| Age | Commit message (Collapse) | Author |
|---|
|
https://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs.git
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/cel/linux
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse.git
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux.git
|
|
Building the uapi headers with -Wpadded shows a warning that
may indicate an incompatibility:
./usr/include/linux/ntfs.h:91:1: error: padding struct size to alignment boundary with 4 bytes [-Werror=padded]
This is relatively harmless here as the 64-bit members force natural
alignment, so this is not a problem for compat ioctls, and I checked
that the padding word is still initialized by means of using kvzalloc()
to allocate it, but it's better to avoid the padding out of
principle.
Change the reserved member to use a 64-bit type so the name field
starts after the structure and all padding is explicit.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Baolin Liu <liubaolin@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
|
|
NTFS supports multiple named $DATA attributes, commonly known as alternate
data streams. Add NTFS-specific ioctls to list, read, write, and remove
named streams through an opened base file or directory.
The UAPI provides separate commands for each operation.
- NTFS_IOC_STREAM_READ
- NTFS_IOC_STREAM_WRITE
- NTFS_IOC_STREAM_REMOVE
- NTFS_IOC_LIST_STREAMS
Read and write requests use struct ntfs_stream to specify the stream name,
byte offset, and transfer length. Writes create the stream if it does not
already exist. A write failure after creation may leave the new stream
visible. It is not rolled back because another caller may already have
opened it. Userspace can remove it with NTFS_IOC_STREAM_REMOVE.
The list command returns variable-length entries containing each named
stream's data size, allocated size, and name. If the buffer is too small,
the command returns -ENOSPC without copying entries. bytes_returned reports
the required buffer size, and stream_count reports the number of streams.
Stream names use the mounted filesystem NLS by default. Set
NTFS_STREAM_FL_UTF16 to pass or receive raw UTF-16LE names. In NLS mode,
names that cannot be represented by the mounted character set are omitted
from the list. Use UTF-16 mode for lossless enumeration. Read and write
transfers are limited to 16 MiB per request.
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull pidfd updates from Christian Brauner:
"This adds thread specific pidfds to af_unix sockets.
SO_PASSPIDFD and SO_PEERPIDFD hand out a pidfd for the thread-group
leader. A coredump server on the coredump socket can't get a handle on
the thread that took the signal and is writing the dump, and anything
doing per-thread authentication has the same problem. The sending and
the connecting thread are recorded in addition to the thread-group
leader and sk_peer_pid becomes an array indexed by pid type.
SO_PASSPIDFD_THREAD works like SO_PASSPIDFD but delivers an
SCM_PIDFD_THREAD cmsg for the sending thread. Both options are
independent so a receiver can ask for both. On SOCK_STREAM sockets
recvmsg() only stops merging data at a thread boundary when the
receiver asked for a thread pidfd. SO_PEERPIDFD_THREAD returns a pidfd
for the thread that called connect(), listen() or socketpair(). pidfs
records the coredump on the dumping thread's struct pid too so its
pidfd reports it like the leader's does. Selftests for af_unix and the
coredump socket are included"
* tag 'vfs-7.4-rc1.shared.net-next.pidfd' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
selftests/coredump: check the dumping thread's pidfd
pidfs: record the coredump on the dumping thread's pid too
selftests/net: SO_PEERPIDFD_THREAD
net: add SO_PEERPIDFD_THREAD to get a thread-specific pidfd
af_unix: record the pid of the connecting thread
net: turn sk_peer_pid into an array indexed by pid type
selftests/net: SO_PASSPIDFD_THREAD
net: add SO_PASSPIDFD_THREAD to get a thread-specific SCM_PIDFD
af_unix: record the pid of the sending thread
pid: add helpers to operate on a struct pid array
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull mount updates from Christian Brauner:
"This adds OPEN_TREE_DROP_MNTNS_MOUNTS.
crun started using OPEN_TREE_NAMESPACE to set up the container's mount
namespace and open_tree(OPEN_TREE_CLONE) for the sources of its bind
mounts. That fails on any host with a mount namespace pinned below
such a source. The recursive clone picks the pinned namespace up and
move_mount() refuses to attach the tree with ELOOP. Only a younger
mount namespace may ever be bound into an older one or mount namespace
references could form a loop. A namespace created with
OPEN_TREE_NAMESPACE is younger than everything else on the system so
from inside it every pinned namespace is older. By the time this fails
setns() has run and the host tree is out of reach, so the runtime has
to predict the situation beforehand and lose the optimization. snapd
pins mount namespaces under /run/snapd/ns so on Ubuntu that is any
container bind mounting the host root.
Every other path crossing a mount namespace boundary already leaves
these mounts behind, copy_mnt_ns() and create_new_namespace() both do.
Only get_detached_copy() asks for them.
The new flag lets a caller get a clone without them. It stays opt-in
because open_tree(OPEN_TREE_CLONE) plus move_mount() is mount --rbind
through a file descriptor and dropping them by default would silently
lose /run/snapd/ns/*.mnt on a live system. It requires AT_RECURSIVE,
is a no-op with OPEN_TREE_NAMESPACE and skips locked nsfs mounts the
way copy_mnt_ns() does, so nothing new is exposed. Selftests are
included"
* tag 'vfs-7.4-rc1.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
selftests/filesystems: test OPEN_TREE_DROP_MNTNS_MOUNTS
mount: add OPEN_TREE_DROP_MNTNS_MOUNTS
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull misc vfs updates from Christian Brauner:
"Fixes:
- aio: a keyed poll completion on an epoll instance could recurse
into the same epoll waitqueue lock when the result eventfd is
watched by that very instance. An unprivileged process could make a
CPU spin on the recursive lock. eventfd-backed poll completions are
always deferred now.
- fsnotify_inoderemove() is only called once the inode is really
dead, no nlink and no aliases, and open_by_handle_at() can't add an
alias to a dead inode anymore. The race could crash fsnotify or
lose inode mark notifications.
- devtmpfs: the conversion of the public instance to ->get_tree()
broke reconfiguring the shared superblock's options on later mounts
which made the boot time defaults permanent. A reconfigure context
is kept in fc->fs_private so the parse ops can forward options to
the underlying filesystem.
- ufs truncated the 64-bit directory size to an unsigned int in
ufs_last_byte(). A crafted image with a 4 GiB directory produced an
out-of-folio read in ufs_find_entry() and, with
CONFIG_UFS_FS_WRITE, a write into an adjacent page.
- devpts rejects max=0 instead of silently lifting the per-instance
pty limit. The value wrapped into ida_alloc_max() and became
unlimited.
- fs_pin publishes pins with the rcu list helpers so the kill paths
reading the lists under rcu see the initialization.
- dentry_kill() reports a Tasks-RCU quiescent state. Its
cond_resched() is the only reschedule point on the dentry teardown
path and cond_resched() isn't a quiescent state for Tasks-RCU, so
Meta kept seeing rcu_tasks stalls in btrfs subvolume deletion.
- writeback sizes foreign flushes by the target wb's dirty pages
instead of the memcg-wide count which over or undersized a single
bdi flush.
- nfsd READ emitted two fsnotify access events on the iterator path
since vfs_iocb_iter_read() already sends one. A READ on a krb5i or
krb5p mount showed up twice in inotify.
- pipe and splice pass a poll key when waking readers and writers so
epoll, poll() and select() waiters only wake for the event they
asked for.
- the iso8859-14 Unicode to charset tables had page01 duplicated as
page1e so 29 code points mapped to the wrong bytes and 22 that
aren't in the charset were accepted.
- orangefs doesn't wait for an unmount service operation that never
returns on system shutdown and uses ssize_t for strscpy() errors.
- __register_chrdev() checks the kobject_set_name() return value.
- selftest fixes: the openat2 tests hardcoded O_LARGEFILE to 0x8000
which is O_NOFOLLOW on powerpc, resolve_test makes /tmp a
mountpoint so RESOLVE_NO_XDEV has a boundary to trip over,
file_stressor moves into its own directory with a 30 minute
timeout, the kernfs listxattr test skips when SELinux exposes
security.selinux, the namespaces active reference tests wait for
the thread via a PIDFD_THREAD pidfd since pthread_join() returns
before exit_nsproxy_namespaces(), the idmapped_tmpfile test chowns
its directory into the mapped range, the clone3 CLONE_CLEAR_SIGHAND
test adds CLONE_VM so it fails for the intended reason, the pidfd
PPID error message prints the values it compares and fscontext_ns
gets a .gitignore.
Cleanups:
- vmcore prints the release of the crashed kernel from the VMCOREINFO
note so a kdump that dies before the dump lands still says which
kernel it was for.
- initramfs allocates hardlink hash entries with the validated cpio
name length instead of PATH_MAX, which put every entry in
kmalloc-8k.
- the unused dax_layout_busy_page() is removed,
dax_layout_busy_page_range() becomes static and dax_folio_init()
drops a redundant list initialization.
- vfs_empty_path() is removed, it has had no callers since
getname_maybe_null().
