summaryrefslogtreecommitdiff
path: root/include
AgeCommit message (Collapse)Author
2026-07-30mm/damon/core: introduce damon_nr_accesses_mvsum()SJ Park
Patch series "mm/damon: optimize out nr_accesses_bp". TLDR: Replace damon_region->nr_accesses_bp, which is easy to be wrong, with a simpler on-demand moving sum function, damon_nr_accesses_mvsum(). Background ========== DAMON's monitoring output (access pattern snapshot, or more technically speaking, damon_region->nr_accesses) is completed once per aggregation interval, which is 100 ms by default. Users can arbitrarily increase the interval for demand. Under the suggested intervals auto-tuning setup, it can span up to 200 seconds. If the aggregation interval is too long, the snapshot users cannot use it in reasonable time. To mitigate this, we introduced a new field of damon_region, namely nr_accesses_bp. It contains a pseudo moving sum of nr_accesses in bp units and is updated for each sampling interval. It turned out keeping it correctly updated every sampling interval is not that easy. From online parameter update feature development and more experimental hacks, we found it is easy to be corrupted. Once it is corrupted, DAMON's monitoring outputs become quite insane. Hence we added a few validation checks. It is easy to be corrupted because it requires every update per sampling interval to be correct. Solution ======== There is no real reason to keep it updated every sampling interval. Due to the simple pseudo-moving sum mechanism and existing helper field (last_nr_accesses), we can also calculate the pseudo moving sum on demand in a much simpler way. Implement a function for getting the pseudo moving sum on demand, and replace nr_accessses_bp uses with the new function. Also remove no more needed tests for nr_accesses_bp and the per-sampling interval update functions. Finally, remove the nr_accesses_bp. The new function is quite simple. Discussion ========== Depending on the use case, multiple nr_accesses readers could be executed in the same kdamond_fn() main loop iteration, which is executed once per sampling interval. Such readers include DAMON region exporting tracepoints (damon_[region_]aggregated and damos_before_apply), DAMOS, and DAMON sysfs interface logic for update_schemes_tried_regions command. In this case, the new function will be called multiple times and this could be overhead compared to the old logic, which simply reads the field without any additional work. Nonetheless, the new function is quite simple. And the new approach does nothing while there is no need to read. The old approach had to execute its update function for each region for every sampling interval. Hence the new approach is believed to be even more lightweight in common case, and the overhead is anyway negligible. One more advantage of this change is that one field from the damon_region struct is removed. On setups that uses a high number of DAMON regions, this could be a potential memory space benefit. Patches Sequence ================ Patch 1 introduces the new function for getting the pseudo moving sum of nr_accesses on demands. Patch 2 implements a unit test for the new function's internal logic. Patch 3 and 4 update monitoring logic and the new function to ready for safe use on the existing logic. Patches 5-7 replace uses of nr_accesses_bp in DAMOS, tracepoints and DAMON sysfs interface with the new function, respectively. Patches 8-10 removes nr_accesses_bp validation functions in DAMON core, one by one. Patches 11 and 12 further remove tests and test helper for nr_accesses_bp, respectively. Patches 13 removes the setups and updates or nr_accesses_bp field. Patches 14-16 cleans up function parameters that are no more being used due to the previous patch. Patch 17 removes the function that was used for updating nr_accesses_bp field with its unit test, which is the single remaining caller of the function. Finally, patch 18 removes damon_region->nr_accesses_bp field. This patch (of 18): Introduce a new DAMON core function, damon_nr_accesses_mvsum(). It returns a pseudo moving sum value of a given region's nr_accesses for the last aggregation interval. The internal logic is the same to nr_accesses_bp. The difference is that nr_accesses_bp is updated for each sampling interval, while the new function needs to be executed only when requested. Hence the function's return value is the same as the value of nr_accesses_bp. Link: https://lore.kernel.org/20260630040812.149729-1-sj@kernel.org Link: https://lore.kernel.org/20260630040812.149729-2-sj@kernel.org Signed-off-by: SJ Park <sj@kernel.org> Cc: Brendan Higgins <brendan.higgins@linux.dev> Cc: "Masami Hiramatsu (Google)" <mhiramat@kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Cc: Shuah Khan <shuah@kernel.org> Cc: Steven Rostedt <rostedt@goodmis.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-07-30mm: gfp_types: fix __GFP_ACCOUNT, GFP_KERNEL_ACCOUNT documentationJohannes Weiner
Gregory points out that these descriptions are cursed and confusing, considering what these flags actually do. This is mostly due to historic implementation choices and cgroup1 baggage. Improve the description of their actual effects. Link: https://lore.kernel.org/20260701182102.1586784-1-hannes@cmpxchg.org Signed-off-by: Johannes Weiner <hannes@cmpxchg.org> Reported-by: Gregory Price <gourry@gourry.net> Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Acked-by: Shakeel Butt <shakeel.butt@linux.dev> Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org> Reviewed-by: Gregory Price <gourry@gourry.net> Acked-by: SJ Park <sj@kernel.org> Cc: David Hildenbrand <david@kernel.org> Cc: Liam Howlett <liam.howlett@oracle.com> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@kernel.org> Cc: Muchun Song <muchun.song@linux.dev> Cc: Roman Gushchin <roman.gushchin@linux.dev> Cc: Suren Baghdasaryan <surenb@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-07-30mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplugGregory Price
We miss a failed allocation check for pgdat->per_cpu_nodestats, which results in a NULL deref when we offset into the per-cpu area. Propagate -ENOMEM up the stack and leave per_cpu_nodestats pointing at boot_nodestats so a later online can retry the allocation. hotadd_init_pgdat() returns NULL on failure, which __try_online_node() already maps to -ENOMEM. On failure nothing needs to be unwound: - the node is never marked online - per_cpu_nodestats is left pointing at boot_nodestats - __add_memory_resource() cleans up pending memblock resources - later online attempts retry the per_cpu_nodestats allocation Link: https://lore.kernel.org/20260701221613.2818148-1-gourry@gourry.net Fixes: 75ef71840539 ("mm, vmstat: add infrastructure for per-node vmstats") Signed-off-by: Gregory Price <gourry@gourry.net> Reported-by: Sashiko <sashiko-bot@kernel.org> Link: https://sashiko.dev/#/patchset/20260627202243.758289-1-gourry%40gourry.net Acked-by: David Hildenbrand (Arm) <david@kernel.org> Cc: Johannes Weiner <hannes@cmpxchg.org> Cc: Mel Gorman <mgorman@techsingularity.net> Cc: Mike Rapoport <rppt@kernel.org> Cc: Oscar Salvador <osalvador@suse.de> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-07-30mm: fix ASSERT_EXCLUSIVE_BITS by passing memdesc_flags_t by pointerHui Zhu
