summaryrefslogtreecommitdiff
path: root/include/linux
AgeCommit message (Collapse)Author
2026-10-12keys: add KEY_SPEC_FS_VERITY_KEYRINGAndrew Halaney
Same problem as the dm-verity keyring: .fs-verity is allocated unlinked, so the only way for userspace to name it is to scrape /proc/keys. Suggested-by: Christian Brauner (Amutable) <brauner@kernel.org> Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org> Reviewed-by: Christian Brauner (Amutable) <brauner@kernel.org> Signed-off-by: Andrew Halaney <andrew@amutable.com> Link: https://patch.msgid.link/20261008-ajhalaney-dmverity-key-identifier-v2-2-008456d189cb@amutable.com Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-10-12keys: add KEY_SPEC_DM_VERITY_KEYRINGAndrew Halaney
The .dm-verity keyring is not linked into any process keyring, so request_key() and KEYCTL_SEARCH cannot find it. Userspace has to scrape /proc/keys for the serial to use. That's not great, one could put in a bogus description containing a newline to confuse userspace further. For example, thanks to AI models, which I run as root but you could show off as any old user: # DESC=$'.dm-verity: 1\n0badf00d I--Q--- 1 perm 082f0000 0 0 keyring .dm-verity' # k=$(echo -n "1234567" | keyctl padd user "$DESC" @s) # keyctl setperm "$k" 0x3f010001 # cat /proc/keys | grep dm-verity 10402023 I------ 2 perm 082f0000 0 0 keyring .dm-verity: empty 12e0bee6 I--Q--- 1 perm 3f010001 0 0 user .dm-verity: 1 0badf00d I--Q--- 1 perm 082f0000 0 0 keyring .dm-verity: 7 0x0badf00d is not a keyring, it is the text inside our user's key description. Telling the two apart needs a KEYCTL_DESCRIBE per row which is annoying to do. i.e.: # keyctl rdescribe 0x10402023 keyring;0;0;082f0000;.dm-verity # keyctl rdescribe 0x0badf00d keyctl_describe: Required key not available Let's just give it a well known identifier, i.e.: # keyctl rdescribe -10 keyring;0;0;082f0000;.dm-verity This is exactly what commit 264d8fd2794f ("bpf, keys: Add a bpf keyring for program signature validation") did, and was the inspiration for this commit minus the spinlock bits required due to dm-verity being a module. Suggested-by: Christian Brauner (Amutable) <brauner@kernel.org> Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org> Reviewed-by: Christian Brauner (Amutable) <brauner@kernel.org> Signed-off-by: Andrew Halaney <andrew@amutable.com> Link: https://patch.msgid.link/20261008-ajhalaney-dmverity-key-identifier-v2-1-008456d189cb@amutable.com Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-10-12SUNRPC: pass a keyring serial number to the TLS handshakeChuck Lever
The handshake upcall links the keyring named in ta_keyring into tlshd's process keyring before tlshd reads the client certificate and private key. That link is how tlshd gains possession of keys that grant no user read permission. xprtsock never fills the field, so an x509 handshake can present only keys that tlshd's own credentials can read. Add a keyring serial number to struct xprtsec_parms and pass it to the x509 handshake, so an RPC client can name the keyring that holds its credentials. Signed-off-by: Chuck Lever <cel@kernel.org> Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
2026-10-12PCI/AER: Keep ANFE masked on Apple T2 Secure EnclaveJason Perlow
Commit eddba19b8b5f ("PCI/AER: Support Advisory Non-Fatal Errors") unmasks Advisory Non-Fatal Errors on devices which support Role-Based Error Reporting. On a MacBookPro16,1, enabling ANFE on the Apple T2 Secure Enclave Processor [106b:1802] causes spontaneous power loss. Leave the Secure Enclave's ANFE mask unchanged. Set a per-device flag with an EARLY fixup, before pci_aer_init() can unmask ANFE; a FINAL fixup would run too late. Keep the advertised RBER capability and all other AER initialization and reporting unchanged. Other Apple T2 functions and non-Apple devices retain the existing ANFE behavior. Setting the flag repeatedly and skipping the ANFE unmask operation are idempotent. The underlying device or firmware failure is not understood. [bhelgaas: Aditya posted essentially the same patch soon after: https://lore.kernel.org/all/20261010172301.12764-1-aditya.garg@linux.dev] Fixes: eddba19b8b5f ("PCI/AER: Support Advisory Non-Fatal Errors") Reported-by: Jason Perlow <jperlow@gmail.com> Closes: https://lore.kernel.org/linux-pci/CABZrw2HcaOh3DHTJtxU5dXrb3Vg19scr6+qR-xe_+R7rME35_Q@mail.gmail.com/ Assisted-by: LLM Signed-off-by: Jason Perlow <jperlow@gmail.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://patch.msgid.link/CABZrw2H+3yt2Y7xiq6OyAWaJM7P9ox-2nJxoQuJMwoJHLgi+YQ@mail.gmail.com/
2026-10-12mtd: rawnand: qcom: move common code to the 'qpic_common' moduleGabor Juhos
The 'qpic_common' module provides some generic functions which are usable by both the 'qcom_nandc' and by the 'spi-qpic-snand' driver. Move more code from the 'qcom_nandc' driver to there in order to allow using those also from the 'spi-qpic-snand' driver. No functional changes. Signed-off-by: Gabor Juhos <j4g8y7@gmail.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-10-12KVM: Make device name configurableSteffen Eiden
Allow KVM implementations to choose alternative device names. This is especially useful for architectures providing multiple KVM implementations simultaneously. Architectures providing multiple KVM implementations must compile the KVM common code once per implementation and mangle symbols. Suggested-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Steffen Eiden <seiden@linux.ibm.com> Link: https://patch.msgid.link/20260930173441.66762-2-seiden@linux.ibm.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-10-12fs: rename vfs_get_super() to get_tree_super() and export itGiuseppe Scrivano
Rename and export it so filesystems that need a custom superblock matching policy can reuse it directly instead of open-coding sget_fc() + fill_super(). No functional change. This is a preparatory fix for the next patch. Signed-off-by: Giuseppe Scrivano <giuseppe@scrivano.org> Link: https://patch.msgid.link/20261002163225.1258203-2-giuseppe@scrivano.org Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Jan Kara <jack@suse.cz> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-10-12pid: use READ_ONCE() in pid_alive()Babanpreet Singh
KCSAN reports pid_alive() reading task->thread_pid while it gets cleared under tasklist_lock. The check only cares about NULL, so READ_ONCE() and WRITE_ONCE() are enough. Reported-by: syzbot+c382ee653fd70f5cf1bb@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=c382ee653fd70f5cf1bb Signed-off-by: Babanpreet Singh <bbnpreetsingh@gmail.com> Link: https://patch.msgid.link/20261002012141.7-1-bbnpreetsingh@gmail.com Acked-by: Oleg Nesterov <oleg@redhat.com> Reviewed-by: Bradley Morgan <brads@mainlining.org> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-10-12pidfs: record the coredump on the dumping thread's pid tooChristian Brauner
