aboutsummaryrefslogtreecommitdiffstats
path: root/include/linux
AgeCommit message (Collapse)AuthorFilesLines
2026-07-22bpf, x86: Make sure allocation in arch_bpf_trampoline_size() is writableMike Rapoport (Microsoft)1-0/+1
arch_bpf_trampoline_size() allocates a buffer to get actual size required for a trampoline. This buffer must be in the module address space because __arch_prepare_bpf_trampoline() calculates rel32 offsets relatively to that buffer. In preparation for enabling ROX mode for EXECMEM_BPF make sure that the allocated memory is writable. Add bpf_jit_alloc_exec_rw() wrapper for execmem_alloc_rw() and use it for buffer allocation in arch_bpf_trampoline_size(). Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org> Acked-by: Song Liu <song@kernel.org> Link: https://lore.kernel.org/bpf/20260716-execmem-x86-rox-bpf-v0-v3-4-4e76158c01c5@kernel.org Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-22Merge branch 'big-tcp-for-udp-tunnels'Paolo Abeni1-0/+27
Alice Mikityanska says: ==================== BIG TCP for UDP tunnels This series is a follow-up to "BIG TCP without HBH in IPv6", and it adds support for BIG TCP IPv4/IPv6 workloads in vxlan and geneve. Now that IPv6 BIG TCP doesn't require stripping the HBH in all various combinations in tunneled traffic, adding BIG TCP becomes feasible. Patch 01 adds accessors for the length field in the UDP header, as suggested by Paolo in review. The usage of udp_set_len is then added in the following patches that start using length=0 in BIG TCP UDP packets. Patches 02-04 close the gaps that prevent BIG TCP packets from going through UDP tunnel code. Patch 05 validates packets in udp_gro_receive to exclude packets with length=0 from GRO aggregation. Patch 06 is for proper formatting in tcpdump (set UDP len to 0 rather than a trimmed value on overflow). Patches 07-08 bump up tso_max_size for VXLAN and GENEVE. Patch 09 adds selftests. ====================$ Link: https://patch.msgid.link/20260710134242.216538-1-alice.kernel@fastmail.im Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-22net: Use helpers to get/set UDP len tree-wideAlice Mikityanska1-0/+27
Since BIG TCP for UDP tunnels will start using len=0 in the UDP header as an indicator of a GSO packet bigger than 65535 bytes, this commit introduces the following getter and setters to use tree-wide, in order to explicitly mark places where len=0 may be expected, and handle them properly: 1. udp_set_len() sets uh->len to its real value if it's not bigger than 65535, and to 0 otherwise: to be used in GSO context with aggregated packets. 2. udp_set_len_short() is to be used when the length is known to fit 16 bits. It WARNs when the caller tries to assign a bigger value if CONFIG_DEBUG_NET=y. 3. udp_get_len_short() returns len in host byte order: to be used on the RX side to deal with non-aggregated packets, or to access the raw value of the len field. 4. udp_get_len() decodes uh->len set by udp_set_len(). It checks whether the packet is GSO to guard from malformed packets. At the moment udp_set_len() is not used, a following commit will start using it after enabling len>65535 for GSO. Raw uh->len (in network byte order) is still accessed in a few places for checksum calculation purposes, and to decode len=0 in udpv6_rcv for jumbograms. udp_rcv and udpv6_rcv will be addressed by the commit that starts using udp_set_len() to set UDP len=0 for BIG TCP packets in UDP tunnels. Signed-off-by: Alice Mikityanska <alice@isovalent.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Acked-by: Jason A. Donenfeld <Jason@zx2c4.com> Link: https://patch.msgid.link/20260710134242.216538-2-alice.kernel@fastmail.im Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-22Merge back ACPI video bus driver changes for 7.3Rafael J. Wysocki1-0/+1
Merge the introduction of acpi_dev_is_video_device() along with some following driver updates related to it (from Andy Shevchenko). * acpi-video: platform/x86: thinkpad_acpi: Convert to use acpi_dev_is_video_device() helper PCI/VGA: Convert to use acpi_dev_is_video_device() helper i2c: acpi: Convert to use acpi_dev_is_video_device() helper ACPI: video: Convert to use acpi_dev_is_video_device() helper ACPI: scan: Convert to use acpi_dev_is_video_device() helper ACPI: utils: Introduce acpi_dev_is_video_device() helper
2026-07-21perf/arm_pmu: Skip PMCCNTR_EL0 on NVIDIA OlympusBesar Wicaksono1-1/+1
The PMCCNTR_EL0 in NVIDIA Olympus CPU may increment while in WFI/WFE, which does not align with counting CPU_CYCLES on a programmable counter. Add a MIDR range entry and refuse PMCCNTR_EL0 for cycle events on affected parts so perf does not mix the two behaviors. Also keep PMCCNTR_EL0 unavailable to EL0 direct counter reads on affected CPUs. When userspace counter access is enabled, avoid setting PMUSERENR_EL0.CR for PMUs that must avoid PMCCNTR_EL0, while still allowing direct reads from programmable event counters. For 64-bit userspace CPU_CYCLES events on PMUs without native long event counters, reject the event if the only valid direct-read path would be PMCCNTR_EL0. Signed-off-by: Besar Wicaksono <bwicaksono@nvidia.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-07-21Merge tag 'nxpwifi-2026-07-15' of https://github.com/jeffchen71/nxpwifiJohannes Berg1-0/+1
Jeff Chen says: =============== wifi: nxp: patches for wireless-next In nxpwifi, introduce initial driver support for NXP IW61x Wi-Fi chipsets. The driver supports 802.11ac/ax, SDIO interface, Station and uAP modes. =============== [list the full vendor directory in MAINTAINERS] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-21wifi: mac80211: parse enhanced critical updates fieldJohannes Berg1-0/+92
