <rostedt@goodmis.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Tejun Heo <tj@kernel.org> Cc: Waiman Long <longman@redhat.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06mm/damon/core: hide core-private damon_ctx fieldsSJ Park
'ops', 'probes', 'adaptive_targets', 'schemes', and 'rnd_state' fields of damon_ctx are intended to be used by only the DAMON core layer. However, those are mistakenly not marked as private. Mark as private. Link: https://lore.kernel.org/20260714143544.101305-11-sj@kernel.org Signed-off-by: SJ Park <sj@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06mm/damon/core: hide private damon_probe fieldsSJ Park
'filters' and 'list' fields of damon_probe are intended to be used by only the DAMON core layer. However, those are mistakenly not marked as private. Mark as private. Link: https://lore.kernel.org/20260714143544.101305-9-sj@kernel.org Signed-off-by: SJ Park <sj@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06mm/damon/core: hide private damon_filter fieldsSJ Park
damon_filter->list is intended to be used by only the DAMON core layer. However, it is mistakenly not marked as private. Mark as private. Link: https://lore.kernel.org/20260714143544.101305-8-sj@kernel.org Signed-off-by: SJ Park <sj@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06mm/damon/core: hide private damos fieldsSJ Park
'core_filters', 'ops_filters', 'last_applied' and 'list' fields of damos are intended to be used by only the DAMON core layer. However, those are mistakenly not marked as private. Mark as private. Link: https://lore.kernel.org/20260714143544.101305-7-sj@kernel.org Signed-off-by: SJ Park <sj@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06mm/damon/core: hide private damos_filter fieldsSJ Park
damos_filter->list is intended to be used by only the DAMON core layer. However, it is mistakenly not marked as private. Mark as private. Link: https://lore.kernel.org/20260714143544.101305-6-sj@kernel.org Signed-off-by: SJ Park <sj@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06mm/damon/core: hide private damos_quota fieldsSJ Park
damos_quota->goals is intended to be used by only the DAMON core layer. But it is mistakenly not marked as private. Mark as private. Link: https://lore.kernel.org/20260714143544.101305-5-sj@kernel.org Signed-off-by: SJ Park <sj@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06mm/damon/core: hide private damos_quota_goal fieldsSJ Park
'last_psi_total' and 'list' of damos_quota_goal are intended to be used by only the DAMON core layer. Those are mistakenly not marked as private, though. Mark as private. Link: https://lore.kernel.org/20260714143544.101305-4-sj@kernel.org Signed-off-by: SJ Park <sj@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06mm/damon/core: hide private damon_target fieldsSJ Park
'nr_regions', 'regions_list' and 'list' fields of damon_target are intended to be used by only the DAMON core layer. Those are mistakenly not marked as private. Mark as private. Link: https://lore.kernel.org/20260714143544.101305-3-sj@kernel.org Signed-off-by: SJ Park <sj@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06mm/damon/core: hide private damon_region fieldsSJ Park
Patch series "mm/damon/core: hide core-private struct fields". DAMON core structs hide core-private fields using 'private:' comment tags. It is incomplete and inconsistent. The linked list heads in a few structs, for example, are intended to be hidden, and always be used using the wrapper macros like damon_for_each_region(). But those were mistakenly marked as non-private. A few core layer-only fields were also mistakenly added as non-private. This only encourages callers to directly use the private fields. It is easy to make mistakes, and difficult to control. Mark all such DAMON core struct fields as private. Patches 1-8 mark the private fields for damon_region, damon_target, damos_quota_goal, damos_quota, damos_filter, damos, damon_filter and damon_probe, respectively. Patch 9 removes DAMON_SYSFS's direct access to core-private field, damon_ctx->ops. Finally patch 10 mark the private fields for damon_ctx. This patch (of 10): damon_region->list is intended to be used by only the DAMON core layer. But it is mistakenly not marked as private. Hide it from the callers by marking it private. Link: https://lore.kernel.org/20260714143544.101305-1-sj@kernel.org Link: https://lore.kernel.org/20260714143544.101305-2-sj@kernel.org Signed-off-by: SJ Park <sj@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06mm/vma: update create_init_stack_vma() to use vma_flags_tLorenzo Stoakes
