summaryrefslogtreecommitdiff
path: root/include
AgeCommit message (Collapse)Author
2026-10-16drm/sched: Document entity->stopped is protected by entity->lockTvrtko Ursulin
Commit 0e118b936dc5 ("drm/sched: Lock drm_sched_entity_is_idle()") has removed the last unlocked entity->stopped access so lets officially document it in kerneldoc as locked with the entity lock. Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Cc: Christian König <christian.koenig@amd.com> Cc: Danilo Krummrich <dakr@kernel.org> Cc: Matthew Brost <matthew.brost@intel.com> Cc: Philipp Stanner <phasta@kernel.org> Acked-by: Philipp Stanner <phasta@kernel.org> Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net> Link: https://lore.kernel.org/r/20261002124655.74716-1-tvrtko.ursulin@igalia.com [tursulin: fixed commit title typo]
2026-10-16sched: Replace nr_iowait_cpu() with a bool accessorChristian Loehle
The menu governor was the last consumer of the per-CPU I/O-wait count that needed its magnitude, apart from nr_iowait() summing it globally. Commit 38f83090f515 ("cpuidle: menu: Remove iowait influence") removed that use. All remaining per-CPU consumers only test for zero/nonzero. Replace nr_iowait_cpu() with bool cpu_has_iowait() and update the generic and s390 idle accounting callers. Have nr_iowait() read the counters directly so that the global total and existing accounting are preserved. Replace the stale menu comment with a description of the predicate. Also convert the remaining open-coded idle accounting checks to use the predicate, as suggested by Prateek. The conversion was done with coccinelle: @ predicate depends on patch @ expression cpu; @@ - nr_iowait_cpu(cpu) > 0 + cpu_has_iowait(cpu) @ callers depends on patch @ expression cpu; @@ - nr_iowait_cpu(cpu) + cpu_has_iowait(cpu) Signed-off-by: Christian Loehle <christian.loehle@arm.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Kayra Cizmeci <kayracizmeci@gmail.com> Reviewed-by: K Prateek Nayak <kprateek.nayak@amd.com> Tested-by: K Prateek Nayak <kprateek.nayak@amd.com> Link: https://patch.msgid.link/20261016073341.575472-1-christian.loehle@arm.com
2026-10-16sched/cputime: Don't account idle time twice after dyntick-idleStian Halseth
On idle exit the dyntick-idle accounting accounts the time up to now, then the tick is restarted on its old period. The first tick accounts a whole TICK_NSEC to whatever runs, although the part of that period before the idle exit has just been accounted as idle time, or with IRQ_TIME_ACCOUNTING as IRQ time. That is up to a full tick per idle exit, and /proc/stat reports more idle time than wall time. Record how much of the current tick period dyntick-idle has accounted, and leave it out of the tick that ends the period. Fixes: cf6444c3e1bb7 ("tick/sched: Unify idle cputime accounting") Signed-off-by: Stian Halseth <stian@itx.no> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Frederic Weisbecker <frederic@kernel.org> Link: https://lore.kernel.org/all/20261004142724.3896396-1-stian@itx.no/ Link: https://patch.msgid.link/20261007142950.547604-1-stian@itx.no
2026-10-16perf: Track the perf mlock gift separatelyLorenzo Stoakes (ARM)
The locked_vm field in struct user_struct was originally introduced by commit 789f90fcf6b0 ("perf_counter: per user mlock gift") to provide an mlock-like budget for perf measured against mm->pinned_vm (since 2011). perf grants each user a 'gift' of perf_event_mlock_kb * online CPUs of buffer pages which is charged to user->locked_vm without any RLIMIT_MEMLOCK check. Only pages beyond the gift are checked against RLIMIT_MEMLOCK, per-mm, via mm->pinned_vm, which makes it different from the standard mlock() check, which is per-mm and made against RLIMIT_MEMLOCK. However, since this was introduced, a number of other components have utilised this field where a shared resource needed to be limited against RLIMIT_MEMLOCK. The other users are currently MSG_ZEROCOPY, io_uring, AF_XDP, iommufd, s390 KVM zPCI and most recently, secretmem in commit 97d34aa65c29 ("mm/secretmem: properly account locked pages"). This field is shared between all of these, but because the gift is not checked against RLIMIT_MEMLOCK, user->locked_vm alone can exceed it - 16 CPUs * 516 KiB is already more than the default 8 MiB - after which every other user of the field fails unconditionally. This was reported by a user who saw secretmem failing while running a simultaneous perf record. Resolve the issue by simply giving perf its own field separate from the rest. BPF used user->locked_vm up until commit 80ee81e0403c ("bpf: Eliminate rlimit-based memory accounting infra for bpf maps") which landed in 5.11. Thus also eliminate the now-defunct ifdef for CONFIG_BPF_SYSCALL for user->locked_vm. This issue exists between all of the components which use user->locked_vm and perf, however secretmem is the first user who has caused a report over many years and has been backported, so target the fix at that. Fixes: 97d34aa65c29 ("mm/secretmem: properly account locked pages") Closes: https://lore.kernel.org/20261002175651.811343-1-ameer.hamza@truenas.com Reported-by: Ameer Hamza <ameer.hamza@truenas.com> Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20261003-perf-locked-vm-fix-v1-1-d214dcaf0d76@kernel.org
2026-10-16Merge tag 'kvm-x86-coco-7.4' of https://github.com/kvm-x86/linux into HEADPaolo Bonzini
KVM guest_memfd and CoCo changes for 7.4 - Take the invalidate lock when unbinding a dying file to fix a race with kvm_gmem_invalidate_end() that results in KVM leaving the MMU invalidation count elevated. Not taking the lock in the first place was pure misguided paranoid. - When binding a memslot, purge the bindings if storing the new memslot fails, as Xarray's "store range" API can subtly fail partway through. - Establish memslot<=>guest_memfd bindings *after* the memslot is ready, as the memslot becomes reachable the instant the binding is installed. - Don't grab a page refcount when reloading an SNP VMSA and stop returning a "struct page" from guest_memfd's PFN lookup altogether, to ensure that KVM doesn't hold any unnecessary refcounts (the lifetime of the page is ensured by MMU notifiers and similar hooks). Preventing unnecessary refcounts greatly simplifies supporting in-place SHARED=>PRIVATE conversions. - Add support for in-place PRIVATE<=>SHARED conversion, i.e. allow a single guest_memfd instance to be used for both PRIVATE and SHARED variations of CoCo guests' memory (though not at the same time). This eliminates the need to double allocate guest memory for TDX and SNP, and is basically a hard requirement for pKVM, which relies on being able to preserve memory contents on conversions. - Hack-a-fix a deadlock bug in ->error_remove_folio() by returning -EBUSY if the filemap invalidate lock is contended. Punt on a proper fix for the moment, as a proper fix likely involves reworking truncate_error_folio(). - Add a pile of selftests for in-place conversions. - Misc guest_memfd cleanups Conflicts in arch/arm64/kvm/mmu.c: convert to use s2vi.