If a thread-group coredumps only the thread-group leader pidfd will return coredump information. A pidfd for the thread that took the fatal signal cannot be used to retrieve it. Record both the thread-group leader and the specific thread that took the signal and register both in pidfs. Mark both the thread-group leader and the specific thread with the coredump information so retrieval works for both pidfds. Now that both SO_PEERPIDFD and SO_PEERPIDFD_THREAD are available it's easy to get the coredump information for the specific thread. Reviewed-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@futurfusion.io> Signed-off-by: Andrew Halaney <andrew@amutable.com> Link: https://patch.msgid.link/20261005-work-unix-passpidfd-v4-9-350183b6e02a@amutable.com Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-10-12net: add SO_PASSPIDFD_THREAD to get a thread-specific SCM_PIDFDChristian Brauner
Currently, SCM_PIDFD carries a pidfd for the thread-group leader. A broker or the coredump server cannot learn the identity of the specific thread that sent a given message. Now that both struct pids are recorded a receiver can ask for the specific identity it needs. So add SO_PASSPIDFD_THREAD as a sibling of SO_PASSPIDFD. SO_PASSPIDFD_THREAD delivers an SCM_PIDFD_THREAD, i.e. scoped to the specific thread sending. This is completely independent of SO_PASSPIDFD, meaning you can use both options and get both cmsgs. On SOCK_STREAM sockets recvmsg() only stops merging data at a thread boundary when the receiver asked for a thread pidfd. For SO_PASSCRED and SO_PASSPIDFD receivers all threads of one process remain a single writer. Co-developed-by: Andrew Halaney <andrew@amutable.com> Signed-off-by: Andrew Halaney <andrew@amutable.com> Link: https://patch.msgid.link/20261005-work-unix-passpidfd-v4-3-350183b6e02a@amutable.com Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-10-12pid: add helpers to operate on a struct pid arrayChristian Brauner
We're about to extend af_unix sockets and coredump code with the ability to hand out thread-specific pidfds. Add a few simple helpers that allow to operate on multiple struct pids up to PIDTYPE_MAX with automatic bounds checking. Reviewed-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@futurfusion.io> Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com> Signed-off-by: Andrew Halaney <andrew@amutable.com> Link: https://patch.msgid.link/20261005-work-unix-passpidfd-v4-1-350183b6e02a@amutable.com Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-10-12bpf: Reject BTF ids with the same address in tracing_multi linkAlexei Starovoitov
check_dup_ids() rejects equal BTF ids, but different ids can resolve to the same address. Aliases: ffffffff8161b6b0 t __do_sys_munlockall ffffffff8161b6b0 T __ia32_sys_munlockall ffffffff8161b6b0 T __x64_sys_munlockall or several BTF_KIND_FUNC with the same name that vmlinux BTF has when CONFIG_DEBUG_INFO_BTF_INLINE is set. Each id gets its own trampoline and register_fentry_multi() adds them to data->reg with the same ip. update_ftrace_direct_add() checks that new entries are not in direct_functions, but doesn't compare them with each other, so the attach succeeds. At detach update_ftrace_direct_del() sees that 'direct' of one of the entries doesn't match and returns -EINVAL: WARNING: kernel/bpf/trampoline.c:1845 at bpf_trampoline_multi_detach+0x24c/0x280 Call Trace: bpf_link_free+0x51/0x110 bpf_link_release+0x18/0x20 __fput+0x103/0x2d0 __x64_sys_close+0x3d/0x80 The images are freed anyway, while ftrace still calls them: Oops: int3: 0000 [#1] SMP NOPTI RIP: 0010:0xffffffffc042b201 Call Trace: ? __audit_syscall_exit+0x9/0x100 ? do_syscall_64+0x5ab/0x5e0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Kernel panic - not syncing: Fatal exception in interrupt Return -EINVAL from register_fentry_multi() when ip is already in data->reg. When such ids are attached via different links the second attach already fails with -EINVAL in update_ftrace_direct_add(). Move the declaration of ftrace_lookup_ip() to include/linux/ftrace.h. The lookup adds 60 msec to the attach of 64480 functions in tracing_multi_bench_attach: 1.34 -> 1.40 sec. Fixes: aef4dfa790b2 ("bpf: Add bpf_trampoline_multi_attach/detach functions")a Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Leon Hwang <leon.hwang@linux.dev> Acked-by: Jiri Olsa <jolsa@kernel.org> Link: https://lore.kernel.org/bpf/20261011164836.2233874-2-alexei.starovoitov@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-10-12pid: document that do_each_pid_task() needs tasklist_lockOleg Nesterov
do_each_pid_task() looks "obviously rcu-safe". This confuses people and we already have 2 buggy users: send_sigio() and send_sigurg(). The reasons why it is not are not obvious at all, add the comment. Signed-off-by: Oleg Nesterov <oleg@redhat.com> Link: https://patch.msgid.link/asuaU8H_5MbO3-cW@redhat.com Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-10-12rust: sync: add const constructor for raw_spinlock_tAlice Ryhl
The abstractions for pr_*_ratelimited! need to construct a global `struct ratelimit_state`, which contains a `raw_spinlock_t` field. Thus, add a const constructor for the `raw_spinlock_t` type. The SPINLOCK_OWNER_INIT constant isn't mirrored via a const helper because bindgen generates a 'static mut' instead of a constant from the pointer constant., The __ARCH_SPIN_LOCK_UNLOCKED constant cannot be translated by bindgen because it's a define for a struct without type annotations, so it's explicitly declared in Rust. Reviewed-by: Boqun Feng <boqun@kernel.org> Reviewed-by: Carlos Llamas <cmllamas@google.com> Acked-by: Miguel Ojeda <ojeda@kernel.org> Signed-off-by: Alice Ryhl <aliceryhl@google.com> Link: https://patch.msgid.link/20261007-pr-ratelimited-v6-2-f14accd4ea3b@google.com Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-10-11docs: core-api: Document the seq_buf APIKees Cook
The kernel-doc in include/linux/seq_buf.h and lib/seq_buf.c documents the seq_buf interface, but no .rst file pulls either of them in, so none of it reaches the generated documentation. Add the missing kernel-doc for seq_buf_clear() and seq_buf_init(), and a Sequence Buffers section to the kernel API documentation. The static internal helper seq_buf_can_fit() is left out. Additionally fix seq_buf_hex_dump() indentation to avoid the reported Sphinx error: ERROR: Unexpected indentation. WARNING: Block quote ends without a blank line; unexpected unindent. Verified with "make SPHINXDIRS=core-api htmldocs", which rendered happily into core-api/kernel-api.html. Assisted-by: LLM Co-developed-by: Bill Wendling <morbo@google.com> Signed-off-by: Bill Wendling <morbo@google.com> Tested-by: Randy Dunlap <rdunlap@infradead.org> Reviewed-by: Randy Dunlap <rdunlap@infradead.org> Link: https://patch.msgid.link/20261005155708.1471260-12-kees@kernel.org Signed-off-by: Kees Cook <kees@kernel.org>
