Changes in Makefile

67f8bc848ee31831336bd478e57d2f993551902e - Merge drm/drm-fixes into drm-misc-fixes

Tue, 01 Sep 2026 09:38:51 +0200

Merge drm/drm-fixes into drm-misc-fixesLet's start the 7.3 drm-misc-fixes cycle.Signed-off-by: Maxime Ripard List of files: /linux/fs/Makefile

b2128290c29902315e632ea59e0504d6bc9e9b42 - Merge remote-tracking branch 'drm/drm-next' into msm-next-backmerge

Sat, 18 Jul 2026 17:06:55 +0200

Merge remote-tracking branch 'drm/drm-next' into msm-next-backmergeBackmerge of drm-next, mainly to pick up dt bindings docs updates toavoid conflicts.Signed-off-by: Rob Clark List of files: /linux/fs/Makefile

637315cb400eed1dbe721954fea437a61a2d65b2 - Merge tag 'kvm-riscv-7.3-1' of https://github.com/kvm-riscv/linux into HEAD

Tue, 18 Aug 2026 13:07:31 +0200

Merge tag 'kvm-riscv-7.3-1' of https://github.com/kvm-riscv/linux into HEADKVM/riscv changes for 7.3- Svadu/Zicfiss/Zicfilp FWFT support for Guest- Use try_cmpxchg for IMSIC MRIF RMW- More arch-specific tracepoints in KVM RISC-V- Eager Page Splitting for KVM RISC-V- Optimize hfence request handling for SMP Guests- Improve dirty log clearing by skipping zero bits in mask- Guard HFENCE range loops against overflow- CPU PM notifiers in KVM RISC-V for non-retentive idle states- Fix kernel-mode vector context save/restore for Guest List of files: /linux/fs/Makefile

efe86f088f48f18c27b648e5724048947f3b7fb4 - Merge drm/drm-next into drm-xe-next

Tue, 14 Jul 2026 15:40:31 +0200

Merge drm/drm-next into drm-xe-nextSync some i915/display changesSigned-off-by: Rodrigo Vivi List of files: /linux/fs/Makefile

6d177908bad5992e17669030db41caab88041d5e - Merge drm/drm-next into drm-intel-next

Tue, 30 Jun 2026 14:55:43 +0200

Merge drm/drm-next into drm-intel-nextSync with v7.2-rc1.Signed-off-by: Jani Nikula List of files: /linux/fs/Makefile

827b9aabd3ea3e96d5e48abed9f44dbd1e550d4e - Merge drm/drm-next into drm-misc-next

Tue, 30 Jun 2026 10:16:00 +0200

Merge drm/drm-next into drm-misc-nextBackmerging to get drm-misc-next to v7.2-rc1.Signed-off-by: Thomas Zimmermann List of files: /linux/fs/Makefile

7dd19adaaac9a161723a24de7c270861063ec6ac - Merge tag 'v7.2-rc1' into drm-rust-next

Sun, 28 Jun 2026 22:39:43 +0200

Merge tag 'v7.2-rc1' into drm-rust-nextMerge v7.2-rc1 into drm-rust-next to start the next cycle.Devres now requires T: 'static, which conflicts with shmem::Object usingDevres> without that bound. Resolve by adding 'staticas a supertrait to DriverObject and DeviceContext, which does notrestrict any current use cases since DriverObject is always implementedon owned, refcounted types and DeviceContext is a sealed marker traitwith only unit-type implementors.If DriverObject (or DeviceContext) ever becomes lifetime-parameterized(e.g. via a GAT for TTM backed objects), the 'static supertrait can berelaxed at that point.Signed-off-by: Danilo Krummrich List of files: /linux/fs/Makefile

3d5e48944e824bddc20d7b874e784f7b279636fe - Merge branch 'for-7.3/steam' into for-linus

Wed, 19 Aug 2026 09:16:28 +0200

Merge branch 'for-7.3/steam' into for-linus- initial support for 2026 Steam Controller (Vicki Pfau)- support for sensor events on the 2025 Steam Controller (Vicki Pfau)- assorted fixes, improvements and code refactoring (Vicki Pfau) List of files: /linux/fs/Makefile