2026-10-15lib/crypto: chacha: Use size_t lengthEric Biggers
Upgrade the ChaCha functions from 32-bit lengths to size_t. 'size_t' is the best practice for buffer lengths, and it's what the rest of the crypto library uses. Moreover, all the 64-bit ChaCha assembly functions actually already treated the length as 64-bit, despite it being declared as 32-bit in C on arm64, ppc64, and x86_64. For arm64 and x86_64, this caused unspecified behavior due to the high 32 bits of the corresponding register having an unspecified value in those architectures' ABIs. However, in practice these bits are always zero and no issue occurred. (ppc64 was fine too, since there the ABI zero-extends 32-bit arguments.) These issues date to the original introduction of the ChaCha code. However, as noted above, they don't have any real-world impact currently; so this is an API robustness improvement only. Reported-by: Vladimir Kukharenko <vladimir@genproof.com> Closes: https://lore.kernel.org/r/20261012-libcrypto-4gib-lengths-v1-0-ea566c129a2e@genproof.com Tested-by: Vladimir Kukharenko <vladimir@genproof.com> Link: https://patch.msgid.link/20261014152604.323310-3-ebiggers@kernel.org Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-10-15lib/crypto: poly1305: Use size_t lengthEric Biggers
Upgrade the Poly1305 functions from 32-bit lengths to size_t. 'size_t' is the best practice for buffer lengths, and it's what the rest of the crypto library uses. Moreover, all the 64-bit Poly1305 assembly functions actually already treated the length as 64-bit, despite it being declared as 32-bit in C on arm64, mips64, ppc64, and riscv64: - On arm64, this caused unspecified behavior due to the high 32 bits having an unspecified value in that architecture's ABI. However, in practice these bits are always zero and no issue occurred. (ppc64 was fine too, since there the ABI zero-extends 32-bit arguments.) - On mips64 and riscv64, this caused incorrect behavior on lengths above S32_MAX, due to the sign extension done by those architectures' ABIs. Note that no current callers pass lengths over S32_MAX. Also, the expression 'desc->buflen + nbytes >= POLY1305_BLOCK_SIZE' in poly1305_update() could overflow if nbytes was in [UINT_MAX - 14, UINT_MAX]. Note that again, no current callers pass lengths this large. These issues date to the original introduction of the Poly1305 code. However, as noted above, they don't have any real-world impact currently; so this is an API robustness improvement only. Reported-by: Vladimir Kukharenko <vladimir@genproof.com> Closes: https://lore.kernel.org/r/20261012-libcrypto-4gib-lengths-v1-0-ea566c129a2e@genproof.com Tested-by: Vladimir Kukharenko <vladimir@genproof.com> Link: https://patch.msgid.link/20261014152604.323310-2-ebiggers@kernel.org Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-10-16bpf: Pack bpf_insn_aux_data flags into bit fieldsYonghong Song
struct bpf_insn_aux_data spreads its flags over eleven bools, a u8 of three bit fields and a u32 group with 25 of its 32 bits spare. Put them all in u64 bit fields, alu_state with them, which fit in the 32 bits beside seen, so orig_idx starts the next word. The structure goes from 216 bytes to 200, and stays there when a later patch adds a u32, which takes a hole further down. alu_state was a u8, but it only ever holds BPF_ALU_* flags, the highest of which is BPF_ALU_IMMEDIATE (1U << 4), so it gets five bits. With eight, the flags would take 34 bits, more than fit beside seen, so they would start a word of their own, and the later u32 would grow the structure to 208 bytes. A new BPF_ALU_* flag has to widen it. No functional change. Suggested-by: Eduard Zingerman <eddyz87@gmail.com> Signed-off-by: Yonghong Song <yonghong.song@linux.dev> Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-10-16Merge tag 'drm-misc-fixes-2026-10-15' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes A revert for the blend mode property patch being applied twice and a patch to reset the device when frozen in virtio, a power state fix for vc4, a Kconfig fix for amdxdna, an error handling, reference counting, and a null pointer dereference fix for rocket, a revert for dma-buf for a commit introducing a dangling reference, a locking fix for exec, and a fix for panthor to handle 10-core GPUs. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maxime Ripard <mripard@kernel.org> Link: https://patch.msgid.link/atCZfcTvshZx6mcA@houat
2026-10-15Merge branch 'mlx5-next' of ↵Jakub Kicinski
git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux Tariq Toukan says: ==================== mlx5-next updates 2026-10-11 * 'mlx5-next' of git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux: net/mlx5: IFC, Add capability bits for virtual LAG net/mlx5: Add cap_tx_speed and effective_tx_speed support to IFC ==================== Link: https://patch.msgid.link/20261011113534.802524-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-15net: dccp: uapi: clean up kernel-doc commentsRandy Dunlap
Use correct kernel-doc format for struct members and add comments for missing struct members (dccph_seq2 and reserved). Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Link: https://patch.msgid.link/20261011032800.278870-1-rdunlap@infradead.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-15net/sched: act_api: take tcfa_lock for hardware stats updatesAlexandre Cassen
Actions without per CPU stats update their counters under tcfa_lock in the software path but tcf_action_update_stats() adds hardware stats to the same counters without it. A dump of a filter without skip_hw does this even when nothing is offloaded, so such an action loses counter updates. On 32-bit, readers holding tcfa_lock can also observe torn 64-bit values. Callers disable preemption around this update for the per CPU stats. PREEMPT_RT forbids taking a spinlock_t with preemption disabled. Disable BH in the per CPU path instead. On 32-bit, this also keeps a softirq on the same CPU from updating or reading these counters in the middle of the update. Discovered by manual code inspection while letting more actions honor TCA_ACT_FLAGS_NO_PERCPU_STATS. Reproduced in a VM without kernel changes, where the second action counts fewer packets than the first: ip link add d0 type dummy && ip link set d0 up tc qdisc add dev d0 clsact tc filter add dev d0 ingress matchall \ action gact pipe action gact pass no_percpu yes "filter show dev d0 ingress" | head -10000 > batch while :; do tc -s -b batch; done > /dev/null & samples/pktgen/pktgen_bench_xmit_mode_netif_receive.sh -i d0 -t 4 tc -s filter show dev d0 ingress The 32-bit issue in the per CPU path comes from the Sashiko AI review of v1 [1] and was not reproduced. Tested with the reproducer and the tc-testing action, matchall and flower tests with lockdep enabled. Also tested for regressions on ConnectX-7 with firmware 28.48.1000. Cc: stable+noautosel@kernel.org # high regression risk, mixed-use actions are not commonly used in practice Fixes: 5e174d5e73df ("net: sched: modify stats helper functions to support regular stats") Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261009051703.3615846-1-acassen%40corp.free.fr [1] Signed-off-by: Alexandre Cassen <acassen@corp.free.fr> Reviewed-by: Eric Dumazet <edumazet@kernel.org> Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com> Link: https://patch.msgid.link/20261010152227.401987-1-acassen@corp.free.fr Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-15net: netmem: document netmem and memory provider design in commentsMina Almasry
