Merge branch 'for-7.1/core-v2' into for-linus

- fixed handling of 0-sized reports (Dmitry Torokhov)
- convert core code to __free() (Dmitry Torokhov)
- support for multiple batteries per HID device (Lucas Zampieri)

12 files changed, 195 insertions, 146 deletions

diff --git a/include/uapi/linux/android/binder.h b/include/uapi/linux/android/binder.h
index 03ee4c7010d7..701cad36de43 100644
--- a/include/uapi/linux/android/binder.h
+++ b/include/uapi/linux/android/binder.h
@@ -278,7 +278,7 @@ enum {
  * NOTE: Two special error codes you should check for when calling
  * in to the driver are:
  *
- * EINTR -- The operation has been interupted.  This should be
+ * EINTR -- The operation has been interrupted.  This should be
  * handled by retrying the ioctl() until a different error code
  * is returned.
  *
diff --git a/include/uapi/linux/dma-buf.h b/include/uapi/linux/dma-buf.h
index 5a6fda66d9ad..e827c9d20c5d 100644
--- a/include/uapi/linux/dma-buf.h
+++ b/include/uapi/linux/dma-buf.h
@@ -20,6 +20,7 @@
 #ifndef _DMA_BUF_UAPI_H_
 #define _DMA_BUF_UAPI_H_
 
+#include <linux/ioctl.h>
 #include <linux/types.h>
 
 /**
diff --git a/include/uapi/linux/fs.h b/include/uapi/linux/fs.h
index 66ca526cf786..70b2b661f42c 100644
--- a/include/uapi/linux/fs.h
+++ b/include/uapi/linux/fs.h
@@ -253,6 +253,7 @@ struct file_attr {
 #define FS_XFLAG_FILESTREAM	0x00004000	/* use filestream allocator */
 #define FS_XFLAG_DAX		0x00008000	/* use DAX for IO */
 #define FS_XFLAG_COWEXTSIZE	0x00010000	/* CoW extent size allocator hint */
+#define FS_XFLAG_VERITY		0x00020000	/* fs-verity enabled */
 #define FS_XFLAG_HASATTR	0x80000000	/* no DIFLAG for this	*/
 
 /* the read-only stuff doesn't really belong here, but any other place is
diff --git a/include/uapi/linux/idxd.h b/include/uapi/linux/idxd.h
index 3d1987e1bb2d..fdcc8eefb925 100644
--- a/include/uapi/linux/idxd.h
+++ b/include/uapi/linux/idxd.h
@@ -3,11 +3,7 @@
 #ifndef _USR_IDXD_H_
 #define _USR_IDXD_H_
 
-#ifdef __KERNEL__
 #include <linux/types.h>
-#else
-#include <stdint.h>
-#endif
 
 /* Driver command error status */
 enum idxd_scmd_stat {
@@ -176,132 +172,132 @@ enum iax_completion_status {
 #define DSA_COMP_STATUS(status)		((status) & DSA_COMP_STATUS_MASK)
 