KCSAN reports a data race between page_to_nid()/folio_pgdat() reading page->flags and folio_trylock()/folio_lock() concurrently doing test_and_set_bit_lock(PG_locked, ...) on the same word, e.g.: BUG: KCSAN: data-race in __lruvec_stat_mod_folio / shmem_get_folio_gfp The race is benign: nid/zone bits are set once at page init and never overlap with PG_locked. However, ASSERT_EXCLUSIVE_BITS() inside memdesc_nid/zonenum() was checking a by-value copy of the flags word, not the live page->flags, so it failed to annotate the real access. Change memdesc_nid(), memdesc_zonenum(), memdesc_section(), and memdesc_is_zone_device() to take a const memdesc_flags_t * and update all callers to pass &page->flags / &folio->flags, so ASSERT_EXCLUSIVE_BITS() operates on the actual shared word. Guard the ASSERT_EXCLUSIVE_BITS() call in memdesc_zonenum() under ZONES_WIDTH != 0 to avoid a zero-mask check on configs where the zone field is absent. memdesc_section() needs no such guard, since SECTIONS_WIDTH is never 0 wherever SECTION_IN_PAGE_FLAGS is defined. Under CONFIG_NUMA=n, memdesc_nid() itself is stubbed to "return 0" instead of reading page->flags, since NODES_MASK is 0 and the check can never fire; page_to_nid()/folio_nid() now just call memdesc_nid() unconditionally and rely on that stub, instead of duplicating the CONFIG_NUMA split at each call site. [zhuhui@kylinos.cn: v11] Link: https://lore.kernel.org/20260708083308.747930-1-hui.zhu@linux.dev [ziy@nvidia.com: build fix] Link: https://lore.kernel.org/DJSGLP9VFLRI.355AAWR2VHIEL@nvidia.com Link: https://lore.kernel.org/20260630070810.470763-1-hui.zhu@linux.dev Signed-off-by: Hui Zhu <zhuhui@kylinos.cn> Co-developed-by: David Hildenbrand (Arm) <david@kernel.org> Signed-off-by: David Hildenbrand (Arm) <david@kernel.org> Acked-by: David Hildenbrand (Arm) <david@kernel.org> Cc: Axel Rasmussen <axelrasmussen@google.com> Cc: Barry Song <baohua@kernel.org> Cc: Kairui Song <kasong@tencent.com> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Shakeel Butt <shakeel.butt@linux.dev> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Cc: Wei Xu <weixugc@google.com> Cc: Yuanchu Xie <yuanchu@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-07-30mm/vmpressure: move v1 userspace eventfd code into memcontrol-v1.cUsama Arif
Clean up mm/vmpressure.c by separating the cgroup v1 userspace eventfd interface from the shared and v2 in-kernel code. Currently, almost half of mm/vmpressure.c exists to serve tree=true: struct vmpressure_event, the events list and its mutex, the work_struct and vmpressure_work_fn that drains tree_scanned/tree_reclaimed, the parent walk, vmpressure_event(), vmpressure_register_event(), vmpressure_unregister_event(), and vmpressure_prio() (which always calls vmpressure() with tree=true). Move it all into mm/memcontrol-v1.c (built only when CONFIG_MEMCG_V1=y) as a single contiguous block, following the per-component layout already used by that file. Keeping the v1 vmpressure code with the rest of the deprecated cgroup v1 memory controller makes the full footprint of the CONFIG_MEMCG_V1 option easy to see in one place, which matters more than component-level file separation for code that has no active development. vmpressure.c keeps the shared bits (constants, vmpressure_calc_level, the runtime hierarchy check, the tree=false body, init/cleanup plumbing) and calls into three small v1 hooks for the tree=true accumulator and the v1 portions of init/cleanup. The hooks have static-inline no-op stubs in include/linux/vmpressure.h for the !MEMCG_V1 case, so callers don't need ifdefs. vmpressure_prio() gets the same treatment, which means vmscan.c's call site disappears at compile time on v2-only kernels. The only #ifdef CONFIG_MEMCG_V1 in source remains around the v1-only fields inside struct vmpressure itself. Memory savings on CONFIG_MEMCG_V1=n (measured with pahole): struct vmpressure : 112B -> 24B struct mem_cgroup : 1664B -> 1536B This split is the first step toward eventually making vmpressure CONFIG_MEMCG_V1 only. The v2 in-kernel socket pressure path (tree=false) cannot be removed today immediately: PSI is not an exact replacement for vmpressure, and switching networking socket-buffer back-off to PSI may regress networking performance or increase memory pressure in workloads that today rely on vmpressure's hysteresis. The medium-term plan is to introduce a PSI-based socket-pressure path, keep vmpressure available for v2 behind a defconfig as an opt-out for several releases, and only then drop the tree=false path entirely, at which point everything that remains of the vmpressure block in mm/memcontrol-v1.c is the whole subsystem. Link: https://lore.kernel.org/20260630112617.1198623-3-usama.arif@linux.dev Signed-off-by: Usama Arif <usama.arif@linux.dev> Acked-by: Shakeel Butt <shakeel.butt@linux.dev> Cc: David Hildenbrand <david@kernel.org> Cc: Johannes Weiner <hannes@cmpxchg.org> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Michal Koutný <mkoutny@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Roman Gushchin <roman.gushchin@linux.dev> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Tejun Heo <tj@kernel.org> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-07-30mm: rename ARCH_ENABLE_THP_MIGRATION to ARCH_HAS_PMD_SOFTLEAVESUsama Arif
CONFIG_ARCH_ENABLE_THP_MIGRATION gates PMD-level migration entries. PMD-level device-private entries use the same migration mechanism and therefore require the same architecture support. Upcoming PMD-level swap entries can use the same PMD softleaf helpers without depending on page migration, so rename the architecture gate to CONFIG_ARCH_HAS_PMD_SOFTLEAVES. This describes the PMD entry capability rather than one current user of it. This is a pure rename: the set of selecting architectures (x86, arm64, s390, riscv, loongarch, and powerpc on PPC_BOOK3S_64) and the gating semantics are unchanged. No functional change intended. Link: https://lore.kernel.org/20260706114320.1643046-7-usama.arif@linux.dev Signed-off-by: Usama Arif <usama.arif@linux.dev> Reviewed-by: Zi Yan <ziy@nvidia.com> Acked-by: David Hildenbrand (Arm) <david@kernel.org> Cc: Alexandre Ghiti <alex@ghiti.fr> Cc: Baolin Wang <baolin.wang@linux.alibaba.com> Cc: Baoquan He <baoquan.he@linux.dev> Cc: Barry Song <baohua@kernel.org> Cc: Chris Li <chrisl@kernel.org> Cc: Dev Jain <dev.jain@arm.com> Cc: "Huang, Ying" <ying.huang@linux.alibaba.com> Cc: Johannes Weiner <hannes@cmpxchg.org> Cc: Kairui Song <kasong@tencent.com> Cc: Kemeng Shi <shikemeng@huaweicloud.com> Cc: Kiryl Shutsemau <kas@kernel.org> Cc: Lance Yang <lance.yang@linux.dev> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Matthew Wilcox (Oracle) <willy@infradead.org> Cc: Nhat Pham <nphamcs@gmail.com> Cc: Nico Pache <npache@redhat.com> Cc: Rik van Riel <riel@surriel.com> Cc: Ryan Roberts <ryan.roberts@arm.com> Cc: Shakeel Butt <shakeel.butt@linux.dev> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-07-30mm: add softleaf_to_pmd() and convert existing callersUsama Arif
Patch series "mm: preparatory patches for PMD level swap entries", v2. This is the preparatory part of the PMD page table swapin work. The full PMD swap entry series has been split into two parts: 1. this preparatory series, which contains the first 6 patches. Zi [1] and Lance [2] suggested to separate this out from the core series. 2. the PMD swap entry core series, which depends on this one. I will send this once the preparatory series is merged in mm-new as v3 as the combined is currently at v2 [1]. I have not marked this prep series as v3, as its not really adding support for PMD swap entries. This series does not introduce PMD swap entries and does not install any new page-table entry type. It only cleans up existing PMD softleaf helpers and call sites so the follow-up PMD swap entry series can be smaller and easier to review. It should be safe to merge independently. The patches are either helper additions, refactors of existing open-coded logic, defensive checks that preserve current migration/device-private behavior, or a mechanical rename of the PMD softleaf Kconfig gate. The follow-up series depends on these helpers, but this series does not depend on the follow-up series. Patch breakdown: 1. mm: add softleaf_to_pmd() and convert existing callers Add the PMD counterpart to softleaf_to_pte() and convert existing swp_entry_to_pmd() users that are constructing PMD softleaf entries. 