Clarify the netmem, memory provider, page_pool, and skb fragment design principles in header and code comments: - Memory providers allocate struct net_iov or struct page, cast them to netmem_ref, and pass them to page_pool; page_pool, drivers, and the core stack operate on netmem_ref and must not downcast to page or net_iov outside dedicated netmem helpers. - While current memory providers supply struct net_iov, they are not architecturally restricted to net_iov and may supply page-backed netmems. - While current net_iov types are CPU-unreadable, net_iov has no inherent restrictions and may be readable or unreadable. - New code should generalize existing limitations as much as possible to match these design principles. - Per-provider logic belongs in memory_provider_ops, and per-netmem-type logic belongs in netmem helpers. - All frags in an skb must either all be struct page-backed or all belong to the same memory provider instance; mixing them (including via coalescing) is not allowed. Cc: Luigi Rizzo <lrizzo@google.com> Cc: Pavel Begunkov <asml.silence@gmail.com> Signed-off-by: Mina Almasry <almasrymina@google.com> Acked-by: Jesper Dangaard Brouer <hawk@kernel.org> Reviewed-by: Björn Töpel <bjorn@kernel.org> Acked-by: Stanislav Fomichev <sdf@fomichev.me> Link: https://patch.msgid.link/20261010033630.1171692-2-almasrymina@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-15sctp: re-point retained control chunks on association migrationJun Yang
sctp_sock_migrate() transfers DATA chunk ownership but leaves retained control chunks pointing at the old socket. A later retransmission can therefore access the socket after it has been freed. Extend the migration walk to cover retained control chunks and use sctp_control_set_owner_w() to assign their new owner. Reuse the DATA ownership check so each chunk is processed once per pass, even when it is reachable through multiple lists or retained pointers. Preserve a control chunk's existing authentication key across migration so its final release can still generate SCTP_AUTH_FREE_KEY when needed. Fixes: d04adf1b3551 ("sctp: reset owner sk for data chunks on out queues when migrating a sock") Cc: stable@kernel.org Reported-by: TencentOS Corvus AI <corvus@tencent.com> Signed-off-by: Jun Yang <junvyyang@tencent.com> Acked-by: Xin Long <lucien.xin@gmail.com> Link: https://patch.msgid.link/20261009074244.3718-3-juny24602@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-15Merge tag 'for-net-next-2026-10-14' of ↵Jakub Kicinski
git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next Luiz Augusto von Dentz says: ==================== bluetooth-next pull request for net-next: core: - Move H:4 reassembly into the Bluetooth core - Add generic support for vendor packets - MGMT: Add management security level changed event - MGMT: Allow connection rate request as peripheral - L2CAP: Add locking annotations and fix locking of channel operations - Enable context analysis for headers drivers: - btusb: Add support for Bulk Serialization Mode - btusb: Build the driver from multiple source files - btusb: Add support for Qualcomm multi-subsystem QCC2072 - btusb: Add support for Intel Otter Peak2 (OrP2) - btusb: Add USB ID 13d3:3556 for RTL8821CE - btusb: Add Realtek RTL8821CE device 13d3:3558 - btusb: Add device ID for Realtek RTL8761BUE (StarTech AV53C1) - btusb: Add device ID for MediaTek MT7925 (13d3:3631) - btusb: add ASUS 0b05:1825 and 0b05:1868 to QCA Rome quirks - btintel: load unlocker.sfi to allow unsigned firmware - btintel_pcie: Add support for Intel Draco - btintel_pcie: Add PCI ID and CNVi ID for Titan Lake - btintel_pcie: add MDBGC multi-buffer DBGC allocation - btintel_pcie: unified decoder coredump format - btmtk: Add MT7928 support - btmtk: Improve BT firmware logging - btbcm: Add Synaptics 4384 chip support - btbcm: Add entry for BCM4356A3 UART bluetooth * tag 'for-net-next-2026-10-14' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next: (120 commits) Bluetooth: hci_sync: scan unfiltered for host-resolved RPAs Bluetooth: Fix the LE Read Connection Interval response layout Bluetooth: L2CAP: Remove dead configuration state code Bluetooth: L2CAP: Only accept connection responses to outstanding requests Bluetooth: L2CAP: Use default TxWindow for zero socket option Bluetooth: L2CAP: Reject invalid TxWindow in configuration requests Bluetooth: L2CAP: Reject signalling responses in invalid states Bluetooth: L2CAP: Reject mode changes on connected channels Bluetooth: hci_event: Fix LE link drop on remote features command status Bluetooth: btusb: annotate Intel Otter Peak 2 USB ID Bluetooth: btintel_pcie: Add PCI ID for Titan Lake Bluetooth: btmtk: Add MT7928 support Bluetooth: MSFT: Serialize handle map cleanup with event processing Bluetooth: MGMT: Allow connection rate request as peripheral Bluetooth: btintel: load unlocker.sfi to allow unsigned firmware Bluetooth: btintel: Zero version data before parsing TLVs Bluetooth: selftest: Pin module for selftest debugfs file operations Bluetooth: L2CAP: Hold the listener while notifying child teardown Bluetooth: hci_vhci: Pin module for debugfs file operations Bluetooth: hci_sync: Protect IRK identity reads with RCU ... ==================== Link: https://patch.msgid.link/20261014184327.1648397-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-15Merge tag 'wireless-next-2026-10-15' of ↵Jakub Kicinski
https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Johannes Berg says: ==================== Lots of updates: - mt76 - mt7625 NAN fixes - mt7996 connection monitor fix - offchannel/scan improvements - MLO fixes - rtw88 - RTL8723BS support - SDIO TX performance improvements - rtw89 - P2P_DEVICE support - BT-coex updates - mm81x - monitor mode support - rx improvements - fix persistent NO_IR flag bug - iwlwifi - UHR sniffer support - support for newer UEFI/BIOS - cfg80211/mac80211 - latency improvements (e.g. some lockless ops) - RTNL reduction & locking cleanups * tag 'wireless-next-2026-10-15' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (462 commits) wifi: cfg80211: fix potential requested_regd leak wifi: cfg80211: reject WEP/TKIP with multi-link wifi: cfg80211: track SSID regardless of country data wifi: mac80211: tests: fix stack variable bug wifi: iwlwifi: mld: include VI packets in low latency detection wifi: iwlwifi: trans: remove the unused write8 operation wifi: iwlwifi: support SCD_QUEUE_CONFIG_CMD version 4 wifi: iwlwifi: mvm: uninline iwl_mvm_ftm_start versions wifi: iwlwifi: mvm: fix beacon flags compiler warning wifi: iwlwifi: mld: fix const in iwl_mld_mu_mimo_iface_iterator wifi: iwlwifi: mld: avoid const in iwl_mld_chan_load_update_iter() wifi: iwlwifi: pcie: correctly read WFPM_OTP_CFG1_ADDR wifi: iwlwifi: mvm: remove dead sta check in rx_monitor_no_data wifi: iwlwifi: mld: don't enable RSS if there is one queue. wifi: iwlwifi: move context info APIs to a separate file wifi: iwlwifi: fw: api: fix D3 sequence counter docs wifi: iwlwifi: mvm: fix the VHT MCS sent to a v1 firmware wifi: iwlwifi: bump maximum core version for BZ/SC/DR to 109 wifi: iwlwifi: dbg: validate the index before accessing an array wifi: iwlwifi: don't mask ucode_ver in iwl_sar_geo_support() ... ==================== Link: https://patch.msgid.link/20261015105035.137870-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-15ring-buffer: Unify ring buffer minimum page calculationsVincent Donnefort
