summaryrefslogtreecommitdiff
path: root/include/linux
AgeCommit message (Collapse)Author
2026-08-13Merge branch 'slot' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci ↵Alex Williamson
into v7.3/vfio/s390x-pci-error-recovery PCI dependencies from shared branch supporting vfio-pci error recovery on s390x. Signed-off-by: Alex Williamson <alex@shazbot.org>
2026-08-13dma/swiotlb: decouple high watermark tracking from CONFIG_DEBUG_FSchenhuguanshen
Under heavy concurrent DMA traffic on CoCo VMs, inc_used_and_hiwater() performs an atomic_long_add_return() plus a CAS loop on the global used_hiwater, and dec_used() performs an atomic_long_sub() on total_used. All CPUs contend on the same cacheline, causing measurable throughput degradation at scale. Historically these counters were only compiled in under CONFIG_DEBUG_FS, which means production kernels with debugfs paid the atomic overhead unconditionally. Make the tracking boot-time opt-in instead so that it is disabled by default with near-zero overhead via static_call, and can be enabled via "swiotlb=track_hiwater" parameter on demand for debugging. Note that when CONFIG_DEBUG_FS is enabled but hiwater tracking is disabled, the "io_tlb_used" metric reports an approximate value rather than an instantaneously exact one. Suggested-by: Fan Du <fan.du@intel.com> Signed-off-by: Jun Miao <jun.miao@intel.com> Co-developed-by: Fan Du <fan.du@intel.com> Signed-off-by: Fan Du <fan.du@intel.com> Tested-by: chenhuguanshen <chenhgs@chinatelecom.cn> Signed-off-by: chenhuguanshen <chenhgs@chinatelecom.cn> Reviewed-by: Michael Kelley <mhklinux@outlook.com> Tested-by: Michael Kelley <mhklinux@outlook.com> Link: https://lore.kernel.org/r/20260812070459.637077-1-frankchen158@126.com Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
2026-08-13PCI: dwc: Add PCI ID for LECARC PCIe PMUBrett Zhou
Add support for the PCIe PMU found on LECARC SoCs. LECARC platforms use the standard DesignWare PCIe Controller, and the existing DWC driver already handles the enumeration and basic functionality through the generic PCIe core. Hence, add the PCI vendor ID to the vendor-specific capability (VSEC) list, which enables the standard DWC RAS/DES feature detection. Signed-off-by: Brett Zhou <brett_zhou@lecomputing.com> Signed-off-by: Braden Zhang <braden_zhang@lecomputing.com> [mani: commit log] Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Link: https://patch.msgid.link/20260721-pcie-pmu-v5-1-570e44af7cde@lecomputing.com
2026-08-13bpf: Eliminate dup/restore of insn_aux_dataXu Kuohai
The dup/restore of insn_aux_data was introduced to resolve the inconsistency between insnsi and insn_aux_data arrays, which occurs on the failure path where insnsi was rolled back to the original state before constants blinding, while insn_aux_data was not. After JIT failure, there is only one user, bpf_clear_insn_aux_data(), that requires insnsi and insn_aux_data to be synchronized. It accesses both insnsi and insn_aux_data using the same array size and index. However, the access to insnsi in bpf_clear_insn_aux_data() is not necessary. It is checked to skip the second slot of an ldimm64 instruction, whose jt is never set and can be absorbed into the jt check itself. So remove the access to insnsi from bpf_clear_insn_aux_data(), and add a specific length field for insn_aux_data to allow it to have a different length from the insnsi array. Then remove dup/restore of insn_aux_data. Signed-off-by: Xu Kuohai <xukuohai@huawei.com> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/bpf/5a4528f019c8d2638c019a2f37475cccc16a9503.1785240296.git.xukuohai@huawei.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-08-12tcp: clarify comment for mdev_us in struct tcp_sockZiran Zhang
The existing comment for mdev_us says "medium deviation", but this term is inaccurate. The field stores the "mean deviation" of RTT, as originally defined in Van Jacobson's paper "Congestion Avoidance and Control", and it is scaled by 4 (<< 2) in the Linux implementation. Update the comment to reflect the correct terminology and storage format. Signed-off-by: Ziran Zhang <zhangcoder@yeah.net> Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de> Link: https://patch.msgid.link/20260805131927.27661-1-zhangcoder@yeah.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-13bpf: Make bpf_trampoline_multi_detach return voidHui Zhu
bpf_trampoline_multi_detach() always returns 0 and the sole caller ignores the return value. Change it to return void and drop the WARN_ON_ONCE at the call site. Signed-off-by: Hui Zhu <zhuhui@kylinos.cn> Acked-by: Leon Hwang <leon.hwang@linux.dev> Acked-by: Jiri Olsa <jolsa@kernel.org> Link: https://lore.kernel.org/bpf/12beba657f5c9e86a016a097750209287a2f262a.1786412280.git.zhuhui@kylinos.cn Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-08-12bpf: Track verifier instruction stats for each subprogramKumar Kartikeya Dwivedi
The verifier currently records one instruction count for the main program and each global subprogram checked independently. Static subprograms are explored within callers, so their verification cost cannot be reported separately. Track both self and inclusive instruction counts for every subprogram. Charge each processed instruction as self work to the current subprogram and to a path-local subtotal in its function frame. When a function returns, add the callee subtotal to its inclusive count and to its parent subtotal. Fold any remaining frames when a path terminates or is pruned. Instruction subtotals are accounting state, not semantic verifier state. Clear them when a verifier state is copied so work before a path fork is charged once, rather than again when a saved branch is explored. If copying a saved state fails before all frames are allocated, skip missing frames while folding the current path. This generic frame accounting also records self and inclusive totals when an asynchronous callback starts as a fresh frame-zero state. It does not yet charge that independently explored callback path back to the main or global exploration root which scheduled it. That will be done in subsequent changes. This does not change the verification statistics output format. It only prepares the counters for per-subprogram reporting. Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://patch.msgid.link/20260812221925.3358041-2-memxor@gmail.com Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-08-12PCI: Allow per function PCI slots to fix slot reset on s390Farhan Ali