2. mm: extract mm_prepare_for_swap_entries() helper Hoist the "register mm with swapoff" double-checked-locking pattern out of try_to_unmap_one() and copy_nonpresent_pte() so future PMD-level users do not need another open-coded copy. 3. fs/proc: use softleaf_has_pfn() in pagemap PMD walker Avoid assuming every non-present PMD softleaf entry encodes a PFN. Existing migration/device-private behavior is preserved. 4. mm/huge_memory: move softleaf_to_folio() inside migration branch Keep the folio lookup in change_non_present_huge_pmd() scoped to the migration-entry branch that actually needs it. 5. mm/migrate_device: move softleaf_to_folio() inside device-private branch Apply the same ordering cleanup to migrate_vma_collect_pmd(): only derive a folio after confirming the PMD entry is device-private. 6. mm: rename ARCH_ENABLE_THP_MIGRATION to ARCH_HAS_PMD_SOFTLEAVES Rename the architecture gate to describe what it actually enables: PMD softleaf entries. Migration remains the only current user in this series; the follow-up series adds PMD swap entries. This patch (of 6): Add softleaf_to_pmd() as the PMD counterpart to softleaf_to_pte(), completing the symmetry of the softleaf abstraction for page table leaf entries. The upcoming PMD swap entry support needs to construct PMD entries from swap entries. Converting existing swp_entry_to_pmd() callers to softleaf_to_pmd() in a prep patch keeps the feature patches focused on new functionality rather than mixing refactoring with new code. Link: https://lore.kernel.org/20260706114320.1643046-1-usama.arif@linux.dev Link: https://lore.kernel.org/20260706114320.1643046-2-usama.arif@linux.dev Link: https://lore.kernel.org/all/6E99CC4E-A026-4DE3-8A5A-34216771F521@nvidia.com/ [1] Link: https://lore.kernel.org/all/b08cafbb-a4b7-4609-84ae-dbb2cfcfc8be@linux.dev/#t [2] Link: https://lore.kernel.org/all/20260602142537.198755-1-usama.arif@linux.dev/ [3] Signed-off-by: Usama Arif <usama.arif@linux.dev> Acked-by: David Hildenbrand (Arm) <david@kernel.org> Reviewed-by: Zi Yan <ziy@nvidia.com> Reviewed-by: Lance Yang <lance.yang@linux.dev> Cc: Alexandre Ghiti <alex@ghiti.fr> Cc: Baolin Wang <baolin.wang@linux.alibaba.com> Cc: Baoquan He <baoquan.he@linux.dev> Cc: Barry Song <baohua@kernel.org> Cc: Chris Li <chrisl@kernel.org> Cc: Dev Jain <dev.jain@arm.com> Cc: "Huang, Ying" <ying.huang@linux.alibaba.com> Cc: Johannes Weiner <hannes@cmpxchg.org> Cc: Kairui Song <kasong@tencent.com> Cc: Kemeng Shi <shikemeng@huaweicloud.com> Cc: Kiryl Shutsemau <kas@kernel.org> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Matthew Wilcox (Oracle) <willy@infradead.org> Cc: Nhat Pham <nphamcs@gmail.com> Cc: Nico Pache <npache@redhat.com> Cc: Rik van Riel <riel@surriel.com> Cc: Ryan Roberts <ryan.roberts@arm.com> Cc: Shakeel Butt <shakeel.butt@linux.dev> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-07-30net: mctp: usblib: Implement transmit-side packet spanningJeremy Kerr
Add support for packet spanning as defined in DSP0283 v1.1. With the existing v1.0 implementation of multi-packet transfers, all we need here is to adjust the buffer sizes to suit v1.1. Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au> Link: https://patch.msgid.link/20260724-dev-mctp-usb-1-1-v5-9-e66bbba0dbdc@codeconstruct.com.au Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-30net: mctp: usblib: Implement receive-side packet spanningJeremy Kerr
Using the existing prepare/complete API, we can persist the rx skb across receives to implement v1.1 packet spanning. Alter the packet-extraction loop to allow truncated packets, returning early with the skb persisted for the next IN urb completion. When we see we have a complete packet, netif_rx() that. If the packet boundary aligns with the urb completion, we can netif_rx() the whole thing. Those intermediate packets are cloned from the original (large-transfer-data) skb. Unlike existing behaviour, if the clone fails, we drop just that clone, instead of the existing transfer skb. This allows us to process the rest of the skb data, and any continuation of the span into the next transfer. One subtle change: the mctp_usblib_rx() helper now handles skbs with the full transport header, so we shift the skb_pull() for the header data to the helper, before doing the rx_bytes stats update. We still need to handle non-spanning mode, so error out on truncated-packet cases there. Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au> Link: https://patch.msgid.link/20260724-dev-mctp-usb-1-1-v5-8-e66bbba0dbdc@codeconstruct.com.au Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-30net: mctp: usb: Accommodate DSP0283 v1.1 header formatJeremy Kerr
In the v1.1 update to DSP0283, we have a larger header field, of 13 bits rather than 8. In order to accommodate this, in preparation for proper v1.1 support, expand our struct mctp_usb_hdr's len field to a u16, and endian-convert when necessary. Because we don't yet support spanning mode, we will never receive or transmit with the top 5 bits set, so we always mask out anyway. This allows for a future change where we allow spanning mode with >512-byte transfers. Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au> Link: https://patch.msgid.link/20260724-dev-mctp-usb-1-1-v5-7-e66bbba0dbdc@codeconstruct.com.au Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-30net: mctp: usblib: Add support for multi-packet transmitJeremy Kerr
The MCTP over USB spec allows us to pack multiple packets in one transfer. Given the packet max length is 255, and the transfer max length is 512, we can typically include two full-size packets per urb submission. To do this, we allow a struct mctp_usb_tx to persist a tx_ctx, representing the ongoing context for a transmit. If possible, a TX skb will be queued to the context and the send deferred until the context is full, or the device queue reports no more packets. This typically requires a linear buffer for the 512-byte TX, which we allocate along with the TX context. Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au> Link: https://patch.msgid.link/20260724-dev-mctp-usb-1-1-v5-6-e66bbba0dbdc@codeconstruct.com.au Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-30net: mctp: usblib: Move TX transfer processing to mctp-usblibJeremy Kerr
With the RX processing in mctp-usblib, add TX processing alongside. To accommodate packed transfers in DSP0283, where a transfer may contain multiple MCTP packets, we move to a split process for the transmit API: * push: create a new transmit context, and add a skb to it. * send: callback to the driver implementation to send the (possibly multi-packet) USB transfer * complete: update skb accounting and release the tx context The actual multi-packet transfer implementation will be added in the next change; no tx context persists beyond the single send at present. However, we use an anchor in the host driver implementation to track the submitted TX urb when necessary. While we're here, fix an inconsistency between tx and rx stats: both should not include the transport header. Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au> Link: https://patch.msgid.link/20260724-dev-mctp-usb-1-1-v5-5-e66bbba0dbdc@codeconstruct.com.au Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-30net: mctp: usblib: Move RX transfer processing to a new mctp-usblibJeremy Kerr