The codebase scatters hardcoded minimum page limits across multiple places. Introduce RING_BUFFER_MIN_NR_PAGES and rb_calculate_nr_pages() to formalize the requirement of two pages in a ring buffer. Link: https://patch.msgid.link/20260911193937.602202-4-vdonnefort@google.com Signed-off-by: Vincent Donnefort <vdonnefort@google.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2026-10-15ring-buffer: Rename ring_buffer_size() to ring_buffer_capacity()Vincent Donnefort
Since commit 8a5f63637890 ("ring-buffer: Fix subbuf resize race with ring buffer readers"), "capacity" refers to the memory available for events (excluding subbuffer headers) while "size" refers to the raw allocation. ring_buffer_size() actually calculates this event capacity. Rename it to ring_buffer_capacity() to align with this convention. Link: https://patch.msgid.link/20260908090937.838544-2-vdonnefort@google.com Signed-off-by: Vincent Donnefort <vdonnefort@google.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2026-10-15tracing: Parse filter from boot event stringThomas Weißschuh
Make it possible to specify a trace event filter from the kernel command line. Example: trace_event=syscalls:sys_enter_clock_nanosleep:filter:which_clock==0 Link: https://patch.msgid.link/20260908-tracing-cli-event-filter-v2-7-05396a3fb663@linutronix.de Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2026-10-15tracing: Stop modifying the input buffer in ftrace_set_clr_event()Thomas Weißschuh
ftrace_set_clr_event() modifies its input buffer during parsing. Before returning to the caller these modifications are undone. This is restoration is error prone and was forgotten before. Upcoming changes will also make it more complicated. Copy the input argument and modify that copy and drop the restoration logic. Also mark the input argument as const. Link: https://patch.msgid.link/20260908-tracing-cli-event-filter-v2-3-05396a3fb663@linutronix.de Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2026-10-15tracing: Add "within" filter for call-stack-based event filteringChen Jun
Low-level kernel functions are called from many different paths. When debugging, it is often useful to filter trace events to only those occurring within a specific call chain. Add a "within" filter predicate that tests whether a given function appears in the current call stack at event time. The function name is resolved to its address range via kallsyms during filter setup; at runtime, stack_trace_save() captures the call stack and compares each return address against the stored range. Example: echo 'within == "vfs_read"' > events/sched/sched_switch/filter Only "==" and "!=" operators are supported. The filter depends on CONFIG_STACKTRACE. Link: https://patch.msgid.link/20260821233050.335986786@kernel.org Link: https://patch.msgid.link/20260608145556.94931-1-chenjun102@huawei.com Signed-off-by: Chen Jun <chenjun102@huawei.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2026-10-16genirq: Move interrupt thread exit_work object to irqactionRichard Patel
irq_thread() registers irq_thread_dtor() as exit task_work using a stack-allocated callback_head. On normal interrupt thread exit, this work gets cancelled and never runs. On x86, an abnormal interrupt thread exit (e.g. handler oops) discards the stack, including the callback_head, while that callback_head is still pending. By the time exit_task_work() runs, the stack memory formerly backing callback_head is already clobbered. irq_thread() <-- on_exit_work allocated ** IRQ handler faults ** oops_end() rewind_stack_and_make_dead() <-- on_exit_work freed make_task_dead() do_exit(SIGSEGV) ... exit_shm() <-- on_exit_work clobbered ... exit_task_work() <-- stack use-after-free exit_shm()+0x30 <-- wild jump to return addr Thus, a benign threaded IRQ oops (e.g. a NULL pointer deref) is turned into a wild jump. This is caught by kernel IBT: ** first fault ** Oops: general protection fault, kernel NULL pointer dereference 0x3c0: 0000 [#1] SMP NOPTI ... ** second fault ** Missing ENDBR: exit_shm+0x30/0x1c0 kernel BUG at arch/x86/kernel/cet.c:133! ... ? task_work_run+0x5c/0x90 ? do_exit+0x209/0x460 ? rewind_stack_and_make_dead+0x16/0x20 ... note: irq/165-AudioDS[1427] exited with irqs disabled Fixing recursive fault but reboot is needed! Fix this by storing the callback_head in struct irqaction. The irqaction is only freed once irq_thread_dtor() finishes. Fixes: 2deb4be28077 ("x86/dumpstack: When OOPSing, rewind the stack before do_exit()") Signed-off-by: Richard Patel <ripatel@wii.dev> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20261009145842.1616117-3-ripatel@wii.dev
2026-10-15ASoC: soc-component: move snd_soc_component_xxx() to soc-component.cMark Brown
Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> says: I'm now posting ASoC Capsuling patches. Current status, and this patch-set postion is below. This patch-set moves Component related functions to soc-component.c x: done o: This patch-set [x] move DAI functions [x] add new DAI functions [o] move Component functions [ ] move Card functions [ ] add new Component functions [ ] rename DAI/Component list [ ] move Card functions [ ] add new Card functions [ ] adjust Test [ ] use new Card register [ ] use new functions on all drivers [ ] Capsule DAI/Component/Card Link: https://patch.msgid.link/87pkxdyoml.wl-kuninori.morimoto.gx@renesas.com
2026-10-15ASoC: soc-component: rename snd_soc_component_async_complete()Kuninori Morimoto
snd_soc_component_async_complete() is regmap related function. Let's add _regmap_ on function name. It renames function name - snd_soc_component_async_complete() + snd_soc_component_regmap_async_complete() Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Reviewed-by: Alvin Šipraga <alvin.sipraga@analog.com> Link: https://patch.msgid.link/877bjlyokw.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-10-15ASoC: soc-component: move snd_soc_lookup_component() to soc-component.cKuninori Morimoto
struct snd_soc_component will be capsuled soon, its member will not be able to access from non soc-component.c. Move snd_soc_lookup_component() to soc-component.c It renames function name snd_soc_lookup_component_nolocked() -> snd_soc_component_lookup_nolock() snd_soc_lookup_component() -> snd_soc_component_lookup() snd_soc_lookup_component_by_name() -> snd_soc_component_lookup_by_name() Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Reviewed-by: Alvin Šipraga <alvin.sipraga@analog.com> Link: https://patch.msgid.link/878q41yokz.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-10-15ASoC: soc-component: move snd_soc_component_active() to soc-component.cKuninori Morimoto
struct snd_soc_component will be capsuled soon, its member will not be able to access from non soc-component.c. Move snd_soc_component_active() to soc-component.c Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Reviewed-by: Alvin Šipraga <alvin.sipraga@analog.com> Link: https://patch.msgid.link/87bj8xyol6.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-10-15ASoC: soc-component: move snd_soc_component_cache_sync() to soc-component.cKuninori Morimoto
struct snd_soc_component will be capsuled soon, its member will not be able to access from non soc-component.c. Move snd_soc_component_cache_sync() to soc-component.c It renames function name - snd_soc_component_cache_sync() + snd_soc_component_regmap_cache_sync() Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Reviewed-by: Alvin Šipraga <alvin.sipraga@analog.com> Link: https://patch.msgid.link/87cxtdyol9.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-10-15ASoC: soc-component: move snd_soc_component_to_dapm() to soc-component.cKuninori Morimoto