For association and link reconfiguration response, parse and store the enhanced BSS parameter change counter out of the enhanced critical updates field in the multi-link common info or per-STA profile. These are required for UHR connections. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260714134154.adb9fc29252d.I625580fbadbbf4a1440d88d3675586477f1a3263@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-21ACPI: pmtmr: Convert to kernel-doc formatRandy Dunlap1-4/+6
Prevent kernel-doc warnings by converting 2 functions to kernel-doc format: Warning: ./include/linux/acpi_pmtmr.h:29 This comment starts with '/**', but isn't a kernel-doc comment. * Register callback for suspend and resume event Warning: ./include/linux/acpi_pmtmr.h:37 This comment starts with '/**', but isn't a kernel-doc comment. * Remove registered callback for suspend and resume event Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Link: https://patch.msgid.link/20260720032341.3087008-3-rdunlap@infradead.org Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-07-21power: supply: leds: create triggers based on properties, not typeSteffen Dirkwinkel1-1/+2
Currently only battery power supplies get triggers for other properties and other supplies only get the online trigger. This changes it to provide the triggers for any power supply depending on what properties are available. Batteries will still get the same triggers if the properties are there, but now other power supplies can get the triggers too. Signed-off-by: Steffen Dirkwinkel <s.dirkwinkel@beckhoff.com> Link: https://patch.msgid.link/20260625-std-power-supply-triggers-v1-1-d80db570d329@beckhoff.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-07-21power: supply: Add PbAc, NiZn, RAM, and ZnAr supportBoris Shtrasman1-0/+4
Add four new members to the POWER_SUPPLY_TECHNOLOGY enum and sysfs interface to represent the Smart Battery Data Specification v1.1 (Section 5.1.30 DeviceChemistry) battery types: - Lead Acid (PbAc) - Nickel Zinc (NiZn) - Rechargeable Alkaline-Manganese (RAM) - Zinc Air (ZnAr) Update documentation to express these types. Update ABI testing for these types. Link: https://sbs-forum.org/specs/sbdat110.pdf Signed-off-by: Boris Shtrasman <borissh1983@gmail.com> Link: https://patch.msgid.link/20260624135718.286771-2-borissh1983@gmail.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-07-21bpf: Extract the is_struct_ops_tramp helperPu Lehui1-0/+6
Extract the is_struct_ops_tramp helper, and use it in riscv as the current checks are somewhat hacky. Signed-off-by: Pu Lehui <pulehui@huawei.com> Reviewed-by: Björn Töpel <bjorn@kernel.org> Acked-by: Björn Töpel <bjorn@kernel.org> Link: https://lore.kernel.org/bpf/20260708064436.2971933-2-pulehui@huaweicloud.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-21wifi: use UHR operation field presence bitsJohannes Berg1-22/+22
The spec originally had the idea that the fact that it's a beacon frame determines the (non-)presence of the values, but added presence bits in D1.4. Use those presence bits in addition to the enable bits. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260715210407.3b1a79b0d002.Iaa762c55b4b6dc63d55f2d7b8b42acd47e640d50@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-21ACPI: utils: Introduce acpi_dev_is_video_device() helperAndy Shevchenko1-0/+1
There are a couple of users that open code functionality of matching a given handle against ACPI video device IDs. The current approach duplicates ID table along with the matching code. Consolidate it under the acpi_dev_is_video_device() helper's hood. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> [ rjw: Moved the static var declaration into the function body ] Link: https://patch.msgid.link/20260714185915.865396-2-andriy.shevchenko@linux.intel.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-07-21dmaengine: dw-edma: Program endpoint function numbersKoichiro Den1-0/+2
The eDMA/HDMA transfers the driver issues carry a requester function number in their TLPs, but nothing ever programs it: eDMA v0 leaves the FUNC_NUM field of the channel control word zero and HDMA leaves the per-channel func_num register at its reset value, so every transfer is attributed to function 0. That is invisible in single-function setups, but once the DMA block serves a non-zero endpoint function, its requests must carry that function's number for the host to attribute and translate them correctly. Record the function number in the chip data (PCI_FUNC() of the probing device for dw-edma-pcie) and program it per channel. Endpoint-local chip instances keep func_no at 0, so transfers issued by the endpoint-side driver remain PF0-attributed. Delegated channels are programmed by the host-side dw-edma-pcie instance when it takes over the channel, using that instance's PCI_FUNC(). Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Koichiro Den <den@valinux.co.jp> Link: https://patch.msgid.link/20260721062815.4117887-15-den@valinux.co.jp Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-07-21dmaengine: dw-edma: Add partial channel ownership modeKoichiro Den1-0/+7