Replace use of the legacy vm_flags_t flags with vma_flags_t values in create_init_stack_vma(). As part of this change we add VMA_STACK_EARLY and VMA_STACK_INCOMPLETE vma_flags_t defines, and slightly rework create_init_stack_vma() for clarity. No functional change intended. Link: https://lore.kernel.org/20260711-b4-vma-flags-mm-v2-9-0fa2357d5431@kernel.org Signed-off-by: Lorenzo Stoakes <ljs@kernel.org> Reviewed-by: Zi Yan <ziy@nvidia.com> Reviewed-by: Lance Yang <lance.yang@linux.dev> Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Cc: Baolin Wang <baolin.wang@linux.alibaba.com> Cc: Barry Song <baohua@kernel.org> Cc: Christian Brauner <brauner@kernel.org> Cc: Dave Airlie <airlied@gmail.com> Cc: David Hildenbrand <david@kernel.org> Cc: Dev Jain <dev.jain@arm.com> Cc: Jani Nikula <jani.nikula@intel.com> Cc: Jan Kara <jack@suse.cz> Cc: Jann Horn <jannh@google.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Muchun Song <muchun.song@linux.dev> Cc: Nico Pache <npache@redhat.com> Cc: Oscar Salvador <osalvador@suse.de> Cc: Pedro Falcato <pfalcato@suse.de> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06mm: introduce vma_get_page_prot() and use itLorenzo Stoakes
There's a large number of vm_get_page_prot(vma->vm_flags) invocations. Make life easier by introducing vma_get_page_prot() parameterised by the VMA. This also makes converting vm_get_page_prot() to vma_flags_t easier. Also update the userland VMA tests to reflect the change. No functional change intended. Link: https://lore.kernel.org/20260711-b4-vma-flags-mm-v2-8-0fa2357d5431@kernel.org Signed-off-by: Lorenzo Stoakes <ljs@kernel.org> Acked-by: Zi Yan <ziy@nvidia.com> Acked-by: Jani Nikula <jani.nikula@intel.com> # for i915 Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> [DRM] Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Cc: Baolin Wang <baolin.wang@linux.alibaba.com> Cc: Barry Song <baohua@kernel.org> Cc: Christian Brauner <brauner@kernel.org> Cc: Dave Airlie <airlied@gmail.com> Cc: David Hildenbrand <david@kernel.org> Cc: Dev Jain <dev.jain@arm.com> Cc: Jan Kara <jack@suse.cz> Cc: Jann Horn <jannh@google.com> Cc: Lance Yang <lance.yang@linux.dev> Cc: Mike Rapoport <rppt@kernel.org> Cc: Muchun Song <muchun.song@linux.dev> Cc: Nico Pache <npache@redhat.com> Cc: Oscar Salvador <osalvador@suse.de> Cc: Pedro Falcato <pfalcato@suse.de> Cc: Suren Baghdasaryan <surenb@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06mm/vma: rename vma_get_page_prot to vma_flags_to_page_protLorenzo Stoakes
Having vma_get_page_prot() refer to VMA flags and vma_set_page_prot() refer to a VMA is confusing. Rename vma_get_page_prot() to vma_flags_to_page_prot() to resolve this confusion. No functional change intended. Link: https://lore.kernel.org/20260711-b4-vma-flags-mm-v2-7-0fa2357d5431@kernel.org Signed-off-by: Lorenzo Stoakes <ljs@kernel.org> Reviewed-by: Lance Yang <lance.yang@linux.dev> Reviewed-by: Zi Yan <ziy@nvidia.com> Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Cc: Baolin Wang <baolin.wang@linux.alibaba.com> Cc: Barry Song <baohua@kernel.org> Cc: Christian Brauner <brauner@kernel.org> Cc: Dave Airlie <airlied@gmail.com> Cc: David Hildenbrand <david@kernel.org> Cc: Dev Jain <dev.jain@arm.com> Cc: Jani Nikula <jani.nikula@intel.com> Cc: Jan Kara <jack@suse.cz> Cc: Jann Horn <jannh@google.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Muchun Song <muchun.song@linux.dev> Cc: Nico Pache <npache@redhat.com> Cc: Oscar Salvador <osalvador@suse.de> Cc: Pedro Falcato <pfalcato@suse.de> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06mm: update generic_get_unmapped_area[_topdown]() to use vma_flags_tLorenzo Stoakes