- comment and documentation fixes in aio, bpf_fs_kfuncs,
fs-writeback, inode, read_write, squashfs and the vfs.rst copy of
struct file_system_type"
* tag 'vfs-7.4-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (38 commits)
selftests/filesystems: Fix idmapped_tmpfile layer dir ownership
selftests/namespaces: Wait for thread exit via pidfd in active-ref tests
writeback: size foreign flushes by target wb dirty pages
initramfs: Reduce hardlink hash allocation sizes
fs: remove unused vfs_empty_path()
dcache: report a Tasks-RCU quiescent state in dentry_kill()
vmcore: report the release of the crashed kernel
splice: pass a poll key when waking pipe readers and writers
pipe: pass a poll key when waking writers after a resize
orangefs: use ssize_t instead of size_t for error codes...
orangefs_super: don't wait on service operation on system shutdown.
docs/vfs: Fix the struct file_system_type copy
nls: fix the Unicode to charset tables of iso8859-14
selftests/filesystems/openat2: make /tmp a mountpoint inside private namespace
selftests/filesystems/openat2: fix O_LARGEFILE definitions for non-arm64 architectures
fs: fix misleading comments in read_write.c
squashfs: fix inode number description in documentation
fs: fix typos in comments
fs/dax: Make dax_layout_busy_page_range() static
fs/dax: Remove unused dax_layout_busy_page()
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull coredump updates from Christian Brauner:
"This adds sparse coredumps and per-request memory type selection to
the coredump socket protocol.
A coredump sent over the socket transfers every zero of every hole in
every mapping. For a process with 128 threads that's 1 GB of mostly
thread stacks, 8 MB reservations with a few pages touched, and the
holes sit in the middle of the dump rather than at the end. The
coredump_filter bit that was proposed for this stops each PT_LOAD at
the last populated page. But that mask says which kinds of memory to
include and propagates across fork and exec, whereas what is selected
here is an encoding. The usermodehelper isn't salvagable for this
either. The coredump socket already has a handshake for exactly this.
A server that raises COREDUMP_RECORDS in coredump_ack->mask gets the
coredump as a sequence of records, each a struct
coredump_record_header followed by what it describes. The stream ends
explicitly with an end record that reports the size, so a missing one
means truncation.
With COREDUMP_SPARSE holes cross the socket as a bare header that says
how many zero bytes were skipped. Reassembling the records gives back
the same coredump, so a debugger and everything else still see an
ordinary core file. Numbers from the selftests: the 128 thread process
sends 1424153 bytes for a coredump of 1075150848 bytes, a 256 MB
mapping with the first and the last page touched sends 188793 bytes
for 268890112 bytes, and with COREDUMP_RECORDS alone the record
overhead is under one percent.
The selftests also simulate a server uploading to a blob store that
can't seek and rewrites the program headers so the object is an
ordinary ELF core file without the holes.
COREDUMP_MEMORY_TYPES lets the server choose what memory to dump per
request instead of relying on the static /proc/<pid>/coredump_filter
of the crashing task. The request carries the default types and a mask
of every type the kernel knows about, the ack carries the selection.
Zero is valid and dumps the program headers and notes and nothing but
the mappings that are always dumped.
Preparatory cleanups refuse negative skips in dump_skip_to(), chunk
every write at a page so a pipe or a socket never takes a short write
in the middle of a record, make the dump helpers return bool and
replace the core_dumped integer with COREDUMP_STATE_STARTED and
COREDUMP_STATE_TRUNCATED flags.
Also included is a fix for coredump_parse() reading core_pattern while
it is being modified. The sysctl handler now validates a copy and
publishes it under a spinlock and the parser works on a snapshot, so a
rejected pattern is never visible and the rollback logic goes away.
And to_kthread()'s lockless flags read is annotated with READ_ONCE()"
* tag 'vfs-7.4-rc1.coredump' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (29 commits)
kthread: Annotate lockless to_kthread() flags access
coredump: parse a snapshot of core_pattern
selftests/coredump: test failed handshakes
selftests/coredump: improve coredump size negotiation tests
selftests/coredump: test COREDUMP_MEMORY_TYPES
selftests/coredump: simplify the refusal tests
tools: sync coredump.h header
coredump: select memory types to include
selftests/coredump: show how to inspect the task to decide how the coredump should be sent
selftests/coredump: simulate a blob store
selftests/coredump: put a hole in the middle of a sparse mapping
selftests/coredump: hand the record stream to a sink
selftests/coredump: test COREDUMP_RECORDS and COREDUMP_SPARSE
coredump: describe the holes when COREDUMP_SPARSE is negotiated
coredump: send the coredump in records if requested
tools: sync coredump.h header
coredump: add COREDUMP_SPARSE to the coredump socket protocol
coredump: add COREDUMP_RECORDS to the coredump socket protocol
coredump: clean up coredump state handling
coredump: always chunk writes
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull close_range updates from Christian Brauner:
"This adds two new close_range() flags.
CLOSE_RANGE_EXCEPT makes close_range() operate on all file descriptors
outside of [fd, max_fd] instead of the ones inside. Alone it closes
everything but the range. With CLOSE_RANGE_CLOEXEC it marks everything
but the range close-on-exec. With CLOSE_RANGE_UNSHARE dup_fd() never
takes a reference on what is dropped. So a task between
clone(CLONE_FILES | CLONE_VM | CLONE_VFORK) and execve() that has the
descriptors for the child in one window can shed the rest of the
shared table in one call and nothing outside of the window is
referenced by the child at any point.
CLOSE_RANGE_CLOEXEC_ONLY closes the close-on-exec descriptors in the
range and leaves everything else alone. Whatever the caller
deliberately passes down, stdio, LISTEN_FDS, an inherited pipe, stays
where it is. Combined with CLOSE_RANGE_EXCEPT it names the handful of
close-on-exec descriptors that have to survive, the executable or an
error pipe, and closes every other close-on-exec descriptor.
Along the way dup_fd() stops copying a range in the middle of the
table only to close it again. close_range(CLOSE_RANGE_UNSHARE) only
avoided the copy when the range sat at the end of the table.
Descriptors in a skipped range are never copied and no reference is
taken on them, so ->flush() isn't called anymore for files from a
table they were never part of. The flags are turned into an enum and
selftests cover the window positions, the shared and the private table
and the unshare form"
* tag 'vfs-7.4-rc1.close_range' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
selftests/core: test CLOSE_RANGE_CLOEXEC_ONLY
file: add CLOSE_RANGE_CLOEXEC_ONLY
file: let dup_fd() drop only close-on-exec descriptors
selftests/core: test CLOSE_RANGE_EXCEPT
file: add CLOSE_RANGE_EXCEPT
close_range: turn the flags into an enum
file: let dup_fd() drop everything outside of the range
file: rename dup_fd()'s punch_hole to range
selftests/core: test the hole CLOSE_RANGE_UNSHARE leaves behind
file: let dup_fd() leave the punched hole behind
|
|
Add the FUSE_BACKING_MAP_CYCLIC flag for FUSE_NOTIFY_BACKING_MAP
notifications to enable creating striped maps.
This is just a set of regular extents that repeats after the end of the
last extent using a striping pattern (i.e. on the target backings the
stripes have a contiguous footprint).
Two additional limits apply compared to non-cyclic extent map population:
- the size of the extents (chunk size) must be equal
- the extents must start from zero offset and follow each other without
gaps.
Originally-by: John Groves <john@groves.net>
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
|
|
Add support for creating and managing extent maps that map file regions to
dax device regions.
Introduce FUSE_NOTIFY_BACKING_MAP for populating extent maps from
userspace.
Extent maps are handled as a new type of backing and are assigned a 64 bit
backing ID by the server.
One extent consists of
- offset within the containing backing
- length of extent
- target backing ID
- offset into target backing
Extents must be non-overlapping, and can only refer to dax device backings
for now.
At this point only support creating and populating the extent map in one
operation, though the interface is not limited by this and later may be
changed, so that partial population of an extent map would be possible.
Originally-by: John Groves <john@groves.net>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
|
|
Add backing_id_64 field to fuse_open_out to allow opening files with
64-bit server-allocated backing IDs.
If the connection was initialized with FUSE_PASSTHROUGH_V2, the kernel
reads the backing ID from open_out.backing_id_64 instead of
open_out.backing_id.
The open reply is now variable-length for backward compatibility with
servers that don't send the new backing_id_64 field.
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
|
|
Add support for server allocated 64-bit backing IDs alongside the
existing kernel allocated 32-bit IDs.
Opened with FUSE_DEV_IOC_BACKING_CREATE, the backing ID sent via
fuse_backing_create_in.backing_id.
Closed with FUSE_NOTIFY_BACKING_REMOVE. Since close only provides the
backing ID, not the file descriptor, it doesn't have to be done with an
ioctl.
Backing ID can take any 64 bit value other than zero.
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
|
|
At Meta, we use the LOGICAL_INO_V2 ioctl to estimate sharing-aware space
usage. We sample the logical address space and resolve each sample back
to the inodes which reference it. The measurement is statistical, so
with enough samples it gives good bounds on real usage.
Currently in the LOGICAL_INO_V2 ioctl path, iterate_extent_inodes()
(which can walk backrefs either against the current trees or against the
commit roots) acquires a tree modification log sequence number when
walking the current trees, since those trees are being modified while
the walk is in progress. The log is then enabled filesystem wide for as
long as any such walk is running, and is only disabled again once the
last walk has finished.