On s390 systems, which use a machine level hypervisor, PCI devices are always accessed through a form of PCI pass-through which fundamentally operates on a per PCI function granularity. This is also reflected in the s390 PCI hotplug driver which creates hotplug slots for individual PCI functions. Its reset_slot() function, which is a wrapper for zpci_hot_reset_device(), thus also resets individual functions. Currently, the pci_create_slot() assigns the same pci_slot object to multifunction devices. This approach worked fine on s390 systems that only exposed virtual functions as individual PCI domains to the operating system. Since commit 44510d6fa0c0 ("s390/pci: Handling multifunctions") s390 supports exposing the topology of multifunction PCI devices by grouping them in a shared PCI domain. This creates a problem when resetting a function through the hotplug driver's slot_reset() interface. When attempting to reset a function through the hotplug driver, the shared slot assignment causes the wrong function to be reset instead of the intended one. It also leaks memory as we do create a pci_slot object for the function, but don't correctly free it in pci_slot_release(). Add a flag for struct pci_slot to allow per function PCI slots for functions managed through a hypervisor, which exposes individual PCI functions while retaining the topology. Since we can use all 8 bits for slot 'number' (for ARI devices), change slot 'number' u16 to account for special values PCI_SLOT_PLACEHOLDER and PCI_SLOT_ALL_DEVICES. Fixes: 44510d6fa0c0 ("s390/pci: Handling multifunctions") Suggested-by: Niklas Schnelle <schnelle@linux.ibm.com> Signed-off-by: Farhan Ali <alifm@linux.ibm.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Reviewed-by: Niklas Schnelle <schnelle@linux.ibm.com> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260805165518.794-3-alifm@linux.ibm.com
2026-08-12libie: add bookkeeping support for control queue messagesPhani R Burra
Small send control queue message buffers are managed and reused by libie itself, bigger send buffers are consumed. All are tracked with the unique transaction (Xn) ids until they receive response or time out. Responses can be received out of order, therefore transactions are stored in an array and tracked though a bitmap. Rx buffers utilize page_pool. Pre-allocated DMA memory is used where possible. It reduces the driver overhead in handling memory allocation/free and message timeouts. Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Signed-off-by: Phani R Burra <phani.r.burra@intel.com> Co-developed-by: Victor Raj <victor.raj@intel.com> Signed-off-by: Victor Raj <victor.raj@intel.com> Co-developed-by: Pavan Kumar Linga <pavan.kumar.linga@intel.com> Signed-off-by: Pavan Kumar Linga <pavan.kumar.linga@intel.com> Tested-by: Bharath R <bharath.r@intel.com> Tested-by: Samuel Salin <Samuel.salin@intel.com> Co-developed-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-08-12libie: add control queue supportPhani R Burra
Libie will now support control queue setup and configuration APIs. These are mainly used for mailbox communication between drivers and control plane. Make use of the libeth_rx page pool support for managing controlq buffers. Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Signed-off-by: Phani R Burra <phani.r.burra@intel.com> Co-developed-by: Victor Raj <victor.raj@intel.com> Signed-off-by: Victor Raj <victor.raj@intel.com> Co-developed-by: Sridhar Samudrala <sridhar.samudrala@intel.com> Signed-off-by: Sridhar Samudrala <sridhar.samudrala@intel.com> Co-developed-by: Pavan Kumar Linga <pavan.kumar.linga@intel.com> Signed-off-by: Pavan Kumar Linga <pavan.kumar.linga@intel.com> Tested-by: Samuel Salin <Samuel.salin@intel.com> Tested-by: Bharath R <bharath.r@intel.com> Co-developed-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-08-12libie: add PCI device initialization helpers to libiePhani R Burra
idpf and ixd drivers serve different PCI functions on the same device, therefore their PCI configuration flow is very similar. Add support functions for idpf and ixd to configure PCI functionality and access MMIO space. Add a mapping list which can be traversed by a driver, e.g. to pass certain I/O mappings to the auxbus devices. Such list is also traversed by the libie_pci_get_mmio_addr() helper, which allows for easier memory access. Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Signed-off-by: Phani R Burra <phani.r.burra@intel.com> Co-developed-by: Victor Raj <victor.raj@intel.com> Signed-off-by: Victor Raj <victor.raj@intel.com> Co-developed-by: Sridhar Samudrala <sridhar.samudrala@intel.com> Signed-off-by: Sridhar Samudrala <sridhar.samudrala@intel.com> Co-developed-by: Pavan Kumar Linga <pavan.kumar.linga@intel.com> Signed-off-by: Pavan Kumar Linga <pavan.kumar.linga@intel.com> Tested-by: Bharath R <bharath.r@intel.com> Tested-by: Samuel Salin <Samuel.salin@intel.com> Co-developed-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-08-12virtchnl: move virtchnl and virtchnl2 headers to 'include/linux/net/intel'Victor Raj
virtchnl2 headers will be used by both idpf and ixd drivers, so they have to be moved to an include directory. On top of that, it would be useful to place all iavf headers together with other intel networking headers. Move abovementioned intel header files into 'include/linux/net/intel'. While at it, remove the self-include from iavf_types.h. Suggested-by: Alexander Lobakin <aleksander.lobakin@intel.com> Reviewed-by: Sridhar Samudrala <sridhar.samudrala@intel.com> Signed-off-by: Victor Raj <victor.raj@intel.com> Tested-by: Samuel Salin <Samuel.salin@intel.com> Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-08-12PCI: Introduce PCI_SLOT_PLACEHOLDER constant for slot_nr placeholder valueFarhan Ali
Introduce a constant for placeholder value and update the kerneldoc for pci_create_slot() to reference PCI_SLOT_PLACEHOLDER instead of -1 throughout. No functional change. Suggested-by: Bjorn Helgaas <bhelgaas@google.com> Signed-off-by: Farhan Ali <alifm@linux.ibm.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Cc: Madhavan Srinivasan <maddy@linux.ibm.com> Cc: Tyrel Datwyler <tyreld@linux.ibm.com> Cc: linuxppc-dev@lists.ozlabs.org Link: https://patch.msgid.link/20260805165518.794-2-alifm@linux.ibm.com
2026-08-12bpf: Derive the atomic load register in one placeDaniel Borkmann
check_atomic_rmw() open codes the mapping from a BPF_ATOMIC to the register it reads the old value into, the BPF_STX case of insn_def_regno() open codes the very same mapping a second time, the const folding and the liveness transfer functions a third and a fourth time, and BPF JITs need it as well to know which register a faulting BPF_PROBE_ATOMIC has to clear. Add a small helper so that all of them can share it. No functional change. The BPF_LOAD_ACQ case is there for the JITs, which do walk all instruction classes. const_reg_xfer() loses its explicit BPF_ATOMIC mode test since the helper checks class and mode itself; the BPF_PROBE_ATOMIC it additionally accepts cannot be seen there as it is only set from bpf_do_misc_fixups(), that is, after const folding has run. arg_track_xfer() keeps its mode test since that also guards the stack clearing next to it. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://patch.msgid.link/20260811131600.506721-1-daniel@iogearbox.net Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-08-12cachefiles,netfs: sunset ondemand modeGao Xiang