As part of the changes converting VMA flags from a system word size to a bitmap, extend this change to generic_get_unmapped_area() and generic_get_unmapped_area_topdown(), which also allows us to convert stack_guard_placement() as well. We retain arch_get_unmapped_area() and arch_get_unmapped_area_topdown() as-is for now, using legacy_to_vma_flags() as necessary to do so. No functional change intended. Link: https://lore.kernel.org/20260711-b4-vma-flags-mm-v2-4-0fa2357d5431@kernel.org Signed-off-by: Lorenzo Stoakes <ljs@kernel.org> Reviewed-by: Zi Yan <ziy@nvidia.com> Reviewed-by: Lance Yang <lance.yang@linux.dev> Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Cc: Baolin Wang <baolin.wang@linux.alibaba.com> Cc: Barry Song <baohua@kernel.org> Cc: Christian Brauner <brauner@kernel.org> Cc: Dave Airlie <airlied@gmail.com> Cc: David Hildenbrand <david@kernel.org> Cc: Dev Jain <dev.jain@arm.com> Cc: Jani Nikula <jani.nikula@intel.com> Cc: Jan Kara <jack@suse.cz> Cc: Jann Horn <jannh@google.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Muchun Song <muchun.song@linux.dev> Cc: Nico Pache <npache@redhat.com> Cc: Oscar Salvador <osalvador@suse.de> Cc: Pedro Falcato <pfalcato@suse.de> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06mm: convert __get_unmapped_area() to use vma_flags_tLorenzo Stoakes
Update __get_unmapped_area() to be parameterised by vma_flags_t rather than vm_flags_t as part of the effort to move VMA flags from a system word to a bitmap. We cascade the changes up to arch_get_unmapped_area_topdown() and arch_get_unmapped_area(), where, for now, we use vma_flags_to_legacy() in order to propagate the VMA flags. No functional change intended. Link: https://lore.kernel.org/20260711-b4-vma-flags-mm-v2-3-0fa2357d5431@kernel.org Signed-off-by: Lorenzo Stoakes <ljs@kernel.org> Reviewed-by: Lance Yang <lance.yang@linux.dev> Reviewed-by: Zi Yan <ziy@nvidia.com> Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Cc: Baolin Wang <baolin.wang@linux.alibaba.com> Cc: Barry Song <baohua@kernel.org> Cc: Christian Brauner <brauner@kernel.org> Cc: Dave Airlie <airlied@gmail.com> Cc: David Hildenbrand <david@kernel.org> Cc: Dev Jain <dev.jain@arm.com> Cc: Jani Nikula <jani.nikula@intel.com> Cc: Jan Kara <jack@suse.cz> Cc: Jann Horn <jannh@google.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Muchun Song <muchun.song@linux.dev> Cc: Nico Pache <npache@redhat.com> Cc: Oscar Salvador <osalvador@suse.de> Cc: Pedro Falcato <pfalcato@suse.de> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06mm/vma: update do_mmap() to use vma_flags_tLorenzo Stoakes
The core do_mmap() function accepts a vm_flags_t parameter which it then manipulates before passing to mmap_region() to do the heavy lifting of the memory mapping. Update do_mmap() to instead accept a vma_flags_t parameter, and adjust all the logic within do_mmap() to manipulate this instead. This is as part of the ongoing effort to convert VMA flags from a system word size to a bitmap type which allows us to unrestrict the number of VMA flags, as well as gain control over how VMA flag manipulation occurs. We do not cascade these changes to all functions which accept vm_flags_t, but rather use vma_flags_to_legacy() where necessary, specifically deferring converting calc_vm_prot_bits(), calc_vm_flag_bits() and __get_unmapped_area() to vma_flags_t. Also utilise the new vma_flags_can_grow() predicate which correctly handles the case of architectures without upward growing stacks. As part of this change, introduce VMA_SHADOW_STACK so we can correctly handle the case of the shadow stack not being defined. No functional change intended. Link: https://lore.kernel.org/20260711-b4-vma-flags-mm-v2-2-0fa2357d5431@kernel.org Signed-off-by: Lorenzo Stoakes <ljs@kernel.org> Reviewed-by: Lance Yang <lance.yang@linux.dev> Reviewed-by: Zi Yan <ziy@nvidia.com> Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Cc: Baolin Wang <baolin.wang@linux.alibaba.com> Cc: Barry Song <baohua@kernel.org> Cc: Christian Brauner <brauner@kernel.org> Cc: Dave Airlie <airlied@gmail.com> Cc: David Hildenbrand <david@kernel.org> Cc: Dev Jain <dev.jain@arm.com> Cc: Jani Nikula <jani.nikula@intel.com> Cc: Jan Kara <jack@suse.cz> Cc: Jann Horn <jannh@google.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Muchun Song <muchun.song@linux.dev> Cc: Nico Pache <npache@redhat.com> Cc: Oscar Salvador <osalvador@suse.de> Cc: Pedro Falcato <pfalcato@suse.de> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06mm: introduce vma_flags_can_grow() and vma_can_grow()Lorenzo Stoakes