A DesignWare eDMA instance may represent only a subset of channels that is also initialized by another OS instance, such as an endpoint-side OS. Add a partial ownership flag for instances that must preserve controller-wide state owned by that peer. In partial ownership mode, dw-edma skips the initial core reset and uses the limited quiesce path in probe() and remove() instead of the full core-off path. The flag also makes the driver validate the ownership granularity required by each register layout before registering channels. Probe fails if the limited quiesce cannot stop its resources; remove reports the error after completing the remaining driver teardown. Partial instances also skip interrupt-emulation doorbell allocation: the emulated doorbell is a controller-level resource, and a partial owner must not claim it on behalf of the whole block. For EDMA_MF_EDMA_UNROLL and EDMA_MF_HDMA_COMPAT, the driver programs per-direction registers, such as DMA_{WRITE,READ}_INT_MASK_OFF and DMA_{WRITE,READ}_INT_CLEAR_OFF. These register layouts have at most EDMA_MAX_{WR,RD}_CH channels per direction, so the capped hardware channel count still represents the whole direction. A partial instance can therefore expose write or read channels only if it owns every channel in that direction; otherwise two OS instances could update the same direction-wide registers without a shared locking protocol. In contrast, HDMA native uses per-channel registers, so it can be owned at channel granularity. Signed-off-by: Koichiro Den <den@valinux.co.jp> Link: https://patch.msgid.link/20260721062815.4117887-6-den@valinux.co.jp Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-07-21dmaengine: dw-edma: Add per-channel interrupt routing controlKoichiro Den1-0/+32
DesignWare eDMA can signal completion locally through edma_int[] and remotely through IMWr/MSI. When channels are delegated to a remote frontend, the local endpoint side and the remote host side must not both service the same DONE/ABORT status. Add channel interrupt routing state and initialize it from the controller instance configuration. Update the eDMA and HDMA native paths so linked-list interrupt generation, HDMA non-linked-list interrupt enables, and DONE/ABORT masking follow the selected mode. For HDMA native non-linked-list channels, keep the local stop/abort enables set so status is latched. In remote mode, also enable remote signaling and mask the local interrupt pins. Keep the existing dw-edma-pcie host-side instances in remote interrupt routing mode so their IMWr/MSI completion model remains unchanged after local routing becomes the zero value. Note: - The routing mode describes where a channel should report completion. It does not by itself say whether this dw-edma instance owns the interrupt status. A local instance must ignore remote-only channels, and a remote instance must ignore local-only channels, even if such interrupts are unexpectedly delivered. Otherwise the non-owner side could steal the interrupt from the owner by clearing shared DONE/ABORT status. Cc: Devendra K Verma <devendra.verma@amd.com> Suggested-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Koichiro Den <den@valinux.co.jp> Link: https://patch.msgid.link/20260721062815.4117887-3-den@valinux.co.jp Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-07-21slab: silence sparse warning with type-based partitioningMarco Elver1-1/+5
Sparse does not know __builtin_infer_alloc_token() and complains: sparse: sparse: undefined identifier '__builtin_infer_alloc_token' Fix it by using a dummy variant of __kmalloc_token() if __CHECKER__ is defined. Fixes: feb662d9168b ("slab: support for compiler-assisted type-based slab cache partitioning") Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202607110912.nZTqfCrH-lkp@intel.com/ Signed-off-by: Marco Elver <elver@google.com> Link: https://patch.msgid.link/20260721092005.1986693-1-elver@google.com Acked-by: Harry Yoo (Oracle) <harry@kernel.org> Signed-off-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
2026-07-21net: phy: add generic helpers for direct C45 MMD accessCiprian Regus1-0/+3
Some PHYs support direct C45 register access but not C22 indirect MMD access (registers 0xD and 0xE). When discovered via C22, phylib routes MMD access through the indirect path, which won't work on these devices. Add genphy_read_mmd_c45() and genphy_write_mmd_c45() as read_mmd/ write_mmd callbacks that bypass the C22 indirect path and use the bus C45 accessors directly. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Ciprian Regus <ciprian.regus@analog.com> Link: https://patch.msgid.link/20260708-adin1140-driver-v5-10-4aca7b51a58b@analog.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-21net: ethernet: oa_tc6: Add new register address definesCiprian Regus1-1/+5
Add macro defines for the CONFIG2 register and the MMS1 memory map. Signed-off-by: Ciprian Regus <ciprian.regus@analog.com> Link: https://patch.msgid.link/20260708-adin1140-driver-v5-9-4aca7b51a58b@analog.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-21net: ethernet: oa_tc6: Add read_mms/write_mms register access functionsCiprian Regus1-0/+4
The Open Alliance TC6 standard defines multiple memory maps for the MAC-PHY's register space. These are used to separate standard, vendor and PHY MMD specific registers. Define register access functions that allow the caller to specify the MMS. Signed-off-by: Ciprian Regus <ciprian.regus@analog.com> Link: https://patch.msgid.link/20260708-adin1140-driver-v5-7-4aca7b51a58b@analog.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-21net: ethernet: oa_tc6: Add the OA_TC6_ prefix to standard registersCiprian Regus1-20/+20