It was an effort to enhance fscache as a kernel cache for lazy pulling (at least according to previous Incremental FS discussion [1]) and EROFS over fscache was the in-tree user of this mode. fscache has since evolved to be netfslib-oriented, serving network filesystem inodes via the netfs library, but EROFS never acts as a network filesystem and we need to cache golden filesystem images rather than individual EROFS inodes. Since EROFS over fscache is now removed, clean up netfs/fscache/ cachefiles upstream too. [1] https://lore.kernel.org/r/CAOQ4uxi4dzxArY24YO=+kBCK2gGoq3Ptb8WkzCqSogPgU_R3dQ@mail.gmail.com [dh] Fixed up comments on: https://sashiko.dev/#/patchset/20260716103030.3065561-1-dhowells%40redhat.com https://sashiko.dev/#/patchset/20260722130218.78958-1-dhowells%40redhat.com Signed-off-by: Gao Xiang <xiang@kernel.org> Signed-off-by: David Howells <dhowells@redhat.com> Link: https://patch.msgid.link/1046393.1786544127@warthog.procyon.org.uk cc: Paulo Alcantara <pc@manguebit.org> cc: netfs@lists.linux.dev cc: linux-erofs@lists.ozlabs.org cc: bpf@vger.kernel.org cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-08-12pipe: only enable the extra wake_up(rd_wait) for EPOLLET consumersOleg Nesterov
pipe_poll() unconditionally sets ->poll_usage on the first call, forcing anon_pipe_write() to wake up readers on every write even if the pipe was not empty. The reason is that some legacy epoll(EPOLLET) users depend on historical per-write wakeups, see commit 3a34b13a88ca ("pipe: make pipe writes always wake up readers"). Test-case: #include <unistd.h> #include <sys/epoll.h> #include <assert.h> int main(void) { int pfd[2], efd; struct epoll_event evt = { .events = EPOLLIN | EPOLLET }; pipe(pfd); efd = epoll_create1(0); epoll_ctl(efd, EPOLL_CTL_ADD, pfd[0], &evt); for (int i = 0; i < 2; ++i) { write(pfd[1], "", 1); assert(epoll_wait(efd, &evt, 1, 0) == 1); } return 0; } it fails if WRITE_ONCE(poll_usage, true) is removed from pipe_poll(). However, without EPOLLET in .events, it does not need the extra wakeup and succeeds even if write() is called only once before the main loop. Currently io_uring without (unsupported) IORING_POLL_ADD_LEVEL always sets EPOLLET, and in IORING_POLL_ADD_MULTI mode it depends on per-write wakeups the same way: #include <unistd.h> #include <sys/mman.h> #include <sys/epoll.h> #include <sys/syscall.h> #include <linux/io_uring.h> #include <assert.h> int main(void) { struct io_uring_params p = {}; int fd, pfd[2]; pipe(pfd); fd = syscall(SYS_io_uring_setup, 2, &p); assert(fd >= 0); void *ring = mmap(0, p.cq_off.cqes + p.cq_entries * sizeof(struct io_uring_cqe), PROT_READ | PROT_WRITE, MAP_SHARED, fd, IORING_OFF_SQ_RING); assert(ring != MAP_FAILED); *(unsigned *)(ring + p.sq_off.tail) = 1; struct io_uring_sqe *sqes = mmap(0, p.sq_entries * sizeof(*sqes), PROT_READ | PROT_WRITE, MAP_SHARED, fd, IORING_OFF_SQES); assert(sqes != MAP_FAILED); sqes[0].opcode = IORING_OP_POLL_ADD; sqes[0].fd = pfd[0]; sqes[0].len = IORING_POLL_ADD_MULTI; sqes[0].poll32_events = EPOLLIN; syscall(SYS_io_uring_enter, fd, 1, 0, 0, 0, 0); unsigned *cq_head = ring + p.cq_off.head; unsigned *cq_tail = ring + p.cq_off.tail; for (int i = 0; i < 2; ++i) { write(pfd[1], "", 1); syscall(SYS_io_uring_enter, fd, 0, 0, IORING_ENTER_GETEVENTS, 0, 0); assert(*cq_tail == ++*cq_head); } return 0; } the 2nd assert() in the main loop fails without ->poll_usage == true. Rename ->poll_usage to ->pseudo_edgetrigger to make the purpose clearer, update the comments, and change pipe_poll() to set ->pseudo_edgetrigger only if wait->_key & EPOLLET is true. This check should catch both users, and this way poll/select and epoll without EPOLLET users will not pay for the extra wakeup. Signed-off-by: Oleg Nesterov <oleg@redhat.com> Link: https://patch.msgid.link/anCNoW-x0bcB2ggg@redhat.com Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-08-12fs: document semantics of kstat::{uid,gid} fieldsJann Horn
The uid stored in struct kstat is logically a vfsuid; file systems initialize it by converting a kuid (filesystem perspective) to a vfsuid (mount perspective), then use vfsuid_into_kuid(), which essentially just typecasts from vfsuid to kuid. For now, just add a comment to note this mismatch between C type and semantic type. Below are some notes for anyone who wants to refactor this in the future. There are probably two options to refactor this away: 1. Change the type of kstat::uid to vfsuid_t, and perform the conversion from vfsuid to userspace-uid in the VFS layer. This wouldn't change machine code, just be more semantically correct. 2. Change the semantics of kstat::uid to really be a kuid_t, and let the VFS layer take care of doing the translation from kuid to vfsuid that is currently done in filesystem code (or in generic_fillattr, on behalf of the filesystem code). Option 2 is probably neater since it moves more logic into the generic VFS layer, and this is something that is expected to work the same way in all file systems? The following coccinelle script: ``` virtual context @@ struct kstat *stat; @@ * stat->uid @@ struct kstat *stat; @@ * stat->gid @@ struct kstat stat; @@ * stat.uid @@ struct kstat stat; @@ * stat.gid ``` detects 43 field accesses to these uid/gid fields. Signed-off-by: Jann Horn <jannh@google.com> Link: https://patch.msgid.link/20260803-vfs-comment-stat-uid-v1-1-162d062b737c@google.com Reviewed-by: Jan Kara <jack@suse.cz> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-08-11Merge tag 'qcom-clk-for-7.3' of ↵Stephen Boyd
https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into clk-qcom Pull Qualcomm clk driver updates from Bjorn Andersson: Add global, TCSR, RPMh, and video clock controller support for Maili. Add global, RPM, GPU, display, and audio core clock controller support for Shikra. Add display and graphics clock controllers for Nord. Add Glymur camera and EVA clock controllers, the IPQ9650 REFGEN clocks, and Hawi video clock controller support. Extend the IPQ5210 APSS PLL and RPM clock support for Agatti. Enable runtime PM and regulator-backed reference clock handling where needed. Update QCM2290 clock and power-domain handling, critical clock definitions, and arm architecture Kconfig defaults. Correct MDM9607, MSM8916, MSM8939, SM6115, QCS8300, Kaanapali, and Glymur clock and power-domain handling. Improve GDSC error propagation and teardown. Update bindings for the added controllers and required power and OPP properties. * tag 'qcom-clk-for-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (94 commits) clk: qcom: Add support for Qualcomm GPU Clock Controller on Shikra clk: qcom: Return expected ENOMEM error on dynamic allocation failure clk: qcom: apss-ipq-pll: Add IPQ5210 support dt-bindings: clock: qcom,a53pll: Add IPQ5210 compatible clk: qcom: Add support for videocc driver on Qualcomm Maili SoC dt-bindings: clock: qcom: Add Qualcomm Maili video clock controller dt-bindings: clock: qcom: Add Qualcomm Shikra GPU clock controller dt-bindings: clock: qcom: Add Qualcomm Shikra Display clock controller clk: qcom: gpucc-qcm2290: Park RCG's clk source at XO during disable clk: qcom: gpucc-qcm2290: Keep the critical clocks always-on from probe clk: qcom: gpucc-qcm2290: Move to the latest common qcom_cc_probe() model clk: qcom: gpucc-qcm2290: Drop pm_clk handling clk: qcom: qcm2290: Update DISPCC and GPUCC GDSC *wait_val values clk: qcom: qcm2290: Add RETAIN_FF_ENABLE flag for DISPCC and GPUCC GDSCs clk: qcom: qcm2290: Set POLL_CFG_GDSCR flag for DISPCC and GPUCC GDSCs clk: qcom: dispcc-qcm2290: Enable runtime PM support clk: qcom: dispcc-qcm2290: Move to the latest common qcom_cc_probe() model clk: qcom: gcc-qcm2290: Keep the critical clocks always-on from probe dt-bindings: clock: qcom,qcm2290-dispcc: Add missing power-domains property clk: qcom: Add Audio Core clock controller support on Qualcomm Shikra SoC ...