2026-10-11seq_buf: Add seq_buf_init_append()Bill Wendling
Several strlcat() call sites being converted to seq_buf need behavior seq_buf doesn't currently provide. The normal seq_buf_init() always empties the buffer (sets its "len" to 0) via seq_buf_clear(). Code migrating from strlcat(buf, ...), which appends to whatever buf already contains, can't use seq_buf_init() without discarding that existing content. Add seq_buf_init_append(), which preserves the existing contents and positions the seq_buf to append after it. A buffer with no NUL within its size starts out overflowed, as strlcat() treats it as already truncated. Add KUnit tests for behavior coverage. Tests passed under qemu on ARCH=x86_64 with GCC 16.2.0 and CONFIG_KASAN=y, and on big-endian ARCH=s390 with GCC s390x-linux-gnu 16.2.0. Assisted-by: LLM Signed-off-by: Bill Wendling <morbo@google.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Co-developed-by: Kees Cook <kees@kernel.org> Link: https://patch.msgid.link/20261005155708.1471260-9-kees@kernel.org Signed-off-by: Kees Cook <kees@kernel.org>
2026-10-11seq_buf: Add seq_buf_terminate()Kees Cook
Seven callers call seq_buf_str() only to NUL-terminate the buffer, discarding the returned pointer. Two of them need a comment to say so. Add seq_buf_terminate(), wrapping the __seq_buf_terminate() helper that seq_buf_str() and seq_buf_strlen() already use, and convert those callers. It returns void: returning the offset would just be seq_buf_strlen() under another name. A zero-sized seq_buf is left untouched, as in the other accessors. Add tests for the three cases: room for the NUL after the data, an overflowed buffer where it lands in the last byte, and a zero-sized buffer that must not be written to. Build tested ARCH=x86_64 defconfig with GCC 16.2.0, plus CONFIG_HIST_TRIGGERS=y and CONFIG_BPF_SYSCALL=y to reach the converted call sites in kernel/trace/trace_events_hist.c and kernel/bpf/diagnostics.c. Tests run 24/24 passing on ARCH=um. Assisted-by: LLM Acked-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20261005155708.1471260-7-kees@kernel.org Signed-off-by: Kees Cook <kees@kernel.org>
2026-10-11seq_buf: Add seq_buf_strlen()Kees Cook
Several strlcat() call sites being converted to seq_buf need behavior seq_buf doesn't currently provide. The return from seq_buf_used() is not the length of the string in a seq_buf. Once the buffer is full or has overflowed it returns the buffer size, which counts the byte that seq_buf_str() replaces with the NUL, so a caller that needs the string and its length has to call seq_buf_str() and then walk the string with strlen(). Move the termination out of seq_buf_str() into a helper that returns where it put the NUL, and add seq_buf_strlen(), which terminates the buffer in the same way and returns that offset. As discussed in review, don't add WARN_ON() for seq_buf_strlen() and drop it from seq_buf_str(). Add tests comparing seq_buf_strlen() against strlen() of seq_buf_str() for empty, appended, truncated, exactly full, and overflowed buffers, checking that seq_buf_strlen() alone terminates a full buffer, and checking that a zero-sized seq_buf reports an empty string from both accessors without touching the buffer. Tests passed under qemu on ARCH=x86_64 with GCC 16.2.0 and CONFIG_KASAN=y, and on big-endian ARCH=s390 with GCC s390x-linux-gnu 16.2.0. Assisted-by: LLM Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://patch.msgid.link/20261005155708.1471260-6-kees@kernel.org Signed-off-by: Kees Cook <kees@kernel.org>
2026-10-11seq_buf: Clear what a writer did not claim when a seq_buf overflowsKees Cook
Using seq_buf_set_overflow() would leave the bytes between "len" and "size" untouched, so if seq_buf_str() is used on an overflowed seq_buf, those bytes may be exposed. For any paths that don't claim partially written bytes, by setting "len = size" before calling seq_buf_set_overflow(), wipe the unclaimed bytes. The seq_buf_puts() and related APIs already claim those bytes now, so only the unclaimed cases remain. A specific example of this was seq_buf_path() which uses d_path() and would write to the tail before discovering it was out of space, and would correctly mark a seq_buf as overflowed, but the path fragment would be left over. Clear from len to the end of the buffer in seq_buf_set_overflow(), which every overflow goes through, including seq_buf_commit() with a negative count. Add a test that fills a seq_buf, leaves it too little room for a path, and checks that nothing of the path is left in the buffer. The tests run before anything writable is mounted, so it takes its file from shmem. seq_buf_path() was not exported, so the test failed to link as a module. Export it. Tests passed under qemu on ARCH=x86_64 with GCC 16.2.0 and CONFIG_KASAN=y, and on big-endian ARCH=s390 with GCC s390x-linux-gnu 16.2.0, and the test builds as a module (CONFIG_SEQ_BUF_KUNIT_TEST=m). Assisted-by: LLM Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://patch.msgid.link/20261005155708.1471260-5-kees@kernel.org Signed-off-by: Kees Cook <kees@kernel.org>
2026-10-11seq_buf: Copy what fits when seq_buf_puts() and seq_buf_putmem() overflowKees Cook
When seq_buf_puts() or seq_buf_putmem() is given more than fits, it copies nothing and only marks the seq_buf as overflowed. If seq_buf_str() is used, it will terminate the buffer in its last byte, so every byte between the end of the data and the end of the buffer becomes part of the string, though the seq_buf never wrote them. seq_buf_printf() does not have this problem, because vsnprintf() writes as much of the output as fits, followed by a NUL. Repeat this behavior in seq_buf_puts(), using strscpy(), and in seq_buf_putmem(), which also covers seq_buf_putmem_hex(). seq_buf_putc() needs no change, as it can only overflow when the buffer is already full. Each writer now records the buffer as full once it has copied what fits, so that what it wrote can be told apart from bytes nothing touched. Of the callers that check the return value or test for overflow afterward, only lpfc_rx_monitor_report() relied on a string that did not fit being left out, and the previous patch has it drop such a record itself. The others treat overflow as an error or report it. The callers that ignore overflow use whatever the buffer holds, which now ends with the part of the string that fit. Update seq_buf_putmem_hex_overflow_test, which expected a hex group that did not fit whole to be left out entirely, and add tests that overflow seq_buf_puts(), seq_buf_putmem() and seq_buf_putmem_hex() with stale bytes in the buffer. The three partial-overflow tests check the buffer itself rather than seq_buf_str(). Neither writer leaves the last byte of the buffer alone: seq_buf_putmem() copies raw bytes and writes no NUL, and seq_buf_puts() relies on strscpy() to write one. That byte is exactly where seq_buf_str() writes its terminator, so asserting only on the string would pass whether the copy stopped a byte early or dropped the NUL entirely. seq_buf_putmem() was not exported, so the test failed to link as a module. Export it. Tests passed under qemu on ARCH=x86_64 with GCC 16.2.0 and CONFIG_KASAN=y, and on big-endian ARCH=s390 with GCC s390x-linux-gnu 16.2.0, and the test builds as a module (CONFIG_SEQ_BUF_KUNIT_TEST=m). Assisted-by: LLM Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://patch.msgid.link/20261005155708.1471260-4-kees@kernel.org Signed-off-by: Kees Cook <kees@kernel.org>