 struct dsa_hw_desc {
-	uint32_t	pasid:20;
-	uint32_t	rsvd:11;
-	uint32_t	priv:1;
-	uint32_t	flags:24;
-	uint32_t	opcode:8;
-	uint64_t	completion_addr;
+	__u32	pasid:20;
+	__u32	rsvd:11;
+	__u32	priv:1;
+	__u32	flags:24;
+	__u32	opcode:8;
+	__u64	completion_addr;
 	union {
-		uint64_t	src_addr;
-		uint64_t	rdback_addr;
-		uint64_t	pattern;
-		uint64_t	desc_list_addr;
-		uint64_t	pattern_lower;
-		uint64_t	transl_fetch_addr;
+		__u64	src_addr;
+		__u64	rdback_addr;
+		__u64	pattern;
+		__u64	desc_list_addr;
+		__u64	pattern_lower;
+		__u64	transl_fetch_addr;
 	};
 	union {
-		uint64_t	dst_addr;
-		uint64_t	rdback_addr2;
-		uint64_t	src2_addr;
-		uint64_t	comp_pattern;
+		__u64	dst_addr;
+		__u64	rdback_addr2;
+		__u64	src2_addr;
+		__u64	comp_pattern;
 	};
 	union {
-		uint32_t	xfer_size;
-		uint32_t	desc_count;
-		uint32_t	region_size;
+		__u32	xfer_size;
+		__u32	desc_count;
+		__u32	region_size;
 	};
-	uint16_t	int_handle;
-	uint16_t	rsvd1;
+	__u16	int_handle;
+	__u16	rsvd1;
 	union {
-		uint8_t		expected_res;
+		__u8		expected_res;
 		/* create delta record */
 		struct {
-			uint64_t	delta_addr;
-			uint32_t	max_delta_size;
-			uint32_t 	delt_rsvd;
-			uint8_t 	expected_res_mask;
+			__u64	delta_addr;
+			__u32	max_delta_size;
+			__u32	delt_rsvd;
+			__u8	expected_res_mask;
 		};
-		uint32_t	delta_rec_size;
-		uint64_t	dest2;
+		__u32	delta_rec_size;
+		__u64	dest2;
 		/* CRC */
 		struct {
-			uint32_t	crc_seed;
-			uint32_t	crc_rsvd;
-			uint64_t	seed_addr;
+			__u32	crc_seed;
+			__u32	crc_rsvd;
+			__u64	seed_addr;
 		};
 		/* DIF check or strip */
 		struct {
-			uint8_t		src_dif_flags;
-			uint8_t		dif_chk_res;
-			uint8_t		dif_chk_flags;
-			uint8_t		dif_chk_res2[5];
-			uint32_t	chk_ref_tag_seed;
-			uint16_t	chk_app_tag_mask;
-			uint16_t	chk_app_tag_seed;
+			__u8	src_dif_flags;
+			__u8	dif_chk_res;
+			__u8	dif_chk_flags;
+			__u8	dif_chk_res2[5];
+			__u32	chk_ref_tag_seed;
+			__u16	chk_app_tag_mask;
+			__u16	chk_app_tag_seed;
 		};
 		/* DIF insert */
 		struct {
-			uint8_t		dif_ins_res;
-			uint8_t		dest_dif_flag;
-			uint8_t		dif_ins_flags;
-			uint8_t		dif_ins_res2[13];
-			uint32_t	ins_ref_tag_seed;
-			uint16_t	ins_app_tag_mask;
-			uint16_t	ins_app_tag_seed;
+			__u8	dif_ins_res;
+			__u8	dest_dif_flag;
+			__u8	dif_ins_flags;
+			__u8	dif_ins_res2[13];
+			__u32	ins_ref_tag_seed;
+			__u16	ins_app_tag_mask;
+			__u16	ins_app_tag_seed;
 		};
 		/* DIF update */
 		struct {
-			uint8_t		src_upd_flags;
-			uint8_t		upd_dest_flags;
-			uint8_t		dif_upd_flags;
-			uint8_t		dif_upd_res[5];
-			uint32_t	src_ref_tag_seed;
-			uint16_t	src_app_tag_mask;
-			uint16_t	src_app_tag_seed;
-			uint32_t	dest_ref_tag_seed;
-			uint16_t	dest_app_tag_mask;
-			uint16_t	dest_app_tag_seed;
+			__u8	src_upd_flags;
+			__u8	upd_dest_flags;
+			__u8	dif_upd_flags;
+			__u8	dif_upd_res[5];
+			__u32	src_ref_tag_seed;
+			__u16	src_app_tag_mask;
+			__u16	src_app_tag_seed;
+			__u32	dest_ref_tag_seed;
+			__u16	dest_app_tag_mask;
+			__u16	dest_app_tag_seed;
 		};
 
 		/* Fill */
-		uint64_t	pattern_upper;
+		__u64	pattern_upper;
 
 		/* Translation fetch */
 		struct {
-			uint64_t	transl_fetch_res;
-			uint32_t	region_stride;
+			__u64	transl_fetch_res;
+			__u32	region_stride;
 		};
 