0eaed89c18aeedf0898baf2dbf5ff027c6795152 - Merge tag 'timers-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/daniel.lezcano/linux into timers/clocksource

Mon, 17 Aug 2026 10:29:52 +0200

Merge tag 'timers-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/daniel.lezcano/linux into timers/clocksource - Use designated initializers for sh_mtu2, sh_cmt, and sh_tmu, and drop the unused initializer in the platform_device_id table for sh_mtu2 (Uwe Kleine-König) - Remove redundant dev_err()/dev_err_probe() messages when devm_request_*_irq() fails, as the helper already logs an error message (Pan Chuang) - Fix a boot hang on Allwinner D1 when a forced minimum delta is used with the sun4i timer (Felix Yan) - Fix an IRQ leak in the cpuhp_setup_state() error path by freeing the IRQ on failure in the NXP PIT driver (WenTao Liang) - Fix incorrect unmapping of shared MMIO between the clocksource and clockevent drivers. If one of them fails to initialize, the error path unmaps the shared MMIO region, leaving the other driver with an invalid mapping on clps711x (Guangshuo Li) - Make the samsung_pwm driver compatible with PREEMPT_RT by replacing regular spinlocks with raw_spinlock_t in atomic contexts (Marek Szyprowski) - Use __raw_readl() and __raw_writel() instead of ioread32() and iowrite32() to support SWAP_IO_SPACE in the rtl-otto driver (Rustam Adilov) - Fix a missing clk_disable_unprepare() call in the timer initialization error path of the Armada driver (Yuho Choi)Link: https://lore.kernel.org/lkml/75feea31-683d-45a1-87f4-ab045e0152ae@oss.qualcomm.com List of files: /linux/fs/Makefile

b4d85f863e5a6f1fa01b186001af0f68f4f5239e - Merge branch 'next' into for-linus

Sat, 15 Aug 2026 06:26:07 +0200

Merge branch 'next' into for-linusPrepare input updates for 7.3 merge window. List of files: /linux/fs/Makefile

76904fccf81936c084faebc73ac72c0919a42941 - Merge tag 'v7.2-rc3' into next

Tue, 14 Jul 2026 04:06:00 +0200

Merge tag 'v7.2-rc3' into nextSync up with mainline to pull in stable fixes to avoid merge conflicts. List of files: /linux/fs/Makefile

cd051cfe1e35a471fc2cdf6d32fae6ee23305ecb - Merge tag 'vfs-7.3-rc1.failfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Mon, 17 Aug 2026 18:15:52 +0200

Merge tag 'vfs-7.3-rc1.failfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfsPull failfs filesystem from Christian Brauner: "Add failfs and expose a FD_FAILFS_ROOT sentinel. This allows userspace to shed their filesystem state completely. A process with its root or working directory in failfs must anchor every path lookup at an explicit file descriptor. Absolute paths, absolute symlinks and AT_FDCWD-relative lookups simply fail. Failfs is the counterpart to nullfs. nullfs says adds a permanently empty, immutable directory whose lookups fail with ENOENT but which can be opened, read, stat'd and mounted upon. Failfs on the other hand fails every operation. The root cannot be opened at all. A single instance is mounted during early boot via kern_mount(), which makes it logically distinct from every mount namespace. This is accompanied by a new fchroot() system call which makes chrooting via a file descriptor a first class concept. It's possible to chroot into failfs as an unprivileged user provided the task has no new privileges set"* tag 'vfs-7.3-rc1.failfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: Documentation: add failfs documentation selftests/filesystems: add failfs selftests arch: hookup fchroot() system call fs: support FD_FAILFS_ROOT in fchroot() fs: add fchroot() fs: support FD_FAILFS_ROOT in fchdir() fs: add failfs List of files: /linux/fs/Makefile

d31a688a49a82a48e0434aee9d851e094270a6ee - Merge tags 'vfs-7.3-rc1.efs' and 'vfs-7.3-rc1.freevxfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Mon, 17 Aug 2026 17:55:58 +0200