While it is enabled the cost impacts the whole filesystem, not only the
caller. Modifications of interior nodes of the extent tree and of
subvolume trees have to be recorded, serialized on a single filesystem
wide lock. Delayed refs with a sequence number at or above the oldest
active one can not be run (the run path bails out with -EAGAIN in
btrfs_run_delayed_refs_for_head()), and metadata refs above it can not
be merged, so they accumulate and that work is deferred to transaction
commit.
Currently, userspace has no way to ask for anything cheaper. Whenever a
transaction is running, the walk uses the tree modification log, even if
the caller would tolerate results that could be up to one commit interval
stale.
Give userspace this option by adding BTRFS_LOGICAL_INO_ARGS_COMMIT_ROOT,
which makes the backref walk use the commit roots and therefore never
enables the tree modification log. Behavior is unchanged unless the flag
gets explicitly passed by userspace. iterate_extent_inodes() already
takes a search_commit_root argument for this, which scrub, send and the
data relocation warning path all pass as true. The flag simply plumbs it
through to userspace.
Assisted-by: LLM
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
Signed-off-by: David Sterba <dsterba@suse.com>
|
|
Fix all (24) kernel-doc warnings in <uapi/linux/fuse.h>:
- modify some instances to use common C comment style instead of
kernel-doc
- convert a few instances to use kernel-doc format
The warnings are all of this form (list is truncated for brevity):
Warning: include/uapi/linux/fuse.h:370 This comment starts with '/**', but isn't a kernel-doc comment.
* Bitmasks for fuse_setattr_in.valid
Warning: include/uapi/linux/fuse.h:386 This comment starts with '/**', but isn't a kernel-doc comment.
* Flags returned by the OPEN request
Warning: include/uapi/linux/fuse.h:414 This comment starts with '/**', but isn't a kernel-doc comment.
* INIT request/reply flags
Warning: include/uapi/linux/fuse.h:526 This comment starts with '/**', but isn't a kernel-doc comment.
* CUSE INIT request/reply flags
Warning: include/uapi/linux/fuse.h:630 This comment starts with '/**', but isn't a kernel-doc comment.
* extension type
Warning: include/uapi/linux/fuse.h:1307 This comment starts with '/**', but isn't a kernel-doc comment.
* Header for all fuse-io-uring requests
Warning: include/uapi/linux/fuse.h:1320 This comment starts with '/**', but isn't a kernel-doc comment.
* sqe commands to the kernel
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
|
|
Fix misspellings and repeated words in comments, found with
scripts/checkpatch.pl and codespell. Only touches comments, no code
changes.
Assisted-by: Cursor:claude-opus-5
Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
|
|
Currently we define btrfs_fs_info::qgroup_flags as u64, to match the
on-disk qgroup status item's flag.
But for now we have only 4 bits utilized for that flag, and since it's
u64 we have no way to properly use the existing atomic bit operations
(requires an unsigned long pointer).
This results in a lot of non-atomic operations inside qgroup code. Some
maybe fine as other locks are involved, but still it's not a good
practice.
Remove those non-atomic operations by:
- Re-define btrfs_fs_info::qgroup_flags as unsigned long
- Define BTRFS_QGROUP_STATUS_BIT_* and BTRFS_QGROUP_RUNTIME_BIT_*
Instead of the old value define the bit number.
- Use set_bit()/clear_bit()/test_bit() to replace open-coded bit
operations
- Add one extra check at qgroup status item read time
To make sure the on-disk flag is still inside ULONG_MAX.
Otherwise reject the status item and disable qgroup.
- Get rid of unnecessary spinlock when checking a single bit
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
|
|
A recursive open_tree(OPEN_TREE_CLONE) copies the nsfs mounts of any
mount namespaces pinned below the source. When the clone is attached
inside a mount namespace younger than a pinned one, move_mount(2) fails
with ELOOP from check_for_nsfs_mounts(), per the rule from commit
8823c079ba71 ("vfs: Add setns support for the mount namespace") that
prevents mount namespace reference loops.
This breaks container runtimes that use OPEN_TREE_NAMESPACE, such as
crun [1]. The new namespace is younger than everything else, so bind
mounting e.g. the host root fails on any host that pins a mount namespace
(snapd does, under /run/snapd/ns). By the time it fails, setns() has
already run and userspace cannot recover: the host tree is out of reach,
and the offending mounts cannot be unmounted from the detached copy.
copy_mnt_ns() and create_new_namespace() already leave these mounts
behind; only get_detached_copy() copies them. Add an open_tree() flag to
drop them from the clone, as suggested by Aleksa [2]. Locked nsfs mounts
are dropped the same way copy_mnt_ns() does it, so nothing new is exposed.
Keep it opt-in: open_tree(OPEN_TREE_CLONE) plus move_mount(2) is how
mount --rbind works through a file descriptor, and in the caller's own
or an older namespace such mounts remain usable.
The flag requires AT_RECURSIVE, since a non-recursive clone has no
submounts to drop, and OPEN_TREE_CLONE or OPEN_TREE_NAMESPACE. With the
latter it is a no-op, so a runtime can pass it with any recursive
open_tree() call.
Link: https://github.com/containers/crun/issues/2262 [1]
Link: https://lore.kernel.org/all/2026-01-07-oldest-grim-captions-spills-ywC2O3@cyphar.com/ [2]
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Link: https://patch.msgid.link/20261006-nsfs-prune-rfc-v3-1-adb97ea52868@gmail.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
|
|
SO_PEERPIDFD hands out a pidfd for the thread-group that called
connect() or socketpair(). Enable workloads such as the coredump server
or a broker to get a pidfd of the specific thread that connected to the
socket.
Reviewed-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@futurfusion.io>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Signed-off-by: Andrew Halaney <andrew@amutable.com>
Link: https://patch.msgid.link/20261005-work-unix-passpidfd-v4-7-350183b6e02a@amutable.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
|
|
Currently, SCM_PIDFD carries a pidfd for the thread-group leader. A
broker or the coredump server cannot learn the identity of the specific
thread that sent a given message. Now that both struct pids are recorded
a receiver can ask for the specific identity it needs.
So add SO_PASSPIDFD_THREAD as a sibling of SO_PASSPIDFD.
SO_PASSPIDFD_THREAD delivers an SCM_PIDFD_THREAD, i.e. scoped
to the specific thread sending. This is completely independent of
SO_PASSPIDFD, meaning you can use both options and get both cmsgs.
On SOCK_STREAM sockets recvmsg() only stops merging data at a thread
boundary when the receiver asked for a thread pidfd. For SO_PASSCRED and
SO_PASSPIDFD receivers all threads of one process remain a single
writer.
Co-developed-by: Andrew Halaney <andrew@amutable.com>
Signed-off-by: Andrew Halaney <andrew@amutable.com>
Link: https://patch.msgid.link/20261005-work-unix-passpidfd-v4-3-350183b6e02a@amutable.com
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
|
|
Describe the interface that lets a caller take over rpcbind registration.
The request gains a userspace-rpcbind flag. The reply echoes the flag,
lists the programs and versions that the caller should register, and
names the listeners that came up.
NLM is absent. lockd owns its own svc_serv and still registers itself.
Assisted-by: LLM
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260915-nfsd-norpcb-v3-2-3c60d49ade02@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
|
|
CLOSE_RANGE_CLOEXEC marks a range close-on-exec. Nothing happens to
these fds unless an exec happens. Add CLOSE_RANGE_CLOEXEC_ONLY which
closes the close-on-exec file descriptors in the range.
When combined with CLOSE_RANGE_EXCEPT it names the close-on-exec file
descriptors that are supposed to survive. Every close-on-exec fd outside
of the range is closed. File descriptors without that flag are left
alone. Whatever the caller deliberately passes down, stdio, LISTEN_FDS,
an inherited pipe, remains where it is.
The handful of close-on-exec descriptors the caller still needs for the
exec such as the executable, an error pipe, sit in a specific range.
That is what a task between clone(CLONE_FILES) and execve() actually
wants:
clone(CLONE_FILES | CLONE_VM | CLONE_VFORK)
child: close_range(lo, hi, CLOSE_RANGE_UNSHARE |
CLOSE_RANGE_CLOEXEC_ONLY |
CLOSE_RANGE_EXCEPT)
child: rearrange descriptors in the now private table
child: execve()
Between the clone and the close_range() the child holds no reference of
its own on any file because copy_files() only bumps the fdtable
refcount. So a close() in the parent takes effect immediately. The
unshare also never takes a reference on the fds it leaves behind either.
The range is expressed in the parent's numbering. So a caller that
cannot name the file descriptors it keeps contiguously picks a range
wide enough to cover them, unshares, and tidies up with a second
close_range() on the table it now owns alone. That one is cheap. To keep
nothing, name a range that cannot hold an open descriptor, e.g.
close_range(~0U, ~0U, ...).
CLOSE_RANGE_CLOEXEC and CLOSE_RANGE_CLOEXEC_ONLY are mutually exclusive.
Link: https://patch.msgid.link/20260921-work-file-close_range_except-v1-9-c20d0b49270d@kernel.org
Reviewed-by: Jann Horn <jannh@google.com>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
|
|
close_range() operates on [fd, max_fd]. Add CLOSE_RANGE_EXCEPT. This new
flag instructs it to operate on all file descriptors outside of the
range instead.