The OA TC6 standard registers are currently exported in a header file. Add the OA_TC6_ prefix to the register address and subfield mask macros to avoid future naming conflicts. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Ciprian Regus <ciprian.regus@analog.com> Link: https://patch.msgid.link/20260708-adin1140-driver-v5-6-4aca7b51a58b@analog.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-21net: ethernet: oa_tc6: Export standard defined registersCiprian Regus1-0/+50
Move defines for standard Open Alliance TC6 register addresses and subfields in the oa_tc6's header. As such, other ethernet drivers that rely on oa_tc6 can use them directly. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Ciprian Regus <ciprian.regus@analog.com> Link: https://patch.msgid.link/20260708-adin1140-driver-v5-5-4aca7b51a58b@analog.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-21net: ethernet: oa_tc6: Export the C45 access functionsCiprian Regus1-0/+4
The C45 access functions can still be used by some Ethernet drivers which set the OA_TC6_BROKEN_PHY flag. Export them. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Ciprian Regus <ciprian.regus@analog.com> Link: https://patch.msgid.link/20260708-adin1140-driver-v5-4-4aca7b51a58b@analog.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-21net: ethernet: oa_tc6: add OA_TC6_BROKEN_PHY quirk flagCiprian Regus1-1/+10
Some MAC-PHY devices need custom MDIO bus access functions to work around hardware issues. Add the OA_TC6_BROKEN_PHY quirk flag so drivers can opt in to skip oa_tc6's internal PHY init and manage the PHY themselves. When the flag is set, oa_tc6 skips MDIO bus registration, PHY discovery and PHY connection, leaving these to the driver. Drivers that do not set the flag retain the existing behavior. Update lan865x and the framework documentation accordingly. Signed-off-by: Ciprian Regus <ciprian.regus@analog.com> Link: https://patch.msgid.link/20260708-adin1140-driver-v5-3-4aca7b51a58b@analog.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-20mm: mglru: fix stale batch updates after memcg reparentingQi Zheng1-0/+25
The mglru page table walker batches per-generation size deltas in walk->nr_pages while walking page tables without holding the lruvec lock. The reset_batch_size() later folds those deltas into walk->lruvec under the lruvec lock. The page table walker can run concurrently with the memcg reparenting path as follows: CPU0 CPU1 ==== ==== walk_mm --> walk_page_range --> update_batch_size --> walk->nr_pages += delta mem_cgroup_css_offline --> memcg_reparent_objcgs --> lock lruvec lru_gen_reparent_memcg --> reparent child folios to parent unlock lruvec lock lruvec reset_batch_size --> child lrugen->nr_pages += delta This will trigger the following warning in lru_gen_exit_memcg(): VM_WARN_ON_ONCE(memchr_inv(lruvec->lrugen.nr_pages, 0, sizeof(lruvec->lrugen.nr_pages))); And the user-visible impact of underestimated nr_pages in MGLRU was premature OOMs because MGLRU does not try to reclaim memory when nr_pages reaches zero, but there are still more pages. To fix it, make reset_batch_size() check CSS_DYING under RCU before flushing the pending batch. A non-dying memcg keeps the original lruvec stable against RCU-delayed offlining; a dying memcg redirects the deltas to the first non-dying ancestor. Link: https://lore.kernel.org/20260710154318.75388-1-qi.zheng@linux.dev Fixes: f304652609ea ("mm: vmscan: prepare for reparenting MGLRU folios") Signed-off-by: Qi Zheng <zhengqi.arch@bytedance.com> Reported-by: Peiyang He <peiyang_he@smail.nju.edu.cn> Closes: https://lore.kernel.org/all/5A9E929D82717101+12fcf643-efb8-4b9a-a53a-1e28cc894f0b@smail.nju.edu.cn Reviewed-by: Harry Yoo (Oracle) <harry@kernel.org> Acked-by: Johannes Weiner <hannes@cmpxchg.org> Acked-by: Shakeel Butt <shakeel.butt@linux.dev> Cc: Axel Rasmussen <axelrasmussen@google.com> Cc: Barry Song <baohua@kernel.org> Cc: David Hildenbrand <david@kernel.org> Cc: Kairui Song <kasong@tencent.com> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@kernel.org> Cc: Muchun Song <muchun.song@linux.dev> Cc: Roman Gushchin <roman.gushchin@linux.dev> Cc: Wei Xu <weixugc@google.com> Cc: Yuanchu Xie <yuanchu@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-07-20Merge tag 'mm-hotfixes-stable-2026-07-20-11-37' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mmLinus Torvalds2-3/+3
Pull misc fixes from Andrew Morton: "12 hotfixes. 8 are cc:stable and the remainder address post-7.1 issues or aren't considered appropriate for backporting. 10 are for MM. All are singletons - please see the relevant changelogs for details" * tag 'mm-hotfixes-stable-2026-07-20-11-37' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mm/memory-failure: trace: change memory_failure_event to ras subsystem mm: page_reporting: allow driver to set batch capacity mm/kmemleak: fix checksum computation for per-cpu objects mm/damon/core: disallow overlapping input ranges for damon_set_regions() MAINTAINERS: add Usama as a THP reviewer fat: avoid stack overflow warning mm/damon/core: validate ranges in damon_set_regions() m68k: avoid -Wunused-but-set-parameter in clear_user_page() mm/huge_memory: set PG_has_hwpoisoned only after new folio head is established mm/page_vma_mapped: fix device-private PMD handling MAINTAINERS: s/SeongJae/SJ/ userfaultfd: prevent registration of special VMAs
2026-07-20hfs: port HFS+ b-tree bitmap corruption checkAditya Prakash Srivastava1-3/+10