Merge tags 'vfs-7.3-rc1.efs' and 'vfs-7.3-rc1.freevxfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfsPull efs and freevxfs removal from Christian Brauner: "This removes the EFS and freevxfs filesystems: - EFS was the read-only on-disk format SGI used on IRIX before XFS - freevxfs provided compatibility with various old-school Unix systems from the 1990s and was fun 25 years ago. Today it mostly serves as fodder for automated bug checkers. There has been only one known user and contributor in the last 15 years"* tag 'vfs-7.3-rc1.efs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: efs: Remove EFS* tag 'vfs-7.3-rc1.freevxfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: freevxfs: remove the driver List of files: /linux/fs/Makefile

b9cba7ebfe539f3e4bbdd03a1e0efa3b30b3f592 - Merge tag 'vfs-7.3-rc1.binfmt' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Mon, 17 Aug 2026 17:35:25 +0200

Merge tag 'vfs-7.3-rc1.binfmt' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfsPull binfmt updates from Christian Brauner: "This contains a bunch of work for binfmt_misc. It fixes a bunch of old bugs, reworks the locking, and then extends the format registry so a binary type can be matched programmatically and its interpreter computed per exec instead of being a fixed string recorded at registration time. This allows nixos and other to e.g., implement relocatable binaries meaning the interpreter/dynamic loader can be determined programatically, say found relative to the binary. The mechanism is flexible and can support other policies: - Handler lookup is now an rcu walk. An exec that matches no binfmt_misc entry should now never write to a shared cacheline - remove the VERBOSE_STATUS and USE_DEBUG compile time toggles - convert the entry file to a seq_file which simplifies things quite a bit and kills a lot of custom logic - make flags proper enums - rename struct Node to binfmt_misc_entry - allow entries to be removed with unlink(2) - Add the ability to attach bpf programs to binfmt_misc entries so it's possible to dynamically choose the execution environment such as the loader or interpreter on a per binary basis. A handler is an instance of a binfmt_misc_ops struct_ops with a ->match() and a ->load() program. match() decides from the entry lookup walk whether the handler applies under the same registration-order. It can read file content as needed not only the prefetched 256 bytes in bprm->buf. load() then selects the interpreter and stages it through the new bpf_binprm_set_interp(), bpf_binprm_set_interp_arg() and bpf_binprm_set_flags() kfuncs. Handlers are published in a registry keyed by the registering task's user namespace and activated through the existing text interface with a new 'B' type carrying the handler name: echo ':origin:B::::nix:' > /proc/sys/fs/binfmt_misc/register The permission and namespacing model is unchanged. Activating a handler requires the same write access to an instance as any other registration. A container mounting its own instance escapes the host's entries exactly as before. The computed interpreter is opened with open_exec() under the caller's credentials and goes through full LSM vetting as the next binprm level. A program can only ever redirect the caller to something the caller could exec anyway. - Two dispatch modes are added. So far the chosen interpreter owns the whole process identity (argv[0], /proc/pid/cmdline, /proc/self/exe all name interpreter information). So relocatable find the dynamic linker instead. Also a binary passed to execveat() as an inaccessible O_CLOEXEC fd cannot run at all and gdb trips because AT_ENTRY and AT_PHDR do not match the exe file. So PIE symbols are unrelocated. This adds transparent dispatch which allows the interpreter to load the binary through AT_EXECFD and leaves the argument vector exactly as the caller built it and labels mm->exe_file and comm with the binary. It also raises the AT_FLAGS_TRANSPARENT_INTERP aux vector bit. The interpreter keeps control of mapping the binary. The second mode is loader substitution. This allows a binary to be executed natively and only the interpreter to be changed. - Last, interpreters can be bound at registration time. Each interpreter is opened by its own write with the credentials the entry file was opened with. The program picks one per exec with bpf_binprm_select_interp(). Ucounts are used to properly account for pre-opened interpreters via /proc/sys/user/max_binfmt_misc_interpreters"* tag 'vfs-7.3-rc1.binfmt' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (63 commits) binfmt_misc: document the pre-opened interpreter limit selftests/exec: test the pre-opened interpreter limit binfmt_misc: correctly account pre-opened interpreters binfmt_misc: document interpreters bound by a 'B' entry selftests/exec: test interpreters bound to a 'B' entry binfmt_misc: let a 'B' entry bind its interpreters binfmt_misc: carry pre-opened interpreters in struct binfmt_misc_interp selftests/exec: share the bpf handler preconditions binfmt_misc: document registering an entry disabled selftests/exec: test registering an entry disabled selftests/exec: let binfmt_flag_supported() return a bool selftests/exec: check that a binfmt_misc instance cannot be pinned binfmt_misc: let a register string create an entry disabled binfmt_misc: document loader substitution selftests/exec: test binfmt_misc loader substitution binfmt_misc: let a bpf handler request loader substitution binfmt_misc: add the 'L' loader substitution flag binfmt_elf_fdpic: consume a stashed PT_INTERP substitute binfmt_elf: consume a stashed PT_INTERP substitute exec: carry a PT_INTERP substitute in struct linux_binprm ... List of files: /linux/fs/Makefile