Without any other flags that means it closes everything except the file
descriptors in the specified range. Together with CLOSE_RANGE_CLOEXEC it
marks every file descriptor except the ones in the range as
close-on-exec. With CLOSE_RANGE_UNSHARE dup_fd() never takes a reference
on what is dropped.
A task between clone(CLONE_FILES | CLONE_VM | CLONE_VFORK) and execve()
that has the descriptors for the child in one window can shed the rest
of the shared table in one call:
close_range(lo, hi, CLOSE_RANGE_UNSHARE | CLOSE_RANGE_EXCEPT)
Nothing outside of the window is referenced by the child at any point.
Link: https://patch.msgid.link/20260921-work-file-close_range_except-v1-6-c20d0b49270d@kernel.org
Reviewed-by: Jann Horn <jannh@google.com>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
|
|
Turn the close_range() flags into an enum. Makes debugging a lot easier.
No functional changes.
Link: https://patch.msgid.link/20260921-work-file-close_range_except-v1-5-c20d0b49270d@kernel.org
Reviewed-by: Jann Horn <jannh@google.com>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/crng/random
Pull random number generator fixes from Jason Donenfeld:
- VMGENID memory needs to be mapped with the decrypted tag, so that
SEV-SNP machines can boot
- A fix for an initialization race in VMGENID, followed by a cleanup
- Trivial kernel doc cleanups in siphash and random.c
- A fix for a new compilation failure with recent clang on PPC and
RISC-V, due to generating an out-of-line memset in the vDSO
* tag 'random-7.3-rc6-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/crng/random:
random: vDSO: avoid call to memset() when zeroing reserved parameter
random: fix vgetrandom_opaque_params kernel-doc
random: vDSO: fix repeated word 'to' in comment
siphash: clean up kernel-doc comments
virt: vmgenid: move to using dev_set/get_drvdata
virt: vmgenid: set driver_data before registering notification handlers
virt: vmgenid: remap memory as decrypted
|
|
The implied padding causes a harmless warning when testing the uapi
headers with -Wpadded that could in theory indicate incompatibilities
or data leaks:
./usr/include/linux/alloc_tag.h:41:1: error: padding struct size to alignment boundary with 7 bytes [-Werror=padded]
The code here is fine, but it's better to make the padding explicit and
avoid the warning here.
Link: https://lore.kernel.org/20260916065830.1619425-1-arnd@kernel.org
Link: https://lore.kernel.org/20260915202404.3568029-1-arnd@kernel.org
Fixes: 1d581ab2348c ("alloc_tag: add ioctl to /proc/allocinfo")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Suren Baghdasaryan <surenb@google.com>
Acked-by: SJ Park <sj@kernel.org>
Acked-by: Hao Ge <hao.ge@linux.dev>
|
|
Currently /proc/<pid>/coredump_filter determines what types of memory
are included in a coredump produced by <pid>. This is fairly static. The
coredump server has no easy way to configure what memory to dump even
though it can figure out all the necessary details to make an informed
decision.
Add a new COREDUMP_MEMORY_TYPES feature bit. If the coredump server
raises it the kernel will dump memory types raised in the
coredump_ack->memory_types member. Zero is valid and causes the creation
of a coredump that just includes the program headers and notes but no
memory apart from the mappings that are always dumped.
struct coredump_req gains @memory_types which is set to the default
memory types that are included in the coredump. This can be overridden by
raising bits in coredump_ack->memory_types. It also gains
@memory_types_mask which contains a bitmask of all memory types the
kernel knows about. A coredump server may only raise bits in
coredump_ack->memory_types that are raised in
coredump_req->memory_types_mask.
struct coredump_ack grows too. If COREDUMP_MEMORY_TYPES is raised in
@mask the kernel dumps the memory types set in the @memory_types mask.
Zero is valid and dumps no memory apart from the mappings that are
always dumped. A coredump server wanting to add or drop memory types
instead of outright replacing it should simply copy
coredump_req->memory_types and then mask off or raise types as needed.
@memory_types must be zero if COREDUMP_MEMORY_TYPES isn't raised.
COREDUMP_MEMORY_TYPES requires COREDUMP_KERNEL and an ack of at least
COREDUMP_ACK_SIZE_VER1 bytes.
Link: https://patch.msgid.link/20260821-work-coredump-filter-v1-1-91f9a73ef03e@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
|
|
A coredump with a lot of unpopulated mappings sends useless amounts of
zero data to userspace. This is nonsensical. While __dump_skip() can
seek over them when the target is a regular file a socket cannot do
this. COREDUMP_RECORDS put the zeroes in records but it didn't get rid
of them.
Add a COREDUMP_SPARSE feature bit and a COREDUMP_RECORD_ZERO record
type. A zero record is a bare header that tells userspace how many zero
bytes were skipped.
So a hole crosses the socket as one header no matter how long it is. The
coredump server can recreate this sparsely. Zero records only exist
inside a record stream. COREDUMP_SPARSE requires COREDUMP_RECORDS.
Link: https://patch.msgid.link/20260820-work-coredump-sparse-v2-14-ba32dd718c51@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
|
|
Currently a coredump sent over a socket is raw data. The kernel knows
things about the data it's sending that are useful for a coredump
server. For example, it knows where the unpopulated parts of a mapping
are. We can't communicate this to userspace currently though.
Add a COREDUMP_RECORDS feature bit and a struct coredump_record_header
so userspace can negotiate that feature. Instead of a byte stream it
gets a header plus data. Reassembling the records yields the same
coredump that would have been sent without them.
The record itself is also versioned and thus extensible with the same
protocol as the ack-req sync.
A record stream ends explicitly. A COREDUMP_RECORD_END record closes it,
carries no data and reports the size of the coredump. It is only sent
once the whole coredump has been written. If it's missing the coredump
should be treated as truncated.
This just adds the infrastructure.
Link: https://patch.msgid.link/20260820-work-coredump-sparse-v2-13-ba32dd718c51@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
|
|
COREDUMP_REQ_SIZE_VER0 and COREDUMP_ACK_SIZE_VER0 define the initial
struct sizes.
Assert that both published sizes still match their structs. While at it
fix some issues with docs.
Link: https://patch.msgid.link/20260820-work-coredump-sparse-v2-7-ba32dd718c51@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
Pull input fixes from Dmitry Torokhov:
- Fixes for evdev and input compat handling to zero-initialize on-stack
absinfo and force-feedback effect structures before partial or compat
copies from userspace, preventing kernel stack memory disclosure
- Fixes for the Synaptics RMI4 driver to prevent an out-of-bounds read
when writing multi-chunk blocks over SMBus and to avoid a NULL
pointer dereference during suspend/resume when the RMI device is
unbound
- Fixes for the soc_button_array driver to propagate -EPROBE_DEFER on
non-Bay Trail/Cherry Trail platforms (fixing broken power and volume
buttons on the Microsoft Surface Pro 11) and to validate the ACPI
package element count before dereferencing
- A fix for the adp5588-keys driver to cache the initial GPIO hardware
state before registering the gpiochip so pre-configured pin states
are not clobbered by GPIO hogs during registration
- A fix for the cyttsp5 touchscreen driver to clamp the device-supplied
HID report size before copying into the response buffer, preventing a
buffer overflow
- A fix for the HP SDC serio driver to use timer_shutdown_sync() on
module exit so the periodic kicker timer cannot rearm itself during
teardown
- A fix for the eeti_ts touchscreen driver to export its OF module
alias so the module autoloads on Device Tree platforms
- Updates to the xpad joystick driver adding support for the Victrix
Pro BFG controller and Azeron devices, and fixing the device type
classification for the PDP Marvel Xbox 360 controller
- Quirks for the i8042 and atkbd drivers to keep the built-in keyboards
functional on the Acer Aspire Go 15 AG15-42P and Xiaomi Redmi Book
Pro 16 2026
- A quirk for the Synaptics PS/2 touchpad driver disabling SMBus
InterTouch on the Lenovo ThinkPad T440p (board ID 2722) so the
touchpad and TrackPoint respond immediately at boot
- Other minor updates and documentation fixes, including reading the
"ti,poll-period" property as u32 in tsc2007, adding the mt6572
compatible to the MediaTek keypad Device Tree binding, fixing an
attribute name typo in the trackpoint sysfs ABI documentation, and
documenting that no new LED codes should be added to the input
subsystem
* tag 'input-for-v7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
Input: hp_sdc - shut down kicker timer on module exit
Input: xpad - add support for Victrix Pro BFG Controller
Input: tsc2007 - read "ti,poll-period" as u32
Input: trackpoint - fix the inertia attribute name in the ABI document
Input: eeti_ts - publish the OF module alias
Input: xpad - add support for Azeron devices
Input: xpad - fix PDP Marvel Xbox 360 controller
Input: document that no new LED codes should be added
Input: soc_button_array - check btns_desc->package.count
Input: soc_button_array - fix MS Surface Pro 11 probe failure
Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P
Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722)
Input: cyttsp5 - clamp the HID report size before memcpy
Input: zero ff_effect before compat copy in input_ff_effect_from_user
Input: evdev - zero absinfo before partial copy in EVIOCSABS
Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound
Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()
Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026
dt-bindings: input: mediatek,mt6779-keypad: add mt6572
Input: adp5588-keys - cache GPIO state before registering the gpiochip
|
|
struct vgetrandom_opaque_params contains size_of_opaque_state, but its
kernel-doc describes size_per_opaque_state. This leaves the real member
undescribed and adds a nonexistent member to the generated
documentation.