Patch series "mm: convert more vm_flags_t users to vma_flags_t", v2. This series makes further progress in converting usage of the deprecated vm_flags_t type to its replacement, vma_flags_t. It focuses on mm, though updates some users of mm APIs also. It updates: * The core do_mmap() code path for VMA mapping. * Unmapped area logic. * The usage of mm->def_vma_flags. * VMA page protection bit logic. * General usage of VMA flags in core mm code, mlock, mprotect, mremap. This patch (of 13): These test whether the VMA has stack semantics, i.e. is able to grow upwards or downwards depending on the architecture. In order to account for arches which do not support upward-growing stacks, introduce VMA_GROWSUP whose definition depends on the architecture supporting it, and use vma_flags_test_single_mask() in vma_flags_can_grow() to account for this. No functional change intended. Link: https://lore.kernel.org/20260711-b4-vma-flags-mm-v2-0-0fa2357d5431@kernel.org Link: https://lore.kernel.org/20260711-b4-vma-flags-mm-v2-1-0fa2357d5431@kernel.org Signed-off-by: Lorenzo Stoakes <ljs@kernel.org> Reviewed-by: Zi Yan <ziy@nvidia.com> Reviewed-by: Lance Yang <lance.yang@linux.dev> Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Cc: Baolin Wang <baolin.wang@linux.alibaba.com> Cc: Barry Song <baohua@kernel.org> Cc: Christian Brauner <brauner@kernel.org> Cc: Dave Airlie <airlied@gmail.com> Cc: David Hildenbrand <david@kernel.org> Cc: Dev Jain <dev.jain@arm.com> Cc: Jan Kara <jack@suse.cz> Cc: Jann Horn <jannh@google.com> Cc: Lance Yang <lance.yang@linux.dev> Cc: Mike Rapoport <rppt@kernel.org> Cc: Muchun Song <muchun.song@linux.dev> Cc: Nico Pache <npache@redhat.com> Cc: Oscar Salvador <osalvador@suse.de> Cc: Pedro Falcato <pfalcato@suse.de> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Zi Yan <ziy@nvidia.com> Cc: Jani Nikula <jani.nikula@intel.com> Cc: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06mm/memory_hotplug: add offline_and_remove_memory_ranges()Gregory Price
offline_and_remove_memory() handles a single contiguous range. Callers that manage a device composed of several ranges (dax/kmem) currently have to call it in a loop, which gives up atomicity. In addition to pushing rollback logic into the driver, the lack of atomicity creates a race condition between system daemons trying to manage the same resource: - Manager 1: Offlines memory blocks. Removes device. ^^^^ - Manager 2: Detects offline memory blocks, re-onlines them. Add offline_and_remove_memory_ranges(), which takes an array of ranges and processes them as one operation under a single lock_device_hotplug(): - Phase 1 offlines every block of every range. - Phase 2 removes the ranges only if all ranges are offline. - If any offline fails, the whole operation is reverted. This gives callers all-or-nothing semantics for the offline step, so a failed or interrupted unplug leaves the device in a consistent state. This also resolves the battling managers race - the second manager's operation simply fails when the block is destroyed / cannot be onlined. offline_and_remove_memory() becomes a thin wrapper that passes its single range to the new helper, so the offline/rollback logic lives in one place. Link: https://lore.kernel.org/20260712154505.3564379-7-gourry@gourry.net Signed-off-by: Gregory Price <gourry@gourry.net> Suggested-by: David Hildenbrand (Arm) <david@kernel.org> Reviewed-by: Dave Jiang <dave.jiang@intel.com> Acked-by: David Hildenbrand (Arm) <david@kernel.org> Reviewed-by: Dan Williams <djbw@kernel.org> Cc: Alison Schofield <alison.schofield@intel.com> Cc: Danilo Krummrich <dakr@kernel.org> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Hannes Reinecke <hare@suse.de> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Oscar Salvador <osalvador@suse.de> Cc: Pankaj Gupta <pankaj.gupta@amd.com> Cc: "Rafael J. Wysocki" <rafael@kernel.org> Cc: Shuah Khan <shuah@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vishal Verma <vishal.l.verma@intel.com> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06mm/memory_hotplug: add __add_memory_driver_managed() with online_type argGregory Price