e566d0625876b699ee0e752d672c4de73a440764 - Merge patch series "binfmt_misc: bpf-backed binary type handlers"

Fri, 17 Jul 2026 00:36:22 +0200

Merge patch series "binfmt_misc: bpf-backed binary type handlers"Christian Brauner says:binfmt_misc: bpf-backed binary type handlersThis is a POC for the nix people and Farid and Eric in particular. Iwould take my hands off the wheel now that I POCed this and hand it toFarid if he likes to take it forward.VL;MR (very long, must read):For a while now Farid has been trying to make relocatable, hermeticbinaries (think Nix-style store layouts) work without patchelf tricksor wrapper scripts. For such binaries the right dynamic loader can onlybe determined relative to the location of the binary itself, whichneither PT_INTERP nor a fixed binfmt_misc interpreter string canexpress.The first attempt was $ORIGIN expansion in PT_INTERP [1]. I pushed backon that. Userspace guards $ORIGIN behind AT_SECURE so the kernel wouldhave to make the used loader depend on the type of binary, LSMs wouldneed a say, it changes long-standing behavior in ways that are ripe forloader injection attacks, and bprm->file may not have a usable path atall (memfds, deleted files, unresolvable paths). Making the kernelsplice bprm->file back together with PT_INTERP is terrible. The secondattempt was a pluggable ELF interpreter loader registry [2] which wouldmean actual kernel modules for custom binary formats. Also no.binfmt_misc was invented to kill exactly this horrendous past.What I suggested instead [3] was to put this where delegating binaryformats to userspace already lives: binfmt_misc. The only thingsbinfmt_misc cannot do today are matching programmatically and computingthe interpreter per binary instead of using a fixed string recorded atregistration time. Farid prototyped that with an eBPF program [4] andit turned out quite workable, but the prototype ran a SOCKET_FILTERprogram over bprm->buf, added a new helper to the frozen uapi helperlist, and returned the computed path through per-CPU memory.This series is the proposal turned into what I think the bpf side{c,sh}ould actually look like. It is a POC: it builds, the selftestspass, and the design is what I want to discuss. The selftests areFarid's from his v2 posting, adapted to the contract below.A handler is an instance of the new binfmt_misc_ops struct_ops with aname and two ops: struct binfmt_misc_ops { bool (*match)(struct linux_binprm *bprm); int (*load)(struct linux_binprm *bprm); char name[BINFMT_MISC_OPS_NAME_MAX]; };Both programs receive the bprm as a trusted BTF pointer and both aresleepable. The match program decides from the entry lookup walk whetherthe handler applies, under the same rules as magic matching:registration order, first match wins. It is not limited to theprefetched 256 bytes in bprm->buf: it can read arbitrary file contentthrough bpf_dynptr_from_file(), e.g. to find an ELF interpretersegment at whatever offset it sits. That is what makes multipleindependent handlers workable at all - a handler that cannot read thefile would have to match broadly and reject from its load program,stealing the binaries of every handler registered after it. To makethis safe the entry walk becomes an SRCU read-side section. The loadprogram of the matched handler then selects the interpreter, readingthe file the same way and resolving the binary's location viabpf_path_d_path() on &bprm->file->f_path. That also solves theprototype's limitation of only seeing the first 256 bytes of the file.Selecting is the load program's privilege: the verifier rejects theselection kfuncs in match, keyed off the struct_ops member a programattaches to. A match commits the exec to the handler: a failing loadfails the exec instead of falling through to later entries, with-ENOEXEC handing over to the remaining binary formats, so the walk isnever left and re-entered.The genuinely new piece of bpf surface is a small family of kfuncs: int bpf_binprm_set_interp(struct linux_binprm *bprm, const char *path, size_t path__sz); int bpf_binprm_set_interp_arg(struct linux_binprm *bprm, const char *arg, size_t arg__sz); int bpf_binprm_set_flags(struct linux_binprm *bprm, enum bpf_binprm_flags flags);staging the