Use the member's actual name.
Fixes: 4ad10a5f5f78 ("random: introduce generic vDSO getrandom() implementation")
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
Pull rdma fixes from Jason Gunthorpe:
"Lots of bug fixes from the last weeks:
- Various error unwind bugs
- Several more races and bugs in siw and rxe, including remote
triggerable
- HFI1 corruption with its credit scheme
- Remove a bogus user triggerable dev_warn
- Lock __ethtool_get_link_ksettings() properly
- Fix a lockdep loop with diassociation
- Several storage related bugs, some triggerable remotely
- Do no leak physical addresses to userspace in bnxt_re
- Fix wrong irq context for the xarrays in erdma
- User triggerable race in ucma with multicast
- Race in ipoib with multicast flushing and destruction"
* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (28 commits)
RDMA/siw: Bound fragmented header copies by the remaining length
RDMA/efa: Keep EQ resources alive while IRQ is registered
RDMA/efa: Keep admin queues alive while IRQ is registered
RDMA/core: fix refcount bug in iwpm_get_nlmsg_request()
IB/IPoIB: Avoid restoring OPER_UP after multicast flush
RDMA/ucma: Serialize join and leave on copy_to_user failure
RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted
RDMA/irdma: Enforce local fence for IB_WR_REG_MR
RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables
RDMA/mad: Fix receive buffer leak when PKey enforcement fails
RDMA/uverbs: Fix potential leak of resources->collection in flow_resources_alloc()
RDMA/bnxt_re: Avoid exposing umdbr to userspace
RDMA/rtrs: guard against null kobj name
RDMA/bnxt_re: check create_singlethread_workqueue() in DCB setup
IB/isert: wait for deferred control PDU completions before releasing the connection
IB/iser: reject a remote invalidation of an unregistered direction
RDMA/srp: Fix srp_remove_target()
IB/mlx4: Fix use-after-free on pkey sysfs registration failure
RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency
RDMA/core: Reject unregistering netdevs in ib_get_eth_speed
...
|
|
Add a comment to input-event-codes.h clarifying that no new LED
definitions should be added to the input subsystem. The existing
LED_* definitions are legacy and grandfathered for backwards
compatibility with userspace via evdev. Any new LED indicators
should instead use the dedicated LED subsystem.
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
|
|
Fix typos in comments, reported by scripts/checkpatch.pl using the
misspelling list in scripts/spelling.txt. Only touches comments, no code
changes.
Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com>
Link: https://patch.msgid.link/20260907063252.21433-1-hemanth.selam@gmail.com
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity
Pull IMA fixes from Mimi Zohar:
- Instantiating the ima_file_truncate and ima_path_truncate LSM hooks
resulted in configfs locking issues.
configfs files should not be measured, appraised, or audited in the
first place, so the builtin policies are updated to exclude them.
- IMA audit messages include the filename, which could result in a page
fault when the filename doesn't exist
- Un-hide the IMA_MEASURE_PCR_IDX Kconfig prompt
* tag 'integrity-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity:
ima: allow users to specify the pcr index with IMA_MEASURE_PCR_IDX
ima: Check for ERR_PTR from dentry_path() in validate_hash_algo()
ima: don't measure/appraise files on configfs
configfs: move CONFIGFS_MAGIC definition to magic.h
|
|
need to pad before __u64 tcc_disabled_mask variable.
This patch fixes 64bit Kernel + 32 bit mesa combination. But at the same
time it will break 32bit Kernel(using this patch) + older 32bit mesa(not
using this patch).
This issue was discussd with alexander.deucher@amd.com,
christian.koenig@amd.com and pierre-eric.pelloux-prayer@amd.com.
Currently today 32 bit kernel + 32 bit userspace and 64 bit kernel and
64 bit userspace work. Mixed 64 bit kernel and 32 bit userspace is
currently broken. Since 32 bit kernel and userspace is probably pretty
rare these days and the data affected by this is not critical, Hence
we can go ahead with this patch.
Fixes: cf21e76a6005 ("drm/amdgpu: return tcc_disabled_mask to userspace")
Signed-off-by: Yogesh Mohan Marimuthu <yogesh.mohanmarimuthu@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 497b5090f2857ef8ad9a162aa31ada0de5814663)
|
|
The umdbr field in struct bnxt_re_db_region returns the raw
unmapped PCI BAR address of the doorbell region. Avoid sharing
this field to the userspace. Change this to a reserved field
and stop populating it, keeping the ABI layout and size
unchanged for existing binaries.
Fixes: 1234a9d8aebb ("RDMA/bnxt_re: Support doorbell extensions")
Signed-off-by: Sriharsha Basavapatna <sriharsha.basavapatna@broadcom.com>
Link: https://patch.msgid.link/20260824172443.33943-1-sriharsha.basavapatna@broadcom.com
Reviewed-by: Selvin Xavier <selvin.xavier@broadcom.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
|
|
Propagating syncfs()/sync() to a FUSE server via FUSE_SYNCFS lets the
server flush its own cached or intermediate state when userspace asks the
filesystem to sync. This is currently enabled only for virtiofs and
fuseblk, because an untrusted server can use it to stall sync()
indefinitely (see commit 2d82ab251ef0 ("virtiofs: propagate sync() to file
server"), and commit d3906d8f3cee ("fuse: enable FUSE_SYNCFS for all
fuseblk servers")). Both of those mount types require host privilege to
set up, so the server is trusted not to abuse it.
There is nothing virtiofs- or block-specific about wanting to handle
syncfs(), though. A plain /dev/fuse server is just as entitled to
participate in the sync() path -- so that data it has buffered reaches
stable storage when the user asks for it -- provided it is equally
trusted.
The trust property that virtiofs and fuseblk satisfy is that neither can
be mounted without CAP_SYS_ADMIN in the initial user namespace (neither
sets FS_USERNS_MOUNT). A plain fuse mount does set FS_USERNS_MOUNT, so its
existence guarantees no such privilege; the privilege has to be checked
rather than assumed.
Add an opt-in INIT flag, FUSE_HAS_SYNCFS, and honor it only when the
server opened /dev/fuse with CAP_SYS_ADMIN in the initial user namespace,
recorded at mount time via file_ns_capable(). This is the same privilege
that mounting virtiofs or fuseblk requires, applied to the process that
actually services (and could stall) the connection. Checking the device
opener's capability -- rather than the mount's user namespace -- avoids
treating an unprivileged server that merely happens to run in the initial
user namespace (e.g. a normal sshfs mount) as trusted.
The flag is only advertised to servers that pass this check, so an
unprivileged server is never invited to opt in (and is ignored by
fuse_syncfs_enable() if it sets the flag anyway).
Signed-off-by: Jimmy Zuber <jamz@amazon.com>
Assisted-by: Claude:claude-opus-4-8 [Claude-Code]
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
|
|
IMA shouldn't measure or appraise configfs, but currently does because
it's missing from the default exclusion policies. Move CONFIGFS_MAGIC to
magic.h to expose the file system's magic to IMA, as well as other userland
applications.
Suggested-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Frederick Lawler <fred@cloudflare.com>
Acked-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
|
|
Pull more drm updates from Dave Airlie:
"As mentioned last week, an msm pull request fell down the side of the
couch or whatever the email equivalent of that is. This has the msm
next stuff + the usual fixes for amd/intel.
