aboutsummaryrefslogtreecommitdiffstatshomepage
path: root/include/linux
AgeCommit message (Collapse)AuthorFilesLines
2026-06-09net: ethtool: optionally skip rtnl_lock on Netlink path for SET opsJakub Kicinski2-2/+10
Make ethtool not take rtnl_lock for SET commands when operation is performed on an ops-locked driver. cfg/cfg_pending are now ops-locked, since only ethtool modifies them. Some SET driver callbacks will still need rtnl_lock, most notably those which may end up calling netdev_update_features() or the qdisc layer (via netif_set_real_num_tx_queues()). Let drivers selectively opt back into the rtnl_lock with a new bitfield in ops. We need two helpers since Netlink and ioctl cmds have different values. Keep the helpers side by side in common.h to make sure they get updated together, even tho they will only get called from ioctl.c and netlink.c. SET commands which don't use ethnl_default_set_doit() are converted by subsequent commits. Reviewed-by: Eric Dumazet <edumazet@google.com> Acked-by: Stanislav Fomichev <sdf@fomichev.me> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Link: https://patch.msgid.link/20260605002912.3456868-6-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09net: ethtool: optionally skip rtnl_lock on Netlink path for GET opsJakub Kicinski1-1/+17
ethnl_default_doit() and ethnl_default_dump_one() are both used exclusively for GET callbacks (former to get info for a single device or get global strings). ops-locked devices don't need rtnl_lock for GET callbacks, stop taking it. Introduce an opt-out mechanism for devices which use phylink (fbnic) since phylink currently depends on rtnl_lock protection. Subsequent patches will add more exceptions, anyway. Practically the new helpers for judging if command needs rtnl_lock could also call netdev_need_ops_lock() but I find that it makes the code in the callers slightly less obvious. Add a helper for IOCTLs already, even tho it's unused so that we can keep them in sync as the series progresses. This is the first user-visible step of moving ethtool ops out from under rtnl. Subsequent patches do the same for SET ops, as well as the ioctl path. Reviewed-by: Eric Dumazet <edumazet@google.com> Acked-by: Stanislav Fomichev <sdf@fomichev.me> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Link: https://patch.msgid.link/20260605002912.3456868-5-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09net: ethtool: make dev->hwprov ops-protectedJakub Kicinski1-0/+3
dev->hwprov tracks the active hwtstamp provider for the device. Make it ops protected (instance lock if the netdev driver opts into holding instance lock around callbacks, otherwise rtnl_lock). hwprov is written and read in: - drivers/net/phy/phy_device.c phydev and ops protection don't currently mix, add a comment - net/ethtool/ as of now holds both rtnl lock and ops lock, this one will soon only hold one lock or the other read in: - net/core/dev_ioctl.c holds both rtnl lock and ops lock - net/core/timestamping.c RCU reader The new netdev_ops_lock_dereference() helper does not have "compat" in the name. The name would be quite long and I think in this case it should be obvious that we need _a_ lock. netdev_lock_dereference() already exists and means dev->lock is always expected. Reviewed-by: Eric Dumazet <edumazet@google.com> Acked-by: Stanislav Fomichev <sdf@fomichev.me> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Link: https://patch.msgid.link/20260605002912.3456868-4-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09net: ethtool: relax ethnl_req_get_phydev() locking assertionJakub Kicinski1-0/+5
phydev <> netdev linking and lifecycle depends on rtnl_lock. We want to switch to instance locks for most ethtool ops. Let's add an assert that ops locked devices don't use phydev today. If one does we can either opt the phy ops out of being purely ops locked, or do deeper surgery to make phy locking ops-compatible. I don't think there's any fundamental challenge to make that work. Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de> Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Acked-by: Stanislav Fomichev <sdf@fomichev.me> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Link: https://patch.msgid.link/20260605002912.3456868-3-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09hwmon: Support guard() and scoped_guard for subsystem locksGuenter Roeck1-0/+3
Add support for guard() and scoped_guard() for the hwmon subsystem lock to simplify its use. Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-06-09vfs: add FS_USERNS_DELEGATABLE flag and set it for NFSJeff Layton1-0/+1
Commit e1c5ae59c0f2 ("fs: don't allow non-init s_user_ns for filesystems without FS_USERNS_MOUNT") prevents the mount of any filesystem inside a container that doesn't have FS_USERNS_MOUNT set. This broke NFS mounts in our containerized environment. We have a daemon somewhat like systemd-mountfsd running in the init_ns. A process does a fsopen() inside the container and passes it to the daemon via unix socket. The daemon then vets that the request is for an allowed NFS server and performs the mount. This now fails because the fc->user_ns is set to the value in the container and NFS doesn't set FS_USERNS_MOUNT. We don't want to add FS_USERNS_MOUNT to NFS since that would allow the container to mount any NFS server (even malicious ones). Add a new FS_USERNS_DELEGATABLE flag, and enable it on NFS. Fixes: e1c5ae59c0f2 ("fs: don't allow non-init s_user_ns for filesystems without FS_USERNS_MOUNT") Signed-off-by: Jeff Layton <jlayton@kernel.org> Link: https://patch.msgid.link/20260129-twmount-v1-1-4874ed2a15c4@kernel.org Acked-by: Anna Schumaker <anna.schumaker@oracle.com> Reviewed-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@futurfusion.io> Reviewed-by: Jeff Layton <jlayton@kernel.org> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-06-09Merge tag 'ti-driver-soc-for-v7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux into soc/driversArnd Bergmann1-5/+6
TI SoC driver updates for v7.2 TI K3 TISCI: - ti_sci: Add BOARDCFG_MANAGED mode for support system suspend/resume cycles - ti_sci: Add support for restoring IRQ and clock contexts during resume. - clk: keystone: sci-clk: Add clock restoration support. SoC Drivers: - k3-socinfo: Add support for identifying AM62P silicon variants via NVMEM, along with corresponding dt-bindings update for nvmem-cells support - k3-ringacc: Fix incorrect access mode for ring pop tail IO/proxy operations Keystone Navigator (knav) Cleanup and Fixes: - knav_qmss: Multiple code quality improvements - knav_qmss_queue: Implement proper resource cleanup in the remove() path General Cleanups: - k3-ringacc: Use str_enabled_disabled() helper for consistency - knav_qmss: Use %pe format specifier for PTR_ERR() printing * tag 'ti-driver-soc-for-v7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux: firmware: ti_sci: Add support for restoring clock context during resume clk: keystone: sci-clk: Add restore_context() operation firmware: ti_sci: Add support for restoring IRQs during resume firmware: ti_sci: Add BOARDCFG_MANAGED mode support soc: ti: k3-ringacc: Use str_enabled_disabled() helper soc: ti: knav_dma: Use IOMEM_ERR_PTR() in pktdma_get_regs() soc: ti: knav_dma: Remove dead check on unsigned args.args[0] soc: ti: knav_dma: Remove unused DMA_PRIO_MASK macro soc: ti: knav_qmss_acc: Fix kernel-doc Return: tag soc: ti: knav_qmss: Fix __iomem annotations and __be32 type soc: ti: knav_qmss: Use %pe to print PTR_ERR() soc: ti: knav_qmss: Fix kernel-doc Return: tags soc: ti: knav_qmss: Inline lockdep condition in for_each_handle_rcu soc: ti: knav_qmss: Rename global kdev to knav_qdev to fix -Wshadow soc: ti: knav_qmss: Remove remaining redundant ENOMEM printks soc: ti: knav_qmss_queue: Implement resource cleanup in remove() soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy soc: ti: knav_dma: fix all kernel-doc warnings in knav_dma.h soc: ti: k3-socinfo: Add support for AM62P variants via NVMEM dt-bindings: hwinfo: ti,k3-socinfo: Add nvmem-cells support Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-06-09Merge tag 'samsung-drivers-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/driversArnd Bergmann1-13/+23