 		/* DIX generate */
 		struct {
-			uint8_t		dix_gen_res;
-			uint8_t		dest_dif_flags;
-			uint8_t		dif_flags;
-			uint8_t		dix_gen_res2[13];
-			uint32_t	ref_tag_seed;
-			uint16_t	app_tag_mask;
-			uint16_t	app_tag_seed;
+			__u8	dix_gen_res;
+			__u8	dest_dif_flags;
+			__u8	dif_flags;
+			__u8	dix_gen_res2[13];
+			__u32	ref_tag_seed;
+			__u16	app_tag_mask;
+			__u16	app_tag_seed;
 		};
 
-		uint8_t		op_specific[24];
+		__u8		op_specific[24];
 	};
 } __attribute__((packed));
 
 struct iax_hw_desc {
-	uint32_t        pasid:20;
-	uint32_t        rsvd:11;
-	uint32_t        priv:1;
-	uint32_t        flags:24;
-	uint32_t        opcode:8;
-	uint64_t        completion_addr;
-	uint64_t        src1_addr;
-	uint64_t        dst_addr;
-	uint32_t        src1_size;
-	uint16_t        int_handle;
+	__u32        pasid:20;
+	__u32        rsvd:11;
+	__u32        priv:1;
+	__u32        flags:24;
+	__u32        opcode:8;
+	__u64        completion_addr;
+	__u64        src1_addr;
+	__u64        dst_addr;
+	__u32        src1_size;
+	__u16        int_handle;
 	union {
-		uint16_t        compr_flags;
-		uint16_t        decompr_flags;
+		__u16        compr_flags;
+		__u16        decompr_flags;
 	};
-	uint64_t        src2_addr;
-	uint32_t        max_dst_size;
-	uint32_t        src2_size;
-	uint32_t	filter_flags;
-	uint32_t	num_inputs;
+	__u64	src2_addr;
+	__u32	max_dst_size;
+	__u32	src2_size;
+	__u32	filter_flags;
+	__u32	num_inputs;
 } __attribute__((packed));
 
 struct dsa_raw_desc {
-	uint64_t	field[8];
+	__u64	field[8];
 } __attribute__((packed));
 
 /*
@@ -309,91 +305,91 @@ struct dsa_raw_desc {
  * volatile and prevent the compiler from optimize the read.
  */
 struct dsa_completion_record {
-	volatile uint8_t	status;
+	volatile __u8	status;
 	union {
-		uint8_t		result;
-		uint8_t		dif_status;
+		__u8		result;
+		__u8		dif_status;
 	};
-	uint8_t			fault_info;
-	uint8_t			rsvd;
+	__u8			fault_info;
+	__u8			rsvd;
 	union {
-		uint32_t		bytes_completed;
-		uint32_t		descs_completed;
+		__u32		bytes_completed;
+		__u32		descs_completed;
 	};
-	uint64_t		fault_addr;
+	__u64		fault_addr;
 	union {
 		/* common record */
 		struct {
-			uint32_t	invalid_flags:24;
-			uint32_t	rsvd2:8;
+			__u32	invalid_flags:24;
+			__u32	rsvd2:8;
 		};
 
-		uint32_t	delta_rec_size;
-		uint64_t	crc_val;
+		__u32	delta_rec_size;
+		__u64	crc_val;
 
 		/* DIF check & strip */
 		struct {
-			uint32_t	dif_chk_ref_tag;
-			uint16_t	dif_chk_app_tag_mask;
-			uint16_t	dif_chk_app_tag;
+			__u32	dif_chk_ref_tag;
+			__u16	dif_chk_app_tag_mask;
+			__u16	dif_chk_app_tag;
 		};
 
 		/* DIF insert */
 		struct {
-			uint64_t	dif_ins_res;
-			uint32_t	dif_ins_ref_tag;
-			uint16_t	dif_ins_app_tag_mask;
-			uint16_t	dif_ins_app_tag;
+			__u64	dif_ins_res;
+			__u32	dif_ins_ref_tag;
+			__u16	dif_ins_app_tag_mask;
+			__u16	dif_ins_app_tag;
 		};
 