Existing callers of add_memory_driver_managed cannot select the preferred online type (ZONE_NORMAL vs ZONE_MOVABLE), requiring it to hot-add memory as offline blocks, and then follow up by onlining each memory block individually. Most drivers prefer the system default, but the CXL driver wants to plumb a preferred policy through the dax kmem driver. Refactor APIs to add a new interface which allows the dax kmem module to select a preferred policy. Overriding the configured auto-online policy is only safe for known in-tree modules, where we know the override reflects a different, user-requested policy. We do not want arbitrary out-of-tree drivers silently overriding the system-wide onlining policy, so restrict the new interface to the kmem module using EXPORT_SYMBOL_FOR_MODULES() rather than a plain EXPORT_SYMBOL_GPL(). Other in-tree modules (e.g. cxl_core) can be added to the allowed list as the need arises. Refactor add_memory_driver_managed, extract __add_memory_driver_managed - Add proper kernel-doc for add_memory_driver_managed while refactoring - New helper accepts an explicit online_type. - New helper validates online_type is between OFFLINE and ONLINE_MOVABLE Refactor: add_memory_resource, extract __add_memory_resource - new helper accepts an explicit online_type Original APIs now explicitly pass the system-default to new helpers. No functional change for existing users. Link: https://lore.kernel.org/20260712154505.3564379-6-gourry@gourry.net Signed-off-by: Gregory Price <gourry@gourry.net> Acked-by: David Hildenbrand (Arm) <david@kernel.org> Reviewed-by: Pankaj Gupta <pankaj.gupta@amd.com> Reviewed-by: Dave Jiang <dave.jiang@intel.com> Reviewed-by: Dan Williams <djbw@kernel.org> Cc: Alison Schofield <alison.schofield@intel.com> Cc: Danilo Krummrich <dakr@kernel.org> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Hannes Reinecke <hare@suse.de> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Oscar Salvador <osalvador@suse.de> Cc: "Rafael J. Wysocki" <rafael@kernel.org> Cc: Shuah Khan <shuah@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vishal Verma <vishal.l.verma@intel.com> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06mm/memory_hotplug: export mhp_get_default_online_typeGregory Price
Drivers which may pass hotplug policy down to DAX need MMOP_ symbols and the mhp_get_default_online_type function for hotplug use cases. Some drivers (cxl) co-mingle their hotplug and devdax use-cases into the same driver code, and chose the dax_kmem path as the default driver path - making it difficult to require hotplug as a predicate to building the overall driver (it may break other non-hotplug use-cases). Export mhp_get_default_online_type function to allow these drivers to build when hotplug is disabled and still use the DAX use case. In the built-out case we simply return MMOP_OFFLINE as it's non-destructive. The internal function can never return -1 either, so we choose this to allow for defining the function with 'enum mmop'. Link: https://lore.kernel.org/20260712154505.3564379-5-gourry@gourry.net Signed-off-by: Gregory Price <gourry@gourry.net> Reviewed-by: Dave Jiang <dave.jiang@intel.com> Reviewed-by: Dan Williams <djbw@kernel.org> Acked-by: David Hildenbrand (Arm) <david@kernel.org> Cc: Alison Schofield <alison.schofield@intel.com> Cc: Danilo Krummrich <dakr@kernel.org> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Hannes Reinecke <hare@suse.de> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Oscar Salvador <osalvador@suse.de> Cc: Pankaj Gupta <pankaj.gupta@amd.com> Cc: "Rafael J. Wysocki" <rafael@kernel.org> Cc: Shuah Khan <shuah@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vishal Verma <vishal.l.verma@intel.com> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06mm/memory_hotplug: add mhp_online_type_to_str() and export string helpersGregory Price
Add mhp_online_type_to_str() as the inverse of mhp_online_type_from_str(), and export both so a driver can render and parse the memory online type through its own sysfs interface. Link: https://lore.kernel.org/20260712154505.3564379-3-gourry@gourry.net Signed-off-by: Gregory Price <gourry@gourry.net> Reviewed-by: Dave Jiang <dave.jiang@intel.com> Acked-by: David Hildenbrand (Arm) <david@kernel.org> Reviewed-by: Dan Williams <djbw@kernel.org> Cc: Alison Schofield <alison.schofield@intel.com> Cc: Danilo Krummrich <dakr@kernel.org> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Hannes Reinecke <hare@suse.de> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Oscar Salvador <osalvador@suse.de> Cc: Pankaj Gupta <pankaj.gupta@amd.com> Cc: "Rafael J. Wysocki" <rafael@kernel.org> Cc: Shuah Khan <shuah@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vishal Verma <vishal.l.verma@intel.com> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06mm/memory: add memory_block_aligned_range() helperGregory Price