core:
- use drm_warn instead of warn
msm:
- Bindings:
- Added Shikra support
- Document a840, a704, a722
- Core:
- Use drm_client buffers for fbdev emulation
- teardown fixes
- ARM32 DMA fixup
- Remove objects from evict list when re-validated
- Bunch of corner case and error path fixes
- DPU:
- Dropped dev_pm_opp_set_rate(0) preventing burnout
- Fixed SSPP offsets of Kaanapali
- DP:
- Dropped dev_pm_opp_set_rate(0) preventing burnout
- Cleaned up core code in preparation for MST support
- Fixed prepare() to let Pipewire continue in case of the unplugged cable
- GPU:
- Add support for a704
- Add support for a722
- HDMI:
- Simplifed register access
amdgpu:
- eGPU fixes
- Runtime PM fix
- UserQ fixes
- Backlight fix
- Discovery sysfs fix
- Reset handling fixes
- Buffer func handling fix for xgmi
- VCN boundary check fix
- DC lut handling fixes
- MES fixes
- UVD fix
- VCE 3 fix
- Enforce isolation fix
- HPD fix for VGA/LVDS
- DML fix
- DCN 6 fixes
- DC gpu reset fix
amdkfd:
- Fix return value
- CU occupancy for GFX 11
- CU occupancy for GFX 12/12.1
- Queue bounds checking fix
- SVM fixes
- CRIU bounds checking fix
radeon:
- iMac display fix
xe:
- error message cleanups
- i2c global register definitions as dependency for xe/i2c fixes
- Media workardound
- Add CCS to gt_idle debugfs print
- Page fault related fix
- i2c related fixes
- System Controller mailbox bit fix"
* tag 'drm-next-2026-08-29' of https://gitlab.freedesktop.org/drm/kernel: (121 commits)
drm/xe/sysctrl: Read mailbox phase bit from hardware
drm/xe/i2c: Keep the i2c controller always enabled
drm/xe/i2c: Fix the interrupt handling
i2c: designware: Global register definitions
drm/xe: Reject page faults from non-fault-mode scratch VMs
drm/xe/xe_gt_idle: Add CCS to the powergating info print
drm/xe: Do not apply WA 14025883347 to media 3503
drm/amd/display: fix dc_lock leak on GPU reset error paths
drm/amd/display: Fix redundant GPUVMEnable checks in dcn6 flip schedule
drm/amd/display: Fix wrong bytes-per-pixel value for dml2_422_packed_10
drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore
drm/amdgpu/userq: fix lock missing for userq fence error set
drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram
drm/amdkfd: Fix error path at svm_migrate_copy_to_ram
drm/amd/display: Log details when failing to register HPD IRQ
drm/amd/display: Fix HPD consideration for VGA/LVDS connectors on DCE
drm/amdgpu: clamp the isolation index for rings outside a partition
drm/amdkfd: Reject zero-sized AQL queue allocations after size halving
drm/amdgpu: Fix VCE 3 ring align_mask
drm/kfd: Add CU occupancy support to GFX12.1
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs
Pull UBI and UBIFS updates from Richard Weinberger:
"UBI:
- Support for a per-device wear-leveling threshold
- Various fixes and cleanups of error paths
- Correctly preserve torture flag up wear-leveling
UBIFS:
- Various fixes and cleanups of error paths and kernel-doc"
* tag 'ubifs-for-linus-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs:
UBI: support per-device wear-leveling threshold
UBI: fix two issues in the ubi.mtd MODULE_PARM_DESC
mtd: ubi: Release device reference on busy detach
ubi: Fix rollback for explicit UBI device numbers
ubifs: fix out-of-bounds read in signature length check
UBI: fastmap: Pass to_be_tortured when reusing old fastmap PEBs
UBI: Preserve torture flag when rescheduling failed erasures
ubifs: ubifs.h: clean up kernel-doc comments
ubifs: key.h: use correct function parameter name
ubifs: debug.h: fix kernel-doc struct prototypes
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs
Pull f2fs updates from Jaegeuk Kim:
"In this round, key enhancements focus on reducing inode management
memory overhead, introducing resizable tail sections with unified
pinned allocation, and boosting I/O throughput via parallel
multi-device flushes and asynchronous f2fs_write_end_io() execution.
We also add dynamic device alias reservations to allow on-the-fly
space donation from user partitions.
Alongside these features, critical bug fixes resolve folio race
conditions, lingering dirty flags, dentry and block counter leaks, and
potential deadloops in f2fs_fsync_node_pages(). Additional stability
patches address error-path handling across symlink, sync, and
rename/unlink operations, prevent pinned file fragmentation, and
correct segment migration and free section accounting in
free_segment_range.
Enhancements:
- reduce memory footprint of ino management
- support dynamic reserve/release for device aliasing
- issue multi-device flushes in parallel
- add a way to run f2fs_write_end_io() asynchronously
- support resizable tail section and unify pinned allocation
Bug fixes:
- fix to pass folio->index to f2fs_sanity_check_node_footer()
- fix folio_nr_pages() race after put in large folio invalidate
- fix to clear dirty flag on folio in error path
- accurately adjust free_sections during free_segment_range
- fix to avoid potential deadloop in f2fs_fsync_node_pages()
- fix the error path in symlink, device alias in rename/unlink,
f2fs_sync_fs
- fix to migrate all curseg types during free_segment_range
- fix to avoid pinfile fragment on fragment:{block, segment} mode
- fix valid block count leak on data block allocation failure
- fix dentry folio leak in find_in_level
- reject overlapping move range after len expansion
- fix some bugs related to file pinning, GC functions, i_size
And, the series includes a number of minor bug fixes"
* tag 'f2fs-for-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (51 commits)
f2fs: support resizable tail section and unify pinned allocation
f2fs: don't leave the hashed inode while it's unlinked
f2fs: accurately adjust free_sections during free_segment_range
f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages()
f2fs: use adjusted write range after f2fs_write_checks()
f2fs: fix to propagate error from f2fs_sync_fs()
f2fs: return symlink writeback errors
f2fs: fix error handling on device alias check in rename and unlink
f2fs: fix to reset all pinned status during fggc
f2fs: use f2fs_{down, up}_(read, write}_trace() for nat_tree_lock
f2fs: reduce memory footprint of ino management
f2fs: fix i_size when pinned fallocate partially fails
f2fs: fix to migrate all curseg types during free_segment_range
f2fs: avoid setting SBI_NEED_FSCK on transient resize failure
f2fs: fix to avoid pinfile fragment on fragment:{block, segment} mode
f2fs: cleanup w/ f2fs_need_rand_{blk, seg, seg_blk}
f2fs: fix to shrink gc_lock coverage in f2fs_gc_range()
f2fs: fix to reclaim space in f2fs_allocate_pinning_section()
f2fs: unify add/remove ino entry API for all ino types
f2fs: fix to zero post-EOF data when extending file size
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from Jakub Kicinski:
"Including fixes from Bluetooth, IPSec and Netfilter.
Current release - fix to a fix:
- netfilter: ipset: remove need to allocate memory on delete operations
Current release - regressions:
- macb: drop CONFIG_OF #if block, fix build
Previous releases - always broken:
- stream of fixes for SCTP continues
- inet: frags: strip GSO state from fragments before reassembly
- virtio-net: ensure that TCP packets don't overflow gso_segs
- tcp-ao: fix use-after-free of current_key on reconnect to another
peer
- page_pool: remove zone/policy GFP flags when allocating XArray
entries
- Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN
- tls: device: fix out-of-bounds write in tls_append_frag()
- eth: bnxt:
- ring the doorbell when SW USO exits early, avoid packets stuck
in Tx
- gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check, avoid
users of older NICs seeing non-actionable warning messages
- eth: qede: fix NULL pointer dereference in TPA fragment processing"
* tag 'net-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (216 commits)
inet: frags: strip GSO state from fragments before reassembly
net/sched: sch_htb: limit htb_classify inner-class filter hops
selftests/net: packetdrill: add tcp_urg_ptr_retransmit
tcp: fix corruption of urgent data on multi-segment retransmit
usb: atm: usbatm: fix invalid ci_range initialization
net: fec: only stop PTP if it was initialized
slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()
net: bridge: mcast: fix use-after-free of a master VLAN's multicast context
net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup
net: dsa: mxl862xx: enable assisted learning on CPU port
net: stmmac: restore NET_IP_ALIGN in the RX DMA offset
net: stmmac: drop gso_enabled_types and rely on netdev features
net: stmmac: selftests: Don't test flow control for small rx fifos
net: stmmac: selftests: Account for the UC filter list for filtering tests
net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering
net: stmmac: dwmac4: Account for the primary MAC address for UC filtering
net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering
net: stmmac: selftests: Check multiple MMC counters
selftests: net: Fix slow configurations in big_tcp_tunnels.sh
selftests: net: Lower threshold with csum offload off in big_tcp_tunnels.sh
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Pull more MM updates from Andrew Morton:
- "mm/rmap: index MAP_PRIVATE file-backed folios by anonymous pgoff"
(Lorenzo Stoakes)
Index MAP_PRIVATE file-backed folios by their anonymous page offset
to resolve confusion around reverse mapping for zeroed and CoW'd
file-backed memory.
Use this new VMA anonymous page offset tracking to eliminate index
conflicts and lay the foundation for scalable CoW performance
improvements.
- "promote mapped executable folios after first usage for MGLRU"
(Baolin Wang)
Make MGLRU's protection of mapped executable file folios more
reliable. Follow the classical LRU's logic, promoting mapped
executable file folios after their first usage to give executable
code a better chance to stay in memory and improve workload
performance.
- "mm: vmscan: fix node reclaim ignoring swappiness parameter" (Ridong
Chen)
Fix per-node proactive reclaim interface's ignoring the swappiness
parameter when CONFIG_MEMCG is disabled by consolidating
sc_swappiness() into a single function that checks
proactive_swappiness regardless of kernel configuration.
- "mm/vmscan: reduce lru_lock contention via vmstat-derived
scan-balance cost" (Usama Arif)
Reduce lru_lock contention in the reclaim path by deriving
scan-balance costs from vmstat counters rather than lock-acquired
producer updates.
Read and decay these cost signals on the reclaim side under a
dedicated per-lruvec lock, reducing total LRU lock wait time by over
60% without impacting scan throughput.
- "zram: fix zram issues reported by sashiko" (Sergey Senozhatsky)
Fix two low-risk zram bugs which Sashiko spotted in drive-by review.