2026-08-11Merge tag 'clk-eyeq7h-7.3' of ssh://github.com/benoitmonin/linux into ↵Stephen Boyd
clk-mobileye Pull Mobileye clk driver updates from Benoît Monin: - Add support for Mobileye EyeQ7H This patchset brings the support of the Other Logic Blocks (OLB) found in the first Mobileye SoC based on the RISC-V architecture, the EyeQ7H. Despite the change from MIPS to RISC-V, the Other Logic Blocks provide similar clock and reset functions to the controllers of the chip. This series introduces the device tree bindings of the SoC and the necessary changes to the clock and reset eyeq drivers. Signed-off-by: Benoît Monin <benoit.monin@bootlin.com> * tag 'clk-eyeq7h-7.3' of ssh://github.com/benoitmonin/linux: clk: eyeq: Add EyeQ7H compatibles clk: eyeq: Drop PLL, dividers, and fixed factors structs clk: eyeq: Convert clocks declaration to eqc_clock clk: eyeq: Introduce a generic clock type clk: eyeq: Prefix the PLL registers with the PLL type clk: fixed-factor: Export __clk_hw_register_fixed_factor() clk: fixed-factor: Rework initialization with parent clocks reset: eyeq: Add EyeQ7H compatibles dt-bindings: soc: mobileye: Add EyeQ7H OLB
2026-08-11Merge tag 'renesas-clk-for-v7.3-tag1' of ↵Stephen Boyd
git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers into clk-renesas Pull Renesas clk driver updates from Geert Uytterhoeven: - Add RTC and display clocks on RZ/T2H and RZ/N2H - Add audio and display clocks and resets on RZ/G3E - Add SDHI, GPU, and USB2.0 clocks and resets on RZ/G3L - Update the maintainer for the VersaClock 7 driver - Add CAN-FD clocks and resets for RZ/G3S * tag 'renesas-clk-for-v7.3-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers: clk: r9a08g045: Add clocks and resets for CAN-FD dt-bindings: clock: renesas,versaclock7: Update maintainer clk: renesas: r9a09g047: Add LVDS clocks and resets clk: renesas: r9a09g077: Add LCDC and PLL3 clock support for RZ/T2H display pipeline clk: renesas: rzv2h-cpg: Extract PLL calculation helpers into shared library clk: renesas: rzv2h-cpg: Use per-SoC PLL reference frequency for calculations clk: renesas: r9a08g046: Add USB2.0 clock and reset entries clk: renesas: r9a09g077: Add RTC clocks clk: renesas: cpg-mssr: Implement dedicated MSTP delay logic for RZ/T2H LCDC and RTC clk: renesas: r9a08g046: Add clock and reset entries for GE3D clk: renesas: r9a08g046: Add clock and reset entries for SDHI clk: renesas: r9a09g047: Add audio clock and reset support dt-bindings: clock: renesas: Add audio clock inputs for RZ/V2H family dt-bindings: clock: renesas,r9a09g077/87: Add PCLKRTC clock ID dt-bindings: clock: renesas,r9a09g077/87: Add LCDC_CLKD clock ID
2026-08-11cgroup/cpuset: Remove obsolete PFA_SPREAD_SLAB task flagGuopeng Zhang
Commit 16a1d968358a ("mm/slab: remove mm/slab.c and slab_def.h") removed the SLAB allocator, the only allocator that implemented cpuset slab spreading. Commit 61a182ab61a6 ("cgroup/cpuset: Remove cpuset_do_slab_mem_spread()") then removed the last task_spread_slab() caller. Commit 3ab67a9ce82f ("cgroup/cpuset: Mark memory_spread_slab as obsolete") marked the legacy control obsolete. cpuset still updates PFA_SPREAD_SLAB when tasks attach to a legacy cpuset and walks all tasks in a cpuset when memory_spread_slab changes. Remove the unused task flag and its helpers, and make spread task updates depend only on memory_spread_page. Keep the memory_spread_slab control and CS_SPREAD_SLAB state so legacy users retain the existing write, readback and inheritance behavior. Update the comments and documentation to describe only page-cache spreading as functional. Assisted-by: LLM Signed-off-by: Guopeng Zhang <zhangguopeng@kylinos.cn> Reviewed-by: Waiman Long <longman@redhat.com> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-11PCI: Add support for PCIe WAKE# interruptKrishna Chaitanya Chundru
According to PCIe r7.0, sec 5.3.3.2, two link wakeup mechanisms are defined: Beacon and WAKE#. Beacon is a hardware-only mechanism and is invisible to software (sec 4.2.7.8.1). This change adds support for the WAKE# mechanism in the PCI core. According to the PCIe specification, multiple WAKE# signals can exist in a system or several components in the hierarchy may share a single WAKE# signal. In configurations involving a PCIe switch, each downstream port (DSP) of the switch may be connected to a separate WAKE# line, allowing each endpoint to signal WAKE# independently. From figure 5.4 in sec 5.3.3.2, WAKE# can also be terminated at the switch itself. Such topologies are typically not described in Device Tree, therefore it is out of scope for this series. To support this, the WAKE# should be described in the device tree node of the endpoint/bridge. If all endpoints share a single WAKE# line, then each endpoint node shall describe the same WAKE# signal or a single WAKE# in the Root Port node. In pci_device_add(), PCI framework will search for the WAKE# in device node. Once found, register for the wake IRQ through dev_pm_set_dedicated_wake_irq() associates a wakeup IRQ with a device and requests it, but the PM core keeps the IRQ disabled by default. The IRQ is enabled by the PM core, only when the device is permitted to wake the system, i.e. during system suspend and after runtime suspend, and only when device wakeup is enabled. If the same WAKE# GPIO is described in multiple device tree nodes, only the first device that successfully registers the wake IRQ will succeed, while subsequent registrations may fail. This limitation does not affect functional correctness, since WAKE# is only used to bring the link to D0, and endpoint-specific wakeup handling is resolved later through PME detection (PME_EN is set in suspend path by PCI core by default). When the wake IRQ fires, the wakeirq handler invokes pm_runtime_resume() to bring the device back to an active power state, such as transitioning from D3cold to D0. Once the device is active and the link is usable, the endpoint may generate a PME, which is then handled by the PCI core through PME polling or the PCIe PME service driver to complete the wakeup of the endpoint. WAKE# is added in dts schema and merged based on below links. Link: https://lore.kernel.org/all/20250515090517.3506772-1-krishna.chundru@oss.qualcomm.com/ Link: https://github.com/devicetree-org/dt-schema/pull/170 Signed-off-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Acked-by: Manivannan Sadhasivam <mani@kernel.org> Link: https://patch.msgid.link/20260707-wakeirq_support-v12-1-b4453f5bcc97@oss.qualcomm.com