 		/* DIF update */
 		struct {
-			uint32_t	dif_upd_src_ref_tag;
-			uint16_t	dif_upd_src_app_tag_mask;
-			uint16_t	dif_upd_src_app_tag;
-			uint32_t	dif_upd_dest_ref_tag;
-			uint16_t	dif_upd_dest_app_tag_mask;
-			uint16_t	dif_upd_dest_app_tag;
+			__u32	dif_upd_src_ref_tag;
+			__u16	dif_upd_src_app_tag_mask;
+			__u16	dif_upd_src_app_tag;
+			__u32	dif_upd_dest_ref_tag;
+			__u16	dif_upd_dest_app_tag_mask;
+			__u16	dif_upd_dest_app_tag;
 		};
 
 		/* DIX generate */
 		struct {
-			uint64_t	dix_gen_res;
-			uint32_t	dix_ref_tag;
-			uint16_t	dix_app_tag_mask;
-			uint16_t	dix_app_tag;
+			__u64	dix_gen_res;
+			__u32	dix_ref_tag;
+			__u16	dix_app_tag_mask;
+			__u16	dix_app_tag;
 		};
 
-		uint8_t		op_specific[16];
+		__u8		op_specific[16];
 	};
 } __attribute__((packed));
 
 struct dsa_raw_completion_record {
-	uint64_t	field[4];
+	__u64	field[4];
 } __attribute__((packed));
 
 struct iax_completion_record {
-	volatile uint8_t        status;
-	uint8_t                 error_code;
-	uint8_t			fault_info;
-	uint8_t			rsvd;
-	uint32_t                bytes_completed;
-	uint64_t                fault_addr;
-	uint32_t                invalid_flags;
-	uint32_t                rsvd2;
-	uint32_t                output_size;
-	uint8_t                 output_bits;
-	uint8_t                 rsvd3;
-	uint16_t                xor_csum;
-	uint32_t                crc;
-	uint32_t                min;
-	uint32_t                max;
-	uint32_t                sum;
-	uint64_t                rsvd4[2];
+	volatile __u8        status;
+	__u8                 error_code;
+	__u8		     fault_info;
+	__u8		     rsvd;
+	__u32                bytes_completed;
+	__u64                fault_addr;
+	__u32                invalid_flags;
+	__u32                rsvd2;
+	__u32                output_size;
+	__u8                 output_bits;
+	__u8                 rsvd3;
+	__u16                xor_csum;
+	__u32                crc;
+	__u32                min;
+	__u32                max;
+	__u32                sum;
+	__u64                rsvd4[2];
 } __attribute__((packed));
 
 struct iax_raw_completion_record {
-	uint64_t	field[8];
+	__u64	field[8];
 } __attribute__((packed));
 
 #endif
diff --git a/include/uapi/linux/io_uring.h b/include/uapi/linux/io_uring.h
index fc473af6feb4..1ff16141c8a5 100644
--- a/include/uapi/linux/io_uring.h
+++ b/include/uapi/linux/io_uring.h
@@ -188,7 +188,8 @@ enum io_uring_sqe_flags_bit {
 /*
  * If COOP_TASKRUN is set, get notified if task work is available for
  * running and a kernel transition would be needed to run it. This sets
- * IORING_SQ_TASKRUN in the sq ring flags. Not valid with COOP_TASKRUN.
+ * IORING_SQ_TASKRUN in the sq ring flags. Not valid without COOP_TASKRUN
+ * or DEFER_TASKRUN.
  */
 #define IORING_SETUP_TASKRUN_FLAG	(1U << 9)
 #define IORING_SETUP_SQE128		(1U << 10) /* SQEs are 128 byte */
@@ -1090,6 +1091,14 @@ enum zcrx_reg_flags {
 	ZCRX_REG_IMPORT	= 1,
 };
 