Samsung SoC drivers for v7.2 Improve Samsung Exynos (and Google GS101) ACPM (Alive Clock and Power Manager) firmware driver: 1. Few code improvements. 2. Add support for protocol used to communicate with Thermal Management Unit (TMU). This will allow to implement the thermal driver working for newer Samsung Exynos and Google GS101 SoCs. * tag 'samsung-drivers-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: firmware: samsung: acpm: remove compile-testing stubs firmware: samsung: acpm: Add devm_acpm_get_by_phandle helper firmware: samsung: acpm: Add TMU protocol support firmware: samsung: acpm: Make acpm_ops const and access via pointer firmware: samsung: acpm: Drop redundant _ops suffix in acpm_ops members firmware: samsung: acpm: Annotate rx_data->cmd with __counted_by_ptr firmware: samsung: acpm: Consolidate transfer initialization helper firmware: samsung: acpm: Fix infinite loop on sequence number exhaustion firmware: samsung: acpm: Fix missing LKMM barriers in sequence allocator firmware: samsung: acpm: Fix false timeouts and Use-After-Free in polling firmware: samsung: acpm: Fix mailbox channel leak on probe error firmware: samsung: acpm: Fix cross-thread RX length corruption Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-06-09fbdev: Do not export fbcon from fbdevThomas Zimmermann1-55/+0
There are no callers of fbcon outside fbdev. Move the declarations into the internal header. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Helge Deller <deller@gmx.de>
2026-06-09fbdev: Wrap fbcon updates from vga-switcheroo in helperThomas Zimmermann1-0/+1
Handle console remapping in fbcon in fb_switch_output(). Vga-switcheroo invokes this functionality before switching physical outputs to a new graphics device. Open-coding fbcon state in vga-switcheroo exposed fbdev implementation details. Vga-switcheroo is used for switching physical outputs among graphics hardware. This functionality is only supported by DRM drivers. A later update will further move fb_switch_output() into DRM's fbdev emulation; thus fully decoupling vga-switcheroo from fbdev. v3: - remove Kconfig dependency related to fbcon (Geert) v2: - use '#if defined' (Helge) Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Helge Deller <deller@gmx.de>
2026-06-09fbdev: Wrap user-invoked calls to fb_set_var() in helperThomas Zimmermann1-0/+2
Handle fbcon during display updates in fb_set_var_from_user(). Check with fbcon if the mode change is possible, update hardware state and finally update fbcon. Update all callers. Only the FBIOPUT_VSCREENINFO ioctl currently does all steps. Other mode-changes callers in sysfs and driver code are missing fbcon-related steps. With the new helper, ps3fb and sh_mobile_lcdcfb no longer maintain fbcon state themselves. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Helge Deller <deller@gmx.de>
2026-06-09netconsole: do not dequeue pooled skbs that cannot satisfy lenBreno Leitao1-0/+16
find_skb() falls back to np->skb_pool when the GFP_ATOMIC alloc_skb() fails. The pool is refilled by refill_skbs(), which always allocates buffers of MAX_SKB_SIZE (ethhdr + iphdr + udphdr + MAX_UDP_CHUNK == 1502 bytes). netconsole, however, computes the requested length dynamically as total_len + np->dev->needed_tailroom If the egress device declares a non-zero needed_tailroom (e.g. some tunnel or hardware accelerator devices), the required length can exceed MAX_SKB_SIZE. The pooled skb is then handed back to the caller, which immediately performs skb_put(skb, len), trips the tail > end check, and triggers skb_over_panic(). Leave the normal alloc_skb(len, GFP_ATOMIC) path untouched -- the slab allocator can still satisfy oversized requests when memory is available, so senders to devices with non-zero needed_tailroom keep working in the common case. Only the pool fallback is gated: when alloc_skb() failed and len exceeds the pool buffer size, skip the skb_dequeue() instead of burning a pre-allocated skb on a request that would later trip skb_over_panic(). Reserving pool entries for requests they can actually satisfy also keeps the panic path, which depends on the pool being primed, intact. When that drop happens, emit a rate-limited net_warn() so the user notices that netconsole is unable to push messages on the egress device. The warn is skipped under in_nmi() for the same reason schedule_work() is: printk machinery taken by net_warn_ratelimited() is not NMI-safe and would risk recursing into the same nbcon console we are servicing. MAX_SKB_SIZE / MAX_UDP_CHUNK were private to net/core/netpoll.c. Move them to include/linux/netpoll.h so netconsole can reference the same definition that refill_skbs() uses, keeping the two in sync by construction. The header now pulls in <linux/ip.h> and <linux/udp.h> explicitly so MAX_SKB_SIZE remains self-contained for any future user. Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260604-netcons_fix_before_move-v3-2-ab055b3a6aa5@debian.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-09Merge tag 'mtk-soc-for-v7.2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mediatek/linux into soc/driversKrzysztof Kozlowski1-0/+24
MediaTek SoC driver updates This adds subsys ID compatibility in MediaTek CMDQ, paving the way for adding support for the MT8196 SoC, and fixes the Multimedia System (MMSYS) routing masks for the MT8167 SoC. * tag 'mtk-soc-for-v7.2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mediatek/linux: soc: mediatek: mtk-mmsys: Restore MT8167 routing masks lost during merge soc: mediatek: mtk-cmdq: Add cmdq_pkt_jump_rel_temp() for removing shift_pa soc: mediatek: Use pkt_write function pointer for subsys ID compatibility Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
2026-06-08net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_listDragos Tatulea1-2/+2
mlx5_query_nic_vport_mac_list() sizes its firmware command buffer using the PF's log_max_current_uc/mc_list capabilities. When querying a VF vport with a larger configured max (via devlink), the firmware response can overflow this buffer: BUG: KASAN: slab-out-of-bounds in mlx5_query_nic_vport_mac_list+0x453/0x4c0 [mlx5_core] Read of size 4 at addr ff1100013ffc8a12 by task kworker/u96:2/385 CPU: 12 UID: 0 PID: 385 Comm: kworker/u96:2 Not tainted 7.0.0-rc6+ #1 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009) Workqueue: mlx5_esw_wq esw_vport_change_handler [mlx5_core] Call Trace: <TASK> dump_stack_lvl+0x69/0xa0 print_report+0x176/0x4e4 kasan_report+0xc8/0x100 mlx5_query_nic_vport_mac_list+0x453/0x4c0 [mlx5_core] esw_update_vport_addr_list+0x2e3/0xda0 [mlx5_core] esw_vport_change_handle_locked+0xa1f/0x1060 [mlx5_core] esw_vport_change_handler+0x6a/0x90 [mlx5_core] process_one_work+0x87f/0x15e0 worker_thread+0x62b/0x1020 kthread+0x375/0x490 ret_from_fork+0x4dc/0x810 ret_from_fork_asm+0x11/0x20 </TASK> Fix by querying the vport's own HCA caps to size the buffer correctly. Refactor the function to allocate and return the MAC list internally, removing the caller's dependency on knowing the correct max. Fixes: e16aea2744ab ("net/mlx5: Introduce access functions to modify/query vport mac lists") Signed-off-by: Dragos Tatulea <dtatulea@nvidia.com> Reviewed-by: Carolina Jubran <cjubran@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260604135849.458060-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-08mm/compaction: cap compact_gap() at COMPACT_CLUSTER_MAXJP Kobryn1-4/+4