2026-08-11of: reserved_mem: Introduce devres-managed initialization functionKonrad Dybcio
Introduce devres-based helper for of_reserved_mem_device_init() to help fight dangling references and ever so slightly reduce the number of boilerplate deinitialization calls. Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com> Link: https://patch.msgid.link/20260730073214.1146432-1-mukesh.ojha@oss.qualcomm.com Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2026-08-11ASoC: amd: enable audio on HP OmniBook X Flip 14Mark Brown
Ville Saarinen <wiza@saarinenkoti.fi> says: The HP OmniBook X Flip 14-kc0xxx (board 8EA1, Strix Point, ACP 7.2) has no usable audio on mainline at all. Its BIOS reports an ACP configuration flag of FLAG_AMD_LEGACY_ONLY_DMIC, which binds the legacy ACP driver and registers a PDM-only card, so the SoundWire links are never scanned. The two TAS2783 speaker amplifiers on link 0 and the RT712-VB jack codec on link 1 never enumerate, and the machine has no playback path whatsoever. Patch 1 adds a DMI quirk overriding the flag so snd_pci_ps probes. Patch 2 adds the machine entry describing the link topology. With both applied the card comes up and every path on the machine works: internal speakers, headphone jack with detection, headset microphone and the internal DMIC array. Two further patches are needed for the speakers to render stereo rather than mono, and to survive a system resume; those are in the TAS2783 codec driver and are being sent separately to the TI maintainers, since they have no build dependency on this pair. Related reports for the same root cause on other machines: - kernel bugzilla #221226 (ASUS Zenbook S16) - CachyOS linux-cachyos#820 (HP OmniBook X Flip 16, board 8EA2 -- the sibling board, which would need its own entry; I have no access to one and have not added it) Tested on the affected machine only. I do not have any other ACP 7.2 board, so the gating on patch 2 is written to be conservative rather than broad. Testing ======= The hardware testing was done on v7.1.6, where an equivalent version of this pair is what makes audio work on the machine. Against the master commit named below, both patches have been compile-tested only (gcc, W=1, no new warnings, no new external symbol references). Patch 2 has been reworked slightly relative to the tested build: the RT712-VB entry now reuses the existing jack_dmic_endpoints array, which already describes exactly the AIF1 jack + AIF3 DMIC pairing this board needs, instead of adding a second identical copy of it. That was a mechanical substitution, but it has not been through hardware. Tool disclosure, per Documentation/process/generated-content.rst ================================================================ This work was done in extended interactive sessions with Claude (Anthropic, model claude-opus-5) acting as a coding and debugging assistant, and a substantial amount of the analysis and of the patch text originated with it. Both patches carry an Assisted-by tag as described in Documentation/process/coding-assistants.rst. The division of work: - The assistant read the DMI data and ACP configuration flag off the running machine, identified the flag override as the fix, derived the SoundWire topology from the enumerated peripherals, and drafted both patches and both changelogs. - I ran everything that needed root or physical access, rebooted into each build, and did the listening tests. The left/right ordering in patch 2 is set by the order of the two amplifier entries; the first version had the sides reversed and that was caught by ear, not by the assistant. - No single prompt generated these patches. The session was iterative over roughly a day: inspect state, form a hypothesis, build, reboot, measure, discard the hypothesis if the measurement disagreed. Several confident intermediate conclusions were wrong and were only caught by measurement. I have reviewed both patches, I understand what they do, and I take responsibility for them. Link: https://patch.msgid.link/20260809101439.4798-1-wiza@saarinenkoti.fi
2026-08-11timekeeping: Use u32 for clock_was_set_seqThomas Weißschuh (Schneider Electric)
Use an explicitly sized type to make the code a bit more consistent with other fields of the datastructure and other sequence counters. Signed-off-by: Thomas Weißschuh (Schneider Electric) <thomas.weissschuh@linutronix.de> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260803-auxclock-nanosleep-prep-v2-2-910cbd485390@linutronix.de
2026-08-11timekeeping: Rename clockid_aux_valid() to clockid_is_aux_clock()Thomas Weißschuh (Schneider Electric)
The current name is not clear about its behavior. Rename it. Signed-off-by: Thomas Weißschuh (Schneider Electric) <thomas.weissschuh@linutronix.de> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260803-auxclock-nanosleep-prep-v2-1-910cbd485390@linutronix.de
2026-08-11timekeeping: Annotate auxiliary clock accessors with __must_checkThomas Weißschuh (Schneider Electric)
In contrast to the system time accessors, the ones for auxiliary clocks can fail. Make sure the callers check for this. Signed-off-by: Thomas Weißschuh (Schneider Electric) <thomas.weissschuh@linutronix.de> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260731-timekeeping-aux-must-check-v1-2-11ae93068497@linutronix.de
2026-08-11timekeeping: Remove the unused ktime_get_clock_ts64()Thomas Weißschuh (Schneider Electric)
The last user was removed in commit a6d799608e6a ("ptp: Switch to ktime_get_snapshot_id() for pre/post timestamps"). Signed-off-by: Thomas Weißschuh (Schneider Electric) <thomas.weissschuh@linutronix.de> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260731-timekeeping-aux-must-check-v1-1-11ae93068497@linutronix.de
2026-08-11Merge branches 'arm/smmu/updates', 'arm/smmu/bindings', 'mediatek', ↵Joerg Roedel
'qualcomm/msm', 'rockchip', 'ti/omap', 'riscv', 'intel/vt-d', 'amd/amd-vi', 'core' and 'typos' into next
2026-08-10Merge branch 'master' of ↵Tejun Heo
git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next into for-7.3-arena-args Pull bpf-next d114bb989367 ("Merge branch 'add-arena-argument-support-to-kfuncs-and-struct_ops'") to make the __arena and __arena__nullable kfunc and struct_ops argument suffixes available. The suffixed arguments will be used to convert sched_ext kfuncs and struct_ops callbacks that currently pass arena pointers as scalars and rebase them by hand.