selected interpreter, an optional single argument for it(the slot the optional argument of a #! interpreter line has), and theper-exec invocation flags - 'P', 'C' and 'O' equivalents. Selectioncannot go through bprm_change_interp() directly becauseload_misc_binary() copies bprm->interp into argv[1] after the programran, hence the staging fields added in patch 1.Registering (attaching) the struct_ops map publishes the handler underits name in a registry keyed by the registering task's user namespace.Activation reuses the existing text interface with a new 'B' type wherethe interpreter field carries the handler name - it consistently nameswhoever supplies the interpreter - and offset, magic, and mask must beempty: echo ':origin:B::::nix:' > /proc/sys/fs/binfmt_misc/registerThis keeps the existing permission and namespacing model completelyintact. Activating a handler requires the same write access to abinfmt_misc instance as any other registration, a container mountingits own instance escapes the host's entries exactly as before, andshadowing e.g. all ELF binaries takes the same privilege as a static'M' entry matching \x7fELF does today.The only novelty is that matching becomes programmable. Handler lookupwalks the user namespace hierarchy upwards, mirroring how binfmt_miscinstances themselves are resolved, so a handler registered on the hostcan be activated from a container's own instance without being forcedupon it.The computed interpreter is opened with open_exec() under the caller'scredentials and goes through the full LSM vetting as the next binprmlevel, exactly like a statically registered interpreter, so the programcannot widen access. It only ever redirects the caller to something thecaller could exec anyway.A 'B' entry carries no flags in the register string: the load programchooses the invocation flags per exec through bpf_binprm_set_flags()instead. BPF_BINPRM_PRESERVE_ARGV0, BPF_BINPRM_CREDENTIALS andBPF_BINPRM_EXECFD keep the static 'P', 'C' and 'O' semantics -BPF_BINPRM_CREDENTIALS honors the matched binary's suid bits exactlyas a static 'C' entry does, with the setuid transition gated byvfsuid_has_mapping() in the caller's user namespace either way, whichmakes 'B' handlers usable for a per-binary loader over setuidbinaries. 'F' (pre-open a fixed interpreter) is rejected: a 'B' entryhas no fixed interpreter. AT_EXECVE_CHECK never invokes programs andinterpreter chains stay capped by the usual ELOOP depth.A handler for the Nix case then looks roughly like: SEC("struct_ops.s/match") bool BPF_PROG(nix_match, struct linux_binprm *bprm) { return !bpf_strncmp(bprm->buf, 4, "\x7f" "ELF"); } SEC("struct_ops.s/load") int BPF_PROG(nix_load, struct linux_binprm *bprm) { char path[256]; long n; n = bpf_path_d_path(&bprm->file->f_path, path, sizeof(path)); if (n < 0) return n; /* derive the loader location from the binary's path */ return bpf_binprm_set_interp(bprm, path, sizeof(path)); } SEC(".struct_ops.link") struct binfmt_misc_ops nix = { .match = (void *)nix_match, .load = (void *)nix_load, .name = "nix", };Farid, this should slot underneath your qemu demo from [4] with theprogram ported to struct_ops. Feel free to take it from here.[1]: https://lore.kernel.org/20260622043934.179879-1-farid.m.zakaria@gmail.com[2]: https://lore.kernel.org/20260702214247.1253741-1-farid.m.zakaria@gmail.com[3]: https://lore.kernel.org/20260703-meditation-ratsuchende-moratorium-9ecdf1f3f8bb@brauner[4]: https://lore.kernel.org/20260704211409.1978485-1-farid.m.zakaria@gmail.com* patches from https://patch.msgid.link/20260714-work-bpf-binfmt_misc-v2-0-57b7529c002c@kernel.org: selftests/exec: add binfmt_misc bpf-backed handler test binfmt_misc: let a bpf handler choose the invocation flags per exec binfmt_misc: let bpf handlers pass an argument to the interpreter bpf: allow fs kfuncs for binfmt_misc_ops programs binfmt_misc: wire up bpf-backed 'B' entries binfmt_misc: let the entry lookup walk sleep binfmt_misc: add binfmt_misc_ops bpf struct_ops exec: stash bpf-selected interpreter state in struct linux_binprmLink: https://patch.msgid.link/20260714-work-bpf-binfmt_misc-v2-0-57b7529c002c@kernel.orgSigned-off-by: Christian Brauner (Amutable) List of files: /linux/fs/Makefile