struct snd_soc_component will be capsuled soon, its member will not be able to access from non soc-component.c. Move snd_soc_component_to_dapm() to soc-component.c Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Reviewed-by: Alvin Šipraga <alvin.sipraga@analog.com> Link: https://patch.msgid.link/87ecdtyolc.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-10-15ASoC: soc-component: move soc_{probe/remove}_component() to soc-component.cKuninori Morimoto
struct snd_soc_component will be capsuled soon, its member will not be able to access from non soc-component.c. Move soc_{probe/remove}_component() to soc-component.c It renames function name - soc_{probe/remove}_component() + snd_soc_component_{probe/remove}() Then soc-component.c had original snd_soc_component_{probe/remove}() which is wrapper function. These wil be deployed internally. Releted fucntions also be moved. It renames function name. soc_set_name_prefix() -> snd_soc_component_set_name_prefix() soc_init_component_debugfs() -> snd_soc_component_debugfs_init() soc_cleanup_component_debugfs() -> snd_soc_component_debugfs_cleanup() Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Reviewed-by: Alvin Šipraga <alvin.sipraga@analog.com> Link: https://patch.msgid.link/87fqy9yoli.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-10-15ASoC: soc-component: move snd_soc_component_fixup_controls()Kuninori Morimoto
snd_soc_component_xxx_controls() are located between _probe() and _remove() in soc-component.c, and are located in scattered positions in soc-component.h. Fixup them. Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Reviewed-by: Alvin Šipraga <alvin.sipraga@analog.com> Link: https://patch.msgid.link/87jynlyolt.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-10-15ASoC: soc-component: move snd_soc_add_component_controls()Kuninori Morimoto
snd_soc_add_component_controls() is Component related function. And its parameter will be capsuled soon, will be not enable to access from soc-core.c. Move it to soc-component.c It renames function name - snd_soc_add_component_controls() + snd_soc_component_add_controls() Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Reviewed-by: Alvin Šipraga <alvin.sipraga@analog.com> Link: https://patch.msgid.link/87ld81yolw.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-10-15ASoC: soc-component: replace bool member to bit fieldKuninori Morimoto
soc-component has meny bit fields (A), no need to have bool member (B). Let's makes it as bit field, too struct snd_soc_component_driver { ... ^ unsigned int module_get_upon_open:1; (A) unsigned int idle_bias_on:1; | unsigned int suspend_bias_off:1; | ... v unsigned int legacy_dai_naming:1; ... (B) bool use_dai_pcm_id; ... } Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Reviewed-by: Alvin Šipraga <alvin.sipraga@analog.com> Link: https://patch.msgid.link/87mrshyom0.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-10-15ASoC: soc-component: tidyup be_hw_params_fixup() define positionKuninori Morimoto
be_hw_params_fixup() is one of snd_soc_component_driver callback function, but is defined as alone in a remote location. Let's move it to the same place as other callbacks. Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Reviewed-by: Alvin Šipraga <alvin.sipraga@analog.com> Link: https://patch.msgid.link/87o6cxyom4.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-10-15ASoC: Series of loose fixesMark Brown
Amadeusz Sławiński <amade@asmblr.net> says: Following current fashion of poking code with LLM to see what issues it finds. Some are minor, other more likely to cause some real issues like the one with snd_soc_limit_volume() returning positive value, while callers do simple if (ret) check. Link: https://patch.msgid.link/20261014200608.118770-1-amade@asmblr.net
2026-10-15ASoC: soc-component: Fix return type of snd_soc_pcm_component_pointer()Amadeusz Sławiński
Both caller and pointer callback expect the return value to be snd_pcm_uframes_t, however it was defined incorrectly leading to potential truncation of returned value. Fixes: 0035e2565b93 ("ASoC: soc-component: add snd_soc_pcm_component_pointer()") Signed-off-by: Amadeusz Sławiński <amade@asmblr.net> Link: https://patch.msgid.link/20261014200608.118770-8-amade@asmblr.net Signed-off-by: Mark Brown <broonie@kernel.org>
2026-10-15io_uring: wake ring pollers for local task_workJosef Bacik
With IORING_SETUP_DEFER_TASKRUN completions are queued as local work, and only become CQEs when the submitter enters the kernel to wait for events. For an application that finds out via poll() or epoll on the ring fd when it is time to do that, io_uring_poll() reports EPOLLIN if local work is pending. That only helps if the work is there at the time of the call. When DEFER_TASKRUN was added, io_req_local_work_add() did io_cqring_wake(), which took care of tasks sleeping in poll() as well. Then polling got a wait queue of its own, ->poll_wq, and the wake up in io_req_local_work_add() was replaced by waking the submitter directly. Since then ->poll_wq is only woken when CQEs are committed, which for such a ring is done by the very task that is waiting to be told to: submitter completion poll(ring_fd) io_uring_poll() // nothing yet schedule() io_req_local_work_add() // ->cq_wait_nr: nobody waits // sleeps on Wake ->poll_wq when the first entry is put on the work list. Like for the eventfd, that must not be done right away if the work is queued from a wake up handler, as the chain of wake ups could get back to the wait queue whose lock is held. Use an RCU callback in that case, with a reference to the ring. Fixes: 130bd686d9be ("io_uring: waitqueue-less cq waiting") Assisted-by: LLM Signed-off-by: Josef Bacik <josef@toxicpanda.com> Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-19-c1556f5d7bf5@toxicpanda.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-10-15Merge branch 'io_uring-7.3' into for-7.4/io_uringJens Axboe
Merge 7.3 fixes to avoid conflicts with future changes merged for the 7.4 kernel. * io_uring-7.3: io_uring/cancel: don't spin on local work the task can't run io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6 io_uring/register: don't exempt disabled rings from task restrictions io_uring/kbuf: don't charge provided buffer rings to RLIMIT_MEMLOCK io_uring: do not charge the SQ/CQ rings to RLIMIT_MEMLOCK io_uring: fix task_work add use-after-free with SQPOLL io_uring/cmd_net: end TX_TIMESTAMP multishot when the CQ is full io_uring/zcrx: requeue multishot receives stopped by a local resource io_uring: initialize task context before running the BPF loop
2026-10-15of: overlay: remove unused of_overlay_remove_all()Abdurrahman Hussain
of_overlay_remove_all() has no in-tree callers. It is also subtly broken. It passes &ovcs->id to of_overlay_remove(), which zeroes *ovcs_id once the changeset is reverted, before calling free_overlay_changeset(). Through the aliased pointer that zeroes ovcs->id itself, so free_overlay_changeset()'s "ovcs->id > 0" guard is false and both idr_remove() and list_del() are skipped: the overlay_changeset is kfree()d while still linked in ovcs_list and registered in ovcs_idr. Rather than fix a helper nobody calls, remove it, along with its !CONFIG_OF_OVERLAY stub and the paragraph documenting it in overlay-notes.rst and in the zh_CN translation. ovcs_list itself stays: overlay_removal_is_ok() still walks it to check that a changeset is topmost. Reported-by: Sashiko AI <sashiko-bot@kernel.org> Closes: https://lore.kernel.org/20260901014554.83A8D1F000E9@smtp.kernel.org Suggested-by: Rob Herring <robh@kernel.org> Link: https://lore.kernel.org/all/20260928182658.GA185307-robh@kernel.org/ Signed-off-by: Abdurrahman Hussain <abdurrahman@nexthop.ai> Link: https://patch.msgid.link/20261014-b4-of-overlay-remove-all-fix-v2-1-cf5ea2cc9dc3@nexthop.ai Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2026-10-15Merge branch 'for-next/fw-rmi' into for-next/coreCatalin Marinas