2026-10-11seq_buf: Do not pop from an overflowed seq_bufKees Cook
When a seq_buf has overflowed, its len is size + 1, so seq_buf_pop() decrements len to size and reads buffer[size], one byte past the end of the buffer. It also leaves len equal to size, which no longer counts as overflowed, so a truncated seq_buf then looks like a complete, full one. An overflowed seq_buf logically has no last character to pop: the length of what was written has been lost, and the last byte of the buffer may be the NUL written by vsnprintf() or bytes that were never committed. Return -1 for an overflowed seq_buf, as for an empty one, and leave it overflowed, as the rest of the seq_buf API does until seq_buf_clear() or seq_buf_init(). The current callers do not reach this, e.g. trace_syscalls only calls trace_seq_pop() when the trace_seq it pops from has not overflowed, and kernel/bpf/diagnostics.c sets the length from strnlen() before popping. Add tests for the pop corner cases. Tests passed under qemu on ARCH=x86_64 with GCC 16.2.0 and CONFIG_KASAN=y, and on big-endian ARCH=s390 with GCC s390x-linux-gnu 16.1.0. Fixes: 32e0f607ac6a2 ("tracing: Add trace_seq_pop() and seq_buf_pop()") Assisted-by: LLM Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://patch.msgid.link/20261005155708.1471260-2-kees@kernel.org Signed-off-by: Kees Cook <kees@kernel.org>
2026-10-11NFSD: Use xdrgen XDR functions for NFSv2 READDIR resultsChuck Lever
READDIR is the last NFSv2 procedure whose reply is still produced by a hand-written encoder. Its entry list is the value-follows form of RFC 1094's "entry *entries" -- each entry prefixed by TRUE, the sequence closed by FALSE -- streamed straight from the directory as it is read rather than from a materialized array. The generated encoder could not drive that: the union encoder writes the reply status word before the entry list, yet a streamed read does not learn the status until the directory has been read, and the aggregate loop was bounded by a count the begin hook had to supply up front. The preceding patches remove both obstacles. The optional-data aggregate encoder now pulls entries until the hook signals end, so no count is needed, and the streaming directory reader yields one entry at a time during encode. Mark readdirok's entry list as an aggregate and regenerate; the struct definitions stay the verbatim RFC 1094 types, and the lone "pragma aggregate readdirok entries" selects the hook-driven codec. Split the read across the two phases so the generated encoder owns the framing. nfsd_proc_readdir() opens the directory, where an open error becomes the reply status the union encoder then writes, and the encode hooks stream the entries: each pull reserves a placeholder cookie and back-patches the preceding entry's cookie once the following entry's resume offset is known; the end hook back-patches the final cookie and reports eof. nfssvc_release_readdirres() closes the reader and releases the file handle. The decode hooks are stubs -- a server never decodes a READDIR result -- present only to satisfy the generated decoder's linkage. Retire struct nfsd_readdirres for an embedded struct readdirres so the RPC dispatch layer can cast the response to its xdrgen type. The directory's svc_fh moves into that wrapper and struct readdirargs_wrapper goes away. svc_process() zeroes the result buffer before decode but leaves the argument buffer as the previous request left it, and ->pc_release runs even when decoding fails. A file handle kept in the argument wrapper would reach fh_put() on that path uninitialized. The generated encoder reserves reply space through the xdr_stream, which does not advance rq_next_page as it moves onto the next page. svcrdma retains only the pages below rq_next_page across Send completion, so the end hook sets rq_next_page past the last page the reply uses, as nfsd4_encode_operation() does. A host error during the streamed read cannot retract entries already on the wire, so it ends the list as a truncated, non-eof reply rather than an error status; an error opening the directory is still reported as the reply status. The bytes on the wire are otherwise unchanged. Acked-by: Jeff Layton <jlayton@kernel.org> Link: https://patch.msgid.link/20260916162859.2051-30-cel@kernel.org Signed-off-by: Chuck Lever <cel@kernel.org>
2026-10-11NFSD: Use xdrgen XDR functions for NFSv2 SYMLINK procedureChuck Lever
A SYMLINK request's target pathname can extend from the head of the receive buffer into its page data; the decoder reassembles it from a head segment and a page via svc_fill_symlink_pathname(). Represent the pathname in place rather than materializing it inline: the "pages" directive expresses it as a struct xdr_buf and decodes it with svcxdr_decode_opaque_payload(), which subsegments the source stream instead of pulling the string inline through the bounded xdr scratch buffer. Annotate the to member of symlinkargs with "pragma pages" and replace the NFSPROC_SYMLINK entry in nfsd_procedures2 with the generated nfs_svc_decode_symlinkargs and nfs_svc_encode_nfsstat. A wrapper structure bridges the generated symlinkargs type and the svc_fh and iattr representations the NFSD VFS layer still uses. nfsd_proc_symlink() copies the pathname out of the xdr_buf with read_bytes_from_xdr_buf(), so a target that lands in the receive buffer's tail, or straddles its pages and tail, is handled the same way as one in the head. The pc_argzero field is now set to zero for the NFSv2 SYMLINK procedure. The generated decoder initializes every argument in the argp->xdrgen field, making the early defensive memset unnecessary. The hand-coded nfsd_proc_symlink() accepts a target of any length from the decoder and answers one longer than NFS_MAXPATHLEN with NFSERR_NAMETOOLONG. The generated decoder enforces the path typedef's bound itself, so such a request now fails decoding and nfsd_dispatch() returns RPC GARBAGE_ARGS instead. The Linux NFS client sends targets up to PAGE_SIZE on an NFSv2 mount, and in that case it reports EIO to the application rather than ENAMETOOLONG. nfssvc_decode_symlinkargs() no longer has any callers, so it is removed. Acked-by: Jeff Layton <jlayton@kernel.org> Link: https://patch.msgid.link/20260916162859.2051-23-cel@kernel.org Signed-off-by: Chuck Lever <cel@kernel.org>