- "Honor XA_FLAGS_ACCOUNT in xas_split_alloc() and charge to folio's
memcg" (Zi Yan)
Fix xas_split_alloc() by enabling target folio memcg charging during
splits and adding the missing __GFP_ACCOUNT flag for proper XArray
node memory accounting.
- "selftests/mm: use pattern matching in .gitignore" (Pratyush Mallick)
Replace hardcoded binary names in selftests/mm/.gitignore with a
generic pattern-matching rule to automatically ignore generated test
files and avoid manual updates when adding new tests.
- "mm/page_ext: remove pgdat_page_ext_init()" (Sang-Heon Jeon)
Make the incompatibility between FLATMEM and NUMA explicit in
mm/Kconfig and remove the unused pgdat_page_ext_init() function.
- "zram: fix zstd error paths and add parameter validation" (Haoqin
Huang)
Clean up zram compression backends by removing redundant error
cleanup, adding parameter and dictionary validation, auto-prefixing
algorithm error logs, and resetting parameters prior to
reinitialization.
- "zram: fix stale scan bounds after reinitialization" (Longlong Xia)
Prevent out-of-bounds slot accesses during concurrent zram resets by
moving table scan bound calculations under dev_lock in
writeback_store() and read_block_state().
- "add anon mTHP collapse test cases" (Baolin Wang)
Extend selftests helper functions to support arbitrary page orders
and add new test cases and options for mTHP collapse in khugepaged.
- "selftests/mm: Handle unsupported and transient test conditions"
(Muhammad Usama Anjum)
Update MM selftests to report a SKIP status instead of a failure when
required kernel or filesystem features are unsupported, while adding
retry logic for transient page migration errors.
- "mm/zswap: Fixes and improves the zswap shrink" (Hao Jia)
Fix the missing zswap global shrinker when CONFIG_MEMCG is disabled
and extend shrink_memcg() to support batch writeback for improved
writeback efficiency.
- "alloc_tag: introduce IOCTL-based filtering for MAP" (Suren
Baghdasaryan)
Introduce an IOCTL-based binary interface for memory allocation
profiling that enables kernel-side filtering before per-CPU counter
aggregation.
This eliminates the text-parsing overhead of /proc/allocinfo and
provides up to a 20x speedup by transferring only filtered allocation
data to userspace.
- "better block swap batching and a different take on swap_ops v5"
(Christoph Hellwig)
Refactor block swap I/O to use swap_iocb for batching instead of
single-bio requests and rebase the swap_ops interface, achieving
faster swap throughput during kernel builds.
- "mm: kmemleak: reduce transient false positives by confirming leaks"
(Catalin Marinas)
Reduce false-positive kmemleak reports by combining two kmemleak
enhancements that add a second confirmation scan and a configurable
minimum unreferenced scan count module parameter.
- "mm: kmemleak: default min_unref_scans to 2 for verbose kernels"
(Breno Leitao)
Auto-scanning kernels can generate false-positive memory leak reports
on single scans, so this patch defaults min_unref_scans to 2 when
CONFIG_DEBUG_KMEMLEAK_VERBOSE is enabled to require a second
confirming scan.
- "swap_ops updates" (Christoph Hellwig)
Batching I/O for synchronous swap devices causes performance
regressions and filesystem-based swap suffers from double-indirection
overhead. This series resolves both issues by reintroducing per-folio
writes for synchronous swap and allowing filesystems to directly
export their own swap_ops.
- "mm/khugepaged: several cleanups" (Nico Pache)
khugepaged accumulated redundant state-checking patterns and outdated
comments following mTHP integration. Introduce dedicated helpers for
PTE validation and event counting while refreshing the internal
documentation.
- "maple_tree: lock checking and clean ups" (Liam Howlett)
Syzbot reports incorrectly blame memory management exit paths for
locking bugs, maple tree erase operations risk allocation failures
without gfp flags and internal documentation lacks clarity.
Improve lock error detection, update docs, fix race and allocation
edge cases and optimize erase allocations using a fallback to
GFP_KERNEL | GFP_NOFAIL.
* tag 'mm-stable-2026-08-26-15-22' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (172 commits)
selftests/proc: make proc-maps-race work with READ_IMPLIES_EXEC
memcg: move LRU size accounting on reparenting instead of copying it
mm/vmscan: fix comment logic in balance_pgdat
maple_tree: add helper mas_make_walkable()
maple_tree: avoid extra gap calculation
maple_tree: fix argument name in header
maple_tree: change two GFP flags in tests
maple_tree: document erase and allocations better
maple_tree: avoid mas_erase() and mtree_erase() failures
maple_tree: document that erase may use GFP_KERNEL for allocations
maple_tree: catch race in mas_alloc_cyclic()
maple_tree: add bulk parent set helper
maple_tree: micro optimisation of mas_wr_store_type()
maple_tree: optimise mas_wr_node_store() when not in rcu mode
maple_tree: use prefetched value in mas_wr_store_type()
maple_tree: clarify comments on mas_nomem()
maple_tree: drop MAPLE_ALLOC_SLOTS
maple_tree: drop dead code from mas_extend_spanning_null()
maple_tree: documentation fix
maple_tree: add write lock checking with lockdep sequence numbers
...
|
|
Pull kvm updates from Paolo Bonzini:
"ARM64:
- Add support for 'slot' based PMU events, paired with new UAPI that
compels the user to select a specific PMU implementation
- Lazy save/restore of vCPU state for pKVM, along with various fixes
and cleanups to the management of vCPU state between the untrusted
host and pKVM hypervisor
- Disable traps of EL1 registers for nested hypervisors when
FEAT_NV2p1 is present, guaranteeing that EL2-specific register bits
are stateful in the EL1 counterpart
- Leverage FEAT_NV3 to avoid unnecessary ERET/TLBI traps when the
scope of those instructions remains 'in host' (i.e. L1
kernel/userspace)
- Pile of fixes for the management of the VNCR pseudo-TLB, such as
under-invalidations and races with concurrent TLBIs on other vCPUs
- Consolidate the non-protected and pKVM view of ICH_VTR_EL2 to a
runtime-patched constant, allowing the same data to be shared with
pKVM prior to dropping host privileges
- Considerable pile of LLM-assisted fixes around the shop but mostly
in the VGIC, our in-kernel generator of bugs (and sometimes
interrupts)
LoongArch:
- Advertise already-supported capabilities
- Some bug fixes about timer and MMIO
- Some hardening about interrupt injection
- Replace kvm_err() with kvm_pr_unimpl()
- Add FPU/LSX/LASX test cases for selftests
RISC-V:
- Svadu/Zicfiss/Zicfilp FWFT support for Guest
- Use try_cmpxchg for IMSIC MRIF RMW
- More arch-specific tracepoints in KVM RISC-V
- Eager page splitting when enabling dirty logging
- Optimize hfence request handling for SMP Guests
- Improve dirty log clearing by skipping zero bits in mask
- Guard HFENCE range loops against overflow
- CPU PM notifiers in KVM RISC-V for non-retentive idle states
- Fix kernel-mode vector context save/restore for Guest
s390:
- Fixes for vfio-ap
- Fixes for the gmap rework
- Fixes for vsie
- AI triggered fixes all over
- diag9c tracing
- code move preparation for the additional arm64 support
- enable CONTEXT_ANALYSIS
x86:
- Perform spring cleaning on x86.{c,h} and asm/kvm_host.h, by adding
regs.c (the kvm_cache_regs.h => regs.h is already applied) and
msrs.{c,h}, and moving relevant code out of x86.c
- Split kvm_mmu in three parts, respectively to describe the format
of page tables, walking the guest page tables and building the page
tables. Always use the same page table walker kvm->arch.gva_walk as
the entry point to convert a guest's virtual address, where the
previous code used two different kvm_mmu structs depending on
whether the walk included nested EPT/NPT or not. Make page fault
vmexits reuse the permission checking machinery that is used for
guest page faults. This is both a cleanup and a baby step towards
supporting XS/XU memory permissions
- Document some of the "fun" gotchas with the APIC base when creating
IRQCHIPs on x86
- Remove a defunct masterclock update from kvm_xen_shared_info_init().