2026-08-10Merge tag 'samsung-soc-7.3' of ↵Arnd Bergmann
https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/arm Samsung mach/soc changes for v7.3 Two minor cleanups: 1. Replace __ASSEMBLY__ with __ASSEMBLER__ in headers to have consistency with what compilers define. 2. Drop redundant mailing lists from Samsung MAINTAINERS entries (less code). * tag 'samsung-soc-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: MAINTAINERS: Drop redundant lists from various Samsung entries ARM: s3c: Replace __ASSEMBLY__ with __ASSEMBLER__ in header files Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-08-10spi: spi-mem: Flag DQS capabilityMiquel Raynal
DQS is a typical SPI memory signal used to help with reading the data on the bus at high speeds (especially in DTR mode) by avoiding clock skews. The chip generates a clock signal synchronized with its data output fronts, also called data strobe. SPI NOR and SPI NAND cores must set this flag in order to indicate to other layers that DQS is available. Create a getter and a setter to reach this capability. Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com> Link: https://patch.msgid.link/20260810-winbond-nand-next-phy-tuning-v3-1-a97c3a61e675@bootlin.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-10nmi: Export CPU backtrace APIs for loadable modulesMayank Rungta
Currently, CPU backtrace functions cannot be called from loadable modules because the underlying helper arch_trigger_cpumask_backtrace() is not exported. Instead of exporting arch_trigger_cpumask_backtrace() individually across every supported architecture, introduce and export a common helper, cpumask_backtrace(), in lib/nmi_backtrace.c. Update the four inline CPU backtrace macros in include/linux/nmi.h to route through this centralized helper. Signed-off-by: Mayank Rungta <mrungta@google.com> Reviewed-by: Douglas Anderson <dianders@chromium.org> Reviewed-by: Andrew Morton <akpm@linux-foundation.org> Link: https://lore.kernel.org/r/20260730-export-cpu-backtrace-apis-v1-1-bace8e1cb817@google.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-08-10hwmon: (sysfs) Allow drivers to register const attributesThomas Weißschuh
Switch to the __DEVICE_ATTR() macro which can handle callbacks taking both const and non-const attribute structure arguments. Allow the step-wise migration of the drivers. Also use container_of_const() over container_of() to avoid casting away the constness accidentally. Signed-off-by: Thomas Weißschuh <linux@weissschuh.net> Link: https://lore.kernel.org/r/20260806-sysfs-const-attr-hwmon-v2-3-22fee8b85509@weissschuh.net [groeck: Squashed 'hwmon: (core) Constify PEC device attribute'] Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-08-10tick: Include ktime.h and jiffies.h in linux/tick.hKarl Mehltretter
The !CONFIG_NO_HZ_COMMON stubs use ktime_add(), ktime_get() and TICK_NSEC, but tick.h includes neither <linux/ktime.h> nor <linux/jiffies.h>. Most configurations build only because those declarations arrive transitively. Commit 6440966067dc ("cpuset: Remove cpuset_cpu_is_isolated()") removed <linux/cpuset.h> from <linux/sched/isolation.h>. The <linux/cpuset.h> include chain had been satisfying these declarations before <linux/tick.h> was parsed. Commit 8aa76aa41589 ("ring-buffer: Use a housekeeping CPU to wake up waiters") then added <linux/sched/isolation.h> to ring_buffer.c ahead of any header which provides them. Neither change is wrong on its own: the failure requires both and appeared in v7.0. ARM rpc_defconfig + CONFIG_FUNCTION_TRACER fails to build: $ make ARCH=arm rpc_defconfig $ ./scripts/config -e FTRACE -e FUNCTION_TRACER $ make ARCH=arm olddefconfig $ make ARCH=arm kernel/trace/ring_buffer.o In file included from include/linux/sched/isolation.h:6, from kernel/trace/ring_buffer.c:8: include/linux/tick.h: In function 'tick_nohz_get_next_hrtimer': include/linux/tick.h:156:9: error: implicit declaration of function 'ktime_add'; did you mean 'size_add'? include/linux/tick.h:156:19: error: implicit declaration of function 'ktime_get'; did you mean 'time_init'? include/linux/tick.h:156:32: error: 'TICK_NSEC' undeclared Include the headers the file actually uses. Fixes: 8aa76aa41589 ("ring-buffer: Use a housekeeping CPU to wake up waiters") Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Assisted-by: Codex:gpt-5.6-sol Link: https://patch.msgid.link/20260722062141.19671-1-kmehltretter@gmail.com
2026-08-10sunrpc: remove unused svc_version vs_count fieldJeff Layton
Now that svc_seq_show() and the nfsd netlink stats handler both use the per-netns svc_stat vs_count arrays, the global per-version vs_count percpu counters are no longer read by anything. Remove the vs_count field from struct svc_version and all the associated DEFINE_PER_CPU_ALIGNED arrays and initializers across nfsd, lockd, and the NFS client callback service. Assisted-by: LLM Signed-off-by: Jeff Layton <jlayton@kernel.org> Link: https://patch.msgid.link/20260717-exportd-netlink-v7-4-b7ce17b83b60@kernel.org Signed-off-by: Chuck Lever <cel@kernel.org>
2026-08-10sunrpc: add per-netns per-procedure call counts to svc_statJeff Layton
The existing per-procedure call counts live in global svc_version->vs_count[] arrays which are not network-namespace-aware. Add per-netns equivalents in struct svc_stat so the upcoming netlink stats interface can return namespace-scoped statistics. Add a vs_count pointer array to struct svc_stat, along with svc_stat_alloc_counts() and svc_stat_free_counts() helpers to manage per-version percpu call count arrays. Increment the per-net counter alongside the global one in svc_generic_init_request(). Call the alloc/free helpers from nfsd_net_init() and nfsd_net_exit(). Assisted-by: LLM Signed-off-by: Jeff Layton <jlayton@kernel.org> Link: https://patch.msgid.link/20260717-exportd-netlink-v7-1-b7ce17b83b60@kernel.org Signed-off-by: Chuck Lever <cel@kernel.org>
2026-08-10xdrgen: Add XDR width macros for short integer typesChuck Lever