compact_gap() returns 2 << order, which is used as watermark headroom in __compaction_suitable() and as a threshold in kswapd reclaim decisions. The computed value scales exponentially by order. For order-9 THP allocations this evaluates to 1024 pages, but the compaction free scanner's working set is bounded by COMPACT_CLUSTER_MAX (32 pages). The scanner stops isolating free pages once it matches the migration batch. The current gap over-reserves by 32x. On fragmented production hosts, kswapd will try to reclaim up to the gap, but it only reaches that threshold in 18% of attempts. As a result, reclaim continues in the majority of cases despite many lower-order free pages being available. The over-sized gap also causes 46% of order-9 compaction suitability checks to fail unnecessarily: the zone has sufficient free pages for the scanner to operate, but not enough to clear the inflated threshold. Cap compact_gap() at COMPACT_CLUSTER_MAX so the watermark headroom reflects the scanner's actual capacity. This function is used by two key heuristics. The first is when kswapd can stop high-order reclaim and downgrade to order-0 balancing, allowing kcompactd to be woken for the original higher allocation order. The second is zone suitability checking, where the smaller gap allows compaction to start sooner. Note that orders 0-4 are unaffected since their gap is already less than or equal to COMPACT_CLUSTER_MAX. A/B test on v6.13-based instagram production hosts (64GB, 60s measurement): Unpatched (43 hosts) pgscan_kswapd (mean/host): ~1.6M reclaim efficiency (steal/scan): 83.8% per-compaction success (success/stall): 2.1% THP success (alloc/alloc+fallback): 4.9% forced lru_add_drain (mean/host): ~107K Patched (59 hosts) pgscan_kswapd (mean/host): ~449K reclaim efficiency (steal/scan): 91.0% per-compaction success (success/stall): 28.3% THP success (alloc/alloc+fallback): 17.2% forced lru_add_drain (mean/host): ~64K Additional tests were also performed using a workload of similar shape and based on mm-new at the time of testing. Across three 60s runs, the patch showed improvements consistent with the previous test: reduced kswapd reclaim and fewer THP fault fallbacks. Unpatched kswapd_shrink_node downgrade to order-0 (mean): 0 thp_fault_fallback (mean): 1217 pgscan_kswapd (mean): 6328 pgsteal_kswapd (mean): 5657 Patched kswapd_shrink_node downgrade to order-0 (mean): 28 thp_fault_fallback (mean): 738 pgscan_kswapd (mean): 3773 pgsteal_kswapd (mean): 3243 Link: https://lore.kernel.org/20260604061725.13800-1-jp.kobryn@linux.dev Signed-off-by: JP Kobryn (Meta) <jp.kobryn@linux.dev> Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Cc: Brendan Jackman <jackmanb@google.com> Cc: Johannes Weiner <hannes@cmpxchg.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Zi Yan <ziy@nvidia.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-06-08mm/swap, PM: hibernate: fix swapoff race in uswsusp by pinning swap deviceYoungjun Park1-1/+4
Patch series "mm/swap, PM: hibernate: fix swapoff race in uswsusp by pinning swap device", v8. Currently, in the uswsusp path, only the swap type value is retrieved at lookup time without holding a reference. If swapoff races after the type is acquired, subsequent slot allocations operate on a stale swap device. Additionally, grabbing and releasing the swap device reference on every slot allocation is inefficient across the entire hibernation swap path. This patch series addresses these issues: - Patch 1: Fixes the swapoff race in uswsusp by pinning the swap device from the point it is looked up until the session completes. - Patch 2: Removes the overhead of per-slot reference counting in alloc/free paths and cleans up the redundant SWP_WRITEOK check. This patch (of 2): Hibernation via uswsusp (/dev/snapshot ioctls) has a race window: after selecting the resume swap area but before user space is frozen, swapoff may run and invalidate the selected swap device. Fix this by pinning the swap device with SWP_HIBERNATION while it is in use. The pin is exclusive, which is sufficient since hibernate_acquire() already prevents concurrent hibernation sessions. The kernel swsusp path (sysfs-based hibernate/resume) uses find_hibernation_swap_type() which is not affected by the pin. It freezes user space before touching swap, so swapoff cannot race. Introduce dedicated helpers: - pin_hibernation_swap_type(): Look up and pin the swap device. Used by the uswsusp path. - find_hibernation_swap_type(): Lookup without pinning. Used by the kernel swsusp path. - unpin_hibernation_swap_type(): Clear the hibernation pin. While a swap device is pinned, swapoff is prevented from proceeding. Link: https://lore.kernel.org/20260323160822.1409904-1-youngjun.park@lge.com Link: https://lore.kernel.org/20260323160822.1409904-2-youngjun.park@lge.com Signed-off-by: Youngjun Park <youngjun.park@lge.com> Reviewed-by: Kairui Song <kasong@tencent.com> Cc: Baoquan He <bhe@redhat.com> Cc: Barry Song <baohua@kernel.org> Cc: Chris Li <chrisl@kernel.org> Cc: Kemeng Shi <shikemeng@huaweicloud.com> Cc: Nhat Pham <nphamcs@gmail.com> Cc: "Rafael J . Wysocki" <rafael@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-06-08vmalloc: fix NULL pointer dereference in is_vm_area_hugepages()Hui Zhu1-1/+3
find_vm_area() can return NULL if the given address is not a valid vmalloc area. Check the return value before dereferencing it to avoid a kernel crash. Link: https://lore.kernel.org/20260529014130.671291-1-hui.zhu@linux.dev Fixes: 121e6f3258fe ("mm/vmalloc: hugepage vmalloc mappings") Signed-off-by: Hui Zhu <zhuhui@kylinos.cn> Reviewed-by: Dev Jain <dev.jain@arm.com> Reviewed-by: Uladzislau Rezki (Sony) <urezki@gmail.com> Cc: Nicholas Piggin <npiggin@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-06-08userfaultfd: build __VMA_UFFD_FLAGS from config-gated masksKiryl Shutsemau (Meta)2-2/+41
The VMA flags bitmap is a single word today: NUM_VMA_FLAG_BITS is BITS_PER_LONG, so on 32-bit vma_flags_t holds only 32 bits. (The bitmap type exists so this can grow past BITS_PER_LONG later; until it does, anything declared above the first word is out of range on 32-bit.) The bit enum nevertheless declares some bits unconditionally above BITS_PER_LONG -- VMA_UFFD_MINOR_BIT is 41, with VM_UFFD_MINOR == VM_NONE on 32-bit so no VMA actually carries the bit. __VMA_UFFD_FLAGS feeds VMA_UFFD_MINOR_BIT to mk_vma_flags() unconditionally. On 32-bit that becomes __set_bit(41, &one_long), a write one word past the end of the single-word bitmap. The compiler folds the out-of-bounds store with wraparound (1UL << (41 % 32) == bit 9) into the first word; bit 9 is already in __VMA_UFFD_FLAGS so the mask happens to come out right today, but it is an out-of-bounds write all the same, and any high-numbered bit whose mod-BITS_PER_LONG position is otherwise unused would silently OR an extra bit into the mask. Rather than feed bit numbers that may not exist on the current build to mk_vma_flags(), build the mask from whole per-mode masks that collapse to EMPTY_VMA_FLAGS when their feature is unavailable. Add mk_vma_flags_from_masks() for that, and define VMA_UFFD_MISSING / _WP / _MINOR alongside the VM_UFFD_* flags, gating VMA_UFFD_MINOR on the same config as VM_UFFD_MINOR (which implies 64BIT, where bit 41 fits). An out-of-range bit is then never materialised, on any arch, and the in-range fast path stays a compile-time constant. Link: https://lore.kernel.org/20260529172331.356655-7-kas@kernel.org Fixes: 9ea35a25d51b ("mm: introduce VMA flags bitmap type") Signed-off-by: Kiryl Shutsemau <kas@kernel.org> Reported-by: Sashiko AI review <sashiko-bot@kernel.org> Suggested-by: Lorenzo Stoakes <ljs@kernel.org> Reviewed-by: Lorenzo Stoakes <ljs@kernel.org> Assisted-by: Claude:claude-opus-4-8 Cc: David Hildenbrand <david@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Peter Xu <peterx@redhat.com> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Cc: Balbir Singh <balbirs@nvidia.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-06-08mm: delete stale comment about cachelinesBrendan Jackman1-2/+0