Patch series "dax/kmem: atomic whole-device hotplug via sysfs", v7. The dax kmem driver onlines memory during probe using the system default policy, with no atomic control for the state of an entire region at runtime - only by toggling individual memory blocks. Offlining and removing a whole region therefore races with other userland controllers that interfere between the two steps. This series adds a sysfs "state" attribute for atomic whole-device hotplug control, plus the mm and dax plumbing to support it. Transitions are atomic across every range of the device. The state names mirror the per-block memoryX/state ABI with one modification: - "unplugged": memory blocks are not present - "online": online as system RAM, zone chosen by the kernel - "online_kernel": online in ZONE_NORMAL - "online_movable": online in ZONE_MOVABLE "offline" (blocks present but offline) is reportable for backward compatibility but is not writable because it entices the race condition we are trying to solve (separate atomic steps for offline and unplug). 'unplugged' (atomic offline+remove of the whole device) is the new capability provided by the new kmem sysfs attribute. dax/kmem probe still creates the memory blocks by default when the default policy is "offline", to preserve backwards compatibility. This patch (of 10): Memory hotplug operations require ranges aligned to memory block boundaries. This is a generic operation for hotplug. Add memory_block_aligned_range() as a common helper in <linux/memory.h> that aligns the start address up and end address down to memory block boundaries. Guard against end underflow when the range falls below the first memory block boundary, returning an empty range instead. Update dax/kmem to use this helper. Link: https://lore.kernel.org/20260712154505.3564379-1-gourry@gourry.net Link: https://lore.kernel.org/20260712154505.3564379-2-gourry@gourry.net Signed-off-by: Gregory Price <gourry@gourry.net> Reviewed-by: Dave Jiang <dave.jiang@intel.com> Reviewed-by: Dan Williams <djbw@kernel.org> Acked-by: David Hildenbrand (Arm) <david@kernel.org> Cc: Alison Schofield <alison.schofield@intel.com> Cc: Danilo Krummrich <dakr@kernel.org> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Oscar Salvador <osalvador@suse.de> Cc: "Rafael J. Wysocki" <rafael@kernel.org> Cc: Shuah Khan <shuah@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vishal Verma <vishal.l.verma@intel.com> Cc: Vlastimil Babka <vbabka@kernel.org> Cc: Hannes Reinecke <hare@suse.de> Cc: Pankaj Gupta <pankaj.gupta@amd.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-07power: supply: add stubs for notifier registration helpersElson Serrao
power_supply_reg_notifier() and power_supply_unreg_notifier() are declared unconditionally, with no fallback when CONFIG_POWER_SUPPLY is disabled. Any driver that calls them unconditionally fails to link: ERROR: modpost: "power_supply_unreg_notifier" [drivers/usb/dwc3/dwc3.ko] undefined! ERROR: modpost: "power_supply_reg_notifier" [drivers/usb/dwc3/dwc3.ko] undefined! Fix this by adding stub functions for these calls. Fixes: 7c87ef27af79 ("usb: dwc3: avoid probe deferral when USB power supply is not available") Reported-by: Randy Dunlap <rdunlap@infradead.org> Closes: https://lore.kernel.org/all/a9dd53b3-0666-404a-99e0-76617ae3f944@infradead.org/ Signed-off-by: Elson Serrao <elson.serrao@oss.qualcomm.com> Tested-by: Randy Dunlap <rdunlap@infradead.org> Acked-by: Randy Dunlap <rdunlap@infradead.org> Link: https://patch.msgid.link/20260805185401.3625514-1-elson.serrao@oss.qualcomm.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-08-06drm/ttm: Hook up a cgroup-aware reclaim callback for the dmem controllerThomas Hellström