Commit ae78eb497868 ("xdrgen: Implement short (16-bit) integer types") taught the generator to emit XDR_short and XDR_unsigned_short in the computed maxsize macros and added the matching encode and decode primitives to _builtins.h, but it left the two width macros themselves undefined in _defs.h. Define XDR_short and XDR_unsigned_short, each one XDR unit wide, to match the width the generator's maxsize table assigns them. Fixes: ae78eb497868 ("xdrgen: Implement short (16-bit) integer types") Link: https://patch.msgid.link/20260712193122.116845-5-cel@kernel.org Signed-off-by: Chuck Lever <cel@kernel.org>
2026-08-10xdrgen: Share void RPC procedure handlers across programsChuck Lever
The generated server-side decoder and encoder for a void procedure argument or result are named after the RPC program (for example, nfs_svc_decode_void). xdrgen derives that prefix from the program name alone, not the version, so two versions of one program built into the same module emit the identical symbol. NFSv2 and NFSv3 both declare program NFS_PROGRAM; once both are converted, fs/nfsd fails to link with multiple definitions of nfs_svc_decode_void and nfs_svc_encode_void. A void handler carries no program- or version-specific behavior: each merely forwards to xdrgen_decode_void() or xdrgen_encode_void(). Define one shared pair, xdrgen_svc_decode_void() and xdrgen_svc_encode_void(), in the xdrgen builtins, and stop the program generator from emitting a per-program void handler. lockd is the one in-tree consumer that already emits per-program void handlers, so regenerate the NLMv3 and NLMv4 XDR code to drop nlm_svc_{decode,encode}_void() and nlm4_svc_{decode,encode}_void() and point both procedure tables at the shared handlers. The shared handlers are identical to the generated ones they replace, so no wire behavior changes. Only the server (svc) handlers are affected. The client-side void stubs remain static and per-program, so they do not collide. Link: https://patch.msgid.link/20260712193122.116845-3-cel@kernel.org Signed-off-by: Chuck Lever <cel@kernel.org>
2026-08-10xdrgen: Emit a blank line ahead of enum declarationsChuck Lever
Clean up. The declaration templates for structs, pointers, and typedefs each begin with a blank line, which keeps successive declarations and the include block above them visually separated. The enum declaration template omits that blank line. trim_blocks collapses the template's lone comment line to nothing, so the omission stayed invisible as long as every generated header happened to lead with a non-enum declaration. Fixes: 4329010ad9c3 ("xdrgen: Address some checkpatch whitespace complaints") Link: https://patch.msgid.link/20260712193122.116845-2-cel@kernel.org Signed-off-by: Chuck Lever <cel@kernel.org>
2026-08-10sunrpc: derive the pool count instead of caching it in sv_nrpoolsJeff Layton
Now that the pool mode is always pernode, svc_serv.sv_nrpools is redundant with sv_is_pooled: an unpooled service always has a single pool, and a pooled service has svc_pool_map.npools pools (which is one on a single-node host). sv_nrpools cannot distinguish an unpooled service from a pooled service that happens to have one pool, so it is sv_nrpools, not sv_is_pooled, that carries no unique information. Replace the cached field with a svc_serv_nrpools() helper that derives the count from sv_is_pooled and the pool map, and convert all readers to it. svc_pool_map is file-local to svc.c, so export the helper for the svc_xprt.c and nfsd callers. Reading svc_pool_map.npools without svc_pool_map_mutex is safe: the mutex protects only svc_pool_map.count, and npools is already read locklessly in svc_pool_for_cpu(). A pooled service holds a map reference for its whole lifetime, so npools is stable while any reader could observe it. The hot path (svc_pool_for_cpu()) already dereferences svc_pool_map for to_pool, and npools shares that cacheline, so there is no new locking or coherence cost. __svc_create() keeps using its local npools argument for the sv_pools[] allocation, since sv_is_pooled is not set until svc_create_pooled() has returned from it. Doing this also removes a modulus operation from svc_pool_for_cpu(), which should make for more efficient RPC queueing. Assisted-by: Claude:claude-opus-4-8 Suggested-by: NeilBrown <neilb@ownmail.net> Signed-off-by: Jeff Layton <jlayton@kernel.org> Link: https://patch.msgid.link/20260706-sunrpc-pool-mode-v5-5-6c4ee7cd89aa@kernel.org Signed-off-by: Chuck Lever <cel@kernel.org>
2026-08-10lockd: Regenerate NLMv4 XDR codeChuck Lever
The checked-in NLMv4 xdrgen output predates the addition of enum value validation to generated decoders. As a result the decoders for fsh4_mode, fsh4_access, and nlm4_stats still accept any 32-bit value, while the current generator rejects values outside the enumeration. Resync the generated files with the in-tree xdrgen by regenerating from the unchanged nlm4.x specification. This is a plain regeneration with no specification change; it also refreshes the recorded specification modification time to show that all existing enum decoders have picked up the xdrgen tool fix. Reviewed-by: Jeff Layton <jlayton@kernel.org> Link: https://patch.msgid.link/20260630155638.874492-1-cel@kernel.org Signed-off-by: Chuck Lever <cel@kernel.org>
2026-08-10nfs_common: add new NOTIFY4_* flags proposed in RFC8881bisJeff Layton
RFC8881bis adds some new flags to GET_DIR_DELEGATION that later patches will consume. In particular, Linux nfsd can't easily provide info about directory cookies and ordering. The new flags allow it to omit that information. There is some risk here -- RFC8881bis is still a working group document, and has been for years. The changes to directory delegations have been stable for the last year or so however, so the hope is that those parts won't change (much). Signed-off-by: Jeff Layton <jlayton@kernel.org> Link: https://patch.msgid.link/20260616-dir-deleg-v7-3-6cbc7eac0ade@kernel.org Signed-off-by: Chuck Lever <cel@kernel.org>
2026-08-10nfsd: add protocol support for CB_NOTIFYJeff Layton