These comments have been wrong since commit a211c6550efc ("mm: page_alloc: defrag_mode kswapd/kcompactd watermarks") added NR_FREE_PAGES_BLOCKS. Since nobody has complained about it in the last year, it seems unlikely these comments were particularly useful anyway, so delete them. Link: https://lore.kernel.org/20260601-zone_stat_item-comment-v1-1-f452dd91d5eb@google.com Signed-off-by: Brendan Jackman <jackmanb@google.com> Acked-by: David Hildenbrand (Arm) <david@kernel.org> Reviewed-by: Lorenzo Stoakes <ljs@kernel.org> Acked-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-06-08mm/compaction: respect cpusets when checking retry suitabilityfujunjie1-1/+1
should_compact_retry() handles COMPACT_SKIPPED by asking compaction_zonelist_suitable() whether reclaim can make a later compaction attempt worthwhile. That answer is used for the current allocation, so it should follow the same zone eligibility rules as the allocation itself. When cpusets are enabled, allocator slowpath decisions are marked with ALLOC_CPUSET. The allocation path, direct compaction and reclaim retry all skip zones rejected by __cpuset_zone_allowed(). compaction_zonelist_suitable() does not apply that filter. It only walks ac->zonelist/ac->nodemask, so it can return true because a zone that is not usable for the current allocation would pass __compaction_suitable(). That does not let the allocation use the disallowed zone. Later allocation and direct compaction paths still apply cpuset filtering. However, it can make should_compact_retry() retry based on memory that this allocation cannot use. Pass gfp_mask down and apply the same ALLOC_CPUSET check in compaction_zonelist_suitable(). This keeps the retry decision aligned with the zones that the allocation is allowed to use. A temporary debugfs probe was also used to call the old and new compaction_zonelist_suitable() predicates in the same two-node NUMA guest. The task was restricted to mems=0 while ac->nodemask covered nodes 0-1. After putting pressure on node0, node0 failed __compaction_suitable() for order-10 and node1 passed it, but node1 was rejected by __cpuset_zone_allowed(). In that state the old predicate returned true and the patched predicate returned false. Link: https://lore.kernel.org/tencent_F59F2BA2CC5779308E10DF54593C736D3E0A@qq.com Fixes: 435b3894e742 ("mm:page_alloc: fix the NULL ac->nodemask in __alloc_pages_slowpath()") Signed-off-by: fujunjie <fujunjie1@qq.com> Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Cc: Brendan Jackman <jackmanb@google.com> Cc: Johannes Weiner <hannes@cmpxchg.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Zi Yan <ziy@nvidia.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-06-08mm: switch deferred split shrinker to list_lruJohannes Weiner3-21/+12
The deferred split queue handles cgroups in a suboptimal fashion. The queue is per-NUMA node or per-cgroup, not the intersection. That means on a cgrouped system, a node-restricted allocation entering reclaim can end up splitting large pages on other nodes: alloc/unmap deferred_split_folio() list_add_tail(memcg->split_queue) set_shrinker_bit(memcg, node, deferred_shrinker_id) for_each_zone_zonelist_nodemask(restricted_nodes) mem_cgroup_iter() shrink_slab(node, memcg) shrink_slab_memcg(node, memcg) if test_shrinker_bit(memcg, node, deferred_shrinker_id) deferred_split_scan() walks memcg->split_queue The shrinker bit adds an imperfect guard rail. As soon as the cgroup has a single large page on the node of interest, all large pages owned by that memcg, including those on other nodes, will be split. list_lru properly sets up per-node, per-cgroup lists. As a bonus, it streamlines a lot of the list operations and reclaim walks. It's used widely by other major shrinkers already. Convert the deferred split queue as well. The list_lru per-memcg heads are instantiated on demand when the first object of interest is allocated for a cgroup, by calling folio_memcg_alloc_deferred(). Add calls to where splittable pages are created: anon faults, swapin faults, khugepaged collapse. These calls create all possible node heads for the cgroup at once, so the migration code (between nodes) doesn't need any special care. [akpm@linux-foundation.org: fix build with CONFIG_TRANSPARENT_HUGEPAGE=n] Link: https://lore.kernel.org/202605281620.lc3rtkBm-lkp@intel.com [hannes@cmpxchg.org: fix cgroup.memory=nokmem handling] Link: https://lore.kernel.org/ah9PGv12mqai84ES@cmpxchg.org Link: https://lore.kernel.org/20260527204757.2544958-10-hannes@cmpxchg.org Signed-off-by: Johannes Weiner <hannes@cmpxchg.org> Reported-by: Mikhail Zaslonko <zaslonko@linux.ibm.com> Tested-by: Mikhail Zaslonko <zaslonko@linux.ibm.com> Acked-by: Shakeel Butt <shakeel.butt@linux.dev> Reviewed-by: Lorenzo Stoakes (Oracle) <ljs@kernel.org> Acked-by: Usama Arif <usama.arif@linux.dev> Reviewed-by: Kairui Song <kasong@tencent.com> Cc: Baolin Wang <baolin.wang@linux.alibaba.com> Cc: Barry Song <baohua@kernel.org> Cc: Dave Chinner <david@fromorbit.com> Cc: David Hildenbrand (Arm) <david@kernel.org> Cc: Dev Jain <dev.jain@arm.com> Cc: Lance Yang <lance.yang@linux.dev> Cc: Liam R. Howlett <liam@infradead.org> Cc: Michal Hocko <mhocko@kernel.org> Cc: Muchun Song <muchun.song@linux.dev> Cc: Nico Pache <npache@redhat.com> Cc: Roman Gushchin <roman.gushchin@linux.dev> Cc: Ryan Roberts <ryan.roberts@arm.com> Cc: Vasily Gorbik <gor@linux.ibm.com> Cc: Vlastimil Babka <vbabka@kernel.org> Cc: Zi Yan <ziy@nvidia.com> Cc: kernel test robot <lkp@intel.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-06-08mm: list_lru: introduce folio_memcg_list_lru_alloc()Johannes Weiner1-0/+27
memcg_list_lru_alloc() is called every time an object that may end up on the list_lru is created. It needs to quickly check if the list_lru heads for the memcg already exist, and allocate them when they don't. Doing this with folio objects is tricky: folio_memcg() is not stable and requires either RCU protection or pinning the cgroup. But it's desirable to make the existence check lightweight under RCU, and only pin the memcg when we need to allocate list_lru heads and may block. In preparation for switching the THP shrinker to list_lru, add a helper function for allocating list_lru heads coming from a folio. Link: https://lore.kernel.org/20260527204757.2544958-8-hannes@cmpxchg.org Signed-off-by: Johannes Weiner <hannes@cmpxchg.org> Reviewed-by: David Hildenbrand (Arm) <david@kernel.org> Acked-by: Shakeel Butt <shakeel.butt@linux.dev> Reviewed-by: Lorenzo Stoakes (Oracle) <ljs@kernel.org> Cc: Baolin Wang <baolin.wang@linux.alibaba.com> Cc: Barry Song <baohua@kernel.org> Cc: Dave Chinner <david@fromorbit.com> Cc: Dev Jain <dev.jain@arm.com> Cc: Kairui Song <ryncsn@gmail.com> Cc: Lance Yang <lance.yang@linux.dev> Cc: Liam R. Howlett <liam@infradead.org> Cc: Michal Hocko <mhocko@kernel.org> Cc: Mikhail Zaslonko <zaslonko@linux.ibm.com> Cc: Muchun Song <muchun.song@linux.dev> Cc: Nico Pache <npache@redhat.com> Cc: Roman Gushchin <roman.gushchin@linux.dev> Cc: Ryan Roberts <ryan.roberts@arm.com> Cc: Usama Arif <usama.arif@linux.dev> Cc: Vasily Gorbik <gor@linux.ibm.com> Cc: Vlastimil Babka <vbabka@kernel.org> Cc: Zi Yan <ziy@nvidia.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-06-08mm: list_lru: introduce caller locking for additions and deletionsJohannes Weiner1-0/+43