In HFS+ filesystems, during b-tree open (hfs_btree_open()), the code verifies that the allocation map bit for the tree header (node 0) is set. If not, it indicates a corrupted map record/bitmap and mounts the volume as read-only (SB_RDONLY) to prevent further damage. HFS filesystems share the same b-tree structure but currently lack this corruption detection check. Port this check to HFS, aligning its implementation with HFS+ to maintain consistent b-tree logic across both filesystems: 1. Define struct hfs_bmap_ctx, and define HFS_TREE_HEAD and the relevant map record indices in include/linux/hfs_common.h. 2. Port the necessary offset and length validation helpers to fs/hfs/btree.h as static inline functions with robust null pointer checks. 3. Implement static hfs_bmap_get_map_page() in fs/hfs/btree.c. 4. Implement static hfs_bmap_test_bit() in fs/hfs/btree.c to inspect the B-tree bitmap using the get_map_page helper. 5. Implement static hfs_bmap_clear_bit() in fs/hfs/btree.c. 6. Rewrite hfs_bmap_alloc() in fs/hfs/btree.c to use the unified hfs_bmap_get_map_page() helper, eliminating redundant page and offset calculation code. 7. Refactor hfs_bmap_free() in fs/hfs/btree.c to use the new hfs_bmap_clear_bit() helper. 8. In hfs_btree_open(), retrieve the header node via hfs_bnode_find(), test its allocation bit with hfs_bmap_test_bit(), and release it using hfs_bnode_put(). Suggested-by: Viacheslav Dubeyko <slava@dubeyko.com> Link: https://lore.kernel.org/all/6a36101b.be22b350.2a3e9.0001.GAE@google.com/T/#r446d0fed2a2900bd805534bbcb799d86619ae2ea Signed-off-by: Aditya Prakash Srivastava <aditya.ansh182@gmail.com> Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com> Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com> Link: https://lore.kernel.org/r/20260716074150.1660-1-aditya.ansh182@gmail.com Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
2026-07-20entry, treewide: Make syscall_enter_from_user_mode[_work]() indicate syscall executionThomas Gleixner1-16/+16
The return values of syscall_enter_from_user_mode[_work]() are non-intuitive. Both functions return the syscall number which should be invoked by the architecture specific syscall entry code. The returned number can be: - the unmodified syscall number which was handed in by the caller - a modified syscall number (ptrace, seccomp, trace/probe/bpf) That has an additional twist. If the return value is -1L then the caller is not allowed to modify the return value as that indicates that the modifying entity requests to abort the syscall and set the return value already. That can obviously not be differentiated from a syscall which handed in -1 as syscall number. The most trivial way to deal with that is: set_return_value(regs, -ENOSYS); nr = syscall_enter_from_user_mode(regs, nr); if (valid(nr)) handle_syscall(regs, nr); That's what LOONGARCH, RISCV, and X86 do. But PowerPC and S390 do not preset the return value, so when user space hands in -1 and there is nothing setting the return value in the entry work code, then the syscall is skipped but the return value is whatever random data has been in the return value register. Change the return values of syscall_enter_from_user_mode[_work]() to boolean and return false, when either ptrace or seccomp request to skip the syscall. If they return true, update the syscall number as it might have been changed. That results in slightly different behaviour of the architectures versus tracing. If the syscall tracepoint has probe/BPF attached, those might set the syscall number to -1 and also set the return value. PowerPC and S390 will then overwrite that value with -ENOSYS. The other architectures will just ignore it like any other invalid syscall and use the modified one. Originally-by: Michal Suchánek <msuchanek@suse.de> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Tested-by: Michal Suchánek <msuchanek@suse.de> Link: https://patch.msgid.link/20260712141346.772209074@kernel.org
2026-07-20entry: Make return type of syscall_trace_enter() boolThomas Gleixner1-7/+11
This prepares for changing the return types of syscall_enter_from_user_mode[_work]() to bool, which in turn separates the decision of invoking the syscall from the syscall number, which might have been changed in the call by ptrace, seccomp, tracing. Signed-off-by: Thomas Gleixner <tglx@kernel.org> Tested-by: Michal Suchánek <msuchanek@suse.de> Reviewed-by: Jinjie Ruan <ruanjinjie@huawei.com> Link: https://patch.msgid.link/20260712141346.699072205@kernel.org
2026-07-20entry: Rework trace_syscall_enter()Thomas Gleixner1-6/+4
Reread the syscall number from pt_regs and stop returning the eventually modified syscall number. That moves the reread to the end of syscall_trace_enter() and prepares for moving it to the call site. No functional change. Signed-off-by: Thomas Gleixner <tglx@kernel.org> Tested-by: Michal Suchánek <msuchanek@suse.de> Reviewed-by: Jinjie Ruan <ruanjinjie@huawei.com> Link: https://patch.msgid.link/20260712141346.639115923@kernel.org
2026-07-20entry: Rework syscall_audit_enter()Thomas Gleixner1-11/+3
Move it out of line and let it reread the syscall number on it's own. That makes the low level entry code denser and allows to move the reread to the call site of syscall_trace_enter() once the tracer is fixed up. To prevent the compiler from putting audit_context() out of line and thereby breaking dead code elimination, mark audit_context() __always_inline. Signed-off-by: Thomas Gleixner <tglx@kernel.org> Tested-by: Michal Suchánek <msuchanek@suse.de> Reviewed-by: Jinjie Ruan <ruanjinjie@huawei.com> Link: https://patch.msgid.link/20260712141346.576865340@kernel.org
2026-07-20regcache: Warn if regcache_sync() is called in cache_only modeMark Brown126-1053/+1700