b4bfe2f6b0117f3d8de6430bdaee10094383e97a - binfmt_misc: add binfmt_misc_ops bpf struct_ops

Tue, 14 Jul 2026 21:58:07 +0200

binfmt_misc: add binfmt_misc_ops bpf struct_opsAdd the bpf plumbing for binary type handlers whose matching andinterpreter selection are implemented by bpf programs instead of afixed magic/extension and a fixed interpreter string recorded atregistration time. This serves relocatable binary formats where theinterpreter must be computed per binary, e.g. relative to the locationof the binary itself, as discussed for hermetic Nix-style executables.A handler is an instance of the new binfmt_misc_ops struct_ops with aname that binfmt_misc entries reference it by and two ops: bool (*match)(struct linux_binprm *bprm); int (*load)(struct linux_binprm *bprm);struct_ops is the sanctioned mechanism for this kind of user-suppliedpolicy callback: program types, attach types, and the uapi helper listare frozen, and every recently added subsystem hook (bpf qdisc, SMChandshake control, io_uring loop ops, sched_ext) is a struct_ops user.The ops receive the bprm as a trusted BTF pointer, so a program canmatch on the header in bprm->buf, read arbitrary file content viabpf_dynptr_from_file() to parse e.g. ELF program headers, and inspectthe binary's location. No dedicated program type, ctx blob, or uapihelper is needed.The two ops split along what they decide, not what they may do: thematch program decides whether the handler applies to a binary, theload program decides how a matched binary is run. Both are requiredto be sleepable. Matching cannot be limited to the prefetched 256bytes in bprm->buf: deciding whether a handler applies takes e.g.parsing the ELF program headers to find an interpreter segment, whichsits at an arbitrary file offset, and non-sleepable file reads arelimited to whatever happens to be resident in the page cache. A matchprogram that cannot read the file reliably would have to matchbroadly and leave the rejection to its load program, which breaksfirst-match-wins entry semantics the moment more than one handler isregistered. Reliable file reads at exec time fault in the file'spages, so both ops must be able to sleep. This also constrains thecaller: binfmt_misc must invoke both from sleepable context, which alater patch takes care of. Both ops are required; a handler thatwants to decide everything from the load program supplies a matchprogram that just returns true.The load program communicates its decisions through three new kfuncs: int bpf_binprm_set_interp(struct linux_binprm *bprm, const char *path, size_t path__sz);selects the interpreter and enforces an absolute path shorter thanPATH_MAX. int bpf_binprm_set_interp_arg(struct linux_binprm *bprm, const char *arg, size_t arg__sz);passes a single optional argument to the interpreter, mirroring theoptional argument of a #! interpreter line - something a static entrycannot express at all. int bpf_binprm_set_flags(struct linux_binprm *bprm, enum bpf_binprm_flags flags);chooses the invocation flags for this exec, withBPF_BINPRM_PRESERVE_ARGV0, BPF_BINPRM_CREDENTIALS andBPF_BINPRM_EXECFD mapping to 'P', 'C' and 'O'. Unknown bits arerejected so a program built against a newer kernel fails loudly on anolder one rather than silently losing a flag. Repeated calls replacethe staged flags and a zero argument clears them again - theset-or-clear semantics of bpf_bprm_opts_set() on the same struct. Aflags word carries this better than a kfunc per flag: it is one call,it is set atomically, and new behaviour is a new bit rather than newsurface - the same shape the register string's flags field alreadyhas.All three stage their result in the bprm; consuming it fromload_misc_binary() is wired up by the following patches. The bprm isexclusively owned by the task doing the exec, so no shared or per-CPUstate is involved and nothing here can race. The kfuncs are registeredfor struct_ops programs with a filter that limits them to the loadprogram of a binfmt_misc_ops instance, keyed off the struct_ops memberoffset the program attaches to: match decides whether a handlerapplies, load decides how the binary is run, and the verifier enforcesthat split at program load time.Registering an ops instance (updating the struct_ops map or attachingits link) publishes the handler under its name in a registry keyed bythe registering task's user namespace. Lookups do not walk thathierarchy: a handler is only visible in the user namespace it wasregistered in, so an entry can only reference a handler registered inthe same user namespace as its binfmt_misc instance. Consumers take areference on the ops via bpf_struct_ops_get() which pins the underlyingmap and programs, so an activated handler keeps working even if the mapis deleted or the registering container goes away; deregistration onlyprevents new activations, exactly like unregistering a tcp congestionops with live users.Link: https://lore.kernel.org/20260704211409.1978485-1-farid.m.zakaria@gmail.comLink: https://patch.msgid.link/20260714-work-bpf-binfmt_misc-v2-2-57b7529c002c@kernel.orgSigned-off-by: Christian Brauner (Amutable) List of files: /linux/fs/Makefile