Locking is currently internal to the list_lru API. However, a caller might want to keep auxiliary state synchronized with the LRU state. For example, the THP shrinker uses the lock of its custom LRU to keep PG_partially_mapped and vmstats consistent. To allow the THP shrinker to switch to list_lru, provide normal and irqsafe locking primitives as well as caller-locked variants of the addition and deletion functions. Link: https://lore.kernel.org/20260527204757.2544958-7-hannes@cmpxchg.org Signed-off-by: Johannes Weiner <hannes@cmpxchg.org> Reviewed-by: David Hildenbrand (Arm) <david@kernel.org> Acked-by: Shakeel Butt <shakeel.butt@linux.dev> Reviewed-by: Lorenzo Stoakes (Oracle) <ljs@kernel.org> Reviewed-by: Liam R. Howlett (Oracle) <liam@infradead.org> Cc: Baolin Wang <baolin.wang@linux.alibaba.com> Cc: Barry Song <baohua@kernel.org> Cc: Dave Chinner <david@fromorbit.com> Cc: Dev Jain <dev.jain@arm.com> Cc: Kairui Song <ryncsn@gmail.com> Cc: Lance Yang <lance.yang@linux.dev> Cc: Michal Hocko <mhocko@kernel.org> Cc: Mikhail Zaslonko <zaslonko@linux.ibm.com> Cc: Muchun Song <muchun.song@linux.dev> Cc: Nico Pache <npache@redhat.com> Cc: Roman Gushchin <roman.gushchin@linux.dev> Cc: Ryan Roberts <ryan.roberts@arm.com> Cc: Usama Arif <usama.arif@linux.dev> Cc: Vasily Gorbik <gor@linux.ibm.com> Cc: Vlastimil Babka <vbabka@kernel.org> Cc: Zi Yan <ziy@nvidia.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-06-08mm/nodemask: correctly describe nodemask operation return typesJoshua Hahn1-9/+9
Commit 0dfe54071d7c8 ("nodemask: Fix return values to be unsigned") changed a number of nodemask operations that used to return int to returning a bool instead. However, it did not update the comment block that described these functions, leaving the documentation incorrect. Fix the comment block to accurately describe the functions. Also fix a typo (unsigend --> unsigned), and fix a callsite in mempolicy.c that did not get updated during the conversion. No functional changes intended; changes are purely cosmetic. Link: https://lore.kernel.org/20260529202755.1846800-1-joshua.hahnjy@gmail.com Signed-off-by: Joshua Hahn <joshua.hahnjy@gmail.com> Reviewed-by: SeongJae Park <sj@kernel.org> Cc: Alistair Popple <apopple@nvidia.com> Cc: Byungchul Park <byungchul@sk.com> Cc: David Hildenbrand <david@kernel.org> Cc: Gregory Price <gourry@gourry.net> Cc: Matthew Brost <matthew.brost@intel.com> Cc: Rakie Kim <rakie.kim@sk.com> Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk> Cc: Ying Huang <ying.huang@linux.alibaba.com> Cc: Yury Norov (NVIDIA) <yury.norov@gmail.com> Cc: Zi Yan <ziy@nvidia.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-06-08Merge branch 'mlx5-next' of git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linuxJakub Kicinski1-4/+7
Tariq Toukan says: ==================== mlx5-next updates 2026-06-07 * 'mlx5-next' of git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux: net/mlx5: Add sd_group_size bits for SD management net/mlx5: Update IFC allowed_list_size field bits ==================== Link: https://patch.msgid.link/20260607111157.470978-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-08driver core: platform: set mod_name in driver registrationShashank Balaji2-10/+12
Pass KBUILD_MODNAME through the driver registration macro so that the driver core can create the module symlink in sysfs for built-in drivers, and fixup all callers. The Rust platform adapter is updated to pass the module name through to the new parameter. Tested on qemu with: - x86 defconfig + CONFIG_RUST - arm64 defconfig + CONFIG_RUST + CONFIG_CORESIGHT stuff Examples after this patch: /sys/bus/platform/drivers/... coresight-itnoc/module -> coresight_tnoc coresight-static-tpdm/module -> coresight_tpdm coresight-catu-platform/module -> coresight_catu serial8250/module -> 8250 acpi-ged/module -> acpi vmclock/module -> ptp_vmclock Co-developed-by: Rahul Bukte <rahul.bukte@sony.com> Signed-off-by: Rahul Bukte <rahul.bukte@sony.com> Signed-off-by: Shashank Balaji <shashank.mahadasyam@sony.com> Link: https://patch.msgid.link/20260518-acpi_mod_name-v5-4-705ccc430885@sony.com Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-06-08coresight: pass THIS_MODULE implicitly through a macroShashank Balaji1-2/+4
Rename coresight_init_driver() to coresight_init_driver_with_owner() and replace it with a macro wrapper that passes THIS_MODULE implicitly. This is in line with what other buses do. Suggested-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Reviewed-by: Leo Yan <leo.yan@arm.com> Co-developed-by: Rahul Bukte <rahul.bukte@sony.com> Signed-off-by: Rahul Bukte <rahul.bukte@sony.com> Signed-off-by: Shashank Balaji <shashank.mahadasyam@sony.com> Link: https://patch.msgid.link/20260518-acpi_mod_name-v5-3-705ccc430885@sony.com Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-06-08Merge tag 'svc_updates_for_v7.2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux into char-misc-nextGreg Kroah-Hartman2-9/+29
Dinh writes: SoCFPGA firmware updates for v7.2 - Simplify service driver memory management by using a flexible array - Change FCS call to get provision data to asynchronous - Avoid blocking the call the reboot_image sysfs when busy - Add support to query the ATF version * tag 'svc_updates_for_v7.2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: firmware: stratix10-svc: Add support to query Arm Trusted Firmware (ATF) version firmware: stratix10-rsu: avoid blocking reboot_image sysfs when busy firmware: stratix10-svc: change get provision data to async SMC call firmware: stratix10-svc: kmalloc_array + kzalloc to flex
2026-06-08Merge tag 'coresight-next-v7.2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/coresight/linux into char-misc-nextGreg Kroah-Hartman2-7/+22
Suzuki writes: coresight: Self-hosted tracing updates for Linux v7.2 Updates for the CoreSight self hosted tracing subsystem includes: - Better power management for components based on the CPU PM, including support for components on the trace path for CPUs. Add support for save/restore for TRBE - Miscellaneous fixes to the drivers * Fix overflow when the buffer size is > 2GB for tmc-etr * Ultrasoc SMB Perf buffer OOB access Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com> * tag 'coresight-next-v7.2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/coresight/linux: (36 commits) coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() coresight: etb10: restore atomic_t for shared reading state coresight: platform: defer connection counter increment until alloc succeeds coresight: sysfs: Validate CPU online status for per-CPU sources coresight: Move CPU hotplug callbacks to core layer coresight: sysfs: Increment refcount only for software source coresight: trbe: Save and restore state across CPU low power state coresight: Add PM callbacks for sink device coresight: Control path during CPU idle coresight: sysfs: Use source's path pointer for path control coresight: etm3x: Set active path on target CPU coresight: etm4x: Set active path on target CPU coresight: Save active path for system tracers coresight: Introduce coresight_enable_source() helper coresight: Use helpers to fetch first and last nodes coresight: Control path with range coresight: Disable source helpers in coresight_disable_path() coresight: syscfg: Use IRQ-safe spinlock to protect active variables coresight: etm4x: Remove redundant checks in PM save and restore coresight: etm4x: Hook CPU PM callbacks ...