phucduc.bui@gmail.com <phucduc.bui@gmail.com> did a bit of work to help people avoid running into silly errors. Link: https://patch.msgid.link/20260720033238.52479-1-phucduc.bui@gmail.com
2026-07-20blk-crypto: Remove unused function blk_crypto_config_supported()Eric Biggers1-2/+0
blk_crypto_config_supported() is no longer called, so remove it. Reviewed-by: Christoph Hellwig <hch@lst.de> Link: https://patch.msgid.link/20260718214655.63186-6-ebiggers@kernel.org Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-07-20fscrypt: Remove unused function fscrypt_finalize_bounce_page()Eric Biggers1-11/+0
fscrypt_finalize_bounce_page() is no longer called, so remove it. Reviewed-by: Christoph Hellwig <hch@lst.de> Link: https://patch.msgid.link/20260718214655.63186-4-ebiggers@kernel.org Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-07-20fs: Update outdated comment for SB_INLINECRYPTEric Biggers1-1/+1
Update the comment for SB_INLINECRYPT to match the latest code, where SB_INLINECRYPT now controls whether blk-crypto uses inline encryption hardware rather than whether blk-crypto is used. Reviewed-by: Christoph Hellwig <hch@lst.de> Link: https://patch.msgid.link/20260718214655.63186-2-ebiggers@kernel.org Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-07-20fscrypt: Merge bio.c and inline_crypt.c into block.cEric Biggers1-13/+9
Now that fscrypt always uses blk-crypto on block-based filesystems, there's no meaningful difference between bio.c and inline_crypt.c. Therefore merge the two files into one named block.c. Note: I didn't carry over bio.c's "Copyright (C) 2015, Motorola Mobility", as none of the code that applied to remained. Reviewed-by: Christoph Hellwig <hch@lst.de> Link: https://patch.msgid.link/20260713023708.9245-17-ebiggers@kernel.org Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-07-20fscrypt: Remove unused functions and workqueueEric Biggers1-47/+0
Remove functions that are no longer used: - fscrypt_decrypt_bio() - fscrypt_decrypt_pagecache_blocks() - fscrypt_inode_uses_fs_layer_crypto() - fscrypt_inode_uses_inline_crypto() - fscrypt_enqueue_decrypt_work() This makes the decryption workqueue unused, so remove it too. Reviewed-by: Christoph Hellwig <hch@lst.de> Link: https://patch.msgid.link/20260713023708.9245-16-ebiggers@kernel.org Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-07-20fscrypt: Remove fscrypt_dio_supported()Eric Biggers1-7/+0
On block-based filesystems, fscrypt file contents encryption is now always implemented using blk-crypto. This implementation supports direct I/O. Therefore, fscrypt_dio_supported() now always returns true, except in the edge case where statx(STATX_DIOALIGN) is called on an encrypted regular file that hasn't had its key set up. But that was really a workaround rather than the desired behavior, so we can disregard it. Thus, fscrypt_dio_supported() is no longer needed. Remove it. Reviewed-by: Christoph Hellwig <hch@lst.de> Link: https://patch.msgid.link/20260713023708.9245-14-ebiggers@kernel.org Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-07-20fscrypt: Always use blk-crypto for contents on block-based filesystemsEric Biggers1-17/+11
For encrypting and decrypting file contents on block-based filesystems (i.e., ext4 and f2fs, but not ceph and ubifs), always use blk-crypto instead of fs-layer crypto (direct use of crypto_skcipher). Since the blk-crypto API provides a fallback to CPU-based encryption, it's all that's needed on block-based filesystems. The support for two alternative block-based file contents encryption implementations, fs-layer and blk-crypto, existed mainly for historical reasons, as the fs-layer path came first. Some of it is also still needed for the non-block-based filesystems, but a lot of it isn't. Removing the duplicate fs-layer code paths greatly simplifies the code, most of which is done in later commits. Specific implementation details: - SB_INLINECRYPT now controls whether blk_crypto_config::allow_hw is set to true, instead of whether blk-crypto is used at all. The effect is that the semantics are preserved: the inlinecrypt mount option selects the use of inline encryption hardware instead of the CPU. - Set up a blk_crypto_key iff the file is a regular file on a block-based filesystem. To determine whether the filesystem is block-based, add a bit fscrypt_operations::is_block_based. - Remove fscrypt_select_encryption_impl(). Move the logging logic that was previously there into fscrypt_prepare_inline_crypt_key(). Note that blk_crypto_config_supported() is no longer needed. Reviewed-by: Christoph Hellwig <hch@lst.de> Link: https://patch.msgid.link/20260713023708.9245-6-ebiggers@kernel.org Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-07-20blk-crypto: Allow control over whether hardware is usedEric Biggers1-1/+12
fscrypt uses inline encryption hardware only when the "inlinecrypt" mount option is given. I'd like to keep that behavior even after standardizing on the blk-crypto API for file contents encryption. That is, the default should continue to be the well-tested CPU-based encryption code, and the use of inline encryption hardware should continue to be an opt-in feature for systems where it's beneficial and has been fully validated (including verifying ciphertext correctness). To support this use case, extend blk_crypto_config with a new flag BLK_CRYPTO_CFG_ALLOW_HW. For now it's always set. Later commits will change that. Reviewed-by: Christoph Hellwig <hch@lst.de> Link: https://patch.msgid.link/20260713023708.9245-4-ebiggers@kernel.org Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-07-20fscrypt: Avoid dynamic allocation in fscrypt_get_devices()Eric Biggers1-8/+10