a3ed4fcd04b95347ad04cf4409b394bb7fbd0c02 - freevxfs: remove the driver

Wed, 29 Jul 2026 13:36:40 +0200

freevxfs: remove the driverProviding compatibility to various old-school Unix systems from the 1990swas fun 25 years ago, but today it just attracts automated bug checkersthat have no point in something like this used for retro-computing.As there as only one known users (and contributor) in the last 15 years,drop it. Anyone who needs to access such a file system can stay on anolder kernel, or maintain the code out of tree as it doesn't requireanything fancy.Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20260729113643.2255419-2-hch@lst.deReviewed-by: "Darrick J. Wong" Signed-off-by: Christian Brauner (Amutable) List of files: /linux/fs/Makefile

1d38e750a389e919c1608dbc61cd5c93cd4915dc - Merge patch series "fs: add failfs"

Mon, 27 Jul 2026 11:49:54 +0200

Merge patch series "fs: add failfs"Christian Brauner says:nullfs provides a permanently empty and immutable directory. Lookupsfail with ENOENT. The directory can be opened, read, stat, mounted upon.It behaves like nothing is there.Add its counterpart failfs where the semantics are not "there isnothing here" but "nothing is supported here". Every operation thatreaches the filesystem fails with EOPNOTSUPP. Even statfs()/fstatfs()fail so the filesystem cannot be discovered through an fd to it.EOPNOTSUPP rather than a permission errno keeps that coherent. Thereis no permission model in which anything could ever be allowed andEACCES or EPERM would merely suggest that different credentials mightsucceed while EIO would suggest corruption. It also makes hitting thefailfs boundary mostly quite dinstinguishable. A task anchoring itslookups at real directory file descriptors may be able to tell a failfsrefusal from an ordinary permission failure. I wouldn't go so far asguaranteeing that but it should mostly work.The root cannot be opened at all not even with O_PATH. It is neverreached by a lookup in a parent directory. The only way to a path-walkterminal at the root is a jump through a /proc//{root,cwd} magiclink or by mountpoint traversal. The root also refuses->d_weak_revalidate() which the VFS calls for jumped terminals. Thatcloses every remaining way to reference it. An O_PATHopen is refused and name_to_handle_at() cannot encode it into a filehandle, and following a magic link into it fails. A plain readlink() ofsuch a link still works and shows "failfs:/".There is a single instance of failfs mounted during early boot viakern_mount() making it logically distinct from every mount namespace.Since the mount is a member of no mount namespace mounting onto itfails. So nothing can ever be mounted on top of it. It cannot be clonedvia OPEN_TREE_CLONE and it does not show up in statmount()/listmount()or /proc//mountinfo. The filesystem is not registered so it isnot visible in /proc/filesystems and cannot be mounted from userspace.This lets tasks shed their filesystem state completely. A process withits root directory or working directory in failfs must anchor every pathlookup at an explicit file descriptor or is doomed to fail any lookup.Absolute paths, absolute symlinks, and AT_FDCWD-relative lookupssimply fail. Followup patches will expose it via a new FD_FAILFS_ROOTfile descriptor sentinel understood by fchdir() and the new fchroot()system call.Fun fact, because of how dynamic binary execution work with PT_INTERPthis also currently prevents execution of dynamic binaries becauseloaders have absolute paths (see selftests).* patches from https://patch.msgid.link/20260724-work-failfs-v2-0-485dabbae185@kernel.org: Documentation: add failfs documentation selftests/filesystems: add failfs selftests arch: hookup fchroot() system call fs: support FD_FAILFS_ROOT in fchroot() fs: add fchroot() fs: support FD_FAILFS_ROOT in fchdir() fs: add failfsLink: https://patch.msgid.link/20260724-work-failfs-v2-0-485dabbae185@kernel.orgSigned-off-by: Christian Brauner (Amutable) List of files: /linux/fs/Makefile