2026-10-11NFSD: Use xdrgen XDR functions for NFSv2 WRITE procedureChuck Lever
The NFSv2 WRITE argument decoder could not be generated because the write payload must be directed into the server's page cache and decoded in place; a materializing decoder would copy every write. The "pages" directive now expresses this: it represents the payload as a struct xdr_buf and decodes it with svcxdr_decode_opaque_payload(), which subsegments the source stream in place rather than copying it. Annotate the data member of writeargs with "pragma pages" and replace the NFSPROC_WRITE entry in nfsd_procedures2 with the generated nfs_svc_decode_writeargs and nfs_svc_encode_attrstat. A wrapper structure bridges the generated writeargs type and the svc_fh the NFSD VFS layer still uses; the result reuses the attrstat wrapper from the GETATTR conversion. The pc_argzero field is now set to zero for the NFSv2 WRITE procedure. The generated decoder initializes every argument in the argp->xdrgen field, making the early defensive memset unnecessary. This refactor replaces the use of svcxdr_encode_fattr(), so the reference to the file handle can be released directly by nfsd_proc_write(). A separate ->pc_release callback is thus no longer needed. This makes it straightforward to confirm that the file handle is properly released during every error flow. Acked-by: Jeff Layton <jlayton@kernel.org> Link: https://patch.msgid.link/20260916162859.2051-17-cel@kernel.org Signed-off-by: Chuck Lever <cel@kernel.org>
2026-10-11NFSD: Use xdrgen XDR functions for NFSv2 READ procedureChuck Lever
Replace the hand-written NFSv2 READ codec pair with the xdrgen-generated functions. The NFSPROC_READ entry in the nfsd_procedures2 array now dispatches nfs_svc_decode_readargs and nfs_svc_encode_readres. A wrapper structure bridges the generated xdrgen readargs type and the legacy svc_fh representation the NFSD VFS layer still uses. The file's data does not reside at the data pointer of the readresok data member: nfsd_read() deposits it directly in the pages of the Reply buffer, so the generic encoder that copies an opaque from the member's data pointer cannot encode it. Mark the member with the "pragma pages" directive so the generated encoder calls svcxdr_encode_opaque_payload(), which encodes the length prefix and inserts the payload pages into the stream by reference. The page anchor that the result structure carried duplicated rq_res.pages -- svc_process() points rq_res.pages at the first Reply page before dispatch, and the readargs decoder consumes no pages -- so the helper locates the payload through the Reply buffer itself, and the wrapper collapses to the generated readres type. The pc_argzero field is now set to zero for the NFSv2 READ procedure. The xdrgen decoders are trusted to initialize all arguments in the argp->xdrgen field, making the early defensive memset unnecessary. The remaining argp fields are cleared as needed. Because the generated encoder no longer needs the svc_fh at encode time, nfsd_proc_read() releases the file handle directly and no separate ->pc_release callback is needed. This makes it straightforward to confirm that the file handle is properly released during every error flow. Acked-by: Jeff Layton <jlayton@kernel.org> Link: https://patch.msgid.link/20260916162859.2051-15-cel@kernel.org Signed-off-by: Chuck Lever <cel@kernel.org>
2026-10-11NFSD: Use xdrgen XDR functions for NFSv2 READLINK procedureChuck Lever
Replace the hand-written NFSv2 READLINK codec pair with the xdrgen-generated functions. The NFSPROC_READLINK entry in the nfsd_procedures2 array now dispatches nfs_svc_decode_fhandle and nfs_svc_encode_readlinkres. A wrapper structure bridges the generated xdrgen fhandle type and the legacy svc_fh representation the NFSD VFS layer still uses. The link target does not reside at the data pointer of the readlinkres union arm: nfsd_readlink() deposits it directly in a page of the Reply buffer, so the generic encoder that copies an opaque from the member's data pointer cannot encode it. Mark the arm with the "pragma pages" directive so the generated encoder calls svcxdr_encode_opaque_payload(), which encodes the length prefix and inserts the payload page into the stream by reference. The page anchor that the result structure carried duplicated rq_res.pages -- svc_process() points rq_res.pages at the first Reply page before dispatch, and the fhandle argument decoder consumes no pages -- so the helper locates the payload through the Reply buffer itself, and the wrapper collapses to the generated readlinkres type. The pc_argzero field is now set to zero for the NFSv2 READLINK procedure. The xdrgen decoders are trusted to initialize all arguments in the argp->xdrgen field, making the early defensive memset unnecessary. The remaining argp fields are cleared as needed. Acked-by: Jeff Layton <jlayton@kernel.org> Link: https://patch.msgid.link/20260916162859.2051-14-cel@kernel.org Signed-off-by: Chuck Lever <cel@kernel.org>
2026-10-11NFSD: Use xdrgen XDR functions for NFSv2 GETATTR procedureChuck Lever
Replace the NFSPROC_GETATTR entry in the nfsd_procedures2 array with an entry that dispatches the xdrgen-generated nfs_svc_decode_fhandle and nfs_svc_encode_attrstat. Wrapper structures bridge the generated xdrgen types and the legacy svc_fh and kstat representations the NFSD VFS layer still uses. A few helper functions are introduced which will be used here and in subsequent patches. The pc_argzero field is now set to zero for the NFSv2 GETATTR procedure. The xdrgen decoders are trusted to initialize all arguments in the argp->xdrgen field, making the early defensive memset unnecessary. The remaining argp fields are cleared as needed. This refactor replaces the use of svcxdr_encode_fattr(), so the reference to the file handle can be released directly by nfsd_proc_getattr(). A separate ->pc_release callback is thus no longer needed. This makes it straightforward to confirm that the file handle is properly released during every error flow. The new nfsd_mode_to_ftype() utility no longer maps socket and FIFO devices to non-standard values: NFSOCK=6 which is outside the ftype enum, and NFCHR for FIFOs which is semantically wrong. The Linux NFS client implementation does not seem to use or depend on these non-standard values. The new utility function returns NFNON for both, which is the RFC-compliant behavior. Acked-by: Jeff Layton <jlayton@kernel.org> Link: https://patch.msgid.link/20260916162859.2051-10-cel@kernel.org Signed-off-by: Chuck Lever <cel@kernel.org>