2026-06-08Merge tag 'iio-for-7.2a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into work-testingGreg Kroah-Hartman4-73/+46
IIO: New device support, features and cleanup for the 7.2 cycle. Like many areas of the kernel IIO has seen a lot of new contributors though in this case that is not all AI driven, but also reflects and annual surge of student contributions from usp.br. We also have several new regular reviewers who are helping with the surge (thanks to all our active reviewers!) Given there was a lot of cases of similar improvements applied to different drivers, I have grouped those into a special section (various drivers) to avoid mass duplication. New device support ------------------ adi,ad4130 - Add support for AD4129-4, AD4129-8, AD4130-4, AD4131-4 and AD4131-8 after reworking the driver to be suitable for multiple device support. adi,ad4080 - Support the AD4880 and AD4884 dual-channel parts. Interesting parts as have two separate data pipelines (including SPI buses interfaces), but the only current backend IP combines the two so they cannot be treated as independent devices. adi,ad5706r - New driver for this 4 channel current output DAC. adi,ad4691 - New driver supporting this family of ADCs. Support for AD4691, AD4692, AD4693 and AD4694 which support either 8 or 16 channels with different max sampling rates. Feature rich driver including SPI offload support. adi,ltc2983 - Add support for the ADT7604 in which the same sensor die as the LTC2984 is used for leak detection (liquid coverage of a sense area). allwinner,adc - Support for A523 SoCs. Similar to existing parts but with an additional clock. Includes adding support for non contiguous channel lookup for in kernel use (fwnode_xlate callback). broadcomm,apds9999 - New driver for the APDS9999 Ambient Light, RGB and proximity sensor. memsic,mmc5983 - New driver for this 3-axis magnetometer. taos,tsl2772 - Add support for the AVAGO APDS9900 and APDS9901 Ambient Light and Proximity sensors. which are very similar to existing part with slightly different integration time choices. Includes removal of driver for these parts from drivers/misc. vishay,veml3328 - New driver for this RGB+IR light sensor. Features -------- IIO Core - Support for IEEE 754 floating point values in buffer scan elements. - Support quaternion axis representation (missing the scaler part) microchip,mcp4821 - Add configurable gain control qcom,pm8xxx-xoadc - Add per channel labels. st,lsm6dsx - Support for rotation sensing on the LSM6DSV and LSM6DSV16X using both floating point and new quaterionaxis rotation modifier. MAINTAINERS update ------------------ IIO top level entry - Include Documentation/driver-api/iio/ adi,* - Top level ADI entry maintainer switch from Lars-Peter Clausen to Nuno Sá reflecting what has been the reality for some time. Thanks to Lars-Peter who was very active for many years, but has moved on to other things. Also add the linux@analog.com email list to ensure we don't get a gap in future. - Maintainer updates to reflect Cosmin Tanislav having moved on - thanks to Marcelo Schmitt for taking these over. sensiron,scd30 - Replace maintainer (Tomasz Duszynski) with Maxwell Doose. Cleanups, minor fixes and hardening. ------------------------------------ Documentation - Add missing powerdown modes to ABI docs. - Use modern helpers for buffer definition in the examples. core - Rework of the handling of timestamps so that the offset is cached at buffer resize time (during enabling) rather than based on assumption that relied in the timestamp being last and the largest element and so always 8 bytes before end of the scan. Underlying problem was triggered by scans with repeated type elements such as quaternions with each element more than 2 bytes - Giving a 16 byte+ aligned channel with result that a following timestamp may be 16 bytes from end of scan, rather than 8. Note that for the bosch,bno55 a compatibility hack means that it will duplicate the timestamp putting a second copy at previously incorrect location. - Tidy up use of kernel types in buffer code to not use int64_t given all calls use s64. various drivers - Drop unused driver_data in device id tables - includes cleanup of various drivers that had only one choice where it can be hard coded elsewhere. - Move to named initializers for many i2c_device_id and platform_device_id tables (I have no idea how we go into habit of using named initializers for only a subset of the table types - e.g. of_device_id). - Make IIO_CHAN_SOFT_TIMESTAMP() macro a compound literal allowing simple use in various drivers that do dynamic channel definitions. Use it in all such cases. - Use dev_err_probe() and local dev variables to tidy up older drivers. - Switch more drivers to devm_mutex_init() to provide minor debug benefits. - Reorder code to put MODULE_DEVICE_TABLE() next to the tables. - Lots of use of cleanup.h magic to improve code flow, often including related refactors such as introducing helpers. - Replacement of usleep_range() with fsleep() - Reduce logging noise where functions either provide their own extensive reports on error, or where a clear error code is returned to userspace. - Minor spelling and style fixes (improving bracket usage, not using __packed etc) hid-sensors-* - Drop helpers for setting channel bit masks in favor of a compound literal at the call site. Also general cleanup of surrounding code. hid-sensors-magn - Use u32 rather than bare unsigned for types. hid-sensors-rotation - Make sue of ext_scan_type handling for static case rather than duplicate chan_info structures. adi,ad3552r - Use field_get() to replace open coded equivalent. adi,ad4170 - Switch from switch to table lookup for GPIO modes. adi,ad5686 - Apply IWYU principal to included a consistent set of headers. - Deduplicate regmaps for AD5684 and AD5693 as identical. - Switch from an enum value in driver data and array look up to pointers to separate structures, improving readabilty and avoiding issues with 0 value when using helpers to deal with different firmware types. - Add of_match_id table to SPI driver rather than relying on fallback to spi_device_id table. - Introduce some helpers for powerdown mask control. - Add helpers for control sync simplifying a couple of corner cases. - Docs fixes. - Add an ops structure to simplify future addition of operations beyond read and write. adi,ad7191 - Switch to best practice of using device_property_present() to detect if an optional property is there rather than error values on querying the property. adi,ad7280a - Use local variables to improve readability of breaking up chan-address. adi,ad7825 - Cleanup a type mismatch in clamp() call. adi,ad799x - Include improvements - Local dev variable to shorten code lines. - Cache regulator voltage at probe (these never change in practice) - Convert to devm for all unwind handling. adi,ad9832 - Improve include relevance including replacing kernel.h with more specific headers. - Simplify some maths. adi,ad9834 - Improve include relevance including replacing kernel.h with more specific headers. adi,adt7316 - Add a comment to avoid future 'fixes' for error handling during the odd sequence used to flip from I2C mode to SPI mode. adi,adxl* - Documentation consistency improvements. asahi-kasei,ak8975 - Fix missing runtime pm calls for buffered capture. - Fix missing pm_runtime_put_autosuspend() in an error path that would leave the device stuck on. - Close a potential uninitialized kernel stack leak. - Extensive driver modernization including: header relevance, fsleep() various minor bugs, dropping duplicate error messages and avoiding magic lengths for buffers. - Replace opencoded polling with iopoll(). - Add error checking to gpio reads. avia,hx711 - Move scale computation from global data to per device avoiding problems if multiple devices present. - General binding text cleanup. bosch,bmg160 - Add missing mount-matrix entry to binding. bosch,bno55 - Terminate error strings with newlines. devantech,srf08 - Replace sprintf() with sysfs_emit() and sysfs_emit_at() to make intent clearer. freescale,mma8452 - Add missing return value check. - Fix potential probe ordering issue by switching to non devm irq request. linear,ltc2309 - Add chip specific read delays. - Improve chip_info structure, adding __counted_by_ptr marking and reorganizing to improve packing. linear,ltc2983 - Fix a firmware combination where default n_wires of 2 bypasses exclusion of adi,current-rotate whereas explicitly setting it to 2 does not. - Fix potential race with completion reinit. - Improve error message wording consistency. - Use fwnode_property_present() to detect optional properties rather than fragile return value checking. microchip,mcp3422 - Use of GENMASK(), FIELD_GET(), FIELD_PREP() to improve readability and generally modernize driver. microchip,mcp47feb02 - Fix binding example to use a possible I2C address. - Fix binding bounds on channel number. - Standardize binding example indentation nxp,saradc - Increase chances of recovering from a failure in the interrupt handler by notifying the trigger that it can reenable even when the read failed. - Use field_get() to replace opencoded equivalent. qualcomm,* - Standardize on Qualcomm company naming in Kconfig. richtek,rtq6056 - Add i2c_device_id table for legacy instantiation. samsung,ssp - Replace custom timestamp channel macro with main one. sciosense,ens210 - Now scoped_guard() has been reworked, no need for a return that can never be reached. sensiron,scd30 - Constify command lookup table. - Sanity check for NULL buffer of non zero size being provided to sc30_i2c_command() sensortek,stk3310 - Include more appropriate headers. - Ensure interrupt in appropriate mode after resume. - Structure definition improvements. - Use size_of() to replace opencoded sizes. siliconimage,si1133 - Resolve counter related issues on timeout error paths. - Unused macro removal, improved macro definitions,. - Include relevance improvements. st,lsm6dsx - Fix an issue with applying invalid data check to wrong type of sample. taos,tcs3472 - Try to powerdown chip on probe failure. - Devm usage and dropping of remove() callback. - Various other minor cleanup. taos,tsl2591 - Dead code removal. - Simplify tsl2591_persist functions using a look up table. ti,ads1298 - Fix wrong comment on timeout (and minor code improvement) - Drop unnecessary CONFIG2 write during init. ti,ads7950 - Check ret rather that ret < 0 for spi_setup() call. - Use fully devm managed resources including moving to devm_regulator_get_enable_read_voltage() at probe time rather than querying evey time. - Using spi_optimize_message() to reduce CPU usage. ti,ads8688 - User read_avail() callback rather than open coding handling of available attributes. ti,opt3001 - Header relevance improvements - Use GENMASK for field definitions to improve readability. vishay,vcnl4000 - Switch from enum in device_data to individual names structures impmroving code readabililty. - Move to devm handling for remainder of probe. vishay,veml6030 - Drop pointless read of current Iteration Time index as it is not used. xilinx,ams - Fix potential out of bound channel lookup. - Replace some large switch statements with table lookups. yamaha,yas530 - Put label in chip info structure to avoid look up in i2c_device_id table. Drop ---- iio-trig-interrupt. - Not used for some time and no support for modern firmware bindings or in kernel users. So drop it. * tag 'iio-for-7.2a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio: (266 commits) iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure iio: chemical: scd30: Replace manual locking with RAII locking iio: light: tsl2591: remove unneeded tsl2591_compatible_als_persist_cycle() iio: dac: ad5686: create bus ops struct iio: dac: ad5686: cleanup doc header of local structs iio: dac: ad5686: add control_sync() for single-channel devices iio: dac: ad5686: add helpers to handle powerdown masks iio: dac: ad5686: add of_match table to the spi driver iio: dac: ad5686: drop enum id iio: dac: ad5686: remove redundant register definition iio: dac: ad5686: refactor include headers iio: adc: ad4080: fix AD4880 chip ID iio: light: veml3328: add support for new device dt-bindings: iio: light: veml6030: add veml3328 docs: iio: adc: ad4691: add driver documentation iio: adc: ad4691: add oversampling support iio: adc: ad4691: add SPI offload support iio: adc: ad4691: add triggered buffer support iio: adc: ad4691: add initial driver for AD4691 family dt-bindings: iio: adc: add AD4691 family ...