+enum zcrx_features {
+	/*
+	 * The user can ask for the desired rx page size by passing the
+	 * value in struct io_uring_zcrx_ifq_reg::rx_buf_len.
+	 */
+	ZCRX_FEATURE_RX_PAGE_SIZE	= 1 << 0,
+};
+
 /*
  * Argument for IORING_REGISTER_ZCRX_IFQ
  */
diff --git a/include/uapi/linux/io_uring/bpf_filter.h b/include/uapi/linux/io_uring/bpf_filter.h
index 220351b81bc0..1b461d792a7b 100644
--- a/include/uapi/linux/io_uring/bpf_filter.h
+++ b/include/uapi/linux/io_uring/bpf_filter.h
@@ -35,13 +35,19 @@ enum {
 	 * If set, any currently unset opcode will have a deny filter attached
 	 */
 	IO_URING_BPF_FILTER_DENY_REST	= 1,
+	/*
+	 * If set, if kernel and application don't agree on pdu_size for
+	 * the given opcode, fail the registration of the filter.
+	 */
+	IO_URING_BPF_FILTER_SZ_STRICT	= 2,
 };
 
 struct io_uring_bpf_filter {
 	__u32	opcode;		/* io_uring opcode to filter */
 	__u32	flags;
 	__u32	filter_len;	/* number of BPF instructions */
-	__u32	resv;
+	__u8	pdu_size;	/* expected pdu size for opcode */
+	__u8	resv[3];
 	__u64	filter_ptr;	/* pointer to BPF filter */
 	__u64	resv2[5];
 };
diff --git a/include/uapi/linux/io_uring/query.h b/include/uapi/linux/io_uring/query.h
index 2456e6c5ebb5..95500759cc13 100644
--- a/include/uapi/linux/io_uring/query.h
+++ b/include/uapi/linux/io_uring/query.h
@@ -1,6 +1,9 @@
 /* SPDX-License-Identifier: (GPL-2.0 WITH Linux-syscall-note) OR MIT */
 /*
  * Header file for the io_uring query interface.
+ *
+ * Copyright (C) 2026 Pavel Begunkov <asml.silence@gmail.com>
+ * Copyright (C) Meta Platforms, Inc.
  */
 #ifndef LINUX_IO_URING_QUERY_H
 #define LINUX_IO_URING_QUERY_H
@@ -50,7 +53,8 @@ struct io_uring_query_zcrx {
 	__u64 area_flags;
 	/* The number of supported ZCRX_CTRL_* opcodes */
 	__u32 nr_ctrl_opcodes;
-	__u32 __resv1;
+	/* Bitmask of ZCRX_FEATURE_* indicating which features are available */
+	__u32 features;
 	/* The refill ring header size */
 	__u32 rq_hdr_size;
 	/* The alignment for the header */
diff --git a/include/uapi/linux/kvm.h b/include/uapi/linux/kvm.h
index 65500f5db379..80364d4dbebb 100644
--- a/include/uapi/linux/kvm.h
+++ b/include/uapi/linux/kvm.h
@@ -14,6 +14,10 @@
 #include <linux/ioctl.h>
 #include <asm/kvm.h>
 
+#ifdef __KERNEL__
+#include <linux/kvm_types.h>
+#endif
+
 #define KVM_API_VERSION 12
 
 /*
@@ -1601,7 +1605,11 @@ struct kvm_stats_desc {
 	__u16 size;
 	__u32 offset;
 	__u32 bucket_size;
+#ifdef __KERNEL__
+	char name[KVM_STATS_NAME_SIZE];
+#else
 	char name[];
+#endif
 };
 