2026-10-11NFSD: Use xdrgen-generated NFSv2 protocol definitionsChuck Lever
Switch the server's NFSv2 implementation to use the machine- generated protocol definitions. Acked-by: Jeff Layton <jlayton@kernel.org> Link: https://patch.msgid.link/20260916162859.2051-6-cel@kernel.org Signed-off-by: Chuck Lever <cel@kernel.org>
2026-10-11NFSD: Add infrastructure for generating NFSv2 XDR encoders and decodersChuck Lever
NFSD's NFSv2 XDR codecs are hand-maintained; they are being converted to xdrgen-generated code one RPC procedure at a time. The first step is to generate and commit the xdrgen C code based on nfs2.x. The generated code can be refreshed any time nfs2.x is modified by running "(cd fs/nfsd && make xdrgen)". Acked-by: Jeff Layton <jlayton@kernel.org> Link: https://patch.msgid.link/20260916162859.2051-4-cel@kernel.org Signed-off-by: Chuck Lever <cel@kernel.org>
2026-10-11SUNRPC: allow a service to opt out of rpcbind registrationJeff Layton
svc_bind() creates the local rpcbind client, and svc_register() then makes one synchronous call for each program and version. Both run under the caller's mutex. A caller that registers from userland needs neither. Add sv_no_rpcbind to struct svc_serv, and fix up the code to honor it. No caller sets the flag yet, so behaviour does not change. Assisted-by: LLM Signed-off-by: Jeff Layton <jlayton@kernel.org> Link: https://patch.msgid.link/20260915-nfsd-norpcb-v3-1-3c60d49ade02@kernel.org Signed-off-by: Chuck Lever <cel@kernel.org>
2026-10-12Merge tag 'drm-msm-next-2026-10-11' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/msm into drm-next Changes for v7.4 CI: - Dropped sc7180 trogdor lazor from the CI Core: - Fixed msm_ioremap for resources without a name - Changed msm.separate_gpu_kms to default to auto selection GPU: - Enable CLX (Current Limit eXtension) for gen8 to avoid exceeding limits on CX/GX rails - New GPUs: a830 (Pakala), a845 (Maili), a850 (Hawi), x2-85 (Mahua) - Fix VBIF halt mask on a306, which was preventing runpm suspend - Enable THP support for GEM buffers - Add modparam to disable waiting on fences in shrinker - Drop use of drm_prime_sg_to_page_array() - a5xx: don't read the GPMU registers on GPUs without a GPMU - a2xx/a3xx/a5xx: hangcheck progress detection - a6xx: gmuwrapper runpm fix - Calculate reported GMEM size based on active slices - Split a6xx/a7xx/a8xx catalog DP: - Picked up some preparation patches for the MST support - Fixed reported status of the link training DPU: - Fixed CRTC bandwidth computation - Fixed DSC programming - Fixed encoder disablement path DSI: - Fixed VM leak in error path - Indention fix MDP5: - Added MSM8952 configuration - Dropped incorrect cursor pipe on MSM8976/56 HDMI: - Small fixes Notes: - Merged qcom-drivers-for-7.4 to pick up UBWC_7_0 support (needed for Hawi/Maili) which in turn depended on qcom-arm64-for-7.4 Signed-off-by: Dave Airlie <airlied@redhat.com> From: Rob Clark <rob.clark@oss.qualcomm.com> Link: https://patch.msgid.link/CACSVV02V-FOzGj71G0ZL7khkYEKWFW4q4biOZR8B8vyWy20PdQ@mail.gmail.com
2026-10-11bus: mhi: ep: Add mhi_ep_queue_buf() API for raw buffer queuingSumit Kumar
Some MHI endpoint clients do not use socket buffers and need a way to queue raw buffers for DL transfers. Add mhi_ep_queue_buf() to support this use case. Refactor mhi_ep_queue_skb() to delegate to a new internal mhi_ep_queue() helper shared by both APIs, and rename mhi_ep_skb_completion() to mhi_ep_buf_completion() to reflect its broader use. Signed-off-by: Sumit Kumar <sumit.kumar@oss.qualcomm.com> Link: https://patch.msgid.link/20261005-lb-v7-2-36a268b6386f@oss.qualcomm.com Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
2026-10-11Merge tag 'block-7.3-20261010' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fixes from Jens Axboe: - NVMe fixes via Keith: - Fix swapped ZRASF zone state values for full and read only - nvme-multipath revalidate head zones after unfreezing the head queue - Revert "nvme: do not reset controllers in NVME_CTRL_NEW state", which broke things - nvmet fixes for invalid NSIDs on feature 82h and using the local P2P device on metadata allocation failure - zloop: zero out only the unread tail of a short read * tag 'block-7.3-20261010' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: Revert "nvme: do not reset controllers in NVME_CTRL_NEW state" zloop: zero out only the unread tail of short reads nvmet: use the local P2P device on metadata allocation failure nvme-multipath: revalidate head zones after unfreezing the head queue nvme: fix swapped ZRASF zone state values for full and read only nvmet: return Invalid Field for invalid NSIDs feature 82h
2026-10-11Merge tag 'io_uring-7.3-20261010' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fixes from Jens Axboe: - Don't spin on local work the exiting task can't run. For a ring still R_DISABLED when the task got its tctx node, the submitter is set later and may be another task, so DEFER_TASKRUN local work stays pending forever and the exiting task spins in do_exit(). - Don't charge the SQ/CQ rings or provided buffer rings to RLIMIT_MEMLOCK. The region API conversion started charging them, which the rings had been exempt from. - Don't exempt disabled rings from task restrictions on register - Populate the CONNECT filter fields for a 24-byte sockaddr_in6 * tag 'io_uring-7.3-20261010' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/cancel: don't spin on local work the task can't run io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6 io_uring/register: don't exempt disabled rings from task restrictions io_uring/kbuf: don't charge provided buffer rings to RLIMIT_MEMLOCK io_uring: do not charge the SQ/CQ rings to RLIMIT_MEMLOCK
2026-10-11btf: Preserve string relocation maps for split BTFAlan Maguire
Make btf_relocate() optionally return the string-offset map it builds while relocating a BTF relative to a distilled base. A subsequent split BTF object can use that map to rebase references to base strings. Also account for the accumulated base string offset when assigning a new BTF base. This is required when the base is itself split. Signed-off-by: Alan Maguire <alan.maguire@oracle.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20261009112324.1442319-5-alan.maguire@oracle.com
2026-10-11kbuild, btf: Expose vmlinux inline BTF through sysfsAlan Maguire