When a blk_crypto_key starts being used or is evicted, fs/crypto/ calls fscrypt_get_devices() to get the filesystem's list of block devices, then iterates over them and calls blk_crypto_config_supported(), blk_crypto_start_using_key(), or blk_crypto_evict_key() on each one. Currently, the block device pointers are placed in a dynamically allocated array. This dynamic allocation is problematic because: - It can fail, especially at the fscrypt_destroy_inline_crypt_key() call site when it's invoked for inode eviction under direct reclaim. - fscrypt_destroy_inline_crypt_key() doesn't handle the failure. It just zeroizes and frees the blk_crypto_key without calling blk_crypto_evict_key(). That causes a use-after-free. For now, let's fix this in the straightforward and easily-backportable way by switching to an on-stack array. Currently the fscrypt multi-device functionality is used only by f2fs, which has a hardcoded limit of 8 block devices. An on-stack array works fine for that. (Of course, this solution won't scale up to large number of block devices. For that we'd need a different solution, like moving the block device iteration into the filesystem. Or in the case of btrfs, which will only support blk-crypto-fallback, we should make it just call blk-crypto-fallback directly, so the block devices won't be needed.) Fixes: 22e9947a4b2b ("fscrypt: stop holding extra request_queue references") Cc: stable@vger.kernel.org Reported-by: Sashiko <sashiko-bot@kernel.org> Closes: https://sashiko.dev/#/patchset/20260713023708.9245-1-ebiggers%40kernel.org Reviewed-by: Christoph Hellwig <hch@lst.de> Link: https://patch.msgid.link/20260719055602.78828-1-ebiggers@kernel.org Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-07-20posix-cpu-timers: Avoid kernel-doc warningsRandy Dunlap1-3/+3
Use the struct keyword when describing a struct. Without that, the type defaults to function. Warning: ./include/linux/posix-timers_types.h:40 cannot understand function prototype: 'struct posix_cputimer_base' Warning: ./include/linux/posix-timers_types.h:55 cannot understand function prototype: 'struct posix_cputimers' Warning: ./include/linux/posix-timers_types.h:67 cannot understand function prototype: 'struct posix_cputimers_work' Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260720031236.3070575-2-rdunlap@infradead.org
2026-07-20posix-timers: Clean up kernel-doc warningsRandy Dunlap1-1/+2
Use the struct keyword when describing a struct. Add missing kernel-doc for @it_pid_type. Warning: ./include/linux/posix-timers.h:58 cannot understand function prototype: 'struct cpu_timer' Warning: ./include/linux/posix-timers.h:222 struct member 'it_pid_type' not described in 'k_itimer' Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260720031236.3070575-1-rdunlap@infradead.org
2026-07-20PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systemsSteffen Persvold1-0/+3
On 32-bit systems the config space is too large to ioremap in one go, so pci_ecam_create() maps each bus segment separately and relies on the ->add_bus callback (pci_ecam_add_bus) to populate the per-bus mapping in cfg->winp[]. pci_ecam_map_bus() then uses that mapping as the base for every config access. The generic ECAM ops (pci_generic_ecam_ops) already provide the ->add_bus and ->remove_bus callbacks, but the CAM (legacy) ops in pci-host-generic.c do not. As a result, on a 32-bit host using "pci-host-cam-generic" the per-bus mapping is never set up and the first config read dereferences a NULL base, crashing during bus enumeration: Unable to handle kernel NULL pointer dereference at virtual address 00000800 Oops [#1] CPU: 0 PID: 1 Comm: swapper Not tainted 6.9.7+ #43 Hardware name: Digilent Nexys-Video-A7 RV32 (DT) epc : pci_generic_config_read+0x40/0xb0 ra : pci_generic_config_read+0x2c/0xb0 [<c038db9c>] pci_generic_config_read+0x40/0xb0 [<c038da04>] pci_bus_read_config_dword+0x50/0xb0 [<c0391e94>] pci_bus_generic_read_dev_vendor_id+0x3c/0x1ec [<c039245c>] pci_scan_single_device+0xa4/0x11c [<c0392570>] pci_scan_slot+0x9c/0x23c [<c039388c>] pci_scan_child_bus_extend+0x58/0x2f4 [<c0393db0>] pci_scan_root_bus_bridge+0x64/0xe8 [<c0393e54>] pci_host_probe+0x20/0xc8 [<c03bc6f4>] pci_host_common_probe+0x144/0x1e4 Fix this by giving the CAM ops the same ->add_bus/->remove_bus callbacks. Since pci_ecam_add_bus() and pci_ecam_remove_bus() are static to ecam.c, move the CAM ops definition there as pci_generic_cam_ops (mirroring pci_generic_ecam_ops) and export it for pci-host-generic.c to reference. Fixes: 8fe55ef23387 ("PCI: Dynamically map ECAM regions") Signed-off-by: Steffen Persvold <spersvold@gmail.com> [mani: removed timestamp from log] Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260709122446.3151899-1-spersvold@gmail.com
2026-07-20Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netPaolo Abeni7-11/+51
Cross-merge networking fixes after downstream PR (net-7.2-rc4). No conflicts. Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-19sched_ext: Hand over cgroups at sub-scheduler enable/disableTejun Heo1-0/+13