Add the necessary bits to nfs4_1.x and remove the duplicate definitions from nfs4.h and the uapi nfs4 header. Regenerate the xdr files. Note that regenerating these files caused conflicts with the definitions of NFS4_VERIFIER_SIZE and NFS4_FHSIZE in include/uapi/linux/nfs4.h. These constants are defined by the RFC, and are not part of the kernel API. They have been removed. Userspace consumers who require those constants should plan to get them from more authoritative sources. The nfsstat4 enum defined in the .x is fed to the xdrgen-generated wire encoder and decoder, which treat every enumerated value as legal on the wire. Do not carry the NFS4ERR_FIRST_FREE sentinel (which is not a protocol error code) into the .x; keeping it would make 10097 a value that could leak onto the wire. Instead base nfsd's internal error codes (NFSERR_EOF and friends) at an impossible nfsstat4 value, as lockd does for its nlm__int__* status codes. Signed-off-by: Jeff Layton <jlayton@kernel.org> Link: https://patch.msgid.link/20260616-dir-deleg-v7-2-6cbc7eac0ade@kernel.org Signed-off-by: Chuck Lever <cel@kernel.org>
2026-08-10lockd, nfsd: RCU-protect nlmsvc_ops dispatchJeff Layton
nlmsvc_ops is published by nfsd_lockd_init() and cleared by nfsd_lockd_shutdown() with plain stores, while lockd dereferences it unguarded from dispatch sites in fs/lockd/svcsubs.c. The pointer targets nfsd's .rodata and the fopen/fclose callbacks live in nfsd's .text, so a stale load after rmmod nfsd results in either a NULL deref or a module-text use-after-free. Declare nlmsvc_ops as __rcu, publish via rcu_assign_pointer(), clear via RCU_INIT_POINTER() + synchronize_rcu(). Add a struct module *owner field to nlmsvc_binding and pin the module across indirect calls with try_module_get/module_put. When the binding is torn down, fall back to fput() to avoid leaking struct file references. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Jeff Layton <jlayton@kernel.org> Link: https://patch.msgid.link/20260611-nfsd-testing-v2-16-5b90e276f2d9@kernel.org Signed-off-by: Chuck Lever <cel@kernel.org>
2026-08-10SUNRPC: Add svc_serv_maxthreads() to report the thread ceilingChuck Lever
A pooled RPC service sizes its threads dynamically, growing and shrinking each pool between its minimum and maximum bounds as load varies. The count of running threads therefore reflects recent demand, not the service's capacity. A consumer that sizes a data structure against the concurrency the service can sustain -- NFSD's NFSv4 session slot tables, for one -- needs that stable ceiling, and computing it means summing sp_nrthrmax across every pool. Add svc_serv_maxthreads() so the summation, and its dependence on the layout of struct svc_serv and struct svc_pool, stays within sunrpc. The read is lock-free: pool maxima change only when a service is reconfigured, a path callers already serialize against startup and shutdown, so a racing reader observes at worst a transient value. This is acceptable for the sizing heuristics that will consume it. nfsd_nrthreads() already sums sp_nrthrmax across pools by hand; convert it to svc_serv_maxthreads(), giving the new export an in-tree consumer and removing a copy of the dependence on svc_serv internals. Reviewed-by: NeilBrown <neil@brown.name> Reviewed-by: Jeff Layton <jlayton@kernel.org> Reviewed-by: Benjamin Coddington <bcodding@hammerspace.com> Link: https://patch.msgid.link/20260610-nfsd-slot-growth-clamp-v1-1-7b966700df0b@kernel.org Signed-off-by: Chuck Lever <cel@kernel.org>
2026-08-10SUNRPC: close backchannel before destroying callback serviceChuck Lever
A backchannel receive can complete a request while the NFS callback service is being torn down. xprt_complete_bc_request() removes the request from bc_pa_list, drops bc_alloc_count, marks the request in use, and then asks xprt_enqueue_bc_request() to hand it to the callback service. If teardown has already cleared xprt->bc_serv, xprt_enqueue_bc_request() currently returns without enqueueing or freeing the committed request. The xprt_get() taken on entry is leaked as well. If the producer wins the race before bc_serv is cleared, it can also enqueue onto sv_cb_list after nfs_callback_down() has stopped the callback threads, leaving the request linked to a svc_serv that is about to be freed. Close the producer side before callback threads are stopped. Add xprt_svc_shutdown_bc() to clear xprt->bc_serv under bc_pa_lock, and call it on callback shutdown and callback-start failure before stopping the service threads. Requests that lose the NULL transition in xprt_enqueue_bc_request() are released through the normal backchannel free path after balancing bc_slot_count. Finally, drain any remaining sv_cb_list requests after the callback threads have stopped and before svc_destroy() frees the service. Fixes: 441244d4273a ("SUNRPC: cleanup common code in backchannel request") Fixes: 9e9fdd0ad0fb ("NFSv4.1: protect destroying and nullifying bc_serv structure") Cc: stable@vger.kernel.org Signed-off-by: Chris Mason <clm@meta.com> Reviewed-by: Jeff Layton <jlayton@kernel.org> Link: https://patch.msgid.link/20260528-tier2-v1-6-d026a1415e0b@oracle.com Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
2026-08-10netfilter: flowtable: rename tun.l3_proto to tun.inner_protoPablo Neira Ayuso
This field refers to the inner protocol that is encapsulated by the tunnel header, just a comestic change. No functional changes are expected. Acked-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2026-08-10net: netfilter: add ether_type to net_device_path_ctx and use itPablo Neira Ayuso
Add an ether_type field to struct net_device_path_ctx to reject IPv4 over IPv6 and vice-versa, this is currently not support. Otherwise, incorrect dst_entry family can be reached from datapath. Acked-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2026-08-10net: pass net_device_path_ctx to dev_fill_forward_path()Lorenzo Bianconi
Refactor dev_fill_forward_path() to take a struct net_device_path_ctx pointer instead of a (dev, daddr) pair, so the caller can build and populate the context up front and keep it after the forward path walk. This allows additional fields (e.g. vlan and ether_type) to be carried in the context and shared with ndo_fill_forward_path implementations, instead of being reconstructed on the stack inside the core helper. Update the mtk_ppe_offload, airoha_ppe and nf_flow_table_path callers to allocate and fill the context before invoking dev_fill_forward_path(). The network topology resolution behaviour is unchanged. This is a preliminary patch to enable HW flowtable offload for IPv4 over IPv6 tunnels. Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@oss.qualcomm.com> Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>