Expose BTF inline-location information from vmlinux .BTF.inline sections in /sys/kernel/btf as vmlinux.inline. Embedded vmlinux inline BTF supports read-only mmap(). Provide runtime support for a module-delivered vmlinux inline BTF carrier. Its link record binds the carrier module name, BTF size, and SHA-256 digest to the running kernel before its data is made available through a lazy vmlinux.inline sysfs attribute. The carrier is handled before ordinary module BTF registration, so its incidental .BTF data is not exposed. Make CONFIG_DEBUG_INFO_BTF_INLINE tristate. When configured as a module, retain vmlinux final split inline BTF for btf_vmlinux_inline.ko instead of embedding it in vmlinux. Reserve .BTF.inline.link in vmlinux and extend the final resolve_btfids patch pass to bind btf_vmlinux_inline to the raw vmlinux.BTF.inline payload. This preserves the normal built-in configuration while allowing the large inline BTF payload to load on demand. Normal module inline BTF is handled separately, after its references have been relocated against the final module BTF. Signed-off-by: Alan Maguire <alan.maguire@oracle.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20261009112324.1442319-4-alan.maguire@oracle.com
2026-10-11usb: xhci-pci: Add TUSB73x0 definitionsFabio Estevam
Instead of hard-coding the TUSB73X0 PCI ID, USB_CTRL register address and the PWRON_POLARITY, introduce definitions for them to make the code easier to read. No functional change. Signed-off-by: Fabio Estevam <festevam@gmail.com> Acked-by: Bjorn Helgaas <bhelgaas@google.com> # pci_ids.h Link: https://patch.msgid.link/20261009125154.266435-1-festevam@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-10-11net/mlx5: IFC, Add capability bits for virtual LAGShay Drory
Virtual LAG can also be built over virtual uplinks rather than physical ports. The support for this virtual LAG is indicated by multi_uplink_eswitch and port_select_eswitch caps bit. Signed-off-by: Shay Drory <shayd@nvidia.com> Reviewed-by: Mark Bloch <mbloch@nvidia.com> Reviewed-by: Moshe Shemesh <moshe@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20261005084047.237081-3-tariqt@nvidia.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-10-11net/mlx5: Add cap_tx_speed and effective_tx_speed support to IFCOr Har-Toov
Introduce the cap_tx_speed and effective_tx_speed fields to the query and modify_vport_state structures. Add the esw_vport_state_cap_tx_speed and esw_vport_state_effective_tx_speed capability bits, indicating the firmware supports modifying the cap_tx_speed and effective_tx_speed fields, via the MODIFY_VPORT_STATE command. Signed-off-by: Or Har-Toov <ohartoov@nvidia.com> Reviewed-by: Mark Bloch <mbloch@nvidia.com> Reviewed-by: Nimrod Oren <noren@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20261005084047.237081-2-tariqt@nvidia.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-10-11Merge branch kvm-arm64/pre-faulting into kvmarm-master/nextMarc Zyngier
* kvm-arm64/pre-faulting: : \ : Enable stage-2 pre-faulting in the canonical IPA space, implementing the : KVM_PRE_FAULT_MEMORY API. Patches courtesy of Lorenzo Stoakes, and based : on an initial work by Jack Thomson. : / KVM: selftests: Add nested pre-fault test for arm64 KVM: selftests: Add option for different backing in pre-fault tests KVM: selftests: Enable pre_fault_memory_test for arm64 Documentation: KVM: document arm64 KVM_PRE_FAULT_MEMORY KVM: arm64: Implement KVM_PRE_FAULT_MEMORY KVM: arm64: Pass walk flags to kvm_pgtable_get_leaf() KVM: arm64: Propagate EHWPOISON in kvm_s2_fault_pin_pfn() KVM: arm64: Size the stage-2 memcache from the fault MMU KVM: arm64: Propagate and use kvm_s2_fault_result on S2 fault KVM: arm64: Propagate and use mmu in s2fd when handling guest aborts KVM: arm64: Propagate and use esr in s2fd when handling guest aborts KVM: arm64: Use ESR helpers in guest abort handling arm64: Add ESR fault helpers KVM: Allow architectures to disallow pre-fault Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-10-11Merge branch kvm-arm64/gicv5-7.4 into kvmarm-master/nextMarc Zyngier
* kvm-arm64/gicv5-7.4: (52 commits) : \ : GICv5 IRS support, courtesy of Sascha Bischoff. From the cover letter: : : "This series builds on the initial vGICv5 support and adds support : for the GICv5 IRS, as described by the GICv5 (EAC0) specification. : With this, a GICv5 guest is no longer restricted to PPIs, and can make : use of SPIs and LPIs as well." : / KVM: arm64: vgic-v5: Correctly handle host ISTE __le32 conversion KVM: arm64: vgic-v5: Tidy-up programming of vpe descriptor address KVM: arm64: vgic-v5: Correctly reset h_lpi_ist to NULL KVM: arm64: vgic-v5: Drop __iomem attribute from {vmd,vpet}_base KVM: selftests: Add VGICv5 sparse vCPU IDs test KVM: selftests: Add VGICv5 IST save/restore coverage KVM: selftests: Add VGICv5 LPI delivery tests KVM: selftests: Add VGICv5 SPI injection tests KVM: selftests: Add VGICv5 CPU sysreg attribute tests KVM: selftests: Add VGICv5 USERSPACE_PPIS tests KVM: selftests: Add VGICv5 IST attribute tests KVM: selftests: Add VGICv5 IRS_REGS attribute tests KVM: selftests: Add VGICv5 NR_IRQS attribute tests KVM: selftests: Add VGICv5 IRS address attribute tests Documentation: KVM: Add the VGICv5 IRS save/restore sequences Documentation: KVM: Add docs for KVM_DEV_ARM_VGIC_GRP_IST Documentation: KVM: Add KVM_DEV_ARM_VGIC_GRP_IRS_REGS to VGICv5 docs Documentation: KVM: Document KVM_DEV_ARM_VGIC_GRP_CPU_SYSREGS for VGICv5 KVM: arm64: gic-v5: Implement save/restore mechanisms for ISTs KVM: arm64: gic-v5: Add VGICv5 IST save/restore UAPI ... Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-10-11Merge branch kvm-arm64/hyp-type-checking-7.4 into kvmarm-master/nextMarc Zyngier
* kvm-arm64/hyp-type-checking-7.4: : \ : Restore some sanity in the EL2 department by enforcing the type : checking that was lost when converting the KVM internal : interface to SMCCC. Patches courtesy of Fuad Tabba. : : From the cover letter: : : "This series implements that, in plain preprocessor macros rather than : an external generator, in the mold of the syscall wrappers. Each : hypercall's signature is declared once, in kvm_hcall.h: : kvm_call_hyp_nvhe() resolves to a typed nvhe_hvc_##f() stub generated : from the declaration, and the hyp-main.c handlers unmarshal their : arguments through glue that is type-checked against the same : declaration. A mistyped or stale call, or a handler that drifts from : its caller, now fails to compile. On top of that shared declaration, : host-VA parameters gain a __kern sparse address space, so : dereferencing one at EL2 without kern_hyp_va_host() translation is : flagged by sparse. The address space is KVM-private and lives with the : interface it annotates rather than in compiler_types.h, like x86's : __seg_gs in asm/percpu.h. The deeper instances of that bug class, host : VAs reached through struct fields after the boundary, are follow-up : work." : / KVM: arm64: Tag host-VA hypercall parameters __kern KVM: arm64: nVHE: Check hypercall handlers against the declared ABI KVM: arm64: Type-check hypercall arguments at the caller KVM: arm64: Move the host hypercall interface to its own header KVM: arm64: nVHE: Pass host VA arguments as pointers arm64: pi: Run the source checker on the libfdt objects under C=2 KVM: arm64: nVHE: Run the source checker under C=2 KVM: arm64: nVHE: Use NULL to reset the trace buffer backing pointer KVM: arm64: nVHE: Declare the hyp event IDs before defining them KVM: arm64: nVHE: Share the stacktrace per-CPU declarations with EL2 tracing: Include linux/types.h in trace_remote_event.h Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-10-11Merge tag 'socfpga_firmware_updates_for_v7.4' of ↵Greg Kroah-Hartman
ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux into char-misc-next Dinh writes: SoCFPGA Firmware update for v7.4 - Turn off secondary CPUs using PSCI on Agilex7 and Stratix10 Warm resets on these platforms require a clean PSCI state. - Clean up stratix10_svc_free_memory() to reduce nesting - Add SMMU DMA coherent support on Agilex5 Use DMA-coherent buffers and IOVAs in the service driver for Agilex5 - Set kaddr1 to res.a1 which matches the existing error path and allow callers to retrieve firmware status details - Allow older firmware that excluded COMMAND_RSU_UPDATE and COMMAND_RSU_STATUS to return SVC_STATUS_NO_SUPPORT so the firmware can continue instead of waiting for a timeout. - Add support for SDM mailbox interrupt on async transactions - Reduce polling times by introducing polling modes(Fast and Slow) * tag 'socfpga_firmware_updates_for_v7.4' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: firmware: stratix10-svc: Reduce polling interval for command status firmware: stratix10-svc: Add for SDM mailbox doorbell interrupt firmware: stratix10-svc: remove RSU exclusion from no-support path firmware: stratix10-svc: populate kaddr1 from config status response firmware: stratix10-svc: add Agilex5 SMMU DMA coherent support firmware: stratix10-svc: warn on unmatched free in stratix10_svc_free_memory firmware: stratix10-svc: add PSCI secondary CPU offline on warm reboot for agilex and stratix10
2026-10-11firewire: core: use context analysis annotations and lockdep checks for ↵Takashi Sakamoto
topology map lock The spinlock protects the topology map from concurrent access. Add context analysis annotations and lockdep checks for this lock. Link: https://lore.kernel.org/r/20261011063146.497455-6-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
2026-10-11firewire: core: use context analysis annotations and lockdep checks for ↵Takashi Sakamoto
split timeout lock The spinlock protects parameters related to split transaction timeouts. Add context analysis annotations and lockdep checks for this lock. Link: https://lore.kernel.org/r/20261009121048.282982-5-o-takashi@sakamocchi.jp Link: https://lore.kernel.org/r/20261011063146.497455-5-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
2026-10-11firewire: core: use context analysis annotations and lockdep checks for ↵Takashi Sakamoto
transactions lock The transaction lock protects the list of pending transactions and the transaction label. Add context analysis annotations for the transaction lock. Compiler-based context analysis has difficulty tracking the locking scope when the lock is accessed through an indirect reference (e.g. t->card->lock), making some functions difficult to annotate. Use lockdep assertions to cover these cases. Link: https://lore.kernel.org/r/20261011063146.497455-4-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
2026-10-11bootconfig: Move BOOTCONFIG_FOOTER_SIZE to include/linux/bootconfig.hMasami Hiramatsu (Google)
BOOTCONFIG_FOOTER_SIZE was defined locally in tools/bootconfig/main.c. Move it to include/linux/bootconfig.h so that it can be shared with the kernel and user-space tools. Also, use it in init/main.c instead of the hardcoded (BOOTCONFIG_MAGIC_LEN + 8) expression when checking the initrd size. Link: https://lore.kernel.org/all/178913601321.248794.4786502771058559887.stgit@devnote2/ Suggested-by: Sang-Heon Jeon <ekffu200098@gmail.com> Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Reviewed-by: Sang-Heon Jeon <ekffu200098@gmail.com>
2026-10-11bootconfig: Skip printing early params to cmdline from bootconfigMasami Hiramatsu (Google)
If user configures `kernel.key` in bootconfig, the 'key' is shown in kernel cmdline (/proc/cmdline) and kernel boot parameter handler associated with 'key' is invoked. However, since the bootconfig does not support the parameter defined with early_param, those keys are shown in '/proc/cmdline' but not handled by kernel. This could easily mislead users who expected to be able to specify early parameters via the boot configuration, leading them to wonder why it doesn't work. Let's skip printing out early params to cmdline buffer, and warn if there is such parameters in bootconfig. Link: https://lore.kernel.org/all/178844899530.263905.7707547252181797215.stgit@devnote2/ Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
2026-10-10vfio/pci: Remove the core dependency on driver dataSimon Song
vfio-pci-core currently has runtime functions that interpret pci driver_data as a pointer to vfio_pci_core_device, and enforce vfio variant drivers must set vfio_pci_core_device to their pci driver_data. This constrains variant drivers' private-data layout, including the typed driver data used by the Rust PCI infrastructure. Add VFIO_PCI_CORE_DEFINE_CALLBACKS macro to generate wrapper code for each vfio variant driver, update vfio variant drivers to store their private structures in driver_data and use generated wrapper to pass the vfio core device to helpers. Assisted-by: LLM Suggested-by: Jason Gunthorpe <jgg@nvidia.com> Suggested-by: Alex Williamson <alex.williamson@nvidia.com> Suggested-by: Danilo Krummrich <dakr@kernel.org> Link: https://lore.kernel.org/all/DLFD2ZDSK9YQ.3A4R66G8UJMD8@kernel.org/ Signed-off-by: Simon Song <xinmengs@nvidia.com> Reviewed-by: Jason Gunthorpe <jgg@nvidia.com> Reviewed-by: Danilo Krummrich <dakr@kernel.org> Link: https://lore.kernel.org/r/20261005184236.1946167-2-xinmengs@nvidia.com [VGA chunks and commit log reference dropped with rebase to commit 93d41424caf7 ("PCI/VGA: pass a data pointer to be used in the decode callback (v2)")] Signed-off-by: Alex Williamson <alex@shazbot.org>
2026-10-10Merge tag 'topic/pci-vgaarb-rework-2026-10-01' of ↵Alex Williamson
https://gitlab.freedesktop.org/drm/kernel into v7.4/vfio/next pci/vgaarb rework for drm/vfio This reworks the vgaarb API to be a bit more sane. Signed-off-by: Alex Williamson <alex@shazbot.org>