* for-next/fw-rmi: : RMM v2.0 base RMI support firmware: arm_rmm: hotplug: Skip memory added to ZONE_MOVABLE firmware: arm_rmm: Add wrappers for Realm related RMI commands arm64: Block hibernate and kexec while RMM is active PM: hibernate: Add an arch hook for preventing hibernation firmware: arm_rmm: Ensure the RMM has GPT entries for memory firmware: arm_rmm: Activate the RMM firmware: arm_rmm: Add support for SRO firmware: arm_rmm: Configure the RMM with the host's page size firmware: arm_rmm: Check for RMI support at init firmware: arm_rmm: Add SMC definitions for calling the RMM arm64: mm: Handle Granule Protection Faults (GPFs)
2026-10-15Merge branches 'for-next/misc', 'for-next/be-gone', 'for-next/smccc-bus', ↵Catalin Marinas
'for-next/preemptible-this-cpu', 'for-next/cpu-errata', 'for-next/mpam', 'for-next/kselftest', 'for-next/efi', 'for-next/secondary-boot-prep', 'for-next/sysreg' and 'for-next/gcs', remote-tracking branch 'arm64/for-next/perf' into for-next/core * arm64/for-next/perf: (22 commits) drivers/perf: apple_m1: Add macOS 27 M2 Event perf/marvell: cn10k_tad: Publish the OF module alias perf: xgene: initialize lock before requesting IRQ perf: marvell: avoid large stack variables perf/dwc_pcie: Fix PCI device reference leak in probe coresight: perf: Suppress ITRACE start records perf: arm_spe: Suppress redundant ITRACE start records perf/core: Export perf_event_itrace_started() perf/cxl: Clear stale overflow status before using a counter perf/cxl: Don't log through pmu.dev in the overflow interrupt handler perf/cxl: Validate the hardware-reported counter width perf/cxl: Unfreeze counters after handling an overflow interrupt perf/cxl: Don't share the overflow interrupt, and keep it pinned cxl/pci: Add the PMUs after configuring events perf/cxl: Split the MSI vector out of info->irq perf/cxl: Accept an overflow interrupt on MSI message number 0 perf/cxl: Fix the counter overflow delta fixup perf/cxl: Clear stale event fields before reprogramming a counter perf/cxl: Program the requested event group on configurable counters drivers/perf: hisi: Add cycle event for new MN PMU ... * for-next/misc: arm64: cpufeature: Enable BBML2 for NVIDIA Rigel arm64: cputype: Add NVIDIA Rigel definitions arm64: raise default ARCH_MMAP_RND_BITS for 48-bit and 52-bit VA arm64/debug: mask debug exceptions when called from common code arm64: clear_page[s] using memset arm64/sve: Don't zero the SVE state buffer when the SVE state is live arm64/cpufeature: Drop redundant define(ID_AA64MMFR0..._SUPPORTED_LPA2) arm64: Use proper include variant arm64: include: fix repeated word 'to' in comment selftests: arm64: fix typo "hander" in comment arm64: fix typos in comments docs: arm64: Fix typo "initalised" in booting.rst arm64: alternative: Remove 'cfg' parameter arm64: mte-kasan: Use IS_ENABLED() rather than ALTERNATIVE() 'cfg' parameter arm64/cpufeature: Change description for ARM64_HAS_LPA2 * for-next/be-gone: drivers: Kconfig: Simplify dependencies on ARM64 && !CPU_BIG_ENDIAN arm64: Kbuild: Remove vestigial big-endian support gve: Add explicit ARM64 dependency to Kconfig crypto: hisilicon/sec2: Remove check of CONFIG_CPU_LITTLE_ENDIAN arm64: Remove all usage of __AARCH64EB__ arm64: Remove all usage of CONFIG_CPU_BIG_ENDIAN KVM: arm64: Remove support for a big-endian hypervisor object arm64: vdso32: Always build compat vDSO object as little-endian arm64: assembler: Remove endianness helper macros arm64: lib: Assume a little-endian kernel in optimised string routines arm64: lib: Assume a little-endian kernel in custom library routines arm64: crypto: Assume a little-endian kernel arm64: bpf: Remove big-endian support from the JIT compiler selftests/arm64: Remove big-endian support * for-next/smccc-bus: : Switch Arm SMCCC firmware services to an SMCCC bus arm64: rsi: Correct type of realm_config::hash_algo firmware: smccc: Pass only the required device probe arguments firmware: arm_rmm: Add SPDX and sort the Kconfig and Makefile entries coco: guest: arm64: Remove dummy CCA platform device coco: guest: arm64: Add sysfs ABI for CCA Realm guests firmware: smccc: arm-cca-guest: Bind the TSM provider to an SMCCC device virt: coco: arm-cca-guest: Rename TSM report source file arm64: realm: Move Realm memory encryption ops to RSI code firmware: arm_rmm: Move RSI support out of arch/arm64 firmware: hwrng: arm_smccc_trng: Register as an SMCCC device firmware: smccc: Add an Arm SMCCC bus * for-next/preemptible-this-cpu: : Preemptible this_cpu_*() operations arm64: percpu: Remove _pcp_protect*() wrappers arm64: percpu: Implement preemptible CMPXCHG128 ops arm64: percpu: Implement preemptible CMPXCHG ops arm64: percpu: Implement preemptible XCHG ops arm64: percpu: Implement preemptible return RMW ops arm64: percpu: Implement preemptible void RMW ops arm64: percpu: Implement preemptible read/write ops arm64: percpu: Add infrastructure for preemptible this_cpu_*() ops arm64: entry: sdei: Make 'tsk' available arm64: entry: sdei: Restore all clobberable GPRs arm64: gpr-num: add __GPR_NUM() helper arm64: gpr-num: Add wxN aliases for wN registers arm64: percpu: Factor out percpu offset asm arm64: ptrace: Always inline pt_regs_{read,write}_reg() arm64: preempt: Treat should_resched() as unlikely arm64: preempt: Simplify and optimize __preempt_count_dec_and_test() arm64: cmpxchg128: LSE: Remove redundant operands arm64: cmpxchg: LL/SC: Avoid redundant extension * for-next/cpu-errata: : Various CPU errata workarounds arm64: errata: Add NXP i.MX8QM/8QP workaround for A53 cache coherency issue arm64: cpufeature: Add ARM64_CPUCAP_SOC_ERRATUM for SoC-level errata * for-next/mpam: (30 commits) : MPAM updates arm_mpam: make the mon_sel guard conditional only arm_mpam: On saving mbwu state read the monitors before clearing CFG_MBWU_CTL arm_mpam: detect and enable MPAM-Fb PCC support arm_mpam: change MPAM-Fb error IRQ to use a threaded IRQ handler arm_mpam: add MPAM-Fb MSC firmware access support arm_mpam: prepare mon_sel locking for MPAM-Fb arm_mpam: propagate MSC access errors in mpam_reset_class_locked() arm_mpam: propagate MSC access errors for interrupt control arm_mpam: propagate MSC access errors for mpam_reprogram_ris_partid() arm_mpam: propagate MSC access errors for state saving function arm_mpam: propagate MSC access errors for __ris_msmon_read() arm_mpam: propagate MSC access errors for msmon helpers arm_mpam: propagate MSC access errors for MBWU counters arm_mpam: propagate MSC access errors for hw_probe functions arm_mpam: let low level MSC accessors return an error MAINTAINERS: Use linux-arm-kernel list for the MPAM driver MAINTAINERS: Add mpam.rst to the MPAM DRIVER entry arm_mpam: resctrl: Don't stop early when tearing down a class arm_mpam: Switch to kvzmalloc_objs() for allocation of component cfg arm_mpam: Don't loop forever if there is the maximum possible amount of PARTIDs ... * for-next/kselftest: : arm64 kselftest updates kselftest/arm64: signal: copy each test binary only once kselftest/arm64/mte: Use MTE safe memory accessors kselftest/arm64/mte: Introduce MTE safe memory accessors kselftest/arm64: Extend gcs-locking to cover cases where enable is unlocked * for-next/efi: : arm64 EFI updates/fixes arm64/mm: Treat faults taken by EFI runtime firmware as kernel faults arm64/efi: Clear PTE_WRITE when applying EFI_MEMORY_RO * for-next/secondary-boot-prep: : cpuinfo cleanup in preparation for parallel secondary bring-up arm64: smp: Defer RCU registration during secondary CPU bringup arm64: smp: Don't bother printing the I-cache policy for each CPU arm64: smp: Defer update of secondary CPU capabilities arm64: smp: Tidy up cpuinfo init and cpufeature updates arm64: smp: Tidy up smp_prepare_cpus() arm64: cpufeature: Store every ID register with its overrides applied arm64: cpufeature: Read MPAMIDR_EL1 in __cpuinfo_store_cpu() arm64: cpufeature: Add read_cpuid_with_overrides() arm64: cpufeature: Check arm64_ftr_regs[] before the first store * for-next/sysreg: : sysreg updates perf: arm_brbe: Remove the check for TME transaction states arm64: sysreg: Mark fields the architecture dropped as RES0 arm64: sysreg: Fix the names of two misspelt fields arm64: sysreg: Fix three incorrect enum values * for-next/gcs: : GCS updates/fixes kselftest/arm64: Check for -EPERM not -EBUSY in the locking test arm64: gcs: Return -EPERM not -EBUSY for prctl() locking failures