 #define KVM_GET_STATS_FD  _IO(KVMIO,  0xce)
diff --git a/include/uapi/linux/mshv.h b/include/uapi/linux/mshv.h
index dee3ece28ce5..e0645a34b55b 100644
--- a/include/uapi/linux/mshv.h
+++ b/include/uapi/linux/mshv.h
@@ -27,6 +27,8 @@ enum {
 	MSHV_PT_BIT_X2APIC,
 	MSHV_PT_BIT_GPA_SUPER_PAGES,
 	MSHV_PT_BIT_CPU_AND_XSAVE_FEATURES,
+	MSHV_PT_BIT_NESTED_VIRTUALIZATION,
+	MSHV_PT_BIT_SMT_ENABLED_GUEST,
 	MSHV_PT_BIT_COUNT,
 };
 
diff --git a/include/uapi/linux/netfilter_bridge.h b/include/uapi/linux/netfilter_bridge.h
index f6e8d1e05c97..758de72b2764 100644
--- a/include/uapi/linux/netfilter_bridge.h
+++ b/include/uapi/linux/netfilter_bridge.h
@@ -5,6 +5,10 @@
 /* bridge-specific defines for netfilter. 
  */
 
+#ifndef __KERNEL__
+#include <netinet/if_ether.h>	/* for __UAPI_DEF_ETHHDR if defined */
+#endif
+
 #include <linux/in.h>
 #include <linux/netfilter.h>
 #include <linux/if_ether.h>
diff --git a/include/uapi/linux/pci_regs.h b/include/uapi/linux/pci_regs.h
index ec1c54b5a310..14f634ab9350 100644
--- a/include/uapi/linux/pci_regs.h
+++ b/include/uapi/linux/pci_regs.h
@@ -712,7 +712,7 @@
 #define  PCI_EXP_LNKCTL2_HASD		0x0020 /* HW Autonomous Speed Disable */
 #define PCI_EXP_LNKSTA2		0x32	/* Link Status 2 */
 #define  PCI_EXP_LNKSTA2_FLIT		0x0400 /* Flit Mode Status */
-#define PCI_CAP_EXP_ENDPOINT_SIZEOF_V2	0x32	/* end of v2 EPs w/ link */
+#define PCI_CAP_EXP_ENDPOINT_SIZEOF_V2	0x34	/* end of v2 EPs w/ link */
 #define PCI_EXP_SLTCAP2		0x34	/* Slot Capabilities 2 */
 #define  PCI_EXP_SLTCAP2_IBPD	0x00000001 /* In-band PD Disable Supported */
 #define PCI_EXP_SLTCTL2		0x38	/* Slot Control 2 */
diff --git a/include/uapi/linux/rseq.h b/include/uapi/linux/rseq.h
index 863c4a00a66b..f69344fe6c08 100644
--- a/include/uapi/linux/rseq.h
+++ b/include/uapi/linux/rseq.h
@@ -87,10 +87,17 @@ struct rseq_slice_ctrl {
 };
 
 /*
- * struct rseq is aligned on 4 * 8 bytes to ensure it is always
- * contained within a single cache-line.
+ * The original size and alignment of the allocation for struct rseq is
+ * 32 bytes.
  *
- * A single struct rseq per thread is allowed.
+ * The allocation size needs to be greater or equal to
+ * max(getauxval(AT_RSEQ_FEATURE_SIZE), 32), and the allocation needs to
+ * be aligned on max(getauxval(AT_RSEQ_ALIGN), 32).
+ *
+ * As an alternative, userspace is allowed to use both the original size
+ * and alignment of 32 bytes for backward compatibility.
+ *
+ * A single active struct rseq registration per thread is allowed.
  */
 struct rseq {
 	/*
@@ -181,9 +188,20 @@ struct rseq {
 	struct rseq_slice_ctrl slice_ctrl;
 
 	/*
+	 * Before rseq became extensible, its original size was 32 bytes even
+	 * though the active rseq area was only 20 bytes.
+	 * Exposing a 32 bytes feature size would make life needlessly painful
+	 * for userspace. Therefore, add a reserved byte after byte 32
+	 * to bump the rseq feature size from 32 to 33.
+	 * The next field to be added to the rseq area will be larger
+	 * than one byte, and will replace this reserved byte.
+	 */
+	__u8 __reserved;
+
+	/*
 	 * Flexible array member at end of structure, after last feature field.
 	 */
 	char end[];
-} __attribute__((aligned(4 * sizeof(__u64))));
+} __attribute__((aligned(32)));
 
 #endif /* _UAPI_LINUX_RSEQ_H */