Add ttm_bo_evict_cgroup() to evict buffer objects charged to a specific dmem cgroup pool from a resource manager's LRU until a byte target is met. Add ttm_resource_manager_set_dmem_region() to associate a dmem cgroup region with a resource manager; drivers supply their own dmem_cgroup_ops with ttm_resource_manager_dmem_reclaim as the reclaim function and the manager pointer as reclaim_priv in the dmem_cgroup_init to wire up TTM eviction as the reclaim callback. The eviction context is interruptible; signals abort the operation and propagate back through the write() syscall. Introduce a new mode for the bo LRU walker so that sleeping locks can be taken. This can be used when the caller doesn't hold any previous dma_resv locks, and where it intends to hold at most one lock at a time. Like the rest of the TTM eviction this should sooner than later be converted to full WW transactions. v3: - Fix ttm_resource_manager_set_dmem_region() storing an error pointer in man->cg unconditionally. (Sashiko-bot) - Fix kernel-doc function name format for ttm_bo_evict_cgroup() and ttm_resource_manager_set_dmem_region(). v5: - Rebased on the introduction of struct dmem_cgroup_init. - Handle NULL region in ttm_resource_manager_set_dmem_region() to clear the reclaim callback, preventing use-after-free when the manager is torn down while the dmem region outlives it. (Sashiko-bot) - Return 0 on any progress (even partial eviction), -ENOSPC only when nothing was freed; fixes callers that expected 0 on partial success. - Document that the reclaim callback should return 0 if some progress was made, -ENOSPC if no progress at all, or another error for fatal failures. v8: - Fix ttm_resource_manager_set_dmem_region() using IS_ERR_OR_NULL(), which skipped the assignment for a NULL region and thus never cleared man->cg. Use IS_ERR() so that a NULL region detaches the region as the kernel-doc and the v5 changelog intended. (Sashiko-bot) v9: - Don't leak cgroup charges for bos that may have survived dmemcg region fini. - Drop the misleading "Capture size before eviction in case res is cleared" comment in ttm_bo_evict_cb(). (Maarten Lankhorst) Assisted-by: GitHub_Copilot:claude-sonnet-4.6 Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> #v7 Tested-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com> Link: https://patch.msgid.link/20260725100036.2372-5-thomas.hellstrom@linux.intel.com Signed-off-by: Maarten Lankhorst <dev@lankhorst.se>
2026-08-06cgroup/dmem: Add reclaim callback for lowering max below current usageThomas Hellström
Add an optional reclaim callback to struct dmem_cgroup_region. When dmem.max is set below the current usage of a cgroup pool, the new limit is applied immediately (so that concurrent allocations are throttled while reclaim is in progress) and then the driver is asked to evict memory to bring usage back below the limit. Reclaim is attempted up to a bounded number of times. No error is returned to userspace if usage remains above the limit after reclaim, and a pending signal will abort the reclaim loop early. This matches the behavior of memory.max in the memory cgroup controller. Also honor O_NONBLOCK so that if that flag is set during the max value write, no reclaim is initiated. The idea is to avoid charging the reclaim cost to the writer of the max value. v2: - Write max before reclaim is attempted (Maarten) - Let signals abort the reclaim without error (Maarten) - If a new max value is written with the O_NONBLOCK flag, reclaim is not attempted (Maarten) - Extract region from the pool parameter rather than passing it explicitly to set_resource_xxx(). v3: - Use an rw_semaphore (unregister_sem) to protect reclaim callbacks against concurrent region unregistration: readers (reclaim) hold the read side; dmem_cgroup_unregister_region() takes the write side to drain in-flight callbacks before returning. (Sashiko-bot) v5: - Rebased on the introduction of struct dmem_cgroup_init. - Use nonblock=true in reset_all_resource_limits() to avoid sleeping inside rcu_read_lock() in dmemcs_offline(). (Sashiko-bot) - Compare usage against the truncated limit value stored in cnt.max, not the original u64. (Sashiko-bot) - Use a DMEM_MAX_RECLAIM_RETRIES (16) retry budget instead of 5, matching the memcg controller's MAX_RECLAIM_RETRIES. Only -ENOSPC (no progress) counts against the retry budget; other errors terminate the loop immediately. v6: - Fix dmem_cgroup_ops->reclaim docstring: -ENOSPC does not stop reclaim immediately but is retried up to DMEM_MAX_RECLAIM_RETRIES times; only other negative errors terminate the loop. (Sashiko-bot) v7: - Replace the per-region rw_semaphore with a static SRCU domain (dmemcg_srcu). SRCU is a better fit than rwsem for this use: it avoids the per-region lock overhead on every reclaim call, and synchronize_srcu() at unregister time is a rare operation. (Maarten) - Trim in-function comments to focus on what rather than how. Assisted-by: GitHub_Copilot:claude-sonnet-4.6 Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Tested-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com> Link: https://patch.msgid.link/20260725100036.2372-4-thomas.hellstrom@linux.intel.com Signed-off-by: Maarten Lankhorst <dev@lankhorst.se>