The processing of USB receive transfers is common to both sides of a MCTP over USB transport. In order to support a future gadget driver, move the current host-side driver into a new common file, mctp-usblib. This currently handles the submit-complete-packetise process of the receive path of the USB transport. We'll add transmit handling in an upcoming change. Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au> Link: https://patch.msgid.link/20260724-dev-mctp-usb-1-1-v5-3-e66bbba0dbdc@codeconstruct.com.au Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-30net: mctp: usb: Use packet-length max for maximum packet-size checkJeremy Kerr
The max packet size is smaller than the max transfer size, as we only have a u8 length field in the transport header. Add a define for the maximum representable length, and use that for our check. Use this for the MTU maximum calculation too. Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au> Link: https://patch.msgid.link/20260724-dev-mctp-usb-1-1-v5-2-e66bbba0dbdc@codeconstruct.com.au Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-30net: mctp: usb: Include version indicator in max packet size definesJeremy Kerr
DSP0283 v1.1.0 will introduce larger maximum packet sizes. In preparation, indicate that the current maxima are specific to v1.0.x. Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au> Link: https://patch.msgid.link/20260724-dev-mctp-usb-1-1-v5-1-e66bbba0dbdc@codeconstruct.com.au Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-30vxlan: honor per-nexthop fdb destination portJack Ma
When an fdb entry points at a nexthop group, vxlan_fdb_nh_path_select() resolves the selected leg's remote IP but leaves the UDP destination port at the device default (vxlan->cfg.dst_port). Extend nexthop_path_fdb_result() to also return the selected nexthop's NHA_DST_PORT (0 when unset) and have vxlan_fdb_nh_path_select() store it in rdst->remote_port. vxlan_xmit_one() already prefers rdst->remote_port when non-zero and falls back to the device port otherwise, so nexthops without a port are unaffected. This lets one fdb nexthop group load-balance a flow across legs that share an underlay IP but differ in UDP destination port. Signed-off-by: Jack Ma <jack4it@gmail.com> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Reviewed-by: David Ahern <dsahern@kernel.org> Link: https://patch.msgid.link/20260724-b4-vxlan-fdb-port-v5-2-cd1c6aeee058@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-30net: nexthop: add NHA_DST_PORT for fdb nexthopsJack Ma
Commit 1274e1cc4226 ("vxlan: ecmp support for mac fdb entries") lets a single inner MAC be reached through a group of remote VTEPs, with the kernel flow-hashing across the group members. Each member carries its own remote IP, but the UDP destination port is always taken from the VXLAN device (vxlan->cfg.dst_port) and cannot be set per member. Some deployments pack several receivers behind one underlay IP and tell them apart by UDP port, so they need a per-nexthop destination port to spread flows across (IP, port) tuples rather than IP alone. Add a netlink attribute NHA_DST_PORT (__be16, mirroring NDA_PORT) that carries an optional UDP destination port on an fdb nexthop. It is only accepted together with NHA_FDB and NHA_GATEWAY; it is stored in struct nh_info and echoed back on dump. The attribute is named generically rather than fdb-specific so it can be reused should another nexthop type ever need a destination port. This patch is control-plane plumbing only; the VXLAN datapath is wired up in a follow-up patch, so behaviour is unchanged for now. Signed-off-by: Jack Ma <jack4it@gmail.com> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Reviewed-by: David Ahern <dsahern@kernel.org> Link: https://patch.msgid.link/20260724-b4-vxlan-fdb-port-v5-1-cd1c6aeee058@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-30libnvdimm: nd.h: clean up kernel-doc warningsRandy Dunlap
Add missing struct member, function parameters, and function return values to eliminate all kernel-doc warnings: Warning: include/linux/nd.h:124 struct member 'common' not described in 'nd_namespace_io' Warning: include/linux/nd.h:124 Excess struct member 'dev' description in 'nd_namespace_io' Warning: include/linux/nd.h:166 function parameter 'flags' not described in 'nvdimm_read_bytes' Warning: include/linux/nd.h:166 No description found for return value of 'nvdimm_read_bytes' Warning: include/linux/nd.h:185 function parameter 'flags' not described in 'nvdimm_write_bytes' Warning: include/linux/nd.h:185 No description found for return value of 'nvdimm_write_bytes' Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Reviewed-by: Dave Jiang <dave.jiang@intel.com> Link: https://patch.msgid.link/20260721172132.3718892-1-rdunlap@infradead.org Signed-off-by: Alison Schofield <alison.schofield@intel.com>
2026-07-30ASoC: SOF: ipc4: Add decoder for RESOURCE_EVENT notifications from firmwarePeter Ujfalusi
Decode and print out the content of currently supported RESOURCE_EVENT notifications from firmware along with the needed data structures and definitions. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com> Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com> Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com> Link: https://patch.msgid.link/20260730082444.4828-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-30Merge tag 'for-linus-iommufd' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd Pull iommufd fixes from Jason Gunthorpe: "Several bug fixes found by tools and fuzzing: - Incorrect domain passed during replace to ack faults - Block the access API from using dmabuf - Missing unlock on error unwind - Race seeing a partially setup vdevice in the xarray - Do not allow vdevices to have multiple stream ids in SMMUv3 - Possible UAF if racing faults with domain changes" * tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd: iommu/iommufd: Fix IOPF group ownership UAF iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE iommufd/viommu: Publish a vDEVICE only after vdevice_init() succeeds iommufd/viommu: Release the igroup lock on the vdevice_size error path iommufd: Reject DMABUF pages from the access pin path iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace
2026-07-30soc: qcom: smem: Expose DDR data from SMEMKonrad Dybcio
Most modern Qualcomm platforms (>= SM8150) expose information about the DDR memory present on the system via SMEM. Details from this information is used in various scenarios, such as multimedia drivers configuring the hardware based on the "Highest Bank address Bit" (hbb), or the list of valid frequencies in validation scenarios... Add support for parsing v3-v7 version of the structs. Unforunately, they are not versioned, so some elbow grease is necessary to determine which one is present. See for reference: ver 3: https://git.codelinaro.org/clo/la/abl/tianocore/edk2/-/commit/1d11897d2cfcc7b85f28ff74c445018dbbecac7a ver 4: https://git.codelinaro.org/clo/la/abl/tianocore/edk2/-/commit/f6e9aa549260bbc0bdcb156c2b05f48dc5963203 ver 5: https://git.codelinaro.org/clo/la/abl/tianocore/edk2/-/commit/617d3297abe8b1b8dd3de3d1dd69c3961e6f343f ver 5 with 6regions: https://git.codelinaro.org/clo/la/abl/tianocore/edk2/-/commit/d770e009f9bae58d56d926f7490bbfb45af8341f ver 6: https://git.codelinaro.org/clo/la/abl/tianocore/edk2/-/commit/62659b557fdb1551b20fae8073d1d701dfa8a62e ver 7: https://git.codelinaro.org/clo/la/abl/tianocore/edk2/-/commit/734d95599c5ebb1ca0d4e1639142e65c590532b7 Reviewed-by: Bjorn Andersson <andersson@kernel.org> Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://git.codelinaro.org/clo/la/abl/tianocore/edk2/-/commit/1d11897d2cfcc7b85f28ff74c445018dbbecac7a Link: https://lore.kernel.org/r/20260727-topic-smem_dramc-v5-2-66188b3e338d@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-30dt-bindings: clock: qcom: Add Maili global clock controllerTaniya Das