fa0d6d945e5ce96cff14b114eec7527f13d7f23a - fs: add failfs

Fri, 24 Jul 2026 15:41:17 +0200

fs: add failfsnullfs provides a permanently empty and immutable directory. Lookupsfail with ENOENT. The directory can be opened, read, stat, mounted upon.It behaves like nothing is there.Add its counterpart failfs where the semantics are not "there isnothing here" but "nothing is supported here". Every operation thatreaches the filesystem fails with EOPNOTSUPP. Even statfs()/fstatfs()fail so the filesystem cannot be discovered through an fd to it.EOPNOTSUPP rather than a permission errno keeps that coherent. Thereis no permission model in which anything could ever be allowed andEACCES or EPERM would merely suggest that different credentials mightsucceed while EIO would suggest corruption. It also makes hitting thefailfs boundary mostly quite dinstinguishable. A task anchoring itslookups at real directory file descriptors may be able to tell a failfsrefusal from an ordinary permission failure. I wouldn't go so far asguaranteeing that but it should mostly work.No path lookup can open the root, not even with O_PATH. It is neverreached by a lookup in a parent directory. The only way to a path-walkterminal at the root is a jump through a /proc//{root,cwd} magiclink or by mountpoint traversal. The root also refuses->d_weak_revalidate() which the VFS calls for jumped terminals. Thatcovers the jump-based references too: an O_PATH open is refused,name_to_handle_at() cannot encode it into a file handle, and following amagic link into it fails. A plain readlink() of such a link still worksand shows "failfs:/".There is a single instance of failfs mounted during early boot viakern_mount() making it logically distinct from every mount namespace.Since the mount is a member of no mount namespace mounting onto itfails. So nothing can ever be mounted on top of it. It cannot be clonedvia OPEN_TREE_CLONE and it does not show up in statmount()/listmount()or /proc//mountinfo. The filesystem is not registered so it isnot visible in /proc/filesystems and cannot be mounted from userspace.This lets tasks shed their filesystem state completely. A process withits root directory or working directory in failfs must anchor every pathlookup at an explicit file descriptor or is doomed to fail any lookup.Absolute paths, absolute symlinks, and AT_FDCWD-relative lookupssimply fail. Followup patches will expose it via a new FD_FAILFS_ROOTfile descriptor sentinel understood by fchdir() and the new fchroot()system call.Link: https://patch.msgid.link/20260724-work-failfs-v2-1-485dabbae185@kernel.orgSigned-off-by: Christian Brauner (Amutable) List of files: /linux/fs/Makefile

00599d4841790d05401820a96cf7edb193888b00 - Merge drm/drm-fixes into drm-misc-fixes

Mon, 29 Jun 2026 17:58:00 +0200

Merge drm/drm-fixes into drm-misc-fixesPull in tag v7.2-rc1 so that drm-misc-fixes becomes useful again,and drm-misc-next-fixes can be closed.Signed-off-by: Maarten Lankhorst List of files: /linux/fs/Makefile