2026-08-06cgroup/dmem: Introduce struct dmem_cgroup_init for region initializationThomas Hellström
Replace the bare u64 size argument to dmem_cgroup_register_region() and drmm_cgroup_register_region() with a const struct dmem_cgroup_init * pointer. The struct currently carries only the size field, but using a struct makes the API extensible: future callers can supply additional initialization parameters without adding more positional arguments. Update all in-tree callers (amdgpu, xe) to use a compound-literal initializer. v5: - Commit introduced. Assisted-by: GitHub_Copilot:claude-sonnet-4.6 Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Tested-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com> Link: https://patch.msgid.link/20260725100036.2372-3-thomas.hellstrom@linux.intel.com Acked-by: Dave Airlie <airlied@redhat.com> Acked-by: Christian König <christian.koenig@amd.com> Signed-off-by: Maarten Lankhorst <dev@lankhorst.se>
2026-08-06Merge tag 'for-7.2-rc6-fixup-worker-tag' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull Btrfs Fixes 2: Electric Boogaloo from David Sterba: "This brings back the fixup worker infrastructure. It's a mechanism to detect pages/folios that are marked dirty without filesystem knowledge and require COW fixup. The consequence of not doing so is silent data loss. The first patch covers the scenarios in detail, also reflecting folio API port and subpage block size support added in recent years. The original fixup worker was only for pages. The patch is relatively big, half of the code is debugging and support code, the rest is the core design around the detection and fix. The second patch handles an unlikely case when there's work left during unmount" * tag 'for-7.2-rc6-fixup-worker-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: flush the fixup workers during close_ctree btrfs: trigger cow fixup via dirty_folio()
2026-08-06Merge tag 'wireless-next-2026-08-06' of ↵Jakub Kicinski
https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Johannes Berg says: ==================== Quite a bunch more work, of note: - iwlwifi: new FW version support - mt76: - mt7928 support - mt7925 NAN support - mt7996 AP powersave improvements - rtw89: - LED support - RTL8922DE support - dual-BT coex for RTL8922D - ath12k: AHB platform MultiPD support - cfg80211: pre-assign cookies for operations - mac80211: AQL support for multicast * tag 'wireless-next-2026-08-06' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (403 commits) wifi: nxpwifi: bound uAP association event IEs to the event buffer wifi: nxpwifi: detach sync command buffer on interrupted wait wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() wifi: rsi: Fix types to appease CFI wifi: mac80211: skip default WMM setup for AP_VLAN links wifi: nxpwifi: fix multiple static analysis errors and warnings wifi: morsemicro: MM81X should be invisible and selected by its users wifi: nxp: NXPWIFI should be invisible and selected by its users wifi: cfg80211: stop PMSR before P2P and NAN teardown wifi: mac80211: disconnect on CSA to channel 0 wifi: brcmfmac: fix P2P action frame handling without device vif wifi: brcmfmac: Set DMA direction for msgbuf packet IDs wifi: brcmfmac: validate msgbuf flowring IDs before use wifi: mac80211: fix RCU usage in peer probing wifi: mac80211: fix RCU dereference in throughput estimate wifi: wilc1000: validate monitor transmit frame headers wifi: mac80211: skip unused probe response countdown offsets wifi: zd1211rw: reject secondary interfaces to prevent conflicts wifi: nl80211: clean up color-change beacon data on errors wifi: mac80211: send TWT teardown to peer after setup TX failure ... ==================== Link: https://patch.msgid.link/20260806121304.190084-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-06Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski
Cross-merge networking fixes after downstream PR (net-7.2-rc7). No conflicts, or adjacent changes. Signed-off-by: Jakub Kicinski <kuba@kernel.org>