It could result in incorrect kvmclock due to triggering an
unnecessary switch to/from masterclock mode
- Skip Xen runstate time updates if time has effectively gone
backwards, so that the guest doesn't report 100% steal time for
a very, very long time
- Drop KVM's runtime updates of the Xen PV timing CPUID leaf, as KVM
was updating the wrong sub-leaf, and upstream KVM will soon provide
all the information needed by userspace to populate the CPUID field
itself
- Fix a bug where KVM would walk a newly created rmap without holding
the rmap lock (or mmu_lock) during aging
- Fix a bug where aging TDP MMU SPTEs could clobber FROZEN SPTEs
- Fix a variety of #DB priority bugs
- Fix a class of races related to enabling Hyper-V emulation on a
vCPU after the vCPU is visible to the rest of KVM
- Use static calls for nested virtualization ops
- Move more KVM-internal code out of x86's kvm_host.h
- Enumerate support for a variety of Zhaoxin instructions that don't
require explicit virtualization
- Fix missing EFER validation bugs, including in the KVM_SET_SREGS*
path
- Harden kvm_vcpu_map() against double-mapping and thus leaking
references
- Misc fixes and cleanups, e.g. for largely benign syzkaller splats
x86 (Intel):
- Zero a vCPU's entry in VMX's Posted Interrupt Descriptor table used
for IPI virtualization when the vCPU is freed, to fix a
use-after-free where hardware will write to a freed vCPU's PID
- Service local TLB flushes on a failed nested VM-Enter to fix a bug
where KVM could miss a TLB on a future, successful VM-Enter with
the same L2 VPID
- Cap the maximum value shoved into the VMX Preemption Timer to
workaround an erratum that affects all existing Intel CPUs that
support CPUID 0x15
- Fix VPID virtualization bugs where KVM would fail to flush hardware
TLBs
- Harden the TDX "populate" ioctls against bad input, and to prepare
for supporting in-place private<=>shared conversion
x86 (AMD):
- Forcefully invalidate SNP VMSA pages if their backing guest_memfd
page is zapped/invalidated, e.g. due to a PUNCH_HOLE in response to
a Page-State Change request
- Remove a dying VM from the GA Log notifier list before the VM is
actually destroyed, to fix a potential use-after-free
- While FOLL_WRITE was needed in the past to trigger CoW unsharing,
nowadays FOLL_LONGTERM does that already even without FOLL_WRITE,
and in fact, get_user_pages() actually disallows FOLL_WRITE
together with FOLL_LONGTERM. So don't pass FOLL_WRITE when
registering encrypted memory regions, i.e. when pinning SEV/SEV-ES
guest memory, to fix a regression with file-backed memory
introduced by KVM's (correct) usage of long-term pins
(This was reviewed by mm maintainers; for more information, see
commit ee1a586dd1fa "KVM: SEV: Drop FOLL_WRITE for encrypted region
registration")
- Allocate full pages for SEV/SEV-ES {DE,EN}CRYPT ops on SNP-enabled
hosts to fix a data corruption issue due to the PSP driver
assigning to-be-written pages to firmware (as required by the SNP
specs)
- Unconditionally intercept ICBEP so that KVM generates the correct
guest RIP when handling an ICEBP-induced TASK_SWITCH #VMEXIT
- Harden the SNP "populate" ioctls against bad input, and to prepare
for supporting in-place private<=>shared conversion
Generic:
- Remove kvm_debugfs_dir if kvm_init() fails after creating KVM's
debugfs
- Add a per-VM bitmap to track which vCPU IDs have been "claimed" but
for which the vCPU isn't yet online, and use the bitmap to reject
duplicate IDs before calling into arch code. This allows arch code
to consume vcpu_id without having to worry about cross-vCPU
clobbering (at least s390 and x86 have had related bugs)
- Rework the so called "prepare" and "invalidate" guest_memfd hooks
to prepare for in-place private<=>shared conversion, and clean up a
few warts along the way
Selftests:
- Automatically allocate a full page for L2 guest stacks on x86
instead of requiring test-specific L1 guest code to carve out a
portion of the L1 stack for L2 usage, and to ensure the L2 stack
also adheres to the x86-64 calling convention ABI
- Add a selftest to verify {Guest,Host}-Only behavior in x86's
mediated PMU
- Clean up nested SVM's handling of GPRs on L2<=>L1 transitions,
reuse the functionality for nested VMX, and drop the ucall hack
that was fudging around the lack of GPR switching on nVMX
- Add a stress test to verify KVM doesn't clobber/drop #PF state,
e.g. CR2, across save/restore, including when L2 is active
- Add a test to verify KVM_CREATE_VM accepts exactly what is reported
by KVM_CAP_VM_TYPES
- Misc selftests fixes and cleanups
- Fix several issues with seeding the pRNG, and rework the pRNG APIs
to that the pRNG can be sanely used in host code, not just guest
code
- Add an IRQ test to validate virtual IRQ deliverty for IRQs wired up
via KVM_IRQFD + KVM_SET_GSI_ROUTING, with optional support for
triggering IRQs via writes to an assigned VFIO device
- Add syscall wrappers to assert success on a variety of pthreads and
CPU affinity APIs
- Set vCPU pthread affinity as early as possible to reduce contention
issues that were surfaced by PREEMPT_LAZY, which result in runtimes
of over a minute on large hosts, versus the expected ~5 seconds
- Rework the PMU counters test to run each testcase using a single VM
with many vCPUs for each sub-testcase, instead of using a unique VM
for each sub-testcase. This cuts the runtime by ~20x
Miscellaneous:
- MAINTAINERS updates for vfio-ap, guest_memfd, kvm-x86. Mostly
representing the status quo more accurately, but also... welcome
David Hildenbrand as guest_memfd reviewer!"
* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (413 commits)
KVM: arm64: Validate GICv5 timer PPIs before claiming ownership
KVM: arm64: vgic: Reject out-of-range GICv5 PPI IDs
KVM: arm64: vgic: Prevent speculative SPI array underflow
KVM: arm64: vgic: Free gic_kvm_info on initialization failure
KVM: arm64: Avoid mismatched accesses to 'struct kvm_nvhe_init_params'
s390/vfio-ap: Fix NULL deref in status_show() during queue probe
s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed
s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap
s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove
s390/vfio-ap: Fix required lock not held during update of ap_matrix_mdev object
s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects
s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL
s390/vfio-ap: Fix stale do_remove flag across iterations in vfio_ap_mdev_cfg_remove
RISC-V: KVM: fix vcpu vector context handling for kernel-mode vector
riscv: vector: allow non-preemptible kernel-mode vector with IRQs off
riscv: vector: refactor riscv_v_start_kernel_context
KVM: s390: gmap: Make prefix handling optional
KVM: s390: gmap: Make CMMA optional
KVM: s390: gmap: Make storage keys optional
KVM: s390: Prepare gmap for a second KVM implementation
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty
Pull TTY / serial driver updates from Greg KH:
"Here is the "big" set of tty and serial driver updates for 7.3-rc1.
Not really all that much happened this development cycle for this
subsystem, changes in here are:
- removal of the ipwireless driver as it's no longer used or needed
- new 8250_mxpcie driver added
- qcom serial driver updates and additions
- vt mode validation addition
- lots of other small serial driver updates and additions
All of these have been in linux-next for weeks with no reported issues"
* tag 'tty-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (97 commits)
serial: imx: serialize imx_uart_ports[] lifetime
tty: clear cdev pointer after cdev_add() failure
tty: skip cdev_del() when no cdev is registered
serial: core: clear freed pointers on uart_register_driver() failure
serial: core: do fallible allocations before the console can be registered
serial: 8250_mxpcie: implement rx_trig_bytes callbacks via MUEx50 RTL
serial: 8250_mxpcie: introduce per-port private data structure
serial: 8250: allow UART drivers to override rx_trig_bytes handling
serial: 8250_mxpcie: add break support for RS485 using MUEx50 features
serial: 8250: allow low-level drivers to override break control
serial: 8250_mxpcie: support serial interface mode switching
serial: 8250_mxpcie: speed up TX using memory-mapped FIFO window
serial: 8250_mxpcie: speed up RX using memory-mapped FIFO window
serial: 8250_mxpcie: add custom handle_irq callback
serial: 8250_mxpcie: offload XON/XOFF flow control to MUEx50 hardware
serial: 8250_mxpcie: enable automatic RTS/CTS flow control
serial: 8250_mxpcie: enable enhanced mode and program FIFO trigger levels
serial: 8250: add Moxa MUEx50 UART port type
serial: 8250: split Moxa PCIe serial board support out of 8250_pci
serial: qcom-geni: Use geni_se_set_perf_level() for baud rate perf level
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
Pull USB / Thunderbolt updates from Greg KH:
"Here is the big set of USB and Thunderbolt driver updates for 7.3-rc1.
Lots of driver work for new devices and systems, and many other minor
fixes and updates. Included in here are:
- Thunderbolt subsystem driver updates and additions
- typec driver updates and additions
- usb gadget fixes all over the place, seems like people are finally
paying attention to these drivers for some reason
- xhci driver updates and fixes based on lots of reports
- usb-serial driver updates and additions
- new device ids
- other minor USB driver updates and fixes
All of these have been in linux-next for a while with no reported issues"
* tag 'usb-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (163 commits)
usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()
usb: typec: hd3ss3220: fix VBUS regulator error message
usb: usbfs: fix use-after-free of usb_device in usbdev_release()
usb: gadget: u_audio: Fix use-after-free on sound card disconnect
usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition
usb: gadget: f_tcm: keep port count until LUN teardown completes
usb: usbtest: disable dynamic ID support
usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive()
USB: c67x00: fix use-after-free in c67x00_add_iso_urb()
usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion
usb: gadget: snps_udc_plat: clean up PHY on probe deferral
usb: gadget: f_tcm: fix deadlock in usbg_make_tpg()
usb: dwc2: gadget: Exit partial power down state when changing USB pull-up
usb: gadget: f_fs: Fix Use-After-Free in AIO error path
usb: gadget: f_fs: Prevent deadlock during ep0 read loop
usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed
usb: gadget: midi2: remove default configfs groups on teardown
usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init()
usb: typec: thunderbolt: Disable work before freeing tbt on remove
usb: xhci: Handle bogus TRB pointers in Missed Service Error events
...
|