Add device tree bindings for the global clock controller (GCC) on the Qualcomm Maili SoC by extending the existing Qualcomm Hawi GCC bindings, since the Maili GCC is identical to the Hawi GCC apart from a few additional clocks. Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Taniya Das <taniya.das@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260730-maili_initial_clock-v4-3-ed52ade264f0@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-30dt-bindings: clock: qcom: gcc-mdm9607: Drop SYSTEM_NOC_BFDCD_CLK_SRCStephan Gerhold
This clock does not exist in the hardware, it has no consumers and reading/writing to the registers fails. Drop it from the bindings. Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Stephan Gerhold <stephan@gerhold.net> Link: https://lore.kernel.org/r/20260706-qcom-clk-mdm9607-fixes-v2-9-745565101869@linaro.org Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-30soc: qcom: geni-se: Use HW PROG_RAM_DEPTH to validate firmware sizeViken Dadhaniya
The hardcoded MAX_GENI_CFG_RAMn_CNT limit is not accurate for all SoCs: some targets have less CFG RAM than the constant implies, while others like QCS615 need more entries than the old limit of 455 allowed, causing valid firmware to be rejected at load time. Rather than hardcoding a constant, read PROG_RAM_DEPTH from SE_HW_PARAM_2 at runtime to get the actual CFG RAM depth of the hardware instance and use that as the upper bound for firmware size validation. Fixes: d4bf06592ad6 ("soc: qcom: geni-se: Add support to load QUP SE Firmware via Linux subsystem") Cc: stable@vger.kernel.org Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260702-qup-se-increase-ram-cnt-v3-1-80b363373a5b@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-30rust: driver: remove open-coded matching logicGary Guo
With device ID info now including pointers instead of indices, the open-coded ACPI/OF matching is no longer needed and can be replaced with `device_get_match_data`. With the removal of open-coded matching, the exposed functions and helpers are also removed; this effectively reverts most of commit 2690d071584e ("rust: ACPI: fix missing match data for PRP0001"). Signed-off-by: Gary Guo <gary@garyguo.net> Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Link: https://patch.msgid.link/20260629-id_info-v2-9-56fccbe9c5ef@garyguo.net [ Consider the serdev code merged in the meantime. - Danilo ] Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-07-30Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski
Cross-merge networking fixes after downstream PR (net-7.2-rc6). No conflicts. Adjacent changes: net/ipv4/route.c dbc3791e3b24 ("net: do not send ICMP/NDISC Redirects when peer allocation fails") 7804eaa057fe ("ipv4: snapshot dst.dev in ip_rt_send_redirect() and ip_rt_get_source()") drivers/net/tun.c 23dad2d088df ("tun: no longer rely on RTNL in tun_fill_info()") c3da92af07ea ("Revert "tun/tap: add ptr_ring consume helper with netdev queue wakeup"") drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c 3bd438a58e91 ("octeontx2-af: Block VFs from clobbering special CGX PKIND state") 5ba5611ef946 ("octeontx2-af: reserve 4 PKINDs for skip-size custom use") drivers/net/wireless/ath/ath12k/core.h drivers/net/wireless/ath/ath12k/mac.c drivers/net/wireless/ath/ath12k/peer.c 469d7e6077c1 ("wifi: ath12k: resolve PENDING ML peer ID from MLO_PEER_MAP HTT event") 378e659029d5 ("wifi: ath12k: introduce host_alloc_ml_id hardware parameter") c42b27336eef ("wifi: ath12k: fix survey indexing across bands") Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-30Merge tag 'pm-7.2-rc6' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These fix issues related to cpufreq, in the ACPI CPPC library and the generic CPPC cpufreq driver, in the powernow-k8 and amd-pstate drivers, and in the schedutil governor: - Allow fast frequency switching in the ACPI CPPC library only when every supported control used by the driver callback has an address space already accepted for fast access (Christian Loehle) - Skip writes to unsupported performance controls in the ACPI CPPC library (Christian Loehle) - Update cppc_cpufreq_update_perf_limits() to read policy->min and policy->max once and, if the lockless snapshot is inconsistent, reduce the minimum to the observed maximum, along the lines of cpufreq_driver_resolve_freq() (Christian Loehle) - Fix a possible memory leak in the powernowk8_cpu_init() error paths (Abdun Nihaal) - Loosen the requirement on lowest nonlinear frequency != min freq in the amd-pstate driver that is too tight for new systems some of which actually have the lowest nonlinear frequency identical to the minimum frequency (Mario Limonciello) - Prevent amd-pstate from loading on unsupported hardware (Rong Zhang) - Address an initialization race in the schedutil governor when it runs on multi-CPU cpufreq policies, by making it initialize all per-CPU structures first and only then publish the per-CPU utilization update hooks (Zhongqiu Han)" * tag 'pm-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() ACPI: CPPC: Skip writes to unsupported performance controls cpufreq/amd-pstate: Prevent the driver from loading on unsupported hardware cpufreq/amd-pstate: Loosen requirement on lowest nonlinear frequency != min freq cpufreq: schedutil: Publish util hooks only after all sg_cpu are initialized cpufreq: cppc: Sanitize lockless policy limit snapshots ACPI: CPPC: Check all controls for fast switching
2026-07-30media: rppx1: lin: Add support for gamma sensor linearizationJai Luthra
Extend the RPPX1 driver to allow setting the gamma sensor linearization configuration parameters. It uses the RPPX1 framework for parameters and its writer abstraction to allow the user to control how, and when, configuration is applied to the RPPX1. Signed-off-by: Jai Luthra <jai.luthra@ideasonboard.com> Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-30media: rppx1: ga: Add support for gamma out correctionNiklas Söderlund
Extend the RPPX1 driver to allow setting the gamma out correction configuration parameters. It uses the RPPX1 framework for parameters and its writer abstraction to allow the user to control how, and when, configuration is applied to the RPPX1. Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Co-developed-by: Jai Luthra <jai.luthra+renesas@ideasonboard.com> Signed-off-by: Jai Luthra <jai.luthra+renesas@ideasonboard.com> Co-developed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com> Signed-off-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com> Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-30media: rppx1: lsc: Add support for lens shade correctionNiklas Söderlund
Extend the RPPX1 driver to allow setting the lens shade correction configuration parameters. It uses the RPPX1 framework for parameters and its writer abstraction to allow the user to control how, and when, configuration is applied to the RPPX1. Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Co-developed-by: Jai Luthra <jai.luthra+renesas@ideasonboard.com> Signed-off-by: Jai Luthra <jai.luthra+renesas@ideasonboard.com> Co-developed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com> Signed-off-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com> Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-30media: rppx1: ccor: Add support for color correction matrixNiklas Söderlund
Extend the RPPX1 driver to allow setting the color correction matrix configuration parameters. It uses the RPPX1 framework for parameters and its writer abstraction to allow the user to control how, and when, configuration is applied to the RPPX1. Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Co-developed-by: Jai Luthra <jai.luthra+renesas@ideasonboard.com> Signed-off-by: Jai Luthra <jai.luthra+renesas@ideasonboard.com> Co-developed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com> Signed-off-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-30media: rppx1: bls: Add support for black level compensationNiklas Söderlund