2026-06-08nfs: use nfsi->rwsem to protect traversal of the file lock listYang Erkun1-1/+0
Lingfeng identified a bug and suggested two solutions, but both appear to have issues. Generally, we cannot release flc_lock while iterating over the file lock list to avoid use-after-free (UAF) problems with file locks. However, functions like nfs_delegation_claim_locks and nfs4_reclaim_locks cannot adhere to this rule because recover_lock or nfs4_lock_delegation_recall may take a long time. To resolve this, NFS switches to using nfsi->rwsem for the same protection, and nfs_reclaim_locks follows this approach. Although nfs_delegation_claim_locks uses so_delegreturn_mutex instead, this is inadequate since a single inode can have multiple nfs4_state instances. Therefore, the fix is to also use nfsi->rwsem in this case. Furthermore, after commit c69899a17ca4 ("NFSv4: Update of VFS byte range lock must be atomic with the stateid update"), the functions nfs4_locku_done and nfs4_lock_done also break this rule because they call locks_lock_inode_wait without holding nfsi->rwsem. Simply adding this protection could cause many deadlocks, so instead, the call to locks_lock_inode_wait is moved into _nfs4_proc_setlk. Regarding the bug fixed by commit c69899a17ca4 ("NFSv4: Update of VFS byte range lock must be atomic with the stateid update"), it has been resolved after commit 0460253913e5 ("NFSv4: nfs4_do_open() is incorrectly triggering state recovery") because all slots are drained before calling nfs4_do_reclaim, which prevents concurrent stateid changes along this path. Also, nfs_delegation_claim_locks does not cause this concurrency either since when _nfs4_proc_setlk is called with NFS_DELEGATED_STATE, no RPC is sent, so nfs4_lock_done is not called. Therefore, nfs4_lock_delegation_recall from nfs_delegation_claim_locks is the first time the stateid is set. Reported-by: Li Lingfeng <lilingfeng3@huawei.com> Closes: https://lore.kernel.org/all/20250419085709.1452492-1-lilingfeng3@huawei.com/ Closes: https://lore.kernel.org/all/20250715030559.2906634-1-lilingfeng3@huawei.com/ Fixes: c69899a17ca4 ("NFSv4: Update of VFS byte range lock must be atomic with the stateid update") Signed-off-by: Yang Erkun <yangerkun@huawei.com> Reviewed-by: Jeff Layton <jlayton@kernel.org> Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
2026-06-08watchdog: linux/watchdog.h: repair kernel-doc commentsRandy Dunlap1-2/+6
Convert struct comments to correct kernel-doc format and add one missing struct member description. Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-06-08ASoC: simple-card: remove platform data styleMark Brown5-18/+12
Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> says: SuperH ecovec24/7724se are the last user of Simple Audio Card as "platform data style". It is mainly supporting "DT style" in these days. Now, Simple Audio Card "platform data style" is no longer correctly working during almost this 10 years. but we have not get such report. Let's remove Sound support from SuperH ecovec24/7724se, and remove Simple Audio Card platform data style. Link: https://patch.msgid.link/87zf1le4fu.wl-kuninori.morimoto.gx@renesas.com
2026-06-08nfs: keep PG_UPTODATE clear after read errors in page groupsClark Wang1-0/+1
When a read request is split into multiple subrequests, earlier completions may advance PG_UPTODATE state for the page group once their bytes fall within hdr->good_bytes. If a later subrequest in the same group then completes with NFS_IOHDR_ERROR, the read path needs to clear any accumulated PG_UPTODATE state and keep later completions from rebuilding it. Otherwise, a subsequent successful subrequest can re-enter nfs_page_group_set_uptodate(), restore the page-group sync state, and leave stale PG_UPTODATE behind for nfs_page_group_destroy() to trip over in nfs_free_request(). Add a sticky page-group read-failed flag. Once any subrequest in the group is known to be bad, mark the group failed, clear any accumulated PG_UPTODATE state, and refuse further PG_UPTODATE synchronization for the rest of the completion walk. Fixes: 67d0338edd71 ("nfs: page group syncing in read path") Signed-off-by: Clark Wang <xiaoning.wang@nxp.com> Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
2026-06-08Merge tag 'hyperv-fixes-signed-20260607' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linuxLinus Torvalds1-0/+7
Pull hyperv fixes from Wei Liu: - MSHV driver fixes from various people (Anirudh Rayabharam, Can Peng, Dexuan Cui, Michael Kelley, Jork Loeser, Wei Liu) - Hyper-V user space tools fixes (Thorsten Blum) - Allow VMBus to be unloaded after frame buffer is flushed (Michael Kelley) * tag 'hyperv-fixes-signed-20260607' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: mshv: support 1G hugepages by passing them as 2M-aligned chunks Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs mshv: use kmalloc_array in mshv_root_scheduler_init mshv: Add conditional VMBus dependency hyperv: Clean up and fix the guest ID comment in hvgdk.h drm/hyperv: During panic do VMBus unload after frame buffer is flushed Drivers: hv: vmbus: Provide option to skip VMBus unload on panic mshv: unmap debugfs stats pages on kexec mshv: clean up SynIC state on kexec for L1VH mshv: limit SynIC management to MSHV-owned resources hv: utils: replace deprecated strcpy with strscpy in kvp_register hv: utils: handle and propagate errors in kvp_register mshv: add a missing padding field
2026-06-08nfs: remove fileid field from struct nfs_inodeJeff Layton1-5/+0
Now that all NFS client code uses inode->i_ino directly to store and access the 64-bit NFS fileid, the separate fileid field in struct nfs_inode is unused. Remove it to save 8 bytes per NFS inode. Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Jeff Layton <jlayton@kernel.org> Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
2026-06-08nfs: replace NFS_FILEID() and nfsi->fileid with inode->i_inoJeff Layton1-10/+0
Now that inode->i_ino stores the full 64-bit NFS fileid, replace all uses of NFS_FILEID(), set_nfs_fileid(), and direct nfsi->fileid accesses with inode->i_ino throughout the NFS client. Remove the NFS_FILEID() and set_nfs_fileid() helper functions from include/linux/nfs_fs.h since they are no longer needed. Also fix two pre-existing truncation bugs in nfs4trace.h where fileid trace fields were declared as u32 instead of u64. Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Jeff Layton <jlayton@kernel.org> Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
2026-06-08nfs: remove nfs_compat_user_ino64() and deprecate enable_ino64Jeff Layton1-10/+0
Now that inode->i_ino stores the full 64-bit NFS fileid, the nfs_compat_user_ino64() function is no longer needed. generic_fillattr() already copies inode->i_ino into stat->ino, so the explicit override in nfs_getattr() is also redundant. Also remove the now-unused nfs_fileid_to_ino_t() and nfs_fattr_to_ino_t() helper functions that were used to XOR-fold 64-bit fileids into the old unsigned long i_ino. Keep the enable_ino64 module parameter as a deprecated stub that accepts but ignores the value, logging a notice when set. This avoids breaking existing configurations that pass nfs.enable_ino64 on the kernel command line or in modprobe.d. Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Jeff Layton <jlayton@kernel.org> Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
2026-06-08nfs: store the full NFS fileid in inode->i_inoJeff Layton1-2/+2
Now that inode->i_ino is a 64-bit value, store the full NFS fileid in it directly instead of an XOR-folded hash. This makes NFS_FILEID() and set_nfs_fileid() operate on inode->i_ino rather than the separate nfsi->fileid field. Since iget5_locked() and ilookup5() now accept a u64 hashval, pass the full fileid as the hash parameter directly. Convert direct nfsi->fileid accesses in nfs_check_inode_attributes(), nfs_update_inode(), and nfs_same_file() to use inode->i_ino. Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Jeff Layton <jlayton@kernel.org> Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