2026-10-15iommufd/iova_bitmap: Ensure that iova_bitmap_set() handles the full IOVAAndrea Parri
Generally userspace is going to step the dirty bitmap through the IOVA space. However if the bitmap ends in the middle of a large PTE this is problematic. The first step will clear the dirty bit and report dirty to the end of its bitmap while the second step will see the clear'd dirty and report clean for the start of the bitmap. If it happens this ends up losing dirties. Further this function is missing bounds checking so if this does happen ther is a good chance it will write memory beyond what the userspace was expecting. Return an error code if this illegal condition happens. Fixes: 58ccf0190d19 ("vfio: Add an IOVA bitmap support") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Andrea Parri <parri.andrea@gmail.com> Link: https://patch.msgid.link/20260925161142.189813-2-parri.andrea@gmail.com Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-10-15ALSA: core: Serialize snd_refcount put and syncTakashi Iwai
When a thread tries to sync-and-destroy the resource with snd_refcount_sync(), it might lead to a UAF in a very slight time window. Namely, snd_refount_put() calls wake_up() after atomic_dec_and_test(), but wait_event() in snd_refcount_sync() checks the condition via atomic_test() without serialization, hence the thread that called snd_refcount_sync() can continue immediately to release the resource before another thread calls wake_up(). For avoiding the race above, introduce the spinlock and take it at snd_refcount_put() and snd_refcount_sync() in order to serialize the operations. Fixes: dcca9b6064c3 ("ALSA: Add simple refcount helper functions") Reported-by: Sashiko <sashiko-bot@kernel.org> Closes: https://sashiko.dev/#/patchset/20261015071838.31082-1-tiwai%40suse.de Reviewed-by: Cen Zhang <zzzccc427@gmail.com> Link: https://patch.msgid.link/20261015112256.3902-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-10-15Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski
Cross-merge networking fixes after downstream PR (net-7.3-rc8). No conflicts. Adjacent changes: drivers/net/ethernet/microchip/lan865x/lan865x.c 2a3f6d2a9ac3 ("microchip: lan865x: move setting of netops to fix crash") 15358c2c3dca ("net: ethernet: oa_tc6: return ERR_PTR from oa_tc6_init()") Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-15USB: Documentation: Update description of completion callback contextAlan Stern
The existing kerneldoc documentation for URB completion callbacks is incorrect about the context in which the callbacks occur; it is not always in_interrupt. State explicitly that a callback may occur in any context with no guarantees, and likewise for the status of CPU-local interrupts. Documentation update only; no code changes. Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Link: https://patch.msgid.link/de582feb-a0aa-4fc8-9818-890014de32a9@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-10-15ASoC: qcom: Add QAIF driver for Shikra audio platformMark Brown
Harendra Gautam <harendra.gautam@oss.qualcomm.com> says: This series introduces the Qualcomm Audio Interface (QAIF) driver for the Shikra audio platform. Hardware IP Overview ==================== QAIF (Qualcomm Audio Interface) is a fully configurable DMA-based audio subsystem used to transmit and receive audio data over serial audio interfaces (PCM, TDM, MI2S) and to provide a DMA interface for internal codec connections. It manages two independent data paths: AIF (Audio Interface): multiple multi-lane Unified Audio Interfaces, each supporting up to 8 independent data lanes. Each lane is individually configurable as TX (output/speaker) or RX (input/mic). All lanes of an interface share a single bit clock and frame sync. Supported modes are PCM (short/long sync), TDM, and MI2S (stereo/mono). Per-interface configuration includes sync source (master/slave), sync mode, sync delay, sync inversion, slot width (8/16/24/32-bit), sample width, active slot masks (up to 32 slots), bits-per-lane frame size, lane enable/direction masks, loopback, output-enable control, and full-cycle path support for long chip-to-chip connections. CIF (Codec Interface): multiple RDDMA (playback) and WRDMA (capture) channels connecting to an internal codec over a parallel bus. Each channel supports active-channel enable mask (up to 16 channels), frame-sync selection, frame-sync delay, frame-sync output gating, dynamic clock gating, and 16-bit packing/unpacking. Note on RX/TX naming convention: in QAIF, TX refers to the output (speaker/playback) direction and RX refers to the input (mic/capture) direction. This applies to both AIF lane directions and CIF slot/mask properties. DMA Engine: RDDMA fetches audio from DDR/TCM/LPM into a shared SRAM latency buffer (SHRAM) and drains it to the interface. WRDMA collects data from the interface into SHRAM and writes it to memory. Each DMA owns a private SHRAM region defined by start address and length registers. Burst sizes of 1/2/4/8/16 beats (64-bit) are supported with up to 4 outstanding transactions per DMA. Two QSB master ports (QXM0 for TCM, QXM1 for DDR/LPM) provide the memory interface. Execution Environments (EE): Resources (DMAs, audio interfaces, interface groups) are partitioned among up to 5 EEs via map registers. Each EE owns a set of DMAs, audio interfaces, and interface groups, and receives its own independent interrupt output. The interrupt hierarchy has a two-level structure: a summary register identifies the event class (DMA period, underflow/overflow, error response, audio interface underflow/overflow, group done, rate detector, VFR), and per-resource status registers identify the specific channel. Interface Grouping (Bonding): Multiple AIF and CIF interfaces can be bonded into a group to start synchronously and align their DMA period interrupts within half a frame duration using the RDDMA padding feature. Up to 6 groups are supported. Rate Detector: Two rate detector blocks measure the frequency of incoming frame sync or word select signals and generate interrupts on rate change, undetected rate, or sync timeout. Block Diagram ============= System Memory (DDR / LPM / TCM) +---------------------------------+ | Circular Buffers (ping-pong) | +----------+----------+-----------+ | ^ 64-bit AXI 64-bit AXI | | +----------v----------+-----------+ | QSB Master Ports | | +----------+ +----------+ | | | QXM0 | | QXM1 | | | +----+-----+ +-----+----+ | +-------|--------------|----------+ | | +-------v--------------v----------+ | Shared RAM (SHRAM) | | +------------+ +------------+ | | | QXM0 Read | | QXM0 Write | | | | SHRAM | | SHRAM | | | +------------+ +------------+ | | +------------+ +------------+ | | | QXM1 Read | | QXM1 Write | | | | SHRAM | | SHRAM | | | +------------+ +------------+ | +---+--------+--------+-------+---+ | | | | +---v--+ +--v---+ +--v---+ +-v----+ |RDDMA | |RDDMA | |WRDMA | |WRDMA | | AIF | | CIF | | AIF | | CIF | |[0..n]| |[0..n]| |[0..n]| |[0..n]| +--+---+ +--+---+ +--+---+ +-+----+ | | ^ ^ | TX | TX | RX | RX v v | | +--+--------------------+ +----+----------+ | Unified Audio Intf | | Codec DMA | | (AIF 0..12) | | Interface | | | | (CIF) | | AUD_INTFa block: | | | | - Serializer (TX) | | RDDMA: DDR -> | | - De-serializer (RX) | | internal | | - Sync gen/detect | | codec | | - Up to 8 data lanes | | WRDMA: codec | | - PCM / TDM / MI2S | | -> DDR | | - Near Pad Logic | | Up to 16 ch | +--+--------------------+ +----+----------+ | Lane 0..7 (TX/RX) | Parallel bus | Bit clk + Frame sync | + Frame sync v v +--+--------+ +------+------+ | External | | Internal | | Serial | | Digital | | Peripherals| | Codec | | (PCM/TDM/ | | (Bolero/ | | MI2S) | | WCD) | +-----------+ +-------------+ Software Design =============== The driver follows the standard ALSA SoC split: qaif-cpu.c: CPU DAI component. Manages clocks, implements DAI ops (startup/shutdown/hw_params/trigger) for both AIF and CIF paths using direct regmap_update_bits() calls with address macros from qaif-reg.h, registers an of_xlate_dai_name callback so that sound-dai references using non-sequential DAI IDs resolve correctly, parses per-interface AIF configuration from DT child nodes, and provides runtime PM suspend/resume via pm_runtime_force_suspend/resume for power collapse. AIF child nodes use standard properties (dai-format, dai-tdm-slot-*, qcom,qaif-aif-lane-map) without a compatible string; the protocol is identified by dai-format and set_fmt() is called by the machine driver. qaif-platform.c: PCM platform component. Handles DMA buffer allocation (dma_alloc_pages()), PCM ops (open/close/hw_params/hw_free/prepare/trigger/ pointer/mmap/copy), and table-driven two-level IRQ dispatch with period-elapsed notification. qaif-shikra.c: Shikra SoC-specific variant descriptor. Provides register base addresses, DMA channel counts, SHRAM geometry, clock names and the DAI driver array. This abstraction keeps the core driver portable across future QAIF integrations. qaif.h / qaif-reg.h: Shared data structures, constants and the complete MMIO register address map consumed by both the CPU and platform drivers. soc-core.c: This series adds snd_soc_of_xlate_dai_name() as a generic ASoC helper that resolves a sound-dai phandle argument to a DAI name by searching the component DAI list by ID. Both lpass-cpu.c and qaif-cpu.c assign it directly as .of_xlate_dai_name, removing their private implementations. The series is split by functionality to aid review -- register map and data structures first, then CPU DAI ops with regmap and DT parsing, the of_xlate helper, PCM ops, IRQ handling and finally the Shikra variant glue. Link: https://patch.msgid.link/20261013-b4-qaif-shikra-audio-v9-0-f3022e28f2fd@oss.qualcomm.com
2026-10-15ASoC: soc-core: Add snd_soc_of_xlate_dai_name() generic helperHarendra Gautam
Some ASoC CPU DAI drivers need to resolve a sound-dai phandle argument to a DAI name by matching the argument against the component's DAI IDs. lpass-cpu carries a local implementation of this lookup. Add snd_soc_of_xlate_dai_name() to soc-core.c as a generic helper that can be assigned directly to the .of_xlate_dai_name component driver callback. It iterates the component's DAI list using for_each_component_dais() and matches by DAI ID. Signed-off-by: Harendra Gautam <harendra.gautam@oss.qualcomm.com> Link: https://patch.msgid.link/20261013-b4-qaif-shikra-audio-v9-5-f3022e28f2fd@oss.qualcomm.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-10-15vdso/math64: Add and use __iter_div64_u64_rem()Zhan Xusheng
The vDSO basetimes for CLOCK_MONOTONIC and CLOCK_BOOTTIME are stored in the scaled nanoseconds of tkr_mono, so normalising them requires a division by NSEC_PER_SEC << shift. That divisor does not fit the u32 parameter of __iter_div_u64_rem(), so update_vdso_time_data() open-codes the same iterative division twice. Repeated subtraction is the appropriate form at these two sites because the quotient never exceeds one. accumulate_nsecs_to_secs() keeps xtime_nsec below one scaled second, and the offset added to it is a normalised timespec64 fraction, so the dividend stays below twice the divisor. That bound holds on every architecture, which matters more here than the cost of a division on any particular one. Add __iter_div64_u64_rem(), the u64-divisor counterpart of __iter_div_u64_rem(), and use it at both sites. Return the quotient as a u32 for consistency with the u32-divisor variant; the bound above leaves no use for a wider type. Store the remainder directly into the basetime, as the coarse clocks already do. The CLOCK_BOOTTIME copy of the CLOCK_MONOTONIC values then takes both fields from the same place. Folding the two open-coded loops into one inlined helper removes 16 bytes of vsyscall.o text on x86-64 with gcc 13. No functional change. Suggested-by: David Laight <david.laight.linux@gmail.com> Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Reviewed-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Link: https://patch.msgid.link/20261002153104.1347978-3-zhanxusheng@xiaomi.com
2026-10-15vdso/math64: Use OPTIMIZER_HIDE_VAR() in __iter_div_u64_rem()Zhan Xusheng
__iter_div_u64_rem() open-codes an empty asm() to keep the compiler from turning the subtraction loop into a modulo operation. That is what OPTIMIZER_HIDE_VAR() is for, so use it and reflow the comment. The macro lives in linux/compiler.h, which this header did not include. vdso/math64.h is reached from linux/math64.h, whose includes are linux/types.h, linux/math.h, asm/div64.h and vdso/math64.h; none of them guarantees linux/compiler.h. x86 happens to get it through asm/div64.h -> linux/log2.h, m68k's asm/div64.h only pulls in asm-generic/div64.h and linux/types.h, so the macro is undeclared there and the build fails with -Werror=implicit-function-declaration. Include linux/compiler.h so the header no longer depends on its includer. This is a no-op for the vDSO, where lib/vdso/gettimeofday.c already gets it through linux/build_bug.h, and vdso/unaligned.h sets the same precedent by including linux/compiler_types.h. Reported-by: kernel test robot <lkp@intel.com> Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20261002153104.1347978-2-zhanxusheng@xiaomi.com Closes: https://lore.kernel.org/oe-kbuild-all/202609300626.zwNjKaO6-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202609301300.uAawkHuh-lkp@intel.com/
2026-10-15vdso: Remove __ASSEMBLER__ guards from vsyscall.hThomas Weißschuh
These headers are only used from regular C code. Remove the unnecessary guards. Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260909-vdso-asm-generic-vsyscall-h-v1-15-63ae856cc659@linutronix.de
2026-10-15vdso: Add asm-generic/vdso/vsyscall.hThomas Weißschuh
Most architectures' asm/vdso/vsyscall.h do not define any symbols. Add an empty asm-generic variant and replace the pointless architecture-specific copies. Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260909-vdso-asm-generic-vsyscall-h-v1-14-63ae856cc659@linutronix.de
generated by cgit v1.2.3 (git 2.0.4) at 2026-11-07 01:53:27 +0000