Sub-schedulers don't get cgroups yet: every task_group is inited on the root sched and the routing added by the previous patches always resolves to it. Add the handover: an enabling sub-scheduler takes over the cgroups in its subtree and a disabling one returns them to its parent. scx_cgroup_claim_subtree() runs while the sub enables, after the subtree's cgrp->scx_sched's are set and before any task is claimed. It inits each subtree task_group on the sub, exits it from the parent and updates tg->scx.sched. A failed ops.cgroup_init() unwinds the sub-side inits and aborts the enable with the parent untouched. Disabling reverses it with scx_cgroup_return_subtree(): exit each cgroup from the sub, then re-init it on the parent with the current tg->scx.* values, resyncing weight and bandwidth changes made while the sub had it. When a re-init fails, the parent is failed and the remaining task_groups still transfer uninited and get no cgroup ops - the same punting done for tasks. The dying parent's own disable moves them onward. The handover walks include dying but not yet offlined task_groups, the same as root's bulk walks: a removed cgroup keeps hosting scheduling events until its dying tasks finish their final context switches, and its ops.cgroup_exit() must follow the last of them. tg on/offlining is excluded through cgroup_lock(), so either ordering against an rmdir of a subtree cgroup delivers balanced init/exit pairs. Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-07-19sched_ext: Deliver cgroup ops to each task_group's schedTejun Heo1-0/+2
With sub-schedulers claiming cgroup subtrees, cgroup ops must be delivered to each task_group's sched rather than always to root. Add tg->scx.sched to track which sched initialized the task_group. It is set and cleared together with SCX_TG_INITED. Deliver the ops accordingly: - ops.cgroup_exit() goes to the sched whose ops.cgroup_init() it pairs with. - ops.cgroup_prep_move/move/cancel_move() go to the task's sched, and only for moves that don't re-home the task. A re-homing move is reported through the ops.exit_task/init_task() pair instead. The cgroups passed to the move ops can be outside the sched's inited set as the cpu controller can be coarser than the sub-scheduler topology. - Knobs of a cgroup belong to the parent, so ops.set_weight/idle/bandwidth() go to the parent task_group's sched. All task_groups currently resolve to the root sched, so no behavior changes until sub-schedulers start claiming cgroups. While at it, scx_cgroup_init() is restructured so both paths share the recording. Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-07-19cgroup: Add cgroup_task_notifier and task migration eventsTejun Heo1-0/+26
A subsystem can attach to the cgroup hierarchy itself, independent of which controllers are enabled where - BPF hooks already behave this way and sched_ext sub-schedulers do too. Controller callbacks can't track task migrations for them: sched_ext must re-home a task whose migration crosses a sub-scheduler boundary, but the cpu controller's attach callbacks fire only when the task_group changes and miss moves whenever the controller topology is coarser than the sub-scheduler topology. Add cgroup_task_notifier with per-task migration events mirroring the can_attach/attach/cancel_attach phases so that a consumer which prepares per-task state can also veto a migration: CGROUP_TASK_MIGRATING fires pre-commit, CGROUP_TASK_MIGRATED post-commit and CGROUP_TASK_MIGRATE_CANCELED unwinds a failed migration. Only migrations that change a task's dfl cgroup are reported. Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-07-19bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insnLeon Hwang1-2/+2
The BPF_MOV64_PERCPU_REG insn requires JIT to emit native code to for 'dst_reg = src_reg + <percpu_base_off>'. However, the interpreter ignores the 'off' at its ALU64_MOV_X label. The 'off' indicates the insn is BPF_MOV64_PERCPU_REG insn. Then, when the interpreter loads memory from the register, it will hit a page fault. [ 2.545572] BUG: unable to handle page fault for address: ffffffffacaaf034 [ 2.546485] #PF: supervisor read access in kernel mode [ 2.547167] #PF: error_code(0x0000) - not-present page [ 2.547850] PGD 134e63067 P4D 134e63067 PUD 134e64063 PMD 10021c063 PTE 800ffffeca550062 [ 2.548912] Oops: Oops: 0000 [#1] SMP PTI Set jit_required as true in order to disallow interpreter fallback in core.c::__bpf_prog_select_runtime(), if any BPF_ADDR_PERCPU insn is patched to the prog. BTW, rename the helper bpf_map_supports_cpu_flags() to bpf_map_is_percpu_map(). Fixes: 7bdbf7446305 ("bpf: add special internal-only MOV instruction to resolve per-CPU addrs") Signed-off-by: Leon Hwang <leon.hwang@linux.dev> Link: https://lore.kernel.org/bpf/20260715141122.15783-4-leon.hwang@linux.dev Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-17Merge branch 'for-7.2-fixes' into for-7.3Tejun Heo1-5/+5
Pull to receive: 477869bfafea ("sched_ext: Reject setting disallow from init_task outside the enable path") 5f8b69642d18 ("sched_ext: Take cgroup_lock() first in scx_cgroup_lock()") 8c13364db9c9 ("sched_ext: Skip sub-disable teardown for never-linked sub-schedulers") 5cdc92859809 ("sched_ext: Don't enable non-ext tasks in the sub-sched task loops") as dependencies for the upcoming cgroup migration patchset and to resolve the conflicts with the ext.c/sub.c split on for-7.3. 5f8b69642d18 comments scx_cgroup_lock() which for-7.3 exported for sub.c. Resolved by keeping the exported version with the comment. 8c13364db9c9 and 5cdc92859809 patch the pre-split sub-sched enable and disable paths in ext.c which for-7.3 moved to sub.c. Resolved by applying the never-linked teardown skip and the class gates to sub.c. Signed-off-by: Tejun Heo <tj@kernel.org>
Copyright © 1996 – 2026 Jason A. Donenfeld. All Rights Reverse Engineered.