Extend the RPPX1 driver to allow setting the black level measurement and gain configuration. It uses the RPPX1 framework for parameters and its writer abstraction to allow the user to control how, and when, configuration is applied to the RPPX1. Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Co-developed-by: Jai Luthra <jai.luthra+renesas@ideasonboard.com> Signed-off-by: Jai Luthra <jai.luthra+renesas@ideasonboard.com> Co-developed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com> Signed-off-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-30media: rppx1: hist: Add support histogram measurementNiklas Söderlund
Extend the RPPX1 driver to allow setting the histogram measurement configuration and consuming the resulting statistics. It uses the RPPX1 framework for parameters and its writer abstraction to allow the user to control how, and when, configuration is applied to the RPPX1. Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Co-developed-by: Jai Luthra <jai.luthra+renesas@ideasonboard.com> Signed-off-by: Jai Luthra <jai.luthra+renesas@ideasonboard.com> Co-developed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com> Signed-off-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com> Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-30media: rppx1: exm: Add support for exposure measurementNiklas Söderlund
Extend the RPPX1 driver to allow setting the exposure measurement configuration and consuming the resulting statistics. It uses the RPPX1 framework for parameters and its writer abstraction to allow the user to control how, and when, configuration is applied to the RPPX1. Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Co-developed-by: Jai Luthra <jai.luthra+renesas@ideasonboard.com> Signed-off-by: Jai Luthra <jai.luthra+renesas@ideasonboard.com> Co-developed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com> Signed-off-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com> Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-30media: rppx1: awbg: Add support for white balance gain settingsNiklas Söderlund
Extend the RPPX1 driver to allow setting the white balance gain configuration parameters. It uses the RPPX1 framework for parameters and its writer abstraction to allow the user to control how, and when, configuration is applied to the RPPX1. Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Co-developed-by: Jai Luthra <jai.luthra+renesas@ideasonboard.com> Signed-off-by: Jai Luthra <jai.luthra+renesas@ideasonboard.com> Co-developed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com> Signed-off-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com> Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-30media: rppx1: wbmeas: Add support for white balance measurementNiklas Söderlund
Extend the RPPX1 driver to allow setting the white balance measurement configuration and consuming the resulting statistics. It uses the RPPX1 framework for parameters and its writer abstraction to allow the user to control how, and when, configuration is applied to the RPPX1. Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Co-developed-by: Jai Luthra <jai.luthra+renesas@ideasonboard.com> Signed-off-by: Jai Luthra <jai.luthra+renesas@ideasonboard.com> Co-developed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com> Signed-off-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com> Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-30media: rppx1: Add framework to support Dreamchip RPPX1 ISPNiklas Söderlund
Add a framework driver for Dreamchip RPPX1 ISP. The driver aims to provide a framework for other V4L2 based drivers to drive the RPPX1 functionality. The reason for this split is that the RPPX1 IP itself do not provide any DMA engines to drive data to/from the device, instead it depends on other IP blocks to implement these features. While the peripherals around the RPPX1 ISP used in different designs and by different vendors are different the RPPX1 core itself is the same. For this reason the framework solution to be able to split the Dreamchip RPPX1 driver from vendors usage of it have been picked in hope to reduce duplication of the common parts. The design is to try and keep the surface of this framework as small as possible. The intention of this change is to be able to fill all needs of this. * Two functions to create and destroy a RPPX1 instance, rppx1_create() and rppx1_destory(). These are intended to be called in the users probe and remove code paths. * Two functions to start and stop the RPPX1 processing, rppx1_start() and rppx1_stop(). These are intended to be called in the users stream on and stream off code paths. * One function to ask the RPPX1 to process parameters buffer prepared by user space, rppx1_params(). The intention is to call this function when the parameter buffer is queued to the V4L2 driver and the result stored by the driver until the time it needs to be written to the RPPX1. It's the users responsibility to write it either using MMIO or other means. * One function to fill in a statistic buffer based on the current status of the RPPX1, rppx1_stats_fill_isr(). The intention is that the user call's this in its interrupt handler when it knows the RPPX1 is done processing a frame. * One function to ack and retrieve the interrupts generated by the RPPX1, rppx1_interrupt(). The intention is to call this function when the users interrupt handler detects the RPPX1 have raised and interrupt. There is no need for the user to understand, or act, on the actual RPPX1 interrupt, but it can if it wants too. The initial support in the framework is limited and do not implement any ISP processing algorithms other then configuring the RPPX1 to process any Bayer (8-, 10, or 12-bit) image and produce either a RGB or YUYV output. It do however probe all function blocks of the RPPX1 and provide an interface to interact with both parameter and statistic bufferers. The user of the framework will not change as algorithms for the different function blocks of the ISP are being added. Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Co-developed-by: Jai Luthra <jai.luthra+renesas@ideasonboard.com> Signed-off-by: Jai Luthra <jai.luthra+renesas@ideasonboard.com> Co-developed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com> Signed-off-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com> Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-30media: uapi: Add extensible param and stats blocks for RPPX1Jai Luthra
Add the scaffolding for the parameters and statistics buffers for Dreamchip RPPX1. The parameters for each ISP function block will be added together with the logic for it. In addition to the scaffolding add a common struct that describes the measurement window. This struct is not specific to any block and will used by many of them. Signed-off-by: Jai Luthra <jai.luthra@ideasonboard.com> [Niklas: Commit message] Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-30media: Add RPPX1_PARAMS and RPPX1_STATS meta formatsJai Luthra
Register V4L2 metadata fourcc codes for the Dreamchip RPP-X1 ISP parameters and statistics buffers. These formats are used by the driver to exchange ISP configuration and 3A statistics with userspace through the extensible parameters framework. Signed-off-by: Jai Luthra <jai.luthra+renesas@ideasonboard.com> Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-30media: v4l2-isp: Add helpers for stats bufferJacopo Mondi