2026-06-08firmware: stratix10-svc: Add support to query Arm Trusted Firmware (ATF) versionTze Yee Ng2-1/+25
Add entry in Stratix10 service layer that allow client to retrieve the ATF version at runtime, which is useful for system diagnostics, compatibility checks, and ensuring the correct secure firmware is in use. The change introduces: - A new service command definition in the Stratix10 service layer to initiate the ATF version query. - A corresponding macro definition in the header file to expose the command ID for use by other components. The service layer uses a Secure Monitor Call (SMC) to communicate with the ATF and retrieve the version string, which can then be logged or validated by client application. Signed-off-by: Tze Yee Ng <tze.yee.ng@altera.com> Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
2026-06-08dmaengine: iop32x-adma: Remove a leftover header fileVladimir Zapolskiy1-110/+0
The Intel IOPx3xx platform was completely removed in commit b91a69d162aa ("ARM: iop32x: remove the platform"), and it'd be safe to remove an unused and leftover platform data specific header file dma-iop32x.h also. Signed-off-by: Vladimir Zapolskiy <vz@mleia.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260114051508.3908807-1-vz@mleia.com [vkoul: fixed subsystem tag] Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-06-08irqchip/renesas-rzv2h: Add DMA ACK signal routing supportJohn Madieu1-0/+5
Some peripherals on RZ/G3E SoCs (SSIU, SPDIF, SCU/SRC, DVC) require explicit ACK signal routing through the ICU via the ICU_DMACKSELk registers for level-based DMA handshaking. Add rzv2h_icu_register_dma_ack() to configure ICU_DMACKSELk, routing a DMAC channel's ACK signal to the specified peripheral. Signed-off-by: John Madieu <john.madieu.xa@bp.renesas.com> Acked-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260525110750.4020112-2-john.madieu.xa@bp.renesas.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-06-08power: sequencing: Add an API to return the pwrseq device's 'dev' pointerManivannan Sadhasivam1-0/+7
The consumer drivers can make use of the pwrseq device's 'dev' pointer to query the pwrseq provider's DT node to check for existence of specific properties. Hence, add an API to return the pwrseq device's 'dev' pointer to consumers. Note that since pwrseq_get() would've increased the pwrseq refcount, there is no need to increase the refcount in this API again. Tested-by: Wei Deng <wei.deng@oss.qualcomm.com> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Link: https://patch.msgid.link/20260519-pwrseq-m2-bt-v3-6-b39dc2ae3966@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-06-08mm: Refactor lazy_mmu_mode_pause() and lazy_mmu_mode_resume()Juergen Gross1-11/+45
In order to allow pausing and resuming MMU lazy mode for other tasks than current, refactor lazy_mmu_mode_pause() and lazy_mmu_mode_resume(). This will be needed when dropping the Xen PV private lazy MMU bookkeeping. Acked-by: "David Hildenbrand (Arm)" <david@kernel.org> Signed-off-by: Juergen Gross <jgross@suse.com> Message-ID: <20260526150514.129330-4-jgross@suse.com>
2026-06-08wifi: mac80211: bound S1G TIM PVB walk to the TIM elementBryam Vargas1-1/+1
ieee80211_s1g_check_tim() parses the S1G Partial Virtual Bitmap (PVB) of a received TIM element. The TIM is handed in as the element payload: ieee802_11_parse_elems_full() stores elems->tim = elem->data and elems->tim_len = elem->datalen (net/mac80211/parse.c), so the valid bytes are [tim, tim + tim_len). When walking the encoded blocks the function passes the walker an end sentinel of (const u8 *)tim + tim_len + 2, i.e. two bytes past the end of the element. ieee80211_s1g_find_target_block() loops while (ptr + 1 <= end) and dereferences ptr (and the per-mode ieee80211_s1g_len_*() helpers read *ptr), so it can read up to two bytes beyond the TIM element -- an out-of-bounds read of adjacent skb/heap data when the TIM is the last element in the frame. The +2 appears to account for the element id/len header, but tim already points past that header at the element payload, so the addend is wrong. Pass the correct element end, (const u8 *)tim + tim_len. Fixes: e0c47c6229c2 ("wifi: mac80211: support parsing S1G TIM PVB") Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me> Link: https://patch.msgid.link/20260606074341.49135-1-hexlabsecurity@proton.me Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-06-07Merge tag 'sched-urgent-2026-06-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tipLinus Torvalds1-2/+3
Pull rseq fix from Ingo Molnar: - Fix uninitialized stack variable in rseq_exit_user_update() (Qing Wang) * tag 'sched-urgent-2026-06-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: rseq: Fix using an uninitialized stack variable in rseq_exit_user_update()
2026-06-07rhashtable: Fix rhashtable_next_key() build warningsMykyta Yatsenko1-40/+2
rhashtable.o builds with warnings as rhashtable_next_key() kdoc from lib/rhashtable.c does not have the arguments descriptions. Move rhashtable_next_key() kdoc from header to c file, matching other functions. Move rhashtable_next_key() next to the other forward declarations in the header file. Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202606061925.WI4bYI8k-lkp@intel.com/ Fixes: 8f4fa9f89b72 ("rhashtable: Add rhashtable_next_key() API") Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com> Link: https://lore.kernel.org/r/20260606-rhash_fixes_1-v1-1-932ab036e6bc@meta.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-07bpf: Add support for tracing_multi link sessionJiri Olsa1-1/+5
Adding support to use session attachment with tracing_multi link. Adding new BPF_TRACE_FSESSION_MULTI program attach type, that follows the BPF_TRACE_FSESSION behaviour but on the tracing_multi link. Such program is called on entry and exit of the attached function and allows to pass cookie value from entry to exit execution. Signed-off-by: Jiri Olsa <jolsa@kernel.org> Link: https://lore.kernel.org/r/20260606123955.345967-16-jolsa@kernel.org Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-07bpf: Add support for tracing_multi link cookiesJiri Olsa1-0/+1
Add support to specify cookies for tracing_multi link. Cookies are provided in array where each value is paired with provided BTF ID value with the same array index. Such cookie can be retrieved by bpf program with bpf_get_attach_cookie helper call. We need to sort cookies array together with ids array in check_dup_ids, to keep the id->cookie relation. Signed-off-by: Jiri Olsa <jolsa@kernel.org> Link: https://lore.kernel.org/r/20260606123955.345967-15-jolsa@kernel.org Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-07bpf: Add support for tracing multi linkJiri Olsa2-0/+7
Adding new link to allow to attach program to multiple function BTF IDs. The link is represented by struct bpf_tracing_multi_link. To configure the link, new fields are added to bpf_attr::link_create to pass array of BTF IDs; struct { __aligned_u64 ids; __u32 cnt; } tracing_multi; Each BTF ID represents function (BTF_KIND_FUNC) that the link will attach bpf program to. We use previously added bpf_trampoline_multi_attach/detach functions to attach/detach the link. The linkinfo/fdinfo callbacks will be implemented in following changes. Note this is supported only for archs (x86_64) with ftrace direct and have single ops support. CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS && CONFIG_HAVE_SINGLE_FTRACE_DIRECT_OPS Note using sort_r (instead of plain sort) in check_dup_ids, because we will use the swap callback in following changes. Signed-off-by: Jiri Olsa <jolsa@kernel.org> Link: https://lore.kernel.org/r/20260606123955.345967-14-jolsa@kernel.org Signed-off-by: Alexei Starovoitov <ast@kernel.org>