Add two helper functions to v4l2-isp to handle statistics: - v4l2_isp_stats_init_buffer() to initialize a statistics buffer - v4l2_isp_stats_init_block() to initialize a statistics block in the next available memory location of a buffer The v4l2_isp_stats_init_buffer() resets the data size counter of the buffer and initializes its 'version' field. The v4l2_isp_stats_init_block() helper accepts the type of the stats block about to be populated, an array of per-block-type information and the maximum size of the v4l2-isp buffer. If enough space for the new block is available, the function increments the v4l2_isp_buffer.data_size counter, initializes the new stats block header and returns a pointer to the block for the driver to populate it. Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-30media: v4l2-isp: Add per-block validation callbackJacopo Mondi
Drivers are expected to provide to the helper function v4l2_isp_params_validate_buffer() a list of 'struct v4l2_isp_params_block_type_info' entries, one for each supported ISP block. The type 'struct v4l2_isp_params_block_type_info' so far only contained the expected block size for the core framework to validate the declared block size against the expected one. For some blocks, drivers might want to implement more precise per-block validations. Add a function pointer member to 'struct v4l2_isp_params_block_type_info' to allow drivers to register a callback and call it from the core framework during validation. Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-30media: v4l2-isp: Rename v4l2_isp_params_buffer_sizeJacopo Mondi
Rename v4l2_isp_params_buffer_size() to v4l2_isp_buffer_size() to support statistics. Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-30media: uapi: v4l2-isp: Add extensible statisticsAntoine Bouyer
Extend the v4l2-isp extensible format introduced for isp parameters buffers to the support buffers of ISP statistic. Like for ISP configuration purpose, that will help supporting various ISP hardware versions reporting different statistics data with less impact on userspace. Rename all 'v4l2_isp_params' types to generic 'v4l2_isp' types to prepare to use them for statistics as well and maintain the existing types for compatibility with existing userspace only. Signed-off-by: Antoine Bouyer <antoine.bouyer@nxp.com> Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> [Rework to remove 'v4l2_isp_stats' and unify types] Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-30ASoC: SDCA: export sdca_asoc_populate_rate_format() helperShuming Fan
Export populate_rate_format() as sdca_asoc_populate_rate_format() so that it can be used by codec drivers. The codec driver could get rate and format information for the IT/OT entity. Signed-off-by: Shuming Fan <shumingf@realtek.com> Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com> Link: https://patch.msgid.link/20260729032237.3750805-1-shumingf@realtek.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-30ASoC: SDCA: export sdca_find_entity_by_label() helperShuming Fan
Export the sdca_find_entity_by_label() helper so that codec drivers can locate SDCA entities by their labels. Signed-off-by: Shuming Fan <shumingf@realtek.com> Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com> Link: https://patch.msgid.link/20260729032227.3750770-1-shumingf@realtek.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-30btrfs: trigger cow fixup via dirty_folio()Boris Burkov
The problem scenario: If we have a folio mmapped shared and then somebody does a dio read with that folio as the read destination, then it is possible that the dio will see a dirty destination page when it starts (and thus skip dirtying and just GUP pin it) but then while it is doing the read, btrfs finishes writing it back and by the endio, the folio is clean. In that case, the dio read must re-dirty the folio with aops->dirty_folio(): btrfs_check_read_bio() |- __iomap_dio_bio_end_io() from btrfs_bio_end_io() |- bio_check_pages_dirty() |- bio_dirty_fn() |- bio_release_pages(bio, true) |- __bio_release_pages(bio, mark_dirty == true) |- folio_lock() |- folio_mark_dirty() |- aops->dirty_folio() |- folio_unlock() A data block normally moves through writeback as follows: TASK folio_lock write clean -> dirty bit + delalloc folio_unlock WRITEBACK for-each-dirty-folio: folio_lock run_delalloc delalloc consumed -> dirty bit + OE submission dirty bit consumed -> writeback bit + OE folio_unlock ENDIO endio OE bytes accounted OE finish writeback -> clean; destroy OE Three critical invariants that this path maintains are: I1. Any dirty block is covered by delalloc xor an ordered extent I2. Any dirty block covered by an OE will be submitted into that OE I3. Any dirty block already submitted into an OE will not be submitted again into the same OE. These ensure that the block will be written exactly once. It is clear that not reserving delalloc for the re-dirty case violates I1. This situation, even without bs < folio_size, has long required btrfs to fixup such dirty pages during writeback with an asynchronous worker that is allowed to do this expensive work and writeback does not proceed for a folio while it is doing this work. Commit 247e743cbe6e ("Btrfs: Use async helpers to deal with pages that have been improperly dirtied") introduced the COW fixup to catch exactly this class at writeback, way back in 2008. Since then, there have been many advances to prevent most of the causes of such re-dirtying and we thought we could get away with removing the annoying cow-fixup in the hope of simplifying writeback for large folio support. Commit b2a9f217ad3f ("btrfs: remove the COW fixup mechanism") Commit 4927b141877c ("btrfs: remove folio ordered flag and subpage bitmap") Since it turns out this assumption was incorrect, as evidenced by the report and attendant reproducers, we must reintroduce the fixup concept. This is of course critically further complicated by bs < folio_size. In that case, rather than just a folio dirty bit, we have a bitmap for the dirty blocks in the folio. And the (also broken) invariant is: I4. folio dirty IFF at least one block bitmap dirty. The original report of a stall on a misinterpreted empty bitmap is exactly evidence of a violation of I4. It is exactly because of bs < folio_size we don't want to simply revert the removal patches. The original fixup was not properly bs < folio_size aware, which motivated removal in the first place. So we wish to build a bs < folio_size aware fixup. One other important detail from the old design, any normal write that happens after a re-dirty but before a fixup is racing with the cow fixup to do the delalloc reservation, therefore it must cancel the fixup state. If it arrives after the reservation exists, it will be a normal dirty overwrite. This critically informs the design in a pretty clear way. fixup requiring re-dirty has folio granularity, while cancellation has delalloc (block) granularity so while we only ever produce fixup in chunks of folios, we must be able to clear it in blocks. Therefore we must track the blocks needing fixup at block granularity. The obvious way to do this is with a new bitmap in btrfs_folio_state, but it is desirable to avoid that if possible. Unfortunately, I don't think it is possible and the reason is subtle and leans on a sort of extreme reproducer, but I think can be explained relatively succinctly. Consider a folio whose two halves will land in different ordered extents (can be accomplished with tricks using nodatasum) and a dio read is running with it as the shared mmap destination. 1. The front half: a. folio comes clean on a normal write b. dio read completes into the folio marking it fixup. c. a write comes for the previous folio for a range extending into this folio, this is a cancellation of the fixup which reserves space. d. writeback runs on the range *not* overlapping the folio. This half remains dirty but is now covered by an OE and is awaiting writeback running on its range to be submitted and finish the OE. 2. The back half: a. the folio is part of an OE that gets far enough along to clear writeback. b. dio read completes into the folio marking it fixup. After this, the folio's front half is dirty in the "normal" sense, it needs to be submitted to the OE waiting for it. It's a cancelled fixup. Meanwhile, the second half is a true fresh fixup. So at this point if we run writeback on this folio, we genuinely can't know what to do without block level information. If we submit it, we submit unreserved dirty from the back half. If we don't, we will never finish the OE waiting for it. So it's either a corruption or a deadlock. Thus, the full high level design picture: - btrfs_data_dirty_folio(): For out of band non-reserving dirties, mark still-clean blocks inside EOF dirty and set their fixup bits (the event carries no range, so every clean block is suspect). Already-dirty blocks are covered or pending and are left alone. - Writeback: skip fixup blocks and enqueue work for them - writepage_fixup(): for each fixup block do the fixup reservation in a worker, after which the blocks can be written back normally. - Typical reserving write paths cancel fixup state for the ranges they cover with btrfs_folio_cancel_fixup() Link: https://lore.kernel.org/linux-btrfs/20260721191152.101118-1-borntraeger@linux.ibm.com/ Assisted-by: LLM Reviewed-by: Qu Wenruo <wqu@suse.com> Signed-off-by: Boris Burkov <boris@bur.io> Signed-off-by: David Sterba <dsterba@suse.com>
2026-07-30Merge tag 'net-7.2-rc6' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "This is again larger than usual: the backlog accumulated in the past weeks is not done yet. I'm not aware of any known pending regression. Including fixes from netfilter, Bluetooth, WiFi and CAN. Current release - regressions: - bluetooth: remove unnecessary hci_conn_get in create_conn_sync - can: isotp: fix timer drain order, wakeup handling and tx_gen ordering - eth: - tun/vhost: revert avoid ptr_ring tail-drop when a qdisc is present Previous releases - regressions: - core: do not send ICMP/NDISC Redirects when peer allocation fails - ipv6: take nexthop lock for f6i_list walks in replace check and notify - wifi: fix an ath12k MLO regression impacting WCN7850/QCC2072. - netfilter: nf_tables: make nft_object rhltable per table - af_unix: fix listen() succeeding on sockets in the wrong state - openvswitch: fix potential UAF on meter attach failure - bluetooth: - fix advertising data UAFs - avoid deadlocks in iso_sock_timeout - smc: fix socket use-after-free during link group termination - dpll: use pin owner's dpll ref for pin-level attribute reporting - eth: - veth: convert frag_list skbs before running XDP - ice: wait for reset completion in ice_resume() - igc: remove napi_synchronize() in igc_down() - vxlan: use pskb_network_may_pull() for transmit path header pulls Previous releases - always broken: - xsk: fix AF_XDP multi-buffer Tx descriptor reclaim - psp: fix NULL genl_sock deref race with concurrent netns teardown - netfilter: widen NAT rewrite delta to s32 in sip_help_tcp() - can: peak_usb: fix double free of transfer buffer on URB submit error - dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister - sctp: prevent peer transport count overflow - dsa: mt7530: error out on failed reads in MT7531 PHY polling - eth: - idpf: bound interrupt-vector register fill to the allocated array" * tag 'net-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (156 commits) qede: sync udp_tunnel ports outside qede_lock in the recovery path net: openvswitch: fix potential UAF on meter attach failure octeontx2-pf: Set correct sequence for carrier off and tx queue stop net: libwx: fix FDIR ATR queue mismatch for software VLAN packets net: dsa: realtek: use devm_mutex_init for l2_lock net: dsa: realtek: use devm_mutex_init for vlan_lock net: dsa: realtek: use devm_mutex_init for regmap lock net: dsa: realtek: rtl8365mb: use devm_mutex_init for mib_lock ptp: netc: fix potential interrupt storm caused by incorrect unbind order net: mana: Return error code from mana_create_rxq() net: openvswitch: fix skb leak on flow key update failure during ct net: openvswitch: fix skb leak on flow key update failure during recirculation net: stmmac: Fix E2E delay mechanism net: dsa: mt7530: error out on failed reads in MT7531 PHY polling net: dsa: mt7530: error out on failed reads in ATC/VTCR command polling net: dsa: mt7530: check bus->read() errors in the MDIO regmap backend Revert "tun/tap: add ptr_ring consume helper with netdev queue wakeup" Revert "vhost-net: wake queue of tun/tap after ptr_ring consume" Revert "ptr_ring: move free-space check into separate helper" Revert "tun/tap & vhost-net: avoid ptr_ring tail-drop when a qdisc is present" ...
2026-07-30serial: 8250: Switch to nbcon console, take 2John Ogness
Implement the necessary callbacks to switch the 8250 console driver to perform as an nbcon console. Add implementations for the nbcon console callbacks: ->write_atomic() ->write_thread() ->device_lock() ->device_unlock() and add CON_NBCON to the initial @flags. All hardware access in the callbacks is within unsafe sections. The ->write_atomic() and ->write_thread() callbacks allow safe handover/takeover per byte and add a preceding newline if they take over from another context mid-line. For the ->write_atomic() callback, a new irq_work is used to defer modem control since it may be called from a context that does not allow waking up tasks. During suspend/resume the irq_work is not used as this has been shown to cause suspend problems for some hardware. Upon resume, any pending modem control is performed. Note: A new __serial8250_clear_IER() is introduced for direct clearing of UART_IER during console writing (which will not be holding the port lock for atomic printing or KDB/KGDB). This allows restoring a lockdep check to serial8250_clear_IER() in a follow-up commit. Signed-off-by: John Ogness <john.ogness@linutronix.de> Link: https://patch.msgid.link/20260729120439.281252-2-john.ogness@linutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-30fwnode: add missing kernel-doc for struct fwnode_operations membersDanilo Krummrich
Document the four undocumented struct members in struct fwnode_operations: device_dma_supported, device_get_dma_attr, iomap, and irq_get. This avoids kernel-doc warnings once include/linux/fwnode.h is included in the driver-api infrastructure documentation. Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com> Reviewed-by: Randy Dunlap <rdunlap@infradead.org> Tested-by: Randy Dunlap <rdunlap@infradead.org> Link: https://patch.msgid.link/20260727202748.2232253-1-dakr@kernel.org Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-07-30mfd: ucb1x00: Register software node for GPIO controllerDmitry Torokhov
Define a static software node for the UCB1x00 GPIO controller and attach it to the core MFD device in ucb1x00_probe(). This node will also be used by the created GPIO chip. This allows machine subdrivers (such as Assabet evaluation board support) to reference the UCB1x00 GPIO controller in property entries when converting legacy platform data to software nodes, resolving pin bindings directly via the attached firmware node without relying on name matching. Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Acked-by: Arnd Bergmann <arnd@arndb.de> Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Link: https://patch.msgid.link/20260706-ucb1x00-assabet-swnode-v2-1-e6271ea3d3dc@gmail.com Signed-off-by: Lee Jones <lee@kernel.org>